From f678ea96e0f494a1afb351210c35932b217df0a4 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Mon, 3 Apr 2023 08:50:46 +0200
Subject: [PATCH 01/98] Nix shell setup

---
 spectec/.envrc     |  1 +
 spectec/.gitignore |  2 ++
 spectec/flake.lock | 26 ++++++++++++++++++++++++++
 spectec/flake.nix  | 20 ++++++++++++++++++++
 4 files changed, 49 insertions(+)
 create mode 100644 spectec/.envrc
 create mode 100644 spectec/flake.lock
 create mode 100644 spectec/flake.nix

diff --git a/spectec/.envrc b/spectec/.envrc
new file mode 100644
index 0000000000..3550a30f2d
--- /dev/null
+++ b/spectec/.envrc
@@ -0,0 +1 @@
+use flake
diff --git a/spectec/.gitignore b/spectec/.gitignore
index 96abbd1af7..d2342b15a2 100644
--- a/spectec/.gitignore
+++ b/spectec/.gitignore
@@ -1 +1,3 @@
 watsup
+
+.direnv
diff --git a/spectec/flake.lock b/spectec/flake.lock
new file mode 100644
index 0000000000..a958875734
--- /dev/null
+++ b/spectec/flake.lock
@@ -0,0 +1,26 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1680503963,
+        "narHash": "sha256-UN+DpGcuczv2DS1aR7dJ1Reci7TlY0+dvPOEs6BgHkA=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b50b1cce7a7900d1721850f61c506823e64173d6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/spectec/flake.nix b/spectec/flake.nix
new file mode 100644
index 0000000000..96baca0373
--- /dev/null
+++ b/spectec/flake.nix
@@ -0,0 +1,20 @@
+{
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs";
+
+  description = "Nix infrastructure for spectec";
+  outputs = { self, nixpkgs }:
+    let
+      system = "x86_64-linux";
+      pkgs = nixpkgs.legacyPackages.${system};
+    in {
+      devShells.${system}.default =
+        pkgs.mkShell {
+          packages = with pkgs; [
+            dune_3
+            ocamlPackages.ocaml
+            ocamlPackages.menhir
+            ocamlPackages.mdx
+          ];
+        };
+    };
+}

From c28fca59e94335cf3670d63a62af7e586a0ae7e1 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Mon, 3 Apr 2023 11:47:42 +0200
Subject: [PATCH 02/98] First stabs at Haskell stuff

---
 spectec/.gitignore                  |  1 +
 spectec/Makefile                    | 12 +++-
 spectec/flake.nix                   |  2 +
 spectec/src/backend-haskell/dune    |  5 ++
 spectec/src/backend-haskell/gen.ml  | 94 +++++++++++++++++++++++++++++
 spectec/src/backend-haskell/gen.mli |  2 +
 spectec/src/dune                    |  1 +
 spectec/src/exe-haskell/dune        |  4 ++
 spectec/src/exe-haskell/main.ml     | 72 ++++++++++++++++++++++
 9 files changed, 190 insertions(+), 3 deletions(-)
 create mode 100644 spectec/src/backend-haskell/dune
 create mode 100644 spectec/src/backend-haskell/gen.ml
 create mode 100644 spectec/src/backend-haskell/gen.mli
 create mode 100644 spectec/src/exe-haskell/dune
 create mode 100644 spectec/src/exe-haskell/main.ml

diff --git a/spectec/.gitignore b/spectec/.gitignore
index d2342b15a2..66d37780dc 100644
--- a/spectec/.gitignore
+++ b/spectec/.gitignore
@@ -1,3 +1,4 @@
 watsup
+watsup-haskell
 
 .direnv
diff --git a/spectec/Makefile b/spectec/Makefile
index 3ca2d6343f..c423692774 100644
--- a/spectec/Makefile
+++ b/spectec/Makefile
@@ -6,11 +6,13 @@ EXT = $(NAME)
 TESTDIRS = test-frontend test-latex
 
 
+DUNE_OPTS ?=
+
 # Main targets
 
 .PHONY: default all ci
 
-default: exe
+default: exe exe-haskell
 all: exe latex test
 ci: all test-frontend test-latex
 
@@ -24,8 +26,12 @@ OUTDIR = _build/default/src
 .PHONY: exe
 
 exe:
-	dune build $(SRCDIR)/$(EXE)
-	ln -f $(OUTDIR)/$(EXE) ./$(NAME)
+	dune build $(DUNE_OPTS) $(SRCDIR)/$(EXE)
+	ln -sf $(OUTDIR)/$(EXE) ./$(NAME)
+
+exe-haskell:
+	dune build $(DUNE_OPTS) $(SRCDIR)/exe-haskell/main.exe
+	ln -sf $(OUTDIR)/exe-haskell/main.exe ./$(NAME)-haskell
 
 
 # Latex
diff --git a/spectec/flake.nix b/spectec/flake.nix
index 96baca0373..3a4eb16ad2 100644
--- a/spectec/flake.nix
+++ b/spectec/flake.nix
@@ -14,6 +14,8 @@
             ocamlPackages.ocaml
             ocamlPackages.menhir
             ocamlPackages.mdx
+            ocamlPackages.merlin
+            ghc
           ];
         };
     };
diff --git a/spectec/src/backend-haskell/dune b/spectec/src/backend-haskell/dune
new file mode 100644
index 0000000000..be8ddf8467
--- /dev/null
+++ b/spectec/src/backend-haskell/dune
@@ -0,0 +1,5 @@
+(library
+  (name backend_haskell)
+  (libraries util el frontend str)
+  (modules gen)
+)
diff --git a/spectec/src/backend-haskell/gen.ml b/spectec/src/backend-haskell/gen.ml
new file mode 100644
index 0000000000..f556904207
--- /dev/null
+++ b/spectec/src/backend-haskell/gen.ml
@@ -0,0 +1,94 @@
+open Il.Ast
+
+let render_type_name (id : id) = String.capitalize_ascii id.it
+
+let make_id = String.map (function
+  | '.' -> '_'
+  | c -> c
+  )
+
+let render_con_name id : atom -> string = function
+  | Atom s ->
+    (* Lets disambiguate always, to start with 
+    if String.starts_with ~prefix:"_" s
+    then render_type_name id ^ s
+    else String.capitalize_ascii s
+    *)
+    if String.starts_with ~prefix:"_" s
+    then render_type_name id ^ make_id s
+    else render_type_name id ^ "_" ^ make_id s
+  | a -> "{- render_con_name: TODO -} " ^ Il.Print.string_of_atom a 
+
+
+let rec render_typ (ty : typ) = match ty.it with
+  | VarT id -> render_type_name id
+  | BoolT -> "Bool"
+  | NatT -> "Natural"
+  | TextT -> "String"
+  | TupT tys -> render_tuple tys
+  | IterT (ty, _) -> "[" ^ render_typ ty ^ "]"
+
+and render_tuple tys = "(" ^ String.concat ", " (List.map render_typ tys) ^ ")"
+
+
+let _unsupported_def d =
+  "{- " ^
+  Il.Print.string_of_def d ^
+  "\n-}"
+
+let rec prepend first rest = function
+  | [] -> ""
+  | (x::xs) -> first ^ x ^ prepend rest rest xs
+
+
+let render_variant_inj id1 id2 =
+  render_type_name id1 ^ "_of_" ^ render_type_name id2
+
+let render_variant_inj_case id1 id2 =
+  render_variant_inj id1 id2 ^ " " ^ render_type_name id2
+
+let render_variant_case id (case : typcase) = match case with
+  | (a, {it = TupT [];_}, _hints) -> render_con_name id a
+  | (a, ty, _hints) -> render_con_name id a ^ " " ^ render_typ ty
+
+
+let rec render_def (d : def) =
+  "{- " (*  ^ Util.Source.string_of_region d.at ^ "\n"*)  ^
+  Il.Print.string_of_def d ^
+  "\n-}\n" ^
+  match d.it with
+  | SynD (id, deftyp, _hints) ->
+    begin match deftyp.it with
+    | AliasT ty ->
+      "type " ^ render_type_name id ^ " = " ^ render_typ ty
+    | NotationT (_op, ty) ->
+      "type " ^ render_type_name id ^ " = " ^ render_typ ty
+    | VariantT (ids, cases) ->
+      "data " ^ render_type_name id ^ prepend "\n = " "\n | " (
+        List.map (render_variant_inj_case id) ids @
+        List.map (render_variant_case id) cases
+      )
+    | StructT fields ->
+      "type " ^ render_type_name id ^ " = " ^ render_tuple (
+        List.map (fun (_a, ty, _hints) -> ty) fields
+      )
+    end
+  | RecD defs ->
+    String.concat "\n" (List.map render_def defs)
+  | _ -> ""
+
+let render_script (el : script) =
+  String.concat "\n" (List.map render_def el)
+
+let gen_string (el : script) =
+  "module Test where\n" ^
+  "import Prelude (Bool, String)\n" ^
+  "import Numeric.Natural (Natural)\n" ^
+  render_script el
+
+
+let gen_file file el =
+  let haskell_code = gen_string el in
+  let oc = Out_channel.open_text file in
+  Fun.protect (fun () -> Out_channel.output_string oc haskell_code)
+    ~finally:(fun () -> Out_channel.close oc)
diff --git a/spectec/src/backend-haskell/gen.mli b/spectec/src/backend-haskell/gen.mli
new file mode 100644
index 0000000000..5df21766f4
--- /dev/null
+++ b/spectec/src/backend-haskell/gen.mli
@@ -0,0 +1,2 @@
+val gen_string : Il.Ast.script -> string
+val gen_file : string -> Il.Ast.script -> unit
diff --git a/spectec/src/dune b/spectec/src/dune
index 0eb3c22f77..0ec43c64e4 100644
--- a/spectec/src/dune
+++ b/spectec/src/dune
@@ -8,5 +8,6 @@
     (re_export frontend)
     (re_export backend_latex)
     (re_export backend_prose)
+    (re_export backend_haskell)
   )
 )
diff --git a/spectec/src/exe-haskell/dune b/spectec/src/exe-haskell/dune
new file mode 100644
index 0000000000..a9da47797c
--- /dev/null
+++ b/spectec/src/exe-haskell/dune
@@ -0,0 +1,4 @@
+(executable
+  (name main)
+  (libraries spectec)
+)
diff --git a/spectec/src/exe-haskell/main.ml b/spectec/src/exe-haskell/main.ml
new file mode 100644
index 0000000000..dc30d13318
--- /dev/null
+++ b/spectec/src/exe-haskell/main.ml
@@ -0,0 +1,72 @@
+open Util
+
+
+(* Configuration *)
+
+let name = "watsup"
+let version = "0.3"
+
+
+(* Flags and parameters *)
+
+let log = ref false  (* log execution steps *)
+let dst = ref false  (* patch files *)
+
+let srcs = ref []    (* src file arguments *)
+let dsts = ref []    (* destination file arguments *)
+let odst = ref ""    (* generation file argument *)
+
+
+(* Argument parsing *)
+
+let banner () =
+  print_endline (name ^ " " ^ version ^ " generator")
+
+let usage = "Usage: " ^ name ^ " [option] [file ...] [-p file ...]"
+
+let add_arg source =
+  let args = if !dst then dsts else srcs in args := !args @ [source]
+
+let argspec = Arg.align
+[
+  "-v", Arg.Unit banner, " Show version";
+  "-o", Arg.String (fun s -> odst := s), " Generate file";
+  "-p", Arg.Set dst, " Patch files";
+  "-l", Arg.Set log, " Log execution steps";
+  "-help", Arg.Unit ignore, "";
+  "--help", Arg.Unit ignore, "";
+]
+
+
+(* Main *)
+
+let log s = if !log then Printf.printf "== %s\n%!" s
+
+let () =
+  Printexc.record_backtrace true;
+  try
+    Arg.parse argspec add_arg usage;
+    log "Parsing...";
+    let el = List.concat_map Frontend.Parse.parse_file !srcs in
+    log "Multiplicity checking...";
+    Frontend.Multiplicity.check el;
+    log "Elaboration...";
+    let il = Frontend.Elab.elab el in
+    log "IL Validation...";
+    Il.Validation.valid il;
+    log "Haskell Generation...";
+    if !odst = "" && !dsts = [] then
+      print_endline (Backend_haskell.Gen.gen_string il);
+    if !odst <> "" then
+      Backend_haskell.Gen.gen_file !odst il;
+    log "Complete."
+  with
+  | Source.Error (at, msg) ->
+    prerr_endline (Source.string_of_region at ^ ": " ^ msg);
+    exit 1
+  | exn ->
+    flush_all ();
+    prerr_endline
+      (Sys.argv.(0) ^ ": uncaught exception " ^ Printexc.to_string exn);
+    Printexc.print_backtrace stderr;
+    exit 2

From 7208f10b95e0fc2609633dcbad0b2604ba3e8f8b Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Mon, 3 Apr 2023 11:47:51 +0200
Subject: [PATCH 03/98] IL: Keep full path of types in CaseE

---
 spectec/src/frontend/elab.ml | 47 ++++++++++++++++++++++++------------
 spectec/src/il/ast.ml        |  2 +-
 spectec/src/il/eq.ml         |  8 +++---
 spectec/src/il/free.ml       |  2 +-
 spectec/src/il/print.ml      |  8 +++---
 spectec/src/il/validation.ml | 22 ++++++++---------
 6 files changed, 53 insertions(+), 36 deletions(-)

diff --git a/spectec/src/frontend/elab.ml b/spectec/src/frontend/elab.ml
index 4213f351d2..1d9f5011b0 100644
--- a/spectec/src/frontend/elab.ml
+++ b/spectec/src/frontend/elab.ml
@@ -128,8 +128,8 @@ let find_field fields atom at =
   | None -> error_atom at atom "unbound field"
 
 let find_case cases atom at =
-  match List.find_opt (fun (atom', _, _) -> atom' = atom) cases with
-  | Some (_, x, _) -> x
+  match List.find_opt (fun ((atom', _, _), _) -> atom' = atom) cases with
+  | Some ((_, nottyp, _), styps) -> nottyp, styps
   | None -> error_atom at atom "unknown case"
 
 
@@ -202,24 +202,30 @@ let as_struct_typ phrase env dir typ at : typfield list =
   | VarT id -> as_struct_typid' phrase env id at
   | _ -> error_dir_typ at phrase dir typ "{...}"
 
-let rec as_variant_typid' phrase env id at : typcase list * dots =
+let rec as_variant_typid' phrase env id at : (typcase * Il.id list) list * dots =
   match as_defined_typid' env id at with
   | VariantT (_dots1, ids, cases, dots2) ->
-    let casess = map_nl_list (as_variant_typid "" env) ids in
-    List.concat (filter_nl cases :: List.map fst casess), dots2
+    let casess = map_nl_list (fun sid ->
+      let scases, _ = as_variant_typid "" env sid in
+      List.map (fun ((a, t, hint), ts) -> (a, t, hint), (sid :: ts)) scases
+    ) ids in
+    List.concat (
+      List.map (fun immediate_case -> (immediate_case, [])) (filter_nl cases) ::
+      casess), dots2
   | _ -> error_dir_typ id.at phrase Infer (VarT id $ id.at) "| ..."
 
-and as_variant_typid phrase env id : typcase list * dots =
+and as_variant_typid phrase env id : (typcase * Il.id list) list * dots =
   as_variant_typid' phrase env id id.at
 
-let as_variant_typ phrase env dir typ at : typcase list * dots =
+let as_variant_typ phrase env dir typ at : (typcase * Il.id list) list * dots =
   match expand_singular' env typ.it with
   | VarT id -> as_variant_typid' phrase env id at
   | _ -> error_dir_typ at phrase dir typ "| ..."
 
 let case_has_args env typ atom at : bool =
   let cases, _ = as_variant_typ "" env Check typ at in
-  find_case cases atom at <> []
+  let nottyp, _styps = find_case cases atom at
+  in nottyp <> []
 
 
 let is_x_typ as_x_typ env typ =
@@ -241,7 +247,7 @@ let is_variant_nottyp env nottyp =
   | TypT typ -> is_variant_typ env typ
   | _ -> false
 
-let as_variant_nottyp env nottyp at : typcase list * typ =
+let as_variant_nottyp env nottyp at : (typcase * Il.id list) list * typ =
   match nottyp.it with
   | TypT typ -> fst (as_variant_typ "" env Check typ at), typ
   | _ -> error_dir_typ at "expression" Check (VarT ("?" $ at) $ at) "| ..."
@@ -360,6 +366,15 @@ let rec elab_iter env iter : Il.iter =
 
 (* Types *)
 
+and elab_typ_id env typ : Il.id =
+  match typ.it with
+  | VarT id ->
+    (match find "syntax type" env.typs id with
+    | Either.Left Bad -> error_id id "invalid forward reference to syntax type"
+    | _ -> id
+    )
+  | _ -> error typ.at "expected explicit typ id"
+
 and elab_typ env typ : Il.typ =
   match typ.it with
   | VarT id ->
@@ -392,10 +407,10 @@ and elab_deftyp env id deftyp : Il.deftyp =
     Il.StructT (map_nl_list (elab_typfield env) fields)
   | VariantT (dots1, ids, cases, _dots2) ->
     let cases0 =
-      if dots1 = Dots then fst (as_variant_typid "own type" env id) else [] in
+      if dots1 = Dots then List.map fst (fst (as_variant_typid "own type" env id)) else [] in
     let casess = map_nl_list (as_variant_typid "parent type" env) ids in
-    let cases' =
-      List.flatten (cases0 :: filter_nl cases :: List.map fst casess) in
+    let cases' = List.flatten (
+      cases0 :: filter_nl cases :: List.map (List.map fst) (List.map fst casess)) in
     check_atoms "variant" "case" (fun (atom, _, _) -> atom) cases' deftyp.at;
     Il.VariantT (filter_nl ids, map_nl_list (elab_typcase env deftyp.at) cases)
   ) $ deftyp.at
@@ -843,13 +858,13 @@ and elab_exp_variant env exps cases typ at : Il.exp =
   *)
   match exps with
   | {it = AtomE atom; _} :: exps ->
-    let nottyps = find_case cases atom at in
+    let nottyps, styps = find_case cases atom at in
     (* TODO: this is a bit hacky *)
     let exp2 = SeqE exps $ at in
     let exps' = elab_exp_notation' env exp2 (SeqT nottyps $ typ.at) in
     let typ2 = expand_singular' env typ.it $ at in
     cast_exp "variant case" env
-      (Il.CaseE (elab_atom atom, tup_exp' exps' at, elab_typ env typ2) $ at)
+      (Il.CaseE (elab_atom atom, tup_exp' exps' at, elab_typ_id env typ2, styps) $ at)
       typ2 typ
   | _ ->
     error_typ at "expression" typ
@@ -907,8 +922,8 @@ and cast_exp_variant phrase env exp' typ1 typ2 : Il.exp =
     if dots1 = Dots then
       error exp'.at "used variant type is only partially defined at this point";
     (try
-      List.iter (fun (atom, nottyps1, _) ->
-        let nottyps2 = find_case cases2 atom typ1.at in
+      List.iter (fun ((atom, nottyps1, _), _) ->
+        let nottyps2, _styps = find_case cases2 atom typ1.at in
         (* Shallow subtyping on variants *)
         if List.length nottyps1 <> List.length nottyps2
         || not (List.for_all2 Eq.eq_nottyp nottyps1 nottyps2) then
diff --git a/spectec/src/il/ast.ml b/spectec/src/il/ast.ml
index 7877762047..8aa0e78e61 100644
--- a/spectec/src/il/ast.ml
+++ b/spectec/src/il/ast.ml
@@ -113,7 +113,7 @@ and exp' =
   | OptE of exp option           (* exp? : typ? *)
   | ListE of exp list            (* [exp ... exp] *)
   | CatE of exp * exp            (* exp :: exp *)
-  | CaseE of atom * exp * typ    (* atom exp : typ *)
+  | CaseE of atom * exp * id * id list  (* atom exp : typ  (via typs) *)
   | SubE of exp * typ * typ      (* exp : typ1 <: typ2 *)
 
 and expfield = atom * exp        (* atom exp *)
diff --git a/spectec/src/il/eq.ml b/spectec/src/il/eq.ml
index 153b703ecf..35f11af975 100644
--- a/spectec/src/il/eq.ml
+++ b/spectec/src/il/eq.ml
@@ -24,6 +24,8 @@ let rec eq_iter iter1 iter2 =
 
 (* Types *)
 
+and eq_id id1 id2 = id1.it = id2.it
+
 and eq_typ typ1 typ2 =
   (*
   Printf.printf "[eq] (%s) == (%s)  eq=%b\n%!"
@@ -32,7 +34,7 @@ and eq_typ typ1 typ2 =
   *)
   typ1.it = typ2.it ||
   match typ1.it, typ2.it with
-  | VarT id1, VarT id2 -> id1.it = id2.it
+  | VarT id1, VarT id2 -> eq_id id1 id2
   | TupT typs1, TupT typs2 ->
     eq_list eq_typ typs1 typs2
   | IterT (typ11, iter1), IterT (typ21, iter2) ->
@@ -79,8 +81,8 @@ and eq_exp exp1 exp2 =
     eq_exp exp11 exp21 && eq_iter iter1 iter2
   | OptE expo1, OptE expo2 ->
     eq_opt eq_exp expo1 expo2
-  | CaseE (atom1, exp1, typ1), CaseE (atom2, exp2, typ2) ->
-    atom1 = atom2 && eq_exp exp1 exp2 && eq_typ typ1 typ2
+  | CaseE (atom1, exp1, id1, styps1), CaseE (atom2, exp2, id2, styps2) ->
+    atom1 = atom2 && eq_exp exp1 exp2 && eq_id id1 id2 && eq_list eq_id styps1 styps2
   | SubE (exp1, typ11, typ12), SubE (exp2, typ21, typ22) ->
     eq_exp exp1 exp2 && eq_typ typ11 typ21 && eq_typ typ12 typ22
   | _, _ ->
diff --git a/spectec/src/il/free.ml b/spectec/src/il/free.ml
index e99b8d29fb..c3d5aeaa0e 100644
--- a/spectec/src/il/free.ml
+++ b/spectec/src/il/free.ml
@@ -93,7 +93,7 @@ and free_exp exp =
   | StrE expfields -> free_list free_expfield expfields
   | CallE (id, exp1) -> union (free_defid id) (free_exp exp1)
   | IterE (exp1, iter) -> union (free_exp exp1) (free_iter iter)
-  | CaseE (_, exp1, typ) -> union (free_exp exp1) (free_typ typ)
+  | CaseE (_, exp1, id2, styps) -> union (free_exp exp1) (free_list free_synid (id2::styps))
 
 and free_expfield (_, exp) = free_exp exp
 
diff --git a/spectec/src/il/print.ml b/spectec/src/il/print.ml
index 0098408cbe..51e95f1df7 100644
--- a/spectec/src/il/print.ml
+++ b/spectec/src/il/print.ml
@@ -79,9 +79,11 @@ let rec string_of_iter iter =
   | List1 -> "+"
   | ListN exp -> "^" ^ string_of_exp exp
 
+and string_of_id id = id.it
+
 and string_of_typ typ =
   match typ.it with
-  | VarT id -> id.it
+  | VarT id -> string_of_id id
   | BoolT -> "bool"
   | NatT -> "nat"
   | TextT -> "text"
@@ -153,8 +155,8 @@ and string_of_exp exp =
   | OptE expo -> "?(" ^ string_of_exps "" (Option.to_list expo) ^ ")"
   | ListE exps -> "[" ^ string_of_exps " " exps ^ "]"
   | CatE (exp1, exp2) -> string_of_exp exp1 ^ " :: " ^ string_of_exp exp2
-  | CaseE (atom, exp1, typ) ->
-    string_of_atom atom ^ "_" ^ string_of_typ typ ^ string_of_exp_args exp1
+  | CaseE (atom, exp1, id2, styps) ->
+    string_of_atom atom ^ "_" ^ String.concat "_" (List.map string_of_id (List.rev (id2 :: styps))) ^ string_of_exp_args exp1
   | SubE (exp1, _typ1, typ2) ->
     "(" ^ string_of_exp exp1 ^ " <: " ^ string_of_typ typ2 ^ ")"
 
diff --git a/spectec/src/il/validation.ml b/spectec/src/il/validation.ml
index e2088de8fb..dd3693e94e 100644
--- a/spectec/src/il/validation.ml
+++ b/spectec/src/il/validation.ml
@@ -135,12 +135,6 @@ let rec as_variant_typid phrase env id at : typcase list =
     List.concat (cases :: List.map (fun id -> as_variant_typid "" env id at) ids)
   | _ -> as_error at phrase Infer (VarT id $ id.at) "| ..."
 
-let as_variant_typ phrase env dir typ at : typcase list =
-  match expand' env typ.it with
-  | VarT id -> as_variant_typid phrase env id at
-  | _ -> as_error at phrase dir typ "| ..."
-
-
 (* Type Equivalence *)
 
 let equiv_list equiv_x xs1 xs2 =
@@ -214,11 +208,13 @@ let rec valid_iter env iter =
 
 (* Types *)
 
+and valid_id env id =
+    if find "syntax type" env.typs id = fwd_deftyp_bad then
+      error id.at ("invalid forward reference to syntax type `" ^ id.it ^ "`")
+
 and valid_typ env typ =
   match typ.it with
-  | VarT id ->
-    if find "syntax type" env.typs id = fwd_deftyp_bad then
-      error typ.at ("invalid forward reference to syntax type `" ^ id.it ^ "`")
+  | VarT id -> valid_id env id
   | BoolT
   | NatT
   | TextT ->
@@ -390,11 +386,13 @@ and valid_exp env exp typ =
     let _typ1 = as_iter_typ List "list" env Check typ exp.at in
     valid_exp env exp1 typ;
     valid_exp env exp2 typ
-  | CaseE (atom, exp1, typ2) ->
-    valid_typ env typ2;
-    let cases = as_variant_typ "case" env Check typ2 exp.at in
+  | CaseE (atom, exp1, id2, styps) ->
+    valid_id env id2;
+    List.iter (valid_id env) styps;
+    let cases = as_variant_typid "case" env id2 exp.at in
     let typ1 = find_case cases atom exp1.at in
     valid_exp env exp1 typ1;
+    let typ2 = {it = VarT id2; at= id2.at} in
     equiv_typ env typ2 typ exp.at
   | SubE (exp1, typ1, typ2) ->
     valid_typ env typ1;

From c5c1eea6f4daad33394e67bc1f5e8d61b6dc9c50 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Mon, 3 Apr 2023 12:40:06 +0200
Subject: [PATCH 04/98] Haskell: Function definitions

---
 spectec/src/backend-haskell/gen.ml | 47 +++++++++++++++++++++++++-----
 1 file changed, 40 insertions(+), 7 deletions(-)

diff --git a/spectec/src/backend-haskell/gen.ml b/spectec/src/backend-haskell/gen.ml
index f556904207..53aadc82b3 100644
--- a/spectec/src/backend-haskell/gen.ml
+++ b/spectec/src/backend-haskell/gen.ml
@@ -1,5 +1,9 @@
 open Il.Ast
 
+let parens s = "(" ^ s ^ ")"
+let ($$) s1 s2 = parens (s1 ^ " " ^ s2)
+let render_tuple how tys = parens (String.concat ", " (List.map how tys))
+
 let render_type_name (id : id) = String.capitalize_ascii id.it
 
 let make_id = String.map (function
@@ -17,7 +21,7 @@ let render_con_name id : atom -> string = function
     if String.starts_with ~prefix:"_" s
     then render_type_name id ^ make_id s
     else render_type_name id ^ "_" ^ make_id s
-  | a -> "{- render_con_name: TODO -} " ^ Il.Print.string_of_atom a 
+  | a -> "{- render_con_name: TODO -} " ^ Il.Print.string_of_atom a
 
 
 let rec render_typ (ty : typ) = match ty.it with
@@ -25,12 +29,9 @@ let rec render_typ (ty : typ) = match ty.it with
   | BoolT -> "Bool"
   | NatT -> "Natural"
   | TextT -> "String"
-  | TupT tys -> render_tuple tys
+  | TupT tys -> render_tuple render_typ tys
   | IterT (ty, _) -> "[" ^ render_typ ty ^ "]"
 
-and render_tuple tys = "(" ^ String.concat ", " (List.map render_typ tys) ^ ")"
-
-
 let _unsupported_def d =
   "{- " ^
   Il.Print.string_of_def d ^
@@ -44,6 +45,10 @@ let rec prepend first rest = function
 let render_variant_inj id1 id2 =
   render_type_name id1 ^ "_of_" ^ render_type_name id2
 
+let render_variant_inj' (typ1 : typ) (typ2 : typ) = match typ1.it, typ2.it with
+  | VarT id1, VarT id2 -> render_variant_inj id1 id2
+  | _, _ -> "_ {- render_variant_inj': Typs not ids -}"
+
 let render_variant_inj_case id1 id2 =
   render_variant_inj id1 id2 ^ " " ^ render_type_name id2
 
@@ -51,6 +56,30 @@ let render_variant_case id (case : typcase) = match case with
   | (a, {it = TupT [];_}, _hints) -> render_con_name id a
   | (a, ty, _hints) -> render_con_name id a ^ " " ^ render_typ ty
 
+let rec render_exp (exp : exp) = match exp.it with
+  | VarE v -> v.it
+  | BoolE true -> "True"
+  | BoolE false -> "Frue"
+  | NatE n -> string_of_int n
+  | TextE t -> "\"" ^ String.escaped t ^ "\""
+  | MixE (_, e) -> render_exp e
+  | TupE es -> render_tuple render_exp es
+  | IterE (e, _) -> render_exp e
+  | CaseE (a, e, typ, styps) -> render_case a e typ styps
+  | SubE (e, typ1, typ2) -> render_variant_inj' typ2 typ1 $$ render_exp e
+  | _ -> "undefined {- " ^ Il.Print.string_of_exp exp ^ " -}"
+
+and render_case a e typ = function
+  | [] ->
+    if e.it = TupE []
+    then render_con_name typ a
+    else render_con_name typ a $$ render_exp e
+  | (styp::styps) -> render_variant_inj typ styp $$ render_case a e styp styps
+
+let render_clause (id : id) (clause : clause) = match clause.it with
+  | DefD (_binds, lhs, rhs, premise) ->
+   (if premise <> [] then "-- Premises ignored! \n" else "") ^
+   id.it ^ " " ^ render_exp lhs ^ " = " ^ render_exp rhs
 
 let rec render_def (d : def) =
   "{- " (*  ^ Util.Source.string_of_region d.at ^ "\n"*)  ^
@@ -69,10 +98,14 @@ let rec render_def (d : def) =
         List.map (render_variant_case id) cases
       )
     | StructT fields ->
-      "type " ^ render_type_name id ^ " = " ^ render_tuple (
+      "type " ^ render_type_name id ^ " = " ^ render_tuple render_typ (
         List.map (fun (_a, ty, _hints) -> ty) fields
       )
     end
+  | DecD (id, typ1, typ2, clauses, _hints) ->
+    id.it ^ " :: " ^ render_typ typ1 ^ " -> " ^ render_typ typ2 ^ "\n" ^
+    String.concat "\n" (List.map (render_clause id) clauses)
+
   | RecD defs ->
     String.concat "\n" (List.map render_def defs)
   | _ -> ""
@@ -82,7 +115,7 @@ let render_script (el : script) =
 
 let gen_string (el : script) =
   "module Test where\n" ^
-  "import Prelude (Bool, String)\n" ^
+  "import Prelude (Bool, String, undefined)\n" ^
   "import Numeric.Natural (Natural)\n" ^
   render_script el
 

From d37facb538ea9589ae1f509453481c061f427137 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Mon, 3 Apr 2023 16:45:44 +0200
Subject: [PATCH 05/98] Records

---
 spectec/src/backend-haskell/gen.ml | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/spectec/src/backend-haskell/gen.ml b/spectec/src/backend-haskell/gen.ml
index 53aadc82b3..98e10d470c 100644
--- a/spectec/src/backend-haskell/gen.ml
+++ b/spectec/src/backend-haskell/gen.ml
@@ -6,6 +6,8 @@ let render_tuple how tys = parens (String.concat ", " (List.map how tys))
 
 let render_type_name (id : id) = String.capitalize_ascii id.it
 
+let render_rec_con (id : id) = "Mk" ^ render_type_name id
+
 let make_id = String.map (function
   | '.' -> '_'
   | c -> c
@@ -23,6 +25,10 @@ let render_con_name id : atom -> string = function
     else render_type_name id ^ "_" ^ make_id s
   | a -> "{- render_con_name: TODO -} " ^ Il.Print.string_of_atom a
 
+let render_field_name : atom -> string = function
+  | Atom s -> String.uncapitalize_ascii (make_id s)
+  | a -> "{- render_field_name: TODO -} " ^ Il.Print.string_of_atom a
+
 
 let rec render_typ (ty : typ) = match ty.it with
   | VarT id -> render_type_name id
@@ -30,6 +36,7 @@ let rec render_typ (ty : typ) = match ty.it with
   | NatT -> "Natural"
   | TextT -> "String"
   | TupT tys -> render_tuple render_typ tys
+  | IterT (ty, Opt) -> "Maybe" $$ render_typ ty
   | IterT (ty, _) -> "[" ^ render_typ ty ^ "]"
 
 let _unsupported_def d =
@@ -67,6 +74,9 @@ let rec render_exp (exp : exp) = match exp.it with
   | IterE (e, _) -> render_exp e
   | CaseE (a, e, typ, styps) -> render_case a e typ styps
   | SubE (e, typ1, typ2) -> render_variant_inj' typ2 typ1 $$ render_exp e
+  | DotE (e, a) -> render_exp e ^ "." ^ render_field_name a
+  | IdxE (e1, e2) -> parens (render_exp e1 ^ " !! " ^ ("fromIntegral" $$ render_exp e2))
+  | BinE (AddOp, e1, e2) -> parens (render_exp e1 ^ " + " ^ render_exp e2)
   | _ -> "undefined {- " ^ Il.Print.string_of_exp exp ^ " -}"
 
 and render_case a e typ = function
@@ -98,9 +108,14 @@ let rec render_def (d : def) =
         List.map (render_variant_case id) cases
       )
     | StructT fields ->
+      (*
       "type " ^ render_type_name id ^ " = " ^ render_tuple render_typ (
         List.map (fun (_a, ty, _hints) -> ty) fields
       )
+      *)
+      "data " ^ render_type_name id ^ " = " ^ render_rec_con id ^ prepend "\n { " "\n , " (
+        List.map (fun (a, ty, _hints) -> render_field_name a ^ " :: " ^ render_typ ty) fields
+      ) ^ "\n }"
     end
   | DecD (id, typ1, typ2, clauses, _hints) ->
     id.it ^ " :: " ^ render_typ typ1 ^ " -> " ^ render_typ typ2 ^ "\n" ^
@@ -111,11 +126,13 @@ let rec render_def (d : def) =
   | _ -> ""
 
 let render_script (el : script) =
-  String.concat "\n" (List.map render_def el)
+  String.concat "\n\n" (List.map render_def el)
 
 let gen_string (el : script) =
+  "{-# LANGUAGE OverloadedRecordDot #-}\n" ^
+  "{-# LANGUAGE DuplicateRecordFields #-}\n" ^
   "module Test where\n" ^
-  "import Prelude (Bool, String, undefined)\n" ^
+  "import Prelude (Bool, String, undefined, Maybe, fromIntegral, (+), (!!))\n" ^
   "import Numeric.Natural (Natural)\n" ^
   render_script el
 

From 89d289179d4830a51d68559b332ec88b1606da5f Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Mon, 3 Apr 2023 16:53:48 +0200
Subject: [PATCH 06/98] include_input flag

---
 spectec/src/backend-haskell/gen.ml | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/spectec/src/backend-haskell/gen.ml b/spectec/src/backend-haskell/gen.ml
index 98e10d470c..d6461b3293 100644
--- a/spectec/src/backend-haskell/gen.ml
+++ b/spectec/src/backend-haskell/gen.ml
@@ -1,5 +1,7 @@
 open Il.Ast
 
+let include_input = true
+
 let parens s = "(" ^ s ^ ")"
 let ($$) s1 s2 = parens (s1 ^ " " ^ s2)
 let render_tuple how tys = parens (String.concat ", " (List.map how tys))
@@ -92,9 +94,13 @@ let render_clause (id : id) (clause : clause) = match clause.it with
    id.it ^ " " ^ render_exp lhs ^ " = " ^ render_exp rhs
 
 let rec render_def (d : def) =
-  "{- " (*  ^ Util.Source.string_of_region d.at ^ "\n"*)  ^
-  Il.Print.string_of_def d ^
-  "\n-}\n" ^
+  begin
+    if include_input then
+    "{- " (*  ^ Util.Source.string_of_region d.at ^ "\n"*)  ^
+    Il.Print.string_of_def d ^
+    "\n-}\n"
+    else ""
+  end ^
   match d.it with
   | SynD (id, deftyp, _hints) ->
     begin match deftyp.it with

From dd39b7a08c5dfb144b67b1256355a785435c012e Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Mon, 3 Apr 2023 17:16:27 +0200
Subject: [PATCH 07/98] More comments

---
 spectec/src/backend-haskell/gen.ml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/spectec/src/backend-haskell/gen.ml b/spectec/src/backend-haskell/gen.ml
index d6461b3293..1976e7257d 100644
--- a/spectec/src/backend-haskell/gen.ml
+++ b/spectec/src/backend-haskell/gen.ml
@@ -106,8 +106,8 @@ let rec render_def (d : def) =
     begin match deftyp.it with
     | AliasT ty ->
       "type " ^ render_type_name id ^ " = " ^ render_typ ty
-    | NotationT (_op, ty) ->
-      "type " ^ render_type_name id ^ " = " ^ render_typ ty
+    | NotationT (mop, ty) ->
+      "type " ^ render_type_name id ^ " = {- mixop: " ^ Il.Print.string_of_mixop mop ^ " -} " ^ render_typ ty
     | VariantT (ids, cases) ->
       "data " ^ render_type_name id ^ prepend "\n = " "\n | " (
         List.map (render_variant_inj_case id) ids @

From c8bbec51ce039d853f2000c2bb0c8caae115160b Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Tue, 4 Apr 2023 10:50:37 +0200
Subject: [PATCH 08/98] Lean experiments

---
 spectec/.gitignore                |   5 +
 spectec/Makefile                  |   3 +
 spectec/lake-manifest.json        |   9 ++
 spectec/lakefile.lean             |  10 ++
 spectec/lean-toolchain            |   1 +
 spectec/src/backend-lean4/dune    |   5 +
 spectec/src/backend-lean4/gen.ml  | 148 ++++++++++++++++++++++++++++++
 spectec/src/backend-lean4/gen.mli |   2 +
 spectec/src/dune                  |   1 +
 spectec/src/exe-lean4/dune        |   4 +
 spectec/src/exe-lean4/main.ml     |  72 +++++++++++++++
 11 files changed, 260 insertions(+)
 create mode 100644 spectec/lake-manifest.json
 create mode 100644 spectec/lakefile.lean
 create mode 100644 spectec/lean-toolchain
 create mode 100644 spectec/src/backend-lean4/dune
 create mode 100644 spectec/src/backend-lean4/gen.ml
 create mode 100644 spectec/src/backend-lean4/gen.mli
 create mode 100644 spectec/src/exe-lean4/dune
 create mode 100644 spectec/src/exe-lean4/main.ml

diff --git a/spectec/.gitignore b/spectec/.gitignore
index 66d37780dc..850ddd0860 100644
--- a/spectec/.gitignore
+++ b/spectec/.gitignore
@@ -1,4 +1,9 @@
 watsup
 watsup-haskell
+watsup-lean4
+
+# lean stuff
+build
+lake-packages
 
 .direnv
diff --git a/spectec/Makefile b/spectec/Makefile
index c423692774..f21dd428a1 100644
--- a/spectec/Makefile
+++ b/spectec/Makefile
@@ -33,6 +33,9 @@ exe-haskell:
 	dune build $(DUNE_OPTS) $(SRCDIR)/exe-haskell/main.exe
 	ln -sf $(OUTDIR)/exe-haskell/main.exe ./$(NAME)-haskell
 
+exe-lean4:
+	dune build $(DUNE_OPTS) $(SRCDIR)/exe-lean4/main.exe
+	ln -sf $(OUTDIR)/exe-lean4/main.exe ./$(NAME)-lean4
 
 # Latex
 
diff --git a/spectec/lake-manifest.json b/spectec/lake-manifest.json
new file mode 100644
index 0000000000..101df59481
--- /dev/null
+++ b/spectec/lake-manifest.json
@@ -0,0 +1,9 @@
+{"version": 4,
+ "packagesDir": "lake-packages",
+ "packages":
+ [{"git":
+   {"url": "https://github.com/leanprover/std4",
+    "subDir?": null,
+    "rev": "5507f9d8409f93b984ce04eccf4914d534e6fca2",
+    "name": "std",
+    "inputRev?": "main"}}]}
diff --git a/spectec/lakefile.lean b/spectec/lakefile.lean
new file mode 100644
index 0000000000..e96e5eed18
--- /dev/null
+++ b/spectec/lakefile.lean
@@ -0,0 +1,10 @@
+import Lake
+
+open Lake DSL
+
+package spectec
+
+@[default_target]
+lean_lib SpecTec where
+
+require std from git "https://github.com/leanprover/std4" @ "main"
diff --git a/spectec/lean-toolchain b/spectec/lean-toolchain
new file mode 100644
index 0000000000..5bf01da5f3
--- /dev/null
+++ b/spectec/lean-toolchain
@@ -0,0 +1 @@
+leanprover/lean4:nightly-2023-02-10
diff --git a/spectec/src/backend-lean4/dune b/spectec/src/backend-lean4/dune
new file mode 100644
index 0000000000..ea28fde790
--- /dev/null
+++ b/spectec/src/backend-lean4/dune
@@ -0,0 +1,5 @@
+(library
+  (name backend_lean4)
+  (libraries util el frontend str)
+  (modules gen)
+)
diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
new file mode 100644
index 0000000000..2b71d74b30
--- /dev/null
+++ b/spectec/src/backend-lean4/gen.ml
@@ -0,0 +1,148 @@
+open Il.Ast
+
+let include_input = true
+
+let parens s = "(" ^ s ^ ")"
+let ($$) s1 s2 = parens (s1 ^ " " ^ s2)
+let render_tuple how tys = parens (String.concat ", " (List.map how tys))
+
+let render_type_name (id : id) = String.capitalize_ascii id.it
+
+(* let render_rec_con (id : id) = "Mk" ^ render_type_name id *)
+
+let make_id = String.map (function
+  | '.' -> '_'
+  | c -> c
+  )
+
+let render_con_name qual id : atom -> string = function
+  | Atom s ->
+    (if qual then render_type_name id ^ "." else "") ^
+    make_id s
+  | a -> "/- render_con_name: TODO -/ " ^ Il.Print.string_of_atom a
+
+let render_field_name : atom -> string = function
+  | Atom s -> String.uncapitalize_ascii (make_id s)
+  | a -> "/- render_field_name: TODO -/ " ^ Il.Print.string_of_atom a
+
+let rec render_typ (ty : typ) = match ty.it with
+  | VarT id -> render_type_name id
+  | BoolT -> "Bool"
+  | NatT -> "Nat"
+  | TextT -> "String"
+  | TupT [] -> "Unit"
+  | TupT tys -> render_tuple_typ tys
+  | IterT (ty, Opt) -> "Option" $$ render_typ ty
+  | IterT (ty, _) -> "List" $$ render_typ ty
+
+and render_tuple_typ tys = parens (String.concat " × " (List.map render_typ tys))
+
+let _unsupported_def d =
+  "{- " ^
+  Il.Print.string_of_def d ^
+  "\n-}"
+
+let rec prepend first rest = function
+  | [] -> ""
+  | (x::xs) -> first ^ x ^ prepend rest rest xs
+
+
+let render_variant_inj qual id1 id2 =
+  (if qual then render_type_name id1 ^ "." else "" ) ^
+  render_type_name id2
+
+let render_variant_inj' (typ1 : typ) (typ2 : typ) = match typ1.it, typ2.it with
+  | VarT id1, VarT id2 -> render_variant_inj true id1 id2
+  | _, _ -> "_ {- render_variant_inj': Typs not ids -}"
+
+let render_variant_inj_case id1 id2 =
+  render_variant_inj false id1 id2 ^ " : " ^
+  render_type_name id2 ^ " -> " ^ render_type_name id1
+
+let render_variant_case id ((a, ty, _hints) : typcase) =
+  render_con_name false id a ^ " : " ^
+  if ty.it = TupT []
+  then render_type_name id
+  else render_typ ty ^ " -> " ^ render_type_name id
+
+let rec render_exp (exp : exp) = match exp.it with
+  | VarE v -> v.it
+  | BoolE true -> "True"
+  | BoolE false -> "Frue"
+  | NatE n -> string_of_int n
+  | TextE t -> "\"" ^ String.escaped t ^ "\""
+  | MixE (_, e) -> render_exp e
+  | TupE es -> render_tuple render_exp es
+  | IterE (e, _) -> render_exp e
+  | CaseE (a, e, typ, styps) -> render_case a e typ styps
+  | SubE (e, typ1, typ2) -> render_variant_inj' typ2 typ1 $$ render_exp e
+  | DotE (e, a) -> render_exp e ^ "." ^ render_field_name a
+  | IdxE (e1, e2) -> parens (render_exp e1 ^ " !! " ^ ("fromIntegral" $$ render_exp e2))
+  | BinE (AddOp, e1, e2) -> "Nat.add" $$ render_exp e1 $$ render_exp e2 ^
+                            " /- TODO: Why does + not work -/"
+  | _ -> "undefined {- " ^ Il.Print.string_of_exp exp ^ " -}"
+
+and render_case a e typ = function
+  | [] ->
+    if e.it = TupE []
+    then render_con_name true typ a
+    else render_con_name true typ a $$ render_exp e
+  | (styp::styps) -> render_variant_inj true typ styp $$ render_case a e styp styps
+
+let render_clause (_id : id) (clause : clause) = match clause.it with
+  | DefD (_binds, lhs, rhs, premise) ->
+   (if premise <> [] then "-- Premises ignored! \n" else "") ^
+   "\n  | " ^ render_exp lhs ^ " => " ^ render_exp rhs
+
+let rec render_def (d : def) =
+  begin
+    if include_input then
+    "/- " (*  ^ Util.Source.string_of_region d.at ^ "\n"*)  ^
+    Il.Print.string_of_def d ^
+    "\n-/\n"
+    else ""
+  end ^
+  match d.it with
+  | SynD (id, deftyp, _hints) ->
+    begin match deftyp.it with
+    | AliasT ty ->
+      "def " ^ render_type_name id ^ " := " ^ render_typ ty
+    | NotationT (mop, ty) ->
+      "def " ^ render_type_name id ^ " := /- mixop: " ^ Il.Print.string_of_mixop mop ^ " -/ " ^ render_typ ty
+    | VariantT (ids, cases) ->
+      "inductive " ^ render_type_name id ^ " where" ^ prepend "\n | " "\n | " (
+        List.map (render_variant_inj_case id) ids @
+        List.map (render_variant_case id) cases
+      )
+    | StructT fields ->
+      (*
+      "type " ^ render_type_name id ^ " = " ^ render_tuple render_typ (
+        List.map (fun (_a, ty, _hints) -> ty) fields
+      )
+      *)
+      "structure " ^ render_type_name id ^ " where " ^
+      String.concat "" ( List.map (fun (a, ty, _hints) ->
+        "\n  " ^ render_field_name a ^ " : " ^ render_typ ty
+      ) fields)
+    end
+  | DecD (id, typ1, typ2, clauses, _hints) ->
+    "def " ^ id.it ^ " : " ^ render_typ typ1 ^ " -> " ^ render_typ typ2 ^
+    String.concat "" (List.map (render_clause id) clauses)
+
+  | RecD defs ->
+    String.concat "\n" (List.map render_def defs)
+  | _ -> ""
+
+let render_script (el : script) =
+  String.concat "\n\n" (List.map render_def el)
+
+let gen_string (el : script) =
+  "/- Lean 4 export -/\n" ^
+  render_script el
+
+
+let gen_file file el =
+  let haskell_code = gen_string el in
+  let oc = Out_channel.open_text file in
+  Fun.protect (fun () -> Out_channel.output_string oc haskell_code)
+    ~finally:(fun () -> Out_channel.close oc)
diff --git a/spectec/src/backend-lean4/gen.mli b/spectec/src/backend-lean4/gen.mli
new file mode 100644
index 0000000000..5df21766f4
--- /dev/null
+++ b/spectec/src/backend-lean4/gen.mli
@@ -0,0 +1,2 @@
+val gen_string : Il.Ast.script -> string
+val gen_file : string -> Il.Ast.script -> unit
diff --git a/spectec/src/dune b/spectec/src/dune
index 0ec43c64e4..87184f6a84 100644
--- a/spectec/src/dune
+++ b/spectec/src/dune
@@ -9,5 +9,6 @@
     (re_export backend_latex)
     (re_export backend_prose)
     (re_export backend_haskell)
+    (re_export backend_lean4)
   )
 )
diff --git a/spectec/src/exe-lean4/dune b/spectec/src/exe-lean4/dune
new file mode 100644
index 0000000000..a9da47797c
--- /dev/null
+++ b/spectec/src/exe-lean4/dune
@@ -0,0 +1,4 @@
+(executable
+  (name main)
+  (libraries spectec)
+)
diff --git a/spectec/src/exe-lean4/main.ml b/spectec/src/exe-lean4/main.ml
new file mode 100644
index 0000000000..c6676ee3ed
--- /dev/null
+++ b/spectec/src/exe-lean4/main.ml
@@ -0,0 +1,72 @@
+open Util
+
+
+(* Configuration *)
+
+let name = "watsup"
+let version = "0.3"
+
+
+(* Flags and parameters *)
+
+let log = ref false  (* log execution steps *)
+let dst = ref false  (* patch files *)
+
+let srcs = ref []    (* src file arguments *)
+let dsts = ref []    (* destination file arguments *)
+let odst = ref ""    (* generation file argument *)
+
+
+(* Argument parsing *)
+
+let banner () =
+  print_endline (name ^ " " ^ version ^ " generator")
+
+let usage = "Usage: " ^ name ^ " [option] [file ...] [-p file ...]"
+
+let add_arg source =
+  let args = if !dst then dsts else srcs in args := !args @ [source]
+
+let argspec = Arg.align
+[
+  "-v", Arg.Unit banner, " Show version";
+  "-o", Arg.String (fun s -> odst := s), " Generate file";
+  "-p", Arg.Set dst, " Patch files";
+  "-l", Arg.Set log, " Log execution steps";
+  "-help", Arg.Unit ignore, "";
+  "--help", Arg.Unit ignore, "";
+]
+
+
+(* Main *)
+
+let log s = if !log then Printf.printf "== %s\n%!" s
+
+let () =
+  Printexc.record_backtrace true;
+  try
+    Arg.parse argspec add_arg usage;
+    log "Parsing...";
+    let el = List.concat_map Frontend.Parse.parse_file !srcs in
+    log "Multiplicity checking...";
+    Frontend.Multiplicity.check el;
+    log "Elaboration...";
+    let il = Frontend.Elab.elab el in
+    log "IL Validation...";
+    Il.Validation.valid il;
+    log "Lean4 Generation...";
+    if !odst = "" && !dsts = [] then
+      print_endline (Backend_lean4.Gen.gen_string il);
+    if !odst <> "" then
+      Backend_lean4.Gen.gen_file !odst il;
+    log "Complete."
+  with
+  | Source.Error (at, msg) ->
+    prerr_endline (Source.string_of_region at ^ ": " ^ msg);
+    exit 1
+  | exn ->
+    flush_all ();
+    prerr_endline
+      (Sys.argv.(0) ^ ": uncaught exception " ^ Printexc.to_string exn);
+    Printexc.print_backtrace stderr;
+    exit 2

From 9056af3a2f31d7971822f6692403a9a8159dd52c Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Tue, 4 Apr 2023 12:10:57 +0200
Subject: [PATCH 09/98] Add partiality hints

---
 spectec/spec/2-aux.watsup     | 2 +-
 spectec/spec/4-runtime.watsup | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/spectec/spec/2-aux.watsup b/spectec/spec/2-aux.watsup
index b52ac464fd..d73043e13b 100644
--- a/spectec/spec/2-aux.watsup
+++ b/spectec/spec/2-aux.watsup
@@ -2,7 +2,7 @@
 
 ;; def |I n| = |F n| = |V n| = n        ;; ????
 
-def $size(valtype) : nat  hint(show |%|)
+def $size(valtype) : nat  hint(show |%|) hint(partial ())
 def $size(I32) = 32
 def $size(I64) = 64
 def $size(F32) = 32
diff --git a/spectec/spec/4-runtime.watsup b/spectec/spec/4-runtime.watsup
index 8b6768ae47..6229899178 100644
--- a/spectec/spec/4-runtime.watsup
+++ b/spectec/spec/4-runtime.watsup
@@ -41,7 +41,7 @@ syntax externval hint(desc "external value") =
 var xv : externval
 
 
-def $default_(valtype) : val
+def $default_(valtype) : val hint(partial "")
 def $default_(I32) = (CONST I32 0)
 def $default_(I64) = (CONST I64 0)
 def $default_(F32) = (CONST F32 0)

From 46e98a75e1e9e2e245f9af1bae18fbc58e5e4d4a Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Tue, 4 Apr 2023 12:11:09 +0200
Subject: [PATCH 10/98] Mor Lean-ing

---
 spectec/src/backend-lean4/gen.ml | 72 +++++++++++++++++++++++++-------
 1 file changed, 57 insertions(+), 15 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 2b71d74b30..e9609a95c0 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -3,17 +3,30 @@ open Il.Ast
 let include_input = true
 
 let parens s = "(" ^ s ^ ")"
+let brackets s = "[" ^ s ^ "]"
 let ($$) s1 s2 = parens (s1 ^ " " ^ s2)
 let render_tuple how tys = parens (String.concat ", " (List.map how tys))
+let render_list how tys = brackets (String.concat ", " (List.map how tys))
 
 let render_type_name (id : id) = String.capitalize_ascii id.it
 
 (* let render_rec_con (id : id) = "Mk" ^ render_type_name id *)
 
-let make_id = String.map (function
-  | '.' -> '_'
-  | c -> c
-  )
+let make_id s = match s with
+ | "in" -> "in_"
+ | "export" -> "export_"
+ | s -> String.map (function
+    | '.' -> '_'
+    | '-' -> '_'
+    | c -> c
+    ) s
+
+let render_id (id : id) = make_id id.it
+
+let render_rule_name _qual _ty_id (rule_id : id) (i : int) :  string =
+  if rule_id.it = ""
+  then "rule_" ^ string_of_int i
+  else make_id rule_id.it
 
 let render_con_name qual id : atom -> string = function
   | Atom s ->
@@ -38,9 +51,9 @@ let rec render_typ (ty : typ) = match ty.it with
 and render_tuple_typ tys = parens (String.concat " × " (List.map render_typ tys))
 
 let _unsupported_def d =
-  "{- " ^
+  "/- " ^
   Il.Print.string_of_def d ^
-  "\n-}"
+  "\n-/"
 
 let rec prepend first rest = function
   | [] -> ""
@@ -73,14 +86,15 @@ let rec render_exp (exp : exp) = match exp.it with
   | TextE t -> "\"" ^ String.escaped t ^ "\""
   | MixE (_, e) -> render_exp e
   | TupE es -> render_tuple render_exp es
+  | ListE es -> render_list render_exp es
   | IterE (e, _) -> render_exp e
   | CaseE (a, e, typ, styps) -> render_case a e typ styps
   | SubE (e, typ1, typ2) -> render_variant_inj' typ2 typ1 $$ render_exp e
   | DotE (e, a) -> render_exp e ^ "." ^ render_field_name a
-  | IdxE (e1, e2) -> parens (render_exp e1 ^ " !! " ^ ("fromIntegral" $$ render_exp e2))
+  | IdxE (e1, e2) -> parens (render_exp e1 ^ ".get! " ^ render_exp e2)
   | BinE (AddOp, e1, e2) -> "Nat.add" $$ render_exp e1 $$ render_exp e2 ^
                             " /- TODO: Why does + not work -/"
-  | _ -> "undefined {- " ^ Il.Print.string_of_exp exp ^ " -}"
+  | _ -> "default /- " ^ Il.Print.string_of_exp exp ^ " -/"
 
 and render_case a e typ = function
   | [] ->
@@ -106,14 +120,20 @@ let rec render_def (d : def) =
   | SynD (id, deftyp, _hints) ->
     begin match deftyp.it with
     | AliasT ty ->
-      "def " ^ render_type_name id ^ " := " ^ render_typ ty
+      "def " ^ render_type_name id ^ " := " ^ render_typ ty ^
+      "\n  deriving Inhabited" ^
+      (if ty.it = NatT
+       then "\n\ninstance : OfNat " ^ render_type_name id ^ " n where ofNat := (OfNat.ofNat n : Nat)"
+       else "")
     | NotationT (mop, ty) ->
-      "def " ^ render_type_name id ^ " := /- mixop: " ^ Il.Print.string_of_mixop mop ^ " -/ " ^ render_typ ty
+      "def " ^ render_type_name id ^ " := /- mixop: " ^ Il.Print.string_of_mixop mop ^ " -/ " ^ render_typ ty ^
+      "\n  deriving Inhabited"
     | VariantT (ids, cases) ->
       "inductive " ^ render_type_name id ^ " where" ^ prepend "\n | " "\n | " (
         List.map (render_variant_inj_case id) ids @
         List.map (render_variant_case id) cases
-      )
+      ) ^
+      (if ids = [] && cases = [] then "" else "\n  deriving Inhabited")
     | StructT fields ->
       (*
       "type " ^ render_type_name id ^ " = " ^ render_tuple render_typ (
@@ -123,15 +143,37 @@ let rec render_def (d : def) =
       "structure " ^ render_type_name id ^ " where " ^
       String.concat "" ( List.map (fun (a, ty, _hints) ->
         "\n  " ^ render_field_name a ^ " : " ^ render_typ ty
-      ) fields)
+      ) fields) ^
+      "\n  deriving Inhabited"
     end
-  | DecD (id, typ1, typ2, clauses, _hints) ->
+  | DecD (id, typ1, typ2, clauses, hints) ->
     "def " ^ id.it ^ " : " ^ render_typ typ1 ^ " -> " ^ render_typ typ2 ^
-    String.concat "" (List.map (render_clause id) clauses)
+    String.concat "" (List.map (render_clause id) clauses) ^
+    (if (List.exists (fun h -> h.hintid.it = "partial") hints)
+    then "\n  | _ => default" else "") (* Could use no_error_if_unused% as well *)
+
+  | RelD (id, _mixop, typ, rules, _hints) ->
+    "inductive " ^ render_type_name id ^ " : " ^ render_typ typ ^ " -> Prop where" ^
+    String.concat "" (List.mapi (fun i (rule : rule) -> match rule.it with
+      | RuleD (rule_id, binds, _mixop, exp, prems) ->
+        "\n  | " ^ render_rule_name false id rule_id i ^ " " ^
+        String.concat " " (List.map (fun ((bid : id), btyp) ->
+          parens (render_id bid ^ " : " ^ render_typ btyp)
+          ) binds) ^ " : " ^
+        String.concat "" (List.map (fun (prem : premise) ->
+          "\n    " ^
+          begin match prem.it with
+          | RulePr (pid, _mixops, pexp, _iter) ->
+            render_type_name pid $$ render_exp pexp
+          | IffPr (pexp, _iter) -> render_exp pexp
+          | ElsePr -> "/- Else? -?"
+          end ^ " -> "
+        ) prems) ^
+          "\n    " ^ (render_type_name id $$ render_exp exp)
+    ) rules)
 
   | RecD defs ->
     String.concat "\n" (List.map render_def defs)
-  | _ -> ""
 
 let render_script (el : script) =
   String.concat "\n\n" (List.map render_def el)

From f0e69526a1193b6f2d9fd3ca76bac706f24043fb Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Tue, 4 Apr 2023 12:39:26 +0200
Subject: [PATCH 11/98] OptE

---
 spectec/src/backend-lean4/gen.ml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index e9609a95c0..0aedae84ee 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -87,6 +87,8 @@ let rec render_exp (exp : exp) = match exp.it with
   | MixE (_, e) -> render_exp e
   | TupE es -> render_tuple render_exp es
   | ListE es -> render_list render_exp es
+  | OptE None -> "none"
+  | OptE (Some e) -> "some" $$ render_exp e
   | IterE (e, _) -> render_exp e
   | CaseE (a, e, typ, styps) -> render_case a e typ styps
   | SubE (e, typ1, typ2) -> render_variant_inj' typ2 typ1 $$ render_exp e
@@ -94,6 +96,10 @@ let rec render_exp (exp : exp) = match exp.it with
   | IdxE (e1, e2) -> parens (render_exp e1 ^ ".get! " ^ render_exp e2)
   | BinE (AddOp, e1, e2) -> "Nat.add" $$ render_exp e1 $$ render_exp e2 ^
                             " /- TODO: Why does + not work -/"
+  | CmpE (EqOp, e1, e2) -> (render_exp e1 ^ " = " ^ render_exp e2)
+  (* CompE can compose records piecewise
+  | CompE (e1, e2) -> (render_exp e1 ^ " ++ " ^ render_exp e2)
+  *)
   | _ -> "default /- " ^ Il.Print.string_of_exp exp ^ " -/"
 
 and render_case a e typ = function

From 639ba5aed5efa6ac05ae5927d9a82ccc2412b8c2 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Tue, 4 Apr 2023 14:52:59 +0200
Subject: [PATCH 12/98] More expressions

---
 spectec/src/backend-lean4/gen.ml | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 0aedae84ee..1e1e08d22d 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -4,6 +4,7 @@ let include_input = true
 
 let parens s = "(" ^ s ^ ")"
 let brackets s = "[" ^ s ^ "]"
+let braces s = "{" ^ s ^ "}"
 let ($$) s1 s2 = parens (s1 ^ " " ^ s2)
 let render_tuple how tys = parens (String.concat ", " (List.map how tys))
 let render_list how tys = brackets (String.concat ", " (List.map how tys))
@@ -12,9 +13,15 @@ let render_type_name (id : id) = String.capitalize_ascii id.it
 
 (* let render_rec_con (id : id) = "Mk" ^ render_type_name id *)
 
+let is_reserved = function
+ | "in"
+ | "export"
+ | "import"
+ -> true
+ | _ -> false
+
 let make_id s = match s with
- | "in" -> "in_"
- | "export" -> "export_"
+ | s when is_reserved s -> "«" ^ s ^ "»"
  | s -> String.map (function
     | '.' -> '_'
     | '-' -> '_'
@@ -79,7 +86,7 @@ let render_variant_case id ((a, ty, _hints) : typcase) =
   else render_typ ty ^ " -> " ^ render_type_name id
 
 let rec render_exp (exp : exp) = match exp.it with
-  | VarE v -> v.it
+  | VarE v -> render_id v
   | BoolE true -> "True"
   | BoolE false -> "Frue"
   | NatE n -> string_of_int n
@@ -91,12 +98,21 @@ let rec render_exp (exp : exp) = match exp.it with
   | OptE (Some e) -> "some" $$ render_exp e
   | IterE (e, _) -> render_exp e
   | CaseE (a, e, typ, styps) -> render_case a e typ styps
+  | StrE fields -> braces ( String.concat ", " (List.map (fun (a, e) ->
+    render_field_name a ^ " := " ^ render_exp e
+    ) fields))
   | SubE (e, typ1, typ2) -> render_variant_inj' typ2 typ1 $$ render_exp e
   | DotE (e, a) -> render_exp e ^ "." ^ render_field_name a
   | IdxE (e1, e2) -> parens (render_exp e1 ^ ".get! " ^ render_exp e2)
+  | LenE e -> render_exp e ^ ".length"
   | BinE (AddOp, e1, e2) -> "Nat.add" $$ render_exp e1 $$ render_exp e2 ^
                             " /- TODO: Why does + not work -/"
   | CmpE (EqOp, e1, e2) -> (render_exp e1 ^ " = " ^ render_exp e2)
+  | CmpE (NeOp, e1, e2) -> (render_exp e1 ^ " != " ^ render_exp e2)
+  | CmpE (LeOp, e1, e2) -> (render_exp e1 ^ " <= " ^ render_exp e2)
+  | CmpE (LtOp, e1, e2) -> (render_exp e1 ^ " < " ^ render_exp e2)
+  | CmpE (GeOp, e1, e2) -> (render_exp e1 ^ " >= " ^ render_exp e2)
+  | CmpE (GtOp, e1, e2) -> (render_exp e1 ^ " > " ^ render_exp e2)
   (* CompE can compose records piecewise
   | CompE (e1, e2) -> (render_exp e1 ^ " ++ " ^ render_exp e2)
   *)

From 0aca04d9a49f69d64835b25cf0b6573eadee3f3b Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Tue, 4 Apr 2023 15:23:21 +0200
Subject: [PATCH 13/98] Record monoid instance

---
 spectec/src/backend-lean4/gen.ml | 61 +++++++++++++++++++-------------
 1 file changed, 36 insertions(+), 25 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 1e1e08d22d..f45ae36673 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -42,7 +42,7 @@ let render_con_name qual id : atom -> string = function
   | a -> "/- render_con_name: TODO -/ " ^ Il.Print.string_of_atom a
 
 let render_field_name : atom -> string = function
-  | Atom s -> String.uncapitalize_ascii (make_id s)
+  | Atom s -> make_id s
   | a -> "/- render_field_name: TODO -/ " ^ Il.Print.string_of_atom a
 
 let rec render_typ (ty : typ) = match ty.it with
@@ -105,17 +105,22 @@ let rec render_exp (exp : exp) = match exp.it with
   | DotE (e, a) -> render_exp e ^ "." ^ render_field_name a
   | IdxE (e1, e2) -> parens (render_exp e1 ^ ".get! " ^ render_exp e2)
   | LenE e -> render_exp e ^ ".length"
-  | BinE (AddOp, e1, e2) -> "Nat.add" $$ render_exp e1 $$ render_exp e2 ^
-                            " /- TODO: Why does + not work -/"
-  | CmpE (EqOp, e1, e2) -> (render_exp e1 ^ " = " ^ render_exp e2)
-  | CmpE (NeOp, e1, e2) -> (render_exp e1 ^ " != " ^ render_exp e2)
-  | CmpE (LeOp, e1, e2) -> (render_exp e1 ^ " <= " ^ render_exp e2)
-  | CmpE (LtOp, e1, e2) -> (render_exp e1 ^ " < " ^ render_exp e2)
-  | CmpE (GeOp, e1, e2) -> (render_exp e1 ^ " >= " ^ render_exp e2)
-  | CmpE (GtOp, e1, e2) -> (render_exp e1 ^ " > " ^ render_exp e2)
-  (* CompE can compose records piecewise
-  | CompE (e1, e2) -> (render_exp e1 ^ " ++ " ^ render_exp e2)
-  *)
+  | CallE (id, e) -> render_id id $$ render_exp e
+  | BinE (AddOp, e1, e2)   -> parens (render_exp e1 ^ " + " ^ render_exp e2)
+  | BinE (SubOp, e1, e2)   -> parens (render_exp e1 ^ " - " ^ render_exp e2)
+  | BinE (ExpOp, e1, e2)   -> parens ("Nat.pow" $$ render_exp e1 $$ render_exp e2)
+  | BinE (DivOp, e1, e2)   -> parens ("Nat.div" $$ render_exp e1 $$ render_exp e2)
+  | BinE (AndOp, e1, e2)   -> parens (render_exp e1 ^ " && "  ^ render_exp e2)
+  | BinE (EquivOp, e1, e2) -> parens (render_exp e1 ^ " <=> " ^ render_exp e2)
+  | BinE (OrOp, e1, e2)    -> parens (render_exp e1 ^ " || "  ^ render_exp e2)
+  | CmpE (EqOp, e1, e2)    -> parens (render_exp e1 ^ " = "   ^ render_exp e2)
+  | CmpE (NeOp, e1, e2)    -> parens (render_exp e1 ^ " != "  ^ render_exp e2)
+  | CmpE (LeOp, e1, e2)    -> parens (render_exp e1 ^ " <= "  ^ render_exp e2)
+  | CmpE (LtOp, e1, e2)    -> parens (render_exp e1 ^ " < "   ^ render_exp e2)
+  | CmpE (GeOp, e1, e2)    -> parens (render_exp e1 ^ " >= "  ^ render_exp e2)
+  | CmpE (GtOp, e1, e2)    -> parens (render_exp e1 ^ " > "   ^ render_exp e2)
+  | CatE (e1, e2)          -> parens (render_exp e1 ^ " ++ "  ^ render_exp e2)
+  | CompE (e1, e2)         -> parens (render_exp e1 ^ " ++ "  ^ render_exp e2)
   | _ -> "default /- " ^ Il.Print.string_of_exp exp ^ " -/"
 
 and render_case a e typ = function
@@ -130,26 +135,22 @@ let render_clause (_id : id) (clause : clause) = match clause.it with
    (if premise <> [] then "-- Premises ignored! \n" else "") ^
    "\n  | " ^ render_exp lhs ^ " => " ^ render_exp rhs
 
-let rec render_def (d : def) =
-  begin
+let show_input (d:def) =
     if include_input then
     "/- " (*  ^ Util.Source.string_of_region d.at ^ "\n"*)  ^
     Il.Print.string_of_def d ^
     "\n-/\n"
     else ""
-  end ^
+
+let rec render_def (d : def) =
   match d.it with
   | SynD (id, deftyp, _hints) ->
+    show_input d ^
     begin match deftyp.it with
     | AliasT ty ->
-      "def " ^ render_type_name id ^ " := " ^ render_typ ty ^
-      "\n  deriving Inhabited" ^
-      (if ty.it = NatT
-       then "\n\ninstance : OfNat " ^ render_type_name id ^ " n where ofNat := (OfNat.ofNat n : Nat)"
-       else "")
+      "@[reducible] def " ^ render_type_name id ^ " := " ^ render_typ ty 
     | NotationT (mop, ty) ->
-      "def " ^ render_type_name id ^ " := /- mixop: " ^ Il.Print.string_of_mixop mop ^ " -/ " ^ render_typ ty ^
-      "\n  deriving Inhabited"
+      "@[reducible] def " ^ render_type_name id ^ " := /- mixop: " ^ Il.Print.string_of_mixop mop ^ " -/ " ^ render_typ ty 
     | VariantT (ids, cases) ->
       "inductive " ^ render_type_name id ^ " where" ^ prepend "\n | " "\n | " (
         List.map (render_variant_inj_case id) ids @
@@ -166,15 +167,23 @@ let rec render_def (d : def) =
       String.concat "" ( List.map (fun (a, ty, _hints) ->
         "\n  " ^ render_field_name a ^ " : " ^ render_typ ty
       ) fields) ^
-      "\n  deriving Inhabited"
+      "\n  deriving Inhabited\n" ^
+      "instance : Append " ^ render_type_name id ^ " where\n" ^
+      "  append := fun r1 r2 => {\n" ^
+      String.concat "" (List.map (fun (a, _ty, _hints) ->
+        "    " ^ render_field_name a ^ " := r1." ^ render_field_name a ^ " ++ r2." ^ render_field_name a ^ ",\n"
+      ) fields) ^
+      "  }"
     end
   | DecD (id, typ1, typ2, clauses, hints) ->
+    show_input d ^
     "def " ^ id.it ^ " : " ^ render_typ typ1 ^ " -> " ^ render_typ typ2 ^
     String.concat "" (List.map (render_clause id) clauses) ^
     (if (List.exists (fun h -> h.hintid.it = "partial") hints)
     then "\n  | _ => default" else "") (* Could use no_error_if_unused% as well *)
 
   | RelD (id, _mixop, typ, rules, _hints) ->
+    show_input d ^
     "inductive " ^ render_type_name id ^ " : " ^ render_typ typ ^ " -> Prop where" ^
     String.concat "" (List.mapi (fun i (rule : rule) -> match rule.it with
       | RuleD (rule_id, binds, _mixop, exp, prems) ->
@@ -188,7 +197,7 @@ let rec render_def (d : def) =
           | RulePr (pid, _mixops, pexp, _iter) ->
             render_type_name pid $$ render_exp pexp
           | IffPr (pexp, _iter) -> render_exp pexp
-          | ElsePr -> "/- Else? -?"
+          | ElsePr -> "True /- Else? -/"
           end ^ " -> "
         ) prems) ^
           "\n    " ^ (render_type_name id $$ render_exp exp)
@@ -201,7 +210,9 @@ let render_script (el : script) =
   String.concat "\n\n" (List.map render_def el)
 
 let gen_string (el : script) =
-  "/- Lean 4 export -/\n" ^
+  "/- Lean 4 export -/\n\n" ^
+  "instance : Append (Option a) where\n" ^
+  "  append := fun o1 o2 => match o1 with | none => o2 | _ => o1\n\n" ^
   render_script el
 
 

From e0ac8f8b9538f0dbdef7bd98f49ec4219a225868 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Tue, 4 Apr 2023 17:28:56 +0200
Subject: [PATCH 14/98] Mutual definitions

---
 spectec/src/backend-lean4/gen.ml | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index f45ae36673..0f54b6296d 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -1,6 +1,6 @@
 open Il.Ast
 
-let include_input = true
+let include_input = false
 
 let parens s = "(" ^ s ^ ")"
 let brackets s = "[" ^ s ^ "]"
@@ -111,9 +111,9 @@ let rec render_exp (exp : exp) = match exp.it with
   | BinE (ExpOp, e1, e2)   -> parens ("Nat.pow" $$ render_exp e1 $$ render_exp e2)
   | BinE (DivOp, e1, e2)   -> parens ("Nat.div" $$ render_exp e1 $$ render_exp e2)
   | BinE (AndOp, e1, e2)   -> parens (render_exp e1 ^ " && "  ^ render_exp e2)
-  | BinE (EquivOp, e1, e2) -> parens (render_exp e1 ^ " <=> " ^ render_exp e2)
+  | BinE (EquivOp, e1, e2) -> parens (render_exp e1 ^ " = "   ^ render_exp e2)
   | BinE (OrOp, e1, e2)    -> parens (render_exp e1 ^ " || "  ^ render_exp e2)
-  | CmpE (EqOp, e1, e2)    -> parens (render_exp e1 ^ " = "   ^ render_exp e2)
+  | CmpE (EqOp, e1, e2)    -> parens (render_exp e1 ^ " == "  ^ render_exp e2)
   | CmpE (NeOp, e1, e2)    -> parens (render_exp e1 ^ " != "  ^ render_exp e2)
   | CmpE (LeOp, e1, e2)    -> parens (render_exp e1 ^ " <= "  ^ render_exp e2)
   | CmpE (LtOp, e1, e2)    -> parens (render_exp e1 ^ " < "   ^ render_exp e2)
@@ -156,7 +156,7 @@ let rec render_def (d : def) =
         List.map (render_variant_inj_case id) ids @
         List.map (render_variant_case id) cases
       ) ^
-      (if ids = [] && cases = [] then "" else "\n  deriving Inhabited")
+      (if ids = [] && cases = [] then "\n  deriving BEq" else "\n  deriving Inhabited, BEq")
     | StructT fields ->
       (*
       "type " ^ render_type_name id ^ " = " ^ render_tuple render_typ (
@@ -167,7 +167,7 @@ let rec render_def (d : def) =
       String.concat "" ( List.map (fun (a, ty, _hints) ->
         "\n  " ^ render_field_name a ^ " : " ^ render_typ ty
       ) fields) ^
-      "\n  deriving Inhabited\n" ^
+      "\n  deriving Inhabited, BEq\n" ^
       "instance : Append " ^ render_type_name id ^ " where\n" ^
       "  append := fun r1 r2 => {\n" ^
       String.concat "" (List.map (fun (a, _ty, _hints) ->
@@ -203,8 +203,14 @@ let rec render_def (d : def) =
           "\n    " ^ (render_type_name id $$ render_exp exp)
     ) rules)
 
+  | RecD [def] ->
+    (* Self-recursion is always fine *)
+    render_def def
+
   | RecD defs ->
-    String.concat "\n" (List.map render_def defs)
+    "mutual\n" ^
+    String.concat "\n" (List.map render_def defs) ^
+    "end\n"
 
 let render_script (el : script) =
   String.concat "\n\n" (List.map render_def el)

From a7e8577c3f424d8635d0a2efee737aaa15406fc7 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 5 Apr 2023 10:24:28 +0200
Subject: [PATCH 15/98] Undo change to pretty-printer, to make testsuite pass

---
 spectec/src/il/print.ml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/spectec/src/il/print.ml b/spectec/src/il/print.ml
index 88960fa773..1acd2ff2e8 100644
--- a/spectec/src/il/print.ml
+++ b/spectec/src/il/print.ml
@@ -156,8 +156,8 @@ and string_of_exp exp =
   | OptE expo -> "?(" ^ string_of_exps "" (Option.to_list expo) ^ ")"
   | ListE exps -> "[" ^ string_of_exps " " exps ^ "]"
   | CatE (exp1, exp2) -> string_of_exp exp1 ^ " :: " ^ string_of_exp exp2
-  | CaseE (atom, exp1, id2, styps) ->
-    string_of_atom atom ^ "_" ^ String.concat "_" (List.map string_of_id (List.rev (id2 :: styps))) ^ string_of_exp_args exp1
+  | CaseE (atom, exp1, id2, _styps) ->
+    string_of_atom atom ^ "_" ^ string_of_id id2 ^ string_of_exp_args exp1
   | SubE (exp1, _typ1, typ2) ->
     "(" ^ string_of_exp exp1 ^ " <: " ^ string_of_typ typ2 ^ ")"
 

From 215cd3eed351e7f3f471ee9d842730f306927efb Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 5 Apr 2023 10:33:00 +0200
Subject: [PATCH 16/98] Set up test

---
 spectec/test-haskell/TEST.md | 2295 ++++++++++++++++++++++++++++++++++
 spectec/test-haskell/dune    |    8 +
 spectec/test-lean4/TEST.md   | 1003 +++++++++++++++
 spectec/test-lean4/dune      |    8 +
 4 files changed, 3314 insertions(+)
 create mode 100644 spectec/test-haskell/TEST.md
 create mode 100644 spectec/test-haskell/dune
 create mode 100644 spectec/test-lean4/TEST.md
 create mode 100644 spectec/test-lean4/dune

diff --git a/spectec/test-haskell/TEST.md b/spectec/test-haskell/TEST.md
new file mode 100644
index 0000000000..3f5ade3c0f
--- /dev/null
+++ b/spectec/test-haskell/TEST.md
@@ -0,0 +1,2295 @@
+# Preview
+
+```sh
+$ dune exec ../src/exe-haskell/main.exe -- ../spec/*.watsup -o Test.hs
+$ cat Test.hs
+{-# LANGUAGE OverloadedRecordDot #-}
+{-# LANGUAGE DuplicateRecordFields #-}
+module Test where
+import Prelude (Bool, String, undefined, Maybe, fromIntegral, (+), (!!))
+import Numeric.Natural (Natural)
+{-
+;; ../spec/1-syntax.watsup:3.1-3.15
+syntax n = nat
+-}
+type N = Natural
+
+{-
+;; ../spec/1-syntax.watsup:9.1-9.37
+syntax name = text
+-}
+type Name = String
+
+{-
+;; ../spec/1-syntax.watsup:14.1-14.36
+syntax byte = nat
+-}
+type Byte = Natural
+
+{-
+;; ../spec/1-syntax.watsup:15.1-15.45
+syntax u32 = nat
+-}
+type U32 = Natural
+
+{-
+;; ../spec/1-syntax.watsup:22.1-22.36
+syntax idx = nat
+-}
+type Idx = Natural
+
+{-
+;; ../spec/1-syntax.watsup:23.1-23.49
+syntax funcidx = idx
+-}
+type Funcidx = Idx
+
+{-
+;; ../spec/1-syntax.watsup:24.1-24.49
+syntax globalidx = idx
+-}
+type Globalidx = Idx
+
+{-
+;; ../spec/1-syntax.watsup:25.1-25.47
+syntax tableidx = idx
+-}
+type Tableidx = Idx
+
+{-
+;; ../spec/1-syntax.watsup:26.1-26.46
+syntax memidx = idx
+-}
+type Memidx = Idx
+
+{-
+;; ../spec/1-syntax.watsup:27.1-27.45
+syntax elemidx = idx
+-}
+type Elemidx = Idx
+
+{-
+;; ../spec/1-syntax.watsup:28.1-28.45
+syntax dataidx = idx
+-}
+type Dataidx = Idx
+
+{-
+;; ../spec/1-syntax.watsup:29.1-29.47
+syntax labelidx = idx
+-}
+type Labelidx = Idx
+
+{-
+;; ../spec/1-syntax.watsup:30.1-30.47
+syntax localidx = idx
+-}
+type Localidx = Idx
+
+{-
+;; ../spec/1-syntax.watsup:39.1-40.22
+syntax numtype =
+  | I32
+  | I64
+  | F32
+  | F64
+-}
+data Numtype
+ = Numtype_I32
+ | Numtype_I64
+ | Numtype_F32
+ | Numtype_F64
+
+{-
+;; ../spec/1-syntax.watsup:41.1-42.5
+syntax vectype =
+  | V128
+-}
+data Vectype
+ = Vectype_V128
+
+{-
+;; ../spec/1-syntax.watsup:43.1-44.20
+syntax reftype =
+  | FUNCREF
+  | EXTERNREF
+-}
+data Reftype
+ = Reftype_FUNCREF
+ | Reftype_EXTERNREF
+
+{-
+;; ../spec/1-syntax.watsup:45.1-46.34
+syntax valtype =
+  | numtype
+  | vectype
+  | reftype
+  | BOT
+-}
+data Valtype
+ = Valtype_of_Numtype Numtype
+ | Valtype_of_Vectype Vectype
+ | Valtype_of_Reftype Reftype
+ | Valtype_BOT
+
+{-
+;; ../spec/1-syntax.watsup:48.1-48.39
+syntax in =
+  | I32
+  | I64
+-}
+data In
+ = In_I32
+ | In_I64
+
+{-
+;; ../spec/1-syntax.watsup:49.1-49.39
+syntax fn =
+  | F32
+  | F64
+-}
+data Fn
+ = Fn_F32
+ | Fn_F64
+
+{-
+;; ../spec/1-syntax.watsup:56.1-57.11
+syntax resulttype = valtype*
+-}
+type Resulttype = [Valtype]
+
+{-
+;; ../spec/1-syntax.watsup:59.1-60.16
+syntax limits = `[%..%]`(u32, u32)
+-}
+type Limits = {- mixop: `[%..%]` -} (U32, U32)
+
+{-
+;; ../spec/1-syntax.watsup:61.1-62.15
+syntax globaltype = `MUT%?%`(()?, valtype)
+-}
+type Globaltype = {- mixop: `MUT%?%` -} ((Maybe ()), Valtype)
+
+{-
+;; ../spec/1-syntax.watsup:63.1-64.27
+syntax functype = `%->%`(resulttype, resulttype)
+-}
+type Functype = {- mixop: `%->%` -} (Resulttype, Resulttype)
+
+{-
+;; ../spec/1-syntax.watsup:65.1-66.17
+syntax tabletype = `%%`(limits, reftype)
+-}
+type Tabletype = {- mixop: `%%` -} (Limits, Reftype)
+
+{-
+;; ../spec/1-syntax.watsup:67.1-68.12
+syntax memtype = `%I8`(limits)
+-}
+type Memtype = {- mixop: `%I8` -} Limits
+
+{-
+;; ../spec/1-syntax.watsup:69.1-70.10
+syntax elemtype = reftype
+-}
+type Elemtype = Reftype
+
+{-
+;; ../spec/1-syntax.watsup:71.1-72.5
+syntax datatype = OK
+-}
+type Datatype = {- mixop: OK -} ()
+
+{-
+;; ../spec/1-syntax.watsup:73.1-74.69
+syntax externtype =
+  | GLOBAL(globaltype)
+  | FUNC(functype)
+  | TABLE(tabletype)
+  | MEMORY(memtype)
+-}
+data Externtype
+ = Externtype_GLOBAL Globaltype
+ | Externtype_FUNC Functype
+ | Externtype_TABLE Tabletype
+ | Externtype_MEMORY Memtype
+
+{-
+;; ../spec/1-syntax.watsup:86.1-86.44
+syntax sx =
+  | U
+  | S
+-}
+data Sx
+ = Sx_U
+ | Sx_S
+
+{-
+;; ../spec/1-syntax.watsup:88.1-88.39
+syntax unop_IXX =
+  | CLZ
+  | CTZ
+  | POPCNT
+-}
+data Unop_IXX
+ = Unop_IXX_CLZ
+ | Unop_IXX_CTZ
+ | Unop_IXX_POPCNT
+
+{-
+;; ../spec/1-syntax.watsup:89.1-89.70
+syntax unop_FXX =
+  | ABS
+  | NEG
+  | SQRT
+  | CEIL
+  | FLOOR
+  | TRUNC
+  | NEAREST
+-}
+data Unop_FXX
+ = Unop_FXX_ABS
+ | Unop_FXX_NEG
+ | Unop_FXX_SQRT
+ | Unop_FXX_CEIL
+ | Unop_FXX_FLOOR
+ | Unop_FXX_TRUNC
+ | Unop_FXX_NEAREST
+
+{-
+;; ../spec/1-syntax.watsup:91.1-93.62
+syntax binop_IXX =
+  | ADD
+  | SUB
+  | MUL
+  | DIV(sx)
+  | REM(sx)
+  | AND
+  | OR
+  | XOR
+  | SHL
+  | SHR(sx)
+  | ROTL
+  | ROTR
+-}
+data Binop_IXX
+ = Binop_IXX_ADD
+ | Binop_IXX_SUB
+ | Binop_IXX_MUL
+ | Binop_IXX_DIV Sx
+ | Binop_IXX_REM Sx
+ | Binop_IXX_AND
+ | Binop_IXX_OR
+ | Binop_IXX_XOR
+ | Binop_IXX_SHL
+ | Binop_IXX_SHR Sx
+ | Binop_IXX_ROTL
+ | Binop_IXX_ROTR
+
+{-
+;; ../spec/1-syntax.watsup:94.1-94.66
+syntax binop_FXX =
+  | ADD
+  | SUB
+  | MUL
+  | DIV
+  | MIN
+  | MAX
+  | COPYSIGN
+-}
+data Binop_FXX
+ = Binop_FXX_ADD
+ | Binop_FXX_SUB
+ | Binop_FXX_MUL
+ | Binop_FXX_DIV
+ | Binop_FXX_MIN
+ | Binop_FXX_MAX
+ | Binop_FXX_COPYSIGN
+
+{-
+;; ../spec/1-syntax.watsup:96.1-96.26
+syntax testop_IXX =
+  | EQZ
+-}
+data Testop_IXX
+ = Testop_IXX_EQZ
+
+{-
+;; ../spec/1-syntax.watsup:97.1-97.22
+syntax testop_FXX =
+  |
+-}
+data Testop_FXX
+
+{-
+;; ../spec/1-syntax.watsup:99.1-100.108
+syntax relop_IXX =
+  | EQ
+  | NE
+  | LT(sx)
+  | GT(sx)
+  | LE(sx)
+  | GE(sx)
+-}
+data Relop_IXX
+ = Relop_IXX_EQ
+ | Relop_IXX_NE
+ | Relop_IXX_LT Sx
+ | Relop_IXX_GT Sx
+ | Relop_IXX_LE Sx
+ | Relop_IXX_GE Sx
+
+{-
+;; ../spec/1-syntax.watsup:101.1-101.49
+syntax relop_FXX =
+  | EQ
+  | NE
+  | LT
+  | GT
+  | LE
+  | GE
+-}
+data Relop_FXX
+ = Relop_FXX_EQ
+ | Relop_FXX_NE
+ | Relop_FXX_LT
+ | Relop_FXX_GT
+ | Relop_FXX_LE
+ | Relop_FXX_GE
+
+{-
+;; ../spec/1-syntax.watsup:103.1-103.50
+syntax unop_numtype =
+  | _I(unop_IXX)
+  | _F(unop_FXX)
+-}
+data Unop_numtype
+ = Unop_numtype_I Unop_IXX
+ | Unop_numtype_F Unop_FXX
+
+{-
+;; ../spec/1-syntax.watsup:104.1-104.53
+syntax binop_numtype =
+  | _I(binop_IXX)
+  | _F(binop_FXX)
+-}
+data Binop_numtype
+ = Binop_numtype_I Binop_IXX
+ | Binop_numtype_F Binop_FXX
+
+{-
+;; ../spec/1-syntax.watsup:105.1-105.56
+syntax testop_numtype =
+  | _I(testop_IXX)
+  | _F(testop_FXX)
+-}
+data Testop_numtype
+ = Testop_numtype_I Testop_IXX
+ | Testop_numtype_F Testop_FXX
+
+{-
+;; ../spec/1-syntax.watsup:106.1-106.53
+syntax relop_numtype =
+  | _I(relop_IXX)
+  | _F(relop_FXX)
+-}
+data Relop_numtype
+ = Relop_numtype_I Relop_IXX
+ | Relop_numtype_F Relop_FXX
+
+{-
+;; ../spec/1-syntax.watsup:107.1-107.39
+syntax cvtop =
+  | CONVERT
+  | REINTERPRET
+-}
+data Cvtop
+ = Cvtop_CONVERT
+ | Cvtop_REINTERPRET
+
+{-
+;; ../spec/1-syntax.watsup:117.1-117.23
+syntax c_numtype = nat
+-}
+type C_numtype = Natural
+
+{-
+;; ../spec/1-syntax.watsup:118.1-118.23
+syntax c_vectype = nat
+-}
+type C_vectype = Natural
+
+{-
+;; ../spec/1-syntax.watsup:121.1-121.52
+syntax blocktype = functype
+-}
+type Blocktype = Functype
+
+{-
+;; ../spec/1-syntax.watsup:156.1-177.55
+rec {
+
+;; ../spec/1-syntax.watsup:156.1-177.55
+syntax instr =
+  | UNREACHABLE
+  | NOP
+  | DROP
+  | SELECT(valtype?)
+  | BLOCK(blocktype, instr*)
+  | LOOP(blocktype, instr*)
+  | IF(blocktype, instr*, instr*)
+  | BR(labelidx)
+  | BR_IF(labelidx)
+  | BR_TABLE(labelidx*, labelidx)
+  | CALL(funcidx)
+  | CALL_INDIRECT(tableidx, functype)
+  | RETURN
+  | CONST(numtype, c_numtype)
+  | UNOP(numtype, unop_numtype)
+  | BINOP(numtype, binop_numtype)
+  | TESTOP(numtype, testop_numtype)
+  | RELOP(numtype, relop_numtype)
+  | EXTEND(numtype, n)
+  | CVTOP(numtype, cvtop, numtype, sx?)
+  | REF.NULL(reftype)
+  | REF.FUNC(funcidx)
+  | REF.IS_NULL
+  | LOCAL.GET(localidx)
+  | LOCAL.SET(localidx)
+  | LOCAL.TEE(localidx)
+  | GLOBAL.GET(globalidx)
+  | GLOBAL.SET(globalidx)
+  | TABLE.GET(tableidx)
+  | TABLE.SET(tableidx)
+  | TABLE.SIZE(tableidx)
+  | TABLE.GROW(tableidx)
+  | TABLE.FILL(tableidx)
+  | TABLE.COPY(tableidx, tableidx)
+  | TABLE.INIT(tableidx, elemidx)
+  | ELEM.DROP(elemidx)
+  | MEMORY.SIZE
+  | MEMORY.GROW
+  | MEMORY.FILL
+  | MEMORY.COPY
+  | MEMORY.INIT(dataidx)
+  | DATA.DROP(dataidx)
+  | LOAD(numtype, (n, sx)?, nat, nat)
+  | STORE(numtype, n?, nat, nat)
+}
+-}
+{-
+;; ../spec/1-syntax.watsup:156.1-177.55
+syntax instr =
+  | UNREACHABLE
+  | NOP
+  | DROP
+  | SELECT(valtype?)
+  | BLOCK(blocktype, instr*)
+  | LOOP(blocktype, instr*)
+  | IF(blocktype, instr*, instr*)
+  | BR(labelidx)
+  | BR_IF(labelidx)
+  | BR_TABLE(labelidx*, labelidx)
+  | CALL(funcidx)
+  | CALL_INDIRECT(tableidx, functype)
+  | RETURN
+  | CONST(numtype, c_numtype)
+  | UNOP(numtype, unop_numtype)
+  | BINOP(numtype, binop_numtype)
+  | TESTOP(numtype, testop_numtype)
+  | RELOP(numtype, relop_numtype)
+  | EXTEND(numtype, n)
+  | CVTOP(numtype, cvtop, numtype, sx?)
+  | REF.NULL(reftype)
+  | REF.FUNC(funcidx)
+  | REF.IS_NULL
+  | LOCAL.GET(localidx)
+  | LOCAL.SET(localidx)
+  | LOCAL.TEE(localidx)
+  | GLOBAL.GET(globalidx)
+  | GLOBAL.SET(globalidx)
+  | TABLE.GET(tableidx)
+  | TABLE.SET(tableidx)
+  | TABLE.SIZE(tableidx)
+  | TABLE.GROW(tableidx)
+  | TABLE.FILL(tableidx)
+  | TABLE.COPY(tableidx, tableidx)
+  | TABLE.INIT(tableidx, elemidx)
+  | ELEM.DROP(elemidx)
+  | MEMORY.SIZE
+  | MEMORY.GROW
+  | MEMORY.FILL
+  | MEMORY.COPY
+  | MEMORY.INIT(dataidx)
+  | DATA.DROP(dataidx)
+  | LOAD(numtype, (n, sx)?, nat, nat)
+  | STORE(numtype, n?, nat, nat)
+-}
+data Instr
+ = Instr_UNREACHABLE
+ | Instr_NOP
+ | Instr_DROP
+ | Instr_SELECT (Maybe Valtype)
+ | Instr_BLOCK (Blocktype, [Instr])
+ | Instr_LOOP (Blocktype, [Instr])
+ | Instr_IF (Blocktype, [Instr], [Instr])
+ | Instr_BR Labelidx
+ | Instr_BR_IF Labelidx
+ | Instr_BR_TABLE ([Labelidx], Labelidx)
+ | Instr_CALL Funcidx
+ | Instr_CALL_INDIRECT (Tableidx, Functype)
+ | Instr_RETURN
+ | Instr_CONST (Numtype, C_numtype)
+ | Instr_UNOP (Numtype, Unop_numtype)
+ | Instr_BINOP (Numtype, Binop_numtype)
+ | Instr_TESTOP (Numtype, Testop_numtype)
+ | Instr_RELOP (Numtype, Relop_numtype)
+ | Instr_EXTEND (Numtype, N)
+ | Instr_CVTOP (Numtype, Cvtop, Numtype, (Maybe Sx))
+ | Instr_REF_NULL Reftype
+ | Instr_REF_FUNC Funcidx
+ | Instr_REF_IS_NULL
+ | Instr_LOCAL_GET Localidx
+ | Instr_LOCAL_SET Localidx
+ | Instr_LOCAL_TEE Localidx
+ | Instr_GLOBAL_GET Globalidx
+ | Instr_GLOBAL_SET Globalidx
+ | Instr_TABLE_GET Tableidx
+ | Instr_TABLE_SET Tableidx
+ | Instr_TABLE_SIZE Tableidx
+ | Instr_TABLE_GROW Tableidx
+ | Instr_TABLE_FILL Tableidx
+ | Instr_TABLE_COPY (Tableidx, Tableidx)
+ | Instr_TABLE_INIT (Tableidx, Elemidx)
+ | Instr_ELEM_DROP Elemidx
+ | Instr_MEMORY_SIZE
+ | Instr_MEMORY_GROW
+ | Instr_MEMORY_FILL
+ | Instr_MEMORY_COPY
+ | Instr_MEMORY_INIT Dataidx
+ | Instr_DATA_DROP Dataidx
+ | Instr_LOAD (Numtype, (Maybe (N, Sx)), Natural, Natural)
+ | Instr_STORE (Numtype, (Maybe N), Natural, Natural)
+
+{-
+;; ../spec/1-syntax.watsup:179.1-180.9
+syntax expr = instr*
+-}
+type Expr = [Instr]
+
+{-
+;; ../spec/1-syntax.watsup:185.1-185.50
+syntax elemmode =
+  | TABLE(tableidx, expr)
+  | DECLARE
+-}
+data Elemmode
+ = Elemmode_TABLE (Tableidx, Expr)
+ | Elemmode_DECLARE
+
+{-
+;; ../spec/1-syntax.watsup:186.1-186.39
+syntax datamode =
+  | MEMORY(memidx, expr)
+-}
+data Datamode
+ = Datamode_MEMORY (Memidx, Expr)
+
+{-
+;; ../spec/1-syntax.watsup:188.1-189.30
+syntax func = FUNC(functype, valtype*, expr)
+-}
+type Func = {- mixop: FUNC -} (Functype, [Valtype], Expr)
+
+{-
+;; ../spec/1-syntax.watsup:190.1-191.25
+syntax global = GLOBAL(globaltype, expr)
+-}
+type Global = {- mixop: GLOBAL -} (Globaltype, Expr)
+
+{-
+;; ../spec/1-syntax.watsup:192.1-193.18
+syntax table = TABLE(tabletype)
+-}
+type Table = {- mixop: TABLE -} Tabletype
+
+{-
+;; ../spec/1-syntax.watsup:194.1-195.17
+syntax mem = MEMORY(memtype)
+-}
+type Mem = {- mixop: MEMORY -} Memtype
+
+{-
+;; ../spec/1-syntax.watsup:196.1-197.31
+syntax elem = ELEM(reftype, expr*, elemmode?)
+-}
+type Elem = {- mixop: ELEM -} (Reftype, [Expr], (Maybe Elemmode))
+
+{-
+;; ../spec/1-syntax.watsup:198.1-199.26
+syntax data = DATA(byte**, datamode?)
+-}
+type Data = {- mixop: DATA -} ([[Byte]], (Maybe Datamode))
+
+{-
+;; ../spec/1-syntax.watsup:200.1-201.16
+syntax start = START(funcidx)
+-}
+type Start = {- mixop: START -} Funcidx
+
+{-
+;; ../spec/1-syntax.watsup:203.1-204.65
+syntax externuse =
+  | FUNC(funcidx)
+  | GLOBAL(globalidx)
+  | TABLE(tableidx)
+  | MEMORY(memidx)
+-}
+data Externuse
+ = Externuse_FUNC Funcidx
+ | Externuse_GLOBAL Globalidx
+ | Externuse_TABLE Tableidx
+ | Externuse_MEMORY Memidx
+
+{-
+;; ../spec/1-syntax.watsup:205.1-206.24
+syntax export = EXPORT(name, externuse)
+-}
+type Export = {- mixop: EXPORT -} (Name, Externuse)
+
+{-
+;; ../spec/1-syntax.watsup:207.1-208.30
+syntax import = IMPORT(name, name, externtype)
+-}
+type Import = {- mixop: IMPORT -} (Name, Name, Externtype)
+
+{-
+;; ../spec/1-syntax.watsup:210.1-211.70
+syntax module = MODULE(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
+-}
+type Module = {- mixop: MODULE -} ([Import], [Func], [Global], [Table], [Mem], [Elem], [Data], [Start], [Export])
+
+{-
+;; ../spec/2-aux.watsup:5.1-5.55
+def size : valtype -> nat
+  ;; ../spec/2-aux.watsup:10.1-10.22
+  def size(V128_valtype) = 128
+  ;; ../spec/2-aux.watsup:9.1-9.20
+  def size(F64_valtype) = 64
+  ;; ../spec/2-aux.watsup:8.1-8.20
+  def size(F32_valtype) = 32
+  ;; ../spec/2-aux.watsup:7.1-7.20
+  def size(I64_valtype) = 64
+  ;; ../spec/2-aux.watsup:6.1-6.20
+  def size(I32_valtype) = 32
+-}
+size :: Valtype -> Natural
+size (Valtype_of_Vectype Vectype_V128) = 128
+size (Valtype_of_Numtype Numtype_F64) = 64
+size (Valtype_of_Numtype Numtype_F32) = 32
+size (Valtype_of_Numtype Numtype_I64) = 64
+size (Valtype_of_Numtype Numtype_I32) = 32
+
+{-
+;; ../spec/2-aux.watsup:15.1-15.40
+def test_sub_ATOM_22 : n -> nat
+  ;; ../spec/2-aux.watsup:16.1-16.38
+  def {n_3_ATOM_y : n} test_sub_ATOM_22(n_3_ATOM_y) = 0
+-}
+test_sub_ATOM_22 :: N -> Natural
+test_sub_ATOM_22 n_3_ATOM_y = 0
+
+{-
+;; ../spec/2-aux.watsup:18.1-18.26
+def curried_ : (n, n) -> nat
+  ;; ../spec/2-aux.watsup:19.1-19.39
+  def {n_1 : n, n_2 : n} curried_(n_1, n_2) = (n_1 + n_2)
+-}
+curried_ :: (N, N) -> Natural
+curried_ (n_1, n_2) = (n_1 + n_2)
+
+{-
+;; ../spec/2-aux.watsup:21.1-30.39
+syntax testfuse =
+  | AB_(nat, nat, nat)
+  | CD(nat, nat, nat)
+  | EF(nat, nat, nat)
+  | GH(nat, nat, nat)
+  | IJ(nat, nat, nat)
+  | KL(nat, nat, nat)
+  | MN(nat, nat, nat)
+  | OP(nat, nat, nat)
+  | QR(nat, nat, nat)
+-}
+data Testfuse
+ = Testfuse_AB_ (Natural, Natural, Natural)
+ | Testfuse_CD (Natural, Natural, Natural)
+ | Testfuse_EF (Natural, Natural, Natural)
+ | Testfuse_GH (Natural, Natural, Natural)
+ | Testfuse_IJ (Natural, Natural, Natural)
+ | Testfuse_KL (Natural, Natural, Natural)
+ | Testfuse_MN (Natural, Natural, Natural)
+ | Testfuse_OP (Natural, Natural, Natural)
+ | Testfuse_QR (Natural, Natural, Natural)
+
+{-
+;; ../spec/3-typing.watsup:3.1-6.60
+syntax context = {FUNC functype*, GLOBAL globaltype*, TABLE tabletype*, MEM memtype*, ELEM elemtype*, DATA datatype*, LOCAL valtype*, LABEL resulttype*, RETURN resulttype?}
+-}
+data Context = MkContext
+ { fUNC :: [Functype]
+ , gLOBAL :: [Globaltype]
+ , tABLE :: [Tabletype]
+ , mEM :: [Memtype]
+ , eLEM :: [Elemtype]
+ , dATA :: [Datatype]
+ , lOCAL :: [Valtype]
+ , lABEL :: [Resulttype]
+ , rETURN :: (Maybe Resulttype)
+ }
+
+{-
+;; ../spec/3-typing.watsup:14.1-14.66
+relation Limits_ok: `|-%:%`(limits, nat)
+  ;; ../spec/3-typing.watsup:22.1-24.24
+  rule _ {k : nat, n_1 : n, n_2 : n}:
+    `|-%:%`(`[%..%]`(n_1, n_2), k)
+    -- if ((n_1 <= n_2) /\ (n_2 <= k))
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:15.1-15.64
+relation Functype_ok: `|-%:OK`(functype)
+  ;; ../spec/3-typing.watsup:26.1-27.13
+  rule _ {ft : functype}:
+    `|-%:OK`(ft)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:16.1-16.66
+relation Globaltype_ok: `|-%:OK`(globaltype)
+  ;; ../spec/3-typing.watsup:29.1-30.13
+  rule _ {gt : globaltype}:
+    `|-%:OK`(gt)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:17.1-17.65
+relation Tabletype_ok: `|-%:OK`(tabletype)
+  ;; ../spec/3-typing.watsup:32.1-34.35
+  rule _ {lim : limits, rt : reftype}:
+    `|-%:OK`(`%%`(lim, rt))
+    -- Limits_ok: `|-%:%`(lim, ((2 ^ 32) - 1))
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:18.1-18.63
+relation Memtype_ok: `|-%:OK`(memtype)
+  ;; ../spec/3-typing.watsup:36.1-38.33
+  rule _ {lim : limits}:
+    `|-%:OK`(`%I8`(lim))
+    -- Limits_ok: `|-%:%`(lim, (2 ^ 16))
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:19.1-19.66
+relation Externtype_ok: `|-%:OK`(externtype)
+  ;; ../spec/3-typing.watsup:53.1-55.33
+  rule mem {memtype : memtype}:
+    `|-%:OK`(MEMORY_externtype(memtype))
+    -- Memtype_ok: `|-%:OK`(memtype)
+
+  ;; ../spec/3-typing.watsup:49.1-51.37
+  rule table {tabletype : tabletype}:
+    `|-%:OK`(TABLE_externtype(tabletype))
+    -- Tabletype_ok: `|-%:OK`(tabletype)
+
+  ;; ../spec/3-typing.watsup:45.1-47.39
+  rule global {globaltype : globaltype}:
+    `|-%:OK`(GLOBAL_externtype(globaltype))
+    -- Globaltype_ok: `|-%:OK`(globaltype)
+
+  ;; ../spec/3-typing.watsup:41.1-43.35
+  rule func {functype : functype}:
+    `|-%:OK`(FUNC_externtype(functype))
+    -- Functype_ok: `|-%:OK`(functype)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:61.1-61.65
+relation Valtype_sub: `|-%<:%`(valtype, valtype)
+  ;; ../spec/3-typing.watsup:67.1-68.14
+  rule bot {t : valtype}:
+    `|-%<:%`(BOT_valtype, t)
+
+  ;; ../spec/3-typing.watsup:64.1-65.12
+  rule refl {t : valtype}:
+    `|-%<:%`(t, t)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:62.1-62.72
+relation Resulttype_sub: `|-%<:%`(valtype*, valtype*)
+  ;; ../spec/3-typing.watsup:70.1-72.35
+  rule _ {t_1 : valtype, t_2 : valtype}:
+    `|-%<:%`(t_1*, t_2*)
+    -- (Valtype_sub: `|-%<:%`(t_1, t_2))*
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:75.1-75.75
+relation Limits_sub: `|-%<:%`(limits, limits)
+  ;; ../spec/3-typing.watsup:83.1-86.21
+  rule _ {n_11 : n, n_12 : n, n_21 : n, n_22 : n}:
+    `|-%<:%`(`[%..%]`(n_11, n_12), `[%..%]`(n_21, n_22))
+    -- if (n_11 >= n_21)
+    -- if (n_12 <= n_22)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:76.1-76.73
+relation Functype_sub: `|-%<:%`(functype, functype)
+  ;; ../spec/3-typing.watsup:88.1-89.14
+  rule _ {ft : functype}:
+    `|-%<:%`(ft, ft)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:77.1-77.75
+relation Globaltype_sub: `|-%<:%`(globaltype, globaltype)
+  ;; ../spec/3-typing.watsup:91.1-92.14
+  rule _ {gt : globaltype}:
+    `|-%<:%`(gt, gt)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:78.1-78.74
+relation Tabletype_sub: `|-%<:%`(tabletype, tabletype)
+  ;; ../spec/3-typing.watsup:94.1-96.35
+  rule _ {lim_1 : limits, lim_2 : limits, rt : reftype}:
+    `|-%<:%`(`%%`(lim_1, rt), `%%`(lim_2, rt))
+    -- Limits_sub: `|-%<:%`(lim_1, lim_2)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:79.1-79.72
+relation Memtype_sub: `|-%<:%`(memtype, memtype)
+  ;; ../spec/3-typing.watsup:98.1-100.35
+  rule _ {lim_1 : limits, lim_2 : limits}:
+    `|-%<:%`(`%I8`(lim_1), `%I8`(lim_2))
+    -- Limits_sub: `|-%<:%`(lim_1, lim_2)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:80.1-80.75
+relation Externtype_sub: `|-%<:%`(externtype, externtype)
+  ;; ../spec/3-typing.watsup:115.1-117.34
+  rule mem {mt_1 : memtype, mt_2 : memtype}:
+    `|-%<:%`(MEMORY_externtype(mt_1), MEMORY_externtype(mt_2))
+    -- Memtype_sub: `|-%<:%`(mt_1, mt_2)
+
+  ;; ../spec/3-typing.watsup:111.1-113.36
+  rule table {tt_1 : tabletype, tt_2 : tabletype}:
+    `|-%<:%`(TABLE_externtype(tt_1), TABLE_externtype(tt_2))
+    -- Tabletype_sub: `|-%<:%`(tt_1, tt_2)
+
+  ;; ../spec/3-typing.watsup:107.1-109.37
+  rule global {gt_1 : globaltype, gt_2 : globaltype}:
+    `|-%<:%`(GLOBAL_externtype(gt_1), GLOBAL_externtype(gt_2))
+    -- Globaltype_sub: `|-%<:%`(gt_1, gt_2)
+
+  ;; ../spec/3-typing.watsup:103.1-105.35
+  rule func {ft_1 : functype, ft_2 : functype}:
+    `|-%<:%`(FUNC_externtype(ft_1), FUNC_externtype(ft_2))
+    -- Functype_sub: `|-%<:%`(ft_1, ft_2)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:172.1-172.76
+relation Blocktype_ok: `%|-%:%`(context, blocktype, functype)
+  ;; ../spec/3-typing.watsup:174.1-176.29
+  rule _ {C : context, ft : functype}:
+    `%|-%:%`(C, ft, ft)
+    -- Functype_ok: `|-%:OK`(ft)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:123.1-124.67
+rec {
+
+;; ../spec/3-typing.watsup:123.1-123.66
+relation Instr_ok: `%|-%:%`(context, instr, functype)
+  ;; ../spec/3-typing.watsup:357.1-362.32
+  rule store {C : context, in : in, mt : memtype, n : n, n_A : n, n_O : n, nt : numtype, t : valtype}:
+    `%|-%:%`(C, STORE_instr(nt, n?, n_A, n_O), `%->%`([I32_valtype (nt <: valtype)], []))
+    -- if (C.MEM_context[0] = mt)
+    -- if ((2 ^ n_A) <= ($size(t) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(t) / 8))))?
+    -- if ((n? = ?()) \/ (nt = (in <: numtype)))
+
+  ;; ../spec/3-typing.watsup:350.1-355.32
+  rule load {C : context, in : in, mt : memtype, n : n, n_A : n, n_O : n, nt : numtype, sx : sx, t : valtype}:
+    `%|-%:%`(C, LOAD_instr(nt, ?((n, sx)), n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
+    -- if (C.MEM_context[0] = mt)
+    -- if ((2 ^ n_A) <= ($size(t) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(t) / 8))))?
+    -- if ((n? = ?()) \/ (nt = (in <: numtype)))
+
+  ;; ../spec/3-typing.watsup:346.1-348.23
+  rule data.drop {C : context, x : idx}:
+    `%|-%:%`(C, DATA.DROP_instr(x), `%->%`([], []))
+    -- if (C.DATA_context[x] = OK)
+
+  ;; ../spec/3-typing.watsup:341.1-344.23
+  rule memory.init {C : context, mt : memtype, x : idx}:
+    `%|-%:%`(C, MEMORY.INIT_instr(x), `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+    -- if (C.DATA_context[x] = OK)
+
+  ;; ../spec/3-typing.watsup:337.1-339.22
+  rule memory.copy {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.COPY_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; ../spec/3-typing.watsup:333.1-335.22
+  rule memory.fill {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.FILL_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; ../spec/3-typing.watsup:329.1-331.22
+  rule memory.grow {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.GROW_instr, `%->%`([I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; ../spec/3-typing.watsup:325.1-327.22
+  rule memory.size {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.SIZE_instr, `%->%`([], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; ../spec/3-typing.watsup:320.1-322.23
+  rule elem.drop {C : context, rt : reftype, x : idx}:
+    `%|-%:%`(C, ELEM.DROP_instr(x), `%->%`([], []))
+    -- if (C.ELEM_context[x] = rt)
+
+  ;; ../spec/3-typing.watsup:315.1-318.25
+  rule table.init {C : context, lim : limits, rt : reftype, x_1 : idx, x_2 : idx}:
+    `%|-%:%`(C, TABLE.INIT_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (C.TABLE_context[x_1] = `%%`(lim, rt))
+    -- if (C.ELEM_context[x_2] = rt)
+
+  ;; ../spec/3-typing.watsup:310.1-313.32
+  rule table.copy {C : context, lim_1 : limits, lim_2 : limits, rt : reftype, x_1 : idx, x_2 : idx}:
+    `%|-%:%`(C, TABLE.COPY_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (C.TABLE_context[x_1] = `%%`(lim_1, rt))
+    -- if (C.TABLE_context[x_2] = `%%`(lim_2, rt))
+
+  ;; ../spec/3-typing.watsup:306.1-308.28
+  rule table.fill {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype (rt <: valtype) I32_valtype], []))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; ../spec/3-typing.watsup:302.1-304.28
+  rule table.grow {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([(rt <: valtype) I32_valtype], [I32_valtype]))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; ../spec/3-typing.watsup:298.1-300.24
+  rule table.size {C : context, tt : tabletype, x : idx}:
+    `%|-%:%`(C, TABLE.SIZE_instr(x), `%->%`([], [I32_valtype]))
+    -- if (C.TABLE_context[x] = tt)
+
+  ;; ../spec/3-typing.watsup:294.1-296.28
+  rule table.set {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype (rt <: valtype)], []))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; ../spec/3-typing.watsup:290.1-292.28
+  rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [(rt <: valtype)]))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; ../spec/3-typing.watsup:285.1-287.28
+  rule global.set {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
+
+  ;; ../spec/3-typing.watsup:281.1-283.29
+  rule global.get {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
+
+  ;; ../spec/3-typing.watsup:276.1-278.23
+  rule local.tee {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.TEE_instr(x), `%->%`([t], [t]))
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; ../spec/3-typing.watsup:272.1-274.23
+  rule local.set {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.SET_instr(x), `%->%`([t], []))
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; ../spec/3-typing.watsup:268.1-270.23
+  rule local.get {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.GET_instr(x), `%->%`([], [t]))
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; ../spec/3-typing.watsup:264.1-265.31
+  rule ref.is_null {C : context, rt : reftype}:
+    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([(rt <: valtype)], [I32_valtype]))
+
+  ;; ../spec/3-typing.watsup:260.1-262.23
+  rule ref.func {C : context, ft : functype, x : idx}:
+    `%|-%:%`(C, REF.FUNC_instr(x), `%->%`([], [FUNCREF_valtype]))
+    -- if (C.FUNC_context[x] = ft)
+
+  ;; ../spec/3-typing.watsup:257.1-258.35
+  rule ref.null {C : context, rt : reftype}:
+    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [(rt <: valtype)]))
+
+  ;; ../spec/3-typing.watsup:252.1-254.22
+  rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
+    `%|-%:%`(C, CVTOP_instr((fn_1 <: numtype), CONVERT_cvtop, (fn_2 <: numtype), ?()), `%->%`([(fn_2 <: valtype)], [(fn_1 <: valtype)]))
+    -- if (fn_1 =/= fn_2)
+
+  ;; ../spec/3-typing.watsup:247.1-250.52
+  rule convert-i {C : context, in_1 : in, in_2 : in, sx : sx}:
+    `%|-%:%`(C, CVTOP_instr((in_1 <: numtype), CONVERT_cvtop, (in_2 <: numtype), sx?), `%->%`([(in_2 <: valtype)], [(in_1 <: valtype)]))
+    -- if (in_1 =/= in_2)
+    -- if ((sx? = ?()) <=> ($size(in_1 <: valtype) > $size(in_2 <: valtype)))
+
+  ;; ../spec/3-typing.watsup:242.1-245.34
+  rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype}:
+    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([(nt_2 <: valtype)], [(nt_1 <: valtype)]))
+    -- if (nt_1 =/= nt_2)
+    -- if ($size(nt_1 <: valtype) = $size(nt_2 <: valtype))
+
+  ;; ../spec/3-typing.watsup:238.1-240.23
+  rule extend {C : context, n : n, nt : numtype}:
+    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
+    -- if (n <= $size(nt <: valtype))
+
+  ;; ../spec/3-typing.watsup:234.1-235.37
+  rule relop {C : context, nt : numtype, relop : relop_numtype}:
+    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([(nt <: valtype) (nt <: valtype)], [I32_valtype]))
+
+  ;; ../spec/3-typing.watsup:231.1-232.36
+  rule testop {C : context, nt : numtype, testop : testop_numtype}:
+    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([(nt <: valtype)], [I32_valtype]))
+
+  ;; ../spec/3-typing.watsup:228.1-229.36
+  rule binop {C : context, binop : binop_numtype, nt : numtype}:
+    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([(nt <: valtype) (nt <: valtype)], [(nt <: valtype)]))
+
+  ;; ../spec/3-typing.watsup:225.1-226.31
+  rule unop {C : context, nt : numtype, unop : unop_numtype}:
+    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
+
+  ;; ../spec/3-typing.watsup:222.1-223.37
+  rule const {C : context, c_nt : c_numtype, nt : numtype}:
+    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [(nt <: valtype)]))
+
+  ;; ../spec/3-typing.watsup:216.1-219.26
+  rule call_indirect {C : context, ft : functype, lim : limits, t_1 : valtype, t_2 : valtype, x : idx}:
+    `%|-%:%`(C, CALL_INDIRECT_instr(x, ft), `%->%`(t_1* :: [I32_valtype], t_2*))
+    -- if (C.TABLE_context[x] = `%%`(lim, FUNCREF_reftype))
+    -- if (ft = `%->%`(t_1*, t_2*))
+
+  ;; ../spec/3-typing.watsup:212.1-214.33
+  rule call {C : context, t_1 : valtype, t_2 : valtype, x : idx}:
+    `%|-%:%`(C, CALL_instr(x), `%->%`(t_1*, t_2*))
+    -- if (C.FUNC_context[x] = `%->%`(t_1*, t_2*))
+
+  ;; ../spec/3-typing.watsup:208.1-210.24
+  rule return {C : context, t : valtype, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, RETURN_instr, `%->%`(t_1* :: t*, t_2*))
+    -- if (C.RETURN_context = ?(t*))
+
+  ;; ../spec/3-typing.watsup:203.1-206.42
+  rule br_table {C : context, l : labelidx, l' : labelidx, t : valtype, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, BR_TABLE_instr(l*, l'), `%->%`(t_1* :: t*, t_2*))
+    -- (Resulttype_sub: `|-%<:%`(t*, C.LABEL_context[l]))*
+    -- Resulttype_sub: `|-%<:%`(t*, C.LABEL_context[l'])
+
+  ;; ../spec/3-typing.watsup:199.1-201.24
+  rule br_if {C : context, l : labelidx, t : valtype}:
+    `%|-%:%`(C, BR_IF_instr(l), `%->%`(t* :: [I32_valtype], t*))
+    -- if (C.LABEL_context[l] = t*)
+
+  ;; ../spec/3-typing.watsup:195.1-197.24
+  rule br {C : context, l : labelidx, t : valtype, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, BR_instr(l), `%->%`(t_1* :: t*, t_2*))
+    -- if (C.LABEL_context[l] = t*)
+
+  ;; ../spec/3-typing.watsup:188.1-192.59
+  rule if {C : context, bt : blocktype, instr_1 : instr, instr_2 : instr, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, IF_instr(bt, instr_1*, instr_2*), `%->%`(t_1*, [t_2]))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*, [t_2]))
+    -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*, RETURN ?()}, instr_1*, `%->%`(t_1*, t_2*))
+    -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*, RETURN ?()}, instr_2*, `%->%`(t_1*, t_2*))
+
+  ;; ../spec/3-typing.watsup:183.1-186.56
+  rule loop {C : context, bt : blocktype, instr : instr, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, LOOP_instr(bt, instr*), `%->%`(t_1*, t_2*))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*, t_2*))
+    -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_1]*, RETURN ?()}, instr*, `%->%`(t_1*, [t_2]))
+
+  ;; ../spec/3-typing.watsup:178.1-181.57
+  rule block {C : context, bt : blocktype, instr : instr, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, BLOCK_instr(bt, instr*), `%->%`(t_1*, t_2*))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*, t_2*))
+    -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*, RETURN ?()}, instr*, `%->%`(t_1*, t_2*))
+
+  ;; ../spec/3-typing.watsup:166.1-169.37
+  rule select-impl {C : context, numtype : numtype, t : valtype, t' : valtype, vectype : vectype}:
+    `%|-%:%`(C, SELECT_instr(?()), `%->%`([t t I32_valtype], [t]))
+    -- Valtype_sub: `|-%<:%`(t, t')
+    -- if ((t' = (numtype <: valtype)) \/ (t' = (vectype <: valtype)))
+
+  ;; ../spec/3-typing.watsup:163.1-164.31
+  rule select-expl {C : context, t : valtype}:
+    `%|-%:%`(C, SELECT_instr(?(t)), `%->%`([t t I32_valtype], [t]))
+
+  ;; ../spec/3-typing.watsup:159.1-160.27
+  rule drop {C : context, t : valtype}:
+    `%|-%:%`(C, DROP_instr, `%->%`([t], []))
+
+  ;; ../spec/3-typing.watsup:156.1-157.32
+  rule nop {C : context}:
+    `%|-%:%`(C, NOP_instr, `%->%`([], []))
+
+  ;; ../spec/3-typing.watsup:153.1-154.34
+  rule unreachable {C : context, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, UNREACHABLE_instr, `%->%`(t_1*, t_2*))
+
+;; ../spec/3-typing.watsup:124.1-124.67
+relation InstrSeq_ok: `%|-%:%`(context, instr*, functype)
+  ;; ../spec/3-typing.watsup:148.1-150.45
+  rule frame {C : context, instr : instr, t : valtype, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, instr*, `%->%`(t* :: t_1*, t* :: t_2*))
+    -- InstrSeq_ok: `%|-%:%`(C, instr*, `%->%`(t_1*, t_2*))
+
+  ;; ../spec/3-typing.watsup:141.1-146.38
+  rule weak {C : context, instr : instr, t'_1 : valtype, t'_2 : valtype, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, instr*, `%->%`([t'_1], t'_2*))
+    -- InstrSeq_ok: `%|-%:%`(C, instr*, `%->%`(t_1*, t_2*))
+    -- Resulttype_sub: `|-%<:%`(t'_1*, t_1*)
+    -- Resulttype_sub: `|-%<:%`(t_2*, t'_2*)
+
+  ;; ../spec/3-typing.watsup:136.1-139.46
+  rule seq {C : context, instr_1 : instr, instr_2 : instr, t_1 : valtype, t_2 : valtype, t_3 : valtype}:
+    `%|-%:%`(C, [instr_1] :: instr_2*, `%->%`(t_1*, t_3*))
+    -- Instr_ok: `%|-%:%`(C, instr_1, `%->%`(t_1*, t_2*))
+    -- InstrSeq_ok: `%|-%:%`(C, [instr_2], `%->%`(t_2*, t_3*))
+
+  ;; ../spec/3-typing.watsup:133.1-134.36
+  rule empty {C : context}:
+    `%|-%:%`(C, [], `%->%`([], []))
+}
+-}
+{-
+;; ../spec/3-typing.watsup:123.1-123.66
+relation Instr_ok: `%|-%:%`(context, instr, functype)
+  ;; ../spec/3-typing.watsup:357.1-362.32
+  rule store {C : context, in : in, mt : memtype, n : n, n_A : n, n_O : n, nt : numtype, t : valtype}:
+    `%|-%:%`(C, STORE_instr(nt, n?, n_A, n_O), `%->%`([I32_valtype (nt <: valtype)], []))
+    -- if (C.MEM_context[0] = mt)
+    -- if ((2 ^ n_A) <= ($size(t) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(t) / 8))))?
+    -- if ((n? = ?()) \/ (nt = (in <: numtype)))
+
+  ;; ../spec/3-typing.watsup:350.1-355.32
+  rule load {C : context, in : in, mt : memtype, n : n, n_A : n, n_O : n, nt : numtype, sx : sx, t : valtype}:
+    `%|-%:%`(C, LOAD_instr(nt, ?((n, sx)), n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
+    -- if (C.MEM_context[0] = mt)
+    -- if ((2 ^ n_A) <= ($size(t) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(t) / 8))))?
+    -- if ((n? = ?()) \/ (nt = (in <: numtype)))
+
+  ;; ../spec/3-typing.watsup:346.1-348.23
+  rule data.drop {C : context, x : idx}:
+    `%|-%:%`(C, DATA.DROP_instr(x), `%->%`([], []))
+    -- if (C.DATA_context[x] = OK)
+
+  ;; ../spec/3-typing.watsup:341.1-344.23
+  rule memory.init {C : context, mt : memtype, x : idx}:
+    `%|-%:%`(C, MEMORY.INIT_instr(x), `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+    -- if (C.DATA_context[x] = OK)
+
+  ;; ../spec/3-typing.watsup:337.1-339.22
+  rule memory.copy {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.COPY_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; ../spec/3-typing.watsup:333.1-335.22
+  rule memory.fill {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.FILL_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; ../spec/3-typing.watsup:329.1-331.22
+  rule memory.grow {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.GROW_instr, `%->%`([I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; ../spec/3-typing.watsup:325.1-327.22
+  rule memory.size {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.SIZE_instr, `%->%`([], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; ../spec/3-typing.watsup:320.1-322.23
+  rule elem.drop {C : context, rt : reftype, x : idx}:
+    `%|-%:%`(C, ELEM.DROP_instr(x), `%->%`([], []))
+    -- if (C.ELEM_context[x] = rt)
+
+  ;; ../spec/3-typing.watsup:315.1-318.25
+  rule table.init {C : context, lim : limits, rt : reftype, x_1 : idx, x_2 : idx}:
+    `%|-%:%`(C, TABLE.INIT_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (C.TABLE_context[x_1] = `%%`(lim, rt))
+    -- if (C.ELEM_context[x_2] = rt)
+
+  ;; ../spec/3-typing.watsup:310.1-313.32
+  rule table.copy {C : context, lim_1 : limits, lim_2 : limits, rt : reftype, x_1 : idx, x_2 : idx}:
+    `%|-%:%`(C, TABLE.COPY_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (C.TABLE_context[x_1] = `%%`(lim_1, rt))
+    -- if (C.TABLE_context[x_2] = `%%`(lim_2, rt))
+
+  ;; ../spec/3-typing.watsup:306.1-308.28
+  rule table.fill {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype (rt <: valtype) I32_valtype], []))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; ../spec/3-typing.watsup:302.1-304.28
+  rule table.grow {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([(rt <: valtype) I32_valtype], [I32_valtype]))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; ../spec/3-typing.watsup:298.1-300.24
+  rule table.size {C : context, tt : tabletype, x : idx}:
+    `%|-%:%`(C, TABLE.SIZE_instr(x), `%->%`([], [I32_valtype]))
+    -- if (C.TABLE_context[x] = tt)
+
+  ;; ../spec/3-typing.watsup:294.1-296.28
+  rule table.set {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype (rt <: valtype)], []))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; ../spec/3-typing.watsup:290.1-292.28
+  rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [(rt <: valtype)]))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; ../spec/3-typing.watsup:285.1-287.28
+  rule global.set {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
+
+  ;; ../spec/3-typing.watsup:281.1-283.29
+  rule global.get {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
+
+  ;; ../spec/3-typing.watsup:276.1-278.23
+  rule local.tee {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.TEE_instr(x), `%->%`([t], [t]))
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; ../spec/3-typing.watsup:272.1-274.23
+  rule local.set {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.SET_instr(x), `%->%`([t], []))
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; ../spec/3-typing.watsup:268.1-270.23
+  rule local.get {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.GET_instr(x), `%->%`([], [t]))
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; ../spec/3-typing.watsup:264.1-265.31
+  rule ref.is_null {C : context, rt : reftype}:
+    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([(rt <: valtype)], [I32_valtype]))
+
+  ;; ../spec/3-typing.watsup:260.1-262.23
+  rule ref.func {C : context, ft : functype, x : idx}:
+    `%|-%:%`(C, REF.FUNC_instr(x), `%->%`([], [FUNCREF_valtype]))
+    -- if (C.FUNC_context[x] = ft)
+
+  ;; ../spec/3-typing.watsup:257.1-258.35
+  rule ref.null {C : context, rt : reftype}:
+    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [(rt <: valtype)]))
+
+  ;; ../spec/3-typing.watsup:252.1-254.22
+  rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
+    `%|-%:%`(C, CVTOP_instr((fn_1 <: numtype), CONVERT_cvtop, (fn_2 <: numtype), ?()), `%->%`([(fn_2 <: valtype)], [(fn_1 <: valtype)]))
+    -- if (fn_1 =/= fn_2)
+
+  ;; ../spec/3-typing.watsup:247.1-250.52
+  rule convert-i {C : context, in_1 : in, in_2 : in, sx : sx}:
+    `%|-%:%`(C, CVTOP_instr((in_1 <: numtype), CONVERT_cvtop, (in_2 <: numtype), sx?), `%->%`([(in_2 <: valtype)], [(in_1 <: valtype)]))
+    -- if (in_1 =/= in_2)
+    -- if ((sx? = ?()) <=> ($size(in_1 <: valtype) > $size(in_2 <: valtype)))
+
+  ;; ../spec/3-typing.watsup:242.1-245.34
+  rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype}:
+    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([(nt_2 <: valtype)], [(nt_1 <: valtype)]))
+    -- if (nt_1 =/= nt_2)
+    -- if ($size(nt_1 <: valtype) = $size(nt_2 <: valtype))
+
+  ;; ../spec/3-typing.watsup:238.1-240.23
+  rule extend {C : context, n : n, nt : numtype}:
+    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
+    -- if (n <= $size(nt <: valtype))
+
+  ;; ../spec/3-typing.watsup:234.1-235.37
+  rule relop {C : context, nt : numtype, relop : relop_numtype}:
+    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([(nt <: valtype) (nt <: valtype)], [I32_valtype]))
+
+  ;; ../spec/3-typing.watsup:231.1-232.36
+  rule testop {C : context, nt : numtype, testop : testop_numtype}:
+    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([(nt <: valtype)], [I32_valtype]))
+
+  ;; ../spec/3-typing.watsup:228.1-229.36
+  rule binop {C : context, binop : binop_numtype, nt : numtype}:
+    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([(nt <: valtype) (nt <: valtype)], [(nt <: valtype)]))
+
+  ;; ../spec/3-typing.watsup:225.1-226.31
+  rule unop {C : context, nt : numtype, unop : unop_numtype}:
+    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
+
+  ;; ../spec/3-typing.watsup:222.1-223.37
+  rule const {C : context, c_nt : c_numtype, nt : numtype}:
+    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [(nt <: valtype)]))
+
+  ;; ../spec/3-typing.watsup:216.1-219.26
+  rule call_indirect {C : context, ft : functype, lim : limits, t_1 : valtype, t_2 : valtype, x : idx}:
+    `%|-%:%`(C, CALL_INDIRECT_instr(x, ft), `%->%`(t_1* :: [I32_valtype], t_2*))
+    -- if (C.TABLE_context[x] = `%%`(lim, FUNCREF_reftype))
+    -- if (ft = `%->%`(t_1*, t_2*))
+
+  ;; ../spec/3-typing.watsup:212.1-214.33
+  rule call {C : context, t_1 : valtype, t_2 : valtype, x : idx}:
+    `%|-%:%`(C, CALL_instr(x), `%->%`(t_1*, t_2*))
+    -- if (C.FUNC_context[x] = `%->%`(t_1*, t_2*))
+
+  ;; ../spec/3-typing.watsup:208.1-210.24
+  rule return {C : context, t : valtype, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, RETURN_instr, `%->%`(t_1* :: t*, t_2*))
+    -- if (C.RETURN_context = ?(t*))
+
+  ;; ../spec/3-typing.watsup:203.1-206.42
+  rule br_table {C : context, l : labelidx, l' : labelidx, t : valtype, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, BR_TABLE_instr(l*, l'), `%->%`(t_1* :: t*, t_2*))
+    -- (Resulttype_sub: `|-%<:%`(t*, C.LABEL_context[l]))*
+    -- Resulttype_sub: `|-%<:%`(t*, C.LABEL_context[l'])
+
+  ;; ../spec/3-typing.watsup:199.1-201.24
+  rule br_if {C : context, l : labelidx, t : valtype}:
+    `%|-%:%`(C, BR_IF_instr(l), `%->%`(t* :: [I32_valtype], t*))
+    -- if (C.LABEL_context[l] = t*)
+
+  ;; ../spec/3-typing.watsup:195.1-197.24
+  rule br {C : context, l : labelidx, t : valtype, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, BR_instr(l), `%->%`(t_1* :: t*, t_2*))
+    -- if (C.LABEL_context[l] = t*)
+
+  ;; ../spec/3-typing.watsup:188.1-192.59
+  rule if {C : context, bt : blocktype, instr_1 : instr, instr_2 : instr, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, IF_instr(bt, instr_1*, instr_2*), `%->%`(t_1*, [t_2]))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*, [t_2]))
+    -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*, RETURN ?()}, instr_1*, `%->%`(t_1*, t_2*))
+    -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*, RETURN ?()}, instr_2*, `%->%`(t_1*, t_2*))
+
+  ;; ../spec/3-typing.watsup:183.1-186.56
+  rule loop {C : context, bt : blocktype, instr : instr, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, LOOP_instr(bt, instr*), `%->%`(t_1*, t_2*))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*, t_2*))
+    -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_1]*, RETURN ?()}, instr*, `%->%`(t_1*, [t_2]))
+
+  ;; ../spec/3-typing.watsup:178.1-181.57
+  rule block {C : context, bt : blocktype, instr : instr, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, BLOCK_instr(bt, instr*), `%->%`(t_1*, t_2*))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*, t_2*))
+    -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*, RETURN ?()}, instr*, `%->%`(t_1*, t_2*))
+
+  ;; ../spec/3-typing.watsup:166.1-169.37
+  rule select-impl {C : context, numtype : numtype, t : valtype, t' : valtype, vectype : vectype}:
+    `%|-%:%`(C, SELECT_instr(?()), `%->%`([t t I32_valtype], [t]))
+    -- Valtype_sub: `|-%<:%`(t, t')
+    -- if ((t' = (numtype <: valtype)) \/ (t' = (vectype <: valtype)))
+
+  ;; ../spec/3-typing.watsup:163.1-164.31
+  rule select-expl {C : context, t : valtype}:
+    `%|-%:%`(C, SELECT_instr(?(t)), `%->%`([t t I32_valtype], [t]))
+
+  ;; ../spec/3-typing.watsup:159.1-160.27
+  rule drop {C : context, t : valtype}:
+    `%|-%:%`(C, DROP_instr, `%->%`([t], []))
+
+  ;; ../spec/3-typing.watsup:156.1-157.32
+  rule nop {C : context}:
+    `%|-%:%`(C, NOP_instr, `%->%`([], []))
+
+  ;; ../spec/3-typing.watsup:153.1-154.34
+  rule unreachable {C : context, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, UNREACHABLE_instr, `%->%`(t_1*, t_2*))
+-}
+
+{-
+;; ../spec/3-typing.watsup:124.1-124.67
+relation InstrSeq_ok: `%|-%:%`(context, instr*, functype)
+  ;; ../spec/3-typing.watsup:148.1-150.45
+  rule frame {C : context, instr : instr, t : valtype, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, instr*, `%->%`(t* :: t_1*, t* :: t_2*))
+    -- InstrSeq_ok: `%|-%:%`(C, instr*, `%->%`(t_1*, t_2*))
+
+  ;; ../spec/3-typing.watsup:141.1-146.38
+  rule weak {C : context, instr : instr, t'_1 : valtype, t'_2 : valtype, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, instr*, `%->%`([t'_1], t'_2*))
+    -- InstrSeq_ok: `%|-%:%`(C, instr*, `%->%`(t_1*, t_2*))
+    -- Resulttype_sub: `|-%<:%`(t'_1*, t_1*)
+    -- Resulttype_sub: `|-%<:%`(t_2*, t'_2*)
+
+  ;; ../spec/3-typing.watsup:136.1-139.46
+  rule seq {C : context, instr_1 : instr, instr_2 : instr, t_1 : valtype, t_2 : valtype, t_3 : valtype}:
+    `%|-%:%`(C, [instr_1] :: instr_2*, `%->%`(t_1*, t_3*))
+    -- Instr_ok: `%|-%:%`(C, instr_1, `%->%`(t_1*, t_2*))
+    -- InstrSeq_ok: `%|-%:%`(C, [instr_2], `%->%`(t_2*, t_3*))
+
+  ;; ../spec/3-typing.watsup:133.1-134.36
+  rule empty {C : context}:
+    `%|-%:%`(C, [], `%->%`([], []))
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:125.1-125.71
+relation Expr_ok: `%|-%:%`(context, expr, resulttype)
+  ;; ../spec/3-typing.watsup:128.1-130.46
+  rule _ {C : context, instr : instr, t : valtype}:
+    `%|-%:%`(C, instr*, t*)
+    -- InstrSeq_ok: `%|-%:%`(C, instr*, `%->%`([], t*))
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:367.1-367.78
+relation Instr_const: `%|-%CONST`(context, instr)
+  ;; ../spec/3-typing.watsup:380.1-382.32
+  rule global.get {C : context, t : valtype, x : idx}:
+    `%|-%CONST`(C, GLOBAL.GET_instr(x))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(), t))
+
+  ;; ../spec/3-typing.watsup:377.1-378.26
+  rule ref.func {C : context, x : idx}:
+    `%|-%CONST`(C, REF.FUNC_instr(x))
+
+  ;; ../spec/3-typing.watsup:374.1-375.27
+  rule ref.null {C : context, rt : reftype}:
+    `%|-%CONST`(C, REF.NULL_instr(rt))
+
+  ;; ../spec/3-typing.watsup:371.1-372.26
+  rule const {C : context, c : c_numtype, nt : numtype}:
+    `%|-%CONST`(C, CONST_instr(nt, c))
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:368.1-368.77
+relation Expr_const: `%|-%CONST`(context, expr)
+  ;; ../spec/3-typing.watsup:385.1-386.38
+  rule _ {C : context, instr : instr}:
+    `%|-%CONST`(C, instr*)
+    -- (Instr_const: `%|-%CONST`(C, instr))*
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:369.1-369.78
+relation Expr_ok_const: `%|-%:%CONST`(context, expr, valtype)
+  ;; ../spec/3-typing.watsup:389.1-392.33
+  rule _ {C : context, expr : expr, t : valtype}:
+    `%|-%:%CONST`(C, expr, t)
+    -- Expr_ok: `%|-%:%`(C, expr, [t])
+    -- Expr_const: `%|-%CONST`(C, expr)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:397.1-397.73
+relation Func_ok: `%|-%:%`(context, func, functype)
+  ;; ../spec/3-typing.watsup:408.1-412.75
+  rule _ {C : context, expr : expr, ft : functype, t : valtype, t_1 : valtype, t_2 : valtype}:
+    `%|-%:%`(C, FUNC(ft, t*, expr), ft)
+    -- if (ft = `%->%`(t_1*, t_2*))
+    -- Functype_ok: `|-%:OK`(ft)
+    -- Expr_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL t_1* :: t*, LABEL [], RETURN ?()} ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2*], RETURN ?()} ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [], RETURN ?(t_2*)}, expr, t_2*)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:398.1-398.75
+relation Global_ok: `%|-%:%`(context, global, globaltype)
+  ;; ../spec/3-typing.watsup:414.1-418.40
+  rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
+    `%|-%:%`(C, GLOBAL(gt, expr), gt)
+    -- Globaltype_ok: `|-%:OK`(gt)
+    -- if (gt = `MUT%?%`(?(()), t))
+    -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:399.1-399.74
+relation Table_ok: `%|-%:%`(context, table, tabletype)
+  ;; ../spec/3-typing.watsup:420.1-422.30
+  rule _ {C : context, tt : tabletype}:
+    `%|-%:%`(C, TABLE(tt), tt)
+    -- Tabletype_ok: `|-%:OK`(tt)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:400.1-400.72
+relation Mem_ok: `%|-%:%`(context, mem, memtype)
+  ;; ../spec/3-typing.watsup:424.1-426.28
+  rule _ {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY(mt), mt)
+    -- Memtype_ok: `|-%:OK`(mt)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:403.1-403.77
+relation Elemmode_ok: `%|-%:%`(context, elemmode, reftype)
+  ;; ../spec/3-typing.watsup:443.1-444.20
+  rule declare {C : context, rt : reftype}:
+    `%|-%:%`(C, DECLARE_elemmode, rt)
+
+  ;; ../spec/3-typing.watsup:438.1-441.45
+  rule active {C : context, expr : expr, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE_elemmode(x, expr), rt)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+    -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:401.1-401.73
+relation Elem_ok: `%|-%:%`(context, elem, reftype)
+  ;; ../spec/3-typing.watsup:428.1-431.40
+  rule _ {C : context, elemmode : elemmode, expr : expr, rt : reftype}:
+    `%|-%:%`(C, ELEM(rt, expr*, elemmode?), rt)
+    -- (Expr_ok: `%|-%:%`(C, expr, [(rt <: valtype)]))*
+    -- (Elemmode_ok: `%|-%:%`(C, elemmode, rt))?
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:404.1-404.77
+relation Datamode_ok: `%|-%:OK`(context, datamode)
+  ;; ../spec/3-typing.watsup:446.1-449.45
+  rule _ {C : context, expr : expr, mt : memtype}:
+    `%|-%:OK`(C, MEMORY_datamode(0, expr))
+    -- if (C.MEM_context[0] = mt)
+    -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:402.1-402.73
+relation Data_ok: `%|-%:OK`(context, data)
+  ;; ../spec/3-typing.watsup:434.1-436.40
+  rule _ {C : context, b : byte, datamode : datamode}:
+    `%|-%:OK`(C, DATA(b**, datamode?))
+    -- (Datamode_ok: `%|-%:OK`(C, datamode))?
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:405.1-405.74
+relation Start_ok: `%|-%:OK`(context, start)
+  ;; ../spec/3-typing.watsup:451.1-453.39
+  rule _ {C : context, x : idx}:
+    `%|-%:OK`(C, START(x))
+    -- if (C.FUNC_context[x] = `%->%`([], []))
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:456.1-456.80
+relation Import_ok: `%|-%:%`(context, import, externtype)
+  ;; ../spec/3-typing.watsup:460.1-462.31
+  rule _ {C : context, name_1 : name, name_2 : name, xt : externtype}:
+    `%|-%:%`(C, IMPORT(name_1, name_2, xt), xt)
+    -- Externtype_ok: `|-%:OK`(xt)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:458.1-458.83
+relation Externuse_ok: `%|-%:%`(context, externuse, externtype)
+  ;; ../spec/3-typing.watsup:480.1-482.22
+  rule mem {C : context, mt : memtype, x : idx}:
+    `%|-%:%`(C, MEMORY_externuse(x), MEMORY_externtype(mt))
+    -- if (C.MEM_context[x] = mt)
+
+  ;; ../spec/3-typing.watsup:476.1-478.24
+  rule table {C : context, tt : tabletype, x : idx}:
+    `%|-%:%`(C, TABLE_externuse(x), TABLE_externtype(tt))
+    -- if (C.TABLE_context[x] = tt)
+
+  ;; ../spec/3-typing.watsup:472.1-474.25
+  rule global {C : context, gt : globaltype, x : idx}:
+    `%|-%:%`(C, GLOBAL_externuse(x), GLOBAL_externtype(gt))
+    -- if (C.GLOBAL_context[x] = gt)
+
+  ;; ../spec/3-typing.watsup:468.1-470.23
+  rule func {C : context, ft : functype, x : idx}:
+    `%|-%:%`(C, FUNC_externuse(x), FUNC_externtype(ft))
+    -- if (C.FUNC_context[x] = ft)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:457.1-457.80
+relation Export_ok: `%|-%:%`(context, export, externtype)
+  ;; ../spec/3-typing.watsup:464.1-466.39
+  rule _ {C : context, externuse : externuse, name : name, xt : externtype}:
+    `%|-%:%`(C, EXPORT(name, externuse), xt)
+    -- Externuse_ok: `%|-%:%`(C, externuse, xt)
+-}
+
+
+{-
+;; ../spec/3-typing.watsup:485.1-485.62
+relation Module_ok: `|-%:OK`(module)
+  ;; ../spec/3-typing.watsup:487.1-499.22
+  rule _ {C : context, data : data, elem : elem, export : export, ft : functype, func : func, global : global, gt : globaltype, import : import, mem : mem, mt : memtype, n : n, rt : reftype, start : start, table : table, tt : tabletype}:
+    `|-%:OK`(MODULE(import*, func*, global*, table*, mem*, elem*, data^n, start*, export*))
+    -- (Func_ok: `%|-%:%`(C, func, ft))*
+    -- (Global_ok: `%|-%:%`(C, global, gt))*
+    -- (Table_ok: `%|-%:%`(C, table, tt))*
+    -- (Mem_ok: `%|-%:%`(C, mem, mt))*
+    -- (Elem_ok: `%|-%:%`(C, elem, rt))*
+    -- (Data_ok: `%|-%:OK`(C, data))^n
+    -- (Start_ok: `%|-%:OK`(C, start))*
+    -- if (C = {FUNC ft*, GLOBAL gt*, TABLE tt*, MEM mt*, ELEM rt*, DATA OK^n, LOCAL [], LABEL [], RETURN ?()})
+    -- if (|mem*| <= 1)
+    -- if (|start*| <= 1)
+-}
+
+
+{-
+;; ../spec/4-runtime.watsup:3.1-3.39
+syntax addr = nat
+-}
+type Addr = Natural
+
+{-
+;; ../spec/4-runtime.watsup:4.1-4.53
+syntax funcaddr = addr
+-}
+type Funcaddr = Addr
+
+{-
+;; ../spec/4-runtime.watsup:5.1-5.53
+syntax globaladdr = addr
+-}
+type Globaladdr = Addr
+
+{-
+;; ../spec/4-runtime.watsup:6.1-6.51
+syntax tableaddr = addr
+-}
+type Tableaddr = Addr
+
+{-
+;; ../spec/4-runtime.watsup:7.1-7.50
+syntax memaddr = addr
+-}
+type Memaddr = Addr
+
+{-
+;; ../spec/4-runtime.watsup:8.1-8.49
+syntax elemaddr = addr
+-}
+type Elemaddr = Addr
+
+{-
+;; ../spec/4-runtime.watsup:9.1-9.49
+syntax dataaddr = addr
+-}
+type Dataaddr = Addr
+
+{-
+;; ../spec/4-runtime.watsup:10.1-10.51
+syntax labeladdr = addr
+-}
+type Labeladdr = Addr
+
+{-
+;; ../spec/4-runtime.watsup:11.1-11.49
+syntax hostaddr = addr
+-}
+type Hostaddr = Addr
+
+{-
+;; ../spec/4-runtime.watsup:24.1-25.24
+syntax num =
+  | CONST(numtype, c_numtype)
+-}
+data Num
+ = Num_CONST (Numtype, C_numtype)
+
+{-
+;; ../spec/4-runtime.watsup:26.1-27.67
+syntax ref =
+  | REF.NULL(reftype)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+-}
+data Ref
+ = Ref_REF_NULL Reftype
+ | Ref_REF_FUNC_ADDR Funcaddr
+ | Ref_REF_HOST_ADDR Hostaddr
+
+{-
+;; ../spec/4-runtime.watsup:28.1-29.10
+syntax val =
+  | num
+  | ref
+-}
+data Val
+ = Val_of_Num Num
+ | Val_of_Ref Ref
+
+{-
+;; ../spec/4-runtime.watsup:31.1-32.18
+syntax result =
+  | _VALS(val*)
+  | TRAP
+-}
+data Result
+ = Result_VALS [Val]
+ | Result_TRAP
+
+{-
+;; ../spec/4-runtime.watsup:38.1-39.66
+syntax externval =
+  | FUNC(funcaddr)
+  | GLOBAL(globaladdr)
+  | TABLE(tableaddr)
+  | MEM(memaddr)
+-}
+data Externval
+ = Externval_FUNC Funcaddr
+ | Externval_GLOBAL Globaladdr
+ | Externval_TABLE Tableaddr
+ | Externval_MEM Memaddr
+
+{-
+;; ../spec/4-runtime.watsup:44.1-44.44
+def default_ : valtype -> val
+  ;; ../spec/4-runtime.watsup:49.1-49.34
+  def {rt : reftype} default_(rt <: valtype) = REF.NULL_val(rt)
+  ;; ../spec/4-runtime.watsup:48.1-48.35
+  def default_(F64_valtype) = CONST_val(F64_numtype, 0)
+  ;; ../spec/4-runtime.watsup:47.1-47.35
+  def default_(F32_valtype) = CONST_val(F32_numtype, 0)
+  ;; ../spec/4-runtime.watsup:46.1-46.35
+  def default_(I64_valtype) = CONST_val(I64_numtype, 0)
+  ;; ../spec/4-runtime.watsup:45.1-45.35
+  def default_(I32_valtype) = CONST_val(I32_numtype, 0)
+-}
+default_ :: Valtype -> Val
+default_ (Valtype_of_Reftype rt) = (Val_of_Ref (Ref_REF_NULL rt))
+default_ (Valtype_of_Numtype Numtype_F64) = (Val_of_Num (Num_CONST (Numtype_F64, 0)))
+default_ (Valtype_of_Numtype Numtype_F32) = (Val_of_Num (Num_CONST (Numtype_F32, 0)))
+default_ (Valtype_of_Numtype Numtype_I64) = (Val_of_Num (Num_CONST (Numtype_I64, 0)))
+default_ (Valtype_of_Numtype Numtype_I32) = (Val_of_Num (Num_CONST (Numtype_I32, 0)))
+
+{-
+;; ../spec/4-runtime.watsup:60.1-60.71
+syntax exportinst = EXPORT(name, externval)
+-}
+type Exportinst = {- mixop: EXPORT -} (Name, Externval)
+
+{-
+;; ../spec/4-runtime.watsup:70.1-77.25
+syntax moduleinst = {FUNC funcaddr*, GLOBAL globaladdr*, TABLE tableaddr*, MEM memaddr*, ELEM elemaddr*, DATA dataaddr*, EXPORT exportinst*}
+-}
+data Moduleinst = MkModuleinst
+ { fUNC :: [Funcaddr]
+ , gLOBAL :: [Globaladdr]
+ , tABLE :: [Tableaddr]
+ , mEM :: [Memaddr]
+ , eLEM :: [Elemaddr]
+ , dATA :: [Dataaddr]
+ , eXPORT :: [Exportinst]
+ }
+
+{-
+;; ../spec/4-runtime.watsup:54.1-54.66
+syntax funcinst = `%;%`(moduleinst, func)
+-}
+type Funcinst = {- mixop: `%;%` -} (Moduleinst, Func)
+
+{-
+;; ../spec/4-runtime.watsup:55.1-55.53
+syntax globalinst = val
+-}
+type Globalinst = Val
+
+{-
+;; ../spec/4-runtime.watsup:56.1-56.52
+syntax tableinst = ref*
+-}
+type Tableinst = [Ref]
+
+{-
+;; ../spec/4-runtime.watsup:57.1-57.52
+syntax meminst = byte*
+-}
+type Meminst = [Byte]
+
+{-
+;; ../spec/4-runtime.watsup:58.1-58.53
+syntax eleminst = ref*
+-}
+type Eleminst = [Ref]
+
+{-
+;; ../spec/4-runtime.watsup:59.1-59.51
+syntax datainst = byte*
+-}
+type Datainst = [Byte]
+
+{-
+;; ../spec/4-runtime.watsup:62.1-68.21
+syntax store = {FUNC funcinst*, GLOBAL globalinst*, TABLE tableinst*, MEM meminst*, ELEM eleminst*, DATA datainst*}
+-}
+data Store = MkStore
+ { fUNC :: [Funcinst]
+ , gLOBAL :: [Globalinst]
+ , tABLE :: [Tableinst]
+ , mEM :: [Meminst]
+ , eLEM :: [Eleminst]
+ , dATA :: [Datainst]
+ }
+
+{-
+;; ../spec/4-runtime.watsup:79.1-81.24
+syntax frame = {LOCAL val*, MODULE moduleinst}
+-}
+data Frame = MkFrame
+ { lOCAL :: [Val]
+ , mODULE :: Moduleinst
+ }
+
+{-
+;; ../spec/4-runtime.watsup:82.1-82.47
+syntax state = `%;%`(store, frame)
+-}
+type State = {- mixop: `%;%` -} (Store, Frame)
+
+{-
+;; ../spec/4-runtime.watsup:130.1-137.5
+rec {
+
+;; ../spec/4-runtime.watsup:130.1-137.5
+syntax admininstr =
+  | instr
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+  | CALL_ADDR(funcaddr)
+  | LABEL_(n, instr*, admininstr*)
+  | FRAME_(n, frame, admininstr*)
+  | TRAP
+}
+-}
+{-
+;; ../spec/4-runtime.watsup:130.1-137.5
+syntax admininstr =
+  | instr
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+  | CALL_ADDR(funcaddr)
+  | LABEL_(n, instr*, admininstr*)
+  | FRAME_(n, frame, admininstr*)
+  | TRAP
+-}
+data Admininstr
+ = Admininstr_of_Instr Instr
+ | Admininstr_REF_FUNC_ADDR Funcaddr
+ | Admininstr_REF_HOST_ADDR Hostaddr
+ | Admininstr_CALL_ADDR Funcaddr
+ | Admininstr_LABEL_ (N, [Instr], [Admininstr])
+ | Admininstr_FRAME_ (N, Frame, [Admininstr])
+ | Admininstr_TRAP
+
+{-
+;; ../spec/4-runtime.watsup:83.1-83.62
+syntax config = `%;%`(state, admininstr*)
+-}
+type Config = {- mixop: `%;%` -} (State, [Admininstr])
+
+{-
+;; ../spec/4-runtime.watsup:98.1-98.59
+def funcaddr : state -> funcaddr*
+  ;; ../spec/4-runtime.watsup:99.1-99.38
+  def {f : frame, s : store} funcaddr(`%;%`(s, f)) = f.MODULE_frame.FUNC_moduleinst
+-}
+funcaddr :: State -> [Funcaddr]
+funcaddr (s, f) = f.mODULE.fUNC
+
+{-
+;; ../spec/4-runtime.watsup:101.1-101.52
+def funcinst : state -> funcinst*
+  ;; ../spec/4-runtime.watsup:102.1-102.31
+  def {f : frame, s : store} funcinst(`%;%`(s, f)) = s.FUNC_store
+-}
+funcinst :: State -> [Funcinst]
+funcinst (s, f) = s.fUNC
+
+{-
+;; ../spec/4-runtime.watsup:104.1-104.61
+def func : (state, funcidx) -> funcinst
+  ;; ../spec/4-runtime.watsup:105.1-105.48
+  def {f : frame, s : store, x : idx} func(`%;%`(s, f), x) = s.FUNC_store[f.MODULE_frame.FUNC_moduleinst[x]]
+-}
+func :: (State, Funcidx) -> Funcinst
+func ((s, f), x) = (s.fUNC !! (fromIntegral (f.mODULE.fUNC !! (fromIntegral x))))
+
+{-
+;; ../spec/4-runtime.watsup:107.1-107.59
+def local : (state, localidx) -> val
+  ;; ../spec/4-runtime.watsup:108.1-108.35
+  def {f : frame, s : store, x : idx} local(`%;%`(s, f), x) = f.LOCAL_frame[x]
+-}
+local :: (State, Localidx) -> Val
+local ((s, f), x) = (f.lOCAL !! (fromIntegral x))
+
+{-
+;; ../spec/4-runtime.watsup:110.1-110.69
+def global : (state, globalidx) -> globalinst
+  ;; ../spec/4-runtime.watsup:111.1-111.54
+  def {f : frame, s : store, x : idx} global(`%;%`(s, f), x) = s.GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]]
+-}
+global :: (State, Globalidx) -> Globalinst
+global ((s, f), x) = (s.gLOBAL !! (fromIntegral (f.mODULE.gLOBAL !! (fromIntegral x))))
+
+{-
+;; ../spec/4-runtime.watsup:113.1-113.65
+def table : (state, tableidx) -> tableinst
+  ;; ../spec/4-runtime.watsup:114.1-114.51
+  def {f : frame, s : store, x : idx} table(`%;%`(s, f), x) = s.TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]]
+-}
+table :: (State, Tableidx) -> Tableinst
+table ((s, f), x) = (s.tABLE !! (fromIntegral (f.mODULE.tABLE !! (fromIntegral x))))
+
+{-
+;; ../spec/4-runtime.watsup:116.1-116.62
+def elem : (state, tableidx) -> eleminst
+  ;; ../spec/4-runtime.watsup:117.1-117.48
+  def {f : frame, s : store, x : idx} elem(`%;%`(s, f), x) = s.ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]]
+-}
+elem :: (State, Tableidx) -> Eleminst
+elem ((s, f), x) = (s.eLEM !! (fromIntegral (f.mODULE.eLEM !! (fromIntegral x))))
+
+{-
+;; ../spec/4-runtime.watsup:119.1-119.76
+def with_local : (state, localidx, val) -> state
+  ;; ../spec/4-runtime.watsup:120.1-120.50
+  def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL[x] = v])
+-}
+with_local :: (State, Localidx, Val) -> State
+with_local ((s, f), x, v) = (s, undefined {- f[LOCAL[x] = v] -})
+
+{-
+;; ../spec/4-runtime.watsup:122.1-122.79
+def with_global : (state, globalidx, val) -> state
+  ;; ../spec/4-runtime.watsup:123.1-123.69
+  def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
+-}
+with_global :: (State, Globalidx, Val) -> State
+with_global ((s, f), x, v) = (undefined {- s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v] -}, f)
+
+{-
+;; ../spec/4-runtime.watsup:125.1-125.84
+def with_table : (state, tableidx, n, ref) -> state
+  ;; ../spec/4-runtime.watsup:126.1-126.72
+  def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
+-}
+with_table :: (State, Tableidx, N, Ref) -> State
+with_table ((s, f), x, i, r) = (undefined {- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r] -}, f)
+
+{-
+;; ../spec/4-runtime.watsup:139.1-142.21
+rec {
+
+;; ../spec/4-runtime.watsup:139.1-142.21
+syntax E =
+  | _HOLE
+  | _SEQ(val*, E, instr*)
+  | LABEL_(n, instr*, E)
+}
+-}
+{-
+;; ../spec/4-runtime.watsup:139.1-142.21
+syntax E =
+  | _HOLE
+  | _SEQ(val*, E, instr*)
+  | LABEL_(n, instr*, E)
+-}
+data E
+ = E_HOLE
+ | E_SEQ ([Val], E, [Instr])
+ | E_LABEL_ (N, [Instr], E)
+
+{-
+;; ../spec/5-reduction.watsup:4.1-4.63
+relation Step_pure: `%~>%`(admininstr*, admininstr*)
+  ;; ../spec/5-reduction.watsup:86.1-88.18
+  rule br_table-ge {i : nat, l : labelidx, l' : labelidx}:
+    `%~>%`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*, l')], [BR_admininstr(l')])
+    -- if (i >= |l*|)
+
+  ;; ../spec/5-reduction.watsup:82.1-84.17
+  rule br_table-lt {i : nat, l : labelidx, l' : labelidx}:
+    `%~>%`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*, l')], [BR_admininstr(l*[i])])
+    -- if (i < |l*|)
+
+  ;; ../spec/5-reduction.watsup:77.1-79.14
+  rule br_if-false {c : c_numtype, l : labelidx}:
+    `%~>%`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)], [])
+    -- if (c = 0)
+
+  ;; ../spec/5-reduction.watsup:73.1-75.16
+  rule br_if-true {c : c_numtype, l : labelidx}:
+    `%~>%`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)], [BR_admininstr(l)])
+    -- if (c =/= 0)
+
+  ;; ../spec/5-reduction.watsup:69.1-70.65
+  rule br-succ {instr : instr, instr' : instr, l : labelidx, n : n, val : val}:
+    `%~>%`([LABEL__admininstr(n, instr'*, (val <: admininstr)* :: [BR_admininstr(l + 1)] :: (instr <: admininstr)*)], (val <: admininstr)* :: [BR_admininstr(l)])
+
+  ;; ../spec/5-reduction.watsup:66.1-67.69
+  rule br-zero {instr : instr, instr' : instr, n : n, val : val, val' : val}:
+    `%~>%`([LABEL__admininstr(n, instr'*, (val' <: admininstr)* :: (val <: admininstr)^n :: [BR_admininstr(0)] :: (instr <: admininstr)*)], (val <: admininstr)^n :: (instr' <: admininstr)*)
+
+  ;; ../spec/5-reduction.watsup:61.1-63.14
+  rule if-false {bt : blocktype, c : c_numtype, instr_1 : instr, instr_2 : instr}:
+    `%~>%`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*, instr_2*)], [BLOCK_admininstr(bt, instr_2*)])
+    -- if (c = 0)
+
+  ;; ../spec/5-reduction.watsup:57.1-59.16
+  rule if-true {bt : blocktype, c : c_numtype, instr_1 : instr, instr_2 : instr}:
+    `%~>%`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*, instr_2*)], [BLOCK_admininstr(bt, instr_1*)])
+    -- if (c =/= 0)
+
+  ;; ../spec/5-reduction.watsup:53.1-55.28
+  rule loop {bt : blocktype, instr : instr, k : nat, n : n, t_1 : valtype, t_2 : valtype, val : val}:
+    `%~>%`((val <: admininstr)^k :: [LOOP_admininstr(bt, instr*)], [LABEL__admininstr(n, [LOOP_instr(bt, instr*)], (val <: admininstr)^k :: (instr <: admininstr)*)])
+    -- if (bt = `%->%`(t_1^k, t_2^n))
+
+  ;; ../spec/5-reduction.watsup:49.1-51.28
+  rule block {bt : blocktype, instr : instr, k : nat, n : n, t_1 : valtype, t_2 : valtype, val : val}:
+    `%~>%`((val <: admininstr)^k :: [BLOCK_admininstr(bt, instr*)], [LABEL__admininstr(n, [], (val <: admininstr)^k :: (instr <: admininstr)*)])
+    -- if (bt = `%->%`(t_1^k, t_2^n))
+
+  ;; ../spec/5-reduction.watsup:46.1-47.47
+  rule local.tee {val : val, x : idx}:
+    `%~>%`([(val <: admininstr) LOCAL.TEE_admininstr(x)], [(val <: admininstr) (val <: admininstr) LOCAL.SET_admininstr(x)])
+
+  ;; ../spec/5-reduction.watsup:42.1-44.14
+  rule select-false {c : c_numtype, t : valtype, val_1 : val, val_2 : val}:
+    `%~>%`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?)], [(val_2 <: admininstr)])
+    -- if (c = 0)
+
+  ;; ../spec/5-reduction.watsup:38.1-40.16
+  rule select-true {c : c_numtype, t : valtype, val_1 : val, val_2 : val}:
+    `%~>%`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?)], [(val_1 <: admininstr)])
+    -- if (c =/= 0)
+
+  ;; ../spec/5-reduction.watsup:35.1-36.24
+  rule drop {val : val}:
+    `%~>%`([(val <: admininstr) DROP_admininstr], [])
+
+  ;; ../spec/5-reduction.watsup:32.1-33.19
+  rule nop:
+    `%~>%`([NOP_admininstr], [])
+
+  ;; ../spec/5-reduction.watsup:29.1-30.24
+  rule unreachable:
+    `%~>%`([UNREACHABLE_admininstr], [TRAP_admininstr])
+
+  ;; ../spec/5-reduction.watsup:25.1-27.15
+  rule ref.is_null-false {val : val}:
+    `%~>%`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
+    -- otherwise
+
+  ;; ../spec/5-reduction.watsup:21.1-23.26
+  rule ref.is_null-true {rt : reftype, val : val}:
+    `%~>%`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
+    -- if (val = REF.NULL_val(rt))
+-}
+
+
+{-
+;; ../spec/5-reduction.watsup:5.1-5.63
+relation Step_read: `%~>%`(config, admininstr*)
+  ;; ../spec/5-reduction.watsup:165.1-167.61
+  rule call_addr {a : addr, instr : instr, k : nat, m : moduleinst, n : n, t : valtype, t_1 : valtype, t_2 : valtype, val : val, z : state}:
+    `%~>%`(`%;%`(z, (val <: admininstr)^k :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, {LOCAL val^k :: $default_(t)*, MODULE m}, [LABEL__admininstr(n, [], (instr <: admininstr)*)])])
+    -- if ($funcinst(z)[a] = `%;%`(m, FUNC(`%->%`(t_1^k, t_2^n), t*, instr*)))
+
+  ;; ../spec/5-reduction.watsup:161.1-163.15
+  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
+    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [TRAP_admininstr])
+    -- otherwise
+
+  ;; ../spec/5-reduction.watsup:156.1-159.34
+  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
+    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [CALL_ADDR_admininstr(a)])
+    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
+    -- if ($funcinst(z)[a] = `%;%`(m, func))
+
+  ;; ../spec/5-reduction.watsup:153.1-154.47
+  rule call {x : idx, z : state}:
+    `%~>%`(`%;%`(z, [CALL_admininstr(x)]), [CALL_ADDR_admininstr($funcaddr(z)[x])])
+
+  ;; ../spec/5-reduction.watsup:147.1-151.15
+  rule table.init-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, (n + 1)) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) ($elem(z, y)[i] <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)])
+    -- otherwise
+
+  ;; ../spec/5-reduction.watsup:144.1-146.15
+  rule table.init-zero {i : nat, j : nat, x : idx, y : idx, z : state}:
+    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, 0) TABLE.INIT_admininstr(x, y)]), [])
+    -- otherwise
+
+  ;; ../spec/5-reduction.watsup:141.1-143.62
+  rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [TRAP_admininstr])
+    -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; ../spec/5-reduction.watsup:134.1-139.14
+  rule table.copy-gt {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, (n + 1)) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, (j + n)) CONST_admininstr(I32_numtype, (i + n)) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)])
+    -- if (i > i)
+
+  ;; ../spec/5-reduction.watsup:128.1-133.15
+  rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, (n + 1)) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)])
+    -- if (j <= i)
+
+  ;; ../spec/5-reduction.watsup:125.1-127.15
+  rule table.copy-zero {i : nat, j : nat, x : idx, y : idx, z : state}:
+    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, 0) TABLE.COPY_admininstr(x, y)]), [])
+    -- otherwise
+
+  ;; ../spec/5-reduction.watsup:122.1-124.63
+  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [TRAP_admininstr])
+    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; ../spec/5-reduction.watsup:117.1-120.15
+  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, (n + 1)) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) (val <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)])
+    -- otherwise
+
+  ;; ../spec/5-reduction.watsup:114.1-116.15
+  rule table.fill-zero {i : nat, val : val, x : idx, z : state}:
+    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, 0) TABLE.FILL_admininstr(x)]), [])
+    -- otherwise
+
+  ;; ../spec/5-reduction.watsup:111.1-113.34
+  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
+    -- if ((i + n) > |$table(z, x)|)
+
+  ;; ../spec/5-reduction.watsup:107.1-109.27
+  rule table.size {n : n, x : idx, z : state}:
+    `%~>%`(`%;%`(z, [TABLE.SIZE_admininstr(x)]), [CONST_admininstr(I32_numtype, n)])
+    -- if (|$table(z, x)| = n)
+
+  ;; ../spec/5-reduction.watsup:103.1-105.27
+  rule table.get-lt {i : nat, x : idx, z : state}:
+    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [($table(z, x)[i] <: admininstr)])
+    -- if (i < |$table(z, x)|)
+
+  ;; ../spec/5-reduction.watsup:99.1-101.28
+  rule table.get-ge {i : nat, x : idx, z : state}:
+    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    -- if (i >= |$table(z, x)|)
+
+  ;; ../spec/5-reduction.watsup:96.1-97.37
+  rule global.get {x : idx, z : state}:
+    `%~>%`(`%;%`(z, [GLOBAL.GET_admininstr(x)]), [($global(z, x) <: admininstr)])
+
+  ;; ../spec/5-reduction.watsup:93.1-94.35
+  rule local.get {x : idx, z : state}:
+    `%~>%`(`%;%`(z, [LOCAL.GET_admininstr(x)]), [($local(z, x) <: admininstr)])
+
+  ;; ../spec/5-reduction.watsup:90.1-91.53
+  rule ref.func {x : idx, z : state}:
+    `%~>%`(`%;%`(z, [REF.FUNC_admininstr(x)]), [REF.FUNC_ADDR_admininstr($funcaddr(z)[x])])
+-}
+
+
+{-
+;; ../spec/5-reduction.watsup:6.1-6.63
+relation Step_write: `%~>%`(config, config)
+  ;; ../spec/5-reduction.watsup:179.1-181.28
+  rule table.set-ge {i : nat, ref : ref, x : idx, z : state}:
+    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), `%;%`(z, [TRAP_admininstr]))
+    -- if (i >= |$table(z, x)|)
+
+  ;; ../spec/5-reduction.watsup:175.1-177.27
+  rule table.set-lt {i : nat, ref : ref, x : idx, z : state}:
+    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), `%;%`($with_table(z, x, i, ref), []))
+    -- if (i < |$table(z, x)|)
+
+  ;; ../spec/5-reduction.watsup:172.1-173.62
+  rule global.set {val : val, x : idx, z : state}:
+    `%~>%`(`%;%`(z, [(val <: admininstr) GLOBAL.SET_admininstr(x)]), `%;%`($with_global(z, x, val), []))
+
+  ;; ../spec/5-reduction.watsup:169.1-170.60
+  rule local.set {val : val, x : idx, z : state}:
+    `%~>%`(`%;%`(z, [(val <: admininstr) LOCAL.SET_admininstr(x)]), `%;%`($with_local(z, x, val), []))
+-}
+
+
+{-
+;; ../spec/5-reduction.watsup:3.1-3.63
+relation Step: `%~>%`(config, config)
+  ;; ../spec/5-reduction.watsup:16.1-18.42
+  rule write {instr : instr, instr' : instr, z : state, z' : state}:
+    `%~>%`(`%;%`(z, (instr <: admininstr)*), `%;%`(z', (instr' <: admininstr)*))
+    -- Step_write: `%~>%`(`%;%`(z, (instr <: admininstr)*), `%;%`(z', (instr' <: admininstr)*))
+
+  ;; ../spec/5-reduction.watsup:12.1-14.37
+  rule read {instr : instr, instr' : instr, z : state}:
+    `%~>%`(`%;%`(z, (instr <: admininstr)*), `%;%`(z, (instr' <: admininstr)*))
+    -- Step_read: `%~>%`(`%;%`(z, (instr <: admininstr)*), (instr' <: admininstr)*)
+
+  ;; ../spec/5-reduction.watsup:8.1-10.34
+  rule pure {instr : instr, instr' : instr, z : state}:
+    `%~>%`(`%;%`(z, (instr <: admininstr)*), `%;%`(z, (instr' <: admininstr)*))
+    -- Step_pure: `%~>%`((instr <: admininstr)*, (instr' <: admininstr)*)
+-}
+$ ghc -c Test.hs
+```
diff --git a/spectec/test-haskell/dune b/spectec/test-haskell/dune
new file mode 100644
index 0000000000..0fd2d4f0b0
--- /dev/null
+++ b/spectec/test-haskell/dune
@@ -0,0 +1,8 @@
+(mdx
+  (libraries spectec)
+  (deps
+    (file ../src/exe-haskell/main.exe)
+    (glob_files ../spec/*.watsup)
+  )
+  (files TEST.md)
+)
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
new file mode 100644
index 0000000000..aedecf8b58
--- /dev/null
+++ b/spectec/test-lean4/TEST.md
@@ -0,0 +1,1003 @@
+# Preview
+
+```sh
+$ dune exec ../src/exe-lean4/main.exe -- ../spec/*.watsup -o Test.lean
+$ cat Test.lean
+/- Lean 4 export -/
+
+instance : Append (Option a) where
+  append := fun o1 o2 => match o1 with | none => o2 | _ => o1
+
+@[reducible] def N := Nat
+
+@[reducible] def Name := String
+
+@[reducible] def Byte := Nat
+
+@[reducible] def U32 := Nat
+
+@[reducible] def Idx := Nat
+
+@[reducible] def Funcidx := Idx
+
+@[reducible] def Globalidx := Idx
+
+@[reducible] def Tableidx := Idx
+
+@[reducible] def Memidx := Idx
+
+@[reducible] def Elemidx := Idx
+
+@[reducible] def Dataidx := Idx
+
+@[reducible] def Labelidx := Idx
+
+@[reducible] def Localidx := Idx
+
+inductive Numtype where
+ | I32 : Numtype
+ | I64 : Numtype
+ | F32 : Numtype
+ | F64 : Numtype
+  deriving Inhabited, BEq
+
+inductive Vectype where
+ | V128 : Vectype
+  deriving Inhabited, BEq
+
+inductive Reftype where
+ | FUNCREF : Reftype
+ | EXTERNREF : Reftype
+  deriving Inhabited, BEq
+
+inductive Valtype where
+ | Numtype : Numtype -> Valtype
+ | Vectype : Vectype -> Valtype
+ | Reftype : Reftype -> Valtype
+ | BOT : Valtype
+  deriving Inhabited, BEq
+
+inductive In where
+ | I32 : In
+ | I64 : In
+  deriving Inhabited, BEq
+
+inductive Fn where
+ | F32 : Fn
+ | F64 : Fn
+  deriving Inhabited, BEq
+
+@[reducible] def Resulttype := (List Valtype)
+
+@[reducible] def Limits := /- mixop: `[%..%]` -/ (U32 × U32)
+
+@[reducible] def Globaltype := /- mixop: `MUT%?%` -/ ((Option Unit) × Valtype)
+
+@[reducible] def Functype := /- mixop: `%->%` -/ (Resulttype × Resulttype)
+
+@[reducible] def Tabletype := /- mixop: `%%` -/ (Limits × Reftype)
+
+@[reducible] def Memtype := /- mixop: `%I8` -/ Limits
+
+@[reducible] def Elemtype := Reftype
+
+@[reducible] def Datatype := /- mixop: OK -/ Unit
+
+inductive Externtype where
+ | GLOBAL : Globaltype -> Externtype
+ | FUNC : Functype -> Externtype
+ | TABLE : Tabletype -> Externtype
+ | MEMORY : Memtype -> Externtype
+  deriving Inhabited, BEq
+
+inductive Sx where
+ | U : Sx
+ | S : Sx
+  deriving Inhabited, BEq
+
+inductive Unop_IXX where
+ | CLZ : Unop_IXX
+ | CTZ : Unop_IXX
+ | POPCNT : Unop_IXX
+  deriving Inhabited, BEq
+
+inductive Unop_FXX where
+ | ABS : Unop_FXX
+ | NEG : Unop_FXX
+ | SQRT : Unop_FXX
+ | CEIL : Unop_FXX
+ | FLOOR : Unop_FXX
+ | TRUNC : Unop_FXX
+ | NEAREST : Unop_FXX
+  deriving Inhabited, BEq
+
+inductive Binop_IXX where
+ | ADD : Binop_IXX
+ | SUB : Binop_IXX
+ | MUL : Binop_IXX
+ | DIV : Sx -> Binop_IXX
+ | REM : Sx -> Binop_IXX
+ | AND : Binop_IXX
+ | OR : Binop_IXX
+ | XOR : Binop_IXX
+ | SHL : Binop_IXX
+ | SHR : Sx -> Binop_IXX
+ | ROTL : Binop_IXX
+ | ROTR : Binop_IXX
+  deriving Inhabited, BEq
+
+inductive Binop_FXX where
+ | ADD : Binop_FXX
+ | SUB : Binop_FXX
+ | MUL : Binop_FXX
+ | DIV : Binop_FXX
+ | MIN : Binop_FXX
+ | MAX : Binop_FXX
+ | COPYSIGN : Binop_FXX
+  deriving Inhabited, BEq
+
+inductive Testop_IXX where
+ | EQZ : Testop_IXX
+  deriving Inhabited, BEq
+
+inductive Testop_FXX where
+  deriving BEq
+
+inductive Relop_IXX where
+ | EQ : Relop_IXX
+ | NE : Relop_IXX
+ | LT : Sx -> Relop_IXX
+ | GT : Sx -> Relop_IXX
+ | LE : Sx -> Relop_IXX
+ | GE : Sx -> Relop_IXX
+  deriving Inhabited, BEq
+
+inductive Relop_FXX where
+ | EQ : Relop_FXX
+ | NE : Relop_FXX
+ | LT : Relop_FXX
+ | GT : Relop_FXX
+ | LE : Relop_FXX
+ | GE : Relop_FXX
+  deriving Inhabited, BEq
+
+inductive Unop_numtype where
+ | _I : Unop_IXX -> Unop_numtype
+ | _F : Unop_FXX -> Unop_numtype
+  deriving Inhabited, BEq
+
+inductive Binop_numtype where
+ | _I : Binop_IXX -> Binop_numtype
+ | _F : Binop_FXX -> Binop_numtype
+  deriving Inhabited, BEq
+
+inductive Testop_numtype where
+ | _I : Testop_IXX -> Testop_numtype
+ | _F : Testop_FXX -> Testop_numtype
+  deriving Inhabited, BEq
+
+inductive Relop_numtype where
+ | _I : Relop_IXX -> Relop_numtype
+ | _F : Relop_FXX -> Relop_numtype
+  deriving Inhabited, BEq
+
+inductive Cvtop where
+ | CONVERT : Cvtop
+ | REINTERPRET : Cvtop
+  deriving Inhabited, BEq
+
+@[reducible] def C_numtype := Nat
+
+@[reducible] def C_vectype := Nat
+
+@[reducible] def Blocktype := Functype
+
+inductive Instr where
+ | UNREACHABLE : Instr
+ | NOP : Instr
+ | DROP : Instr
+ | SELECT : (Option Valtype) -> Instr
+ | BLOCK : (Blocktype × (List Instr)) -> Instr
+ | LOOP : (Blocktype × (List Instr)) -> Instr
+ | IF : (Blocktype × (List Instr) × (List Instr)) -> Instr
+ | BR : Labelidx -> Instr
+ | BR_IF : Labelidx -> Instr
+ | BR_TABLE : ((List Labelidx) × Labelidx) -> Instr
+ | CALL : Funcidx -> Instr
+ | CALL_INDIRECT : (Tableidx × Functype) -> Instr
+ | RETURN : Instr
+ | CONST : (Numtype × C_numtype) -> Instr
+ | UNOP : (Numtype × Unop_numtype) -> Instr
+ | BINOP : (Numtype × Binop_numtype) -> Instr
+ | TESTOP : (Numtype × Testop_numtype) -> Instr
+ | RELOP : (Numtype × Relop_numtype) -> Instr
+ | EXTEND : (Numtype × N) -> Instr
+ | CVTOP : (Numtype × Cvtop × Numtype × (Option Sx)) -> Instr
+ | REF_NULL : Reftype -> Instr
+ | REF_FUNC : Funcidx -> Instr
+ | REF_IS_NULL : Instr
+ | LOCAL_GET : Localidx -> Instr
+ | LOCAL_SET : Localidx -> Instr
+ | LOCAL_TEE : Localidx -> Instr
+ | GLOBAL_GET : Globalidx -> Instr
+ | GLOBAL_SET : Globalidx -> Instr
+ | TABLE_GET : Tableidx -> Instr
+ | TABLE_SET : Tableidx -> Instr
+ | TABLE_SIZE : Tableidx -> Instr
+ | TABLE_GROW : Tableidx -> Instr
+ | TABLE_FILL : Tableidx -> Instr
+ | TABLE_COPY : (Tableidx × Tableidx) -> Instr
+ | TABLE_INIT : (Tableidx × Elemidx) -> Instr
+ | ELEM_DROP : Elemidx -> Instr
+ | MEMORY_SIZE : Instr
+ | MEMORY_GROW : Instr
+ | MEMORY_FILL : Instr
+ | MEMORY_COPY : Instr
+ | MEMORY_INIT : Dataidx -> Instr
+ | DATA_DROP : Dataidx -> Instr
+ | LOAD : (Numtype × (Option (N × Sx)) × Nat × Nat) -> Instr
+ | STORE : (Numtype × (Option N) × Nat × Nat) -> Instr
+  deriving Inhabited, BEq
+
+@[reducible] def Expr := (List Instr)
+
+inductive Elemmode where
+ | TABLE : (Tableidx × Expr) -> Elemmode
+ | DECLARE : Elemmode
+  deriving Inhabited, BEq
+
+inductive Datamode where
+ | MEMORY : (Memidx × Expr) -> Datamode
+  deriving Inhabited, BEq
+
+@[reducible] def Func := /- mixop: FUNC -/ (Functype × (List Valtype) × Expr)
+
+@[reducible] def Global := /- mixop: GLOBAL -/ (Globaltype × Expr)
+
+@[reducible] def Table := /- mixop: TABLE -/ Tabletype
+
+@[reducible] def Mem := /- mixop: MEMORY -/ Memtype
+
+@[reducible] def Elem := /- mixop: ELEM -/ (Reftype × (List Expr) × (Option Elemmode))
+
+@[reducible] def Data := /- mixop: DATA -/ ((List (List Byte)) × (Option Datamode))
+
+@[reducible] def Start := /- mixop: START -/ Funcidx
+
+inductive Externuse where
+ | FUNC : Funcidx -> Externuse
+ | GLOBAL : Globalidx -> Externuse
+ | TABLE : Tableidx -> Externuse
+ | MEMORY : Memidx -> Externuse
+  deriving Inhabited, BEq
+
+@[reducible] def Export := /- mixop: EXPORT -/ (Name × Externuse)
+
+@[reducible] def Import := /- mixop: IMPORT -/ (Name × Name × Externtype)
+
+@[reducible] def Module := /- mixop: MODULE -/ ((List Import) × (List Func) × (List Global) × (List Table) × (List Mem) × (List Elem) × (List Data) × (List Start) × (List Export))
+
+def size : Valtype -> Nat
+  | (Valtype.Vectype Vectype.V128) => 128
+  | (Valtype.Numtype Numtype.F64) => 64
+  | (Valtype.Numtype Numtype.F32) => 32
+  | (Valtype.Numtype Numtype.I64) => 64
+  | (Valtype.Numtype Numtype.I32) => 32
+  | _ => default
+
+def test_sub_ATOM_22 : N -> Nat
+  | n_3_ATOM_y => 0
+
+def curried_ : (N × N) -> Nat
+  | (n_1, n_2) => (n_1 + n_2)
+
+inductive Testfuse where
+ | AB_ : (Nat × Nat × Nat) -> Testfuse
+ | CD : (Nat × Nat × Nat) -> Testfuse
+ | EF : (Nat × Nat × Nat) -> Testfuse
+ | GH : (Nat × Nat × Nat) -> Testfuse
+ | IJ : (Nat × Nat × Nat) -> Testfuse
+ | KL : (Nat × Nat × Nat) -> Testfuse
+ | MN : (Nat × Nat × Nat) -> Testfuse
+ | OP : (Nat × Nat × Nat) -> Testfuse
+ | QR : (Nat × Nat × Nat) -> Testfuse
+  deriving Inhabited, BEq
+
+structure Context where
+  FUNC : (List Functype)
+  GLOBAL : (List Globaltype)
+  TABLE : (List Tabletype)
+  MEM : (List Memtype)
+  ELEM : (List Elemtype)
+  DATA : (List Datatype)
+  LOCAL : (List Valtype)
+  LABEL : (List Resulttype)
+  RETURN : (Option Resulttype)
+  deriving Inhabited, BEq
+instance : Append Context where
+  append := fun r1 r2 => {
+    FUNC := r1.FUNC ++ r2.FUNC,
+    GLOBAL := r1.GLOBAL ++ r2.GLOBAL,
+    TABLE := r1.TABLE ++ r2.TABLE,
+    MEM := r1.MEM ++ r2.MEM,
+    ELEM := r1.ELEM ++ r2.ELEM,
+    DATA := r1.DATA ++ r2.DATA,
+    LOCAL := r1.LOCAL ++ r2.LOCAL,
+    LABEL := r1.LABEL ++ r2.LABEL,
+    RETURN := r1.RETURN ++ r2.RETURN,
+  }
+
+inductive Limits_ok : (Limits × Nat) -> Prop where
+  | rule_0 (k : Nat) (n_1 : N) (n_2 : N) :
+    ((n_1 <= n_2) && (n_2 <= k)) ->
+    (Limits_ok ((n_1, n_2), k))
+
+inductive Functype_ok : Functype -> Prop where
+  | rule_0 (ft : Functype) :
+    (Functype_ok ft)
+
+inductive Globaltype_ok : Globaltype -> Prop where
+  | rule_0 (gt : Globaltype) :
+    (Globaltype_ok gt)
+
+inductive Tabletype_ok : Tabletype -> Prop where
+  | rule_0 (lim : Limits) (rt : Reftype) :
+    (Limits_ok (lim, ((((Nat.pow 2) 32)) - 1))) ->
+    (Tabletype_ok (lim, rt))
+
+inductive Memtype_ok : Memtype -> Prop where
+  | rule_0 (lim : Limits) :
+    (Limits_ok (lim, (((Nat.pow 2) 16)))) ->
+    (Memtype_ok lim)
+
+inductive Externtype_ok : Externtype -> Prop where
+  | mem (memtype : Memtype) :
+    (Memtype_ok memtype) ->
+    (Externtype_ok (Externtype.MEMORY memtype))
+  | table (tabletype : Tabletype) :
+    (Tabletype_ok tabletype) ->
+    (Externtype_ok (Externtype.TABLE tabletype))
+  | global (globaltype : Globaltype) :
+    (Globaltype_ok globaltype) ->
+    (Externtype_ok (Externtype.GLOBAL globaltype))
+  | func (functype : Functype) :
+    (Functype_ok functype) ->
+    (Externtype_ok (Externtype.FUNC functype))
+
+inductive Valtype_sub : (Valtype × Valtype) -> Prop where
+  | bot (t : Valtype) :
+    (Valtype_sub (Valtype.BOT, t))
+  | refl (t : Valtype) :
+    (Valtype_sub (t, t))
+
+inductive Resulttype_sub : ((List Valtype) × (List Valtype)) -> Prop where
+  | rule_0 (t_1 : Valtype) (t_2 : Valtype) :
+    (Valtype_sub (t_1, t_2)) ->
+    (Resulttype_sub (t_1, t_2))
+
+inductive Limits_sub : (Limits × Limits) -> Prop where
+  | rule_0 (n_11 : N) (n_12 : N) (n_21 : N) (n_22 : N) :
+    (n_11 >= n_21) ->
+    (n_12 <= n_22) ->
+    (Limits_sub ((n_11, n_12), (n_21, n_22)))
+
+inductive Functype_sub : (Functype × Functype) -> Prop where
+  | rule_0 (ft : Functype) :
+    (Functype_sub (ft, ft))
+
+inductive Globaltype_sub : (Globaltype × Globaltype) -> Prop where
+  | rule_0 (gt : Globaltype) :
+    (Globaltype_sub (gt, gt))
+
+inductive Tabletype_sub : (Tabletype × Tabletype) -> Prop where
+  | rule_0 (lim_1 : Limits) (lim_2 : Limits) (rt : Reftype) :
+    (Limits_sub (lim_1, lim_2)) ->
+    (Tabletype_sub ((lim_1, rt), (lim_2, rt)))
+
+inductive Memtype_sub : (Memtype × Memtype) -> Prop where
+  | rule_0 (lim_1 : Limits) (lim_2 : Limits) :
+    (Limits_sub (lim_1, lim_2)) ->
+    (Memtype_sub (lim_1, lim_2))
+
+inductive Externtype_sub : (Externtype × Externtype) -> Prop where
+  | mem (mt_1 : Memtype) (mt_2 : Memtype) :
+    (Memtype_sub (mt_1, mt_2)) ->
+    (Externtype_sub ((Externtype.MEMORY mt_1), (Externtype.MEMORY mt_2)))
+  | table (tt_1 : Tabletype) (tt_2 : Tabletype) :
+    (Tabletype_sub (tt_1, tt_2)) ->
+    (Externtype_sub ((Externtype.TABLE tt_1), (Externtype.TABLE tt_2)))
+  | global (gt_1 : Globaltype) (gt_2 : Globaltype) :
+    (Globaltype_sub (gt_1, gt_2)) ->
+    (Externtype_sub ((Externtype.GLOBAL gt_1), (Externtype.GLOBAL gt_2)))
+  | func (ft_1 : Functype) (ft_2 : Functype) :
+    (Functype_sub (ft_1, ft_2)) ->
+    (Externtype_sub ((Externtype.FUNC ft_1), (Externtype.FUNC ft_2)))
+
+inductive Blocktype_ok : (Context × Blocktype × Functype) -> Prop where
+  | rule_0 (C : Context) (ft : Functype) :
+    (Functype_ok ft) ->
+    (Blocktype_ok (C, ft, ft))
+
+mutual
+inductive Instr_ok : (Context × Instr × Functype) -> Prop where
+  | store (C : Context) («in» : In) (mt : Memtype) (n : N) (n_A : N) (n_O : N) (nt : Numtype) (t : Valtype) :
+    ((C.MEM.get! 0) == mt) ->
+    ((((Nat.pow 2) n_A)) <= (((Nat.div (size t)) 8))) ->
+    (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div (size t)) 8)))) ->
+    ((n == none) || (nt == (Numtype.In «in»))) ->
+    (Instr_ok (C, (Instr.STORE (nt, n, n_A, n_O)), ([(Valtype.Numtype Numtype.I32), (Valtype.Numtype nt)], [])))
+  | load (C : Context) («in» : In) (mt : Memtype) (n : N) (n_A : N) (n_O : N) (nt : Numtype) (sx : Sx) (t : Valtype) :
+    ((C.MEM.get! 0) == mt) ->
+    ((((Nat.pow 2) n_A)) <= (((Nat.div (size t)) 8))) ->
+    (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div (size t)) 8)))) ->
+    ((n == none) || (nt == (Numtype.In «in»))) ->
+    (Instr_ok (C, (Instr.LOAD (nt, (some (n, sx)), n_A, n_O)), ([(Valtype.Numtype Numtype.I32)], [(Valtype.Numtype nt)])))
+  | data_drop (C : Context) (x : Idx) :
+    ((C.DATA.get! x) == ()) ->
+    (Instr_ok (C, (Instr.DATA_DROP x), ([], [])))
+  | memory_init (C : Context) (mt : Memtype) (x : Idx) :
+    ((C.MEM.get! 0) == mt) ->
+    ((C.DATA.get! x) == ()) ->
+    (Instr_ok (C, (Instr.MEMORY_INIT x), ([(Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32)], [(Valtype.Numtype Numtype.I32)])))
+  | memory_copy (C : Context) (mt : Memtype) :
+    ((C.MEM.get! 0) == mt) ->
+    (Instr_ok (C, Instr.MEMORY_COPY, ([(Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32)], [(Valtype.Numtype Numtype.I32)])))
+  | memory_fill (C : Context) (mt : Memtype) :
+    ((C.MEM.get! 0) == mt) ->
+    (Instr_ok (C, Instr.MEMORY_FILL, ([(Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32)], [(Valtype.Numtype Numtype.I32)])))
+  | memory_grow (C : Context) (mt : Memtype) :
+    ((C.MEM.get! 0) == mt) ->
+    (Instr_ok (C, Instr.MEMORY_GROW, ([(Valtype.Numtype Numtype.I32)], [(Valtype.Numtype Numtype.I32)])))
+  | memory_size (C : Context) (mt : Memtype) :
+    ((C.MEM.get! 0) == mt) ->
+    (Instr_ok (C, Instr.MEMORY_SIZE, ([], [(Valtype.Numtype Numtype.I32)])))
+  | elem_drop (C : Context) (rt : Reftype) (x : Idx) :
+    ((C.ELEM.get! x) == rt) ->
+    (Instr_ok (C, (Instr.ELEM_DROP x), ([], [])))
+  | table_init (C : Context) (lim : Limits) (rt : Reftype) (x_1 : Idx) (x_2 : Idx) :
+    ((C.TABLE.get! x_1) == (lim, rt)) ->
+    ((C.ELEM.get! x_2) == rt) ->
+    (Instr_ok (C, (Instr.TABLE_INIT (x_1, x_2)), ([(Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32)], [])))
+  | table_copy (C : Context) (lim_1 : Limits) (lim_2 : Limits) (rt : Reftype) (x_1 : Idx) (x_2 : Idx) :
+    ((C.TABLE.get! x_1) == (lim_1, rt)) ->
+    ((C.TABLE.get! x_2) == (lim_2, rt)) ->
+    (Instr_ok (C, (Instr.TABLE_COPY (x_1, x_2)), ([(Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32)], [])))
+  | table_fill (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
+    ((C.TABLE.get! x) == (lim, rt)) ->
+    (Instr_ok (C, (Instr.TABLE_FILL x), ([(Valtype.Numtype Numtype.I32), (Valtype.Reftype rt), (Valtype.Numtype Numtype.I32)], [])))
+  | table_grow (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
+    ((C.TABLE.get! x) == (lim, rt)) ->
+    (Instr_ok (C, (Instr.TABLE_GROW x), ([(Valtype.Reftype rt), (Valtype.Numtype Numtype.I32)], [(Valtype.Numtype Numtype.I32)])))
+  | table_size (C : Context) (tt : Tabletype) (x : Idx) :
+    ((C.TABLE.get! x) == tt) ->
+    (Instr_ok (C, (Instr.TABLE_SIZE x), ([], [(Valtype.Numtype Numtype.I32)])))
+  | table_set (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
+    ((C.TABLE.get! x) == (lim, rt)) ->
+    (Instr_ok (C, (Instr.TABLE_SET x), ([(Valtype.Numtype Numtype.I32), (Valtype.Reftype rt)], [])))
+  | table_get (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
+    ((C.TABLE.get! x) == (lim, rt)) ->
+    (Instr_ok (C, (Instr.TABLE_GET x), ([(Valtype.Numtype Numtype.I32)], [(Valtype.Reftype rt)])))
+  | global_set (C : Context) (t : Valtype) (x : Idx) :
+    ((C.GLOBAL.get! x) == ((some ()), t)) ->
+    (Instr_ok (C, (Instr.GLOBAL_SET x), ([t], [])))
+  | global_get (C : Context) (t : Valtype) (x : Idx) :
+    ((C.GLOBAL.get! x) == ((some ()), t)) ->
+    (Instr_ok (C, (Instr.GLOBAL_GET x), ([], [t])))
+  | local_tee (C : Context) (t : Valtype) (x : Idx) :
+    ((C.LOCAL.get! x) == t) ->
+    (Instr_ok (C, (Instr.LOCAL_TEE x), ([t], [t])))
+  | local_set (C : Context) (t : Valtype) (x : Idx) :
+    ((C.LOCAL.get! x) == t) ->
+    (Instr_ok (C, (Instr.LOCAL_SET x), ([t], [])))
+  | local_get (C : Context) (t : Valtype) (x : Idx) :
+    ((C.LOCAL.get! x) == t) ->
+    (Instr_ok (C, (Instr.LOCAL_GET x), ([], [t])))
+  | ref_is_null (C : Context) (rt : Reftype) :
+    (Instr_ok (C, Instr.REF_IS_NULL, ([(Valtype.Reftype rt)], [(Valtype.Numtype Numtype.I32)])))
+  | ref_func (C : Context) (ft : Functype) (x : Idx) :
+    ((C.FUNC.get! x) == ft) ->
+    (Instr_ok (C, (Instr.REF_FUNC x), ([], [(Valtype.Reftype Reftype.FUNCREF)])))
+  | ref_null (C : Context) (rt : Reftype) :
+    (Instr_ok (C, (Instr.REF_NULL rt), ([], [(Valtype.Reftype rt)])))
+  | convert_f (C : Context) (fn_1 : Fn) (fn_2 : Fn) :
+    (fn_1 != fn_2) ->
+    (Instr_ok (C, (Instr.CVTOP ((Numtype.Fn fn_1), Cvtop.CONVERT, (Numtype.Fn fn_2), none)), ([(Valtype.Fn fn_2)], [(Valtype.Fn fn_1)])))
+  | convert_i (C : Context) (in_1 : In) (in_2 : In) (sx : Sx) :
+    (in_1 != in_2) ->
+    ((sx == none) = ((size (Valtype.In in_1)) > (size (Valtype.In in_2)))) ->
+    (Instr_ok (C, (Instr.CVTOP ((Numtype.In in_1), Cvtop.CONVERT, (Numtype.In in_2), sx)), ([(Valtype.In in_2)], [(Valtype.In in_1)])))
+  | reinterpret (C : Context) (nt_1 : Numtype) (nt_2 : Numtype) :
+    (nt_1 != nt_2) ->
+    ((size (Valtype.Numtype nt_1)) == (size (Valtype.Numtype nt_2))) ->
+    (Instr_ok (C, (Instr.CVTOP (nt_1, Cvtop.REINTERPRET, nt_2, none)), ([(Valtype.Numtype nt_2)], [(Valtype.Numtype nt_1)])))
+  | extend (C : Context) (n : N) (nt : Numtype) :
+    (n <= (size (Valtype.Numtype nt))) ->
+    (Instr_ok (C, (Instr.EXTEND (nt, n)), ([(Valtype.Numtype nt)], [(Valtype.Numtype nt)])))
+  | relop (C : Context) (nt : Numtype) (relop : Relop_numtype) :
+    (Instr_ok (C, (Instr.RELOP (nt, relop)), ([(Valtype.Numtype nt), (Valtype.Numtype nt)], [(Valtype.Numtype Numtype.I32)])))
+  | testop (C : Context) (nt : Numtype) (testop : Testop_numtype) :
+    (Instr_ok (C, (Instr.TESTOP (nt, testop)), ([(Valtype.Numtype nt)], [(Valtype.Numtype Numtype.I32)])))
+  | binop (C : Context) (binop : Binop_numtype) (nt : Numtype) :
+    (Instr_ok (C, (Instr.BINOP (nt, binop)), ([(Valtype.Numtype nt), (Valtype.Numtype nt)], [(Valtype.Numtype nt)])))
+  | unop (C : Context) (nt : Numtype) (unop : Unop_numtype) :
+    (Instr_ok (C, (Instr.UNOP (nt, unop)), ([(Valtype.Numtype nt)], [(Valtype.Numtype nt)])))
+  | const (C : Context) (c_nt : C_numtype) (nt : Numtype) :
+    (Instr_ok (C, (Instr.CONST (nt, c_nt)), ([], [(Valtype.Numtype nt)])))
+  | call_indirect (C : Context) (ft : Functype) (lim : Limits) (t_1 : Valtype) (t_2 : Valtype) (x : Idx) :
+    ((C.TABLE.get! x) == (lim, Reftype.FUNCREF)) ->
+    (ft == (t_1, t_2)) ->
+    (Instr_ok (C, (Instr.CALL_INDIRECT (x, ft)), ((t_1 ++ [(Valtype.Numtype Numtype.I32)]), t_2)))
+  | call (C : Context) (t_1 : Valtype) (t_2 : Valtype) (x : Idx) :
+    ((C.FUNC.get! x) == (t_1, t_2)) ->
+    (Instr_ok (C, (Instr.CALL x), (t_1, t_2)))
+  | return (C : Context) (t : Valtype) (t_1 : Valtype) (t_2 : Valtype) :
+    (C.RETURN == (some t)) ->
+    (Instr_ok (C, Instr.RETURN, ((t_1 ++ t), t_2)))
+  | br_table (C : Context) (l : Labelidx) (l' : Labelidx) (t : Valtype) (t_1 : Valtype) (t_2 : Valtype) :
+    (Resulttype_sub (t, (C.LABEL.get! l))) ->
+    (Resulttype_sub (t, (C.LABEL.get! l'))) ->
+    (Instr_ok (C, (Instr.BR_TABLE (l, l')), ((t_1 ++ t), t_2)))
+  | br_if (C : Context) (l : Labelidx) (t : Valtype) :
+    ((C.LABEL.get! l) == t) ->
+    (Instr_ok (C, (Instr.BR_IF l), ((t ++ [(Valtype.Numtype Numtype.I32)]), t)))
+  | br (C : Context) (l : Labelidx) (t : Valtype) (t_1 : Valtype) (t_2 : Valtype) :
+    ((C.LABEL.get! l) == t) ->
+    (Instr_ok (C, (Instr.BR l), ((t_1 ++ t), t_2)))
+  | if (C : Context) (bt : Blocktype) (instr_1 : Instr) (instr_2 : Instr) (t_1 : Valtype) (t_2 : Valtype) :
+    (Blocktype_ok (C, bt, (t_1, [t_2]))) ->
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2], RETURN := none}), instr_1, (t_1, t_2))) ->
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2], RETURN := none}), instr_2, (t_1, t_2))) ->
+    (Instr_ok (C, (Instr.IF (bt, instr_1, instr_2)), (t_1, [t_2])))
+  | loop (C : Context) (bt : Blocktype) (instr : Instr) (t_1 : Valtype) (t_2 : Valtype) :
+    (Blocktype_ok (C, bt, (t_1, t_2))) ->
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_1], RETURN := none}), instr, (t_1, [t_2]))) ->
+    (Instr_ok (C, (Instr.LOOP (bt, instr)), (t_1, t_2)))
+  | block (C : Context) (bt : Blocktype) (instr : Instr) (t_1 : Valtype) (t_2 : Valtype) :
+    (Blocktype_ok (C, bt, (t_1, t_2))) ->
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2], RETURN := none}), instr, (t_1, t_2))) ->
+    (Instr_ok (C, (Instr.BLOCK (bt, instr)), (t_1, t_2)))
+  | select_impl (C : Context) (numtype : Numtype) (t : Valtype) (t' : Valtype) (vectype : Vectype) :
+    (Valtype_sub (t, t')) ->
+    ((t' == (Valtype.Numtype numtype)) || (t' == (Valtype.Vectype vectype))) ->
+    (Instr_ok (C, (Instr.SELECT none), ([t, t, (Valtype.Numtype Numtype.I32)], [t])))
+  | select_expl (C : Context) (t : Valtype) :
+    (Instr_ok (C, (Instr.SELECT (some t)), ([t, t, (Valtype.Numtype Numtype.I32)], [t])))
+  | drop (C : Context) (t : Valtype) :
+    (Instr_ok (C, Instr.DROP, ([t], [])))
+  | nop (C : Context) :
+    (Instr_ok (C, Instr.NOP, ([], [])))
+  | unreachable (C : Context) (t_1 : Valtype) (t_2 : Valtype) :
+    (Instr_ok (C, Instr.UNREACHABLE, (t_1, t_2)))
+inductive InstrSeq_ok : (Context × (List Instr) × Functype) -> Prop where
+  | frame (C : Context) (instr : Instr) (t : Valtype) (t_1 : Valtype) (t_2 : Valtype) :
+    (InstrSeq_ok (C, instr, (t_1, t_2))) ->
+    (InstrSeq_ok (C, instr, ((t ++ t_1), (t ++ t_2))))
+  | weak (C : Context) (instr : Instr) (t'_1 : Valtype) (t'_2 : Valtype) (t_1 : Valtype) (t_2 : Valtype) :
+    (InstrSeq_ok (C, instr, (t_1, t_2))) ->
+    (Resulttype_sub (t'_1, t_1)) ->
+    (Resulttype_sub (t_2, t'_2)) ->
+    (InstrSeq_ok (C, instr, ([t'_1], t'_2)))
+  | seq (C : Context) (instr_1 : Instr) (instr_2 : Instr) (t_1 : Valtype) (t_2 : Valtype) (t_3 : Valtype) :
+    (Instr_ok (C, instr_1, (t_1, t_2))) ->
+    (InstrSeq_ok (C, [instr_2], (t_2, t_3))) ->
+    (InstrSeq_ok (C, ([instr_1] ++ instr_2), (t_1, t_3)))
+  | empty (C : Context) :
+    (InstrSeq_ok (C, [], ([], [])))end
+
+
+inductive Expr_ok : (Context × Expr × Resulttype) -> Prop where
+  | rule_0 (C : Context) (instr : Instr) (t : Valtype) :
+    (InstrSeq_ok (C, instr, ([], t))) ->
+    (Expr_ok (C, instr, t))
+
+inductive Instr_const : (Context × Instr) -> Prop where
+  | global_get (C : Context) (t : Valtype) (x : Idx) :
+    ((C.GLOBAL.get! x) == (none, t)) ->
+    (Instr_const (C, (Instr.GLOBAL_GET x)))
+  | ref_func (C : Context) (x : Idx) :
+    (Instr_const (C, (Instr.REF_FUNC x)))
+  | ref_null (C : Context) (rt : Reftype) :
+    (Instr_const (C, (Instr.REF_NULL rt)))
+  | const (C : Context) (c : C_numtype) (nt : Numtype) :
+    (Instr_const (C, (Instr.CONST (nt, c))))
+
+inductive Expr_const : (Context × Expr) -> Prop where
+  | rule_0 (C : Context) (instr : Instr) :
+    (Instr_const (C, instr)) ->
+    (Expr_const (C, instr))
+
+inductive Expr_ok_const : (Context × Expr × Valtype) -> Prop where
+  | rule_0 (C : Context) (expr : Expr) (t : Valtype) :
+    (Expr_ok (C, expr, [t])) ->
+    (Expr_const (C, expr)) ->
+    (Expr_ok_const (C, expr, t))
+
+inductive Func_ok : (Context × Func × Functype) -> Prop where
+  | rule_0 (C : Context) (expr : Expr) (ft : Functype) (t : Valtype) (t_1 : Valtype) (t_2 : Valtype) :
+    (ft == (t_1, t_2)) ->
+    (Functype_ok ft) ->
+    (Expr_ok ((((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := (t_1 ++ t), LABEL := [], RETURN := none}) ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2], RETURN := none}) ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [], RETURN := (some t_2)}), expr, t_2)) ->
+    (Func_ok (C, (ft, t, expr), ft))
+
+inductive Global_ok : (Context × Global × Globaltype) -> Prop where
+  | rule_0 (C : Context) (expr : Expr) (gt : Globaltype) (t : Valtype) :
+    (Globaltype_ok gt) ->
+    (gt == ((some ()), t)) ->
+    (Expr_ok_const (C, expr, t)) ->
+    (Global_ok (C, (gt, expr), gt))
+
+inductive Table_ok : (Context × Table × Tabletype) -> Prop where
+  | rule_0 (C : Context) (tt : Tabletype) :
+    (Tabletype_ok tt) ->
+    (Table_ok (C, tt, tt))
+
+inductive Mem_ok : (Context × Mem × Memtype) -> Prop where
+  | rule_0 (C : Context) (mt : Memtype) :
+    (Memtype_ok mt) ->
+    (Mem_ok (C, mt, mt))
+
+inductive Elemmode_ok : (Context × Elemmode × Reftype) -> Prop where
+  | declare (C : Context) (rt : Reftype) :
+    (Elemmode_ok (C, Elemmode.DECLARE, rt))
+  | active (C : Context) (expr : Expr) (lim : Limits) (rt : Reftype) (x : Idx) :
+    ((C.TABLE.get! x) == (lim, rt)) ->
+    (Expr_ok_const (C, expr, (Valtype.Numtype Numtype.I32))) ->
+    (Elemmode_ok (C, (Elemmode.TABLE (x, expr)), rt))
+
+inductive Elem_ok : (Context × Elem × Reftype) -> Prop where
+  | rule_0 (C : Context) (elemmode : Elemmode) (expr : Expr) (rt : Reftype) :
+    (Expr_ok (C, expr, [(Valtype.Reftype rt)])) ->
+    (Elemmode_ok (C, elemmode, rt)) ->
+    (Elem_ok (C, (rt, expr, elemmode), rt))
+
+inductive Datamode_ok : (Context × Datamode) -> Prop where
+  | rule_0 (C : Context) (expr : Expr) (mt : Memtype) :
+    ((C.MEM.get! 0) == mt) ->
+    (Expr_ok_const (C, expr, (Valtype.Numtype Numtype.I32))) ->
+    (Datamode_ok (C, (Datamode.MEMORY (0, expr))))
+
+inductive Data_ok : (Context × Data) -> Prop where
+  | rule_0 (C : Context) (b : Byte) (datamode : Datamode) :
+    (Datamode_ok (C, datamode)) ->
+    (Data_ok (C, (b, datamode)))
+
+inductive Start_ok : (Context × Start) -> Prop where
+  | rule_0 (C : Context) (x : Idx) :
+    ((C.FUNC.get! x) == ([], [])) ->
+    (Start_ok (C, x))
+
+inductive Import_ok : (Context × Import × Externtype) -> Prop where
+  | rule_0 (C : Context) (name_1 : Name) (name_2 : Name) (xt : Externtype) :
+    (Externtype_ok xt) ->
+    (Import_ok (C, (name_1, name_2, xt), xt))
+
+inductive Externuse_ok : (Context × Externuse × Externtype) -> Prop where
+  | mem (C : Context) (mt : Memtype) (x : Idx) :
+    ((C.MEM.get! x) == mt) ->
+    (Externuse_ok (C, (Externuse.MEMORY x), (Externtype.MEMORY mt)))
+  | table (C : Context) (tt : Tabletype) (x : Idx) :
+    ((C.TABLE.get! x) == tt) ->
+    (Externuse_ok (C, (Externuse.TABLE x), (Externtype.TABLE tt)))
+  | global (C : Context) (gt : Globaltype) (x : Idx) :
+    ((C.GLOBAL.get! x) == gt) ->
+    (Externuse_ok (C, (Externuse.GLOBAL x), (Externtype.GLOBAL gt)))
+  | func (C : Context) (ft : Functype) (x : Idx) :
+    ((C.FUNC.get! x) == ft) ->
+    (Externuse_ok (C, (Externuse.FUNC x), (Externtype.FUNC ft)))
+
+inductive Export_ok : (Context × Export × Externtype) -> Prop where
+  | rule_0 (C : Context) (externuse : Externuse) (name : Name) (xt : Externtype) :
+    (Externuse_ok (C, externuse, xt)) ->
+    (Export_ok (C, (name, externuse), xt))
+
+inductive Module_ok : Module -> Prop where
+  | rule_0 (C : Context) (data : Data) (elem : Elem) («export» : Export) (ft : Functype) (func : Func) (global : Global) (gt : Globaltype) («import» : Import) (mem : Mem) (mt : Memtype) (n : N) (rt : Reftype) (start : Start) (table : Table) (tt : Tabletype) :
+    (Func_ok (C, func, ft)) ->
+    (Global_ok (C, global, gt)) ->
+    (Table_ok (C, table, tt)) ->
+    (Mem_ok (C, mem, mt)) ->
+    (Elem_ok (C, elem, rt)) ->
+    (Data_ok (C, data)) ->
+    (Start_ok (C, start)) ->
+    (C == {FUNC := ft, GLOBAL := gt, TABLE := tt, MEM := mt, ELEM := rt, DATA := (), LOCAL := [], LABEL := [], RETURN := none}) ->
+    (mem.length <= 1) ->
+    (start.length <= 1) ->
+    (Module_ok («import», func, global, table, mem, elem, data, start, «export»))
+
+@[reducible] def Addr := Nat
+
+@[reducible] def Funcaddr := Addr
+
+@[reducible] def Globaladdr := Addr
+
+@[reducible] def Tableaddr := Addr
+
+@[reducible] def Memaddr := Addr
+
+@[reducible] def Elemaddr := Addr
+
+@[reducible] def Dataaddr := Addr
+
+@[reducible] def Labeladdr := Addr
+
+@[reducible] def Hostaddr := Addr
+
+inductive Num where
+ | CONST : (Numtype × C_numtype) -> Num
+  deriving Inhabited, BEq
+
+inductive Ref where
+ | REF_NULL : Reftype -> Ref
+ | REF_FUNC_ADDR : Funcaddr -> Ref
+ | REF_HOST_ADDR : Hostaddr -> Ref
+  deriving Inhabited, BEq
+
+inductive Val where
+ | Num : Num -> Val
+ | Ref : Ref -> Val
+  deriving Inhabited, BEq
+
+inductive Result where
+ | _VALS : (List Val) -> Result
+ | TRAP : Result
+  deriving Inhabited, BEq
+
+inductive Externval where
+ | FUNC : Funcaddr -> Externval
+ | GLOBAL : Globaladdr -> Externval
+ | TABLE : Tableaddr -> Externval
+ | MEM : Memaddr -> Externval
+  deriving Inhabited, BEq
+
+def default_ : Valtype -> Val
+  | (Valtype.Reftype rt) => (Val.Ref (Ref.REF_NULL rt))
+  | (Valtype.Numtype Numtype.F64) => (Val.Num (Num.CONST (Numtype.F64, 0)))
+  | (Valtype.Numtype Numtype.F32) => (Val.Num (Num.CONST (Numtype.F32, 0)))
+  | (Valtype.Numtype Numtype.I64) => (Val.Num (Num.CONST (Numtype.I64, 0)))
+  | (Valtype.Numtype Numtype.I32) => (Val.Num (Num.CONST (Numtype.I32, 0)))
+  | _ => default
+
+@[reducible] def Exportinst := /- mixop: EXPORT -/ (Name × Externval)
+
+structure Moduleinst where
+  FUNC : (List Funcaddr)
+  GLOBAL : (List Globaladdr)
+  TABLE : (List Tableaddr)
+  MEM : (List Memaddr)
+  ELEM : (List Elemaddr)
+  DATA : (List Dataaddr)
+  EXPORT : (List Exportinst)
+  deriving Inhabited, BEq
+instance : Append Moduleinst where
+  append := fun r1 r2 => {
+    FUNC := r1.FUNC ++ r2.FUNC,
+    GLOBAL := r1.GLOBAL ++ r2.GLOBAL,
+    TABLE := r1.TABLE ++ r2.TABLE,
+    MEM := r1.MEM ++ r2.MEM,
+    ELEM := r1.ELEM ++ r2.ELEM,
+    DATA := r1.DATA ++ r2.DATA,
+    EXPORT := r1.EXPORT ++ r2.EXPORT,
+  }
+
+@[reducible] def Funcinst := /- mixop: `%;%` -/ (Moduleinst × Func)
+
+@[reducible] def Globalinst := Val
+
+@[reducible] def Tableinst := (List Ref)
+
+@[reducible] def Meminst := (List Byte)
+
+@[reducible] def Eleminst := (List Ref)
+
+@[reducible] def Datainst := (List Byte)
+
+structure Store where
+  FUNC : (List Funcinst)
+  GLOBAL : (List Globalinst)
+  TABLE : (List Tableinst)
+  MEM : (List Meminst)
+  ELEM : (List Eleminst)
+  DATA : (List Datainst)
+  deriving Inhabited, BEq
+instance : Append Store where
+  append := fun r1 r2 => {
+    FUNC := r1.FUNC ++ r2.FUNC,
+    GLOBAL := r1.GLOBAL ++ r2.GLOBAL,
+    TABLE := r1.TABLE ++ r2.TABLE,
+    MEM := r1.MEM ++ r2.MEM,
+    ELEM := r1.ELEM ++ r2.ELEM,
+    DATA := r1.DATA ++ r2.DATA,
+  }
+
+structure Frame where
+  LOCAL : (List Val)
+  MODULE : Moduleinst
+  deriving Inhabited, BEq
+instance : Append Frame where
+  append := fun r1 r2 => {
+    LOCAL := r1.LOCAL ++ r2.LOCAL,
+    MODULE := r1.MODULE ++ r2.MODULE,
+  }
+
+@[reducible] def State := /- mixop: `%;%` -/ (Store × Frame)
+
+inductive Admininstr where
+ | Instr : Instr -> Admininstr
+ | REF_FUNC_ADDR : Funcaddr -> Admininstr
+ | REF_HOST_ADDR : Hostaddr -> Admininstr
+ | CALL_ADDR : Funcaddr -> Admininstr
+ | LABEL_ : (N × (List Instr) × (List Admininstr)) -> Admininstr
+ | FRAME_ : (N × Frame × (List Admininstr)) -> Admininstr
+ | TRAP : Admininstr
+  deriving Inhabited, BEq
+
+@[reducible] def Config := /- mixop: `%;%` -/ (State × (List Admininstr))
+
+def funcaddr : State -> (List Funcaddr)
+  | (s, f) => f.MODULE.FUNC
+
+def funcinst : State -> (List Funcinst)
+  | (s, f) => s.FUNC
+
+def func : (State × Funcidx) -> Funcinst
+  | ((s, f), x) => (s.FUNC.get! (f.MODULE.FUNC.get! x))
+
+def local : (State × Localidx) -> Val
+  | ((s, f), x) => (f.LOCAL.get! x)
+
+def global : (State × Globalidx) -> Globalinst
+  | ((s, f), x) => (s.GLOBAL.get! (f.MODULE.GLOBAL.get! x))
+
+def table : (State × Tableidx) -> Tableinst
+  | ((s, f), x) => (s.TABLE.get! (f.MODULE.TABLE.get! x))
+
+def elem : (State × Tableidx) -> Eleminst
+  | ((s, f), x) => (s.ELEM.get! (f.MODULE.ELEM.get! x))
+
+def with_local : (State × Localidx × Val) -> State
+  | ((s, f), x, v) => (s, default /- f[LOCAL[x] = v] -/)
+
+def with_global : (State × Globalidx × Val) -> State
+  | ((s, f), x, v) => (default /- s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v] -/, f)
+
+def with_table : (State × Tableidx × N × Ref) -> State
+  | ((s, f), x, i, r) => (default /- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r] -/, f)
+
+inductive E where
+ | _HOLE : E
+ | _SEQ : ((List Val) × E × (List Instr)) -> E
+ | LABEL_ : (N × (List Instr) × E) -> E
+  deriving Inhabited, BEq
+
+inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
+  | br_table_ge (i : Nat) (l : Labelidx) (l' : Labelidx) :
+    (i >= l.length) ->
+    (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.BR_TABLE (l, l')))], [(Admininstr.Instr (Instr.BR l'))]))
+  | br_table_lt (i : Nat) (l : Labelidx) (l' : Labelidx) :
+    (i < l.length) ->
+    (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.BR_TABLE (l, l')))], [(Admininstr.Instr (Instr.BR (l.get! i)))]))
+  | br_if_false (c : C_numtype) (l : Labelidx) :
+    (c == 0) ->
+    (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.BR_IF l))], []))
+  | br_if_true (c : C_numtype) (l : Labelidx) :
+    (c != 0) ->
+    (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.BR_IF l))], [(Admininstr.Instr (Instr.BR l))]))
+  | br_succ (instr : Instr) (instr' : Instr) (l : Labelidx) (n : N) (val : Val) :
+    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((Admininstr.Val val) ++ ([(Admininstr.Instr (Instr.BR (l + 1)))] ++ (Admininstr.Instr instr)))))], ((Admininstr.Val val) ++ [(Admininstr.Instr (Instr.BR l))])))
+  | br_zero (instr : Instr) (instr' : Instr) (n : N) (val : Val) (val' : Val) :
+    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((Admininstr.Val val') ++ ((Admininstr.Val val) ++ ([(Admininstr.Instr (Instr.BR 0))] ++ (Admininstr.Instr instr))))))], ((Admininstr.Val val) ++ (Admininstr.Instr instr'))))
+  | if_false (bt : Blocktype) (c : C_numtype) (instr_1 : Instr) (instr_2 : Instr) :
+    (c == 0) ->
+    (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.IF (bt, instr_1, instr_2)))], [(Admininstr.Instr (Instr.BLOCK (bt, instr_2)))]))
+  | if_true (bt : Blocktype) (c : C_numtype) (instr_1 : Instr) (instr_2 : Instr) :
+    (c != 0) ->
+    (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.IF (bt, instr_1, instr_2)))], [(Admininstr.Instr (Instr.BLOCK (bt, instr_1)))]))
+  | loop (bt : Blocktype) (instr : Instr) (k : Nat) (n : N) (t_1 : Valtype) (t_2 : Valtype) (val : Val) :
+    (bt == (t_1, t_2)) ->
+    (Step_pure (((Admininstr.Val val) ++ [(Admininstr.Instr (Instr.LOOP (bt, instr)))]), [(Admininstr.LABEL_ (n, [(Instr.LOOP (bt, instr))], ((Admininstr.Val val) ++ (Admininstr.Instr instr))))]))
+  | block (bt : Blocktype) (instr : Instr) (k : Nat) (n : N) (t_1 : Valtype) (t_2 : Valtype) (val : Val) :
+    (bt == (t_1, t_2)) ->
+    (Step_pure (((Admininstr.Val val) ++ [(Admininstr.Instr (Instr.BLOCK (bt, instr)))]), [(Admininstr.LABEL_ (n, [], ((Admininstr.Val val) ++ (Admininstr.Instr instr))))]))
+  | local_tee (val : Val) (x : Idx) :
+    (Step_pure ([(Admininstr.Val val), (Admininstr.Instr (Instr.LOCAL_TEE x))], [(Admininstr.Val val), (Admininstr.Val val), (Admininstr.Instr (Instr.LOCAL_SET x))]))
+  | select_false (c : C_numtype) (t : Valtype) (val_1 : Val) (val_2 : Val) :
+    (c == 0) ->
+    (Step_pure ([(Admininstr.Val val_1), (Admininstr.Val val_2), (Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.SELECT t))], [(Admininstr.Val val_2)]))
+  | select_true (c : C_numtype) (t : Valtype) (val_1 : Val) (val_2 : Val) :
+    (c != 0) ->
+    (Step_pure ([(Admininstr.Val val_1), (Admininstr.Val val_2), (Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.SELECT t))], [(Admininstr.Val val_1)]))
+  | drop (val : Val) :
+    (Step_pure ([(Admininstr.Val val), (Admininstr.Instr Instr.DROP)], []))
+  | nop  :
+    (Step_pure ([(Admininstr.Instr Instr.NOP)], []))
+  | unreachable  :
+    (Step_pure ([(Admininstr.Instr Instr.UNREACHABLE)], [Admininstr.TRAP]))
+  | ref_is_null_false (val : Val) :
+    True /- Else? -/ ->
+    (Step_pure ([(Admininstr.Val val), (Admininstr.Instr Instr.REF_IS_NULL)], [(Admininstr.Instr (Instr.CONST (Numtype.I32, 0)))]))
+  | ref_is_null_true (rt : Reftype) (val : Val) :
+    (val == (Val.Ref (Ref.REF_NULL rt))) ->
+    (Step_pure ([(Admininstr.Val val), (Admininstr.Instr Instr.REF_IS_NULL)], [(Admininstr.Instr (Instr.CONST (Numtype.I32, 1)))]))
+
+inductive Step_read : (Config × (List Admininstr)) -> Prop where
+  | call_addr (a : Addr) (instr : Instr) (k : Nat) (m : Moduleinst) (n : N) (t : Valtype) (t_1 : Valtype) (t_2 : Valtype) (val : Val) (z : State) :
+    (((funcinst z).get! a) == (m, ((t_1, t_2), t, instr))) ->
+    (Step_read ((z, ((Admininstr.Val val) ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, {LOCAL := (val ++ (default_ t)), MODULE := m}, [(Admininstr.LABEL_ (n, [], (Admininstr.Instr instr)))]))]))
+  | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
+    True /- Else? -/ ->
+    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CALL_INDIRECT (x, ft)))]), [Admininstr.TRAP]))
+  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
+    (((table (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
+    (((funcinst z).get! a) == (m, func)) ->
+    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CALL_INDIRECT (x, ft)))]), [(Admininstr.CALL_ADDR a)]))
+  | call (x : Idx) (z : State) :
+    (Step_read ((z, [(Admininstr.Instr (Instr.CALL x))]), [(Admininstr.CALL_ADDR ((funcaddr z).get! x))]))
+  | table_init_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    True /- Else? -/ ->
+    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CONST (Numtype.I32, (n + 1)))), (Admininstr.Instr (Instr.TABLE_INIT (x, y)))]), [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Ref ((elem (z, y)).get! i)), (Admininstr.Instr (Instr.TABLE_SET x)), (Admininstr.Instr (Instr.CONST (Numtype.I32, (j + 1)))), (Admininstr.Instr (Instr.CONST (Numtype.I32, (i + 1)))), (Admininstr.Instr (Instr.CONST (Numtype.I32, n))), (Admininstr.Instr (Instr.TABLE_INIT (x, y)))]))
+  | table_init_zero (i : Nat) (j : Nat) (x : Idx) (y : Idx) (z : State) :
+    True /- Else? -/ ->
+    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CONST (Numtype.I32, 0))), (Admininstr.Instr (Instr.TABLE_INIT (x, y)))]), []))
+  | table_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (((i + n) > (elem (z, y)).length) || ((j + n) > (table (z, x)).length)) ->
+    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CONST (Numtype.I32, n))), (Admininstr.Instr (Instr.TABLE_INIT (x, y)))]), [Admininstr.TRAP]))
+  | table_copy_gt (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (i > i) ->
+    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CONST (Numtype.I32, (n + 1)))), (Admininstr.Instr (Instr.TABLE_COPY (x, y)))]), [(Admininstr.Instr (Instr.CONST (Numtype.I32, (j + n)))), (Admininstr.Instr (Instr.CONST (Numtype.I32, (i + n)))), (Admininstr.Instr (Instr.TABLE_GET y)), (Admininstr.Instr (Instr.TABLE_SET x)), (Admininstr.Instr (Instr.CONST (Numtype.I32, (j + 1)))), (Admininstr.Instr (Instr.CONST (Numtype.I32, (i + 1)))), (Admininstr.Instr (Instr.CONST (Numtype.I32, n))), (Admininstr.Instr (Instr.TABLE_COPY (x, y)))]))
+  | table_copy_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (j <= i) ->
+    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CONST (Numtype.I32, (n + 1)))), (Admininstr.Instr (Instr.TABLE_COPY (x, y)))]), [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.TABLE_GET y)), (Admininstr.Instr (Instr.TABLE_SET x)), (Admininstr.Instr (Instr.CONST (Numtype.I32, (j + 1)))), (Admininstr.Instr (Instr.CONST (Numtype.I32, (i + 1)))), (Admininstr.Instr (Instr.CONST (Numtype.I32, n))), (Admininstr.Instr (Instr.TABLE_COPY (x, y)))]))
+  | table_copy_zero (i : Nat) (j : Nat) (x : Idx) (y : Idx) (z : State) :
+    True /- Else? -/ ->
+    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CONST (Numtype.I32, 0))), (Admininstr.Instr (Instr.TABLE_COPY (x, y)))]), []))
+  | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (((i + n) > (table (z, y)).length) || ((j + n) > (table (z, x)).length)) ->
+    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CONST (Numtype.I32, n))), (Admininstr.Instr (Instr.TABLE_COPY (x, y)))]), [Admininstr.TRAP]))
+  | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    True /- Else? -/ ->
+    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Val val), (Admininstr.Instr (Instr.CONST (Numtype.I32, (n + 1)))), (Admininstr.Instr (Instr.TABLE_FILL x))]), [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Val val), (Admininstr.Instr (Instr.TABLE_SET x)), (Admininstr.Instr (Instr.CONST (Numtype.I32, (i + 1)))), (Admininstr.Val val), (Admininstr.Instr (Instr.CONST (Numtype.I32, n))), (Admininstr.Instr (Instr.TABLE_FILL x))]))
+  | table_fill_zero (i : Nat) (val : Val) (x : Idx) (z : State) :
+    True /- Else? -/ ->
+    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Val val), (Admininstr.Instr (Instr.CONST (Numtype.I32, 0))), (Admininstr.Instr (Instr.TABLE_FILL x))]), []))
+  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    ((i + n) > (table (z, x)).length) ->
+    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Val val), (Admininstr.Instr (Instr.CONST (Numtype.I32, n))), (Admininstr.Instr (Instr.TABLE_FILL x))]), [Admininstr.TRAP]))
+  | table_size (n : N) (x : Idx) (z : State) :
+    ((table (z, x)).length == n) ->
+    (Step_read ((z, [(Admininstr.Instr (Instr.TABLE_SIZE x))]), [(Admininstr.Instr (Instr.CONST (Numtype.I32, n)))]))
+  | table_get_lt (i : Nat) (x : Idx) (z : State) :
+    (i < (table (z, x)).length) ->
+    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.TABLE_GET x))]), [(Admininstr.Ref ((table (z, x)).get! i))]))
+  | table_get_ge (i : Nat) (x : Idx) (z : State) :
+    (i >= (table (z, x)).length) ->
+    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.TABLE_GET x))]), [Admininstr.TRAP]))
+  | global_get (x : Idx) (z : State) :
+    (Step_read ((z, [(Admininstr.Instr (Instr.GLOBAL_GET x))]), [(Admininstr.Globalinst (global (z, x)))]))
+  | local_get (x : Idx) (z : State) :
+    (Step_read ((z, [(Admininstr.Instr (Instr.LOCAL_GET x))]), [(Admininstr.Val (local (z, x)))]))
+  | ref_func (x : Idx) (z : State) :
+    (Step_read ((z, [(Admininstr.Instr (Instr.REF_FUNC x))]), [(Admininstr.REF_FUNC_ADDR ((funcaddr z).get! x))]))
+
+inductive Step_write : (Config × Config) -> Prop where
+  | table_set_ge (i : Nat) (ref : Ref) (x : Idx) (z : State) :
+    (i >= (table (z, x)).length) ->
+    (Step_write ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Ref ref), (Admininstr.Instr (Instr.TABLE_GET x))]), (z, [Admininstr.TRAP])))
+  | table_set_lt (i : Nat) (ref : Ref) (x : Idx) (z : State) :
+    (i < (table (z, x)).length) ->
+    (Step_write ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Ref ref), (Admininstr.Instr (Instr.TABLE_GET x))]), ((with_table (z, x, i, ref)), [])))
+  | global_set (val : Val) (x : Idx) (z : State) :
+    (Step_write ((z, [(Admininstr.Val val), (Admininstr.Instr (Instr.GLOBAL_SET x))]), ((with_global (z, x, val)), [])))
+  | local_set (val : Val) (x : Idx) (z : State) :
+    (Step_write ((z, [(Admininstr.Val val), (Admininstr.Instr (Instr.LOCAL_SET x))]), ((with_local (z, x, val)), [])))
+
+inductive Step : (Config × Config) -> Prop where
+  | write (instr : Instr) (instr' : Instr) (z : State) (z' : State) :
+    (Step_write ((z, (Admininstr.Instr instr)), (z', (Admininstr.Instr instr')))) ->
+    (Step ((z, (Admininstr.Instr instr)), (z', (Admininstr.Instr instr'))))
+  | read (instr : Instr) (instr' : Instr) (z : State) :
+    (Step_read ((z, (Admininstr.Instr instr)), (Admininstr.Instr instr'))) ->
+    (Step ((z, (Admininstr.Instr instr)), (z, (Admininstr.Instr instr'))))
+  | pure (instr : Instr) (instr' : Instr) (z : State) :
+    (Step_pure ((Admininstr.Instr instr), (Admininstr.Instr instr'))) ->
+    (Step ((z, (Admininstr.Instr instr)), (z, (Admininstr.Instr instr'))))
+```
diff --git a/spectec/test-lean4/dune b/spectec/test-lean4/dune
new file mode 100644
index 0000000000..cf53a32136
--- /dev/null
+++ b/spectec/test-lean4/dune
@@ -0,0 +1,8 @@
+(mdx
+  (libraries spectec)
+  (deps
+    (file ../src/exe-lean4/main.exe)
+    (glob_files ../spec/*.watsup)
+  )
+  (files TEST.md)
+)

From 88e5f2349f6d5df6041b272e53c14d243f7b39b3 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 5 Apr 2023 10:43:40 +0200
Subject: [PATCH 17/98] Include lean build output in test

---
 spectec/test-lean4/TEST.md            | 850 +++++++++++++++++++++++++-
 spectec/test-lean4/dune               |   3 +
 spectec/test-lean4/lake-manifest.json |   9 +
 spectec/test-lean4/lakefile.lean      |  10 +
 spectec/test-lean4/lean-toolchain     |   1 +
 5 files changed, 871 insertions(+), 2 deletions(-)
 create mode 100644 spectec/test-lean4/lake-manifest.json
 create mode 100644 spectec/test-lean4/lakefile.lean
 create mode 100644 spectec/test-lean4/lean-toolchain

diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index aedecf8b58..03f4bf02bb 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -1,8 +1,8 @@
 # Preview
 
 ```sh
-$ dune exec ../src/exe-lean4/main.exe -- ../spec/*.watsup -o Test.lean
-$ cat Test.lean
+$ dune exec ../src/exe-lean4/main.exe -- ../spec/*.watsup -o SpecTec.lean
+$ cat SpecTec.lean
 /- Lean 4 export -/
 
 instance : Append (Option a) where
@@ -1000,4 +1000,850 @@ inductive Step : (Config × Config) -> Prop where
   | pure (instr : Instr) (instr' : Instr) (z : State) :
     (Step_pure ((Admininstr.Instr instr), (Admininstr.Instr instr'))) ->
     (Step ((z, (Admininstr.Instr instr)), (z, (Admininstr.Instr instr'))))
+$ lake build |& sed -e 's,`.*/toolchains,`.../toolchains`,g'
+info: cloning https://github.com/leanprover/std4 to ./lake-packages/std
+Building SpecTec
+error: > LEAN_PATH=./build/lib:./lake-packages/std/build/lib LD_LIBRARY_PATH=/home/jojo/.elan/toolchains/leanprover--lean4---nightly-2023-02-10/lib:/etc/sane-libs:./build/lib /home/jojo/.elan/toolchains/leanprover--lean4---nightly-2023-02-10/bin/lean ./././SpecTec.lean -R ././. -o ./build/lib/SpecTec.olean -i ./build/lib/SpecTec.ilean -c ./build/ir/SpecTec.c
+error: stdout:
+./././SpecTec.lean:284:4: warning: unused variable `n_3_ATOM_y` [linter.unusedVariables]
+./././SpecTec.lean:371:21: error: application type mismatch
+  Prod.mk t_1
+argument
+  t_1
+has type
+  Valtype : Type
+but is expected to have type
+  List Valtype : Type
+./././SpecTec.lean:422:6: error: type mismatch
+  none
+has type
+  Option ?m.72695 : Type ?u.72694
+but is expected to have type
+  N : Type
+./././SpecTec.lean:422:28: error: unknown constant 'Numtype.In'
+./././SpecTec.lean:428:6: error: type mismatch
+  none
+has type
+  Option ?m.73266 : Type ?u.73265
+but is expected to have type
+  N : Type
+./././SpecTec.lean:428:28: error: unknown constant 'Numtype.In'
+./././SpecTec.lean:499:33: error: unknown constant 'Numtype.Fn'
+./././SpecTec.lean:499:67: error: unknown constant 'Numtype.Fn'
+./././SpecTec.lean:499:96: error: unknown constant 'Valtype.Fn'
+./././SpecTec.lean:499:117: error: unknown constant 'Valtype.Fn'
+./././SpecTec.lean:502:6: error: type mismatch
+  none
+has type
+  Option ?m.75279 : Type ?u.75278
+but is expected to have type
+  Sx : Type
+./././SpecTec.lean:502:28: error: unknown constant 'Valtype.In'
+./././SpecTec.lean:502:55: error: unknown constant 'Valtype.In'
+./././SpecTec.lean:503:33: error: unknown constant 'Numtype.In'
+./././SpecTec.lean:503:67: error: unknown constant 'Numtype.In'
+./././SpecTec.lean:503:94: error: unknown constant 'Valtype.In'
+./././SpecTec.lean:503:115: error: unknown constant 'Valtype.In'
+./././SpecTec.lean:523:5: error: type mismatch
+  (t_1, t_2)
+has type
+  Valtype × Valtype : Type
+but is expected to have type
+  Functype : Type
+./././SpecTec.lean:524:51: error: failed to synthesize instance
+  HAppend Valtype (List Valtype) ?m.76541
+./././SpecTec.lean:526:5: error: type mismatch
+  (t_1, t_2)
+has type
+  Valtype × Valtype : Type
+but is expected to have type
+  Functype : Type
+./././SpecTec.lean:527:35: error: application type mismatch
+  Prod.mk t_1
+argument
+  t_1
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:529:5: error: type mismatch
+  some t
+has type
+  Option Valtype : Type
+but is expected to have type
+  Option Resulttype : Type
+./././SpecTec.lean:530:34: error: failed to synthesize instance
+  HAppend Valtype Valtype ?m.77852
+./././SpecTec.lean:532:21: error: application type mismatch
+  Prod.mk t
+argument
+  t
+has type
+  Valtype : Type
+but is expected to have type
+  List Valtype : Type
+./././SpecTec.lean:533:21: error: application type mismatch
+  Prod.mk t
+argument
+  t
+has type
+  Valtype : Type
+but is expected to have type
+  List Valtype : Type
+./././SpecTec.lean:534:35: error: application type mismatch
+  Prod.mk l
+argument
+  l
+has type
+  Labelidx : Type
+but is expected to have type
+  List Labelidx : Type
+./././SpecTec.lean:534:46: error: failed to synthesize instance
+  HAppend Valtype Valtype ?m.78399
+./././SpecTec.lean:536:5: error: type mismatch
+  t
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:537:37: error: failed to synthesize instance
+  HAppend Valtype (List Valtype) ?m.79015
+./././SpecTec.lean:539:5: error: type mismatch
+  t
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:540:34: error: failed to synthesize instance
+  HAppend Valtype Valtype ?m.79533
+./././SpecTec.lean:542:27: error: application type mismatch
+  Prod.mk t_1
+argument
+  t_1
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:543:146: error: application type mismatch
+  Prod.mk instr_1
+argument
+  instr_1
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:543:156: error: application type mismatch
+  Prod.mk t_1
+argument
+  t_1
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:543:122: error: application type mismatch
+  List.cons t_2
+argument
+  t_2
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:544:146: error: application type mismatch
+  Prod.mk instr_2
+argument
+  instr_2
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:544:156: error: application type mismatch
+  Prod.mk t_1
+argument
+  t_1
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:545:33: error: application type mismatch
+  Prod.mk instr_1
+argument
+  instr_1
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:545:54: error: application type mismatch
+  Prod.mk t_1
+argument
+  t_1
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:544:122: error: application type mismatch
+  List.cons t_2
+argument
+  t_2
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:547:27: error: application type mismatch
+  Prod.mk t_1
+argument
+  t_1
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:548:146: error: application type mismatch
+  Prod.mk instr
+argument
+  instr
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:548:154: error: application type mismatch
+  Prod.mk t_1
+argument
+  t_1
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:549:35: error: application type mismatch
+  (bt, instr)
+argument
+  instr
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:549:45: error: application type mismatch
+  Prod.mk t_1
+argument
+  t_1
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:548:122: error: application type mismatch
+  List.cons t_1
+argument
+  t_1
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:551:27: error: application type mismatch
+  Prod.mk t_1
+argument
+  t_1
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:552:146: error: application type mismatch
+  Prod.mk instr
+argument
+  instr
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:552:154: error: application type mismatch
+  Prod.mk t_1
+argument
+  t_1
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:553:36: error: application type mismatch
+  (bt, instr)
+argument
+  instr
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:553:46: error: application type mismatch
+  Prod.mk t_1
+argument
+  t_1
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:552:122: error: application type mismatch
+  List.cons t_2
+argument
+  t_2
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:565:38: error: application type mismatch
+  Prod.mk t_1
+argument
+  t_1
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:568:21: error: application type mismatch
+  Prod.mk instr
+argument
+  instr
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:568:29: error: application type mismatch
+  Prod.mk t_1
+argument
+  t_1
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:569:21: error: application type mismatch
+  Prod.mk instr
+argument
+  instr
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:569:30: error: failed to synthesize instance
+  HAppend Valtype Valtype ?m.81846
+./././SpecTec.lean:569:42: error: failed to synthesize instance
+  HAppend Valtype Valtype ?m.82047
+./././SpecTec.lean:571:21: error: application type mismatch
+  Prod.mk instr
+argument
+  instr
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:571:29: error: application type mismatch
+  Prod.mk t_1
+argument
+  t_1
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:572:21: error: application type mismatch
+  Prod.mk t'_1
+argument
+  t'_1
+has type
+  Valtype : Type
+but is expected to have type
+  List Valtype : Type
+./././SpecTec.lean:573:21: error: application type mismatch
+  Prod.mk t_2
+argument
+  t_2
+has type
+  Valtype : Type
+but is expected to have type
+  List Valtype : Type
+./././SpecTec.lean:574:21: error: application type mismatch
+  Prod.mk instr
+argument
+  instr
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:574:37: error: application type mismatch
+  ([t'_1], t'_2)
+argument
+  t'_2
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:576:28: error: application type mismatch
+  Prod.mk t_1
+argument
+  t_1
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:577:33: error: application type mismatch
+  Prod.mk t_2
+argument
+  t_2
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:578:22: error: failed to synthesize instance
+  HAppend (List Instr) Instr ?m.83395
+./././SpecTec.lean:578:46: error: application type mismatch
+  Prod.mk t_1
+argument
+  t_1
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:585:21: error: application type mismatch
+  Prod.mk instr
+argument
+  instr
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:585:33: error: application type mismatch
+  ([], t)
+argument
+  t
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:586:17: error: application type mismatch
+  Prod.mk instr
+argument
+  instr
+has type
+  Instr : Type
+but is expected to have type
+  Expr : Type
+./././SpecTec.lean:602:20: error: application type mismatch
+  (C, instr)
+argument
+  instr
+has type
+  Instr : Type
+but is expected to have type
+  Expr : Type
+./././SpecTec.lean:612:5: error: type mismatch
+  (t_1, t_2)
+has type
+  Valtype × Valtype : Type
+but is expected to have type
+  Functype : Type
+./././SpecTec.lean:614:406: error: application type mismatch
+  (expr, t_2)
+argument
+  t_2
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:615:22: error: application type mismatch
+  Prod.mk t
+argument
+  t
+has type
+  Valtype : Type
+but is expected to have type
+  List Valtype : Type
+./././SpecTec.lean:614:107: error: failed to synthesize instance
+  HAppend Valtype Valtype ?m.101807
+./././SpecTec.lean:614:249: error: application type mismatch
+  List.cons t_2
+argument
+  t_2
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:614:392: error: application type mismatch
+  some t_2
+argument
+  t_2
+has type
+  Valtype : Type
+but is expected to have type
+  Resulttype : Type
+./././SpecTec.lean:646:22: error: application type mismatch
+  Prod.mk expr
+argument
+  expr
+has type
+  Expr : Type
+but is expected to have type
+  List Expr : Type
+./././SpecTec.lean:657:18: error: application type mismatch
+  Prod.mk b
+argument
+  b
+has type
+  Byte : Type
+but is expected to have type
+  List (List Byte) : Type
+./././SpecTec.lean:697:19: error: type mismatch
+  ft
+has type
+  Functype : Type
+but is expected to have type
+  List Functype : Type
+./././SpecTec.lean:698:5: error: invalid field 'length', the environment does not contain 'Mem.length'
+  mem
+has type
+  Mem
+./././SpecTec.lean:698:5: error: invalid field 'length', the environment does not contain 'Memtype.length'
+  mem
+has type
+  Memtype
+./././SpecTec.lean:698:5: error: invalid field 'length', the environment does not contain 'Limits.length'
+  mem
+has type
+  Limits
+./././SpecTec.lean:698:5: error: invalid field 'length', the environment does not contain 'Prod.length'
+  mem
+has type
+  U32 × U32
+./././SpecTec.lean:699:5: error: invalid field 'length', the environment does not contain 'Start.length'
+  start
+has type
+  Start
+./././SpecTec.lean:699:5: error: invalid field 'length', the environment does not contain 'Funcidx.length'
+  start
+has type
+  Funcidx
+./././SpecTec.lean:699:5: error: invalid field 'length', the environment does not contain 'Idx.length'
+  start
+has type
+  Idx
+./././SpecTec.lean:699:5: error: invalid field 'length', the environment does not contain 'Nat.length'
+  start
+has type
+  Nat
+./././SpecTec.lean:700:16: error: application type mismatch
+  Prod.mk import
+argument
+  import
+has type
+  Import : Type
+but is expected to have type
+  List Import : Type
+./././SpecTec.lean:700:26: error: application type mismatch
+  Prod.mk func
+argument
+  func
+has type
+  Func : Type
+but is expected to have type
+  List Func : Type
+./././SpecTec.lean:700:32: error: application type mismatch
+  Prod.mk global
+argument
+  global
+has type
+  Global : Type
+but is expected to have type
+  List Global : Type
+./././SpecTec.lean:700:40: error: application type mismatch
+  Prod.mk table
+argument
+  table
+has type
+  Table : Type
+but is expected to have type
+  List Table : Type
+./././SpecTec.lean:700:47: error: application type mismatch
+  Prod.mk mem
+argument
+  mem
+has type
+  Mem : Type
+but is expected to have type
+  List Mem : Type
+./././SpecTec.lean:700:52: error: application type mismatch
+  Prod.mk elem
+argument
+  elem
+has type
+  Elem : Type
+but is expected to have type
+  List Elem : Type
+./././SpecTec.lean:700:58: error: application type mismatch
+  Prod.mk data
+argument
+  data
+has type
+  Data : Type
+but is expected to have type
+  List Data : Type
+./././SpecTec.lean:700:64: error: application type mismatch
+  Prod.mk start
+argument
+  start
+has type
+  Start : Type
+but is expected to have type
+  List Start : Type
+./././SpecTec.lean:832:5: warning: unused variable `s` [linter.unusedVariables]
+./././SpecTec.lean:835:8: warning: unused variable `f` [linter.unusedVariables]
+./././SpecTec.lean:840:4: error: expected identifier
+./././SpecTec.lean:840:10: error: expected 'elab', 'elab_rules', 'infix', 'infixl', 'infixr', 'instance', 'macro', 'macro_rules', 'notation', 'postfix', 'prefix', 'syntax' or 'unif_hint'
+./././SpecTec.lean:853:9: warning: unused variable `f` [linter.unusedVariables]
+./././SpecTec.lean:853:13: warning: unused variable `x` [linter.unusedVariables]
+./././SpecTec.lean:853:16: warning: unused variable `v` [linter.unusedVariables]
+./././SpecTec.lean:856:6: warning: unused variable `s` [linter.unusedVariables]
+./././SpecTec.lean:856:13: warning: unused variable `x` [linter.unusedVariables]
+./././SpecTec.lean:856:16: warning: unused variable `v` [linter.unusedVariables]
+./././SpecTec.lean:859:6: warning: unused variable `s` [linter.unusedVariables]
+./././SpecTec.lean:859:13: warning: unused variable `x` [linter.unusedVariables]
+./././SpecTec.lean:859:16: warning: unused variable `i` [linter.unusedVariables]
+./././SpecTec.lean:859:19: warning: unused variable `r` [linter.unusedVariables]
+./././SpecTec.lean:869:10: error: invalid field 'length', the environment does not contain 'Labelidx.length'
+  l
+has type
+  Labelidx
+./././SpecTec.lean:869:10: error: invalid field 'length', the environment does not contain 'Idx.length'
+  l
+has type
+  Idx
+./././SpecTec.lean:869:10: error: invalid field 'length', the environment does not contain 'Nat.length'
+  l
+has type
+  Nat
+./././SpecTec.lean:870:103: error: application type mismatch
+  Prod.mk l
+argument
+  l
+has type
+  Labelidx : Type
+but is expected to have type
+  List Labelidx : Type
+./././SpecTec.lean:872:9: error: invalid field 'length', the environment does not contain 'Labelidx.length'
+  l
+has type
+  Labelidx
+./././SpecTec.lean:872:9: error: invalid field 'length', the environment does not contain 'Idx.length'
+  l
+has type
+  Idx
+./././SpecTec.lean:872:9: error: invalid field 'length', the environment does not contain 'Nat.length'
+  l
+has type
+  Nat
+./././SpecTec.lean:873:103: error: application type mismatch
+  Prod.mk l
+argument
+  l
+has type
+  Labelidx : Type
+but is expected to have type
+  List Labelidx : Type
+./././SpecTec.lean:873:144: error: invalid field 'get!', the environment does not contain 'Labelidx.get!'
+  l
+has type
+  Labelidx
+./././SpecTec.lean:873:144: error: invalid field 'get!', the environment does not contain 'Idx.get!'
+  l
+has type
+  Idx
+./././SpecTec.lean:873:144: error: invalid field 'get!', the environment does not contain 'Nat.get!'
+  l
+has type
+  Nat
+./././SpecTec.lean:881:40: error: application type mismatch
+  Prod.mk instr'
+argument
+  instr'
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:881:50: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:881:74: error: failed to synthesize instance
+  HAppend (List Admininstr) Admininstr ?m.130319
+./././SpecTec.lean:881:150: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:883:40: error: application type mismatch
+  Prod.mk instr'
+argument
+  instr'
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:883:50: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:883:76: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:883:100: error: failed to synthesize instance
+  HAppend (List Admininstr) Admininstr ?m.130708
+./././SpecTec.lean:883:171: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:886:101: error: application type mismatch
+  Prod.mk instr_1
+argument
+  instr_1
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:886:160: error: application type mismatch
+  (bt, instr_2)
+argument
+  instr_2
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:889:101: error: application type mismatch
+  Prod.mk instr_1
+argument
+  instr_1
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:889:160: error: application type mismatch
+  (bt, instr_1)
+argument
+  instr_1
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:891:5: error: type mismatch
+  (t_1, t_2)
+has type
+  Valtype × Valtype : Type
+but is expected to have type
+  Blocktype : Type
+./././SpecTec.lean:892:18: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:892:77: error: application type mismatch
+  (bt, instr)
+argument
+  instr
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:892:131: error: application type mismatch
+  (bt, instr)
+argument
+  instr
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:892:143: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:894:5: error: type mismatch
+  (t_1, t_2)
+has type
+  Valtype × Valtype : Type
+but is expected to have type
+  Blocktype : Type
+./././SpecTec.lean:895:18: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:895:78: error: application type mismatch
+  (bt, instr)
+argument
+  instr
+has type
+  Instr : Type
+but is expected to have type
+  List Instr : Type
+./././SpecTec.lean:895:120: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:897:18: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:897:82: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:897:104: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:900:18: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:900:42: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:900:156: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:903:18: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:903:42: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:903:156: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:905:18: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:912:18: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:915:18: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:972:81: error: expected ')' or term
+./././SpecTec.lean:972:87: error: expected 'elab', 'elab_rules', 'infix', 'infixl', 'infixr', 'instance', 'macro', 'macro_rules', 'notation', 'postfix', 'prefix', 'syntax' or 'unif_hint'
+./././SpecTec.lean:979:74: error: unknown constant 'Admininstr.Ref'
+./././SpecTec.lean:982:74: error: unknown constant 'Admininstr.Ref'
+./././SpecTec.lean:984:23: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:986:23: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:990:21: error: application type mismatch
+  (z, Admininstr.Instr instr)
+argument
+  Admininstr.Instr instr
+has type
+  Admininstr : Type
+but is expected to have type
+  List Admininstr : Type
+./././SpecTec.lean:990:53: error: application type mismatch
+  (z', Admininstr.Instr instr')
+argument
+  Admininstr.Instr instr'
+has type
+  Admininstr : Type
+but is expected to have type
+  List Admininstr : Type
+./././SpecTec.lean:991:15: error: application type mismatch
+  (z, Admininstr.Instr instr)
+argument
+  Admininstr.Instr instr
+has type
+  Admininstr : Type
+but is expected to have type
+  List Admininstr : Type
+./././SpecTec.lean:991:47: error: application type mismatch
+  (z', Admininstr.Instr instr')
+argument
+  Admininstr.Instr instr'
+has type
+  Admininstr : Type
+but is expected to have type
+  List Admininstr : Type
+./././SpecTec.lean:993:20: error: application type mismatch
+  (z, Admininstr.Instr instr)
+argument
+  Admininstr.Instr instr
+has type
+  Admininstr : Type
+but is expected to have type
+  List Admininstr : Type
+./././SpecTec.lean:994:15: error: application type mismatch
+  (z, Admininstr.Instr instr)
+argument
+  Admininstr.Instr instr
+has type
+  Admininstr : Type
+but is expected to have type
+  List Admininstr : Type
+./././SpecTec.lean:994:46: error: application type mismatch
+  (z, Admininstr.Instr instr')
+argument
+  Admininstr.Instr instr'
+has type
+  Admininstr : Type
+but is expected to have type
+  List Admininstr : Type
+./././SpecTec.lean:996:16: error: application type mismatch
+  Prod.mk (Admininstr.Instr instr)
+argument
+  Admininstr.Instr instr
+has type
+  Admininstr : Type
+but is expected to have type
+  List Admininstr : Type
+./././SpecTec.lean:997:15: error: application type mismatch
+  (z, Admininstr.Instr instr)
+argument
+  Admininstr.Instr instr
+has type
+  Admininstr : Type
+but is expected to have type
+  List Admininstr : Type
+./././SpecTec.lean:997:46: error: application type mismatch
+  (z, Admininstr.Instr instr')
+argument
+  Admininstr.Instr instr'
+has type
+  Admininstr : Type
+but is expected to have type
+  List Admininstr : Type
+error: external command `.../toolchains`/leanprover--lean4---nightly-2023-02-10/bin/lean` exited with code 1
 ```
diff --git a/spectec/test-lean4/dune b/spectec/test-lean4/dune
index cf53a32136..1bcb8e20b8 100644
--- a/spectec/test-lean4/dune
+++ b/spectec/test-lean4/dune
@@ -3,6 +3,9 @@
   (deps
     (file ../src/exe-lean4/main.exe)
     (glob_files ../spec/*.watsup)
+    (file lean-toolchain)
+    (file lake-manifest.json)
+    (file lakefile.lean)
   )
   (files TEST.md)
 )
diff --git a/spectec/test-lean4/lake-manifest.json b/spectec/test-lean4/lake-manifest.json
new file mode 100644
index 0000000000..101df59481
--- /dev/null
+++ b/spectec/test-lean4/lake-manifest.json
@@ -0,0 +1,9 @@
+{"version": 4,
+ "packagesDir": "lake-packages",
+ "packages":
+ [{"git":
+   {"url": "https://github.com/leanprover/std4",
+    "subDir?": null,
+    "rev": "5507f9d8409f93b984ce04eccf4914d534e6fca2",
+    "name": "std",
+    "inputRev?": "main"}}]}
diff --git a/spectec/test-lean4/lakefile.lean b/spectec/test-lean4/lakefile.lean
new file mode 100644
index 0000000000..e96e5eed18
--- /dev/null
+++ b/spectec/test-lean4/lakefile.lean
@@ -0,0 +1,10 @@
+import Lake
+
+open Lake DSL
+
+package spectec
+
+@[default_target]
+lean_lib SpecTec where
+
+require std from git "https://github.com/leanprover/std4" @ "main"
diff --git a/spectec/test-lean4/lean-toolchain b/spectec/test-lean4/lean-toolchain
new file mode 100644
index 0000000000..5bf01da5f3
--- /dev/null
+++ b/spectec/test-lean4/lean-toolchain
@@ -0,0 +1 @@
+leanprover/lean4:nightly-2023-02-10

From ea68e0b786139f7e1884868afa006d25e92ad420 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 5 Apr 2023 10:46:41 +0200
Subject: [PATCH 18/98] No need for std4

---
 spectec/lake-manifest.json            | 10 +---------
 spectec/lakefile.lean                 |  2 +-
 spectec/test-lean4/TEST.md            |  5 ++---
 spectec/test-lean4/lake-manifest.json | 10 +---------
 spectec/test-lean4/lakefile.lean      |  2 +-
 5 files changed, 6 insertions(+), 23 deletions(-)

diff --git a/spectec/lake-manifest.json b/spectec/lake-manifest.json
index 101df59481..1e31dae761 100644
--- a/spectec/lake-manifest.json
+++ b/spectec/lake-manifest.json
@@ -1,9 +1 @@
-{"version": 4,
- "packagesDir": "lake-packages",
- "packages":
- [{"git":
-   {"url": "https://github.com/leanprover/std4",
-    "subDir?": null,
-    "rev": "5507f9d8409f93b984ce04eccf4914d534e6fca2",
-    "name": "std",
-    "inputRev?": "main"}}]}
+{"version": 4, "packagesDir": "lake-packages", "packages": []}
diff --git a/spectec/lakefile.lean b/spectec/lakefile.lean
index e96e5eed18..db0142a79b 100644
--- a/spectec/lakefile.lean
+++ b/spectec/lakefile.lean
@@ -7,4 +7,4 @@ package spectec
 @[default_target]
 lean_lib SpecTec where
 
-require std from git "https://github.com/leanprover/std4" @ "main"
+/- require std from git "https://github.com/leanprover/std4" @ "main" -/
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 03f4bf02bb..5e7df8142b 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -1000,10 +1000,9 @@ inductive Step : (Config × Config) -> Prop where
   | pure (instr : Instr) (instr' : Instr) (z : State) :
     (Step_pure ((Admininstr.Instr instr), (Admininstr.Instr instr'))) ->
     (Step ((z, (Admininstr.Instr instr)), (z, (Admininstr.Instr instr'))))
-$ lake build |& sed -e 's,`.*/toolchains,`.../toolchains`,g'
-info: cloning https://github.com/leanprover/std4 to ./lake-packages/std
+$ lake build |& sed -e 's,/[^ ]*/toolchains,.../toolchains`,g'
 Building SpecTec
-error: > LEAN_PATH=./build/lib:./lake-packages/std/build/lib LD_LIBRARY_PATH=/home/jojo/.elan/toolchains/leanprover--lean4---nightly-2023-02-10/lib:/etc/sane-libs:./build/lib /home/jojo/.elan/toolchains/leanprover--lean4---nightly-2023-02-10/bin/lean ./././SpecTec.lean -R ././. -o ./build/lib/SpecTec.olean -i ./build/lib/SpecTec.ilean -c ./build/ir/SpecTec.c
+error: > LEAN_PATH=./build/lib LD_LIBRARY_PATH=.../toolchains`/leanprover--lean4---nightly-2023-02-10/lib:/etc/sane-libs:./build/lib .../toolchains`/leanprover--lean4---nightly-2023-02-10/bin/lean ./././SpecTec.lean -R ././. -o ./build/lib/SpecTec.olean -i ./build/lib/SpecTec.ilean -c ./build/ir/SpecTec.c
 error: stdout:
 ./././SpecTec.lean:284:4: warning: unused variable `n_3_ATOM_y` [linter.unusedVariables]
 ./././SpecTec.lean:371:21: error: application type mismatch
diff --git a/spectec/test-lean4/lake-manifest.json b/spectec/test-lean4/lake-manifest.json
index 101df59481..1e31dae761 100644
--- a/spectec/test-lean4/lake-manifest.json
+++ b/spectec/test-lean4/lake-manifest.json
@@ -1,9 +1 @@
-{"version": 4,
- "packagesDir": "lake-packages",
- "packages":
- [{"git":
-   {"url": "https://github.com/leanprover/std4",
-    "subDir?": null,
-    "rev": "5507f9d8409f93b984ce04eccf4914d534e6fca2",
-    "name": "std",
-    "inputRev?": "main"}}]}
+{"version": 4, "packagesDir": "lake-packages", "packages": []}
diff --git a/spectec/test-lean4/lakefile.lean b/spectec/test-lean4/lakefile.lean
index e96e5eed18..db0142a79b 100644
--- a/spectec/test-lean4/lakefile.lean
+++ b/spectec/test-lean4/lakefile.lean
@@ -7,4 +7,4 @@ package spectec
 @[default_target]
 lean_lib SpecTec where
 
-require std from git "https://github.com/leanprover/std4" @ "main"
+/- require std from git "https://github.com/leanprover/std4" @ "main" -/

From b001a348ac4b94db648479e1daa5c57adf185e27 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 5 Apr 2023 10:49:13 +0200
Subject: [PATCH 19/98] More keywords

---
 spectec/src/backend-lean4/gen.ml |  2 ++
 spectec/test-lean4/TEST.md       | 54 +++++++++++++++++++++++---------
 2 files changed, 41 insertions(+), 15 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 8f6ecaa485..add4be5270 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -17,6 +17,8 @@ let is_reserved = function
  | "in"
  | "export"
  | "import"
+ | "global"
+ | "local"
  -> true
  | _ -> false
 
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 5e7df8142b..9112ff44fd 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -357,7 +357,7 @@ inductive Externtype_ok : Externtype -> Prop where
   | table (tabletype : Tabletype) :
     (Tabletype_ok tabletype) ->
     (Externtype_ok (Externtype.TABLE tabletype))
-  | global (globaltype : Globaltype) :
+  | «global» (globaltype : Globaltype) :
     (Globaltype_ok globaltype) ->
     (Externtype_ok (Externtype.GLOBAL globaltype))
   | func (functype : Functype) :
@@ -406,7 +406,7 @@ inductive Externtype_sub : (Externtype × Externtype) -> Prop where
   | table (tt_1 : Tabletype) (tt_2 : Tabletype) :
     (Tabletype_sub (tt_1, tt_2)) ->
     (Externtype_sub ((Externtype.TABLE tt_1), (Externtype.TABLE tt_2)))
-  | global (gt_1 : Globaltype) (gt_2 : Globaltype) :
+  | «global» (gt_1 : Globaltype) (gt_2 : Globaltype) :
     (Globaltype_sub (gt_1, gt_2)) ->
     (Externtype_sub ((Externtype.GLOBAL gt_1), (Externtype.GLOBAL gt_2)))
   | func (ft_1 : Functype) (ft_2 : Functype) :
@@ -678,7 +678,7 @@ inductive Externuse_ok : (Context × Externuse × Externtype) -> Prop where
   | table (C : Context) (tt : Tabletype) (x : Idx) :
     ((C.TABLE.get! x) == tt) ->
     (Externuse_ok (C, (Externuse.TABLE x), (Externtype.TABLE tt)))
-  | global (C : Context) (gt : Globaltype) (x : Idx) :
+  | «global» (C : Context) (gt : Globaltype) (x : Idx) :
     ((C.GLOBAL.get! x) == gt) ->
     (Externuse_ok (C, (Externuse.GLOBAL x), (Externtype.GLOBAL gt)))
   | func (C : Context) (ft : Functype) (x : Idx) :
@@ -691,9 +691,9 @@ inductive Export_ok : (Context × Export × Externtype) -> Prop where
     (Export_ok (C, (name, externuse), xt))
 
 inductive Module_ok : Module -> Prop where
-  | rule_0 (C : Context) (data : Data) (elem : Elem) («export» : Export) (ft : Functype) (func : Func) (global : Global) (gt : Globaltype) («import» : Import) (mem : Mem) (mt : Memtype) (n : N) (rt : Reftype) (start : Start) (table : Table) (tt : Tabletype) :
+  | rule_0 (C : Context) (data : Data) (elem : Elem) («export» : Export) (ft : Functype) (func : Func) («global» : Global) (gt : Globaltype) («import» : Import) (mem : Mem) (mt : Memtype) (n : N) (rt : Reftype) (start : Start) (table : Table) (tt : Tabletype) :
     (Func_ok (C, func, ft)) ->
-    (Global_ok (C, global, gt)) ->
+    (Global_ok (C, «global», gt)) ->
     (Table_ok (C, table, tt)) ->
     (Mem_ok (C, mem, mt)) ->
     (Elem_ok (C, elem, rt)) ->
@@ -702,7 +702,7 @@ inductive Module_ok : Module -> Prop where
     (C == {FUNC := ft, GLOBAL := gt, TABLE := tt, MEM := mt, ELEM := rt, DATA := (), LOCAL := [], LABEL := [], RETURN := none}) ->
     (mem.length <= 1) ->
     (start.length <= 1) ->
-    (Module_ok («import», func, global, table, mem, elem, data, start, «export»))
+    (Module_ok («import», func, «global», table, mem, elem, data, start, «export»))
 
 @[reducible] def Addr := Nat
 
@@ -972,9 +972,9 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (i >= (table (z, x)).length) ->
     (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.TABLE_GET x))]), [Admininstr.TRAP]))
   | global_get (x : Idx) (z : State) :
-    (Step_read ((z, [(Admininstr.Instr (Instr.GLOBAL_GET x))]), [(Admininstr.Globalinst (global (z, x)))]))
+    (Step_read ((z, [(Admininstr.Instr (Instr.GLOBAL_GET x))]), [(Admininstr.Globalinst («global» (z, x)))]))
   | local_get (x : Idx) (z : State) :
-    (Step_read ((z, [(Admininstr.Instr (Instr.LOCAL_GET x))]), [(Admininstr.Val (local (z, x)))]))
+    (Step_read ((z, [(Admininstr.Instr (Instr.LOCAL_GET x))]), [(Admininstr.Val («local» (z, x)))]))
   | ref_func (x : Idx) (z : State) :
     (Step_read ((z, [(Admininstr.Instr (Instr.REF_FUNC x))]), [(Admininstr.REF_FUNC_ADDR ((funcaddr z).get! x))]))
 
@@ -1543,7 +1543,7 @@ has type
   Global : Type
 but is expected to have type
   List Global : Type
-./././SpecTec.lean:700:40: error: application type mismatch
+./././SpecTec.lean:700:42: error: application type mismatch
   Prod.mk table
 argument
   table
@@ -1551,7 +1551,7 @@ has type
   Table : Type
 but is expected to have type
   List Table : Type
-./././SpecTec.lean:700:47: error: application type mismatch
+./././SpecTec.lean:700:49: error: application type mismatch
   Prod.mk mem
 argument
   mem
@@ -1559,7 +1559,7 @@ has type
   Mem : Type
 but is expected to have type
   List Mem : Type
-./././SpecTec.lean:700:52: error: application type mismatch
+./././SpecTec.lean:700:54: error: application type mismatch
   Prod.mk elem
 argument
   elem
@@ -1567,7 +1567,7 @@ has type
   Elem : Type
 but is expected to have type
   List Elem : Type
-./././SpecTec.lean:700:58: error: application type mismatch
+./././SpecTec.lean:700:60: error: application type mismatch
   Prod.mk data
 argument
   data
@@ -1575,7 +1575,7 @@ has type
   Data : Type
 but is expected to have type
   List Data : Type
-./././SpecTec.lean:700:64: error: application type mismatch
+./././SpecTec.lean:700:66: error: application type mismatch
   Prod.mk start
 argument
   start
@@ -1758,8 +1758,32 @@ but is expected to have type
 ./././SpecTec.lean:905:18: error: unknown constant 'Admininstr.Val'
 ./././SpecTec.lean:912:18: error: unknown constant 'Admininstr.Val'
 ./././SpecTec.lean:915:18: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:972:81: error: expected ')' or term
-./././SpecTec.lean:972:87: error: expected 'elab', 'elab_rules', 'infix', 'infixl', 'infixr', 'instance', 'macro', 'macro_rules', 'notation', 'postfix', 'prefix', 'syntax' or 'unif_hint'
+./././SpecTec.lean:919:5: error: type mismatch
+  (m, (t_1, t_2), t, instr)
+has type
+  Moduleinst × (Valtype × Valtype) × Valtype × Instr : Type
+but is expected to have type
+  Funcinst : Type
+./././SpecTec.lean:920:22: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:920:110: error: failed to synthesize instance
+  HAppend Val Val ?m.134041
+./././SpecTec.lean:920:174: error: application type mismatch
+  ([], Admininstr.Instr instr)
+argument
+  Admininstr.Instr instr
+has type
+  Admininstr : Type
+but is expected to have type
+  List Admininstr : Type
+./././SpecTec.lean:932:281: error: unknown constant 'Admininstr.Ref'
+./././SpecTec.lean:953:73: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:953:247: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:953:366: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:956:73: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:959:73: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean:965:116: error: unknown constant 'Admininstr.Ref'
+./././SpecTec.lean:970:66: error: unknown constant 'Admininstr.Globalinst'
+./././SpecTec.lean:972:65: error: unknown constant 'Admininstr.Val'
 ./././SpecTec.lean:979:74: error: unknown constant 'Admininstr.Ref'
 ./././SpecTec.lean:982:74: error: unknown constant 'Admininstr.Ref'
 ./././SpecTec.lean:984:23: error: unknown constant 'Admininstr.Val'

From 331fd2fbd3c51d1640779db855df7ccc259bdd20 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 5 Apr 2023 10:51:11 +0200
Subject: [PATCH 20/98] Remove locations in expected test  output to reduc
 diffs

---
 spectec/test-lean4/TEST.md | 368 ++++++++++++++++++-------------------
 1 file changed, 184 insertions(+), 184 deletions(-)

diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 9112ff44fd..57bd0e757e 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -1000,12 +1000,12 @@ inductive Step : (Config × Config) -> Prop where
   | pure (instr : Instr) (instr' : Instr) (z : State) :
     (Step_pure ((Admininstr.Instr instr), (Admininstr.Instr instr'))) ->
     (Step ((z, (Admininstr.Instr instr)), (z, (Admininstr.Instr instr'))))
-$ lake build |& sed -e 's,/[^ ]*/toolchains,.../toolchains`,g'
+$ lake build |& sed -e 's,/[^ ]*/toolchains,.../toolchains`,g' | sed -e 's,SpecTec.lean:[0-9]\+:[0-9]\+,SpecTec.lean,'
 Building SpecTec
 error: > LEAN_PATH=./build/lib LD_LIBRARY_PATH=.../toolchains`/leanprover--lean4---nightly-2023-02-10/lib:/etc/sane-libs:./build/lib .../toolchains`/leanprover--lean4---nightly-2023-02-10/bin/lean ./././SpecTec.lean -R ././. -o ./build/lib/SpecTec.olean -i ./build/lib/SpecTec.ilean -c ./build/ir/SpecTec.c
 error: stdout:
-./././SpecTec.lean:284:4: warning: unused variable `n_3_ATOM_y` [linter.unusedVariables]
-./././SpecTec.lean:371:21: error: application type mismatch
+./././SpecTec.lean: warning: unused variable `n_3_ATOM_y` [linter.unusedVariables]
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1013,51 +1013,51 @@ has type
   Valtype : Type
 but is expected to have type
   List Valtype : Type
-./././SpecTec.lean:422:6: error: type mismatch
+./././SpecTec.lean: error: type mismatch
   none
 has type
   Option ?m.72695 : Type ?u.72694
 but is expected to have type
   N : Type
-./././SpecTec.lean:422:28: error: unknown constant 'Numtype.In'
-./././SpecTec.lean:428:6: error: type mismatch
+./././SpecTec.lean: error: unknown constant 'Numtype.In'
+./././SpecTec.lean: error: type mismatch
   none
 has type
   Option ?m.73266 : Type ?u.73265
 but is expected to have type
   N : Type
-./././SpecTec.lean:428:28: error: unknown constant 'Numtype.In'
-./././SpecTec.lean:499:33: error: unknown constant 'Numtype.Fn'
-./././SpecTec.lean:499:67: error: unknown constant 'Numtype.Fn'
-./././SpecTec.lean:499:96: error: unknown constant 'Valtype.Fn'
-./././SpecTec.lean:499:117: error: unknown constant 'Valtype.Fn'
-./././SpecTec.lean:502:6: error: type mismatch
+./././SpecTec.lean: error: unknown constant 'Numtype.In'
+./././SpecTec.lean: error: unknown constant 'Numtype.Fn'
+./././SpecTec.lean: error: unknown constant 'Numtype.Fn'
+./././SpecTec.lean: error: unknown constant 'Valtype.Fn'
+./././SpecTec.lean: error: unknown constant 'Valtype.Fn'
+./././SpecTec.lean: error: type mismatch
   none
 has type
   Option ?m.75279 : Type ?u.75278
 but is expected to have type
   Sx : Type
-./././SpecTec.lean:502:28: error: unknown constant 'Valtype.In'
-./././SpecTec.lean:502:55: error: unknown constant 'Valtype.In'
-./././SpecTec.lean:503:33: error: unknown constant 'Numtype.In'
-./././SpecTec.lean:503:67: error: unknown constant 'Numtype.In'
-./././SpecTec.lean:503:94: error: unknown constant 'Valtype.In'
-./././SpecTec.lean:503:115: error: unknown constant 'Valtype.In'
-./././SpecTec.lean:523:5: error: type mismatch
+./././SpecTec.lean: error: unknown constant 'Valtype.In'
+./././SpecTec.lean: error: unknown constant 'Valtype.In'
+./././SpecTec.lean: error: unknown constant 'Numtype.In'
+./././SpecTec.lean: error: unknown constant 'Numtype.In'
+./././SpecTec.lean: error: unknown constant 'Valtype.In'
+./././SpecTec.lean: error: unknown constant 'Valtype.In'
+./././SpecTec.lean: error: type mismatch
   (t_1, t_2)
 has type
   Valtype × Valtype : Type
 but is expected to have type
   Functype : Type
-./././SpecTec.lean:524:51: error: failed to synthesize instance
+./././SpecTec.lean: error: failed to synthesize instance
   HAppend Valtype (List Valtype) ?m.76541
-./././SpecTec.lean:526:5: error: type mismatch
+./././SpecTec.lean: error: type mismatch
   (t_1, t_2)
 has type
   Valtype × Valtype : Type
 but is expected to have type
   Functype : Type
-./././SpecTec.lean:527:35: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1065,15 +1065,15 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:529:5: error: type mismatch
+./././SpecTec.lean: error: type mismatch
   some t
 has type
   Option Valtype : Type
 but is expected to have type
   Option Resulttype : Type
-./././SpecTec.lean:530:34: error: failed to synthesize instance
+./././SpecTec.lean: error: failed to synthesize instance
   HAppend Valtype Valtype ?m.77852
-./././SpecTec.lean:532:21: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t
 argument
   t
@@ -1081,7 +1081,7 @@ has type
   Valtype : Type
 but is expected to have type
   List Valtype : Type
-./././SpecTec.lean:533:21: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t
 argument
   t
@@ -1089,7 +1089,7 @@ has type
   Valtype : Type
 but is expected to have type
   List Valtype : Type
-./././SpecTec.lean:534:35: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk l
 argument
   l
@@ -1097,25 +1097,25 @@ has type
   Labelidx : Type
 but is expected to have type
   List Labelidx : Type
-./././SpecTec.lean:534:46: error: failed to synthesize instance
+./././SpecTec.lean: error: failed to synthesize instance
   HAppend Valtype Valtype ?m.78399
-./././SpecTec.lean:536:5: error: type mismatch
+./././SpecTec.lean: error: type mismatch
   t
 has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:537:37: error: failed to synthesize instance
+./././SpecTec.lean: error: failed to synthesize instance
   HAppend Valtype (List Valtype) ?m.79015
-./././SpecTec.lean:539:5: error: type mismatch
+./././SpecTec.lean: error: type mismatch
   t
 has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:540:34: error: failed to synthesize instance
+./././SpecTec.lean: error: failed to synthesize instance
   HAppend Valtype Valtype ?m.79533
-./././SpecTec.lean:542:27: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1123,7 +1123,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:543:146: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk instr_1
 argument
   instr_1
@@ -1131,7 +1131,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:543:156: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1139,7 +1139,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:543:122: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   List.cons t_2
 argument
   t_2
@@ -1147,7 +1147,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:544:146: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk instr_2
 argument
   instr_2
@@ -1155,7 +1155,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:544:156: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1163,7 +1163,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:545:33: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk instr_1
 argument
   instr_1
@@ -1171,7 +1171,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:545:54: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1179,7 +1179,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:544:122: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   List.cons t_2
 argument
   t_2
@@ -1187,7 +1187,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:547:27: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1195,7 +1195,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:548:146: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk instr
 argument
   instr
@@ -1203,7 +1203,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:548:154: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1211,7 +1211,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:549:35: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   (bt, instr)
 argument
   instr
@@ -1219,7 +1219,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:549:45: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1227,7 +1227,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:548:122: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   List.cons t_1
 argument
   t_1
@@ -1235,7 +1235,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:551:27: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1243,7 +1243,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:552:146: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk instr
 argument
   instr
@@ -1251,7 +1251,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:552:154: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1259,7 +1259,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:553:36: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   (bt, instr)
 argument
   instr
@@ -1267,7 +1267,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:553:46: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1275,7 +1275,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:552:122: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   List.cons t_2
 argument
   t_2
@@ -1283,7 +1283,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:565:38: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1291,7 +1291,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:568:21: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk instr
 argument
   instr
@@ -1299,7 +1299,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:568:29: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1307,7 +1307,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:569:21: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk instr
 argument
   instr
@@ -1315,11 +1315,11 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:569:30: error: failed to synthesize instance
+./././SpecTec.lean: error: failed to synthesize instance
   HAppend Valtype Valtype ?m.81846
-./././SpecTec.lean:569:42: error: failed to synthesize instance
+./././SpecTec.lean: error: failed to synthesize instance
   HAppend Valtype Valtype ?m.82047
-./././SpecTec.lean:571:21: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk instr
 argument
   instr
@@ -1327,7 +1327,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:571:29: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1335,7 +1335,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:572:21: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t'_1
 argument
   t'_1
@@ -1343,7 +1343,7 @@ has type
   Valtype : Type
 but is expected to have type
   List Valtype : Type
-./././SpecTec.lean:573:21: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_2
 argument
   t_2
@@ -1351,7 +1351,7 @@ has type
   Valtype : Type
 but is expected to have type
   List Valtype : Type
-./././SpecTec.lean:574:21: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk instr
 argument
   instr
@@ -1359,7 +1359,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:574:37: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   ([t'_1], t'_2)
 argument
   t'_2
@@ -1367,7 +1367,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:576:28: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1375,7 +1375,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:577:33: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_2
 argument
   t_2
@@ -1383,9 +1383,9 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:578:22: error: failed to synthesize instance
+./././SpecTec.lean: error: failed to synthesize instance
   HAppend (List Instr) Instr ?m.83395
-./././SpecTec.lean:578:46: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1393,7 +1393,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:585:21: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk instr
 argument
   instr
@@ -1401,7 +1401,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:585:33: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   ([], t)
 argument
   t
@@ -1409,7 +1409,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:586:17: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk instr
 argument
   instr
@@ -1417,7 +1417,7 @@ has type
   Instr : Type
 but is expected to have type
   Expr : Type
-./././SpecTec.lean:602:20: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   (C, instr)
 argument
   instr
@@ -1425,13 +1425,13 @@ has type
   Instr : Type
 but is expected to have type
   Expr : Type
-./././SpecTec.lean:612:5: error: type mismatch
+./././SpecTec.lean: error: type mismatch
   (t_1, t_2)
 has type
   Valtype × Valtype : Type
 but is expected to have type
   Functype : Type
-./././SpecTec.lean:614:406: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   (expr, t_2)
 argument
   t_2
@@ -1439,7 +1439,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:615:22: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk t
 argument
   t
@@ -1447,9 +1447,9 @@ has type
   Valtype : Type
 but is expected to have type
   List Valtype : Type
-./././SpecTec.lean:614:107: error: failed to synthesize instance
+./././SpecTec.lean: error: failed to synthesize instance
   HAppend Valtype Valtype ?m.101807
-./././SpecTec.lean:614:249: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   List.cons t_2
 argument
   t_2
@@ -1457,7 +1457,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:614:392: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   some t_2
 argument
   t_2
@@ -1465,7 +1465,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean:646:22: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk expr
 argument
   expr
@@ -1473,7 +1473,7 @@ has type
   Expr : Type
 but is expected to have type
   List Expr : Type
-./././SpecTec.lean:657:18: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk b
 argument
   b
@@ -1481,45 +1481,45 @@ has type
   Byte : Type
 but is expected to have type
   List (List Byte) : Type
-./././SpecTec.lean:697:19: error: type mismatch
+./././SpecTec.lean: error: type mismatch
   ft
 has type
   Functype : Type
 but is expected to have type
   List Functype : Type
-./././SpecTec.lean:698:5: error: invalid field 'length', the environment does not contain 'Mem.length'
+./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Mem.length'
   mem
 has type
   Mem
-./././SpecTec.lean:698:5: error: invalid field 'length', the environment does not contain 'Memtype.length'
+./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Memtype.length'
   mem
 has type
   Memtype
-./././SpecTec.lean:698:5: error: invalid field 'length', the environment does not contain 'Limits.length'
+./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Limits.length'
   mem
 has type
   Limits
-./././SpecTec.lean:698:5: error: invalid field 'length', the environment does not contain 'Prod.length'
+./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Prod.length'
   mem
 has type
   U32 × U32
-./././SpecTec.lean:699:5: error: invalid field 'length', the environment does not contain 'Start.length'
+./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Start.length'
   start
 has type
   Start
-./././SpecTec.lean:699:5: error: invalid field 'length', the environment does not contain 'Funcidx.length'
+./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Funcidx.length'
   start
 has type
   Funcidx
-./././SpecTec.lean:699:5: error: invalid field 'length', the environment does not contain 'Idx.length'
+./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Idx.length'
   start
 has type
   Idx
-./././SpecTec.lean:699:5: error: invalid field 'length', the environment does not contain 'Nat.length'
+./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Nat.length'
   start
 has type
   Nat
-./././SpecTec.lean:700:16: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk import
 argument
   import
@@ -1527,7 +1527,7 @@ has type
   Import : Type
 but is expected to have type
   List Import : Type
-./././SpecTec.lean:700:26: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk func
 argument
   func
@@ -1535,7 +1535,7 @@ has type
   Func : Type
 but is expected to have type
   List Func : Type
-./././SpecTec.lean:700:32: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk global
 argument
   global
@@ -1543,7 +1543,7 @@ has type
   Global : Type
 but is expected to have type
   List Global : Type
-./././SpecTec.lean:700:42: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk table
 argument
   table
@@ -1551,7 +1551,7 @@ has type
   Table : Type
 but is expected to have type
   List Table : Type
-./././SpecTec.lean:700:49: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk mem
 argument
   mem
@@ -1559,7 +1559,7 @@ has type
   Mem : Type
 but is expected to have type
   List Mem : Type
-./././SpecTec.lean:700:54: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk elem
 argument
   elem
@@ -1567,7 +1567,7 @@ has type
   Elem : Type
 but is expected to have type
   List Elem : Type
-./././SpecTec.lean:700:60: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk data
 argument
   data
@@ -1575,7 +1575,7 @@ has type
   Data : Type
 but is expected to have type
   List Data : Type
-./././SpecTec.lean:700:66: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk start
 argument
   start
@@ -1583,33 +1583,33 @@ has type
   Start : Type
 but is expected to have type
   List Start : Type
-./././SpecTec.lean:832:5: warning: unused variable `s` [linter.unusedVariables]
-./././SpecTec.lean:835:8: warning: unused variable `f` [linter.unusedVariables]
-./././SpecTec.lean:840:4: error: expected identifier
-./././SpecTec.lean:840:10: error: expected 'elab', 'elab_rules', 'infix', 'infixl', 'infixr', 'instance', 'macro', 'macro_rules', 'notation', 'postfix', 'prefix', 'syntax' or 'unif_hint'
-./././SpecTec.lean:853:9: warning: unused variable `f` [linter.unusedVariables]
-./././SpecTec.lean:853:13: warning: unused variable `x` [linter.unusedVariables]
-./././SpecTec.lean:853:16: warning: unused variable `v` [linter.unusedVariables]
-./././SpecTec.lean:856:6: warning: unused variable `s` [linter.unusedVariables]
-./././SpecTec.lean:856:13: warning: unused variable `x` [linter.unusedVariables]
-./././SpecTec.lean:856:16: warning: unused variable `v` [linter.unusedVariables]
-./././SpecTec.lean:859:6: warning: unused variable `s` [linter.unusedVariables]
-./././SpecTec.lean:859:13: warning: unused variable `x` [linter.unusedVariables]
-./././SpecTec.lean:859:16: warning: unused variable `i` [linter.unusedVariables]
-./././SpecTec.lean:859:19: warning: unused variable `r` [linter.unusedVariables]
-./././SpecTec.lean:869:10: error: invalid field 'length', the environment does not contain 'Labelidx.length'
+./././SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
+./././SpecTec.lean: warning: unused variable `f` [linter.unusedVariables]
+./././SpecTec.lean: error: expected identifier
+./././SpecTec.lean: error: expected 'elab', 'elab_rules', 'infix', 'infixl', 'infixr', 'instance', 'macro', 'macro_rules', 'notation', 'postfix', 'prefix', 'syntax' or 'unif_hint'
+./././SpecTec.lean: warning: unused variable `f` [linter.unusedVariables]
+./././SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
+./././SpecTec.lean: warning: unused variable `v` [linter.unusedVariables]
+./././SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
+./././SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
+./././SpecTec.lean: warning: unused variable `v` [linter.unusedVariables]
+./././SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
+./././SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
+./././SpecTec.lean: warning: unused variable `i` [linter.unusedVariables]
+./././SpecTec.lean: warning: unused variable `r` [linter.unusedVariables]
+./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Labelidx.length'
   l
 has type
   Labelidx
-./././SpecTec.lean:869:10: error: invalid field 'length', the environment does not contain 'Idx.length'
+./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Idx.length'
   l
 has type
   Idx
-./././SpecTec.lean:869:10: error: invalid field 'length', the environment does not contain 'Nat.length'
+./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Nat.length'
   l
 has type
   Nat
-./././SpecTec.lean:870:103: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk l
 argument
   l
@@ -1617,19 +1617,19 @@ has type
   Labelidx : Type
 but is expected to have type
   List Labelidx : Type
-./././SpecTec.lean:872:9: error: invalid field 'length', the environment does not contain 'Labelidx.length'
+./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Labelidx.length'
   l
 has type
   Labelidx
-./././SpecTec.lean:872:9: error: invalid field 'length', the environment does not contain 'Idx.length'
+./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Idx.length'
   l
 has type
   Idx
-./././SpecTec.lean:872:9: error: invalid field 'length', the environment does not contain 'Nat.length'
+./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Nat.length'
   l
 has type
   Nat
-./././SpecTec.lean:873:103: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk l
 argument
   l
@@ -1637,19 +1637,19 @@ has type
   Labelidx : Type
 but is expected to have type
   List Labelidx : Type
-./././SpecTec.lean:873:144: error: invalid field 'get!', the environment does not contain 'Labelidx.get!'
+./././SpecTec.lean: error: invalid field 'get!', the environment does not contain 'Labelidx.get!'
   l
 has type
   Labelidx
-./././SpecTec.lean:873:144: error: invalid field 'get!', the environment does not contain 'Idx.get!'
+./././SpecTec.lean: error: invalid field 'get!', the environment does not contain 'Idx.get!'
   l
 has type
   Idx
-./././SpecTec.lean:873:144: error: invalid field 'get!', the environment does not contain 'Nat.get!'
+./././SpecTec.lean: error: invalid field 'get!', the environment does not contain 'Nat.get!'
   l
 has type
   Nat
-./././SpecTec.lean:881:40: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk instr'
 argument
   instr'
@@ -1657,11 +1657,11 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:881:50: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:881:74: error: failed to synthesize instance
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: failed to synthesize instance
   HAppend (List Admininstr) Admininstr ?m.130319
-./././SpecTec.lean:881:150: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:883:40: error: application type mismatch
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: application type mismatch
   Prod.mk instr'
 argument
   instr'
@@ -1669,12 +1669,12 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:883:50: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:883:76: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:883:100: error: failed to synthesize instance
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: failed to synthesize instance
   HAppend (List Admininstr) Admininstr ?m.130708
-./././SpecTec.lean:883:171: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:886:101: error: application type mismatch
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: application type mismatch
   Prod.mk instr_1
 argument
   instr_1
@@ -1682,7 +1682,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:886:160: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   (bt, instr_2)
 argument
   instr_2
@@ -1690,7 +1690,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:889:101: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk instr_1
 argument
   instr_1
@@ -1698,7 +1698,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:889:160: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   (bt, instr_1)
 argument
   instr_1
@@ -1706,14 +1706,14 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:891:5: error: type mismatch
+./././SpecTec.lean: error: type mismatch
   (t_1, t_2)
 has type
   Valtype × Valtype : Type
 but is expected to have type
   Blocktype : Type
-./././SpecTec.lean:892:18: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:892:77: error: application type mismatch
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: application type mismatch
   (bt, instr)
 argument
   instr
@@ -1721,7 +1721,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:892:131: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   (bt, instr)
 argument
   instr
@@ -1729,15 +1729,15 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:892:143: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:894:5: error: type mismatch
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: type mismatch
   (t_1, t_2)
 has type
   Valtype × Valtype : Type
 but is expected to have type
   Blocktype : Type
-./././SpecTec.lean:895:18: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:895:78: error: application type mismatch
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: application type mismatch
   (bt, instr)
 argument
   instr
@@ -1745,29 +1745,29 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean:895:120: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:897:18: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:897:82: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:897:104: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:900:18: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:900:42: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:900:156: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:903:18: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:903:42: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:903:156: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:905:18: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:912:18: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:915:18: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:919:5: error: type mismatch
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: type mismatch
   (m, (t_1, t_2), t, instr)
 has type
   Moduleinst × (Valtype × Valtype) × Valtype × Instr : Type
 but is expected to have type
   Funcinst : Type
-./././SpecTec.lean:920:22: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:920:110: error: failed to synthesize instance
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: failed to synthesize instance
   HAppend Val Val ?m.134041
-./././SpecTec.lean:920:174: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   ([], Admininstr.Instr instr)
 argument
   Admininstr.Instr instr
@@ -1775,20 +1775,20 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean:932:281: error: unknown constant 'Admininstr.Ref'
-./././SpecTec.lean:953:73: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:953:247: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:953:366: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:956:73: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:959:73: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:965:116: error: unknown constant 'Admininstr.Ref'
-./././SpecTec.lean:970:66: error: unknown constant 'Admininstr.Globalinst'
-./././SpecTec.lean:972:65: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:979:74: error: unknown constant 'Admininstr.Ref'
-./././SpecTec.lean:982:74: error: unknown constant 'Admininstr.Ref'
-./././SpecTec.lean:984:23: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:986:23: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean:990:21: error: application type mismatch
+./././SpecTec.lean: error: unknown constant 'Admininstr.Ref'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Ref'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Globalinst'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Ref'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Ref'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
+./././SpecTec.lean: error: application type mismatch
   (z, Admininstr.Instr instr)
 argument
   Admininstr.Instr instr
@@ -1796,7 +1796,7 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean:990:53: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   (z', Admininstr.Instr instr')
 argument
   Admininstr.Instr instr'
@@ -1804,7 +1804,7 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean:991:15: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   (z, Admininstr.Instr instr)
 argument
   Admininstr.Instr instr
@@ -1812,7 +1812,7 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean:991:47: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   (z', Admininstr.Instr instr')
 argument
   Admininstr.Instr instr'
@@ -1820,7 +1820,7 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean:993:20: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   (z, Admininstr.Instr instr)
 argument
   Admininstr.Instr instr
@@ -1828,7 +1828,7 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean:994:15: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   (z, Admininstr.Instr instr)
 argument
   Admininstr.Instr instr
@@ -1836,7 +1836,7 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean:994:46: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   (z, Admininstr.Instr instr')
 argument
   Admininstr.Instr instr'
@@ -1844,7 +1844,7 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean:996:16: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   Prod.mk (Admininstr.Instr instr)
 argument
   Admininstr.Instr instr
@@ -1852,7 +1852,7 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean:997:15: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   (z, Admininstr.Instr instr)
 argument
   Admininstr.Instr instr
@@ -1860,7 +1860,7 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean:997:46: error: application type mismatch
+./././SpecTec.lean: error: application type mismatch
   (z, Admininstr.Instr instr')
 argument
   Admininstr.Instr instr'

From 29f27bf963de5d7f8beca2fae1381691d5d5176e Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 5 Apr 2023 11:14:31 +0200
Subject: [PATCH 21/98] Simplify lean test setup

---
 spectec/flake.nix                     |   2 +
 spectec/test-lean4/TEST.md            | 372 +++++++++++++-------------
 spectec/test-lean4/dune               |   3 -
 spectec/test-lean4/lake-manifest.json |   1 -
 spectec/test-lean4/lakefile.lean      |  10 -
 spectec/test-lean4/lean-toolchain     |   1 -
 6 files changed, 186 insertions(+), 203 deletions(-)
 delete mode 100644 spectec/test-lean4/lake-manifest.json
 delete mode 100644 spectec/test-lean4/lakefile.lean
 delete mode 100644 spectec/test-lean4/lean-toolchain

diff --git a/spectec/flake.nix b/spectec/flake.nix
index 3a4eb16ad2..8f27f3605b 100644
--- a/spectec/flake.nix
+++ b/spectec/flake.nix
@@ -1,5 +1,6 @@
 {
   inputs.nixpkgs.url = "github:NixOS/nixpkgs";
+#  inputs.lean.url = "github:leanprover/lean4";
 
   description = "Nix infrastructure for spectec";
   outputs = { self, nixpkgs }:
@@ -10,6 +11,7 @@
       devShells.${system}.default =
         pkgs.mkShell {
           packages = with pkgs; [
+            #lean.packages.${system}.lean-all
             dune_3
             ocamlPackages.ocaml
             ocamlPackages.menhir
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 57bd0e757e..96225d8a04 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -1000,12 +1000,9 @@ inductive Step : (Config × Config) -> Prop where
   | pure (instr : Instr) (instr' : Instr) (z : State) :
     (Step_pure ((Admininstr.Instr instr), (Admininstr.Instr instr'))) ->
     (Step ((z, (Admininstr.Instr instr)), (z, (Admininstr.Instr instr'))))
-$ lake build |& sed -e 's,/[^ ]*/toolchains,.../toolchains`,g' | sed -e 's,SpecTec.lean:[0-9]\+:[0-9]\+,SpecTec.lean,'
-Building SpecTec
-error: > LEAN_PATH=./build/lib LD_LIBRARY_PATH=.../toolchains`/leanprover--lean4---nightly-2023-02-10/lib:/etc/sane-libs:./build/lib .../toolchains`/leanprover--lean4---nightly-2023-02-10/bin/lean ./././SpecTec.lean -R ././. -o ./build/lib/SpecTec.olean -i ./build/lib/SpecTec.ilean -c ./build/ir/SpecTec.c
-error: stdout:
-./././SpecTec.lean: warning: unused variable `n_3_ATOM_y` [linter.unusedVariables]
-./././SpecTec.lean: error: application type mismatch
+$ lean SpecTec.lean |& sed -e 's,/[^ ]*/toolchains,.../toolchains`,g' | sed -e 's,SpecTec.lean:[0-9]\+:[0-9]\+,SpecTec.lean,'
+SpecTec.lean: warning: unused variable `n_3_ATOM_y` [linter.unusedVariables]
+SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1013,51 +1010,51 @@ has type
   Valtype : Type
 but is expected to have type
   List Valtype : Type
-./././SpecTec.lean: error: type mismatch
+SpecTec.lean: error: type mismatch
   none
 has type
   Option ?m.72695 : Type ?u.72694
 but is expected to have type
   N : Type
-./././SpecTec.lean: error: unknown constant 'Numtype.In'
-./././SpecTec.lean: error: type mismatch
+SpecTec.lean: error: unknown constant 'Numtype.In'
+SpecTec.lean: error: type mismatch
   none
 has type
   Option ?m.73266 : Type ?u.73265
 but is expected to have type
   N : Type
-./././SpecTec.lean: error: unknown constant 'Numtype.In'
-./././SpecTec.lean: error: unknown constant 'Numtype.Fn'
-./././SpecTec.lean: error: unknown constant 'Numtype.Fn'
-./././SpecTec.lean: error: unknown constant 'Valtype.Fn'
-./././SpecTec.lean: error: unknown constant 'Valtype.Fn'
-./././SpecTec.lean: error: type mismatch
+SpecTec.lean: error: unknown constant 'Numtype.In'
+SpecTec.lean: error: unknown constant 'Numtype.Fn'
+SpecTec.lean: error: unknown constant 'Numtype.Fn'
+SpecTec.lean: error: unknown constant 'Valtype.Fn'
+SpecTec.lean: error: unknown constant 'Valtype.Fn'
+SpecTec.lean: error: type mismatch
   none
 has type
   Option ?m.75279 : Type ?u.75278
 but is expected to have type
   Sx : Type
-./././SpecTec.lean: error: unknown constant 'Valtype.In'
-./././SpecTec.lean: error: unknown constant 'Valtype.In'
-./././SpecTec.lean: error: unknown constant 'Numtype.In'
-./././SpecTec.lean: error: unknown constant 'Numtype.In'
-./././SpecTec.lean: error: unknown constant 'Valtype.In'
-./././SpecTec.lean: error: unknown constant 'Valtype.In'
-./././SpecTec.lean: error: type mismatch
+SpecTec.lean: error: unknown constant 'Valtype.In'
+SpecTec.lean: error: unknown constant 'Valtype.In'
+SpecTec.lean: error: unknown constant 'Numtype.In'
+SpecTec.lean: error: unknown constant 'Numtype.In'
+SpecTec.lean: error: unknown constant 'Valtype.In'
+SpecTec.lean: error: unknown constant 'Valtype.In'
+SpecTec.lean: error: type mismatch
   (t_1, t_2)
 has type
   Valtype × Valtype : Type
 but is expected to have type
   Functype : Type
-./././SpecTec.lean: error: failed to synthesize instance
+SpecTec.lean: error: failed to synthesize instance
   HAppend Valtype (List Valtype) ?m.76541
-./././SpecTec.lean: error: type mismatch
+SpecTec.lean: error: type mismatch
   (t_1, t_2)
 has type
   Valtype × Valtype : Type
 but is expected to have type
   Functype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1065,15 +1062,15 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: type mismatch
+SpecTec.lean: error: type mismatch
   some t
 has type
   Option Valtype : Type
 but is expected to have type
   Option Resulttype : Type
-./././SpecTec.lean: error: failed to synthesize instance
+SpecTec.lean: error: failed to synthesize instance
   HAppend Valtype Valtype ?m.77852
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t
 argument
   t
@@ -1081,7 +1078,7 @@ has type
   Valtype : Type
 but is expected to have type
   List Valtype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t
 argument
   t
@@ -1089,7 +1086,7 @@ has type
   Valtype : Type
 but is expected to have type
   List Valtype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk l
 argument
   l
@@ -1097,25 +1094,25 @@ has type
   Labelidx : Type
 but is expected to have type
   List Labelidx : Type
-./././SpecTec.lean: error: failed to synthesize instance
+SpecTec.lean: error: failed to synthesize instance
   HAppend Valtype Valtype ?m.78399
-./././SpecTec.lean: error: type mismatch
+SpecTec.lean: error: type mismatch
   t
 has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: failed to synthesize instance
+SpecTec.lean: error: failed to synthesize instance
   HAppend Valtype (List Valtype) ?m.79015
-./././SpecTec.lean: error: type mismatch
+SpecTec.lean: error: type mismatch
   t
 has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: failed to synthesize instance
+SpecTec.lean: error: failed to synthesize instance
   HAppend Valtype Valtype ?m.79533
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1123,7 +1120,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk instr_1
 argument
   instr_1
@@ -1131,7 +1128,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1139,7 +1136,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   List.cons t_2
 argument
   t_2
@@ -1147,7 +1144,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk instr_2
 argument
   instr_2
@@ -1155,7 +1152,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1163,7 +1160,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk instr_1
 argument
   instr_1
@@ -1171,7 +1168,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1179,7 +1176,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   List.cons t_2
 argument
   t_2
@@ -1187,7 +1184,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1195,7 +1192,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk instr
 argument
   instr
@@ -1203,7 +1200,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1211,7 +1208,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   (bt, instr)
 argument
   instr
@@ -1219,7 +1216,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1227,7 +1224,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   List.cons t_1
 argument
   t_1
@@ -1235,7 +1232,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1243,7 +1240,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk instr
 argument
   instr
@@ -1251,7 +1248,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1259,7 +1256,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   (bt, instr)
 argument
   instr
@@ -1267,7 +1264,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1275,7 +1272,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   List.cons t_2
 argument
   t_2
@@ -1283,7 +1280,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1291,7 +1288,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk instr
 argument
   instr
@@ -1299,7 +1296,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1307,7 +1304,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk instr
 argument
   instr
@@ -1315,11 +1312,11 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: failed to synthesize instance
+SpecTec.lean: error: failed to synthesize instance
   HAppend Valtype Valtype ?m.81846
-./././SpecTec.lean: error: failed to synthesize instance
+SpecTec.lean: error: failed to synthesize instance
   HAppend Valtype Valtype ?m.82047
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk instr
 argument
   instr
@@ -1327,7 +1324,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1335,7 +1332,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t'_1
 argument
   t'_1
@@ -1343,7 +1340,7 @@ has type
   Valtype : Type
 but is expected to have type
   List Valtype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t_2
 argument
   t_2
@@ -1351,7 +1348,7 @@ has type
   Valtype : Type
 but is expected to have type
   List Valtype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk instr
 argument
   instr
@@ -1359,7 +1356,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   ([t'_1], t'_2)
 argument
   t'_2
@@ -1367,7 +1364,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1375,7 +1372,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t_2
 argument
   t_2
@@ -1383,9 +1380,9 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: failed to synthesize instance
+SpecTec.lean: error: failed to synthesize instance
   HAppend (List Instr) Instr ?m.83395
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t_1
 argument
   t_1
@@ -1393,7 +1390,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk instr
 argument
   instr
@@ -1401,7 +1398,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   ([], t)
 argument
   t
@@ -1409,7 +1406,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk instr
 argument
   instr
@@ -1417,7 +1414,7 @@ has type
   Instr : Type
 but is expected to have type
   Expr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   (C, instr)
 argument
   instr
@@ -1425,13 +1422,13 @@ has type
   Instr : Type
 but is expected to have type
   Expr : Type
-./././SpecTec.lean: error: type mismatch
+SpecTec.lean: error: type mismatch
   (t_1, t_2)
 has type
   Valtype × Valtype : Type
 but is expected to have type
   Functype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   (expr, t_2)
 argument
   t_2
@@ -1439,7 +1436,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk t
 argument
   t
@@ -1447,9 +1444,9 @@ has type
   Valtype : Type
 but is expected to have type
   List Valtype : Type
-./././SpecTec.lean: error: failed to synthesize instance
+SpecTec.lean: error: failed to synthesize instance
   HAppend Valtype Valtype ?m.101807
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   List.cons t_2
 argument
   t_2
@@ -1457,7 +1454,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   some t_2
 argument
   t_2
@@ -1465,7 +1462,7 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk expr
 argument
   expr
@@ -1473,7 +1470,7 @@ has type
   Expr : Type
 but is expected to have type
   List Expr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk b
 argument
   b
@@ -1481,45 +1478,45 @@ has type
   Byte : Type
 but is expected to have type
   List (List Byte) : Type
-./././SpecTec.lean: error: type mismatch
+SpecTec.lean: error: type mismatch
   ft
 has type
   Functype : Type
 but is expected to have type
   List Functype : Type
-./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Mem.length'
+SpecTec.lean: error: invalid field 'length', the environment does not contain 'Mem.length'
   mem
 has type
   Mem
-./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Memtype.length'
+SpecTec.lean: error: invalid field 'length', the environment does not contain 'Memtype.length'
   mem
 has type
   Memtype
-./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Limits.length'
+SpecTec.lean: error: invalid field 'length', the environment does not contain 'Limits.length'
   mem
 has type
   Limits
-./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Prod.length'
+SpecTec.lean: error: invalid field 'length', the environment does not contain 'Prod.length'
   mem
 has type
   U32 × U32
-./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Start.length'
+SpecTec.lean: error: invalid field 'length', the environment does not contain 'Start.length'
   start
 has type
   Start
-./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Funcidx.length'
+SpecTec.lean: error: invalid field 'length', the environment does not contain 'Funcidx.length'
   start
 has type
   Funcidx
-./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Idx.length'
+SpecTec.lean: error: invalid field 'length', the environment does not contain 'Idx.length'
   start
 has type
   Idx
-./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Nat.length'
+SpecTec.lean: error: invalid field 'length', the environment does not contain 'Nat.length'
   start
 has type
   Nat
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk import
 argument
   import
@@ -1527,7 +1524,7 @@ has type
   Import : Type
 but is expected to have type
   List Import : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk func
 argument
   func
@@ -1535,7 +1532,7 @@ has type
   Func : Type
 but is expected to have type
   List Func : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk global
 argument
   global
@@ -1543,7 +1540,7 @@ has type
   Global : Type
 but is expected to have type
   List Global : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk table
 argument
   table
@@ -1551,7 +1548,7 @@ has type
   Table : Type
 but is expected to have type
   List Table : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk mem
 argument
   mem
@@ -1559,7 +1556,7 @@ has type
   Mem : Type
 but is expected to have type
   List Mem : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk elem
 argument
   elem
@@ -1567,7 +1564,7 @@ has type
   Elem : Type
 but is expected to have type
   List Elem : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk data
 argument
   data
@@ -1575,7 +1572,7 @@ has type
   Data : Type
 but is expected to have type
   List Data : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk start
 argument
   start
@@ -1583,33 +1580,33 @@ has type
   Start : Type
 but is expected to have type
   List Start : Type
-./././SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
-./././SpecTec.lean: warning: unused variable `f` [linter.unusedVariables]
-./././SpecTec.lean: error: expected identifier
-./././SpecTec.lean: error: expected 'elab', 'elab_rules', 'infix', 'infixl', 'infixr', 'instance', 'macro', 'macro_rules', 'notation', 'postfix', 'prefix', 'syntax' or 'unif_hint'
-./././SpecTec.lean: warning: unused variable `f` [linter.unusedVariables]
-./././SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
-./././SpecTec.lean: warning: unused variable `v` [linter.unusedVariables]
-./././SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
-./././SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
-./././SpecTec.lean: warning: unused variable `v` [linter.unusedVariables]
-./././SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
-./././SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
-./././SpecTec.lean: warning: unused variable `i` [linter.unusedVariables]
-./././SpecTec.lean: warning: unused variable `r` [linter.unusedVariables]
-./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Labelidx.length'
+SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `f` [linter.unusedVariables]
+SpecTec.lean: error: expected identifier
+SpecTec.lean: error: expected 'elab', 'elab_rules', 'infix', 'infixl', 'infixr', 'instance', 'macro', 'macro_rules', 'notation', 'postfix', 'prefix', 'syntax' or 'unif_hint'
+SpecTec.lean: warning: unused variable `f` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `v` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `v` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `i` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `r` [linter.unusedVariables]
+SpecTec.lean: error: invalid field 'length', the environment does not contain 'Labelidx.length'
   l
 has type
   Labelidx
-./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Idx.length'
+SpecTec.lean: error: invalid field 'length', the environment does not contain 'Idx.length'
   l
 has type
   Idx
-./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Nat.length'
+SpecTec.lean: error: invalid field 'length', the environment does not contain 'Nat.length'
   l
 has type
   Nat
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk l
 argument
   l
@@ -1617,19 +1614,19 @@ has type
   Labelidx : Type
 but is expected to have type
   List Labelidx : Type
-./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Labelidx.length'
+SpecTec.lean: error: invalid field 'length', the environment does not contain 'Labelidx.length'
   l
 has type
   Labelidx
-./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Idx.length'
+SpecTec.lean: error: invalid field 'length', the environment does not contain 'Idx.length'
   l
 has type
   Idx
-./././SpecTec.lean: error: invalid field 'length', the environment does not contain 'Nat.length'
+SpecTec.lean: error: invalid field 'length', the environment does not contain 'Nat.length'
   l
 has type
   Nat
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk l
 argument
   l
@@ -1637,19 +1634,19 @@ has type
   Labelidx : Type
 but is expected to have type
   List Labelidx : Type
-./././SpecTec.lean: error: invalid field 'get!', the environment does not contain 'Labelidx.get!'
+SpecTec.lean: error: invalid field 'get!', the environment does not contain 'Labelidx.get!'
   l
 has type
   Labelidx
-./././SpecTec.lean: error: invalid field 'get!', the environment does not contain 'Idx.get!'
+SpecTec.lean: error: invalid field 'get!', the environment does not contain 'Idx.get!'
   l
 has type
   Idx
-./././SpecTec.lean: error: invalid field 'get!', the environment does not contain 'Nat.get!'
+SpecTec.lean: error: invalid field 'get!', the environment does not contain 'Nat.get!'
   l
 has type
   Nat
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk instr'
 argument
   instr'
@@ -1657,11 +1654,11 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: failed to synthesize instance
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: failed to synthesize instance
   HAppend (List Admininstr) Admininstr ?m.130319
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: application type mismatch
   Prod.mk instr'
 argument
   instr'
@@ -1669,12 +1666,12 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: failed to synthesize instance
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: failed to synthesize instance
   HAppend (List Admininstr) Admininstr ?m.130708
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: application type mismatch
   Prod.mk instr_1
 argument
   instr_1
@@ -1682,7 +1679,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   (bt, instr_2)
 argument
   instr_2
@@ -1690,7 +1687,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk instr_1
 argument
   instr_1
@@ -1698,7 +1695,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   (bt, instr_1)
 argument
   instr_1
@@ -1706,14 +1703,14 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: type mismatch
+SpecTec.lean: error: type mismatch
   (t_1, t_2)
 has type
   Valtype × Valtype : Type
 but is expected to have type
   Blocktype : Type
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: application type mismatch
   (bt, instr)
 argument
   instr
@@ -1721,7 +1718,7 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   (bt, instr)
 argument
   instr
@@ -1729,15 +1726,15 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: type mismatch
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: type mismatch
   (t_1, t_2)
 has type
   Valtype × Valtype : Type
 but is expected to have type
   Blocktype : Type
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: application type mismatch
   (bt, instr)
 argument
   instr
@@ -1745,29 +1742,29 @@ has type
   Instr : Type
 but is expected to have type
   List Instr : Type
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: type mismatch
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: type mismatch
   (m, (t_1, t_2), t, instr)
 has type
   Moduleinst × (Valtype × Valtype) × Valtype × Instr : Type
 but is expected to have type
   Funcinst : Type
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: failed to synthesize instance
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: failed to synthesize instance
   HAppend Val Val ?m.134041
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   ([], Admininstr.Instr instr)
 argument
   Admininstr.Instr instr
@@ -1775,20 +1772,20 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean: error: unknown constant 'Admininstr.Ref'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Ref'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Globalinst'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Ref'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Ref'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: unknown constant 'Admininstr.Val'
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: unknown constant 'Admininstr.Ref'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Ref'
+SpecTec.lean: error: unknown constant 'Admininstr.Globalinst'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Ref'
+SpecTec.lean: error: unknown constant 'Admininstr.Ref'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: application type mismatch
   (z, Admininstr.Instr instr)
 argument
   Admininstr.Instr instr
@@ -1796,7 +1793,7 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   (z', Admininstr.Instr instr')
 argument
   Admininstr.Instr instr'
@@ -1804,7 +1801,7 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   (z, Admininstr.Instr instr)
 argument
   Admininstr.Instr instr
@@ -1812,7 +1809,7 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   (z', Admininstr.Instr instr')
 argument
   Admininstr.Instr instr'
@@ -1820,7 +1817,7 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   (z, Admininstr.Instr instr)
 argument
   Admininstr.Instr instr
@@ -1828,7 +1825,7 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   (z, Admininstr.Instr instr)
 argument
   Admininstr.Instr instr
@@ -1836,7 +1833,7 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   (z, Admininstr.Instr instr')
 argument
   Admininstr.Instr instr'
@@ -1844,7 +1841,7 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   Prod.mk (Admininstr.Instr instr)
 argument
   Admininstr.Instr instr
@@ -1852,7 +1849,7 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   (z, Admininstr.Instr instr)
 argument
   Admininstr.Instr instr
@@ -1860,7 +1857,7 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-./././SpecTec.lean: error: application type mismatch
+SpecTec.lean: error: application type mismatch
   (z, Admininstr.Instr instr')
 argument
   Admininstr.Instr instr'
@@ -1868,5 +1865,4 @@ has type
   Admininstr : Type
 but is expected to have type
   List Admininstr : Type
-error: external command `.../toolchains`/leanprover--lean4---nightly-2023-02-10/bin/lean` exited with code 1
 ```
diff --git a/spectec/test-lean4/dune b/spectec/test-lean4/dune
index 1bcb8e20b8..cf53a32136 100644
--- a/spectec/test-lean4/dune
+++ b/spectec/test-lean4/dune
@@ -3,9 +3,6 @@
   (deps
     (file ../src/exe-lean4/main.exe)
     (glob_files ../spec/*.watsup)
-    (file lean-toolchain)
-    (file lake-manifest.json)
-    (file lakefile.lean)
   )
   (files TEST.md)
 )
diff --git a/spectec/test-lean4/lake-manifest.json b/spectec/test-lean4/lake-manifest.json
deleted file mode 100644
index 1e31dae761..0000000000
--- a/spectec/test-lean4/lake-manifest.json
+++ /dev/null
@@ -1 +0,0 @@
-{"version": 4, "packagesDir": "lake-packages", "packages": []}
diff --git a/spectec/test-lean4/lakefile.lean b/spectec/test-lean4/lakefile.lean
deleted file mode 100644
index db0142a79b..0000000000
--- a/spectec/test-lean4/lakefile.lean
+++ /dev/null
@@ -1,10 +0,0 @@
-import Lake
-
-open Lake DSL
-
-package spectec
-
-@[default_target]
-lean_lib SpecTec where
-
-/- require std from git "https://github.com/leanprover/std4" @ "main" -/
diff --git a/spectec/test-lean4/lean-toolchain b/spectec/test-lean4/lean-toolchain
deleted file mode 100644
index 5bf01da5f3..0000000000
--- a/spectec/test-lean4/lean-toolchain
+++ /dev/null
@@ -1 +0,0 @@
-leanprover/lean4:nightly-2023-02-10

From e04dc576d8b39115f933d764d5e8f4db8e974b16 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 5 Apr 2023 11:21:27 +0200
Subject: [PATCH 22/98] Add haskell and lean to CI setup

---
 .github/workflows/ci-spectec.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/ci-spectec.yml b/.github/workflows/ci-spectec.yml
index 5568044f82..f57df7defd 100644
--- a/.github/workflows/ci-spectec.yml
+++ b/.github/workflows/ci-spectec.yml
@@ -22,6 +22,16 @@ jobs:
         uses: ocaml/setup-ocaml@v2
         with:
           ocaml-compiler: 4.14.x
+      - name: Setup Haskell
+        uses: haskell/actions/setup@v2
+        with:
+          ghc-version: 9.2
+      - name: Setup Lean
+        uses: engineerd/configurator@v0.0.9
+        with:
+          name: Lean
+          url: https://github.com/leanprover/lean4-nightly/releases/download/nightly-2023-04-04/lean-4.0.0-nightly-2023-04-04-linux.tar.zst
+          pathInArchive: bin/lean
       - name: Setup Dune
         run: opam install --yes dune menhir mdx
       - name: Setup Latex

From 832fe238e5f60b3d956c38753576eec7f4e96f0f Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 5 Apr 2023 11:29:10 +0200
Subject: [PATCH 23/98] Avoid bashim

---
 .github/workflows/ci-spectec.yml | 4 ++--
 spectec/test-lean4/TEST.md       | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci-spectec.yml b/.github/workflows/ci-spectec.yml
index f57df7defd..f09cc1249b 100644
--- a/.github/workflows/ci-spectec.yml
+++ b/.github/workflows/ci-spectec.yml
@@ -30,8 +30,8 @@ jobs:
         uses: engineerd/configurator@v0.0.9
         with:
           name: Lean
-          url: https://github.com/leanprover/lean4-nightly/releases/download/nightly-2023-04-04/lean-4.0.0-nightly-2023-04-04-linux.tar.zst
-          pathInArchive: bin/lean
+          url: https://github.com/leanprover/lean4-nightly/releases/download/nightly-2023-02-10/lean-4.0.0-nightly-2023-02-10-linux.tar.zst
+          pathInArchive: lean-4.0.0-nightly-2023-02-10-linux/bin/lean
       - name: Setup Dune
         run: opam install --yes dune menhir mdx
       - name: Setup Latex
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 96225d8a04..c7bd647763 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -1000,7 +1000,7 @@ inductive Step : (Config × Config) -> Prop where
   | pure (instr : Instr) (instr' : Instr) (z : State) :
     (Step_pure ((Admininstr.Instr instr), (Admininstr.Instr instr'))) ->
     (Step ((z, (Admininstr.Instr instr)), (z, (Admininstr.Instr instr'))))
-$ lean SpecTec.lean |& sed -e 's,/[^ ]*/toolchains,.../toolchains`,g' | sed -e 's,SpecTec.lean:[0-9]\+:[0-9]\+,SpecTec.lean,'
+$ lean SpecTec.lean 2>&1 | sed -e 's,/[^ ]*/toolchains,.../toolchains`,g' | sed -e 's,SpecTec.lean:[0-9]\+:[0-9]\+,SpecTec.lean,'
 SpecTec.lean: warning: unused variable `n_3_ATOM_y` [linter.unusedVariables]
 SpecTec.lean: error: application type mismatch
   Prod.mk t_1

From 8ed71a7bfb51110a31a8b141b47c7c45771ea566 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 5 Apr 2023 11:33:50 +0200
Subject: [PATCH 24/98] Test the Pull Request, not the merge commit

---
 .github/workflows/ci-spectec.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci-spectec.yml b/.github/workflows/ci-spectec.yml
index f09cc1249b..ff2c79a40b 100644
--- a/.github/workflows/ci-spectec.yml
+++ b/.github/workflows/ci-spectec.yml
@@ -17,7 +17,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
       - name: Setup OCaml
         uses: ocaml/setup-ocaml@v2
         with:

From 9bdda9649a4b0da305e32bb10341a7bff19ce4ae Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 5 Apr 2023 11:43:29 +0200
Subject: [PATCH 25/98] Try this path

---
 .github/workflows/ci-spectec.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-spectec.yml b/.github/workflows/ci-spectec.yml
index ff2c79a40b..b588a337a2 100644
--- a/.github/workflows/ci-spectec.yml
+++ b/.github/workflows/ci-spectec.yml
@@ -33,7 +33,7 @@ jobs:
         with:
           name: Lean
           url: https://github.com/leanprover/lean4-nightly/releases/download/nightly-2023-02-10/lean-4.0.0-nightly-2023-02-10-linux.tar.zst
-          pathInArchive: lean-4.0.0-nightly-2023-02-10-linux/bin/lean
+          pathInArchive: bin/lean
       - name: Setup Dune
         run: opam install --yes dune menhir mdx
       - name: Setup Latex

From ddf581442629f0f96779bb22eb0937860436ccc7 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 5 Apr 2023 11:46:42 +0200
Subject: [PATCH 26/98] Lower case lean

---
 .github/workflows/ci-spectec.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci-spectec.yml b/.github/workflows/ci-spectec.yml
index b588a337a2..132786c419 100644
--- a/.github/workflows/ci-spectec.yml
+++ b/.github/workflows/ci-spectec.yml
@@ -31,9 +31,9 @@ jobs:
       - name: Setup Lean
         uses: engineerd/configurator@v0.0.9
         with:
-          name: Lean
+          name: lean
           url: https://github.com/leanprover/lean4-nightly/releases/download/nightly-2023-02-10/lean-4.0.0-nightly-2023-02-10-linux.tar.zst
-          pathInArchive: bin/lean
+          pathInArchive: lean-4.0.0-nightly-2023-02-10-linux/bin/lean
       - name: Setup Dune
         run: opam install --yes dune menhir mdx
       - name: Setup Latex

From dc7d5693d473a0ea83ddd31146330c79c0101d2d Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 5 Apr 2023 22:01:58 +0200
Subject: [PATCH 27/98] Try manually

---
 .github/workflows/ci-spectec.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci-spectec.yml b/.github/workflows/ci-spectec.yml
index 132786c419..fe2b0595c1 100644
--- a/.github/workflows/ci-spectec.yml
+++ b/.github/workflows/ci-spectec.yml
@@ -29,11 +29,11 @@ jobs:
         with:
           ghc-version: 9.2
       - name: Setup Lean
-        uses: engineerd/configurator@v0.0.9
-        with:
-          name: lean
-          url: https://github.com/leanprover/lean4-nightly/releases/download/nightly-2023-02-10/lean-4.0.0-nightly-2023-02-10-linux.tar.zst
-          pathInArchive: lean-4.0.0-nightly-2023-02-10-linux/bin/lean
+        run: |
+          cd /tmp
+          curl -O https://github.com/leanprover/lean4-nightly/releases/download/nightly-2023-02-10/lean-4.0.0-nightly-2023-02-10-linux.tar.zst
+          tar xaf lean-4.0.0-nightly-2023-02-10-linux.tar.zst
+          echo "/tmp/lean-4.0.0-nightly-2023-02-10-linux/bin" >> $GITHUB_PATH
       - name: Setup Dune
         run: opam install --yes dune menhir mdx
       - name: Setup Latex

From 4a7fd54129e3aa7f1efb65da16daf7d689c60c6b Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 5 Apr 2023 22:09:43 +0200
Subject: [PATCH 28/98] Update for multiplicity variables

---
 spectec/src/backend-lean4/gen.ml |  14 +-
 spectec/src/exe-haskell/main.ml  |   2 -
 spectec/src/exe-lean4/main.ml    |   2 -
 spectec/test-haskell/TEST.md     | 118 ++--
 spectec/test-lean4/TEST.md       | 936 +++++++++----------------------
 5 files changed, 325 insertions(+), 747 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index add4be5270..634def627b 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -47,6 +47,13 @@ let render_field_name : atom -> string = function
   | Atom s -> make_id s
   | a -> "/- render_field_name: TODO -/ " ^ Il.Print.string_of_atom a
 
+
+let wrap_type_iter (ty : string) : iter -> string = function
+  | Opt -> "Option" $$ ty
+  |  _  -> "List" $$ ty
+
+let wrap_type_iters (ty : string) : iter list -> string = List.fold_left wrap_type_iter ty
+
 let rec render_typ (ty : typ) = match ty.it with
   | VarT id -> render_type_name id
   | BoolT -> "Bool"
@@ -54,8 +61,7 @@ let rec render_typ (ty : typ) = match ty.it with
   | TextT -> "String"
   | TupT [] -> "Unit"
   | TupT tys -> render_tuple_typ tys
-  | IterT (ty, Opt) -> "Option" $$ render_typ ty
-  | IterT (ty, _) -> "List" $$ render_typ ty
+  | IterT (ty, it) -> wrap_type_iter (render_typ ty) it
 
 and render_tuple_typ tys = parens (String.concat " × " (List.map render_typ tys))
 
@@ -190,8 +196,8 @@ let rec render_def (d : def) =
     String.concat "" (List.mapi (fun i (rule : rule) -> match rule.it with
       | RuleD (rule_id, binds, _mixop, exp, prems) ->
         "\n  | " ^ render_rule_name false id rule_id i ^ " " ^
-        String.concat " " (List.map (fun ((bid : id), btyp) ->
-          parens (render_id bid ^ " : " ^ render_typ btyp)
+        String.concat " " (List.map (fun ((bid : id), btyp, iters) ->
+          parens (render_id bid ^ " : " ^ wrap_type_iters (render_typ btyp) iters)
           ) binds) ^ " : " ^
         String.concat "" (List.map (fun (prem : premise) ->
           "\n    " ^
diff --git a/spectec/src/exe-haskell/main.ml b/spectec/src/exe-haskell/main.ml
index dc30d13318..6f77250c9d 100644
--- a/spectec/src/exe-haskell/main.ml
+++ b/spectec/src/exe-haskell/main.ml
@@ -48,8 +48,6 @@ let () =
     Arg.parse argspec add_arg usage;
     log "Parsing...";
     let el = List.concat_map Frontend.Parse.parse_file !srcs in
-    log "Multiplicity checking...";
-    Frontend.Multiplicity.check el;
     log "Elaboration...";
     let il = Frontend.Elab.elab el in
     log "IL Validation...";
diff --git a/spectec/src/exe-lean4/main.ml b/spectec/src/exe-lean4/main.ml
index c6676ee3ed..e6d466a785 100644
--- a/spectec/src/exe-lean4/main.ml
+++ b/spectec/src/exe-lean4/main.ml
@@ -48,8 +48,6 @@ let () =
     Arg.parse argspec add_arg usage;
     log "Parsing...";
     let el = List.concat_map Frontend.Parse.parse_file !srcs in
-    log "Multiplicity checking...";
-    Frontend.Multiplicity.check el;
     log "Elaboration...";
     let il = Frontend.Elab.elab el in
     log "IL Validation...";
diff --git a/spectec/test-haskell/TEST.md b/spectec/test-haskell/TEST.md
index 3f5ade3c0f..abd002c042 100644
--- a/spectec/test-haskell/TEST.md
+++ b/spectec/test-haskell/TEST.md
@@ -838,7 +838,7 @@ relation Valtype_sub: `|-%<:%`(valtype, valtype)
 ;; ../spec/3-typing.watsup:62.1-62.72
 relation Resulttype_sub: `|-%<:%`(valtype*, valtype*)
   ;; ../spec/3-typing.watsup:70.1-72.35
-  rule _ {t_1 : valtype, t_2 : valtype}:
+  rule _ {t_1* : valtype*, t_2* : valtype*}:
     `|-%<:%`(t_1*, t_2*)
     -- (Valtype_sub: `|-%<:%`(t_1, t_2))*
 -}
@@ -935,7 +935,7 @@ rec {
 ;; ../spec/3-typing.watsup:123.1-123.66
 relation Instr_ok: `%|-%:%`(context, instr, functype)
   ;; ../spec/3-typing.watsup:357.1-362.32
-  rule store {C : context, in : in, mt : memtype, n : n, n_A : n, n_O : n, nt : numtype, t : valtype}:
+  rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, t : valtype}:
     `%|-%:%`(C, STORE_instr(nt, n?, n_A, n_O), `%->%`([I32_valtype (nt <: valtype)], []))
     -- if (C.MEM_context[0] = mt)
     -- if ((2 ^ n_A) <= ($size(t) / 8))
@@ -943,8 +943,8 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if ((n? = ?()) \/ (nt = (in <: numtype)))
 
   ;; ../spec/3-typing.watsup:350.1-355.32
-  rule load {C : context, in : in, mt : memtype, n : n, n_A : n, n_O : n, nt : numtype, sx : sx, t : valtype}:
-    `%|-%:%`(C, LOAD_instr(nt, ?((n, sx)), n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
+  rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?, t : valtype}:
+    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?, n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
     -- if (C.MEM_context[0] = mt)
     -- if ((2 ^ n_A) <= ($size(t) / 8))
     -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(t) / 8))))?
@@ -1031,7 +1031,7 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
   ;; ../spec/3-typing.watsup:281.1-283.29
   rule global.get {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(()?, t))
 
   ;; ../spec/3-typing.watsup:276.1-278.23
   rule local.tee {C : context, t : valtype, x : idx}:
@@ -1067,7 +1067,7 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (fn_1 =/= fn_2)
 
   ;; ../spec/3-typing.watsup:247.1-250.52
-  rule convert-i {C : context, in_1 : in, in_2 : in, sx : sx}:
+  rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?}:
     `%|-%:%`(C, CVTOP_instr((in_1 <: numtype), CONVERT_cvtop, (in_2 <: numtype), sx?), `%->%`([(in_2 <: valtype)], [(in_1 <: valtype)]))
     -- if (in_1 =/= in_2)
     -- if ((sx? = ?()) <=> ($size(in_1 <: valtype) > $size(in_2 <: valtype)))
@@ -1104,52 +1104,52 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [(nt <: valtype)]))
 
   ;; ../spec/3-typing.watsup:216.1-219.26
-  rule call_indirect {C : context, ft : functype, lim : limits, t_1 : valtype, t_2 : valtype, x : idx}:
+  rule call_indirect {C : context, ft : functype, lim : limits, t_1* : valtype*, t_2* : valtype*, x : idx}:
     `%|-%:%`(C, CALL_INDIRECT_instr(x, ft), `%->%`(t_1* :: [I32_valtype], t_2*))
     -- if (C.TABLE_context[x] = `%%`(lim, FUNCREF_reftype))
     -- if (ft = `%->%`(t_1*, t_2*))
 
   ;; ../spec/3-typing.watsup:212.1-214.33
-  rule call {C : context, t_1 : valtype, t_2 : valtype, x : idx}:
+  rule call {C : context, t_1* : valtype*, t_2* : valtype*, x : idx}:
     `%|-%:%`(C, CALL_instr(x), `%->%`(t_1*, t_2*))
     -- if (C.FUNC_context[x] = `%->%`(t_1*, t_2*))
 
   ;; ../spec/3-typing.watsup:208.1-210.24
-  rule return {C : context, t : valtype, t_1 : valtype, t_2 : valtype}:
+  rule return {C : context, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, RETURN_instr, `%->%`(t_1* :: t*, t_2*))
     -- if (C.RETURN_context = ?(t*))
 
   ;; ../spec/3-typing.watsup:203.1-206.42
-  rule br_table {C : context, l : labelidx, l' : labelidx, t : valtype, t_1 : valtype, t_2 : valtype}:
+  rule br_table {C : context, l* : labelidx*, l' : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, BR_TABLE_instr(l*, l'), `%->%`(t_1* :: t*, t_2*))
     -- (Resulttype_sub: `|-%<:%`(t*, C.LABEL_context[l]))*
     -- Resulttype_sub: `|-%<:%`(t*, C.LABEL_context[l'])
 
   ;; ../spec/3-typing.watsup:199.1-201.24
-  rule br_if {C : context, l : labelidx, t : valtype}:
+  rule br_if {C : context, l : labelidx, t* : valtype*}:
     `%|-%:%`(C, BR_IF_instr(l), `%->%`(t* :: [I32_valtype], t*))
     -- if (C.LABEL_context[l] = t*)
 
   ;; ../spec/3-typing.watsup:195.1-197.24
-  rule br {C : context, l : labelidx, t : valtype, t_1 : valtype, t_2 : valtype}:
+  rule br {C : context, l : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, BR_instr(l), `%->%`(t_1* :: t*, t_2*))
     -- if (C.LABEL_context[l] = t*)
 
   ;; ../spec/3-typing.watsup:188.1-192.59
-  rule if {C : context, bt : blocktype, instr_1 : instr, instr_2 : instr, t_1 : valtype, t_2 : valtype}:
+  rule if {C : context, bt : blocktype, instr_1* : instr*, instr_2* : instr*, t_1* : valtype*, t_2 : valtype}:
     `%|-%:%`(C, IF_instr(bt, instr_1*, instr_2*), `%->%`(t_1*, [t_2]))
     -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*, [t_2]))
     -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*, RETURN ?()}, instr_1*, `%->%`(t_1*, t_2*))
     -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*, RETURN ?()}, instr_2*, `%->%`(t_1*, t_2*))
 
   ;; ../spec/3-typing.watsup:183.1-186.56
-  rule loop {C : context, bt : blocktype, instr : instr, t_1 : valtype, t_2 : valtype}:
+  rule loop {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2 : valtype}:
     `%|-%:%`(C, LOOP_instr(bt, instr*), `%->%`(t_1*, t_2*))
     -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*, t_2*))
     -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_1]*, RETURN ?()}, instr*, `%->%`(t_1*, [t_2]))
 
   ;; ../spec/3-typing.watsup:178.1-181.57
-  rule block {C : context, bt : blocktype, instr : instr, t_1 : valtype, t_2 : valtype}:
+  rule block {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, BLOCK_instr(bt, instr*), `%->%`(t_1*, t_2*))
     -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*, t_2*))
     -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*, RETURN ?()}, instr*, `%->%`(t_1*, t_2*))
@@ -1173,25 +1173,25 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     `%|-%:%`(C, NOP_instr, `%->%`([], []))
 
   ;; ../spec/3-typing.watsup:153.1-154.34
-  rule unreachable {C : context, t_1 : valtype, t_2 : valtype}:
+  rule unreachable {C : context, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, UNREACHABLE_instr, `%->%`(t_1*, t_2*))
 
 ;; ../spec/3-typing.watsup:124.1-124.67
 relation InstrSeq_ok: `%|-%:%`(context, instr*, functype)
   ;; ../spec/3-typing.watsup:148.1-150.45
-  rule frame {C : context, instr : instr, t : valtype, t_1 : valtype, t_2 : valtype}:
+  rule frame {C : context, instr* : instr*, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, instr*, `%->%`(t* :: t_1*, t* :: t_2*))
     -- InstrSeq_ok: `%|-%:%`(C, instr*, `%->%`(t_1*, t_2*))
 
   ;; ../spec/3-typing.watsup:141.1-146.38
-  rule weak {C : context, instr : instr, t'_1 : valtype, t'_2 : valtype, t_1 : valtype, t_2 : valtype}:
+  rule weak {C : context, instr* : instr*, t'_1 : valtype, t'_2* : valtype*, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, instr*, `%->%`([t'_1], t'_2*))
     -- InstrSeq_ok: `%|-%:%`(C, instr*, `%->%`(t_1*, t_2*))
     -- Resulttype_sub: `|-%<:%`(t'_1*, t_1*)
     -- Resulttype_sub: `|-%<:%`(t_2*, t'_2*)
 
   ;; ../spec/3-typing.watsup:136.1-139.46
-  rule seq {C : context, instr_1 : instr, instr_2 : instr, t_1 : valtype, t_2 : valtype, t_3 : valtype}:
+  rule seq {C : context, instr_1 : instr, instr_2 : instr, t_1* : valtype*, t_2* : valtype*, t_3* : valtype*}:
     `%|-%:%`(C, [instr_1] :: instr_2*, `%->%`(t_1*, t_3*))
     -- Instr_ok: `%|-%:%`(C, instr_1, `%->%`(t_1*, t_2*))
     -- InstrSeq_ok: `%|-%:%`(C, [instr_2], `%->%`(t_2*, t_3*))
@@ -1205,7 +1205,7 @@ relation InstrSeq_ok: `%|-%:%`(context, instr*, functype)
 ;; ../spec/3-typing.watsup:123.1-123.66
 relation Instr_ok: `%|-%:%`(context, instr, functype)
   ;; ../spec/3-typing.watsup:357.1-362.32
-  rule store {C : context, in : in, mt : memtype, n : n, n_A : n, n_O : n, nt : numtype, t : valtype}:
+  rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, t : valtype}:
     `%|-%:%`(C, STORE_instr(nt, n?, n_A, n_O), `%->%`([I32_valtype (nt <: valtype)], []))
     -- if (C.MEM_context[0] = mt)
     -- if ((2 ^ n_A) <= ($size(t) / 8))
@@ -1213,8 +1213,8 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if ((n? = ?()) \/ (nt = (in <: numtype)))
 
   ;; ../spec/3-typing.watsup:350.1-355.32
-  rule load {C : context, in : in, mt : memtype, n : n, n_A : n, n_O : n, nt : numtype, sx : sx, t : valtype}:
-    `%|-%:%`(C, LOAD_instr(nt, ?((n, sx)), n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
+  rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?, t : valtype}:
+    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?, n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
     -- if (C.MEM_context[0] = mt)
     -- if ((2 ^ n_A) <= ($size(t) / 8))
     -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(t) / 8))))?
@@ -1301,7 +1301,7 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
   ;; ../spec/3-typing.watsup:281.1-283.29
   rule global.get {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(()?, t))
 
   ;; ../spec/3-typing.watsup:276.1-278.23
   rule local.tee {C : context, t : valtype, x : idx}:
@@ -1337,7 +1337,7 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (fn_1 =/= fn_2)
 
   ;; ../spec/3-typing.watsup:247.1-250.52
-  rule convert-i {C : context, in_1 : in, in_2 : in, sx : sx}:
+  rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?}:
     `%|-%:%`(C, CVTOP_instr((in_1 <: numtype), CONVERT_cvtop, (in_2 <: numtype), sx?), `%->%`([(in_2 <: valtype)], [(in_1 <: valtype)]))
     -- if (in_1 =/= in_2)
     -- if ((sx? = ?()) <=> ($size(in_1 <: valtype) > $size(in_2 <: valtype)))
@@ -1374,52 +1374,52 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [(nt <: valtype)]))
 
   ;; ../spec/3-typing.watsup:216.1-219.26
-  rule call_indirect {C : context, ft : functype, lim : limits, t_1 : valtype, t_2 : valtype, x : idx}:
+  rule call_indirect {C : context, ft : functype, lim : limits, t_1* : valtype*, t_2* : valtype*, x : idx}:
     `%|-%:%`(C, CALL_INDIRECT_instr(x, ft), `%->%`(t_1* :: [I32_valtype], t_2*))
     -- if (C.TABLE_context[x] = `%%`(lim, FUNCREF_reftype))
     -- if (ft = `%->%`(t_1*, t_2*))
 
   ;; ../spec/3-typing.watsup:212.1-214.33
-  rule call {C : context, t_1 : valtype, t_2 : valtype, x : idx}:
+  rule call {C : context, t_1* : valtype*, t_2* : valtype*, x : idx}:
     `%|-%:%`(C, CALL_instr(x), `%->%`(t_1*, t_2*))
     -- if (C.FUNC_context[x] = `%->%`(t_1*, t_2*))
 
   ;; ../spec/3-typing.watsup:208.1-210.24
-  rule return {C : context, t : valtype, t_1 : valtype, t_2 : valtype}:
+  rule return {C : context, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, RETURN_instr, `%->%`(t_1* :: t*, t_2*))
     -- if (C.RETURN_context = ?(t*))
 
   ;; ../spec/3-typing.watsup:203.1-206.42
-  rule br_table {C : context, l : labelidx, l' : labelidx, t : valtype, t_1 : valtype, t_2 : valtype}:
+  rule br_table {C : context, l* : labelidx*, l' : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, BR_TABLE_instr(l*, l'), `%->%`(t_1* :: t*, t_2*))
     -- (Resulttype_sub: `|-%<:%`(t*, C.LABEL_context[l]))*
     -- Resulttype_sub: `|-%<:%`(t*, C.LABEL_context[l'])
 
   ;; ../spec/3-typing.watsup:199.1-201.24
-  rule br_if {C : context, l : labelidx, t : valtype}:
+  rule br_if {C : context, l : labelidx, t* : valtype*}:
     `%|-%:%`(C, BR_IF_instr(l), `%->%`(t* :: [I32_valtype], t*))
     -- if (C.LABEL_context[l] = t*)
 
   ;; ../spec/3-typing.watsup:195.1-197.24
-  rule br {C : context, l : labelidx, t : valtype, t_1 : valtype, t_2 : valtype}:
+  rule br {C : context, l : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, BR_instr(l), `%->%`(t_1* :: t*, t_2*))
     -- if (C.LABEL_context[l] = t*)
 
   ;; ../spec/3-typing.watsup:188.1-192.59
-  rule if {C : context, bt : blocktype, instr_1 : instr, instr_2 : instr, t_1 : valtype, t_2 : valtype}:
+  rule if {C : context, bt : blocktype, instr_1* : instr*, instr_2* : instr*, t_1* : valtype*, t_2 : valtype}:
     `%|-%:%`(C, IF_instr(bt, instr_1*, instr_2*), `%->%`(t_1*, [t_2]))
     -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*, [t_2]))
     -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*, RETURN ?()}, instr_1*, `%->%`(t_1*, t_2*))
     -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*, RETURN ?()}, instr_2*, `%->%`(t_1*, t_2*))
 
   ;; ../spec/3-typing.watsup:183.1-186.56
-  rule loop {C : context, bt : blocktype, instr : instr, t_1 : valtype, t_2 : valtype}:
+  rule loop {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2 : valtype}:
     `%|-%:%`(C, LOOP_instr(bt, instr*), `%->%`(t_1*, t_2*))
     -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*, t_2*))
     -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_1]*, RETURN ?()}, instr*, `%->%`(t_1*, [t_2]))
 
   ;; ../spec/3-typing.watsup:178.1-181.57
-  rule block {C : context, bt : blocktype, instr : instr, t_1 : valtype, t_2 : valtype}:
+  rule block {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, BLOCK_instr(bt, instr*), `%->%`(t_1*, t_2*))
     -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*, t_2*))
     -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*, RETURN ?()}, instr*, `%->%`(t_1*, t_2*))
@@ -1443,7 +1443,7 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     `%|-%:%`(C, NOP_instr, `%->%`([], []))
 
   ;; ../spec/3-typing.watsup:153.1-154.34
-  rule unreachable {C : context, t_1 : valtype, t_2 : valtype}:
+  rule unreachable {C : context, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, UNREACHABLE_instr, `%->%`(t_1*, t_2*))
 -}
 
@@ -1451,19 +1451,19 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 ;; ../spec/3-typing.watsup:124.1-124.67
 relation InstrSeq_ok: `%|-%:%`(context, instr*, functype)
   ;; ../spec/3-typing.watsup:148.1-150.45
-  rule frame {C : context, instr : instr, t : valtype, t_1 : valtype, t_2 : valtype}:
+  rule frame {C : context, instr* : instr*, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, instr*, `%->%`(t* :: t_1*, t* :: t_2*))
     -- InstrSeq_ok: `%|-%:%`(C, instr*, `%->%`(t_1*, t_2*))
 
   ;; ../spec/3-typing.watsup:141.1-146.38
-  rule weak {C : context, instr : instr, t'_1 : valtype, t'_2 : valtype, t_1 : valtype, t_2 : valtype}:
+  rule weak {C : context, instr* : instr*, t'_1 : valtype, t'_2* : valtype*, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, instr*, `%->%`([t'_1], t'_2*))
     -- InstrSeq_ok: `%|-%:%`(C, instr*, `%->%`(t_1*, t_2*))
     -- Resulttype_sub: `|-%<:%`(t'_1*, t_1*)
     -- Resulttype_sub: `|-%<:%`(t_2*, t'_2*)
 
   ;; ../spec/3-typing.watsup:136.1-139.46
-  rule seq {C : context, instr_1 : instr, instr_2 : instr, t_1 : valtype, t_2 : valtype, t_3 : valtype}:
+  rule seq {C : context, instr_1 : instr, instr_2 : instr, t_1* : valtype*, t_2* : valtype*, t_3* : valtype*}:
     `%|-%:%`(C, [instr_1] :: instr_2*, `%->%`(t_1*, t_3*))
     -- Instr_ok: `%|-%:%`(C, instr_1, `%->%`(t_1*, t_2*))
     -- InstrSeq_ok: `%|-%:%`(C, [instr_2], `%->%`(t_2*, t_3*))
@@ -1478,7 +1478,7 @@ relation InstrSeq_ok: `%|-%:%`(context, instr*, functype)
 ;; ../spec/3-typing.watsup:125.1-125.71
 relation Expr_ok: `%|-%:%`(context, expr, resulttype)
   ;; ../spec/3-typing.watsup:128.1-130.46
-  rule _ {C : context, instr : instr, t : valtype}:
+  rule _ {C : context, instr* : instr*, t* : valtype*}:
     `%|-%:%`(C, instr*, t*)
     -- InstrSeq_ok: `%|-%:%`(C, instr*, `%->%`([], t*))
 -}
@@ -1510,7 +1510,7 @@ relation Instr_const: `%|-%CONST`(context, instr)
 ;; ../spec/3-typing.watsup:368.1-368.77
 relation Expr_const: `%|-%CONST`(context, expr)
   ;; ../spec/3-typing.watsup:385.1-386.38
-  rule _ {C : context, instr : instr}:
+  rule _ {C : context, instr* : instr*}:
     `%|-%CONST`(C, instr*)
     -- (Instr_const: `%|-%CONST`(C, instr))*
 -}
@@ -1531,7 +1531,7 @@ relation Expr_ok_const: `%|-%:%CONST`(context, expr, valtype)
 ;; ../spec/3-typing.watsup:397.1-397.73
 relation Func_ok: `%|-%:%`(context, func, functype)
   ;; ../spec/3-typing.watsup:408.1-412.75
-  rule _ {C : context, expr : expr, ft : functype, t : valtype, t_1 : valtype, t_2 : valtype}:
+  rule _ {C : context, expr : expr, ft : functype, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, FUNC(ft, t*, expr), ft)
     -- if (ft = `%->%`(t_1*, t_2*))
     -- Functype_ok: `|-%:OK`(ft)
@@ -1546,7 +1546,7 @@ relation Global_ok: `%|-%:%`(context, global, globaltype)
   rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
     `%|-%:%`(C, GLOBAL(gt, expr), gt)
     -- Globaltype_ok: `|-%:OK`(gt)
-    -- if (gt = `MUT%?%`(?(()), t))
+    -- if (gt = `MUT%?%`(()?, t))
     -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
 -}
 
@@ -1590,7 +1590,7 @@ relation Elemmode_ok: `%|-%:%`(context, elemmode, reftype)
 ;; ../spec/3-typing.watsup:401.1-401.73
 relation Elem_ok: `%|-%:%`(context, elem, reftype)
   ;; ../spec/3-typing.watsup:428.1-431.40
-  rule _ {C : context, elemmode : elemmode, expr : expr, rt : reftype}:
+  rule _ {C : context, elemmode? : elemmode?, expr* : expr*, rt : reftype}:
     `%|-%:%`(C, ELEM(rt, expr*, elemmode?), rt)
     -- (Expr_ok: `%|-%:%`(C, expr, [(rt <: valtype)]))*
     -- (Elemmode_ok: `%|-%:%`(C, elemmode, rt))?
@@ -1612,7 +1612,7 @@ relation Datamode_ok: `%|-%:OK`(context, datamode)
 ;; ../spec/3-typing.watsup:402.1-402.73
 relation Data_ok: `%|-%:OK`(context, data)
   ;; ../spec/3-typing.watsup:434.1-436.40
-  rule _ {C : context, b : byte, datamode : datamode}:
+  rule _ {C : context, b** : byte**, datamode? : datamode?}:
     `%|-%:OK`(C, DATA(b**, datamode?))
     -- (Datamode_ok: `%|-%:OK`(C, datamode))?
 -}
@@ -1677,7 +1677,7 @@ relation Export_ok: `%|-%:%`(context, export, externtype)
 ;; ../spec/3-typing.watsup:485.1-485.62
 relation Module_ok: `|-%:OK`(module)
   ;; ../spec/3-typing.watsup:487.1-499.22
-  rule _ {C : context, data : data, elem : elem, export : export, ft : functype, func : func, global : global, gt : globaltype, import : import, mem : mem, mt : memtype, n : n, rt : reftype, start : start, table : table, tt : tabletype}:
+  rule _ {C : context, data^n : data^n, elem* : elem*, export* : export*, ft* : functype*, func* : func*, global* : global*, gt* : globaltype*, import* : import*, mem* : mem*, mt* : memtype*, n : n, rt* : reftype*, start* : start*, table* : table*, tt* : tabletype*}:
     `|-%:OK`(MODULE(import*, func*, global*, table*, mem*, elem*, data^n, start*, export*))
     -- (Func_ok: `%|-%:%`(C, func, ft))*
     -- (Global_ok: `%|-%:%`(C, global, gt))*
@@ -2063,12 +2063,12 @@ data E
 ;; ../spec/5-reduction.watsup:4.1-4.63
 relation Step_pure: `%~>%`(admininstr*, admininstr*)
   ;; ../spec/5-reduction.watsup:86.1-88.18
-  rule br_table-ge {i : nat, l : labelidx, l' : labelidx}:
+  rule br_table-ge {i : nat, l* : labelidx*, l' : labelidx}:
     `%~>%`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*, l')], [BR_admininstr(l')])
     -- if (i >= |l*|)
 
   ;; ../spec/5-reduction.watsup:82.1-84.17
-  rule br_table-lt {i : nat, l : labelidx, l' : labelidx}:
+  rule br_table-lt {i : nat, l* : labelidx*, l' : labelidx}:
     `%~>%`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*, l')], [BR_admininstr(l*[i])])
     -- if (i < |l*|)
 
@@ -2083,30 +2083,30 @@ relation Step_pure: `%~>%`(admininstr*, admininstr*)
     -- if (c =/= 0)
 
   ;; ../spec/5-reduction.watsup:69.1-70.65
-  rule br-succ {instr : instr, instr' : instr, l : labelidx, n : n, val : val}:
+  rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
     `%~>%`([LABEL__admininstr(n, instr'*, (val <: admininstr)* :: [BR_admininstr(l + 1)] :: (instr <: admininstr)*)], (val <: admininstr)* :: [BR_admininstr(l)])
 
   ;; ../spec/5-reduction.watsup:66.1-67.69
-  rule br-zero {instr : instr, instr' : instr, n : n, val : val, val' : val}:
+  rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
     `%~>%`([LABEL__admininstr(n, instr'*, (val' <: admininstr)* :: (val <: admininstr)^n :: [BR_admininstr(0)] :: (instr <: admininstr)*)], (val <: admininstr)^n :: (instr' <: admininstr)*)
 
   ;; ../spec/5-reduction.watsup:61.1-63.14
-  rule if-false {bt : blocktype, c : c_numtype, instr_1 : instr, instr_2 : instr}:
+  rule if-false {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
     `%~>%`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*, instr_2*)], [BLOCK_admininstr(bt, instr_2*)])
     -- if (c = 0)
 
   ;; ../spec/5-reduction.watsup:57.1-59.16
-  rule if-true {bt : blocktype, c : c_numtype, instr_1 : instr, instr_2 : instr}:
+  rule if-true {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
     `%~>%`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*, instr_2*)], [BLOCK_admininstr(bt, instr_1*)])
     -- if (c =/= 0)
 
   ;; ../spec/5-reduction.watsup:53.1-55.28
-  rule loop {bt : blocktype, instr : instr, k : nat, n : n, t_1 : valtype, t_2 : valtype, val : val}:
+  rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
     `%~>%`((val <: admininstr)^k :: [LOOP_admininstr(bt, instr*)], [LABEL__admininstr(n, [LOOP_instr(bt, instr*)], (val <: admininstr)^k :: (instr <: admininstr)*)])
     -- if (bt = `%->%`(t_1^k, t_2^n))
 
   ;; ../spec/5-reduction.watsup:49.1-51.28
-  rule block {bt : blocktype, instr : instr, k : nat, n : n, t_1 : valtype, t_2 : valtype, val : val}:
+  rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
     `%~>%`((val <: admininstr)^k :: [BLOCK_admininstr(bt, instr*)], [LABEL__admininstr(n, [], (val <: admininstr)^k :: (instr <: admininstr)*)])
     -- if (bt = `%->%`(t_1^k, t_2^n))
 
@@ -2115,12 +2115,12 @@ relation Step_pure: `%~>%`(admininstr*, admininstr*)
     `%~>%`([(val <: admininstr) LOCAL.TEE_admininstr(x)], [(val <: admininstr) (val <: admininstr) LOCAL.SET_admininstr(x)])
 
   ;; ../spec/5-reduction.watsup:42.1-44.14
-  rule select-false {c : c_numtype, t : valtype, val_1 : val, val_2 : val}:
+  rule select-false {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
     `%~>%`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?)], [(val_2 <: admininstr)])
     -- if (c = 0)
 
   ;; ../spec/5-reduction.watsup:38.1-40.16
-  rule select-true {c : c_numtype, t : valtype, val_1 : val, val_2 : val}:
+  rule select-true {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
     `%~>%`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?)], [(val_1 <: admininstr)])
     -- if (c =/= 0)
 
@@ -2152,7 +2152,7 @@ relation Step_pure: `%~>%`(admininstr*, admininstr*)
 ;; ../spec/5-reduction.watsup:5.1-5.63
 relation Step_read: `%~>%`(config, admininstr*)
   ;; ../spec/5-reduction.watsup:165.1-167.61
-  rule call_addr {a : addr, instr : instr, k : nat, m : moduleinst, n : n, t : valtype, t_1 : valtype, t_2 : valtype, val : val, z : state}:
+  rule call_addr {a : addr, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
     `%~>%`(`%;%`(z, (val <: admininstr)^k :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, {LOCAL val^k :: $default_(t)*, MODULE m}, [LABEL__admininstr(n, [], (instr <: admininstr)*)])])
     -- if ($funcinst(z)[a] = `%;%`(m, FUNC(`%->%`(t_1^k, t_2^n), t*, instr*)))
 
@@ -2189,7 +2189,7 @@ relation Step_read: `%~>%`(config, admininstr*)
   ;; ../spec/5-reduction.watsup:134.1-139.14
   rule table.copy-gt {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, (n + 1)) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, (j + n)) CONST_admininstr(I32_numtype, (i + n)) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)])
-    -- if (i > i)
+    -- if (j > i)
 
   ;; ../spec/5-reduction.watsup:128.1-133.15
   rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
@@ -2277,17 +2277,17 @@ relation Step_write: `%~>%`(config, config)
 ;; ../spec/5-reduction.watsup:3.1-3.63
 relation Step: `%~>%`(config, config)
   ;; ../spec/5-reduction.watsup:16.1-18.42
-  rule write {instr : instr, instr' : instr, z : state, z' : state}:
+  rule write {instr* : instr*, instr'* : instr*, z : state, z' : state}:
     `%~>%`(`%;%`(z, (instr <: admininstr)*), `%;%`(z', (instr' <: admininstr)*))
     -- Step_write: `%~>%`(`%;%`(z, (instr <: admininstr)*), `%;%`(z', (instr' <: admininstr)*))
 
   ;; ../spec/5-reduction.watsup:12.1-14.37
-  rule read {instr : instr, instr' : instr, z : state}:
+  rule read {instr* : instr*, instr'* : instr*, z : state}:
     `%~>%`(`%;%`(z, (instr <: admininstr)*), `%;%`(z, (instr' <: admininstr)*))
     -- Step_read: `%~>%`(`%;%`(z, (instr <: admininstr)*), (instr' <: admininstr)*)
 
   ;; ../spec/5-reduction.watsup:8.1-10.34
-  rule pure {instr : instr, instr' : instr, z : state}:
+  rule pure {instr* : instr*, instr'* : instr*, z : state}:
     `%~>%`(`%;%`(z, (instr <: admininstr)*), `%;%`(z, (instr' <: admininstr)*))
     -- Step_pure: `%~>%`((instr <: admininstr)*, (instr' <: admininstr)*)
 -}
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index c7bd647763..6b980e4806 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -371,7 +371,7 @@ inductive Valtype_sub : (Valtype × Valtype) -> Prop where
     (Valtype_sub (t, t))
 
 inductive Resulttype_sub : ((List Valtype) × (List Valtype)) -> Prop where
-  | rule_0 (t_1 : Valtype) (t_2 : Valtype) :
+  | rule_0 (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
     (Valtype_sub (t_1, t_2)) ->
     (Resulttype_sub (t_1, t_2))
 
@@ -420,18 +420,18 @@ inductive Blocktype_ok : (Context × Blocktype × Functype) -> Prop where
 
 mutual
 inductive Instr_ok : (Context × Instr × Functype) -> Prop where
-  | store (C : Context) («in» : In) (mt : Memtype) (n : N) (n_A : N) (n_O : N) (nt : Numtype) (t : Valtype) :
+  | store (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (t : Valtype) :
     ((C.MEM.get! 0) == mt) ->
     ((((Nat.pow 2) n_A)) <= (((Nat.div (size t)) 8))) ->
     (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div (size t)) 8)))) ->
     ((n == none) || (nt == (Numtype.In «in»))) ->
     (Instr_ok (C, (Instr.STORE (nt, n, n_A, n_O)), ([(Valtype.Numtype Numtype.I32), (Valtype.Numtype nt)], [])))
-  | load (C : Context) («in» : In) (mt : Memtype) (n : N) (n_A : N) (n_O : N) (nt : Numtype) (sx : Sx) (t : Valtype) :
+  | load (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (sx : (Option Sx)) (t : Valtype) :
     ((C.MEM.get! 0) == mt) ->
     ((((Nat.pow 2) n_A)) <= (((Nat.div (size t)) 8))) ->
     (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div (size t)) 8)))) ->
     ((n == none) || (nt == (Numtype.In «in»))) ->
-    (Instr_ok (C, (Instr.LOAD (nt, (some (n, sx)), n_A, n_O)), ([(Valtype.Numtype Numtype.I32)], [(Valtype.Numtype nt)])))
+    (Instr_ok (C, (Instr.LOAD (nt, (n, sx), n_A, n_O)), ([(Valtype.Numtype Numtype.I32)], [(Valtype.Numtype nt)])))
   | data_drop (C : Context) (x : Idx) :
     ((C.DATA.get! x) == ()) ->
     (Instr_ok (C, (Instr.DATA_DROP x), ([], [])))
@@ -481,7 +481,7 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     ((C.GLOBAL.get! x) == ((some ()), t)) ->
     (Instr_ok (C, (Instr.GLOBAL_SET x), ([t], [])))
   | global_get (C : Context) (t : Valtype) (x : Idx) :
-    ((C.GLOBAL.get! x) == ((some ()), t)) ->
+    ((C.GLOBAL.get! x) == ((), t)) ->
     (Instr_ok (C, (Instr.GLOBAL_GET x), ([], [t])))
   | local_tee (C : Context) (t : Valtype) (x : Idx) :
     ((C.LOCAL.get! x) == t) ->
@@ -502,7 +502,7 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
   | convert_f (C : Context) (fn_1 : Fn) (fn_2 : Fn) :
     (fn_1 != fn_2) ->
     (Instr_ok (C, (Instr.CVTOP ((Numtype.Fn fn_1), Cvtop.CONVERT, (Numtype.Fn fn_2), none)), ([(Valtype.Fn fn_2)], [(Valtype.Fn fn_1)])))
-  | convert_i (C : Context) (in_1 : In) (in_2 : In) (sx : Sx) :
+  | convert_i (C : Context) (in_1 : In) (in_2 : In) (sx : (Option Sx)) :
     (in_1 != in_2) ->
     ((sx == none) = ((size (Valtype.In in_1)) > (size (Valtype.In in_2)))) ->
     (Instr_ok (C, (Instr.CVTOP ((Numtype.In in_1), Cvtop.CONVERT, (Numtype.In in_2), sx)), ([(Valtype.In in_2)], [(Valtype.In in_1)])))
@@ -523,36 +523,36 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (Instr_ok (C, (Instr.UNOP (nt, unop)), ([(Valtype.Numtype nt)], [(Valtype.Numtype nt)])))
   | const (C : Context) (c_nt : C_numtype) (nt : Numtype) :
     (Instr_ok (C, (Instr.CONST (nt, c_nt)), ([], [(Valtype.Numtype nt)])))
-  | call_indirect (C : Context) (ft : Functype) (lim : Limits) (t_1 : Valtype) (t_2 : Valtype) (x : Idx) :
+  | call_indirect (C : Context) (ft : Functype) (lim : Limits) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (x : Idx) :
     ((C.TABLE.get! x) == (lim, Reftype.FUNCREF)) ->
     (ft == (t_1, t_2)) ->
     (Instr_ok (C, (Instr.CALL_INDIRECT (x, ft)), ((t_1 ++ [(Valtype.Numtype Numtype.I32)]), t_2)))
-  | call (C : Context) (t_1 : Valtype) (t_2 : Valtype) (x : Idx) :
+  | call (C : Context) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (x : Idx) :
     ((C.FUNC.get! x) == (t_1, t_2)) ->
     (Instr_ok (C, (Instr.CALL x), (t_1, t_2)))
-  | return (C : Context) (t : Valtype) (t_1 : Valtype) (t_2 : Valtype) :
+  | return (C : Context) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
     (C.RETURN == (some t)) ->
     (Instr_ok (C, Instr.RETURN, ((t_1 ++ t), t_2)))
-  | br_table (C : Context) (l : Labelidx) (l' : Labelidx) (t : Valtype) (t_1 : Valtype) (t_2 : Valtype) :
+  | br_table (C : Context) (l : (List Labelidx)) (l' : Labelidx) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
     (Resulttype_sub (t, (C.LABEL.get! l))) ->
     (Resulttype_sub (t, (C.LABEL.get! l'))) ->
     (Instr_ok (C, (Instr.BR_TABLE (l, l')), ((t_1 ++ t), t_2)))
-  | br_if (C : Context) (l : Labelidx) (t : Valtype) :
+  | br_if (C : Context) (l : Labelidx) (t : (List Valtype)) :
     ((C.LABEL.get! l) == t) ->
     (Instr_ok (C, (Instr.BR_IF l), ((t ++ [(Valtype.Numtype Numtype.I32)]), t)))
-  | br (C : Context) (l : Labelidx) (t : Valtype) (t_1 : Valtype) (t_2 : Valtype) :
+  | br (C : Context) (l : Labelidx) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
     ((C.LABEL.get! l) == t) ->
     (Instr_ok (C, (Instr.BR l), ((t_1 ++ t), t_2)))
-  | if (C : Context) (bt : Blocktype) (instr_1 : Instr) (instr_2 : Instr) (t_1 : Valtype) (t_2 : Valtype) :
+  | if (C : Context) (bt : Blocktype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) (t_1 : (List Valtype)) (t_2 : Valtype) :
     (Blocktype_ok (C, bt, (t_1, [t_2]))) ->
     (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2], RETURN := none}), instr_1, (t_1, t_2))) ->
     (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2], RETURN := none}), instr_2, (t_1, t_2))) ->
     (Instr_ok (C, (Instr.IF (bt, instr_1, instr_2)), (t_1, [t_2])))
-  | loop (C : Context) (bt : Blocktype) (instr : Instr) (t_1 : Valtype) (t_2 : Valtype) :
+  | loop (C : Context) (bt : Blocktype) (instr : (List Instr)) (t_1 : (List Valtype)) (t_2 : Valtype) :
     (Blocktype_ok (C, bt, (t_1, t_2))) ->
     (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_1], RETURN := none}), instr, (t_1, [t_2]))) ->
     (Instr_ok (C, (Instr.LOOP (bt, instr)), (t_1, t_2)))
-  | block (C : Context) (bt : Blocktype) (instr : Instr) (t_1 : Valtype) (t_2 : Valtype) :
+  | block (C : Context) (bt : Blocktype) (instr : (List Instr)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
     (Blocktype_ok (C, bt, (t_1, t_2))) ->
     (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2], RETURN := none}), instr, (t_1, t_2))) ->
     (Instr_ok (C, (Instr.BLOCK (bt, instr)), (t_1, t_2)))
@@ -566,18 +566,18 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (Instr_ok (C, Instr.DROP, ([t], [])))
   | nop (C : Context) :
     (Instr_ok (C, Instr.NOP, ([], [])))
-  | unreachable (C : Context) (t_1 : Valtype) (t_2 : Valtype) :
+  | unreachable (C : Context) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
     (Instr_ok (C, Instr.UNREACHABLE, (t_1, t_2)))
 inductive InstrSeq_ok : (Context × (List Instr) × Functype) -> Prop where
-  | frame (C : Context) (instr : Instr) (t : Valtype) (t_1 : Valtype) (t_2 : Valtype) :
+  | frame (C : Context) (instr : (List Instr)) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
     (InstrSeq_ok (C, instr, (t_1, t_2))) ->
     (InstrSeq_ok (C, instr, ((t ++ t_1), (t ++ t_2))))
-  | weak (C : Context) (instr : Instr) (t'_1 : Valtype) (t'_2 : Valtype) (t_1 : Valtype) (t_2 : Valtype) :
+  | weak (C : Context) (instr : (List Instr)) (t'_1 : Valtype) (t'_2 : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
     (InstrSeq_ok (C, instr, (t_1, t_2))) ->
     (Resulttype_sub (t'_1, t_1)) ->
     (Resulttype_sub (t_2, t'_2)) ->
     (InstrSeq_ok (C, instr, ([t'_1], t'_2)))
-  | seq (C : Context) (instr_1 : Instr) (instr_2 : Instr) (t_1 : Valtype) (t_2 : Valtype) (t_3 : Valtype) :
+  | seq (C : Context) (instr_1 : Instr) (instr_2 : Instr) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (t_3 : (List Valtype)) :
     (Instr_ok (C, instr_1, (t_1, t_2))) ->
     (InstrSeq_ok (C, [instr_2], (t_2, t_3))) ->
     (InstrSeq_ok (C, ([instr_1] ++ instr_2), (t_1, t_3)))
@@ -586,7 +586,7 @@ inductive InstrSeq_ok : (Context × (List Instr) × Functype) -> Prop where
 
 
 inductive Expr_ok : (Context × Expr × Resulttype) -> Prop where
-  | rule_0 (C : Context) (instr : Instr) (t : Valtype) :
+  | rule_0 (C : Context) (instr : (List Instr)) (t : (List Valtype)) :
     (InstrSeq_ok (C, instr, ([], t))) ->
     (Expr_ok (C, instr, t))
 
@@ -602,7 +602,7 @@ inductive Instr_const : (Context × Instr) -> Prop where
     (Instr_const (C, (Instr.CONST (nt, c))))
 
 inductive Expr_const : (Context × Expr) -> Prop where
-  | rule_0 (C : Context) (instr : Instr) :
+  | rule_0 (C : Context) (instr : (List Instr)) :
     (Instr_const (C, instr)) ->
     (Expr_const (C, instr))
 
@@ -613,7 +613,7 @@ inductive Expr_ok_const : (Context × Expr × Valtype) -> Prop where
     (Expr_ok_const (C, expr, t))
 
 inductive Func_ok : (Context × Func × Functype) -> Prop where
-  | rule_0 (C : Context) (expr : Expr) (ft : Functype) (t : Valtype) (t_1 : Valtype) (t_2 : Valtype) :
+  | rule_0 (C : Context) (expr : Expr) (ft : Functype) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
     (ft == (t_1, t_2)) ->
     (Functype_ok ft) ->
     (Expr_ok ((((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := (t_1 ++ t), LABEL := [], RETURN := none}) ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2], RETURN := none}) ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [], RETURN := (some t_2)}), expr, t_2)) ->
@@ -622,7 +622,7 @@ inductive Func_ok : (Context × Func × Functype) -> Prop where
 inductive Global_ok : (Context × Global × Globaltype) -> Prop where
   | rule_0 (C : Context) (expr : Expr) (gt : Globaltype) (t : Valtype) :
     (Globaltype_ok gt) ->
-    (gt == ((some ()), t)) ->
+    (gt == ((), t)) ->
     (Expr_ok_const (C, expr, t)) ->
     (Global_ok (C, (gt, expr), gt))
 
@@ -645,7 +645,7 @@ inductive Elemmode_ok : (Context × Elemmode × Reftype) -> Prop where
     (Elemmode_ok (C, (Elemmode.TABLE (x, expr)), rt))
 
 inductive Elem_ok : (Context × Elem × Reftype) -> Prop where
-  | rule_0 (C : Context) (elemmode : Elemmode) (expr : Expr) (rt : Reftype) :
+  | rule_0 (C : Context) (elemmode : (Option Elemmode)) (expr : (List Expr)) (rt : Reftype) :
     (Expr_ok (C, expr, [(Valtype.Reftype rt)])) ->
     (Elemmode_ok (C, elemmode, rt)) ->
     (Elem_ok (C, (rt, expr, elemmode), rt))
@@ -657,7 +657,7 @@ inductive Datamode_ok : (Context × Datamode) -> Prop where
     (Datamode_ok (C, (Datamode.MEMORY (0, expr))))
 
 inductive Data_ok : (Context × Data) -> Prop where
-  | rule_0 (C : Context) (b : Byte) (datamode : Datamode) :
+  | rule_0 (C : Context) (b : (List (List Byte))) (datamode : (Option Datamode)) :
     (Datamode_ok (C, datamode)) ->
     (Data_ok (C, (b, datamode)))
 
@@ -691,7 +691,7 @@ inductive Export_ok : (Context × Export × Externtype) -> Prop where
     (Export_ok (C, (name, externuse), xt))
 
 inductive Module_ok : Module -> Prop where
-  | rule_0 (C : Context) (data : Data) (elem : Elem) («export» : Export) (ft : Functype) (func : Func) («global» : Global) (gt : Globaltype) («import» : Import) (mem : Mem) (mt : Memtype) (n : N) (rt : Reftype) (start : Start) (table : Table) (tt : Tabletype) :
+  | rule_0 (C : Context) (data : (List Data)) (elem : (List Elem)) («export» : (List Export)) (ft : (List Functype)) (func : (List Func)) («global» : (List Global)) (gt : (List Globaltype)) («import» : (List Import)) (mem : (List Mem)) (mt : (List Memtype)) (n : N) (rt : (List Reftype)) (start : (List Start)) (table : (List Table)) (tt : (List Tabletype)) :
     (Func_ok (C, func, ft)) ->
     (Global_ok (C, «global», gt)) ->
     (Table_ok (C, table, tt)) ->
@@ -870,10 +870,10 @@ inductive E where
   deriving Inhabited, BEq
 
 inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
-  | br_table_ge (i : Nat) (l : Labelidx) (l' : Labelidx) :
+  | br_table_ge (i : Nat) (l : (List Labelidx)) (l' : Labelidx) :
     (i >= l.length) ->
     (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.BR_TABLE (l, l')))], [(Admininstr.Instr (Instr.BR l'))]))
-  | br_table_lt (i : Nat) (l : Labelidx) (l' : Labelidx) :
+  | br_table_lt (i : Nat) (l : (List Labelidx)) (l' : Labelidx) :
     (i < l.length) ->
     (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.BR_TABLE (l, l')))], [(Admininstr.Instr (Instr.BR (l.get! i)))]))
   | br_if_false (c : C_numtype) (l : Labelidx) :
@@ -882,28 +882,28 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
   | br_if_true (c : C_numtype) (l : Labelidx) :
     (c != 0) ->
     (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.BR_IF l))], [(Admininstr.Instr (Instr.BR l))]))
-  | br_succ (instr : Instr) (instr' : Instr) (l : Labelidx) (n : N) (val : Val) :
+  | br_succ (instr : (List Instr)) (instr' : (List Instr)) (l : Labelidx) (n : N) (val : (List Val)) :
     (Step_pure ([(Admininstr.LABEL_ (n, instr', ((Admininstr.Val val) ++ ([(Admininstr.Instr (Instr.BR (l + 1)))] ++ (Admininstr.Instr instr)))))], ((Admininstr.Val val) ++ [(Admininstr.Instr (Instr.BR l))])))
-  | br_zero (instr : Instr) (instr' : Instr) (n : N) (val : Val) (val' : Val) :
+  | br_zero (instr : (List Instr)) (instr' : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) :
     (Step_pure ([(Admininstr.LABEL_ (n, instr', ((Admininstr.Val val') ++ ((Admininstr.Val val) ++ ([(Admininstr.Instr (Instr.BR 0))] ++ (Admininstr.Instr instr))))))], ((Admininstr.Val val) ++ (Admininstr.Instr instr'))))
-  | if_false (bt : Blocktype) (c : C_numtype) (instr_1 : Instr) (instr_2 : Instr) :
+  | if_false (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) :
     (c == 0) ->
     (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.IF (bt, instr_1, instr_2)))], [(Admininstr.Instr (Instr.BLOCK (bt, instr_2)))]))
-  | if_true (bt : Blocktype) (c : C_numtype) (instr_1 : Instr) (instr_2 : Instr) :
+  | if_true (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) :
     (c != 0) ->
     (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.IF (bt, instr_1, instr_2)))], [(Admininstr.Instr (Instr.BLOCK (bt, instr_1)))]))
-  | loop (bt : Blocktype) (instr : Instr) (k : Nat) (n : N) (t_1 : Valtype) (t_2 : Valtype) (val : Val) :
+  | loop (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
     (bt == (t_1, t_2)) ->
     (Step_pure (((Admininstr.Val val) ++ [(Admininstr.Instr (Instr.LOOP (bt, instr)))]), [(Admininstr.LABEL_ (n, [(Instr.LOOP (bt, instr))], ((Admininstr.Val val) ++ (Admininstr.Instr instr))))]))
-  | block (bt : Blocktype) (instr : Instr) (k : Nat) (n : N) (t_1 : Valtype) (t_2 : Valtype) (val : Val) :
+  | block (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
     (bt == (t_1, t_2)) ->
     (Step_pure (((Admininstr.Val val) ++ [(Admininstr.Instr (Instr.BLOCK (bt, instr)))]), [(Admininstr.LABEL_ (n, [], ((Admininstr.Val val) ++ (Admininstr.Instr instr))))]))
   | local_tee (val : Val) (x : Idx) :
     (Step_pure ([(Admininstr.Val val), (Admininstr.Instr (Instr.LOCAL_TEE x))], [(Admininstr.Val val), (Admininstr.Val val), (Admininstr.Instr (Instr.LOCAL_SET x))]))
-  | select_false (c : C_numtype) (t : Valtype) (val_1 : Val) (val_2 : Val) :
+  | select_false (c : C_numtype) (t : (Option Valtype)) (val_1 : Val) (val_2 : Val) :
     (c == 0) ->
     (Step_pure ([(Admininstr.Val val_1), (Admininstr.Val val_2), (Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.SELECT t))], [(Admininstr.Val val_2)]))
-  | select_true (c : C_numtype) (t : Valtype) (val_1 : Val) (val_2 : Val) :
+  | select_true (c : C_numtype) (t : (Option Valtype)) (val_1 : Val) (val_2 : Val) :
     (c != 0) ->
     (Step_pure ([(Admininstr.Val val_1), (Admininstr.Val val_2), (Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.SELECT t))], [(Admininstr.Val val_1)]))
   | drop (val : Val) :
@@ -920,7 +920,7 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (Step_pure ([(Admininstr.Val val), (Admininstr.Instr Instr.REF_IS_NULL)], [(Admininstr.Instr (Instr.CONST (Numtype.I32, 1)))]))
 
 inductive Step_read : (Config × (List Admininstr)) -> Prop where
-  | call_addr (a : Addr) (instr : Instr) (k : Nat) (m : Moduleinst) (n : N) (t : Valtype) (t_1 : Valtype) (t_2 : Valtype) (val : Val) (z : State) :
+  | call_addr (a : Addr) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
     (((funcinst z).get! a) == (m, ((t_1, t_2), t, instr))) ->
     (Step_read ((z, ((Admininstr.Val val) ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, {LOCAL := (val ++ (default_ t)), MODULE := m}, [(Admininstr.LABEL_ (n, [], (Admininstr.Instr instr)))]))]))
   | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
@@ -942,7 +942,7 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (((i + n) > (elem (z, y)).length) || ((j + n) > (table (z, x)).length)) ->
     (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CONST (Numtype.I32, n))), (Admininstr.Instr (Instr.TABLE_INIT (x, y)))]), [Admininstr.TRAP]))
   | table_copy_gt (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (i > i) ->
+    (j > i) ->
     (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CONST (Numtype.I32, (n + 1)))), (Admininstr.Instr (Instr.TABLE_COPY (x, y)))]), [(Admininstr.Instr (Instr.CONST (Numtype.I32, (j + n)))), (Admininstr.Instr (Instr.CONST (Numtype.I32, (i + n)))), (Admininstr.Instr (Instr.TABLE_GET y)), (Admininstr.Instr (Instr.TABLE_SET x)), (Admininstr.Instr (Instr.CONST (Numtype.I32, (j + 1)))), (Admininstr.Instr (Instr.CONST (Numtype.I32, (i + 1)))), (Admininstr.Instr (Instr.CONST (Numtype.I32, n))), (Admininstr.Instr (Instr.TABLE_COPY (x, y)))]))
   | table_copy_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     (j <= i) ->
@@ -991,13 +991,13 @@ inductive Step_write : (Config × Config) -> Prop where
     (Step_write ((z, [(Admininstr.Val val), (Admininstr.Instr (Instr.LOCAL_SET x))]), ((with_local (z, x, val)), [])))
 
 inductive Step : (Config × Config) -> Prop where
-  | write (instr : Instr) (instr' : Instr) (z : State) (z' : State) :
+  | write (instr : (List Instr)) (instr' : (List Instr)) (z : State) (z' : State) :
     (Step_write ((z, (Admininstr.Instr instr)), (z', (Admininstr.Instr instr')))) ->
     (Step ((z, (Admininstr.Instr instr)), (z', (Admininstr.Instr instr'))))
-  | read (instr : Instr) (instr' : Instr) (z : State) :
+  | read (instr : (List Instr)) (instr' : (List Instr)) (z : State) :
     (Step_read ((z, (Admininstr.Instr instr)), (Admininstr.Instr instr'))) ->
     (Step ((z, (Admininstr.Instr instr)), (z, (Admininstr.Instr instr'))))
-  | pure (instr : Instr) (instr' : Instr) (z : State) :
+  | pure (instr : (List Instr)) (instr' : (List Instr)) (z : State) :
     (Step_pure ((Admininstr.Instr instr), (Admininstr.Instr instr'))) ->
     (Step ((z, (Admininstr.Instr instr)), (z, (Admininstr.Instr instr'))))
 $ lean SpecTec.lean 2>&1 | sed -e 's,/[^ ]*/toolchains,.../toolchains`,g' | sed -e 's,SpecTec.lean:[0-9]\+:[0-9]\+,SpecTec.lean,'
@@ -1007,131 +1007,79 @@ SpecTec.lean: error: application type mismatch
 argument
   t_1
 has type
-  Valtype : Type
-but is expected to have type
   List Valtype : Type
-SpecTec.lean: error: type mismatch
-  none
-has type
-  Option ?m.72695 : Type ?u.72694
-but is expected to have type
-  N : Type
-SpecTec.lean: error: unknown constant 'Numtype.In'
-SpecTec.lean: error: type mismatch
-  none
-has type
-  Option ?m.73266 : Type ?u.73265
-but is expected to have type
-  N : Type
-SpecTec.lean: error: unknown constant 'Numtype.In'
-SpecTec.lean: error: unknown constant 'Numtype.Fn'
-SpecTec.lean: error: unknown constant 'Numtype.Fn'
-SpecTec.lean: error: unknown constant 'Valtype.Fn'
-SpecTec.lean: error: unknown constant 'Valtype.Fn'
-SpecTec.lean: error: type mismatch
-  none
-has type
-  Option ?m.75279 : Type ?u.75278
-but is expected to have type
-  Sx : Type
-SpecTec.lean: error: unknown constant 'Valtype.In'
-SpecTec.lean: error: unknown constant 'Valtype.In'
-SpecTec.lean: error: unknown constant 'Numtype.In'
-SpecTec.lean: error: unknown constant 'Numtype.In'
-SpecTec.lean: error: unknown constant 'Valtype.In'
-SpecTec.lean: error: unknown constant 'Valtype.In'
-SpecTec.lean: error: type mismatch
-  (t_1, t_2)
-has type
-  Valtype × Valtype : Type
-but is expected to have type
-  Functype : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Valtype (List Valtype) ?m.76541
-SpecTec.lean: error: type mismatch
-  (t_1, t_2)
-has type
-  Valtype × Valtype : Type
 but is expected to have type
-  Functype : Type
+  Valtype : Type
 SpecTec.lean: error: application type mismatch
-  Prod.mk t_1
+  Nat.div n
 argument
-  t_1
-has type
-  Valtype : Type
-but is expected to have type
-  Resulttype : Type
-SpecTec.lean: error: type mismatch
-  some t
+  n
 has type
-  Option Valtype : Type
+  Option N : Type
 but is expected to have type
-  Option Resulttype : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Valtype Valtype ?m.77852
+  Nat : Type
 SpecTec.lean: error: application type mismatch
-  Prod.mk t
+  Nat.div n
 argument
-  t
+  n
 has type
-  Valtype : Type
+  Option N : Type
 but is expected to have type
-  List Valtype : Type
+  Nat : Type
+SpecTec.lean: error: unknown constant 'Numtype.In'
 SpecTec.lean: error: application type mismatch
-  Prod.mk t
+  Nat.div n
 argument
-  t
+  n
 has type
-  Valtype : Type
+  Option N : Type
 but is expected to have type
-  List Valtype : Type
+  Nat : Type
 SpecTec.lean: error: application type mismatch
-  Prod.mk l
+  Nat.div n
 argument
-  l
+  n
 has type
-  Labelidx : Type
+  Option N : Type
 but is expected to have type
-  List Labelidx : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Valtype Valtype ?m.78399
-SpecTec.lean: error: type mismatch
-  t
+  Nat : Type
+SpecTec.lean: error: unknown constant 'Numtype.In'
+SpecTec.lean: error: application type mismatch
+  Prod.mk (n, sx)
+argument
+  (n, sx)
 has type
-  Valtype : Type
+  Option N × Option Sx : Type
 but is expected to have type
-  Resulttype : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Valtype (List Valtype) ?m.79015
+  Option (N × Sx) : Type
 SpecTec.lean: error: type mismatch
-  t
-has type
-  Valtype : Type
-but is expected to have type
-  Resulttype : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Valtype Valtype ?m.79533
-SpecTec.lean: error: application type mismatch
-  Prod.mk t_1
-argument
-  t_1
+  ((), t)
 has type
-  Valtype : Type
+  Unit × Valtype : Type
 but is expected to have type
-  Resulttype : Type
+  Globaltype : Type
+SpecTec.lean: error: unknown constant 'Numtype.Fn'
+SpecTec.lean: error: unknown constant 'Numtype.Fn'
+SpecTec.lean: error: unknown constant 'Valtype.Fn'
+SpecTec.lean: error: unknown constant 'Valtype.Fn'
+SpecTec.lean: error: unknown constant 'Valtype.In'
+SpecTec.lean: error: unknown constant 'Valtype.In'
+SpecTec.lean: error: unknown constant 'Numtype.In'
+SpecTec.lean: error: unknown constant 'Numtype.In'
+SpecTec.lean: error: unknown constant 'Valtype.In'
+SpecTec.lean: error: unknown constant 'Valtype.In'
 SpecTec.lean: error: application type mismatch
-  Prod.mk instr_1
+  List.get! C.LABEL l
 argument
-  instr_1
+  l
 has type
-  Instr : Type
+  List Labelidx : Type
 but is expected to have type
-  List Instr : Type
+  Nat : Type
 SpecTec.lean: error: application type mismatch
-  Prod.mk t_1
+  (t_1, t_2)
 argument
-  t_1
+  t_2
 has type
   Valtype : Type
 but is expected to have type
@@ -1145,39 +1093,31 @@ has type
 but is expected to have type
   Resulttype : Type
 SpecTec.lean: error: application type mismatch
-  Prod.mk instr_2
-argument
-  instr_2
-has type
-  Instr : Type
-but is expected to have type
-  List Instr : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk t_1
+  (t_1, t_2)
 argument
-  t_1
+  t_2
 has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
 SpecTec.lean: error: application type mismatch
-  Prod.mk instr_1
+  List.cons t_2
 argument
-  instr_1
+  t_2
 has type
-  Instr : Type
+  Valtype : Type
 but is expected to have type
-  List Instr : Type
+  Resulttype : Type
 SpecTec.lean: error: application type mismatch
-  Prod.mk t_1
+  (t_1, t_2)
 argument
-  t_1
+  t_2
 has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
 SpecTec.lean: error: application type mismatch
-  List.cons t_2
+  (t_1, t_2)
 argument
   t_2
 has type
@@ -1185,563 +1125,182 @@ has type
 but is expected to have type
   Resulttype : Type
 SpecTec.lean: error: application type mismatch
-  Prod.mk t_1
+  Prod.mk t'_1
 argument
-  t_1
+  t'_1
 has type
   Valtype : Type
 but is expected to have type
-  Resulttype : Type
+  List Valtype : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend (List Instr) Instr ?m.77841
 SpecTec.lean: error: application type mismatch
-  Prod.mk instr
+  (C, instr)
 argument
   instr
 has type
+  List Instr : Type
+but is expected to have type
   Instr : Type
+SpecTec.lean: error: type mismatch
+  ((), t)
+has type
+  Unit × Valtype : Type
 but is expected to have type
-  List Instr : Type
+  Globaltype : Type
 SpecTec.lean: error: application type mismatch
-  Prod.mk t_1
+  Prod.mk expr
 argument
-  t_1
+  expr
 has type
-  Valtype : Type
+  List Expr : Type
 but is expected to have type
-  Resulttype : Type
+  Expr : Type
 SpecTec.lean: error: application type mismatch
-  (bt, instr)
+  Prod.mk elemmode
 argument
-  instr
+  elemmode
 has type
-  Instr : Type
+  Option Elemmode : Type
 but is expected to have type
-  List Instr : Type
+  Elemmode : Type
 SpecTec.lean: error: application type mismatch
-  Prod.mk t_1
+  (C, datamode)
 argument
-  t_1
+  datamode
 has type
-  Valtype : Type
+  Option Datamode : Type
 but is expected to have type
-  Resulttype : Type
+  Datamode : Type
 SpecTec.lean: error: application type mismatch
-  List.cons t_1
+  Prod.mk func
 argument
-  t_1
+  func
 has type
-  Valtype : Type
+  List Func : Type
 but is expected to have type
-  Resulttype : Type
+  Func : Type
 SpecTec.lean: error: application type mismatch
-  Prod.mk t_1
+  Prod.mk global
 argument
-  t_1
+  global
 has type
-  Valtype : Type
+  List Global : Type
 but is expected to have type
-  Resulttype : Type
+  Global : Type
 SpecTec.lean: error: application type mismatch
-  Prod.mk instr
+  Prod.mk table
 argument
-  instr
+  table
 has type
-  Instr : Type
+  List Table : Type
 but is expected to have type
-  List Instr : Type
+  Table : Type
 SpecTec.lean: error: application type mismatch
-  Prod.mk t_1
+  Prod.mk mem
 argument
-  t_1
+  mem
 has type
-  Valtype : Type
+  List Mem : Type
 but is expected to have type
-  Resulttype : Type
+  Mem : Type
 SpecTec.lean: error: application type mismatch
-  (bt, instr)
+  Prod.mk elem
 argument
-  instr
+  elem
 has type
-  Instr : Type
+  List Elem : Type
 but is expected to have type
-  List Instr : Type
+  Elem : Type
 SpecTec.lean: error: application type mismatch
-  Prod.mk t_1
+  (C, data)
 argument
-  t_1
+  data
 has type
-  Valtype : Type
+  List Data : Type
 but is expected to have type
-  Resulttype : Type
+  Data : Type
 SpecTec.lean: error: application type mismatch
-  List.cons t_2
+  (C, start)
 argument
-  t_2
+  start
 has type
-  Valtype : Type
+  List Start : Type
 but is expected to have type
-  Resulttype : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk t_1
-argument
-  t_1
+  Start : Type
+SpecTec.lean: error: type mismatch
+  ()
 has type
-  Valtype : Type
+  Unit : Type
 but is expected to have type
-  Resulttype : Type
+  List Datatype : Type
+SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `f` [linter.unusedVariables]
+SpecTec.lean: error: expected identifier
+SpecTec.lean: error: expected 'elab', 'elab_rules', 'infix', 'infixl', 'infixr', 'instance', 'macro', 'macro_rules', 'notation', 'postfix', 'prefix', 'syntax' or 'unif_hint'
+SpecTec.lean: warning: unused variable `f` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `v` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `v` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `i` [linter.unusedVariables]
+SpecTec.lean: warning: unused variable `r` [linter.unusedVariables]
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: application type mismatch
-  Prod.mk instr
+  Admininstr.Instr instr
 argument
   instr
 has type
-  Instr : Type
-but is expected to have type
   List Instr : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk t_1
-argument
-  t_1
-has type
-  Valtype : Type
 but is expected to have type
-  Resulttype : Type
+  Instr : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend (List Admininstr) Admininstr ?m.124169
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: application type mismatch
-  Prod.mk instr
+  Admininstr.Instr instr
 argument
   instr
 has type
-  Instr : Type
-but is expected to have type
   List Instr : Type
+but is expected to have type
+  Instr : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend Valtype Valtype ?m.81846
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Valtype Valtype ?m.82047
+  HAppend (List Admininstr) Admininstr ?m.124562
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: application type mismatch
-  Prod.mk instr
+  Admininstr.Instr instr'
 argument
-  instr
+  instr'
 has type
-  Instr : Type
-but is expected to have type
   List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: application type mismatch
-  Prod.mk t_1
+  Admininstr.Instr instr
 argument
-  t_1
+  instr
 has type
-  Valtype : Type
+  List Instr : Type
 but is expected to have type
-  Resulttype : Type
+  Instr : Type
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: application type mismatch
-  Prod.mk t'_1
-argument
-  t'_1
-has type
-  Valtype : Type
-but is expected to have type
-  List Valtype : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk t_2
-argument
-  t_2
-has type
-  Valtype : Type
-but is expected to have type
-  List Valtype : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk instr
-argument
-  instr
-has type
-  Instr : Type
-but is expected to have type
-  List Instr : Type
-SpecTec.lean: error: application type mismatch
-  ([t'_1], t'_2)
-argument
-  t'_2
-has type
-  Valtype : Type
-but is expected to have type
-  Resulttype : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk t_1
-argument
-  t_1
-has type
-  Valtype : Type
-but is expected to have type
-  Resulttype : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk t_2
-argument
-  t_2
-has type
-  Valtype : Type
-but is expected to have type
-  Resulttype : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Instr) Instr ?m.83395
-SpecTec.lean: error: application type mismatch
-  Prod.mk t_1
-argument
-  t_1
-has type
-  Valtype : Type
-but is expected to have type
-  Resulttype : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk instr
-argument
-  instr
-has type
-  Instr : Type
-but is expected to have type
-  List Instr : Type
-SpecTec.lean: error: application type mismatch
-  ([], t)
-argument
-  t
-has type
-  Valtype : Type
-but is expected to have type
-  Resulttype : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk instr
-argument
-  instr
-has type
-  Instr : Type
-but is expected to have type
-  Expr : Type
-SpecTec.lean: error: application type mismatch
-  (C, instr)
-argument
-  instr
-has type
-  Instr : Type
-but is expected to have type
-  Expr : Type
-SpecTec.lean: error: type mismatch
-  (t_1, t_2)
-has type
-  Valtype × Valtype : Type
-but is expected to have type
-  Functype : Type
-SpecTec.lean: error: application type mismatch
-  (expr, t_2)
-argument
-  t_2
-has type
-  Valtype : Type
-but is expected to have type
-  Resulttype : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk t
-argument
-  t
-has type
-  Valtype : Type
-but is expected to have type
-  List Valtype : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Valtype Valtype ?m.101807
-SpecTec.lean: error: application type mismatch
-  List.cons t_2
-argument
-  t_2
-has type
-  Valtype : Type
-but is expected to have type
-  Resulttype : Type
-SpecTec.lean: error: application type mismatch
-  some t_2
-argument
-  t_2
-has type
-  Valtype : Type
-but is expected to have type
-  Resulttype : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk expr
-argument
-  expr
-has type
-  Expr : Type
-but is expected to have type
-  List Expr : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk b
-argument
-  b
-has type
-  Byte : Type
-but is expected to have type
-  List (List Byte) : Type
-SpecTec.lean: error: type mismatch
-  ft
-has type
-  Functype : Type
-but is expected to have type
-  List Functype : Type
-SpecTec.lean: error: invalid field 'length', the environment does not contain 'Mem.length'
-  mem
-has type
-  Mem
-SpecTec.lean: error: invalid field 'length', the environment does not contain 'Memtype.length'
-  mem
-has type
-  Memtype
-SpecTec.lean: error: invalid field 'length', the environment does not contain 'Limits.length'
-  mem
-has type
-  Limits
-SpecTec.lean: error: invalid field 'length', the environment does not contain 'Prod.length'
-  mem
-has type
-  U32 × U32
-SpecTec.lean: error: invalid field 'length', the environment does not contain 'Start.length'
-  start
-has type
-  Start
-SpecTec.lean: error: invalid field 'length', the environment does not contain 'Funcidx.length'
-  start
-has type
-  Funcidx
-SpecTec.lean: error: invalid field 'length', the environment does not contain 'Idx.length'
-  start
-has type
-  Idx
-SpecTec.lean: error: invalid field 'length', the environment does not contain 'Nat.length'
-  start
-has type
-  Nat
-SpecTec.lean: error: application type mismatch
-  Prod.mk import
-argument
-  import
-has type
-  Import : Type
-but is expected to have type
-  List Import : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk func
-argument
-  func
-has type
-  Func : Type
-but is expected to have type
-  List Func : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk global
-argument
-  global
-has type
-  Global : Type
-but is expected to have type
-  List Global : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk table
-argument
-  table
-has type
-  Table : Type
-but is expected to have type
-  List Table : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk mem
-argument
-  mem
-has type
-  Mem : Type
-but is expected to have type
-  List Mem : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk elem
-argument
-  elem
-has type
-  Elem : Type
-but is expected to have type
-  List Elem : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk data
-argument
-  data
-has type
-  Data : Type
-but is expected to have type
-  List Data : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk start
-argument
-  start
-has type
-  Start : Type
-but is expected to have type
-  List Start : Type
-SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `f` [linter.unusedVariables]
-SpecTec.lean: error: expected identifier
-SpecTec.lean: error: expected 'elab', 'elab_rules', 'infix', 'infixl', 'infixr', 'instance', 'macro', 'macro_rules', 'notation', 'postfix', 'prefix', 'syntax' or 'unif_hint'
-SpecTec.lean: warning: unused variable `f` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `v` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `v` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `i` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `r` [linter.unusedVariables]
-SpecTec.lean: error: invalid field 'length', the environment does not contain 'Labelidx.length'
-  l
-has type
-  Labelidx
-SpecTec.lean: error: invalid field 'length', the environment does not contain 'Idx.length'
-  l
-has type
-  Idx
-SpecTec.lean: error: invalid field 'length', the environment does not contain 'Nat.length'
-  l
-has type
-  Nat
-SpecTec.lean: error: application type mismatch
-  Prod.mk l
-argument
-  l
-has type
-  Labelidx : Type
-but is expected to have type
-  List Labelidx : Type
-SpecTec.lean: error: invalid field 'length', the environment does not contain 'Labelidx.length'
-  l
-has type
-  Labelidx
-SpecTec.lean: error: invalid field 'length', the environment does not contain 'Idx.length'
-  l
-has type
-  Idx
-SpecTec.lean: error: invalid field 'length', the environment does not contain 'Nat.length'
-  l
-has type
-  Nat
-SpecTec.lean: error: application type mismatch
-  Prod.mk l
-argument
-  l
-has type
-  Labelidx : Type
-but is expected to have type
-  List Labelidx : Type
-SpecTec.lean: error: invalid field 'get!', the environment does not contain 'Labelidx.get!'
-  l
-has type
-  Labelidx
-SpecTec.lean: error: invalid field 'get!', the environment does not contain 'Idx.get!'
-  l
-has type
-  Idx
-SpecTec.lean: error: invalid field 'get!', the environment does not contain 'Nat.get!'
-  l
-has type
-  Nat
-SpecTec.lean: error: application type mismatch
-  Prod.mk instr'
-argument
-  instr'
-has type
-  Instr : Type
-but is expected to have type
-  List Instr : Type
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Admininstr) Admininstr ?m.130319
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: application type mismatch
-  Prod.mk instr'
-argument
-  instr'
-has type
-  Instr : Type
-but is expected to have type
-  List Instr : Type
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Admininstr) Admininstr ?m.130708
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: application type mismatch
-  Prod.mk instr_1
-argument
-  instr_1
-has type
-  Instr : Type
-but is expected to have type
-  List Instr : Type
-SpecTec.lean: error: application type mismatch
-  (bt, instr_2)
-argument
-  instr_2
-has type
-  Instr : Type
-but is expected to have type
-  List Instr : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk instr_1
-argument
-  instr_1
-has type
-  Instr : Type
-but is expected to have type
-  List Instr : Type
-SpecTec.lean: error: application type mismatch
-  (bt, instr_1)
-argument
-  instr_1
-has type
-  Instr : Type
-but is expected to have type
-  List Instr : Type
-SpecTec.lean: error: type mismatch
-  (t_1, t_2)
-has type
-  Valtype × Valtype : Type
-but is expected to have type
-  Blocktype : Type
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: application type mismatch
-  (bt, instr)
+  Admininstr.Instr instr
 argument
   instr
 has type
-  Instr : Type
-but is expected to have type
   List Instr : Type
-SpecTec.lean: error: application type mismatch
-  (bt, instr)
-argument
-  instr
-has type
-  Instr : Type
 but is expected to have type
-  List Instr : Type
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: type mismatch
-  (t_1, t_2)
-has type
-  Valtype × Valtype : Type
-but is expected to have type
-  Blocktype : Type
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: application type mismatch
-  (bt, instr)
-argument
-  instr
-has type
   Instr : Type
-but is expected to have type
-  List Instr : Type
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
@@ -1755,23 +1314,24 @@ SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: type mismatch
-  (m, (t_1, t_2), t, instr)
+SpecTec.lean: error: application type mismatch
+  default_ t
+argument
+  t
 has type
-  Moduleinst × (Valtype × Valtype) × Valtype × Instr : Type
+  List Valtype : Type
 but is expected to have type
-  Funcinst : Type
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
+  Valtype : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend Val Val ?m.134041
+  HAppend (List Val) Val ?m.126855
 SpecTec.lean: error: application type mismatch
-  ([], Admininstr.Instr instr)
-argument
   Admininstr.Instr instr
+argument
+  instr
 has type
-  Admininstr : Type
+  List Instr : Type
 but is expected to have type
-  List Admininstr : Type
+  Instr : Type
 SpecTec.lean: error: unknown constant 'Admininstr.Ref'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
@@ -1786,83 +1346,99 @@ SpecTec.lean: error: unknown constant 'Admininstr.Ref'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: application type mismatch
-  (z, Admininstr.Instr instr)
-argument
   Admininstr.Instr instr
+argument
+  instr
 has type
-  Admininstr : Type
+  List Instr : Type
 but is expected to have type
-  List Admininstr : Type
+  Instr : Type
 SpecTec.lean: error: application type mismatch
-  (z', Admininstr.Instr instr')
-argument
   Admininstr.Instr instr'
+argument
+  instr'
 has type
-  Admininstr : Type
+  List Instr : Type
 but is expected to have type
-  List Admininstr : Type
+  Instr : Type
 SpecTec.lean: error: application type mismatch
-  (z, Admininstr.Instr instr)
-argument
   Admininstr.Instr instr
+argument
+  instr
 has type
-  Admininstr : Type
+  List Instr : Type
 but is expected to have type
-  List Admininstr : Type
+  Instr : Type
 SpecTec.lean: error: application type mismatch
-  (z', Admininstr.Instr instr')
-argument
   Admininstr.Instr instr'
+argument
+  instr'
 has type
-  Admininstr : Type
+  List Instr : Type
 but is expected to have type
-  List Admininstr : Type
+  Instr : Type
 SpecTec.lean: error: application type mismatch
-  (z, Admininstr.Instr instr)
-argument
   Admininstr.Instr instr
+argument
+  instr
 has type
-  Admininstr : Type
+  List Instr : Type
 but is expected to have type
-  List Admininstr : Type
+  Instr : Type
 SpecTec.lean: error: application type mismatch
-  (z, Admininstr.Instr instr)
+  Admininstr.Instr instr'
 argument
-  Admininstr.Instr instr
+  instr'
 has type
-  Admininstr : Type
+  List Instr : Type
 but is expected to have type
-  List Admininstr : Type
+  Instr : Type
 SpecTec.lean: error: application type mismatch
-  (z, Admininstr.Instr instr')
+  Admininstr.Instr instr
 argument
-  Admininstr.Instr instr'
+  instr
 has type
-  Admininstr : Type
+  List Instr : Type
 but is expected to have type
-  List Admininstr : Type
+  Instr : Type
 SpecTec.lean: error: application type mismatch
-  Prod.mk (Admininstr.Instr instr)
+  Admininstr.Instr instr'
 argument
+  instr'
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
   Admininstr.Instr instr
+argument
+  instr
 has type
-  Admininstr : Type
+  List Instr : Type
 but is expected to have type
-  List Admininstr : Type
+  Instr : Type
 SpecTec.lean: error: application type mismatch
-  (z, Admininstr.Instr instr)
+  Admininstr.Instr instr'
 argument
-  Admininstr.Instr instr
+  instr'
 has type
-  Admininstr : Type
+  List Instr : Type
 but is expected to have type
-  List Admininstr : Type
+  Instr : Type
 SpecTec.lean: error: application type mismatch
-  (z, Admininstr.Instr instr')
+  Admininstr.Instr instr
 argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
   Admininstr.Instr instr'
+argument
+  instr'
 has type
-  Admininstr : Type
+  List Instr : Type
 but is expected to have type
-  List Admininstr : Type
+  Instr : Type
 ```

From db0f53bd461e0b9eb80a823c3589234eeae94232 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 5 Apr 2023 22:13:56 +0200
Subject: [PATCH 29/98] Sigh, curl

---
 .github/workflows/ci-spectec.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-spectec.yml b/.github/workflows/ci-spectec.yml
index fe2b0595c1..49ae1bb1e7 100644
--- a/.github/workflows/ci-spectec.yml
+++ b/.github/workflows/ci-spectec.yml
@@ -31,7 +31,7 @@ jobs:
       - name: Setup Lean
         run: |
           cd /tmp
-          curl -O https://github.com/leanprover/lean4-nightly/releases/download/nightly-2023-02-10/lean-4.0.0-nightly-2023-02-10-linux.tar.zst
+          curl -LO https://github.com/leanprover/lean4-nightly/releases/download/nightly-2023-02-10/lean-4.0.0-nightly-2023-02-10-linux.tar.zst
           tar xaf lean-4.0.0-nightly-2023-02-10-linux.tar.zst
           echo "/tmp/lean-4.0.0-nightly-2023-02-10-linux/bin" >> $GITHUB_PATH
       - name: Setup Dune

From 27384c9948bc7ad153ca87e15ca8a3f92fc5d841 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 5 Apr 2023 22:53:33 +0200
Subject: [PATCH 30/98] Include multiplicity as comments

---
 spectec/src/backend-lean4/gen.ml | 13 ++++--
 spectec/test-lean4/TEST.md       | 70 ++++++++++++++++----------------
 2 files changed, 45 insertions(+), 38 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 634def627b..85aaa585b8 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -104,7 +104,10 @@ let rec render_exp (exp : exp) = match exp.it with
   | ListE es -> render_list render_exp es
   | OptE None -> "none"
   | OptE (Some e) -> "some" $$ render_exp e
-  | IterE (e, _) -> render_exp e
+  | IterE (e, iter) -> begin match e.it with
+    | VarE v -> render_id v (* Short-ciruit this common form *)
+    | _ -> render_exp e ^ " /- " ^ Il.Print.string_of_iter iter ^ " -/"
+  end
   | CaseE (a, e, typ, styps) -> render_case a e typ styps
   | StrE fields -> braces ( String.concat ", " (List.map (fun (a, e) ->
     render_field_name a ^ " := " ^ render_exp e
@@ -202,8 +205,12 @@ let rec render_def (d : def) =
         String.concat "" (List.map (fun (prem : premise) ->
           "\n    " ^
           begin match prem.it with
-          | RulePr (pid, _mixops, pexp, _iter) ->
-            render_type_name pid $$ render_exp pexp
+          | RulePr (pid, _mixops, pexp, iter) ->
+            (render_type_name pid $$ render_exp pexp) ^
+            begin match iter with
+            | None -> ""
+            | Some iter -> " /- " ^ Il.Print.string_of_iter iter ^ " -/"
+            end
           | IfPr (pexp, _iter) -> render_exp pexp
           | ElsePr -> "True /- Else? -/"
           end ^ " -> "
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 6b980e4806..b57f7f801c 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -372,7 +372,7 @@ inductive Valtype_sub : (Valtype × Valtype) -> Prop where
 
 inductive Resulttype_sub : ((List Valtype) × (List Valtype)) -> Prop where
   | rule_0 (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
-    (Valtype_sub (t_1, t_2)) ->
+    (Valtype_sub (t_1, t_2)) /- * -/ ->
     (Resulttype_sub (t_1, t_2))
 
 inductive Limits_sub : (Limits × Limits) -> Prop where
@@ -431,7 +431,7 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     ((((Nat.pow 2) n_A)) <= (((Nat.div (size t)) 8))) ->
     (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div (size t)) 8)))) ->
     ((n == none) || (nt == (Numtype.In «in»))) ->
-    (Instr_ok (C, (Instr.LOAD (nt, (n, sx), n_A, n_O)), ([(Valtype.Numtype Numtype.I32)], [(Valtype.Numtype nt)])))
+    (Instr_ok (C, (Instr.LOAD (nt, (n, sx) /- ? -/, n_A, n_O)), ([(Valtype.Numtype Numtype.I32)], [(Valtype.Numtype nt)])))
   | data_drop (C : Context) (x : Idx) :
     ((C.DATA.get! x) == ()) ->
     (Instr_ok (C, (Instr.DATA_DROP x), ([], [])))
@@ -481,7 +481,7 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     ((C.GLOBAL.get! x) == ((some ()), t)) ->
     (Instr_ok (C, (Instr.GLOBAL_SET x), ([t], [])))
   | global_get (C : Context) (t : Valtype) (x : Idx) :
-    ((C.GLOBAL.get! x) == ((), t)) ->
+    ((C.GLOBAL.get! x) == (() /- ? -/, t)) ->
     (Instr_ok (C, (Instr.GLOBAL_GET x), ([], [t])))
   | local_tee (C : Context) (t : Valtype) (x : Idx) :
     ((C.LOCAL.get! x) == t) ->
@@ -534,7 +534,7 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (C.RETURN == (some t)) ->
     (Instr_ok (C, Instr.RETURN, ((t_1 ++ t), t_2)))
   | br_table (C : Context) (l : (List Labelidx)) (l' : Labelidx) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
-    (Resulttype_sub (t, (C.LABEL.get! l))) ->
+    (Resulttype_sub (t, (C.LABEL.get! l))) /- * -/ ->
     (Resulttype_sub (t, (C.LABEL.get! l'))) ->
     (Instr_ok (C, (Instr.BR_TABLE (l, l')), ((t_1 ++ t), t_2)))
   | br_if (C : Context) (l : Labelidx) (t : (List Valtype)) :
@@ -545,16 +545,16 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (Instr_ok (C, (Instr.BR l), ((t_1 ++ t), t_2)))
   | if (C : Context) (bt : Blocktype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) (t_1 : (List Valtype)) (t_2 : Valtype) :
     (Blocktype_ok (C, bt, (t_1, [t_2]))) ->
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2], RETURN := none}), instr_1, (t_1, t_2))) ->
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2], RETURN := none}), instr_2, (t_1, t_2))) ->
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2] /- * -/, RETURN := none}), instr_1, (t_1, t_2))) ->
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2] /- * -/, RETURN := none}), instr_2, (t_1, t_2))) ->
     (Instr_ok (C, (Instr.IF (bt, instr_1, instr_2)), (t_1, [t_2])))
   | loop (C : Context) (bt : Blocktype) (instr : (List Instr)) (t_1 : (List Valtype)) (t_2 : Valtype) :
     (Blocktype_ok (C, bt, (t_1, t_2))) ->
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_1], RETURN := none}), instr, (t_1, [t_2]))) ->
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_1] /- * -/, RETURN := none}), instr, (t_1, [t_2]))) ->
     (Instr_ok (C, (Instr.LOOP (bt, instr)), (t_1, t_2)))
   | block (C : Context) (bt : Blocktype) (instr : (List Instr)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
     (Blocktype_ok (C, bt, (t_1, t_2))) ->
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2], RETURN := none}), instr, (t_1, t_2))) ->
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2] /- * -/, RETURN := none}), instr, (t_1, t_2))) ->
     (Instr_ok (C, (Instr.BLOCK (bt, instr)), (t_1, t_2)))
   | select_impl (C : Context) (numtype : Numtype) (t : Valtype) (t' : Valtype) (vectype : Vectype) :
     (Valtype_sub (t, t')) ->
@@ -603,7 +603,7 @@ inductive Instr_const : (Context × Instr) -> Prop where
 
 inductive Expr_const : (Context × Expr) -> Prop where
   | rule_0 (C : Context) (instr : (List Instr)) :
-    (Instr_const (C, instr)) ->
+    (Instr_const (C, instr)) /- * -/ ->
     (Expr_const (C, instr))
 
 inductive Expr_ok_const : (Context × Expr × Valtype) -> Prop where
@@ -622,7 +622,7 @@ inductive Func_ok : (Context × Func × Functype) -> Prop where
 inductive Global_ok : (Context × Global × Globaltype) -> Prop where
   | rule_0 (C : Context) (expr : Expr) (gt : Globaltype) (t : Valtype) :
     (Globaltype_ok gt) ->
-    (gt == ((), t)) ->
+    (gt == (() /- ? -/, t)) ->
     (Expr_ok_const (C, expr, t)) ->
     (Global_ok (C, (gt, expr), gt))
 
@@ -641,25 +641,25 @@ inductive Elemmode_ok : (Context × Elemmode × Reftype) -> Prop where
     (Elemmode_ok (C, Elemmode.DECLARE, rt))
   | active (C : Context) (expr : Expr) (lim : Limits) (rt : Reftype) (x : Idx) :
     ((C.TABLE.get! x) == (lim, rt)) ->
-    (Expr_ok_const (C, expr, (Valtype.Numtype Numtype.I32))) ->
+    (Expr_ok_const (C, expr, (Valtype.Numtype Numtype.I32))) /- * -/ ->
     (Elemmode_ok (C, (Elemmode.TABLE (x, expr)), rt))
 
 inductive Elem_ok : (Context × Elem × Reftype) -> Prop where
   | rule_0 (C : Context) (elemmode : (Option Elemmode)) (expr : (List Expr)) (rt : Reftype) :
-    (Expr_ok (C, expr, [(Valtype.Reftype rt)])) ->
-    (Elemmode_ok (C, elemmode, rt)) ->
+    (Expr_ok (C, expr, [(Valtype.Reftype rt)])) /- * -/ ->
+    (Elemmode_ok (C, elemmode, rt)) /- ? -/ ->
     (Elem_ok (C, (rt, expr, elemmode), rt))
 
 inductive Datamode_ok : (Context × Datamode) -> Prop where
   | rule_0 (C : Context) (expr : Expr) (mt : Memtype) :
     ((C.MEM.get! 0) == mt) ->
-    (Expr_ok_const (C, expr, (Valtype.Numtype Numtype.I32))) ->
+    (Expr_ok_const (C, expr, (Valtype.Numtype Numtype.I32))) /- * -/ ->
     (Datamode_ok (C, (Datamode.MEMORY (0, expr))))
 
 inductive Data_ok : (Context × Data) -> Prop where
   | rule_0 (C : Context) (b : (List (List Byte))) (datamode : (Option Datamode)) :
-    (Datamode_ok (C, datamode)) ->
-    (Data_ok (C, (b, datamode)))
+    (Datamode_ok (C, datamode)) /- ? -/ ->
+    (Data_ok (C, (b /- * -/, datamode)))
 
 inductive Start_ok : (Context × Start) -> Prop where
   | rule_0 (C : Context) (x : Idx) :
@@ -692,14 +692,14 @@ inductive Export_ok : (Context × Export × Externtype) -> Prop where
 
 inductive Module_ok : Module -> Prop where
   | rule_0 (C : Context) (data : (List Data)) (elem : (List Elem)) («export» : (List Export)) (ft : (List Functype)) (func : (List Func)) («global» : (List Global)) (gt : (List Globaltype)) («import» : (List Import)) (mem : (List Mem)) (mt : (List Memtype)) (n : N) (rt : (List Reftype)) (start : (List Start)) (table : (List Table)) (tt : (List Tabletype)) :
-    (Func_ok (C, func, ft)) ->
-    (Global_ok (C, «global», gt)) ->
-    (Table_ok (C, table, tt)) ->
-    (Mem_ok (C, mem, mt)) ->
-    (Elem_ok (C, elem, rt)) ->
-    (Data_ok (C, data)) ->
-    (Start_ok (C, start)) ->
-    (C == {FUNC := ft, GLOBAL := gt, TABLE := tt, MEM := mt, ELEM := rt, DATA := (), LOCAL := [], LABEL := [], RETURN := none}) ->
+    (Func_ok (C, func, ft)) /- * -/ ->
+    (Global_ok (C, «global», gt)) /- * -/ ->
+    (Table_ok (C, table, tt)) /- * -/ ->
+    (Mem_ok (C, mem, mt)) /- * -/ ->
+    (Elem_ok (C, elem, rt)) /- * -/ ->
+    (Data_ok (C, data)) /- ^n -/ ->
+    (Start_ok (C, start)) /- * -/ ->
+    (C == {FUNC := ft, GLOBAL := gt, TABLE := tt, MEM := mt, ELEM := rt, DATA := () /- ^n -/, LOCAL := [], LABEL := [], RETURN := none}) ->
     (mem.length <= 1) ->
     (start.length <= 1) ->
     (Module_ok («import», func, «global», table, mem, elem, data, start, «export»))
@@ -883,9 +883,9 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (c != 0) ->
     (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.BR_IF l))], [(Admininstr.Instr (Instr.BR l))]))
   | br_succ (instr : (List Instr)) (instr' : (List Instr)) (l : Labelidx) (n : N) (val : (List Val)) :
-    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((Admininstr.Val val) ++ ([(Admininstr.Instr (Instr.BR (l + 1)))] ++ (Admininstr.Instr instr)))))], ((Admininstr.Val val) ++ [(Admininstr.Instr (Instr.BR l))])))
+    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((Admininstr.Val val) /- * -/ ++ ([(Admininstr.Instr (Instr.BR (l + 1)))] ++ (Admininstr.Instr instr) /- * -/))))], ((Admininstr.Val val) /- * -/ ++ [(Admininstr.Instr (Instr.BR l))])))
   | br_zero (instr : (List Instr)) (instr' : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) :
-    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((Admininstr.Val val') ++ ((Admininstr.Val val) ++ ([(Admininstr.Instr (Instr.BR 0))] ++ (Admininstr.Instr instr))))))], ((Admininstr.Val val) ++ (Admininstr.Instr instr'))))
+    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((Admininstr.Val val') /- * -/ ++ ((Admininstr.Val val) /- ^n -/ ++ ([(Admininstr.Instr (Instr.BR 0))] ++ (Admininstr.Instr instr) /- * -/)))))], ((Admininstr.Val val) /- ^n -/ ++ (Admininstr.Instr instr') /- * -/)))
   | if_false (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) :
     (c == 0) ->
     (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.IF (bt, instr_1, instr_2)))], [(Admininstr.Instr (Instr.BLOCK (bt, instr_2)))]))
@@ -894,10 +894,10 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.IF (bt, instr_1, instr_2)))], [(Admininstr.Instr (Instr.BLOCK (bt, instr_1)))]))
   | loop (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
     (bt == (t_1, t_2)) ->
-    (Step_pure (((Admininstr.Val val) ++ [(Admininstr.Instr (Instr.LOOP (bt, instr)))]), [(Admininstr.LABEL_ (n, [(Instr.LOOP (bt, instr))], ((Admininstr.Val val) ++ (Admininstr.Instr instr))))]))
+    (Step_pure (((Admininstr.Val val) /- ^k -/ ++ [(Admininstr.Instr (Instr.LOOP (bt, instr)))]), [(Admininstr.LABEL_ (n, [(Instr.LOOP (bt, instr))], ((Admininstr.Val val) /- ^k -/ ++ (Admininstr.Instr instr) /- * -/)))]))
   | block (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
     (bt == (t_1, t_2)) ->
-    (Step_pure (((Admininstr.Val val) ++ [(Admininstr.Instr (Instr.BLOCK (bt, instr)))]), [(Admininstr.LABEL_ (n, [], ((Admininstr.Val val) ++ (Admininstr.Instr instr))))]))
+    (Step_pure (((Admininstr.Val val) /- ^k -/ ++ [(Admininstr.Instr (Instr.BLOCK (bt, instr)))]), [(Admininstr.LABEL_ (n, [], ((Admininstr.Val val) /- ^k -/ ++ (Admininstr.Instr instr) /- * -/)))]))
   | local_tee (val : Val) (x : Idx) :
     (Step_pure ([(Admininstr.Val val), (Admininstr.Instr (Instr.LOCAL_TEE x))], [(Admininstr.Val val), (Admininstr.Val val), (Admininstr.Instr (Instr.LOCAL_SET x))]))
   | select_false (c : C_numtype) (t : (Option Valtype)) (val_1 : Val) (val_2 : Val) :
@@ -922,7 +922,7 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
 inductive Step_read : (Config × (List Admininstr)) -> Prop where
   | call_addr (a : Addr) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
     (((funcinst z).get! a) == (m, ((t_1, t_2), t, instr))) ->
-    (Step_read ((z, ((Admininstr.Val val) ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, {LOCAL := (val ++ (default_ t)), MODULE := m}, [(Admininstr.LABEL_ (n, [], (Admininstr.Instr instr)))]))]))
+    (Step_read ((z, ((Admininstr.Val val) /- ^k -/ ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, {LOCAL := (val ++ (default_ t) /- * -/), MODULE := m}, [(Admininstr.LABEL_ (n, [], (Admininstr.Instr instr) /- * -/))]))]))
   | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
     True /- Else? -/ ->
     (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CALL_INDIRECT (x, ft)))]), [Admininstr.TRAP]))
@@ -992,14 +992,14 @@ inductive Step_write : (Config × Config) -> Prop where
 
 inductive Step : (Config × Config) -> Prop where
   | write (instr : (List Instr)) (instr' : (List Instr)) (z : State) (z' : State) :
-    (Step_write ((z, (Admininstr.Instr instr)), (z', (Admininstr.Instr instr')))) ->
-    (Step ((z, (Admininstr.Instr instr)), (z', (Admininstr.Instr instr'))))
+    (Step_write ((z, (Admininstr.Instr instr) /- * -/), (z', (Admininstr.Instr instr') /- * -/))) ->
+    (Step ((z, (Admininstr.Instr instr) /- * -/), (z', (Admininstr.Instr instr') /- * -/)))
   | read (instr : (List Instr)) (instr' : (List Instr)) (z : State) :
-    (Step_read ((z, (Admininstr.Instr instr)), (Admininstr.Instr instr'))) ->
-    (Step ((z, (Admininstr.Instr instr)), (z, (Admininstr.Instr instr'))))
+    (Step_read ((z, (Admininstr.Instr instr) /- * -/), (Admininstr.Instr instr') /- * -/)) ->
+    (Step ((z, (Admininstr.Instr instr) /- * -/), (z, (Admininstr.Instr instr') /- * -/)))
   | pure (instr : (List Instr)) (instr' : (List Instr)) (z : State) :
-    (Step_pure ((Admininstr.Instr instr), (Admininstr.Instr instr'))) ->
-    (Step ((z, (Admininstr.Instr instr)), (z, (Admininstr.Instr instr'))))
+    (Step_pure ((Admininstr.Instr instr) /- * -/, (Admininstr.Instr instr') /- * -/)) ->
+    (Step ((z, (Admininstr.Instr instr) /- * -/), (z, (Admininstr.Instr instr') /- * -/)))
 $ lean SpecTec.lean 2>&1 | sed -e 's,/[^ ]*/toolchains,.../toolchains`,g' | sed -e 's,SpecTec.lean:[0-9]\+:[0-9]\+,SpecTec.lean,'
 SpecTec.lean: warning: unused variable `n_3_ATOM_y` [linter.unusedVariables]
 SpecTec.lean: error: application type mismatch

From 6ca971b9740e4510ce8a451408a208c3f257492b Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 5 Apr 2023 23:42:00 +0200
Subject: [PATCH 31/98] Add variant flattening IR pass

---
 spectec/spec/4-runtime.watsup      |    3 +-
 spectec/src/backend-haskell/gen.ml |   16 +-
 spectec/src/backend-lean4/gen.ml   |   15 +-
 spectec/src/exe-haskell/main.ml    |    2 +
 spectec/src/exe-lean4/main.ml      |    2 +
 spectec/src/frontend/elab.ml       |   47 +-
 spectec/src/il/ast.ml              |    2 +-
 spectec/src/il/dune                |    2 +-
 spectec/src/il/eq.ml               |    8 +-
 spectec/src/il/flat.ml             |   73 +
 spectec/src/il/flat.mli            |    1 +
 spectec/src/il/free.ml             |    3 +-
 spectec/src/il/print.ml            |    8 +-
 spectec/src/il/validation.ml       |   22 +-
 spectec/test-frontend/TEST.md      |   81 +-
 spectec/test-haskell/TEST.md       | 2031 ++--------------------------
 spectec/test-lean4/TEST.md         |  411 +++---
 17 files changed, 498 insertions(+), 2229 deletions(-)
 create mode 100644 spectec/src/il/flat.ml
 create mode 100644 spectec/src/il/flat.mli

diff --git a/spectec/spec/4-runtime.watsup b/spectec/spec/4-runtime.watsup
index 44dac4faa9..76c6b6ad8e 100644
--- a/spectec/spec/4-runtime.watsup
+++ b/spectec/spec/4-runtime.watsup
@@ -46,7 +46,8 @@ def $default_(I32) = (CONST I32 0)
 def $default_(I64) = (CONST I64 0)
 def $default_(F32) = (CONST F32 0)
 def $default_(F64) = (CONST F64 0)
-def $default_(rt) = (REF.NULL rt)
+def $default_(FUNCREF) = (REF.NULL FUNCREF)
+def $default_(EXTERNREF) = (REF.NULL EXTERNREF)
 
 
 ;; Configurations
diff --git a/spectec/src/backend-haskell/gen.ml b/spectec/src/backend-haskell/gen.ml
index 4e8f6aa346..aaf5ede896 100644
--- a/spectec/src/backend-haskell/gen.ml
+++ b/spectec/src/backend-haskell/gen.ml
@@ -1,6 +1,6 @@
 open Il.Ast
 
-let include_input = true
+let include_input = false
 
 let parens s = "(" ^ s ^ ")"
 let ($$) s1 s2 = parens (s1 ^ " " ^ s2)
@@ -27,6 +27,10 @@ let render_con_name id : atom -> string = function
     else render_type_name id ^ "_" ^ make_id s
   | a -> "{- render_con_name: TODO -} " ^ Il.Print.string_of_atom a
 
+let render_con_name' (typ : typ) a = match typ.it with
+  | VarT id -> render_con_name id a
+  | _ -> "_ {- render_con_name': Typ not id -}"
+
 let render_field_name : atom -> string = function
   | Atom s -> String.uncapitalize_ascii (make_id s)
   | a -> "{- render_field_name: TODO -} " ^ Il.Print.string_of_atom a
@@ -74,19 +78,17 @@ let rec render_exp (exp : exp) = match exp.it with
   | MixE (_, e) -> render_exp e
   | TupE es -> render_tuple render_exp es
   | IterE (e, _) -> render_exp e
-  | CaseE (a, e, typ, styps) -> render_case a e typ styps
+  | CaseE (a, e, typ) -> render_case a e typ
   | SubE (e, typ1, typ2) -> render_variant_inj' typ2 typ1 $$ render_exp e
   | DotE (_typ, e, a) -> render_exp e ^ "." ^ render_field_name a
   | IdxE (e1, e2) -> parens (render_exp e1 ^ " !! " ^ ("fromIntegral" $$ render_exp e2))
   | BinE (AddOp, e1, e2) -> parens (render_exp e1 ^ " + " ^ render_exp e2)
   | _ -> "undefined {- " ^ Il.Print.string_of_exp exp ^ " -}"
 
-and render_case a e typ = function
-  | [] ->
+and render_case a e typ =
     if e.it = TupE []
-    then render_con_name typ a
-    else render_con_name typ a $$ render_exp e
-  | (styp::styps) -> render_variant_inj typ styp $$ render_case a e styp styps
+    then render_con_name' typ a
+    else render_con_name' typ a $$ render_exp e
 
 let render_clause (id : id) (clause : clause) = match clause.it with
   | DefD (_binds, lhs, rhs, premise) ->
diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 85aaa585b8..972383967a 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -43,6 +43,11 @@ let render_con_name qual id : atom -> string = function
     make_id s
   | a -> "/- render_con_name: TODO -/ " ^ Il.Print.string_of_atom a
 
+let render_con_name' qual (typ : typ) a = match typ.it with
+  | VarT id -> render_con_name qual id a
+  | _ -> "_ {- render_con_name': Typ not id -}"
+
+
 let render_field_name : atom -> string = function
   | Atom s -> make_id s
   | a -> "/- render_field_name: TODO -/ " ^ Il.Print.string_of_atom a
@@ -108,7 +113,7 @@ let rec render_exp (exp : exp) = match exp.it with
     | VarE v -> render_id v (* Short-ciruit this common form *)
     | _ -> render_exp e ^ " /- " ^ Il.Print.string_of_iter iter ^ " -/"
   end
-  | CaseE (a, e, typ, styps) -> render_case a e typ styps
+  | CaseE (a, e, typ) -> render_case a e typ
   | StrE fields -> braces ( String.concat ", " (List.map (fun (a, e) ->
     render_field_name a ^ " := " ^ render_exp e
     ) fields))
@@ -134,12 +139,10 @@ let rec render_exp (exp : exp) = match exp.it with
   | CompE (e1, e2)         -> parens (render_exp e1 ^ " ++ "  ^ render_exp e2)
   | _ -> "default /- " ^ Il.Print.string_of_exp exp ^ " -/"
 
-and render_case a e typ = function
-  | [] ->
+and render_case a e typ =
     if e.it = TupE []
-    then render_con_name true typ a
-    else render_con_name true typ a $$ render_exp e
-  | (styp::styps) -> render_variant_inj true typ styp $$ render_case a e styp styps
+    then render_con_name' true typ a
+    else render_con_name' true typ a $$ render_exp e
 
 let render_clause (_id : id) (clause : clause) = match clause.it with
   | DefD (_binds, lhs, rhs, premise) ->
diff --git a/spectec/src/exe-haskell/main.ml b/spectec/src/exe-haskell/main.ml
index 6f77250c9d..283bd0a1c1 100644
--- a/spectec/src/exe-haskell/main.ml
+++ b/spectec/src/exe-haskell/main.ml
@@ -52,6 +52,8 @@ let () =
     let il = Frontend.Elab.elab el in
     log "IL Validation...";
     Il.Validation.valid il;
+    log "Variant flattening";
+    let il = Il.Flat.transform il in
     log "Haskell Generation...";
     if !odst = "" && !dsts = [] then
       print_endline (Backend_haskell.Gen.gen_string il);
diff --git a/spectec/src/exe-lean4/main.ml b/spectec/src/exe-lean4/main.ml
index e6d466a785..6876d7f84b 100644
--- a/spectec/src/exe-lean4/main.ml
+++ b/spectec/src/exe-lean4/main.ml
@@ -52,6 +52,8 @@ let () =
     let il = Frontend.Elab.elab el in
     log "IL Validation...";
     Il.Validation.valid il;
+    log "Variant flattening";
+    let il = Il.Flat.transform il in
     log "Lean4 Generation...";
     if !odst = "" && !dsts = [] then
       print_endline (Backend_lean4.Gen.gen_string il);
diff --git a/spectec/src/frontend/elab.ml b/spectec/src/frontend/elab.ml
index 12cdd2be4b..f27834b33e 100644
--- a/spectec/src/frontend/elab.ml
+++ b/spectec/src/frontend/elab.ml
@@ -128,8 +128,8 @@ let find_field fields atom at =
   | None -> error_atom at atom "unbound field"
 
 let find_case cases atom at =
-  match List.find_opt (fun ((atom', _, _), _) -> atom' = atom) cases with
-  | Some ((_, nottyp, _), styps) -> nottyp, styps
+  match List.find_opt (fun (atom', _, _) -> atom' = atom) cases with
+  | Some (_, x, _) -> x
   | None -> error_atom at atom "unknown case"
 
 
@@ -202,30 +202,24 @@ let as_struct_typ phrase env dir typ at : typfield list =
   | VarT id -> as_struct_typid' phrase env id at
   | _ -> error_dir_typ at phrase dir typ "{...}"
 
-let rec as_variant_typid' phrase env id at : (typcase * Il.id list) list * dots =
+let rec as_variant_typid' phrase env id at : typcase list * dots =
   match as_defined_typid' env id at with
   | VariantT (_dots1, ids, cases, dots2) ->
-    let casess = map_nl_list (fun sid ->
-      let scases, _ = as_variant_typid "" env sid in
-      List.map (fun ((a, t, hint), ts) -> (a, t, hint), (sid :: ts)) scases
-    ) ids in
-    List.concat (
-      List.map (fun immediate_case -> (immediate_case, [])) (filter_nl cases) ::
-      casess), dots2
+    let casess = map_nl_list (as_variant_typid "" env) ids in
+    List.concat (filter_nl cases :: List.map fst casess), dots2
   | _ -> error_dir_typ id.at phrase Infer (VarT id $ id.at) "| ..."
 
-and as_variant_typid phrase env id : (typcase * Il.id list) list * dots =
+and as_variant_typid phrase env id : typcase list * dots =
   as_variant_typid' phrase env id id.at
 
-let as_variant_typ phrase env dir typ at : (typcase * Il.id list) list * dots =
+let as_variant_typ phrase env dir typ at : typcase list * dots =
   match expand_singular' env typ.it with
   | VarT id -> as_variant_typid' phrase env id at
   | _ -> error_dir_typ at phrase dir typ "| ..."
 
 let case_has_args env typ atom at : bool =
   let cases, _ = as_variant_typ "" env Check typ at in
-  let nottyp, _styps = find_case cases atom at
-  in nottyp <> []
+  find_case cases atom at <> []
 
 
 let is_x_typ as_x_typ env typ =
@@ -247,7 +241,7 @@ let is_variant_nottyp env nottyp =
   | TypT typ -> is_variant_typ env typ
   | _ -> false
 
-let as_variant_nottyp env nottyp at : (typcase * Il.id list) list * typ =
+let as_variant_nottyp env nottyp at : typcase list * typ =
   match nottyp.it with
   | TypT typ -> fst (as_variant_typ "" env Check typ at), typ
   | _ -> error_dir_typ at "expression" Check (VarT ("?" $ at) $ at) "| ..."
@@ -366,15 +360,6 @@ let rec elab_iter env iter : Il.iter =
 
 (* Types *)
 
-and elab_typ_id env typ : Il.id =
-  match typ.it with
-  | VarT id ->
-    (match find "syntax type" env.typs id with
-    | Either.Left Bad -> error_id id "invalid forward reference to syntax type"
-    | _ -> id
-    )
-  | _ -> error typ.at "expected explicit typ id"
-
 and elab_typ env typ : Il.typ =
   match typ.it with
   | VarT id ->
@@ -407,10 +392,10 @@ and elab_deftyp env id deftyp : Il.deftyp =
     Il.StructT (map_nl_list (elab_typfield env) fields)
   | VariantT (dots1, ids, cases, _dots2) ->
     let cases0 =
-      if dots1 = Dots then List.map fst (fst (as_variant_typid "own type" env id)) else [] in
+      if dots1 = Dots then fst (as_variant_typid "own type" env id) else [] in
     let casess = map_nl_list (as_variant_typid "parent type" env) ids in
-    let cases' = List.flatten (
-      cases0 :: filter_nl cases :: List.map (List.map fst) (List.map fst casess)) in
+    let cases' =
+      List.flatten (cases0 :: filter_nl cases :: List.map fst casess) in
     check_atoms "variant" "case" (fun (atom, _, _) -> atom) cases' deftyp.at;
     Il.VariantT (filter_nl ids, map_nl_list (elab_typcase env deftyp.at) cases)
   ) $ deftyp.at
@@ -858,13 +843,13 @@ and elab_exp_variant env exps cases typ at : Il.exp =
   *)
   match exps with
   | {it = AtomE atom; _} :: exps ->
-    let nottyps, styps = find_case cases atom at in
+    let nottyps = find_case cases atom at in
     (* TODO: this is a bit hacky *)
     let exp2 = SeqE exps $ at in
     let exps' = elab_exp_notation' env exp2 (SeqT nottyps $ typ.at) in
     let typ2 = expand_singular' env typ.it $ at in
     cast_exp "variant case" env
-      (Il.CaseE (elab_atom atom, tup_exp' exps' at, elab_typ_id env typ2, styps) $ at)
+      (Il.CaseE (elab_atom atom, tup_exp' exps' at, elab_typ env typ2) $ at)
       typ2 typ
   | _ ->
     error_typ at "expression" typ
@@ -922,8 +907,8 @@ and cast_exp_variant phrase env exp' typ1 typ2 : Il.exp =
     if dots1 = Dots then
       error exp'.at "used variant type is only partially defined at this point";
     (try
-      List.iter (fun ((atom, nottyps1, _), _) ->
-        let nottyps2, _styps = find_case cases2 atom typ1.at in
+      List.iter (fun (atom, nottyps1, _) ->
+        let nottyps2 = find_case cases2 atom typ1.at in
         (* Shallow subtyping on variants *)
         if List.length nottyps1 <> List.length nottyps2
         || not (List.for_all2 Eq.eq_nottyp nottyps1 nottyps2) then
diff --git a/spectec/src/il/ast.ml b/spectec/src/il/ast.ml
index 830a749750..1753a60bc3 100644
--- a/spectec/src/il/ast.ml
+++ b/spectec/src/il/ast.ml
@@ -113,7 +113,7 @@ and exp' =
   | OptE of exp option           (* exp? : typ? *)
   | ListE of exp list            (* [exp ... exp] *)
   | CatE of exp * exp            (* exp :: exp *)
-  | CaseE of atom * exp * id * id list  (* atom exp : typ  (via typs) *)
+  | CaseE of atom * exp * typ    (* atom exp : typ *)
   | SubE of exp * typ * typ      (* exp : typ1 <: typ2 *)
 
 and expfield = atom * exp        (* atom exp *)
diff --git a/spectec/src/il/dune b/spectec/src/il/dune
index 38b4366dee..0ee500d741 100644
--- a/spectec/src/il/dune
+++ b/spectec/src/il/dune
@@ -1,5 +1,5 @@
 (library
   (name il)
   (libraries util)
-  (modules ast eq free print validation)
+  (modules ast eq free print validation flat)
 )
diff --git a/spectec/src/il/eq.ml b/spectec/src/il/eq.ml
index 7b565027e7..a71ffbcf44 100644
--- a/spectec/src/il/eq.ml
+++ b/spectec/src/il/eq.ml
@@ -24,8 +24,6 @@ let rec eq_iter iter1 iter2 =
 
 (* Types *)
 
-and eq_id id1 id2 = id1.it = id2.it
-
 and eq_typ typ1 typ2 =
   (*
   Printf.printf "[eq] (%s) == (%s)  eq=%b\n%!"
@@ -34,7 +32,7 @@ and eq_typ typ1 typ2 =
   *)
   typ1.it = typ2.it ||
   match typ1.it, typ2.it with
-  | VarT id1, VarT id2 -> eq_id id1 id2
+  | VarT id1, VarT id2 -> id1.it = id2.it
   | TupT typs1, TupT typs2 ->
     eq_list eq_typ typs1 typs2
   | IterT (typ11, iter1), IterT (typ21, iter2) ->
@@ -81,8 +79,8 @@ and eq_exp exp1 exp2 =
     eq_exp exp11 exp21 && eq_iter iter1 iter2
   | OptE expo1, OptE expo2 ->
     eq_opt eq_exp expo1 expo2
-  | CaseE (atom1, exp1, id1, styps1), CaseE (atom2, exp2, id2, styps2) ->
-    atom1 = atom2 && eq_exp exp1 exp2 && eq_id id1 id2 && eq_list eq_id styps1 styps2
+  | CaseE (atom1, exp1, typ1), CaseE (atom2, exp2, typ2) ->
+    atom1 = atom2 && eq_exp exp1 exp2 && eq_typ typ1 typ2
   | SubE (exp1, typ11, typ12), SubE (exp2, typ21, typ22) ->
     eq_exp exp1 exp2 && eq_typ typ11 typ21 && eq_typ typ12 typ22
   | _, _ ->
diff --git a/spectec/src/il/flat.ml b/spectec/src/il/flat.ml
new file mode 100644
index 0000000000..44636dac4b
--- /dev/null
+++ b/spectec/src/il/flat.ml
@@ -0,0 +1,73 @@
+(*
+This transformation
+ * replaces variant extension with copies of the constructors
+ * generates functions for all occurring subtype coercions
+ * uses these functions
+ * duplicates cases in functions as needed
+*)
+
+open Util
+open Source
+open Ast
+
+(* Errors *)
+
+let error at msg = Source.error at "type" msg
+
+(* Environment *)
+
+module Env = Map.Make(String)
+
+type env =
+  { mutable variants : typcase list Env.t;
+    mutable needed_pairs : (id * id) list;
+    mutable available_pairs : (id * id) list;
+  }
+
+let new_env () : env =
+  { variants = Env.empty;
+    needed_pairs = [];
+    available_pairs = [];
+  }
+
+let lookup_cons (env : env) (id : id) =
+  match Env.find_opt id.it env.variants with
+  | None -> error id.at ("undeclared variant `" ^ id.it ^ "`")
+  | Some t -> t
+
+let register_cons (env : env) (id :id) (cases : typcase list) =
+  if Env.mem id.it env.variants then
+    error id.at ("duplicate declaration for variant `" ^ id.it ^ "`")
+  else
+    env.variants <- Env.add id.it cases env.variants
+
+let rec transform_def env (def : def) : def = match def.it with
+  | RecD defs ->
+    { def with it = RecD (List.map (transform_def env) defs) }
+  | SynD (id, deftyp, hints) ->
+    begin match deftyp.it with
+    | VariantT (ids, cases) ->
+      let cases' = List.concat_map (lookup_cons env) ids @ cases in
+      register_cons env id cases';
+      { def with it = SynD (id, { deftyp with it = VariantT ([], cases') }, hints) }
+    | _ -> def
+    end
+  (* Giving up on this translation
+  | DecD  (id, ty1, ty2, clauses, hints) -> 
+    let clauses' = List.concat_map (fun clause ->
+      match clause.it with
+      | DefD ([(id1, ty1, [])],
+              {it = SubE ({it = VarE id2} as ide, ty2, ty3)} as lhs,
+              rhs, []) when id1.it = id2.it and Eq.eq_typ t1 t2 ->
+        (* This clause has to be duplicated *)
+        (* Lets assume nullary constructors only *)
+        List.map (fun con ->
+          { clause with it = DefD ([], { lhs with it = CaseE (con, 
+   *)
+  | _ ->  
+  def (* TODO: look inside *)
+
+let transform (defs : script) =
+  let env = new_env () in
+  List.map (transform_def env) defs
+
diff --git a/spectec/src/il/flat.mli b/spectec/src/il/flat.mli
new file mode 100644
index 0000000000..c1cea3cf98
--- /dev/null
+++ b/spectec/src/il/flat.mli
@@ -0,0 +1 @@
+val transform : Ast.script -> Ast.script
diff --git a/spectec/src/il/free.ml b/spectec/src/il/free.ml
index e50d529bb1..b0d5dc54fc 100644
--- a/spectec/src/il/free.ml
+++ b/spectec/src/il/free.ml
@@ -92,8 +92,7 @@ and free_exp exp =
   | StrE expfields -> free_list free_expfield expfields
   | CallE (id, exp1) -> union (free_defid id) (free_exp exp1)
   | IterE (exp1, iter) -> union (free_exp exp1) (free_iter iter)
-  | DotE (typ, exp1, _) -> union (free_exp exp1) (free_typ typ)
-  | CaseE (_, exp1, id2, styps) -> union (free_exp exp1) (free_list free_synid (id2::styps))
+  | DotE (typ, exp1, _) | CaseE (_, exp1, typ) -> union (free_exp exp1) (free_typ typ)
 
 and free_expfield (_, exp) = free_exp exp
 
diff --git a/spectec/src/il/print.ml b/spectec/src/il/print.ml
index 67432fbfd0..6871cdd6a1 100644
--- a/spectec/src/il/print.ml
+++ b/spectec/src/il/print.ml
@@ -79,11 +79,9 @@ let rec string_of_iter iter =
   | List1 -> "+"
   | ListN exp -> "^" ^ string_of_exp exp
 
-and string_of_id id = id.it
-
 and string_of_typ typ =
   match typ.it with
-  | VarT id -> string_of_id id
+  | VarT id -> id.it
   | BoolT -> "bool"
   | NatT -> "nat"
   | TextT -> "text"
@@ -156,8 +154,8 @@ and string_of_exp exp =
   | OptE expo -> "?(" ^ string_of_exps "" (Option.to_list expo) ^ ")"
   | ListE exps -> "[" ^ string_of_exps " " exps ^ "]"
   | CatE (exp1, exp2) -> string_of_exp exp1 ^ " :: " ^ string_of_exp exp2
-  | CaseE (atom, exp1, id2, _styps) ->
-    string_of_atom atom ^ "_" ^ string_of_id id2 ^ string_of_exp_args exp1
+  | CaseE (atom, exp1, typ) ->
+    string_of_atom atom ^ "_" ^ string_of_typ typ ^ string_of_exp_args exp1
   | SubE (exp1, _typ1, typ2) ->
     "(" ^ string_of_exp exp1 ^ " <: " ^ string_of_typ typ2 ^ ")"
 
diff --git a/spectec/src/il/validation.ml b/spectec/src/il/validation.ml
index 9d3975b9b4..af1d548796 100644
--- a/spectec/src/il/validation.ml
+++ b/spectec/src/il/validation.ml
@@ -145,6 +145,12 @@ let rec as_variant_typid phrase env id at : typcase list =
     List.concat (cases :: List.map (fun id -> as_variant_typid "" env id at) ids)
   | _ -> as_error at phrase Infer (VarT id $ id.at) "| ..."
 
+let as_variant_typ phrase env dir typ at : typcase list =
+  match expand' env typ.it with
+  | VarT id -> as_variant_typid phrase env id at
+  | _ -> as_error at phrase dir typ "| ..."
+
+
 (* Type Equivalence *)
 
 let equiv_list equiv_x xs1 xs2 =
@@ -218,13 +224,11 @@ let rec valid_iter env iter =
 
 (* Types *)
 
-and valid_id env id =
-    if find "syntax type" env.typs id = fwd_deftyp_bad then
-      error id.at ("invalid forward reference to syntax type `" ^ id.it ^ "`")
-
 and valid_typ env typ =
   match typ.it with
-  | VarT id -> valid_id env id
+  | VarT id ->
+    if find "syntax type" env.typs id = fwd_deftyp_bad then
+      error typ.at ("invalid forward reference to syntax type `" ^ id.it ^ "`")
   | BoolT
   | NatT
   | TextT ->
@@ -402,13 +406,11 @@ and valid_exp env exp typ =
     let _typ1 = as_iter_typ List "list" env Check typ exp.at in
     valid_exp env exp1 typ;
     valid_exp env exp2 typ
-  | CaseE (atom, exp1, id2, styps) ->
-    valid_id env id2;
-    List.iter (valid_id env) styps;
-    let cases = as_variant_typid "case" env id2 exp.at in
+  | CaseE (atom, exp1, typ2) ->
+    valid_typ env typ2;
+    let cases = as_variant_typ "case" env Check typ2 exp.at in
     let typ1 = find_case cases atom exp1.at in
     valid_exp env exp1 typ1;
-    let typ2 = {it = VarT id2; at= id2.at} in
     equiv_typ env typ2 typ exp.at
   | SubE (exp1, typ1, typ2) ->
     valid_typ env typ1;
diff --git a/spectec/test-frontend/TEST.md b/spectec/test-frontend/TEST.md
index 530eec6303..e1fc39add1 100644
--- a/spectec/test-frontend/TEST.md
+++ b/spectec/test-frontend/TEST.md
@@ -984,8 +984,10 @@ syntax externval =
 
 ;; 4-runtime.watsup:44.1-44.44
 def default_ : valtype -> val
-  ;; 4-runtime.watsup:49.1-49.34
-  def {rt : reftype} default_(rt <: valtype) = REF.NULL_val(rt)
+  ;; 4-runtime.watsup:50.1-50.48
+  def default_(EXTERNREF_valtype) = REF.NULL_val(EXTERNREF_reftype)
+  ;; 4-runtime.watsup:49.1-49.44
+  def default_(FUNCREF_valtype) = REF.NULL_val(FUNCREF_reftype)
   ;; 4-runtime.watsup:48.1-48.35
   def default_(F64_valtype) = CONST_val(F64_numtype, 0)
   ;; 4-runtime.watsup:47.1-47.35
@@ -995,43 +997,43 @@ def default_ : valtype -> val
   ;; 4-runtime.watsup:45.1-45.35
   def default_(I32_valtype) = CONST_val(I32_numtype, 0)
 
-;; 4-runtime.watsup:60.1-60.71
+;; 4-runtime.watsup:61.1-61.71
 syntax exportinst = EXPORT(name, externval)
 
-;; 4-runtime.watsup:70.1-77.25
+;; 4-runtime.watsup:71.1-78.25
 syntax moduleinst = {FUNC funcaddr*, GLOBAL globaladdr*, TABLE tableaddr*, MEM memaddr*, ELEM elemaddr*, DATA dataaddr*, EXPORT exportinst*}
 
-;; 4-runtime.watsup:54.1-54.66
+;; 4-runtime.watsup:55.1-55.66
 syntax funcinst = `%;%`(moduleinst, func)
 
-;; 4-runtime.watsup:55.1-55.53
+;; 4-runtime.watsup:56.1-56.53
 syntax globalinst = val
 
-;; 4-runtime.watsup:56.1-56.52
+;; 4-runtime.watsup:57.1-57.52
 syntax tableinst = ref*
 
-;; 4-runtime.watsup:57.1-57.52
+;; 4-runtime.watsup:58.1-58.52
 syntax meminst = byte*
 
-;; 4-runtime.watsup:58.1-58.53
+;; 4-runtime.watsup:59.1-59.53
 syntax eleminst = ref*
 
-;; 4-runtime.watsup:59.1-59.51
+;; 4-runtime.watsup:60.1-60.51
 syntax datainst = byte*
 
-;; 4-runtime.watsup:62.1-68.21
+;; 4-runtime.watsup:63.1-69.21
 syntax store = {FUNC funcinst*, GLOBAL globalinst*, TABLE tableinst*, MEM meminst*, ELEM eleminst*, DATA datainst*}
 
-;; 4-runtime.watsup:79.1-81.24
+;; 4-runtime.watsup:80.1-82.24
 syntax frame = {LOCAL val*, MODULE moduleinst}
 
-;; 4-runtime.watsup:82.1-82.47
+;; 4-runtime.watsup:83.1-83.47
 syntax state = `%;%`(store, frame)
 
-;; 4-runtime.watsup:130.1-137.5
+;; 4-runtime.watsup:131.1-138.5
 rec {
 
-;; 4-runtime.watsup:130.1-137.5
+;; 4-runtime.watsup:131.1-138.5
 syntax admininstr =
   | instr
   | REF.FUNC_ADDR(funcaddr)
@@ -1042,63 +1044,63 @@ syntax admininstr =
   | TRAP
 }
 
-;; 4-runtime.watsup:83.1-83.62
+;; 4-runtime.watsup:84.1-84.62
 syntax config = `%;%`(state, admininstr*)
 
-;; 4-runtime.watsup:98.1-98.59
+;; 4-runtime.watsup:99.1-99.59
 def funcaddr : state -> funcaddr*
-  ;; 4-runtime.watsup:99.1-99.38
+  ;; 4-runtime.watsup:100.1-100.38
   def {f : frame, s : store} funcaddr(`%;%`(s, f)) = f.MODULE_frame.FUNC_moduleinst
 
-;; 4-runtime.watsup:101.1-101.52
+;; 4-runtime.watsup:102.1-102.52
 def funcinst : state -> funcinst*
-  ;; 4-runtime.watsup:102.1-102.31
+  ;; 4-runtime.watsup:103.1-103.31
   def {f : frame, s : store} funcinst(`%;%`(s, f)) = s.FUNC_store
 
-;; 4-runtime.watsup:104.1-104.61
+;; 4-runtime.watsup:105.1-105.61
 def func : (state, funcidx) -> funcinst
-  ;; 4-runtime.watsup:105.1-105.48
+  ;; 4-runtime.watsup:106.1-106.48
   def {f : frame, s : store, x : idx} func(`%;%`(s, f), x) = s.FUNC_store[f.MODULE_frame.FUNC_moduleinst[x]]
 
-;; 4-runtime.watsup:107.1-107.59
+;; 4-runtime.watsup:108.1-108.59
 def local : (state, localidx) -> val
-  ;; 4-runtime.watsup:108.1-108.35
+  ;; 4-runtime.watsup:109.1-109.35
   def {f : frame, s : store, x : idx} local(`%;%`(s, f), x) = f.LOCAL_frame[x]
 
-;; 4-runtime.watsup:110.1-110.69
+;; 4-runtime.watsup:111.1-111.69
 def global : (state, globalidx) -> globalinst
-  ;; 4-runtime.watsup:111.1-111.54
+  ;; 4-runtime.watsup:112.1-112.54
   def {f : frame, s : store, x : idx} global(`%;%`(s, f), x) = s.GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]]
 
-;; 4-runtime.watsup:113.1-113.65
+;; 4-runtime.watsup:114.1-114.65
 def table : (state, tableidx) -> tableinst
-  ;; 4-runtime.watsup:114.1-114.51
+  ;; 4-runtime.watsup:115.1-115.51
   def {f : frame, s : store, x : idx} table(`%;%`(s, f), x) = s.TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]]
 
-;; 4-runtime.watsup:116.1-116.62
+;; 4-runtime.watsup:117.1-117.62
 def elem : (state, tableidx) -> eleminst
-  ;; 4-runtime.watsup:117.1-117.48
+  ;; 4-runtime.watsup:118.1-118.48
   def {f : frame, s : store, x : idx} elem(`%;%`(s, f), x) = s.ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]]
 
-;; 4-runtime.watsup:119.1-119.76
+;; 4-runtime.watsup:120.1-120.76
 def with_local : (state, localidx, val) -> state
-  ;; 4-runtime.watsup:120.1-120.50
+  ;; 4-runtime.watsup:121.1-121.50
   def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL[x] = v])
 
-;; 4-runtime.watsup:122.1-122.79
+;; 4-runtime.watsup:123.1-123.79
 def with_global : (state, globalidx, val) -> state
-  ;; 4-runtime.watsup:123.1-123.69
+  ;; 4-runtime.watsup:124.1-124.69
   def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
 
-;; 4-runtime.watsup:125.1-125.84
+;; 4-runtime.watsup:126.1-126.84
 def with_table : (state, tableidx, n, ref) -> state
-  ;; 4-runtime.watsup:126.1-126.72
+  ;; 4-runtime.watsup:127.1-127.72
   def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
 
-;; 4-runtime.watsup:139.1-142.21
+;; 4-runtime.watsup:140.1-143.21
 rec {
 
-;; 4-runtime.watsup:139.1-142.21
+;; 4-runtime.watsup:140.1-143.21
 syntax E =
   | _HOLE
   | _SEQ(val*, E, instr*)
@@ -2831,7 +2833,8 @@ $$
 {\mathrm{default}}_{\mathsf{i{\scriptstyle64}}} &=& (\mathsf{i{\scriptstyle64}}.\mathsf{const}~0) &  \\
 {\mathrm{default}}_{\mathsf{f{\scriptstyle32}}} &=& (\mathsf{f{\scriptstyle32}}.\mathsf{const}~0) &  \\
 {\mathrm{default}}_{\mathsf{f{\scriptstyle64}}} &=& (\mathsf{f{\scriptstyle64}}.\mathsf{const}~0) &  \\
-{\mathrm{default}}_{\mathit{rt}} &=& (\mathsf{ref.null}~\mathit{rt}) &  \\
+{\mathrm{default}}_{\mathsf{funcref}} &=& (\mathsf{ref.null}~\mathsf{funcref}) &  \\
+{\mathrm{default}}_{\mathsf{externref}} &=& (\mathsf{ref.null}~\mathsf{externref}) &  \\
 \end{array}
 $$
 
diff --git a/spectec/test-haskell/TEST.md b/spectec/test-haskell/TEST.md
index abd002c042..8f80603c84 100644
--- a/spectec/test-haskell/TEST.md
+++ b/spectec/test-haskell/TEST.md
@@ -8,245 +8,94 @@ $ cat Test.hs
 module Test where
 import Prelude (Bool, String, undefined, Maybe, fromIntegral, (+), (!!))
 import Numeric.Natural (Natural)
-{-
-;; ../spec/1-syntax.watsup:3.1-3.15
-syntax n = nat
--}
 type N = Natural
 
-{-
-;; ../spec/1-syntax.watsup:9.1-9.37
-syntax name = text
--}
 type Name = String
 
-{-
-;; ../spec/1-syntax.watsup:14.1-14.36
-syntax byte = nat
--}
 type Byte = Natural
 
-{-
-;; ../spec/1-syntax.watsup:15.1-15.45
-syntax u32 = nat
--}
 type U32 = Natural
 
-{-
-;; ../spec/1-syntax.watsup:22.1-22.36
-syntax idx = nat
--}
 type Idx = Natural
 
-{-
-;; ../spec/1-syntax.watsup:23.1-23.49
-syntax funcidx = idx
--}
 type Funcidx = Idx
 
-{-
-;; ../spec/1-syntax.watsup:24.1-24.49
-syntax globalidx = idx
--}
 type Globalidx = Idx
 
-{-
-;; ../spec/1-syntax.watsup:25.1-25.47
-syntax tableidx = idx
--}
 type Tableidx = Idx
 
-{-
-;; ../spec/1-syntax.watsup:26.1-26.46
-syntax memidx = idx
--}
 type Memidx = Idx
 
-{-
-;; ../spec/1-syntax.watsup:27.1-27.45
-syntax elemidx = idx
--}
 type Elemidx = Idx
 
-{-
-;; ../spec/1-syntax.watsup:28.1-28.45
-syntax dataidx = idx
--}
 type Dataidx = Idx
 
-{-
-;; ../spec/1-syntax.watsup:29.1-29.47
-syntax labelidx = idx
--}
 type Labelidx = Idx
 
-{-
-;; ../spec/1-syntax.watsup:30.1-30.47
-syntax localidx = idx
--}
 type Localidx = Idx
 
-{-
-;; ../spec/1-syntax.watsup:39.1-40.22
-syntax numtype =
-  | I32
-  | I64
-  | F32
-  | F64
--}
 data Numtype
  = Numtype_I32
  | Numtype_I64
  | Numtype_F32
  | Numtype_F64
 
-{-
-;; ../spec/1-syntax.watsup:41.1-42.5
-syntax vectype =
-  | V128
--}
 data Vectype
  = Vectype_V128
 
-{-
-;; ../spec/1-syntax.watsup:43.1-44.20
-syntax reftype =
-  | FUNCREF
-  | EXTERNREF
--}
 data Reftype
  = Reftype_FUNCREF
  | Reftype_EXTERNREF
 
-{-
-;; ../spec/1-syntax.watsup:45.1-46.34
-syntax valtype =
-  | numtype
-  | vectype
-  | reftype
-  | BOT
--}
 data Valtype
- = Valtype_of_Numtype Numtype
- | Valtype_of_Vectype Vectype
- | Valtype_of_Reftype Reftype
+ = Valtype_I32
+ | Valtype_I64
+ | Valtype_F32
+ | Valtype_F64
+ | Valtype_V128
+ | Valtype_FUNCREF
+ | Valtype_EXTERNREF
  | Valtype_BOT
 
-{-
-;; ../spec/1-syntax.watsup:48.1-48.39
-syntax in =
-  | I32
-  | I64
--}
 data In
  = In_I32
  | In_I64
 
-{-
-;; ../spec/1-syntax.watsup:49.1-49.39
-syntax fn =
-  | F32
-  | F64
--}
 data Fn
  = Fn_F32
  | Fn_F64
 
-{-
-;; ../spec/1-syntax.watsup:56.1-57.11
-syntax resulttype = valtype*
--}
 type Resulttype = [Valtype]
 
-{-
-;; ../spec/1-syntax.watsup:59.1-60.16
-syntax limits = `[%..%]`(u32, u32)
--}
 type Limits = {- mixop: `[%..%]` -} (U32, U32)
 
-{-
-;; ../spec/1-syntax.watsup:61.1-62.15
-syntax globaltype = `MUT%?%`(()?, valtype)
--}
 type Globaltype = {- mixop: `MUT%?%` -} ((Maybe ()), Valtype)
 
-{-
-;; ../spec/1-syntax.watsup:63.1-64.27
-syntax functype = `%->%`(resulttype, resulttype)
--}
 type Functype = {- mixop: `%->%` -} (Resulttype, Resulttype)
 
-{-
-;; ../spec/1-syntax.watsup:65.1-66.17
-syntax tabletype = `%%`(limits, reftype)
--}
 type Tabletype = {- mixop: `%%` -} (Limits, Reftype)
 
-{-
-;; ../spec/1-syntax.watsup:67.1-68.12
-syntax memtype = `%I8`(limits)
--}
 type Memtype = {- mixop: `%I8` -} Limits
 
-{-
-;; ../spec/1-syntax.watsup:69.1-70.10
-syntax elemtype = reftype
--}
 type Elemtype = Reftype
 
-{-
-;; ../spec/1-syntax.watsup:71.1-72.5
-syntax datatype = OK
--}
 type Datatype = {- mixop: OK -} ()
 
-{-
-;; ../spec/1-syntax.watsup:73.1-74.69
-syntax externtype =
-  | GLOBAL(globaltype)
-  | FUNC(functype)
-  | TABLE(tabletype)
-  | MEMORY(memtype)
--}
 data Externtype
  = Externtype_GLOBAL Globaltype
  | Externtype_FUNC Functype
  | Externtype_TABLE Tabletype
  | Externtype_MEMORY Memtype
 
-{-
-;; ../spec/1-syntax.watsup:86.1-86.44
-syntax sx =
-  | U
-  | S
--}
 data Sx
  = Sx_U
  | Sx_S
 
-{-
-;; ../spec/1-syntax.watsup:88.1-88.39
-syntax unop_IXX =
-  | CLZ
-  | CTZ
-  | POPCNT
--}
 data Unop_IXX
  = Unop_IXX_CLZ
  | Unop_IXX_CTZ
  | Unop_IXX_POPCNT
 
-{-
-;; ../spec/1-syntax.watsup:89.1-89.70
-syntax unop_FXX =
-  | ABS
-  | NEG
-  | SQRT
-  | CEIL
-  | FLOOR
-  | TRUNC
-  | NEAREST
--}
 data Unop_FXX
  = Unop_FXX_ABS
  | Unop_FXX_NEG
@@ -256,22 +105,6 @@ data Unop_FXX
  | Unop_FXX_TRUNC
  | Unop_FXX_NEAREST
 
-{-
-;; ../spec/1-syntax.watsup:91.1-93.62
-syntax binop_IXX =
-  | ADD
-  | SUB
-  | MUL
-  | DIV(sx)
-  | REM(sx)
-  | AND
-  | OR
-  | XOR
-  | SHL
-  | SHR(sx)
-  | ROTL
-  | ROTR
--}
 data Binop_IXX
  = Binop_IXX_ADD
  | Binop_IXX_SUB
@@ -286,17 +119,6 @@ data Binop_IXX
  | Binop_IXX_ROTL
  | Binop_IXX_ROTR
 
-{-
-;; ../spec/1-syntax.watsup:94.1-94.66
-syntax binop_FXX =
-  | ADD
-  | SUB
-  | MUL
-  | DIV
-  | MIN
-  | MAX
-  | COPYSIGN
--}
 data Binop_FXX
  = Binop_FXX_ADD
  | Binop_FXX_SUB
@@ -306,31 +128,11 @@ data Binop_FXX
  | Binop_FXX_MAX
  | Binop_FXX_COPYSIGN
 
-{-
-;; ../spec/1-syntax.watsup:96.1-96.26
-syntax testop_IXX =
-  | EQZ
--}
 data Testop_IXX
  = Testop_IXX_EQZ
 
-{-
-;; ../spec/1-syntax.watsup:97.1-97.22
-syntax testop_FXX =
-  |
--}
 data Testop_FXX
 
-{-
-;; ../spec/1-syntax.watsup:99.1-100.108
-syntax relop_IXX =
-  | EQ
-  | NE
-  | LT(sx)
-  | GT(sx)
-  | LE(sx)
-  | GE(sx)
--}
 data Relop_IXX
  = Relop_IXX_EQ
  | Relop_IXX_NE
@@ -339,16 +141,6 @@ data Relop_IXX
  | Relop_IXX_LE Sx
  | Relop_IXX_GE Sx
 
-{-
-;; ../spec/1-syntax.watsup:101.1-101.49
-syntax relop_FXX =
-  | EQ
-  | NE
-  | LT
-  | GT
-  | LE
-  | GE
--}
 data Relop_FXX
  = Relop_FXX_EQ
  | Relop_FXX_NE
@@ -357,174 +149,32 @@ data Relop_FXX
  | Relop_FXX_LE
  | Relop_FXX_GE
 
-{-
-;; ../spec/1-syntax.watsup:103.1-103.50
-syntax unop_numtype =
-  | _I(unop_IXX)
-  | _F(unop_FXX)
--}
 data Unop_numtype
  = Unop_numtype_I Unop_IXX
  | Unop_numtype_F Unop_FXX
 
-{-
-;; ../spec/1-syntax.watsup:104.1-104.53
-syntax binop_numtype =
-  | _I(binop_IXX)
-  | _F(binop_FXX)
--}
 data Binop_numtype
  = Binop_numtype_I Binop_IXX
  | Binop_numtype_F Binop_FXX
 
-{-
-;; ../spec/1-syntax.watsup:105.1-105.56
-syntax testop_numtype =
-  | _I(testop_IXX)
-  | _F(testop_FXX)
--}
 data Testop_numtype
  = Testop_numtype_I Testop_IXX
  | Testop_numtype_F Testop_FXX
 
-{-
-;; ../spec/1-syntax.watsup:106.1-106.53
-syntax relop_numtype =
-  | _I(relop_IXX)
-  | _F(relop_FXX)
--}
 data Relop_numtype
  = Relop_numtype_I Relop_IXX
  | Relop_numtype_F Relop_FXX
 
-{-
-;; ../spec/1-syntax.watsup:107.1-107.39
-syntax cvtop =
-  | CONVERT
-  | REINTERPRET
--}
 data Cvtop
  = Cvtop_CONVERT
  | Cvtop_REINTERPRET
 
-{-
-;; ../spec/1-syntax.watsup:117.1-117.23
-syntax c_numtype = nat
--}
 type C_numtype = Natural
 
-{-
-;; ../spec/1-syntax.watsup:118.1-118.23
-syntax c_vectype = nat
--}
 type C_vectype = Natural
 
-{-
-;; ../spec/1-syntax.watsup:121.1-121.52
-syntax blocktype = functype
--}
 type Blocktype = Functype
 
-{-
-;; ../spec/1-syntax.watsup:156.1-177.55
-rec {
-
-;; ../spec/1-syntax.watsup:156.1-177.55
-syntax instr =
-  | UNREACHABLE
-  | NOP
-  | DROP
-  | SELECT(valtype?)
-  | BLOCK(blocktype, instr*)
-  | LOOP(blocktype, instr*)
-  | IF(blocktype, instr*, instr*)
-  | BR(labelidx)
-  | BR_IF(labelidx)
-  | BR_TABLE(labelidx*, labelidx)
-  | CALL(funcidx)
-  | CALL_INDIRECT(tableidx, functype)
-  | RETURN
-  | CONST(numtype, c_numtype)
-  | UNOP(numtype, unop_numtype)
-  | BINOP(numtype, binop_numtype)
-  | TESTOP(numtype, testop_numtype)
-  | RELOP(numtype, relop_numtype)
-  | EXTEND(numtype, n)
-  | CVTOP(numtype, cvtop, numtype, sx?)
-  | REF.NULL(reftype)
-  | REF.FUNC(funcidx)
-  | REF.IS_NULL
-  | LOCAL.GET(localidx)
-  | LOCAL.SET(localidx)
-  | LOCAL.TEE(localidx)
-  | GLOBAL.GET(globalidx)
-  | GLOBAL.SET(globalidx)
-  | TABLE.GET(tableidx)
-  | TABLE.SET(tableidx)
-  | TABLE.SIZE(tableidx)
-  | TABLE.GROW(tableidx)
-  | TABLE.FILL(tableidx)
-  | TABLE.COPY(tableidx, tableidx)
-  | TABLE.INIT(tableidx, elemidx)
-  | ELEM.DROP(elemidx)
-  | MEMORY.SIZE
-  | MEMORY.GROW
-  | MEMORY.FILL
-  | MEMORY.COPY
-  | MEMORY.INIT(dataidx)
-  | DATA.DROP(dataidx)
-  | LOAD(numtype, (n, sx)?, nat, nat)
-  | STORE(numtype, n?, nat, nat)
-}
--}
-{-
-;; ../spec/1-syntax.watsup:156.1-177.55
-syntax instr =
-  | UNREACHABLE
-  | NOP
-  | DROP
-  | SELECT(valtype?)
-  | BLOCK(blocktype, instr*)
-  | LOOP(blocktype, instr*)
-  | IF(blocktype, instr*, instr*)
-  | BR(labelidx)
-  | BR_IF(labelidx)
-  | BR_TABLE(labelidx*, labelidx)
-  | CALL(funcidx)
-  | CALL_INDIRECT(tableidx, functype)
-  | RETURN
-  | CONST(numtype, c_numtype)
-  | UNOP(numtype, unop_numtype)
-  | BINOP(numtype, binop_numtype)
-  | TESTOP(numtype, testop_numtype)
-  | RELOP(numtype, relop_numtype)
-  | EXTEND(numtype, n)
-  | CVTOP(numtype, cvtop, numtype, sx?)
-  | REF.NULL(reftype)
-  | REF.FUNC(funcidx)
-  | REF.IS_NULL
-  | LOCAL.GET(localidx)
-  | LOCAL.SET(localidx)
-  | LOCAL.TEE(localidx)
-  | GLOBAL.GET(globalidx)
-  | GLOBAL.SET(globalidx)
-  | TABLE.GET(tableidx)
-  | TABLE.SET(tableidx)
-  | TABLE.SIZE(tableidx)
-  | TABLE.GROW(tableidx)
-  | TABLE.FILL(tableidx)
-  | TABLE.COPY(tableidx, tableidx)
-  | TABLE.INIT(tableidx, elemidx)
-  | ELEM.DROP(elemidx)
-  | MEMORY.SIZE
-  | MEMORY.GROW
-  | MEMORY.FILL
-  | MEMORY.COPY
-  | MEMORY.INIT(dataidx)
-  | DATA.DROP(dataidx)
-  | LOAD(numtype, (n, sx)?, nat, nat)
-  | STORE(numtype, n?, nat, nat)
--}
 data Instr
  = Instr_UNREACHABLE
  | Instr_NOP
@@ -571,156 +221,54 @@ data Instr
  | Instr_LOAD (Numtype, (Maybe (N, Sx)), Natural, Natural)
  | Instr_STORE (Numtype, (Maybe N), Natural, Natural)
 
-{-
-;; ../spec/1-syntax.watsup:179.1-180.9
-syntax expr = instr*
--}
 type Expr = [Instr]
 
-{-
-;; ../spec/1-syntax.watsup:185.1-185.50
-syntax elemmode =
-  | TABLE(tableidx, expr)
-  | DECLARE
--}
 data Elemmode
  = Elemmode_TABLE (Tableidx, Expr)
  | Elemmode_DECLARE
 
-{-
-;; ../spec/1-syntax.watsup:186.1-186.39
-syntax datamode =
-  | MEMORY(memidx, expr)
--}
 data Datamode
  = Datamode_MEMORY (Memidx, Expr)
 
-{-
-;; ../spec/1-syntax.watsup:188.1-189.30
-syntax func = FUNC(functype, valtype*, expr)
--}
 type Func = {- mixop: FUNC -} (Functype, [Valtype], Expr)
 
-{-
-;; ../spec/1-syntax.watsup:190.1-191.25
-syntax global = GLOBAL(globaltype, expr)
--}
 type Global = {- mixop: GLOBAL -} (Globaltype, Expr)
 
-{-
-;; ../spec/1-syntax.watsup:192.1-193.18
-syntax table = TABLE(tabletype)
--}
 type Table = {- mixop: TABLE -} Tabletype
 
-{-
-;; ../spec/1-syntax.watsup:194.1-195.17
-syntax mem = MEMORY(memtype)
--}
 type Mem = {- mixop: MEMORY -} Memtype
 
-{-
-;; ../spec/1-syntax.watsup:196.1-197.31
-syntax elem = ELEM(reftype, expr*, elemmode?)
--}
 type Elem = {- mixop: ELEM -} (Reftype, [Expr], (Maybe Elemmode))
 
-{-
-;; ../spec/1-syntax.watsup:198.1-199.26
-syntax data = DATA(byte**, datamode?)
--}
 type Data = {- mixop: DATA -} ([[Byte]], (Maybe Datamode))
 
-{-
-;; ../spec/1-syntax.watsup:200.1-201.16
-syntax start = START(funcidx)
--}
 type Start = {- mixop: START -} Funcidx
 
-{-
-;; ../spec/1-syntax.watsup:203.1-204.65
-syntax externuse =
-  | FUNC(funcidx)
-  | GLOBAL(globalidx)
-  | TABLE(tableidx)
-  | MEMORY(memidx)
--}
 data Externuse
  = Externuse_FUNC Funcidx
  | Externuse_GLOBAL Globalidx
  | Externuse_TABLE Tableidx
  | Externuse_MEMORY Memidx
 
-{-
-;; ../spec/1-syntax.watsup:205.1-206.24
-syntax export = EXPORT(name, externuse)
--}
 type Export = {- mixop: EXPORT -} (Name, Externuse)
 
-{-
-;; ../spec/1-syntax.watsup:207.1-208.30
-syntax import = IMPORT(name, name, externtype)
--}
 type Import = {- mixop: IMPORT -} (Name, Name, Externtype)
 
-{-
-;; ../spec/1-syntax.watsup:210.1-211.70
-syntax module = MODULE(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
--}
 type Module = {- mixop: MODULE -} ([Import], [Func], [Global], [Table], [Mem], [Elem], [Data], [Start], [Export])
 
-{-
-;; ../spec/2-aux.watsup:5.1-5.55
-def size : valtype -> nat
-  ;; ../spec/2-aux.watsup:10.1-10.22
-  def size(V128_valtype) = 128
-  ;; ../spec/2-aux.watsup:9.1-9.20
-  def size(F64_valtype) = 64
-  ;; ../spec/2-aux.watsup:8.1-8.20
-  def size(F32_valtype) = 32
-  ;; ../spec/2-aux.watsup:7.1-7.20
-  def size(I64_valtype) = 64
-  ;; ../spec/2-aux.watsup:6.1-6.20
-  def size(I32_valtype) = 32
--}
 size :: Valtype -> Natural
-size (Valtype_of_Vectype Vectype_V128) = 128
-size (Valtype_of_Numtype Numtype_F64) = 64
-size (Valtype_of_Numtype Numtype_F32) = 32
-size (Valtype_of_Numtype Numtype_I64) = 64
-size (Valtype_of_Numtype Numtype_I32) = 32
-
-{-
-;; ../spec/2-aux.watsup:15.1-15.40
-def test_sub_ATOM_22 : n -> nat
-  ;; ../spec/2-aux.watsup:16.1-16.38
-  def {n_3_ATOM_y : n} test_sub_ATOM_22(n_3_ATOM_y) = 0
--}
+size Valtype_V128 = 128
+size Valtype_F64 = 64
+size Valtype_F32 = 32
+size Valtype_I64 = 64
+size Valtype_I32 = 32
+
 test_sub_ATOM_22 :: N -> Natural
 test_sub_ATOM_22 n_3_ATOM_y = 0
 
-{-
-;; ../spec/2-aux.watsup:18.1-18.26
-def curried_ : (n, n) -> nat
-  ;; ../spec/2-aux.watsup:19.1-19.39
-  def {n_1 : n, n_2 : n} curried_(n_1, n_2) = (n_1 + n_2)
--}
 curried_ :: (N, N) -> Natural
 curried_ (n_1, n_2) = (n_1 + n_2)
 
-{-
-;; ../spec/2-aux.watsup:21.1-30.39
-syntax testfuse =
-  | AB_(nat, nat, nat)
-  | CD(nat, nat, nat)
-  | EF(nat, nat, nat)
-  | GH(nat, nat, nat)
-  | IJ(nat, nat, nat)
-  | KL(nat, nat, nat)
-  | MN(nat, nat, nat)
-  | OP(nat, nat, nat)
-  | QR(nat, nat, nat)
--}
 data Testfuse
  = Testfuse_AB_ (Natural, Natural, Natural)
  | Testfuse_CD (Natural, Natural, Natural)
@@ -732,10 +280,6 @@ data Testfuse
  | Testfuse_OP (Natural, Natural, Natural)
  | Testfuse_QR (Natural, Natural, Natural)
 
-{-
-;; ../spec/3-typing.watsup:3.1-6.60
-syntax context = {FUNC functype*, GLOBAL globaltype*, TABLE tabletype*, MEM memtype*, ELEM elemtype*, DATA datatype*, LOCAL valtype*, LABEL resulttype*, RETURN resulttype?}
--}
 data Context = MkContext
  { fUNC :: [Functype]
  , gLOBAL :: [Globaltype]
@@ -748,1089 +292,125 @@ data Context = MkContext
  , rETURN :: (Maybe Resulttype)
  }
 
-{-
-;; ../spec/3-typing.watsup:14.1-14.66
-relation Limits_ok: `|-%:%`(limits, nat)
-  ;; ../spec/3-typing.watsup:22.1-24.24
-  rule _ {k : nat, n_1 : n, n_2 : n}:
-    `|-%:%`(`[%..%]`(n_1, n_2), k)
-    -- if ((n_1 <= n_2) /\ (n_2 <= k))
--}
-
-
-{-
-;; ../spec/3-typing.watsup:15.1-15.64
-relation Functype_ok: `|-%:OK`(functype)
-  ;; ../spec/3-typing.watsup:26.1-27.13
-  rule _ {ft : functype}:
-    `|-%:OK`(ft)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:16.1-16.66
-relation Globaltype_ok: `|-%:OK`(globaltype)
-  ;; ../spec/3-typing.watsup:29.1-30.13
-  rule _ {gt : globaltype}:
-    `|-%:OK`(gt)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:17.1-17.65
-relation Tabletype_ok: `|-%:OK`(tabletype)
-  ;; ../spec/3-typing.watsup:32.1-34.35
-  rule _ {lim : limits, rt : reftype}:
-    `|-%:OK`(`%%`(lim, rt))
-    -- Limits_ok: `|-%:%`(lim, ((2 ^ 32) - 1))
--}
-
-
-{-
-;; ../spec/3-typing.watsup:18.1-18.63
-relation Memtype_ok: `|-%:OK`(memtype)
-  ;; ../spec/3-typing.watsup:36.1-38.33
-  rule _ {lim : limits}:
-    `|-%:OK`(`%I8`(lim))
-    -- Limits_ok: `|-%:%`(lim, (2 ^ 16))
--}
-
-
-{-
-;; ../spec/3-typing.watsup:19.1-19.66
-relation Externtype_ok: `|-%:OK`(externtype)
-  ;; ../spec/3-typing.watsup:53.1-55.33
-  rule mem {memtype : memtype}:
-    `|-%:OK`(MEMORY_externtype(memtype))
-    -- Memtype_ok: `|-%:OK`(memtype)
-
-  ;; ../spec/3-typing.watsup:49.1-51.37
-  rule table {tabletype : tabletype}:
-    `|-%:OK`(TABLE_externtype(tabletype))
-    -- Tabletype_ok: `|-%:OK`(tabletype)
-
-  ;; ../spec/3-typing.watsup:45.1-47.39
-  rule global {globaltype : globaltype}:
-    `|-%:OK`(GLOBAL_externtype(globaltype))
-    -- Globaltype_ok: `|-%:OK`(globaltype)
-
-  ;; ../spec/3-typing.watsup:41.1-43.35
-  rule func {functype : functype}:
-    `|-%:OK`(FUNC_externtype(functype))
-    -- Functype_ok: `|-%:OK`(functype)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:61.1-61.65
-relation Valtype_sub: `|-%<:%`(valtype, valtype)
-  ;; ../spec/3-typing.watsup:67.1-68.14
-  rule bot {t : valtype}:
-    `|-%<:%`(BOT_valtype, t)
-
-  ;; ../spec/3-typing.watsup:64.1-65.12
-  rule refl {t : valtype}:
-    `|-%<:%`(t, t)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:62.1-62.72
-relation Resulttype_sub: `|-%<:%`(valtype*, valtype*)
-  ;; ../spec/3-typing.watsup:70.1-72.35
-  rule _ {t_1* : valtype*, t_2* : valtype*}:
-    `|-%<:%`(t_1*, t_2*)
-    -- (Valtype_sub: `|-%<:%`(t_1, t_2))*
--}
-
-
-{-
-;; ../spec/3-typing.watsup:75.1-75.75
-relation Limits_sub: `|-%<:%`(limits, limits)
-  ;; ../spec/3-typing.watsup:83.1-86.21
-  rule _ {n_11 : n, n_12 : n, n_21 : n, n_22 : n}:
-    `|-%<:%`(`[%..%]`(n_11, n_12), `[%..%]`(n_21, n_22))
-    -- if (n_11 >= n_21)
-    -- if (n_12 <= n_22)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:76.1-76.73
-relation Functype_sub: `|-%<:%`(functype, functype)
-  ;; ../spec/3-typing.watsup:88.1-89.14
-  rule _ {ft : functype}:
-    `|-%<:%`(ft, ft)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:77.1-77.75
-relation Globaltype_sub: `|-%<:%`(globaltype, globaltype)
-  ;; ../spec/3-typing.watsup:91.1-92.14
-  rule _ {gt : globaltype}:
-    `|-%<:%`(gt, gt)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:78.1-78.74
-relation Tabletype_sub: `|-%<:%`(tabletype, tabletype)
-  ;; ../spec/3-typing.watsup:94.1-96.35
-  rule _ {lim_1 : limits, lim_2 : limits, rt : reftype}:
-    `|-%<:%`(`%%`(lim_1, rt), `%%`(lim_2, rt))
-    -- Limits_sub: `|-%<:%`(lim_1, lim_2)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:79.1-79.72
-relation Memtype_sub: `|-%<:%`(memtype, memtype)
-  ;; ../spec/3-typing.watsup:98.1-100.35
-  rule _ {lim_1 : limits, lim_2 : limits}:
-    `|-%<:%`(`%I8`(lim_1), `%I8`(lim_2))
-    -- Limits_sub: `|-%<:%`(lim_1, lim_2)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:80.1-80.75
-relation Externtype_sub: `|-%<:%`(externtype, externtype)
-  ;; ../spec/3-typing.watsup:115.1-117.34
-  rule mem {mt_1 : memtype, mt_2 : memtype}:
-    `|-%<:%`(MEMORY_externtype(mt_1), MEMORY_externtype(mt_2))
-    -- Memtype_sub: `|-%<:%`(mt_1, mt_2)
-
-  ;; ../spec/3-typing.watsup:111.1-113.36
-  rule table {tt_1 : tabletype, tt_2 : tabletype}:
-    `|-%<:%`(TABLE_externtype(tt_1), TABLE_externtype(tt_2))
-    -- Tabletype_sub: `|-%<:%`(tt_1, tt_2)
-
-  ;; ../spec/3-typing.watsup:107.1-109.37
-  rule global {gt_1 : globaltype, gt_2 : globaltype}:
-    `|-%<:%`(GLOBAL_externtype(gt_1), GLOBAL_externtype(gt_2))
-    -- Globaltype_sub: `|-%<:%`(gt_1, gt_2)
-
-  ;; ../spec/3-typing.watsup:103.1-105.35
-  rule func {ft_1 : functype, ft_2 : functype}:
-    `|-%<:%`(FUNC_externtype(ft_1), FUNC_externtype(ft_2))
-    -- Functype_sub: `|-%<:%`(ft_1, ft_2)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:172.1-172.76
-relation Blocktype_ok: `%|-%:%`(context, blocktype, functype)
-  ;; ../spec/3-typing.watsup:174.1-176.29
-  rule _ {C : context, ft : functype}:
-    `%|-%:%`(C, ft, ft)
-    -- Functype_ok: `|-%:OK`(ft)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:123.1-124.67
-rec {
-
-;; ../spec/3-typing.watsup:123.1-123.66
-relation Instr_ok: `%|-%:%`(context, instr, functype)
-  ;; ../spec/3-typing.watsup:357.1-362.32
-  rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, t : valtype}:
-    `%|-%:%`(C, STORE_instr(nt, n?, n_A, n_O), `%->%`([I32_valtype (nt <: valtype)], []))
-    -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= ($size(t) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(t) / 8))))?
-    -- if ((n? = ?()) \/ (nt = (in <: numtype)))
-
-  ;; ../spec/3-typing.watsup:350.1-355.32
-  rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?, t : valtype}:
-    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?, n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
-    -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= ($size(t) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(t) / 8))))?
-    -- if ((n? = ?()) \/ (nt = (in <: numtype)))
-
-  ;; ../spec/3-typing.watsup:346.1-348.23
-  rule data.drop {C : context, x : idx}:
-    `%|-%:%`(C, DATA.DROP_instr(x), `%->%`([], []))
-    -- if (C.DATA_context[x] = OK)
-
-  ;; ../spec/3-typing.watsup:341.1-344.23
-  rule memory.init {C : context, mt : memtype, x : idx}:
-    `%|-%:%`(C, MEMORY.INIT_instr(x), `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
-    -- if (C.MEM_context[0] = mt)
-    -- if (C.DATA_context[x] = OK)
-
-  ;; ../spec/3-typing.watsup:337.1-339.22
-  rule memory.copy {C : context, mt : memtype}:
-    `%|-%:%`(C, MEMORY.COPY_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
-    -- if (C.MEM_context[0] = mt)
-
-  ;; ../spec/3-typing.watsup:333.1-335.22
-  rule memory.fill {C : context, mt : memtype}:
-    `%|-%:%`(C, MEMORY.FILL_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
-    -- if (C.MEM_context[0] = mt)
-
-  ;; ../spec/3-typing.watsup:329.1-331.22
-  rule memory.grow {C : context, mt : memtype}:
-    `%|-%:%`(C, MEMORY.GROW_instr, `%->%`([I32_valtype], [I32_valtype]))
-    -- if (C.MEM_context[0] = mt)
-
-  ;; ../spec/3-typing.watsup:325.1-327.22
-  rule memory.size {C : context, mt : memtype}:
-    `%|-%:%`(C, MEMORY.SIZE_instr, `%->%`([], [I32_valtype]))
-    -- if (C.MEM_context[0] = mt)
-
-  ;; ../spec/3-typing.watsup:320.1-322.23
-  rule elem.drop {C : context, rt : reftype, x : idx}:
-    `%|-%:%`(C, ELEM.DROP_instr(x), `%->%`([], []))
-    -- if (C.ELEM_context[x] = rt)
-
-  ;; ../spec/3-typing.watsup:315.1-318.25
-  rule table.init {C : context, lim : limits, rt : reftype, x_1 : idx, x_2 : idx}:
-    `%|-%:%`(C, TABLE.INIT_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
-    -- if (C.TABLE_context[x_1] = `%%`(lim, rt))
-    -- if (C.ELEM_context[x_2] = rt)
-
-  ;; ../spec/3-typing.watsup:310.1-313.32
-  rule table.copy {C : context, lim_1 : limits, lim_2 : limits, rt : reftype, x_1 : idx, x_2 : idx}:
-    `%|-%:%`(C, TABLE.COPY_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
-    -- if (C.TABLE_context[x_1] = `%%`(lim_1, rt))
-    -- if (C.TABLE_context[x_2] = `%%`(lim_2, rt))
-
-  ;; ../spec/3-typing.watsup:306.1-308.28
-  rule table.fill {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype (rt <: valtype) I32_valtype], []))
-    -- if (C.TABLE_context[x] = `%%`(lim, rt))
-
-  ;; ../spec/3-typing.watsup:302.1-304.28
-  rule table.grow {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([(rt <: valtype) I32_valtype], [I32_valtype]))
-    -- if (C.TABLE_context[x] = `%%`(lim, rt))
-
-  ;; ../spec/3-typing.watsup:298.1-300.24
-  rule table.size {C : context, tt : tabletype, x : idx}:
-    `%|-%:%`(C, TABLE.SIZE_instr(x), `%->%`([], [I32_valtype]))
-    -- if (C.TABLE_context[x] = tt)
-
-  ;; ../spec/3-typing.watsup:294.1-296.28
-  rule table.set {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype (rt <: valtype)], []))
-    -- if (C.TABLE_context[x] = `%%`(lim, rt))
-
-  ;; ../spec/3-typing.watsup:290.1-292.28
-  rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [(rt <: valtype)]))
-    -- if (C.TABLE_context[x] = `%%`(lim, rt))
-
-  ;; ../spec/3-typing.watsup:285.1-287.28
-  rule global.set {C : context, t : valtype, x : idx}:
-    `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
-
-  ;; ../spec/3-typing.watsup:281.1-283.29
-  rule global.get {C : context, t : valtype, x : idx}:
-    `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(()?, t))
-
-  ;; ../spec/3-typing.watsup:276.1-278.23
-  rule local.tee {C : context, t : valtype, x : idx}:
-    `%|-%:%`(C, LOCAL.TEE_instr(x), `%->%`([t], [t]))
-    -- if (C.LOCAL_context[x] = t)
-
-  ;; ../spec/3-typing.watsup:272.1-274.23
-  rule local.set {C : context, t : valtype, x : idx}:
-    `%|-%:%`(C, LOCAL.SET_instr(x), `%->%`([t], []))
-    -- if (C.LOCAL_context[x] = t)
-
-  ;; ../spec/3-typing.watsup:268.1-270.23
-  rule local.get {C : context, t : valtype, x : idx}:
-    `%|-%:%`(C, LOCAL.GET_instr(x), `%->%`([], [t]))
-    -- if (C.LOCAL_context[x] = t)
-
-  ;; ../spec/3-typing.watsup:264.1-265.31
-  rule ref.is_null {C : context, rt : reftype}:
-    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([(rt <: valtype)], [I32_valtype]))
-
-  ;; ../spec/3-typing.watsup:260.1-262.23
-  rule ref.func {C : context, ft : functype, x : idx}:
-    `%|-%:%`(C, REF.FUNC_instr(x), `%->%`([], [FUNCREF_valtype]))
-    -- if (C.FUNC_context[x] = ft)
-
-  ;; ../spec/3-typing.watsup:257.1-258.35
-  rule ref.null {C : context, rt : reftype}:
-    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [(rt <: valtype)]))
-
-  ;; ../spec/3-typing.watsup:252.1-254.22
-  rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
-    `%|-%:%`(C, CVTOP_instr((fn_1 <: numtype), CONVERT_cvtop, (fn_2 <: numtype), ?()), `%->%`([(fn_2 <: valtype)], [(fn_1 <: valtype)]))
-    -- if (fn_1 =/= fn_2)
-
-  ;; ../spec/3-typing.watsup:247.1-250.52
-  rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?}:
-    `%|-%:%`(C, CVTOP_instr((in_1 <: numtype), CONVERT_cvtop, (in_2 <: numtype), sx?), `%->%`([(in_2 <: valtype)], [(in_1 <: valtype)]))
-    -- if (in_1 =/= in_2)
-    -- if ((sx? = ?()) <=> ($size(in_1 <: valtype) > $size(in_2 <: valtype)))
-
-  ;; ../spec/3-typing.watsup:242.1-245.34
-  rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype}:
-    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([(nt_2 <: valtype)], [(nt_1 <: valtype)]))
-    -- if (nt_1 =/= nt_2)
-    -- if ($size(nt_1 <: valtype) = $size(nt_2 <: valtype))
-
-  ;; ../spec/3-typing.watsup:238.1-240.23
-  rule extend {C : context, n : n, nt : numtype}:
-    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
-    -- if (n <= $size(nt <: valtype))
-
-  ;; ../spec/3-typing.watsup:234.1-235.37
-  rule relop {C : context, nt : numtype, relop : relop_numtype}:
-    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([(nt <: valtype) (nt <: valtype)], [I32_valtype]))
-
-  ;; ../spec/3-typing.watsup:231.1-232.36
-  rule testop {C : context, nt : numtype, testop : testop_numtype}:
-    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([(nt <: valtype)], [I32_valtype]))
-
-  ;; ../spec/3-typing.watsup:228.1-229.36
-  rule binop {C : context, binop : binop_numtype, nt : numtype}:
-    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([(nt <: valtype) (nt <: valtype)], [(nt <: valtype)]))
-
-  ;; ../spec/3-typing.watsup:225.1-226.31
-  rule unop {C : context, nt : numtype, unop : unop_numtype}:
-    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
-
-  ;; ../spec/3-typing.watsup:222.1-223.37
-  rule const {C : context, c_nt : c_numtype, nt : numtype}:
-    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [(nt <: valtype)]))
-
-  ;; ../spec/3-typing.watsup:216.1-219.26
-  rule call_indirect {C : context, ft : functype, lim : limits, t_1* : valtype*, t_2* : valtype*, x : idx}:
-    `%|-%:%`(C, CALL_INDIRECT_instr(x, ft), `%->%`(t_1* :: [I32_valtype], t_2*))
-    -- if (C.TABLE_context[x] = `%%`(lim, FUNCREF_reftype))
-    -- if (ft = `%->%`(t_1*, t_2*))
-
-  ;; ../spec/3-typing.watsup:212.1-214.33
-  rule call {C : context, t_1* : valtype*, t_2* : valtype*, x : idx}:
-    `%|-%:%`(C, CALL_instr(x), `%->%`(t_1*, t_2*))
-    -- if (C.FUNC_context[x] = `%->%`(t_1*, t_2*))
-
-  ;; ../spec/3-typing.watsup:208.1-210.24
-  rule return {C : context, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
-    `%|-%:%`(C, RETURN_instr, `%->%`(t_1* :: t*, t_2*))
-    -- if (C.RETURN_context = ?(t*))
-
-  ;; ../spec/3-typing.watsup:203.1-206.42
-  rule br_table {C : context, l* : labelidx*, l' : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
-    `%|-%:%`(C, BR_TABLE_instr(l*, l'), `%->%`(t_1* :: t*, t_2*))
-    -- (Resulttype_sub: `|-%<:%`(t*, C.LABEL_context[l]))*
-    -- Resulttype_sub: `|-%<:%`(t*, C.LABEL_context[l'])
-
-  ;; ../spec/3-typing.watsup:199.1-201.24
-  rule br_if {C : context, l : labelidx, t* : valtype*}:
-    `%|-%:%`(C, BR_IF_instr(l), `%->%`(t* :: [I32_valtype], t*))
-    -- if (C.LABEL_context[l] = t*)
-
-  ;; ../spec/3-typing.watsup:195.1-197.24
-  rule br {C : context, l : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
-    `%|-%:%`(C, BR_instr(l), `%->%`(t_1* :: t*, t_2*))
-    -- if (C.LABEL_context[l] = t*)
-
-  ;; ../spec/3-typing.watsup:188.1-192.59
-  rule if {C : context, bt : blocktype, instr_1* : instr*, instr_2* : instr*, t_1* : valtype*, t_2 : valtype}:
-    `%|-%:%`(C, IF_instr(bt, instr_1*, instr_2*), `%->%`(t_1*, [t_2]))
-    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*, [t_2]))
-    -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*, RETURN ?()}, instr_1*, `%->%`(t_1*, t_2*))
-    -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*, RETURN ?()}, instr_2*, `%->%`(t_1*, t_2*))
-
-  ;; ../spec/3-typing.watsup:183.1-186.56
-  rule loop {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2 : valtype}:
-    `%|-%:%`(C, LOOP_instr(bt, instr*), `%->%`(t_1*, t_2*))
-    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*, t_2*))
-    -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_1]*, RETURN ?()}, instr*, `%->%`(t_1*, [t_2]))
-
-  ;; ../spec/3-typing.watsup:178.1-181.57
-  rule block {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
-    `%|-%:%`(C, BLOCK_instr(bt, instr*), `%->%`(t_1*, t_2*))
-    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*, t_2*))
-    -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*, RETURN ?()}, instr*, `%->%`(t_1*, t_2*))
-
-  ;; ../spec/3-typing.watsup:166.1-169.37
-  rule select-impl {C : context, numtype : numtype, t : valtype, t' : valtype, vectype : vectype}:
-    `%|-%:%`(C, SELECT_instr(?()), `%->%`([t t I32_valtype], [t]))
-    -- Valtype_sub: `|-%<:%`(t, t')
-    -- if ((t' = (numtype <: valtype)) \/ (t' = (vectype <: valtype)))
-
-  ;; ../spec/3-typing.watsup:163.1-164.31
-  rule select-expl {C : context, t : valtype}:
-    `%|-%:%`(C, SELECT_instr(?(t)), `%->%`([t t I32_valtype], [t]))
-
-  ;; ../spec/3-typing.watsup:159.1-160.27
-  rule drop {C : context, t : valtype}:
-    `%|-%:%`(C, DROP_instr, `%->%`([t], []))
-
-  ;; ../spec/3-typing.watsup:156.1-157.32
-  rule nop {C : context}:
-    `%|-%:%`(C, NOP_instr, `%->%`([], []))
-
-  ;; ../spec/3-typing.watsup:153.1-154.34
-  rule unreachable {C : context, t_1* : valtype*, t_2* : valtype*}:
-    `%|-%:%`(C, UNREACHABLE_instr, `%->%`(t_1*, t_2*))
-
-;; ../spec/3-typing.watsup:124.1-124.67
-relation InstrSeq_ok: `%|-%:%`(context, instr*, functype)
-  ;; ../spec/3-typing.watsup:148.1-150.45
-  rule frame {C : context, instr* : instr*, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
-    `%|-%:%`(C, instr*, `%->%`(t* :: t_1*, t* :: t_2*))
-    -- InstrSeq_ok: `%|-%:%`(C, instr*, `%->%`(t_1*, t_2*))
-
-  ;; ../spec/3-typing.watsup:141.1-146.38
-  rule weak {C : context, instr* : instr*, t'_1 : valtype, t'_2* : valtype*, t_1* : valtype*, t_2* : valtype*}:
-    `%|-%:%`(C, instr*, `%->%`([t'_1], t'_2*))
-    -- InstrSeq_ok: `%|-%:%`(C, instr*, `%->%`(t_1*, t_2*))
-    -- Resulttype_sub: `|-%<:%`(t'_1*, t_1*)
-    -- Resulttype_sub: `|-%<:%`(t_2*, t'_2*)
-
-  ;; ../spec/3-typing.watsup:136.1-139.46
-  rule seq {C : context, instr_1 : instr, instr_2 : instr, t_1* : valtype*, t_2* : valtype*, t_3* : valtype*}:
-    `%|-%:%`(C, [instr_1] :: instr_2*, `%->%`(t_1*, t_3*))
-    -- Instr_ok: `%|-%:%`(C, instr_1, `%->%`(t_1*, t_2*))
-    -- InstrSeq_ok: `%|-%:%`(C, [instr_2], `%->%`(t_2*, t_3*))
-
-  ;; ../spec/3-typing.watsup:133.1-134.36
-  rule empty {C : context}:
-    `%|-%:%`(C, [], `%->%`([], []))
-}
--}
-{-
-;; ../spec/3-typing.watsup:123.1-123.66
-relation Instr_ok: `%|-%:%`(context, instr, functype)
-  ;; ../spec/3-typing.watsup:357.1-362.32
-  rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, t : valtype}:
-    `%|-%:%`(C, STORE_instr(nt, n?, n_A, n_O), `%->%`([I32_valtype (nt <: valtype)], []))
-    -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= ($size(t) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(t) / 8))))?
-    -- if ((n? = ?()) \/ (nt = (in <: numtype)))
-
-  ;; ../spec/3-typing.watsup:350.1-355.32
-  rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?, t : valtype}:
-    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?, n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
-    -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= ($size(t) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(t) / 8))))?
-    -- if ((n? = ?()) \/ (nt = (in <: numtype)))
-
-  ;; ../spec/3-typing.watsup:346.1-348.23
-  rule data.drop {C : context, x : idx}:
-    `%|-%:%`(C, DATA.DROP_instr(x), `%->%`([], []))
-    -- if (C.DATA_context[x] = OK)
-
-  ;; ../spec/3-typing.watsup:341.1-344.23
-  rule memory.init {C : context, mt : memtype, x : idx}:
-    `%|-%:%`(C, MEMORY.INIT_instr(x), `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
-    -- if (C.MEM_context[0] = mt)
-    -- if (C.DATA_context[x] = OK)
-
-  ;; ../spec/3-typing.watsup:337.1-339.22
-  rule memory.copy {C : context, mt : memtype}:
-    `%|-%:%`(C, MEMORY.COPY_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
-    -- if (C.MEM_context[0] = mt)
-
-  ;; ../spec/3-typing.watsup:333.1-335.22
-  rule memory.fill {C : context, mt : memtype}:
-    `%|-%:%`(C, MEMORY.FILL_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
-    -- if (C.MEM_context[0] = mt)
-
-  ;; ../spec/3-typing.watsup:329.1-331.22
-  rule memory.grow {C : context, mt : memtype}:
-    `%|-%:%`(C, MEMORY.GROW_instr, `%->%`([I32_valtype], [I32_valtype]))
-    -- if (C.MEM_context[0] = mt)
-
-  ;; ../spec/3-typing.watsup:325.1-327.22
-  rule memory.size {C : context, mt : memtype}:
-    `%|-%:%`(C, MEMORY.SIZE_instr, `%->%`([], [I32_valtype]))
-    -- if (C.MEM_context[0] = mt)
-
-  ;; ../spec/3-typing.watsup:320.1-322.23
-  rule elem.drop {C : context, rt : reftype, x : idx}:
-    `%|-%:%`(C, ELEM.DROP_instr(x), `%->%`([], []))
-    -- if (C.ELEM_context[x] = rt)
-
-  ;; ../spec/3-typing.watsup:315.1-318.25
-  rule table.init {C : context, lim : limits, rt : reftype, x_1 : idx, x_2 : idx}:
-    `%|-%:%`(C, TABLE.INIT_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
-    -- if (C.TABLE_context[x_1] = `%%`(lim, rt))
-    -- if (C.ELEM_context[x_2] = rt)
-
-  ;; ../spec/3-typing.watsup:310.1-313.32
-  rule table.copy {C : context, lim_1 : limits, lim_2 : limits, rt : reftype, x_1 : idx, x_2 : idx}:
-    `%|-%:%`(C, TABLE.COPY_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
-    -- if (C.TABLE_context[x_1] = `%%`(lim_1, rt))
-    -- if (C.TABLE_context[x_2] = `%%`(lim_2, rt))
-
-  ;; ../spec/3-typing.watsup:306.1-308.28
-  rule table.fill {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype (rt <: valtype) I32_valtype], []))
-    -- if (C.TABLE_context[x] = `%%`(lim, rt))
-
-  ;; ../spec/3-typing.watsup:302.1-304.28
-  rule table.grow {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([(rt <: valtype) I32_valtype], [I32_valtype]))
-    -- if (C.TABLE_context[x] = `%%`(lim, rt))
-
-  ;; ../spec/3-typing.watsup:298.1-300.24
-  rule table.size {C : context, tt : tabletype, x : idx}:
-    `%|-%:%`(C, TABLE.SIZE_instr(x), `%->%`([], [I32_valtype]))
-    -- if (C.TABLE_context[x] = tt)
-
-  ;; ../spec/3-typing.watsup:294.1-296.28
-  rule table.set {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype (rt <: valtype)], []))
-    -- if (C.TABLE_context[x] = `%%`(lim, rt))
-
-  ;; ../spec/3-typing.watsup:290.1-292.28
-  rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [(rt <: valtype)]))
-    -- if (C.TABLE_context[x] = `%%`(lim, rt))
-
-  ;; ../spec/3-typing.watsup:285.1-287.28
-  rule global.set {C : context, t : valtype, x : idx}:
-    `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
-
-  ;; ../spec/3-typing.watsup:281.1-283.29
-  rule global.get {C : context, t : valtype, x : idx}:
-    `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(()?, t))
-
-  ;; ../spec/3-typing.watsup:276.1-278.23
-  rule local.tee {C : context, t : valtype, x : idx}:
-    `%|-%:%`(C, LOCAL.TEE_instr(x), `%->%`([t], [t]))
-    -- if (C.LOCAL_context[x] = t)
-
-  ;; ../spec/3-typing.watsup:272.1-274.23
-  rule local.set {C : context, t : valtype, x : idx}:
-    `%|-%:%`(C, LOCAL.SET_instr(x), `%->%`([t], []))
-    -- if (C.LOCAL_context[x] = t)
-
-  ;; ../spec/3-typing.watsup:268.1-270.23
-  rule local.get {C : context, t : valtype, x : idx}:
-    `%|-%:%`(C, LOCAL.GET_instr(x), `%->%`([], [t]))
-    -- if (C.LOCAL_context[x] = t)
-
-  ;; ../spec/3-typing.watsup:264.1-265.31
-  rule ref.is_null {C : context, rt : reftype}:
-    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([(rt <: valtype)], [I32_valtype]))
-
-  ;; ../spec/3-typing.watsup:260.1-262.23
-  rule ref.func {C : context, ft : functype, x : idx}:
-    `%|-%:%`(C, REF.FUNC_instr(x), `%->%`([], [FUNCREF_valtype]))
-    -- if (C.FUNC_context[x] = ft)
-
-  ;; ../spec/3-typing.watsup:257.1-258.35
-  rule ref.null {C : context, rt : reftype}:
-    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [(rt <: valtype)]))
-
-  ;; ../spec/3-typing.watsup:252.1-254.22
-  rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
-    `%|-%:%`(C, CVTOP_instr((fn_1 <: numtype), CONVERT_cvtop, (fn_2 <: numtype), ?()), `%->%`([(fn_2 <: valtype)], [(fn_1 <: valtype)]))
-    -- if (fn_1 =/= fn_2)
-
-  ;; ../spec/3-typing.watsup:247.1-250.52
-  rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?}:
-    `%|-%:%`(C, CVTOP_instr((in_1 <: numtype), CONVERT_cvtop, (in_2 <: numtype), sx?), `%->%`([(in_2 <: valtype)], [(in_1 <: valtype)]))
-    -- if (in_1 =/= in_2)
-    -- if ((sx? = ?()) <=> ($size(in_1 <: valtype) > $size(in_2 <: valtype)))
-
-  ;; ../spec/3-typing.watsup:242.1-245.34
-  rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype}:
-    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([(nt_2 <: valtype)], [(nt_1 <: valtype)]))
-    -- if (nt_1 =/= nt_2)
-    -- if ($size(nt_1 <: valtype) = $size(nt_2 <: valtype))
-
-  ;; ../spec/3-typing.watsup:238.1-240.23
-  rule extend {C : context, n : n, nt : numtype}:
-    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
-    -- if (n <= $size(nt <: valtype))
-
-  ;; ../spec/3-typing.watsup:234.1-235.37
-  rule relop {C : context, nt : numtype, relop : relop_numtype}:
-    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([(nt <: valtype) (nt <: valtype)], [I32_valtype]))
-
-  ;; ../spec/3-typing.watsup:231.1-232.36
-  rule testop {C : context, nt : numtype, testop : testop_numtype}:
-    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([(nt <: valtype)], [I32_valtype]))
-
-  ;; ../spec/3-typing.watsup:228.1-229.36
-  rule binop {C : context, binop : binop_numtype, nt : numtype}:
-    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([(nt <: valtype) (nt <: valtype)], [(nt <: valtype)]))
-
-  ;; ../spec/3-typing.watsup:225.1-226.31
-  rule unop {C : context, nt : numtype, unop : unop_numtype}:
-    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
-
-  ;; ../spec/3-typing.watsup:222.1-223.37
-  rule const {C : context, c_nt : c_numtype, nt : numtype}:
-    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [(nt <: valtype)]))
-
-  ;; ../spec/3-typing.watsup:216.1-219.26
-  rule call_indirect {C : context, ft : functype, lim : limits, t_1* : valtype*, t_2* : valtype*, x : idx}:
-    `%|-%:%`(C, CALL_INDIRECT_instr(x, ft), `%->%`(t_1* :: [I32_valtype], t_2*))
-    -- if (C.TABLE_context[x] = `%%`(lim, FUNCREF_reftype))
-    -- if (ft = `%->%`(t_1*, t_2*))
-
-  ;; ../spec/3-typing.watsup:212.1-214.33
-  rule call {C : context, t_1* : valtype*, t_2* : valtype*, x : idx}:
-    `%|-%:%`(C, CALL_instr(x), `%->%`(t_1*, t_2*))
-    -- if (C.FUNC_context[x] = `%->%`(t_1*, t_2*))
-
-  ;; ../spec/3-typing.watsup:208.1-210.24
-  rule return {C : context, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
-    `%|-%:%`(C, RETURN_instr, `%->%`(t_1* :: t*, t_2*))
-    -- if (C.RETURN_context = ?(t*))
-
-  ;; ../spec/3-typing.watsup:203.1-206.42
-  rule br_table {C : context, l* : labelidx*, l' : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
-    `%|-%:%`(C, BR_TABLE_instr(l*, l'), `%->%`(t_1* :: t*, t_2*))
-    -- (Resulttype_sub: `|-%<:%`(t*, C.LABEL_context[l]))*
-    -- Resulttype_sub: `|-%<:%`(t*, C.LABEL_context[l'])
-
-  ;; ../spec/3-typing.watsup:199.1-201.24
-  rule br_if {C : context, l : labelidx, t* : valtype*}:
-    `%|-%:%`(C, BR_IF_instr(l), `%->%`(t* :: [I32_valtype], t*))
-    -- if (C.LABEL_context[l] = t*)
-
-  ;; ../spec/3-typing.watsup:195.1-197.24
-  rule br {C : context, l : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
-    `%|-%:%`(C, BR_instr(l), `%->%`(t_1* :: t*, t_2*))
-    -- if (C.LABEL_context[l] = t*)
-
-  ;; ../spec/3-typing.watsup:188.1-192.59
-  rule if {C : context, bt : blocktype, instr_1* : instr*, instr_2* : instr*, t_1* : valtype*, t_2 : valtype}:
-    `%|-%:%`(C, IF_instr(bt, instr_1*, instr_2*), `%->%`(t_1*, [t_2]))
-    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*, [t_2]))
-    -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*, RETURN ?()}, instr_1*, `%->%`(t_1*, t_2*))
-    -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*, RETURN ?()}, instr_2*, `%->%`(t_1*, t_2*))
-
-  ;; ../spec/3-typing.watsup:183.1-186.56
-  rule loop {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2 : valtype}:
-    `%|-%:%`(C, LOOP_instr(bt, instr*), `%->%`(t_1*, t_2*))
-    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*, t_2*))
-    -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_1]*, RETURN ?()}, instr*, `%->%`(t_1*, [t_2]))
-
-  ;; ../spec/3-typing.watsup:178.1-181.57
-  rule block {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
-    `%|-%:%`(C, BLOCK_instr(bt, instr*), `%->%`(t_1*, t_2*))
-    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*, t_2*))
-    -- InstrSeq_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*, RETURN ?()}, instr*, `%->%`(t_1*, t_2*))
-
-  ;; ../spec/3-typing.watsup:166.1-169.37
-  rule select-impl {C : context, numtype : numtype, t : valtype, t' : valtype, vectype : vectype}:
-    `%|-%:%`(C, SELECT_instr(?()), `%->%`([t t I32_valtype], [t]))
-    -- Valtype_sub: `|-%<:%`(t, t')
-    -- if ((t' = (numtype <: valtype)) \/ (t' = (vectype <: valtype)))
-
-  ;; ../spec/3-typing.watsup:163.1-164.31
-  rule select-expl {C : context, t : valtype}:
-    `%|-%:%`(C, SELECT_instr(?(t)), `%->%`([t t I32_valtype], [t]))
-
-  ;; ../spec/3-typing.watsup:159.1-160.27
-  rule drop {C : context, t : valtype}:
-    `%|-%:%`(C, DROP_instr, `%->%`([t], []))
-
-  ;; ../spec/3-typing.watsup:156.1-157.32
-  rule nop {C : context}:
-    `%|-%:%`(C, NOP_instr, `%->%`([], []))
-
-  ;; ../spec/3-typing.watsup:153.1-154.34
-  rule unreachable {C : context, t_1* : valtype*, t_2* : valtype*}:
-    `%|-%:%`(C, UNREACHABLE_instr, `%->%`(t_1*, t_2*))
--}
-
-{-
-;; ../spec/3-typing.watsup:124.1-124.67
-relation InstrSeq_ok: `%|-%:%`(context, instr*, functype)
-  ;; ../spec/3-typing.watsup:148.1-150.45
-  rule frame {C : context, instr* : instr*, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
-    `%|-%:%`(C, instr*, `%->%`(t* :: t_1*, t* :: t_2*))
-    -- InstrSeq_ok: `%|-%:%`(C, instr*, `%->%`(t_1*, t_2*))
-
-  ;; ../spec/3-typing.watsup:141.1-146.38
-  rule weak {C : context, instr* : instr*, t'_1 : valtype, t'_2* : valtype*, t_1* : valtype*, t_2* : valtype*}:
-    `%|-%:%`(C, instr*, `%->%`([t'_1], t'_2*))
-    -- InstrSeq_ok: `%|-%:%`(C, instr*, `%->%`(t_1*, t_2*))
-    -- Resulttype_sub: `|-%<:%`(t'_1*, t_1*)
-    -- Resulttype_sub: `|-%<:%`(t_2*, t'_2*)
-
-  ;; ../spec/3-typing.watsup:136.1-139.46
-  rule seq {C : context, instr_1 : instr, instr_2 : instr, t_1* : valtype*, t_2* : valtype*, t_3* : valtype*}:
-    `%|-%:%`(C, [instr_1] :: instr_2*, `%->%`(t_1*, t_3*))
-    -- Instr_ok: `%|-%:%`(C, instr_1, `%->%`(t_1*, t_2*))
-    -- InstrSeq_ok: `%|-%:%`(C, [instr_2], `%->%`(t_2*, t_3*))
-
-  ;; ../spec/3-typing.watsup:133.1-134.36
-  rule empty {C : context}:
-    `%|-%:%`(C, [], `%->%`([], []))
--}
-
-
-{-
-;; ../spec/3-typing.watsup:125.1-125.71
-relation Expr_ok: `%|-%:%`(context, expr, resulttype)
-  ;; ../spec/3-typing.watsup:128.1-130.46
-  rule _ {C : context, instr* : instr*, t* : valtype*}:
-    `%|-%:%`(C, instr*, t*)
-    -- InstrSeq_ok: `%|-%:%`(C, instr*, `%->%`([], t*))
--}
-
-
-{-
-;; ../spec/3-typing.watsup:367.1-367.78
-relation Instr_const: `%|-%CONST`(context, instr)
-  ;; ../spec/3-typing.watsup:380.1-382.32
-  rule global.get {C : context, t : valtype, x : idx}:
-    `%|-%CONST`(C, GLOBAL.GET_instr(x))
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(), t))
-
-  ;; ../spec/3-typing.watsup:377.1-378.26
-  rule ref.func {C : context, x : idx}:
-    `%|-%CONST`(C, REF.FUNC_instr(x))
-
-  ;; ../spec/3-typing.watsup:374.1-375.27
-  rule ref.null {C : context, rt : reftype}:
-    `%|-%CONST`(C, REF.NULL_instr(rt))
-
-  ;; ../spec/3-typing.watsup:371.1-372.26
-  rule const {C : context, c : c_numtype, nt : numtype}:
-    `%|-%CONST`(C, CONST_instr(nt, c))
--}
-
-
-{-
-;; ../spec/3-typing.watsup:368.1-368.77
-relation Expr_const: `%|-%CONST`(context, expr)
-  ;; ../spec/3-typing.watsup:385.1-386.38
-  rule _ {C : context, instr* : instr*}:
-    `%|-%CONST`(C, instr*)
-    -- (Instr_const: `%|-%CONST`(C, instr))*
--}
-
-
-{-
-;; ../spec/3-typing.watsup:369.1-369.78
-relation Expr_ok_const: `%|-%:%CONST`(context, expr, valtype)
-  ;; ../spec/3-typing.watsup:389.1-392.33
-  rule _ {C : context, expr : expr, t : valtype}:
-    `%|-%:%CONST`(C, expr, t)
-    -- Expr_ok: `%|-%:%`(C, expr, [t])
-    -- Expr_const: `%|-%CONST`(C, expr)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:397.1-397.73
-relation Func_ok: `%|-%:%`(context, func, functype)
-  ;; ../spec/3-typing.watsup:408.1-412.75
-  rule _ {C : context, expr : expr, ft : functype, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
-    `%|-%:%`(C, FUNC(ft, t*, expr), ft)
-    -- if (ft = `%->%`(t_1*, t_2*))
-    -- Functype_ok: `|-%:OK`(ft)
-    -- Expr_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL t_1* :: t*, LABEL [], RETURN ?()} ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2*], RETURN ?()} ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [], RETURN ?(t_2*)}, expr, t_2*)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:398.1-398.75
-relation Global_ok: `%|-%:%`(context, global, globaltype)
-  ;; ../spec/3-typing.watsup:414.1-418.40
-  rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
-    `%|-%:%`(C, GLOBAL(gt, expr), gt)
-    -- Globaltype_ok: `|-%:OK`(gt)
-    -- if (gt = `MUT%?%`(()?, t))
-    -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:399.1-399.74
-relation Table_ok: `%|-%:%`(context, table, tabletype)
-  ;; ../spec/3-typing.watsup:420.1-422.30
-  rule _ {C : context, tt : tabletype}:
-    `%|-%:%`(C, TABLE(tt), tt)
-    -- Tabletype_ok: `|-%:OK`(tt)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:400.1-400.72
-relation Mem_ok: `%|-%:%`(context, mem, memtype)
-  ;; ../spec/3-typing.watsup:424.1-426.28
-  rule _ {C : context, mt : memtype}:
-    `%|-%:%`(C, MEMORY(mt), mt)
-    -- Memtype_ok: `|-%:OK`(mt)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:403.1-403.77
-relation Elemmode_ok: `%|-%:%`(context, elemmode, reftype)
-  ;; ../spec/3-typing.watsup:443.1-444.20
-  rule declare {C : context, rt : reftype}:
-    `%|-%:%`(C, DECLARE_elemmode, rt)
-
-  ;; ../spec/3-typing.watsup:438.1-441.45
-  rule active {C : context, expr : expr, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE_elemmode(x, expr), rt)
-    -- if (C.TABLE_context[x] = `%%`(lim, rt))
-    -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*
--}
-
-
-{-
-;; ../spec/3-typing.watsup:401.1-401.73
-relation Elem_ok: `%|-%:%`(context, elem, reftype)
-  ;; ../spec/3-typing.watsup:428.1-431.40
-  rule _ {C : context, elemmode? : elemmode?, expr* : expr*, rt : reftype}:
-    `%|-%:%`(C, ELEM(rt, expr*, elemmode?), rt)
-    -- (Expr_ok: `%|-%:%`(C, expr, [(rt <: valtype)]))*
-    -- (Elemmode_ok: `%|-%:%`(C, elemmode, rt))?
--}
-
-
-{-
-;; ../spec/3-typing.watsup:404.1-404.77
-relation Datamode_ok: `%|-%:OK`(context, datamode)
-  ;; ../spec/3-typing.watsup:446.1-449.45
-  rule _ {C : context, expr : expr, mt : memtype}:
-    `%|-%:OK`(C, MEMORY_datamode(0, expr))
-    -- if (C.MEM_context[0] = mt)
-    -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*
--}
-
-
-{-
-;; ../spec/3-typing.watsup:402.1-402.73
-relation Data_ok: `%|-%:OK`(context, data)
-  ;; ../spec/3-typing.watsup:434.1-436.40
-  rule _ {C : context, b** : byte**, datamode? : datamode?}:
-    `%|-%:OK`(C, DATA(b**, datamode?))
-    -- (Datamode_ok: `%|-%:OK`(C, datamode))?
--}
-
-
-{-
-;; ../spec/3-typing.watsup:405.1-405.74
-relation Start_ok: `%|-%:OK`(context, start)
-  ;; ../spec/3-typing.watsup:451.1-453.39
-  rule _ {C : context, x : idx}:
-    `%|-%:OK`(C, START(x))
-    -- if (C.FUNC_context[x] = `%->%`([], []))
--}
-
-
-{-
-;; ../spec/3-typing.watsup:456.1-456.80
-relation Import_ok: `%|-%:%`(context, import, externtype)
-  ;; ../spec/3-typing.watsup:460.1-462.31
-  rule _ {C : context, name_1 : name, name_2 : name, xt : externtype}:
-    `%|-%:%`(C, IMPORT(name_1, name_2, xt), xt)
-    -- Externtype_ok: `|-%:OK`(xt)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:458.1-458.83
-relation Externuse_ok: `%|-%:%`(context, externuse, externtype)
-  ;; ../spec/3-typing.watsup:480.1-482.22
-  rule mem {C : context, mt : memtype, x : idx}:
-    `%|-%:%`(C, MEMORY_externuse(x), MEMORY_externtype(mt))
-    -- if (C.MEM_context[x] = mt)
-
-  ;; ../spec/3-typing.watsup:476.1-478.24
-  rule table {C : context, tt : tabletype, x : idx}:
-    `%|-%:%`(C, TABLE_externuse(x), TABLE_externtype(tt))
-    -- if (C.TABLE_context[x] = tt)
-
-  ;; ../spec/3-typing.watsup:472.1-474.25
-  rule global {C : context, gt : globaltype, x : idx}:
-    `%|-%:%`(C, GLOBAL_externuse(x), GLOBAL_externtype(gt))
-    -- if (C.GLOBAL_context[x] = gt)
-
-  ;; ../spec/3-typing.watsup:468.1-470.23
-  rule func {C : context, ft : functype, x : idx}:
-    `%|-%:%`(C, FUNC_externuse(x), FUNC_externtype(ft))
-    -- if (C.FUNC_context[x] = ft)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:457.1-457.80
-relation Export_ok: `%|-%:%`(context, export, externtype)
-  ;; ../spec/3-typing.watsup:464.1-466.39
-  rule _ {C : context, externuse : externuse, name : name, xt : externtype}:
-    `%|-%:%`(C, EXPORT(name, externuse), xt)
-    -- Externuse_ok: `%|-%:%`(C, externuse, xt)
--}
-
-
-{-
-;; ../spec/3-typing.watsup:485.1-485.62
-relation Module_ok: `|-%:OK`(module)
-  ;; ../spec/3-typing.watsup:487.1-499.22
-  rule _ {C : context, data^n : data^n, elem* : elem*, export* : export*, ft* : functype*, func* : func*, global* : global*, gt* : globaltype*, import* : import*, mem* : mem*, mt* : memtype*, n : n, rt* : reftype*, start* : start*, table* : table*, tt* : tabletype*}:
-    `|-%:OK`(MODULE(import*, func*, global*, table*, mem*, elem*, data^n, start*, export*))
-    -- (Func_ok: `%|-%:%`(C, func, ft))*
-    -- (Global_ok: `%|-%:%`(C, global, gt))*
-    -- (Table_ok: `%|-%:%`(C, table, tt))*
-    -- (Mem_ok: `%|-%:%`(C, mem, mt))*
-    -- (Elem_ok: `%|-%:%`(C, elem, rt))*
-    -- (Data_ok: `%|-%:OK`(C, data))^n
-    -- (Start_ok: `%|-%:OK`(C, start))*
-    -- if (C = {FUNC ft*, GLOBAL gt*, TABLE tt*, MEM mt*, ELEM rt*, DATA OK^n, LOCAL [], LABEL [], RETURN ?()})
-    -- if (|mem*| <= 1)
-    -- if (|start*| <= 1)
--}
-
-
-{-
-;; ../spec/4-runtime.watsup:3.1-3.39
-syntax addr = nat
--}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 type Addr = Natural
 
-{-
-;; ../spec/4-runtime.watsup:4.1-4.53
-syntax funcaddr = addr
--}
 type Funcaddr = Addr
 
-{-
-;; ../spec/4-runtime.watsup:5.1-5.53
-syntax globaladdr = addr
--}
 type Globaladdr = Addr
 
-{-
-;; ../spec/4-runtime.watsup:6.1-6.51
-syntax tableaddr = addr
--}
 type Tableaddr = Addr
 
-{-
-;; ../spec/4-runtime.watsup:7.1-7.50
-syntax memaddr = addr
--}
 type Memaddr = Addr
 
-{-
-;; ../spec/4-runtime.watsup:8.1-8.49
-syntax elemaddr = addr
--}
 type Elemaddr = Addr
 
-{-
-;; ../spec/4-runtime.watsup:9.1-9.49
-syntax dataaddr = addr
--}
 type Dataaddr = Addr
 
-{-
-;; ../spec/4-runtime.watsup:10.1-10.51
-syntax labeladdr = addr
--}
 type Labeladdr = Addr
 
-{-
-;; ../spec/4-runtime.watsup:11.1-11.49
-syntax hostaddr = addr
--}
 type Hostaddr = Addr
 
-{-
-;; ../spec/4-runtime.watsup:24.1-25.24
-syntax num =
-  | CONST(numtype, c_numtype)
--}
 data Num
  = Num_CONST (Numtype, C_numtype)
 
-{-
-;; ../spec/4-runtime.watsup:26.1-27.67
-syntax ref =
-  | REF.NULL(reftype)
-  | REF.FUNC_ADDR(funcaddr)
-  | REF.HOST_ADDR(hostaddr)
--}
 data Ref
  = Ref_REF_NULL Reftype
  | Ref_REF_FUNC_ADDR Funcaddr
  | Ref_REF_HOST_ADDR Hostaddr
 
-{-
-;; ../spec/4-runtime.watsup:28.1-29.10
-syntax val =
-  | num
-  | ref
--}
 data Val
- = Val_of_Num Num
- | Val_of_Ref Ref
-
-{-
-;; ../spec/4-runtime.watsup:31.1-32.18
-syntax result =
-  | _VALS(val*)
-  | TRAP
--}
+ = Val_CONST (Numtype, C_numtype)
+ | Val_REF_NULL Reftype
+ | Val_REF_FUNC_ADDR Funcaddr
+ | Val_REF_HOST_ADDR Hostaddr
+
 data Result
  = Result_VALS [Val]
  | Result_TRAP
 
-{-
-;; ../spec/4-runtime.watsup:38.1-39.66
-syntax externval =
-  | FUNC(funcaddr)
-  | GLOBAL(globaladdr)
-  | TABLE(tableaddr)
-  | MEM(memaddr)
--}
 data Externval
  = Externval_FUNC Funcaddr
  | Externval_GLOBAL Globaladdr
  | Externval_TABLE Tableaddr
  | Externval_MEM Memaddr
 
-{-
-;; ../spec/4-runtime.watsup:44.1-44.44
-def default_ : valtype -> val
-  ;; ../spec/4-runtime.watsup:49.1-49.34
-  def {rt : reftype} default_(rt <: valtype) = REF.NULL_val(rt)
-  ;; ../spec/4-runtime.watsup:48.1-48.35
-  def default_(F64_valtype) = CONST_val(F64_numtype, 0)
-  ;; ../spec/4-runtime.watsup:47.1-47.35
-  def default_(F32_valtype) = CONST_val(F32_numtype, 0)
-  ;; ../spec/4-runtime.watsup:46.1-46.35
-  def default_(I64_valtype) = CONST_val(I64_numtype, 0)
-  ;; ../spec/4-runtime.watsup:45.1-45.35
-  def default_(I32_valtype) = CONST_val(I32_numtype, 0)
--}
 default_ :: Valtype -> Val
-default_ (Valtype_of_Reftype rt) = (Val_of_Ref (Ref_REF_NULL rt))
-default_ (Valtype_of_Numtype Numtype_F64) = (Val_of_Num (Num_CONST (Numtype_F64, 0)))
-default_ (Valtype_of_Numtype Numtype_F32) = (Val_of_Num (Num_CONST (Numtype_F32, 0)))
-default_ (Valtype_of_Numtype Numtype_I64) = (Val_of_Num (Num_CONST (Numtype_I64, 0)))
-default_ (Valtype_of_Numtype Numtype_I32) = (Val_of_Num (Num_CONST (Numtype_I32, 0)))
-
-{-
-;; ../spec/4-runtime.watsup:60.1-60.71
-syntax exportinst = EXPORT(name, externval)
--}
+default_ Valtype_EXTERNREF = (Val_REF_NULL Reftype_EXTERNREF)
+default_ Valtype_FUNCREF = (Val_REF_NULL Reftype_FUNCREF)
+default_ Valtype_F64 = (Val_CONST (Numtype_F64, 0))
+default_ Valtype_F32 = (Val_CONST (Numtype_F32, 0))
+default_ Valtype_I64 = (Val_CONST (Numtype_I64, 0))
+default_ Valtype_I32 = (Val_CONST (Numtype_I32, 0))
+
 type Exportinst = {- mixop: EXPORT -} (Name, Externval)
 
-{-
-;; ../spec/4-runtime.watsup:70.1-77.25
-syntax moduleinst = {FUNC funcaddr*, GLOBAL globaladdr*, TABLE tableaddr*, MEM memaddr*, ELEM elemaddr*, DATA dataaddr*, EXPORT exportinst*}
--}
 data Moduleinst = MkModuleinst
  { fUNC :: [Funcaddr]
  , gLOBAL :: [Globaladdr]
@@ -1841,46 +421,18 @@ data Moduleinst = MkModuleinst
  , eXPORT :: [Exportinst]
  }
 
-{-
-;; ../spec/4-runtime.watsup:54.1-54.66
-syntax funcinst = `%;%`(moduleinst, func)
--}
 type Funcinst = {- mixop: `%;%` -} (Moduleinst, Func)
 
-{-
-;; ../spec/4-runtime.watsup:55.1-55.53
-syntax globalinst = val
--}
 type Globalinst = Val
 
-{-
-;; ../spec/4-runtime.watsup:56.1-56.52
-syntax tableinst = ref*
--}
 type Tableinst = [Ref]
 
-{-
-;; ../spec/4-runtime.watsup:57.1-57.52
-syntax meminst = byte*
--}
 type Meminst = [Byte]
 
-{-
-;; ../spec/4-runtime.watsup:58.1-58.53
-syntax eleminst = ref*
--}
 type Eleminst = [Ref]
 
-{-
-;; ../spec/4-runtime.watsup:59.1-59.51
-syntax datainst = byte*
--}
 type Datainst = [Byte]
 
-{-
-;; ../spec/4-runtime.watsup:62.1-68.21
-syntax store = {FUNC funcinst*, GLOBAL globalinst*, TABLE tableinst*, MEM meminst*, ELEM eleminst*, DATA datainst*}
--}
 data Store = MkStore
  { fUNC :: [Funcinst]
  , gLOBAL :: [Globalinst]
@@ -1890,49 +442,58 @@ data Store = MkStore
  , dATA :: [Datainst]
  }
 
-{-
-;; ../spec/4-runtime.watsup:79.1-81.24
-syntax frame = {LOCAL val*, MODULE moduleinst}
--}
 data Frame = MkFrame
  { lOCAL :: [Val]
  , mODULE :: Moduleinst
  }
 
-{-
-;; ../spec/4-runtime.watsup:82.1-82.47
-syntax state = `%;%`(store, frame)
--}
 type State = {- mixop: `%;%` -} (Store, Frame)
 
-{-
-;; ../spec/4-runtime.watsup:130.1-137.5
-rec {
-
-;; ../spec/4-runtime.watsup:130.1-137.5
-syntax admininstr =
-  | instr
-  | REF.FUNC_ADDR(funcaddr)
-  | REF.HOST_ADDR(hostaddr)
-  | CALL_ADDR(funcaddr)
-  | LABEL_(n, instr*, admininstr*)
-  | FRAME_(n, frame, admininstr*)
-  | TRAP
-}
--}
-{-
-;; ../spec/4-runtime.watsup:130.1-137.5
-syntax admininstr =
-  | instr
-  | REF.FUNC_ADDR(funcaddr)
-  | REF.HOST_ADDR(hostaddr)
-  | CALL_ADDR(funcaddr)
-  | LABEL_(n, instr*, admininstr*)
-  | FRAME_(n, frame, admininstr*)
-  | TRAP
--}
 data Admininstr
- = Admininstr_of_Instr Instr
+ = Admininstr_UNREACHABLE
+ | Admininstr_NOP
+ | Admininstr_DROP
+ | Admininstr_SELECT (Maybe Valtype)
+ | Admininstr_BLOCK (Blocktype, [Instr])
+ | Admininstr_LOOP (Blocktype, [Instr])
+ | Admininstr_IF (Blocktype, [Instr], [Instr])
+ | Admininstr_BR Labelidx
+ | Admininstr_BR_IF Labelidx
+ | Admininstr_BR_TABLE ([Labelidx], Labelidx)
+ | Admininstr_CALL Funcidx
+ | Admininstr_CALL_INDIRECT (Tableidx, Functype)
+ | Admininstr_RETURN
+ | Admininstr_CONST (Numtype, C_numtype)
+ | Admininstr_UNOP (Numtype, Unop_numtype)
+ | Admininstr_BINOP (Numtype, Binop_numtype)
+ | Admininstr_TESTOP (Numtype, Testop_numtype)
+ | Admininstr_RELOP (Numtype, Relop_numtype)
+ | Admininstr_EXTEND (Numtype, N)
+ | Admininstr_CVTOP (Numtype, Cvtop, Numtype, (Maybe Sx))
+ | Admininstr_REF_NULL Reftype
+ | Admininstr_REF_FUNC Funcidx
+ | Admininstr_REF_IS_NULL
+ | Admininstr_LOCAL_GET Localidx
+ | Admininstr_LOCAL_SET Localidx
+ | Admininstr_LOCAL_TEE Localidx
+ | Admininstr_GLOBAL_GET Globalidx
+ | Admininstr_GLOBAL_SET Globalidx
+ | Admininstr_TABLE_GET Tableidx
+ | Admininstr_TABLE_SET Tableidx
+ | Admininstr_TABLE_SIZE Tableidx
+ | Admininstr_TABLE_GROW Tableidx
+ | Admininstr_TABLE_FILL Tableidx
+ | Admininstr_TABLE_COPY (Tableidx, Tableidx)
+ | Admininstr_TABLE_INIT (Tableidx, Elemidx)
+ | Admininstr_ELEM_DROP Elemidx
+ | Admininstr_MEMORY_SIZE
+ | Admininstr_MEMORY_GROW
+ | Admininstr_MEMORY_FILL
+ | Admininstr_MEMORY_COPY
+ | Admininstr_MEMORY_INIT Dataidx
+ | Admininstr_DATA_DROP Dataidx
+ | Admininstr_LOAD (Numtype, (Maybe (N, Sx)), Natural, Natural)
+ | Admininstr_STORE (Numtype, (Maybe N), Natural, Natural)
  | Admininstr_REF_FUNC_ADDR Funcaddr
  | Admininstr_REF_HOST_ADDR Hostaddr
  | Admininstr_CALL_ADDR Funcaddr
@@ -1940,356 +501,48 @@ data Admininstr
  | Admininstr_FRAME_ (N, Frame, [Admininstr])
  | Admininstr_TRAP
 
-{-
-;; ../spec/4-runtime.watsup:83.1-83.62
-syntax config = `%;%`(state, admininstr*)
--}
 type Config = {- mixop: `%;%` -} (State, [Admininstr])
 
-{-
-;; ../spec/4-runtime.watsup:98.1-98.59
-def funcaddr : state -> funcaddr*
-  ;; ../spec/4-runtime.watsup:99.1-99.38
-  def {f : frame, s : store} funcaddr(`%;%`(s, f)) = f.MODULE_frame.FUNC_moduleinst
--}
 funcaddr :: State -> [Funcaddr]
 funcaddr (s, f) = f.mODULE.fUNC
 
-{-
-;; ../spec/4-runtime.watsup:101.1-101.52
-def funcinst : state -> funcinst*
-  ;; ../spec/4-runtime.watsup:102.1-102.31
-  def {f : frame, s : store} funcinst(`%;%`(s, f)) = s.FUNC_store
--}
 funcinst :: State -> [Funcinst]
 funcinst (s, f) = s.fUNC
 
-{-
-;; ../spec/4-runtime.watsup:104.1-104.61
-def func : (state, funcidx) -> funcinst
-  ;; ../spec/4-runtime.watsup:105.1-105.48
-  def {f : frame, s : store, x : idx} func(`%;%`(s, f), x) = s.FUNC_store[f.MODULE_frame.FUNC_moduleinst[x]]
--}
 func :: (State, Funcidx) -> Funcinst
 func ((s, f), x) = (s.fUNC !! (fromIntegral (f.mODULE.fUNC !! (fromIntegral x))))
 
-{-
-;; ../spec/4-runtime.watsup:107.1-107.59
-def local : (state, localidx) -> val
-  ;; ../spec/4-runtime.watsup:108.1-108.35
-  def {f : frame, s : store, x : idx} local(`%;%`(s, f), x) = f.LOCAL_frame[x]
--}
 local :: (State, Localidx) -> Val
 local ((s, f), x) = (f.lOCAL !! (fromIntegral x))
 
-{-
-;; ../spec/4-runtime.watsup:110.1-110.69
-def global : (state, globalidx) -> globalinst
-  ;; ../spec/4-runtime.watsup:111.1-111.54
-  def {f : frame, s : store, x : idx} global(`%;%`(s, f), x) = s.GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]]
--}
 global :: (State, Globalidx) -> Globalinst
 global ((s, f), x) = (s.gLOBAL !! (fromIntegral (f.mODULE.gLOBAL !! (fromIntegral x))))
 
-{-
-;; ../spec/4-runtime.watsup:113.1-113.65
-def table : (state, tableidx) -> tableinst
-  ;; ../spec/4-runtime.watsup:114.1-114.51
-  def {f : frame, s : store, x : idx} table(`%;%`(s, f), x) = s.TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]]
--}
 table :: (State, Tableidx) -> Tableinst
 table ((s, f), x) = (s.tABLE !! (fromIntegral (f.mODULE.tABLE !! (fromIntegral x))))
 
-{-
-;; ../spec/4-runtime.watsup:116.1-116.62
-def elem : (state, tableidx) -> eleminst
-  ;; ../spec/4-runtime.watsup:117.1-117.48
-  def {f : frame, s : store, x : idx} elem(`%;%`(s, f), x) = s.ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]]
--}
 elem :: (State, Tableidx) -> Eleminst
 elem ((s, f), x) = (s.eLEM !! (fromIntegral (f.mODULE.eLEM !! (fromIntegral x))))
 
-{-
-;; ../spec/4-runtime.watsup:119.1-119.76
-def with_local : (state, localidx, val) -> state
-  ;; ../spec/4-runtime.watsup:120.1-120.50
-  def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL[x] = v])
--}
 with_local :: (State, Localidx, Val) -> State
 with_local ((s, f), x, v) = (s, undefined {- f[LOCAL[x] = v] -})
 
-{-
-;; ../spec/4-runtime.watsup:122.1-122.79
-def with_global : (state, globalidx, val) -> state
-  ;; ../spec/4-runtime.watsup:123.1-123.69
-  def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
--}
 with_global :: (State, Globalidx, Val) -> State
 with_global ((s, f), x, v) = (undefined {- s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v] -}, f)
 
-{-
-;; ../spec/4-runtime.watsup:125.1-125.84
-def with_table : (state, tableidx, n, ref) -> state
-  ;; ../spec/4-runtime.watsup:126.1-126.72
-  def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
--}
 with_table :: (State, Tableidx, N, Ref) -> State
 with_table ((s, f), x, i, r) = (undefined {- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r] -}, f)
 
-{-
-;; ../spec/4-runtime.watsup:139.1-142.21
-rec {
-
-;; ../spec/4-runtime.watsup:139.1-142.21
-syntax E =
-  | _HOLE
-  | _SEQ(val*, E, instr*)
-  | LABEL_(n, instr*, E)
-}
--}
-{-
-;; ../spec/4-runtime.watsup:139.1-142.21
-syntax E =
-  | _HOLE
-  | _SEQ(val*, E, instr*)
-  | LABEL_(n, instr*, E)
--}
 data E
  = E_HOLE
  | E_SEQ ([Val], E, [Instr])
  | E_LABEL_ (N, [Instr], E)
 
-{-
-;; ../spec/5-reduction.watsup:4.1-4.63
-relation Step_pure: `%~>%`(admininstr*, admininstr*)
-  ;; ../spec/5-reduction.watsup:86.1-88.18
-  rule br_table-ge {i : nat, l* : labelidx*, l' : labelidx}:
-    `%~>%`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*, l')], [BR_admininstr(l')])
-    -- if (i >= |l*|)
-
-  ;; ../spec/5-reduction.watsup:82.1-84.17
-  rule br_table-lt {i : nat, l* : labelidx*, l' : labelidx}:
-    `%~>%`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*, l')], [BR_admininstr(l*[i])])
-    -- if (i < |l*|)
-
-  ;; ../spec/5-reduction.watsup:77.1-79.14
-  rule br_if-false {c : c_numtype, l : labelidx}:
-    `%~>%`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)], [])
-    -- if (c = 0)
-
-  ;; ../spec/5-reduction.watsup:73.1-75.16
-  rule br_if-true {c : c_numtype, l : labelidx}:
-    `%~>%`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)], [BR_admininstr(l)])
-    -- if (c =/= 0)
-
-  ;; ../spec/5-reduction.watsup:69.1-70.65
-  rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
-    `%~>%`([LABEL__admininstr(n, instr'*, (val <: admininstr)* :: [BR_admininstr(l + 1)] :: (instr <: admininstr)*)], (val <: admininstr)* :: [BR_admininstr(l)])
-
-  ;; ../spec/5-reduction.watsup:66.1-67.69
-  rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
-    `%~>%`([LABEL__admininstr(n, instr'*, (val' <: admininstr)* :: (val <: admininstr)^n :: [BR_admininstr(0)] :: (instr <: admininstr)*)], (val <: admininstr)^n :: (instr' <: admininstr)*)
-
-  ;; ../spec/5-reduction.watsup:61.1-63.14
-  rule if-false {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
-    `%~>%`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*, instr_2*)], [BLOCK_admininstr(bt, instr_2*)])
-    -- if (c = 0)
-
-  ;; ../spec/5-reduction.watsup:57.1-59.16
-  rule if-true {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
-    `%~>%`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*, instr_2*)], [BLOCK_admininstr(bt, instr_1*)])
-    -- if (c =/= 0)
-
-  ;; ../spec/5-reduction.watsup:53.1-55.28
-  rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
-    `%~>%`((val <: admininstr)^k :: [LOOP_admininstr(bt, instr*)], [LABEL__admininstr(n, [LOOP_instr(bt, instr*)], (val <: admininstr)^k :: (instr <: admininstr)*)])
-    -- if (bt = `%->%`(t_1^k, t_2^n))
-
-  ;; ../spec/5-reduction.watsup:49.1-51.28
-  rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
-    `%~>%`((val <: admininstr)^k :: [BLOCK_admininstr(bt, instr*)], [LABEL__admininstr(n, [], (val <: admininstr)^k :: (instr <: admininstr)*)])
-    -- if (bt = `%->%`(t_1^k, t_2^n))
-
-  ;; ../spec/5-reduction.watsup:46.1-47.47
-  rule local.tee {val : val, x : idx}:
-    `%~>%`([(val <: admininstr) LOCAL.TEE_admininstr(x)], [(val <: admininstr) (val <: admininstr) LOCAL.SET_admininstr(x)])
-
-  ;; ../spec/5-reduction.watsup:42.1-44.14
-  rule select-false {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
-    `%~>%`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?)], [(val_2 <: admininstr)])
-    -- if (c = 0)
-
-  ;; ../spec/5-reduction.watsup:38.1-40.16
-  rule select-true {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
-    `%~>%`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?)], [(val_1 <: admininstr)])
-    -- if (c =/= 0)
-
-  ;; ../spec/5-reduction.watsup:35.1-36.24
-  rule drop {val : val}:
-    `%~>%`([(val <: admininstr) DROP_admininstr], [])
-
-  ;; ../spec/5-reduction.watsup:32.1-33.19
-  rule nop:
-    `%~>%`([NOP_admininstr], [])
-
-  ;; ../spec/5-reduction.watsup:29.1-30.24
-  rule unreachable:
-    `%~>%`([UNREACHABLE_admininstr], [TRAP_admininstr])
-
-  ;; ../spec/5-reduction.watsup:25.1-27.15
-  rule ref.is_null-false {val : val}:
-    `%~>%`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
-    -- otherwise
-
-  ;; ../spec/5-reduction.watsup:21.1-23.26
-  rule ref.is_null-true {rt : reftype, val : val}:
-    `%~>%`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
-    -- if (val = REF.NULL_val(rt))
--}
-
-
-{-
-;; ../spec/5-reduction.watsup:5.1-5.63
-relation Step_read: `%~>%`(config, admininstr*)
-  ;; ../spec/5-reduction.watsup:165.1-167.61
-  rule call_addr {a : addr, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
-    `%~>%`(`%;%`(z, (val <: admininstr)^k :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, {LOCAL val^k :: $default_(t)*, MODULE m}, [LABEL__admininstr(n, [], (instr <: admininstr)*)])])
-    -- if ($funcinst(z)[a] = `%;%`(m, FUNC(`%->%`(t_1^k, t_2^n), t*, instr*)))
-
-  ;; ../spec/5-reduction.watsup:161.1-163.15
-  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
-    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [TRAP_admininstr])
-    -- otherwise
-
-  ;; ../spec/5-reduction.watsup:156.1-159.34
-  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
-    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [CALL_ADDR_admininstr(a)])
-    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
-    -- if ($funcinst(z)[a] = `%;%`(m, func))
-
-  ;; ../spec/5-reduction.watsup:153.1-154.47
-  rule call {x : idx, z : state}:
-    `%~>%`(`%;%`(z, [CALL_admininstr(x)]), [CALL_ADDR_admininstr($funcaddr(z)[x])])
-
-  ;; ../spec/5-reduction.watsup:147.1-151.15
-  rule table.init-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, (n + 1)) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) ($elem(z, y)[i] <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)])
-    -- otherwise
-
-  ;; ../spec/5-reduction.watsup:144.1-146.15
-  rule table.init-zero {i : nat, j : nat, x : idx, y : idx, z : state}:
-    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, 0) TABLE.INIT_admininstr(x, y)]), [])
-    -- otherwise
-
-  ;; ../spec/5-reduction.watsup:141.1-143.62
-  rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [TRAP_admininstr])
-    -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
-
-  ;; ../spec/5-reduction.watsup:134.1-139.14
-  rule table.copy-gt {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, (n + 1)) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, (j + n)) CONST_admininstr(I32_numtype, (i + n)) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)])
-    -- if (j > i)
-
-  ;; ../spec/5-reduction.watsup:128.1-133.15
-  rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, (n + 1)) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)])
-    -- if (j <= i)
-
-  ;; ../spec/5-reduction.watsup:125.1-127.15
-  rule table.copy-zero {i : nat, j : nat, x : idx, y : idx, z : state}:
-    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, 0) TABLE.COPY_admininstr(x, y)]), [])
-    -- otherwise
-
-  ;; ../spec/5-reduction.watsup:122.1-124.63
-  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [TRAP_admininstr])
-    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
-
-  ;; ../spec/5-reduction.watsup:117.1-120.15
-  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
-    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, (n + 1)) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) (val <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)])
-    -- otherwise
-
-  ;; ../spec/5-reduction.watsup:114.1-116.15
-  rule table.fill-zero {i : nat, val : val, x : idx, z : state}:
-    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, 0) TABLE.FILL_admininstr(x)]), [])
-    -- otherwise
-
-  ;; ../spec/5-reduction.watsup:111.1-113.34
-  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
-    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
-    -- if ((i + n) > |$table(z, x)|)
-
-  ;; ../spec/5-reduction.watsup:107.1-109.27
-  rule table.size {n : n, x : idx, z : state}:
-    `%~>%`(`%;%`(z, [TABLE.SIZE_admininstr(x)]), [CONST_admininstr(I32_numtype, n)])
-    -- if (|$table(z, x)| = n)
-
-  ;; ../spec/5-reduction.watsup:103.1-105.27
-  rule table.get-lt {i : nat, x : idx, z : state}:
-    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [($table(z, x)[i] <: admininstr)])
-    -- if (i < |$table(z, x)|)
-
-  ;; ../spec/5-reduction.watsup:99.1-101.28
-  rule table.get-ge {i : nat, x : idx, z : state}:
-    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
-    -- if (i >= |$table(z, x)|)
-
-  ;; ../spec/5-reduction.watsup:96.1-97.37
-  rule global.get {x : idx, z : state}:
-    `%~>%`(`%;%`(z, [GLOBAL.GET_admininstr(x)]), [($global(z, x) <: admininstr)])
-
-  ;; ../spec/5-reduction.watsup:93.1-94.35
-  rule local.get {x : idx, z : state}:
-    `%~>%`(`%;%`(z, [LOCAL.GET_admininstr(x)]), [($local(z, x) <: admininstr)])
-
-  ;; ../spec/5-reduction.watsup:90.1-91.53
-  rule ref.func {x : idx, z : state}:
-    `%~>%`(`%;%`(z, [REF.FUNC_admininstr(x)]), [REF.FUNC_ADDR_admininstr($funcaddr(z)[x])])
--}
-
-
-{-
-;; ../spec/5-reduction.watsup:6.1-6.63
-relation Step_write: `%~>%`(config, config)
-  ;; ../spec/5-reduction.watsup:179.1-181.28
-  rule table.set-ge {i : nat, ref : ref, x : idx, z : state}:
-    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), `%;%`(z, [TRAP_admininstr]))
-    -- if (i >= |$table(z, x)|)
-
-  ;; ../spec/5-reduction.watsup:175.1-177.27
-  rule table.set-lt {i : nat, ref : ref, x : idx, z : state}:
-    `%~>%`(`%;%`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), `%;%`($with_table(z, x, i, ref), []))
-    -- if (i < |$table(z, x)|)
-
-  ;; ../spec/5-reduction.watsup:172.1-173.62
-  rule global.set {val : val, x : idx, z : state}:
-    `%~>%`(`%;%`(z, [(val <: admininstr) GLOBAL.SET_admininstr(x)]), `%;%`($with_global(z, x, val), []))
-
-  ;; ../spec/5-reduction.watsup:169.1-170.60
-  rule local.set {val : val, x : idx, z : state}:
-    `%~>%`(`%;%`(z, [(val <: admininstr) LOCAL.SET_admininstr(x)]), `%;%`($with_local(z, x, val), []))
--}
-
-
-{-
-;; ../spec/5-reduction.watsup:3.1-3.63
-relation Step: `%~>%`(config, config)
-  ;; ../spec/5-reduction.watsup:16.1-18.42
-  rule write {instr* : instr*, instr'* : instr*, z : state, z' : state}:
-    `%~>%`(`%;%`(z, (instr <: admininstr)*), `%;%`(z', (instr' <: admininstr)*))
-    -- Step_write: `%~>%`(`%;%`(z, (instr <: admininstr)*), `%;%`(z', (instr' <: admininstr)*))
-
-  ;; ../spec/5-reduction.watsup:12.1-14.37
-  rule read {instr* : instr*, instr'* : instr*, z : state}:
-    `%~>%`(`%;%`(z, (instr <: admininstr)*), `%;%`(z, (instr' <: admininstr)*))
-    -- Step_read: `%~>%`(`%;%`(z, (instr <: admininstr)*), (instr' <: admininstr)*)
-
-  ;; ../spec/5-reduction.watsup:8.1-10.34
-  rule pure {instr* : instr*, instr'* : instr*, z : state}:
-    `%~>%`(`%;%`(z, (instr <: admininstr)*), `%;%`(z, (instr' <: admininstr)*))
-    -- Step_pure: `%~>%`((instr <: admininstr)*, (instr' <: admininstr)*)
--}
+
+
+
+
+
+
 $ ghc -c Test.hs
 ```
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index b57f7f801c..6e916d8f28 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -51,9 +51,13 @@ inductive Reftype where
   deriving Inhabited, BEq
 
 inductive Valtype where
- | Numtype : Numtype -> Valtype
- | Vectype : Vectype -> Valtype
- | Reftype : Reftype -> Valtype
+ | I32 : Valtype
+ | I64 : Valtype
+ | F32 : Valtype
+ | F64 : Valtype
+ | V128 : Valtype
+ | FUNCREF : Valtype
+ | EXTERNREF : Valtype
  | BOT : Valtype
   deriving Inhabited, BEq
 
@@ -278,11 +282,11 @@ inductive Externuse where
 @[reducible] def Module := /- mixop: MODULE -/ ((List Import) × (List Func) × (List Global) × (List Table) × (List Mem) × (List Elem) × (List Data) × (List Start) × (List Export))
 
 def size : Valtype -> Nat
-  | (Valtype.Vectype Vectype.V128) => 128
-  | (Valtype.Numtype Numtype.F64) => 64
-  | (Valtype.Numtype Numtype.F32) => 32
-  | (Valtype.Numtype Numtype.I64) => 64
-  | (Valtype.Numtype Numtype.I32) => 32
+  | Valtype.V128 => 128
+  | Valtype.F64 => 64
+  | Valtype.F32 => 32
+  | Valtype.I64 => 64
+  | Valtype.I32 => 32
   | _ => default
 
 def test_sub_ATOM_22 : N -> Nat
@@ -425,58 +429,58 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     ((((Nat.pow 2) n_A)) <= (((Nat.div (size t)) 8))) ->
     (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div (size t)) 8)))) ->
     ((n == none) || (nt == (Numtype.In «in»))) ->
-    (Instr_ok (C, (Instr.STORE (nt, n, n_A, n_O)), ([(Valtype.Numtype Numtype.I32), (Valtype.Numtype nt)], [])))
+    (Instr_ok (C, (Instr.STORE (nt, n, n_A, n_O)), ([Valtype.I32, (Valtype.Numtype nt)], [])))
   | load (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (sx : (Option Sx)) (t : Valtype) :
     ((C.MEM.get! 0) == mt) ->
     ((((Nat.pow 2) n_A)) <= (((Nat.div (size t)) 8))) ->
     (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div (size t)) 8)))) ->
     ((n == none) || (nt == (Numtype.In «in»))) ->
-    (Instr_ok (C, (Instr.LOAD (nt, (n, sx) /- ? -/, n_A, n_O)), ([(Valtype.Numtype Numtype.I32)], [(Valtype.Numtype nt)])))
+    (Instr_ok (C, (Instr.LOAD (nt, (n, sx) /- ? -/, n_A, n_O)), ([Valtype.I32], [(Valtype.Numtype nt)])))
   | data_drop (C : Context) (x : Idx) :
     ((C.DATA.get! x) == ()) ->
     (Instr_ok (C, (Instr.DATA_DROP x), ([], [])))
   | memory_init (C : Context) (mt : Memtype) (x : Idx) :
     ((C.MEM.get! 0) == mt) ->
     ((C.DATA.get! x) == ()) ->
-    (Instr_ok (C, (Instr.MEMORY_INIT x), ([(Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32)], [(Valtype.Numtype Numtype.I32)])))
+    (Instr_ok (C, (Instr.MEMORY_INIT x), ([Valtype.I32, Valtype.I32, Valtype.I32], [Valtype.I32])))
   | memory_copy (C : Context) (mt : Memtype) :
     ((C.MEM.get! 0) == mt) ->
-    (Instr_ok (C, Instr.MEMORY_COPY, ([(Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32)], [(Valtype.Numtype Numtype.I32)])))
+    (Instr_ok (C, Instr.MEMORY_COPY, ([Valtype.I32, Valtype.I32, Valtype.I32], [Valtype.I32])))
   | memory_fill (C : Context) (mt : Memtype) :
     ((C.MEM.get! 0) == mt) ->
-    (Instr_ok (C, Instr.MEMORY_FILL, ([(Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32)], [(Valtype.Numtype Numtype.I32)])))
+    (Instr_ok (C, Instr.MEMORY_FILL, ([Valtype.I32, Valtype.I32, Valtype.I32], [Valtype.I32])))
   | memory_grow (C : Context) (mt : Memtype) :
     ((C.MEM.get! 0) == mt) ->
-    (Instr_ok (C, Instr.MEMORY_GROW, ([(Valtype.Numtype Numtype.I32)], [(Valtype.Numtype Numtype.I32)])))
+    (Instr_ok (C, Instr.MEMORY_GROW, ([Valtype.I32], [Valtype.I32])))
   | memory_size (C : Context) (mt : Memtype) :
     ((C.MEM.get! 0) == mt) ->
-    (Instr_ok (C, Instr.MEMORY_SIZE, ([], [(Valtype.Numtype Numtype.I32)])))
+    (Instr_ok (C, Instr.MEMORY_SIZE, ([], [Valtype.I32])))
   | elem_drop (C : Context) (rt : Reftype) (x : Idx) :
     ((C.ELEM.get! x) == rt) ->
     (Instr_ok (C, (Instr.ELEM_DROP x), ([], [])))
   | table_init (C : Context) (lim : Limits) (rt : Reftype) (x_1 : Idx) (x_2 : Idx) :
     ((C.TABLE.get! x_1) == (lim, rt)) ->
     ((C.ELEM.get! x_2) == rt) ->
-    (Instr_ok (C, (Instr.TABLE_INIT (x_1, x_2)), ([(Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32)], [])))
+    (Instr_ok (C, (Instr.TABLE_INIT (x_1, x_2)), ([Valtype.I32, Valtype.I32, Valtype.I32], [])))
   | table_copy (C : Context) (lim_1 : Limits) (lim_2 : Limits) (rt : Reftype) (x_1 : Idx) (x_2 : Idx) :
     ((C.TABLE.get! x_1) == (lim_1, rt)) ->
     ((C.TABLE.get! x_2) == (lim_2, rt)) ->
-    (Instr_ok (C, (Instr.TABLE_COPY (x_1, x_2)), ([(Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32), (Valtype.Numtype Numtype.I32)], [])))
+    (Instr_ok (C, (Instr.TABLE_COPY (x_1, x_2)), ([Valtype.I32, Valtype.I32, Valtype.I32], [])))
   | table_fill (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
     ((C.TABLE.get! x) == (lim, rt)) ->
-    (Instr_ok (C, (Instr.TABLE_FILL x), ([(Valtype.Numtype Numtype.I32), (Valtype.Reftype rt), (Valtype.Numtype Numtype.I32)], [])))
+    (Instr_ok (C, (Instr.TABLE_FILL x), ([Valtype.I32, (Valtype.Reftype rt), Valtype.I32], [])))
   | table_grow (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
     ((C.TABLE.get! x) == (lim, rt)) ->
-    (Instr_ok (C, (Instr.TABLE_GROW x), ([(Valtype.Reftype rt), (Valtype.Numtype Numtype.I32)], [(Valtype.Numtype Numtype.I32)])))
+    (Instr_ok (C, (Instr.TABLE_GROW x), ([(Valtype.Reftype rt), Valtype.I32], [Valtype.I32])))
   | table_size (C : Context) (tt : Tabletype) (x : Idx) :
     ((C.TABLE.get! x) == tt) ->
-    (Instr_ok (C, (Instr.TABLE_SIZE x), ([], [(Valtype.Numtype Numtype.I32)])))
+    (Instr_ok (C, (Instr.TABLE_SIZE x), ([], [Valtype.I32])))
   | table_set (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
     ((C.TABLE.get! x) == (lim, rt)) ->
-    (Instr_ok (C, (Instr.TABLE_SET x), ([(Valtype.Numtype Numtype.I32), (Valtype.Reftype rt)], [])))
+    (Instr_ok (C, (Instr.TABLE_SET x), ([Valtype.I32, (Valtype.Reftype rt)], [])))
   | table_get (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
     ((C.TABLE.get! x) == (lim, rt)) ->
-    (Instr_ok (C, (Instr.TABLE_GET x), ([(Valtype.Numtype Numtype.I32)], [(Valtype.Reftype rt)])))
+    (Instr_ok (C, (Instr.TABLE_GET x), ([Valtype.I32], [(Valtype.Reftype rt)])))
   | global_set (C : Context) (t : Valtype) (x : Idx) :
     ((C.GLOBAL.get! x) == ((some ()), t)) ->
     (Instr_ok (C, (Instr.GLOBAL_SET x), ([t], [])))
@@ -493,10 +497,10 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     ((C.LOCAL.get! x) == t) ->
     (Instr_ok (C, (Instr.LOCAL_GET x), ([], [t])))
   | ref_is_null (C : Context) (rt : Reftype) :
-    (Instr_ok (C, Instr.REF_IS_NULL, ([(Valtype.Reftype rt)], [(Valtype.Numtype Numtype.I32)])))
+    (Instr_ok (C, Instr.REF_IS_NULL, ([(Valtype.Reftype rt)], [Valtype.I32])))
   | ref_func (C : Context) (ft : Functype) (x : Idx) :
     ((C.FUNC.get! x) == ft) ->
-    (Instr_ok (C, (Instr.REF_FUNC x), ([], [(Valtype.Reftype Reftype.FUNCREF)])))
+    (Instr_ok (C, (Instr.REF_FUNC x), ([], [Valtype.FUNCREF])))
   | ref_null (C : Context) (rt : Reftype) :
     (Instr_ok (C, (Instr.REF_NULL rt), ([], [(Valtype.Reftype rt)])))
   | convert_f (C : Context) (fn_1 : Fn) (fn_2 : Fn) :
@@ -514,9 +518,9 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (n <= (size (Valtype.Numtype nt))) ->
     (Instr_ok (C, (Instr.EXTEND (nt, n)), ([(Valtype.Numtype nt)], [(Valtype.Numtype nt)])))
   | relop (C : Context) (nt : Numtype) (relop : Relop_numtype) :
-    (Instr_ok (C, (Instr.RELOP (nt, relop)), ([(Valtype.Numtype nt), (Valtype.Numtype nt)], [(Valtype.Numtype Numtype.I32)])))
+    (Instr_ok (C, (Instr.RELOP (nt, relop)), ([(Valtype.Numtype nt), (Valtype.Numtype nt)], [Valtype.I32])))
   | testop (C : Context) (nt : Numtype) (testop : Testop_numtype) :
-    (Instr_ok (C, (Instr.TESTOP (nt, testop)), ([(Valtype.Numtype nt)], [(Valtype.Numtype Numtype.I32)])))
+    (Instr_ok (C, (Instr.TESTOP (nt, testop)), ([(Valtype.Numtype nt)], [Valtype.I32])))
   | binop (C : Context) (binop : Binop_numtype) (nt : Numtype) :
     (Instr_ok (C, (Instr.BINOP (nt, binop)), ([(Valtype.Numtype nt), (Valtype.Numtype nt)], [(Valtype.Numtype nt)])))
   | unop (C : Context) (nt : Numtype) (unop : Unop_numtype) :
@@ -526,7 +530,7 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
   | call_indirect (C : Context) (ft : Functype) (lim : Limits) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (x : Idx) :
     ((C.TABLE.get! x) == (lim, Reftype.FUNCREF)) ->
     (ft == (t_1, t_2)) ->
-    (Instr_ok (C, (Instr.CALL_INDIRECT (x, ft)), ((t_1 ++ [(Valtype.Numtype Numtype.I32)]), t_2)))
+    (Instr_ok (C, (Instr.CALL_INDIRECT (x, ft)), ((t_1 ++ [Valtype.I32]), t_2)))
   | call (C : Context) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (x : Idx) :
     ((C.FUNC.get! x) == (t_1, t_2)) ->
     (Instr_ok (C, (Instr.CALL x), (t_1, t_2)))
@@ -539,7 +543,7 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (Instr_ok (C, (Instr.BR_TABLE (l, l')), ((t_1 ++ t), t_2)))
   | br_if (C : Context) (l : Labelidx) (t : (List Valtype)) :
     ((C.LABEL.get! l) == t) ->
-    (Instr_ok (C, (Instr.BR_IF l), ((t ++ [(Valtype.Numtype Numtype.I32)]), t)))
+    (Instr_ok (C, (Instr.BR_IF l), ((t ++ [Valtype.I32]), t)))
   | br (C : Context) (l : Labelidx) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
     ((C.LABEL.get! l) == t) ->
     (Instr_ok (C, (Instr.BR l), ((t_1 ++ t), t_2)))
@@ -559,9 +563,9 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
   | select_impl (C : Context) (numtype : Numtype) (t : Valtype) (t' : Valtype) (vectype : Vectype) :
     (Valtype_sub (t, t')) ->
     ((t' == (Valtype.Numtype numtype)) || (t' == (Valtype.Vectype vectype))) ->
-    (Instr_ok (C, (Instr.SELECT none), ([t, t, (Valtype.Numtype Numtype.I32)], [t])))
+    (Instr_ok (C, (Instr.SELECT none), ([t, t, Valtype.I32], [t])))
   | select_expl (C : Context) (t : Valtype) :
-    (Instr_ok (C, (Instr.SELECT (some t)), ([t, t, (Valtype.Numtype Numtype.I32)], [t])))
+    (Instr_ok (C, (Instr.SELECT (some t)), ([t, t, Valtype.I32], [t])))
   | drop (C : Context) (t : Valtype) :
     (Instr_ok (C, Instr.DROP, ([t], [])))
   | nop (C : Context) :
@@ -641,7 +645,7 @@ inductive Elemmode_ok : (Context × Elemmode × Reftype) -> Prop where
     (Elemmode_ok (C, Elemmode.DECLARE, rt))
   | active (C : Context) (expr : Expr) (lim : Limits) (rt : Reftype) (x : Idx) :
     ((C.TABLE.get! x) == (lim, rt)) ->
-    (Expr_ok_const (C, expr, (Valtype.Numtype Numtype.I32))) /- * -/ ->
+    (Expr_ok_const (C, expr, Valtype.I32)) /- * -/ ->
     (Elemmode_ok (C, (Elemmode.TABLE (x, expr)), rt))
 
 inductive Elem_ok : (Context × Elem × Reftype) -> Prop where
@@ -653,7 +657,7 @@ inductive Elem_ok : (Context × Elem × Reftype) -> Prop where
 inductive Datamode_ok : (Context × Datamode) -> Prop where
   | rule_0 (C : Context) (expr : Expr) (mt : Memtype) :
     ((C.MEM.get! 0) == mt) ->
-    (Expr_ok_const (C, expr, (Valtype.Numtype Numtype.I32))) /- * -/ ->
+    (Expr_ok_const (C, expr, Valtype.I32)) /- * -/ ->
     (Datamode_ok (C, (Datamode.MEMORY (0, expr))))
 
 inductive Data_ok : (Context × Data) -> Prop where
@@ -733,8 +737,10 @@ inductive Ref where
   deriving Inhabited, BEq
 
 inductive Val where
- | Num : Num -> Val
- | Ref : Ref -> Val
+ | CONST : (Numtype × C_numtype) -> Val
+ | REF_NULL : Reftype -> Val
+ | REF_FUNC_ADDR : Funcaddr -> Val
+ | REF_HOST_ADDR : Hostaddr -> Val
   deriving Inhabited, BEq
 
 inductive Result where
@@ -750,11 +756,12 @@ inductive Externval where
   deriving Inhabited, BEq
 
 def default_ : Valtype -> Val
-  | (Valtype.Reftype rt) => (Val.Ref (Ref.REF_NULL rt))
-  | (Valtype.Numtype Numtype.F64) => (Val.Num (Num.CONST (Numtype.F64, 0)))
-  | (Valtype.Numtype Numtype.F32) => (Val.Num (Num.CONST (Numtype.F32, 0)))
-  | (Valtype.Numtype Numtype.I64) => (Val.Num (Num.CONST (Numtype.I64, 0)))
-  | (Valtype.Numtype Numtype.I32) => (Val.Num (Num.CONST (Numtype.I32, 0)))
+  | Valtype.EXTERNREF => (Val.REF_NULL Reftype.EXTERNREF)
+  | Valtype.FUNCREF => (Val.REF_NULL Reftype.FUNCREF)
+  | Valtype.F64 => (Val.CONST (Numtype.F64, 0))
+  | Valtype.F32 => (Val.CONST (Numtype.F32, 0))
+  | Valtype.I64 => (Val.CONST (Numtype.I64, 0))
+  | Valtype.I32 => (Val.CONST (Numtype.I32, 0))
   | _ => default
 
 @[reducible] def Exportinst := /- mixop: EXPORT -/ (Name × Externval)
@@ -822,7 +829,50 @@ instance : Append Frame where
 @[reducible] def State := /- mixop: `%;%` -/ (Store × Frame)
 
 inductive Admininstr where
- | Instr : Instr -> Admininstr
+ | UNREACHABLE : Admininstr
+ | NOP : Admininstr
+ | DROP : Admininstr
+ | SELECT : (Option Valtype) -> Admininstr
+ | BLOCK : (Blocktype × (List Instr)) -> Admininstr
+ | LOOP : (Blocktype × (List Instr)) -> Admininstr
+ | IF : (Blocktype × (List Instr) × (List Instr)) -> Admininstr
+ | BR : Labelidx -> Admininstr
+ | BR_IF : Labelidx -> Admininstr
+ | BR_TABLE : ((List Labelidx) × Labelidx) -> Admininstr
+ | CALL : Funcidx -> Admininstr
+ | CALL_INDIRECT : (Tableidx × Functype) -> Admininstr
+ | RETURN : Admininstr
+ | CONST : (Numtype × C_numtype) -> Admininstr
+ | UNOP : (Numtype × Unop_numtype) -> Admininstr
+ | BINOP : (Numtype × Binop_numtype) -> Admininstr
+ | TESTOP : (Numtype × Testop_numtype) -> Admininstr
+ | RELOP : (Numtype × Relop_numtype) -> Admininstr
+ | EXTEND : (Numtype × N) -> Admininstr
+ | CVTOP : (Numtype × Cvtop × Numtype × (Option Sx)) -> Admininstr
+ | REF_NULL : Reftype -> Admininstr
+ | REF_FUNC : Funcidx -> Admininstr
+ | REF_IS_NULL : Admininstr
+ | LOCAL_GET : Localidx -> Admininstr
+ | LOCAL_SET : Localidx -> Admininstr
+ | LOCAL_TEE : Localidx -> Admininstr
+ | GLOBAL_GET : Globalidx -> Admininstr
+ | GLOBAL_SET : Globalidx -> Admininstr
+ | TABLE_GET : Tableidx -> Admininstr
+ | TABLE_SET : Tableidx -> Admininstr
+ | TABLE_SIZE : Tableidx -> Admininstr
+ | TABLE_GROW : Tableidx -> Admininstr
+ | TABLE_FILL : Tableidx -> Admininstr
+ | TABLE_COPY : (Tableidx × Tableidx) -> Admininstr
+ | TABLE_INIT : (Tableidx × Elemidx) -> Admininstr
+ | ELEM_DROP : Elemidx -> Admininstr
+ | MEMORY_SIZE : Admininstr
+ | MEMORY_GROW : Admininstr
+ | MEMORY_FILL : Admininstr
+ | MEMORY_COPY : Admininstr
+ | MEMORY_INIT : Dataidx -> Admininstr
+ | DATA_DROP : Dataidx -> Admininstr
+ | LOAD : (Numtype × (Option (N × Sx)) × Nat × Nat) -> Admininstr
+ | STORE : (Numtype × (Option N) × Nat × Nat) -> Admininstr
  | REF_FUNC_ADDR : Funcaddr -> Admininstr
  | REF_HOST_ADDR : Hostaddr -> Admininstr
  | CALL_ADDR : Funcaddr -> Admininstr
@@ -872,52 +922,52 @@ inductive E where
 inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
   | br_table_ge (i : Nat) (l : (List Labelidx)) (l' : Labelidx) :
     (i >= l.length) ->
-    (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.BR_TABLE (l, l')))], [(Admininstr.Instr (Instr.BR l'))]))
+    (Step_pure ([(Admininstr.CONST (Numtype.I32, i)), (Admininstr.BR_TABLE (l, l'))], [(Admininstr.BR l')]))
   | br_table_lt (i : Nat) (l : (List Labelidx)) (l' : Labelidx) :
     (i < l.length) ->
-    (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.BR_TABLE (l, l')))], [(Admininstr.Instr (Instr.BR (l.get! i)))]))
+    (Step_pure ([(Admininstr.CONST (Numtype.I32, i)), (Admininstr.BR_TABLE (l, l'))], [(Admininstr.BR (l.get! i))]))
   | br_if_false (c : C_numtype) (l : Labelidx) :
     (c == 0) ->
-    (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.BR_IF l))], []))
+    (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.BR_IF l)], []))
   | br_if_true (c : C_numtype) (l : Labelidx) :
     (c != 0) ->
-    (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.BR_IF l))], [(Admininstr.Instr (Instr.BR l))]))
+    (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.BR_IF l)], [(Admininstr.BR l)]))
   | br_succ (instr : (List Instr)) (instr' : (List Instr)) (l : Labelidx) (n : N) (val : (List Val)) :
-    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((Admininstr.Val val) /- * -/ ++ ([(Admininstr.Instr (Instr.BR (l + 1)))] ++ (Admininstr.Instr instr) /- * -/))))], ((Admininstr.Val val) /- * -/ ++ [(Admininstr.Instr (Instr.BR l))])))
+    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((Admininstr.Val val) /- * -/ ++ ([(Admininstr.BR (l + 1))] ++ (Admininstr.Instr instr) /- * -/))))], ((Admininstr.Val val) /- * -/ ++ [(Admininstr.BR l)])))
   | br_zero (instr : (List Instr)) (instr' : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) :
-    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((Admininstr.Val val') /- * -/ ++ ((Admininstr.Val val) /- ^n -/ ++ ([(Admininstr.Instr (Instr.BR 0))] ++ (Admininstr.Instr instr) /- * -/)))))], ((Admininstr.Val val) /- ^n -/ ++ (Admininstr.Instr instr') /- * -/)))
+    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((Admininstr.Val val') /- * -/ ++ ((Admininstr.Val val) /- ^n -/ ++ ([(Admininstr.BR 0)] ++ (Admininstr.Instr instr) /- * -/)))))], ((Admininstr.Val val) /- ^n -/ ++ (Admininstr.Instr instr') /- * -/)))
   | if_false (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) :
     (c == 0) ->
-    (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.IF (bt, instr_1, instr_2)))], [(Admininstr.Instr (Instr.BLOCK (bt, instr_2)))]))
+    (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.IF (bt, instr_1, instr_2))], [(Admininstr.BLOCK (bt, instr_2))]))
   | if_true (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) :
     (c != 0) ->
-    (Step_pure ([(Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.IF (bt, instr_1, instr_2)))], [(Admininstr.Instr (Instr.BLOCK (bt, instr_1)))]))
+    (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.IF (bt, instr_1, instr_2))], [(Admininstr.BLOCK (bt, instr_1))]))
   | loop (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
     (bt == (t_1, t_2)) ->
-    (Step_pure (((Admininstr.Val val) /- ^k -/ ++ [(Admininstr.Instr (Instr.LOOP (bt, instr)))]), [(Admininstr.LABEL_ (n, [(Instr.LOOP (bt, instr))], ((Admininstr.Val val) /- ^k -/ ++ (Admininstr.Instr instr) /- * -/)))]))
+    (Step_pure (((Admininstr.Val val) /- ^k -/ ++ [(Admininstr.LOOP (bt, instr))]), [(Admininstr.LABEL_ (n, [(Instr.LOOP (bt, instr))], ((Admininstr.Val val) /- ^k -/ ++ (Admininstr.Instr instr) /- * -/)))]))
   | block (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
     (bt == (t_1, t_2)) ->
-    (Step_pure (((Admininstr.Val val) /- ^k -/ ++ [(Admininstr.Instr (Instr.BLOCK (bt, instr)))]), [(Admininstr.LABEL_ (n, [], ((Admininstr.Val val) /- ^k -/ ++ (Admininstr.Instr instr) /- * -/)))]))
+    (Step_pure (((Admininstr.Val val) /- ^k -/ ++ [(Admininstr.BLOCK (bt, instr))]), [(Admininstr.LABEL_ (n, [], ((Admininstr.Val val) /- ^k -/ ++ (Admininstr.Instr instr) /- * -/)))]))
   | local_tee (val : Val) (x : Idx) :
-    (Step_pure ([(Admininstr.Val val), (Admininstr.Instr (Instr.LOCAL_TEE x))], [(Admininstr.Val val), (Admininstr.Val val), (Admininstr.Instr (Instr.LOCAL_SET x))]))
+    (Step_pure ([(Admininstr.Val val), (Admininstr.LOCAL_TEE x)], [(Admininstr.Val val), (Admininstr.Val val), (Admininstr.LOCAL_SET x)]))
   | select_false (c : C_numtype) (t : (Option Valtype)) (val_1 : Val) (val_2 : Val) :
     (c == 0) ->
-    (Step_pure ([(Admininstr.Val val_1), (Admininstr.Val val_2), (Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.SELECT t))], [(Admininstr.Val val_2)]))
+    (Step_pure ([(Admininstr.Val val_1), (Admininstr.Val val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)], [(Admininstr.Val val_2)]))
   | select_true (c : C_numtype) (t : (Option Valtype)) (val_1 : Val) (val_2 : Val) :
     (c != 0) ->
-    (Step_pure ([(Admininstr.Val val_1), (Admininstr.Val val_2), (Admininstr.Instr (Instr.CONST (Numtype.I32, c))), (Admininstr.Instr (Instr.SELECT t))], [(Admininstr.Val val_1)]))
+    (Step_pure ([(Admininstr.Val val_1), (Admininstr.Val val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)], [(Admininstr.Val val_1)]))
   | drop (val : Val) :
-    (Step_pure ([(Admininstr.Val val), (Admininstr.Instr Instr.DROP)], []))
+    (Step_pure ([(Admininstr.Val val), Admininstr.DROP], []))
   | nop  :
-    (Step_pure ([(Admininstr.Instr Instr.NOP)], []))
+    (Step_pure ([Admininstr.NOP], []))
   | unreachable  :
-    (Step_pure ([(Admininstr.Instr Instr.UNREACHABLE)], [Admininstr.TRAP]))
+    (Step_pure ([Admininstr.UNREACHABLE], [Admininstr.TRAP]))
   | ref_is_null_false (val : Val) :
     True /- Else? -/ ->
-    (Step_pure ([(Admininstr.Val val), (Admininstr.Instr Instr.REF_IS_NULL)], [(Admininstr.Instr (Instr.CONST (Numtype.I32, 0)))]))
+    (Step_pure ([(Admininstr.Val val), Admininstr.REF_IS_NULL], [(Admininstr.CONST (Numtype.I32, 0))]))
   | ref_is_null_true (rt : Reftype) (val : Val) :
-    (val == (Val.Ref (Ref.REF_NULL rt))) ->
-    (Step_pure ([(Admininstr.Val val), (Admininstr.Instr Instr.REF_IS_NULL)], [(Admininstr.Instr (Instr.CONST (Numtype.I32, 1)))]))
+    (val == (Val.REF_NULL rt)) ->
+    (Step_pure ([(Admininstr.Val val), Admininstr.REF_IS_NULL], [(Admininstr.CONST (Numtype.I32, 1))]))
 
 inductive Step_read : (Config × (List Admininstr)) -> Prop where
   | call_addr (a : Addr) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
@@ -925,70 +975,70 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (Step_read ((z, ((Admininstr.Val val) /- ^k -/ ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, {LOCAL := (val ++ (default_ t) /- * -/), MODULE := m}, [(Admininstr.LABEL_ (n, [], (Admininstr.Instr instr) /- * -/))]))]))
   | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
     True /- Else? -/ ->
-    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CALL_INDIRECT (x, ft)))]), [Admininstr.TRAP]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [Admininstr.TRAP]))
   | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
     (((table (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
     (((funcinst z).get! a) == (m, func)) ->
-    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CALL_INDIRECT (x, ft)))]), [(Admininstr.CALL_ADDR a)]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [(Admininstr.CALL_ADDR a)]))
   | call (x : Idx) (z : State) :
-    (Step_read ((z, [(Admininstr.Instr (Instr.CALL x))]), [(Admininstr.CALL_ADDR ((funcaddr z).get! x))]))
+    (Step_read ((z, [(Admininstr.CALL x)]), [(Admininstr.CALL_ADDR ((funcaddr z).get! x))]))
   | table_init_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     True /- Else? -/ ->
-    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CONST (Numtype.I32, (n + 1)))), (Admininstr.Instr (Instr.TABLE_INIT (x, y)))]), [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Ref ((elem (z, y)).get! i)), (Admininstr.Instr (Instr.TABLE_SET x)), (Admininstr.Instr (Instr.CONST (Numtype.I32, (j + 1)))), (Admininstr.Instr (Instr.CONST (Numtype.I32, (i + 1)))), (Admininstr.Instr (Instr.CONST (Numtype.I32, n))), (Admininstr.Instr (Instr.TABLE_INIT (x, y)))]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, (n + 1))), (Admininstr.TABLE_INIT (x, y))]), [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.Ref ((elem (z, y)).get! i)), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))
   | table_init_zero (i : Nat) (j : Nat) (x : Idx) (y : Idx) (z : State) :
     True /- Else? -/ ->
-    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CONST (Numtype.I32, 0))), (Admininstr.Instr (Instr.TABLE_INIT (x, y)))]), []))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, 0)), (Admininstr.TABLE_INIT (x, y))]), []))
   | table_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     (((i + n) > (elem (z, y)).length) || ((j + n) > (table (z, x)).length)) ->
-    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CONST (Numtype.I32, n))), (Admininstr.Instr (Instr.TABLE_INIT (x, y)))]), [Admininstr.TRAP]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), [Admininstr.TRAP]))
   | table_copy_gt (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     (j > i) ->
-    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CONST (Numtype.I32, (n + 1)))), (Admininstr.Instr (Instr.TABLE_COPY (x, y)))]), [(Admininstr.Instr (Instr.CONST (Numtype.I32, (j + n)))), (Admininstr.Instr (Instr.CONST (Numtype.I32, (i + n)))), (Admininstr.Instr (Instr.TABLE_GET y)), (Admininstr.Instr (Instr.TABLE_SET x)), (Admininstr.Instr (Instr.CONST (Numtype.I32, (j + 1)))), (Admininstr.Instr (Instr.CONST (Numtype.I32, (i + 1)))), (Admininstr.Instr (Instr.CONST (Numtype.I32, n))), (Admininstr.Instr (Instr.TABLE_COPY (x, y)))]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, (n + 1))), (Admininstr.TABLE_COPY (x, y))]), [(Admininstr.CONST (Numtype.I32, (j + n))), (Admininstr.CONST (Numtype.I32, (i + n))), (Admininstr.TABLE_GET y), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
   | table_copy_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     (j <= i) ->
-    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CONST (Numtype.I32, (n + 1)))), (Admininstr.Instr (Instr.TABLE_COPY (x, y)))]), [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.TABLE_GET y)), (Admininstr.Instr (Instr.TABLE_SET x)), (Admininstr.Instr (Instr.CONST (Numtype.I32, (j + 1)))), (Admininstr.Instr (Instr.CONST (Numtype.I32, (i + 1)))), (Admininstr.Instr (Instr.CONST (Numtype.I32, n))), (Admininstr.Instr (Instr.TABLE_COPY (x, y)))]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, (n + 1))), (Admininstr.TABLE_COPY (x, y))]), [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET y), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
   | table_copy_zero (i : Nat) (j : Nat) (x : Idx) (y : Idx) (z : State) :
     True /- Else? -/ ->
-    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CONST (Numtype.I32, 0))), (Admininstr.Instr (Instr.TABLE_COPY (x, y)))]), []))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, 0)), (Admininstr.TABLE_COPY (x, y))]), []))
   | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     (((i + n) > (table (z, y)).length) || ((j + n) > (table (z, x)).length)) ->
-    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, j))), (Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.CONST (Numtype.I32, n))), (Admininstr.Instr (Instr.TABLE_COPY (x, y)))]), [Admininstr.TRAP]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]), [Admininstr.TRAP]))
   | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
     True /- Else? -/ ->
-    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Val val), (Admininstr.Instr (Instr.CONST (Numtype.I32, (n + 1)))), (Admininstr.Instr (Instr.TABLE_FILL x))]), [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Val val), (Admininstr.Instr (Instr.TABLE_SET x)), (Admininstr.Instr (Instr.CONST (Numtype.I32, (i + 1)))), (Admininstr.Val val), (Admininstr.Instr (Instr.CONST (Numtype.I32, n))), (Admininstr.Instr (Instr.TABLE_FILL x))]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.Val val), (Admininstr.CONST (Numtype.I32, (n + 1))), (Admininstr.TABLE_FILL x)]), [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.Val val), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.Val val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
   | table_fill_zero (i : Nat) (val : Val) (x : Idx) (z : State) :
     True /- Else? -/ ->
-    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Val val), (Admininstr.Instr (Instr.CONST (Numtype.I32, 0))), (Admininstr.Instr (Instr.TABLE_FILL x))]), []))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.Val val), (Admininstr.CONST (Numtype.I32, 0)), (Admininstr.TABLE_FILL x)]), []))
   | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
     ((i + n) > (table (z, x)).length) ->
-    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Val val), (Admininstr.Instr (Instr.CONST (Numtype.I32, n))), (Admininstr.Instr (Instr.TABLE_FILL x))]), [Admininstr.TRAP]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.Val val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), [Admininstr.TRAP]))
   | table_size (n : N) (x : Idx) (z : State) :
     ((table (z, x)).length == n) ->
-    (Step_read ((z, [(Admininstr.Instr (Instr.TABLE_SIZE x))]), [(Admininstr.Instr (Instr.CONST (Numtype.I32, n)))]))
+    (Step_read ((z, [(Admininstr.TABLE_SIZE x)]), [(Admininstr.CONST (Numtype.I32, n))]))
   | table_get_lt (i : Nat) (x : Idx) (z : State) :
     (i < (table (z, x)).length) ->
-    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.TABLE_GET x))]), [(Admininstr.Ref ((table (z, x)).get! i))]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]), [(Admininstr.Ref ((table (z, x)).get! i))]))
   | table_get_ge (i : Nat) (x : Idx) (z : State) :
     (i >= (table (z, x)).length) ->
-    (Step_read ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Instr (Instr.TABLE_GET x))]), [Admininstr.TRAP]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]), [Admininstr.TRAP]))
   | global_get (x : Idx) (z : State) :
-    (Step_read ((z, [(Admininstr.Instr (Instr.GLOBAL_GET x))]), [(Admininstr.Globalinst («global» (z, x)))]))
+    (Step_read ((z, [(Admininstr.GLOBAL_GET x)]), [(Admininstr.Globalinst («global» (z, x)))]))
   | local_get (x : Idx) (z : State) :
-    (Step_read ((z, [(Admininstr.Instr (Instr.LOCAL_GET x))]), [(Admininstr.Val («local» (z, x)))]))
+    (Step_read ((z, [(Admininstr.LOCAL_GET x)]), [(Admininstr.Val («local» (z, x)))]))
   | ref_func (x : Idx) (z : State) :
-    (Step_read ((z, [(Admininstr.Instr (Instr.REF_FUNC x))]), [(Admininstr.REF_FUNC_ADDR ((funcaddr z).get! x))]))
+    (Step_read ((z, [(Admininstr.REF_FUNC x)]), [(Admininstr.REF_FUNC_ADDR ((funcaddr z).get! x))]))
 
 inductive Step_write : (Config × Config) -> Prop where
   | table_set_ge (i : Nat) (ref : Ref) (x : Idx) (z : State) :
     (i >= (table (z, x)).length) ->
-    (Step_write ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Ref ref), (Admininstr.Instr (Instr.TABLE_GET x))]), (z, [Admininstr.TRAP])))
+    (Step_write ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.Ref ref), (Admininstr.TABLE_GET x)]), (z, [Admininstr.TRAP])))
   | table_set_lt (i : Nat) (ref : Ref) (x : Idx) (z : State) :
     (i < (table (z, x)).length) ->
-    (Step_write ((z, [(Admininstr.Instr (Instr.CONST (Numtype.I32, i))), (Admininstr.Ref ref), (Admininstr.Instr (Instr.TABLE_GET x))]), ((with_table (z, x, i, ref)), [])))
+    (Step_write ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.Ref ref), (Admininstr.TABLE_GET x)]), ((with_table (z, x, i, ref)), [])))
   | global_set (val : Val) (x : Idx) (z : State) :
-    (Step_write ((z, [(Admininstr.Val val), (Admininstr.Instr (Instr.GLOBAL_SET x))]), ((with_global (z, x, val)), [])))
+    (Step_write ((z, [(Admininstr.Val val), (Admininstr.GLOBAL_SET x)]), ((with_global (z, x, val)), [])))
   | local_set (val : Val) (x : Idx) (z : State) :
-    (Step_write ((z, [(Admininstr.Val val), (Admininstr.Instr (Instr.LOCAL_SET x))]), ((with_local (z, x, val)), [])))
+    (Step_write ((z, [(Admininstr.Val val), (Admininstr.LOCAL_SET x)]), ((with_local (z, x, val)), [])))
 
 inductive Step : (Config × Config) -> Prop where
   | write (instr : (List Instr)) (instr' : (List Instr)) (z : State) (z' : State) :
@@ -1027,6 +1077,7 @@ has type
 but is expected to have type
   Nat : Type
 SpecTec.lean: error: unknown constant 'Numtype.In'
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
 SpecTec.lean: error: application type mismatch
   Nat.div n
 argument
@@ -1052,12 +1103,19 @@ has type
   Option N × Option Sx : Type
 but is expected to have type
   Option (N × Sx) : Type
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: unknown constant 'Valtype.Reftype'
+SpecTec.lean: error: unknown constant 'Valtype.Reftype'
+SpecTec.lean: error: unknown constant 'Valtype.Reftype'
+SpecTec.lean: error: unknown constant 'Valtype.Reftype'
 SpecTec.lean: error: type mismatch
   ((), t)
 has type
   Unit × Valtype : Type
 but is expected to have type
   Globaltype : Type
+SpecTec.lean: error: unknown constant 'Valtype.Reftype'
+SpecTec.lean: error: unknown constant 'Valtype.Reftype'
 SpecTec.lean: error: unknown constant 'Numtype.Fn'
 SpecTec.lean: error: unknown constant 'Numtype.Fn'
 SpecTec.lean: error: unknown constant 'Valtype.Fn'
@@ -1068,6 +1126,22 @@ SpecTec.lean: error: unknown constant 'Numtype.In'
 SpecTec.lean: error: unknown constant 'Numtype.In'
 SpecTec.lean: error: unknown constant 'Valtype.In'
 SpecTec.lean: error: unknown constant 'Valtype.In'
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
 SpecTec.lean: error: application type mismatch
   List.get! C.LABEL l
 argument
@@ -1124,6 +1198,8 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
+SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: unknown constant 'Valtype.Vectype'
 SpecTec.lean: error: application type mismatch
   Prod.mk t'_1
 argument
@@ -1133,7 +1209,7 @@ has type
 but is expected to have type
   List Valtype : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Instr) Instr ?m.77841
+  HAppend (List Instr) Instr ?m.76839
 SpecTec.lean: error: application type mismatch
   (C, instr)
 argument
@@ -1156,6 +1232,7 @@ has type
   List Expr : Type
 but is expected to have type
   Expr : Type
+SpecTec.lean: error: unknown constant 'Valtype.Reftype'
 SpecTec.lean: error: application type mismatch
   Prod.mk elemmode
 argument
@@ -1249,58 +1326,19 @@ SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `i` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `r` [linter.unusedVariables]
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: application type mismatch
-  Admininstr.Instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Admininstr) Admininstr ?m.124169
+SpecTec.lean: error: unknown constant 'Admininstr.Instr'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: application type mismatch
-  Admininstr.Instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Admininstr) Admininstr ?m.124562
+SpecTec.lean: error: unknown constant 'Admininstr.Instr'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: application type mismatch
-  Admininstr.Instr instr'
-argument
-  instr'
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
+SpecTec.lean: error: unknown constant 'Admininstr.Instr'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: application type mismatch
-  Admininstr.Instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
+SpecTec.lean: error: unknown constant 'Admininstr.Instr'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: application type mismatch
-  Admininstr.Instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
+SpecTec.lean: error: unknown constant 'Admininstr.Instr'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
@@ -1323,15 +1361,8 @@ has type
 but is expected to have type
   Valtype : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Val) Val ?m.126855
-SpecTec.lean: error: application type mismatch
-  Admininstr.Instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
+  HAppend (List Val) Val ?m.172081
+SpecTec.lean: error: unknown constant 'Admininstr.Instr'
 SpecTec.lean: error: unknown constant 'Admininstr.Ref'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
@@ -1345,100 +1376,16 @@ SpecTec.lean: error: unknown constant 'Admininstr.Ref'
 SpecTec.lean: error: unknown constant 'Admininstr.Ref'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: application type mismatch
-  Admininstr.Instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  Admininstr.Instr instr'
-argument
-  instr'
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  Admininstr.Instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  Admininstr.Instr instr'
-argument
-  instr'
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  Admininstr.Instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  Admininstr.Instr instr'
-argument
-  instr'
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  Admininstr.Instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  Admininstr.Instr instr'
-argument
-  instr'
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  Admininstr.Instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  Admininstr.Instr instr'
-argument
-  instr'
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  Admininstr.Instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  Admininstr.Instr instr'
-argument
-  instr'
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
+SpecTec.lean: error: unknown constant 'Admininstr.Instr'
+SpecTec.lean: error: unknown constant 'Admininstr.Instr'
+SpecTec.lean: error: unknown constant 'Admininstr.Instr'
+SpecTec.lean: error: unknown constant 'Admininstr.Instr'
+SpecTec.lean: error: unknown constant 'Admininstr.Instr'
+SpecTec.lean: error: unknown constant 'Admininstr.Instr'
+SpecTec.lean: error: unknown constant 'Admininstr.Instr'
+SpecTec.lean: error: unknown constant 'Admininstr.Instr'
+SpecTec.lean: error: unknown constant 'Admininstr.Instr'
+SpecTec.lean: error: unknown constant 'Admininstr.Instr'
+SpecTec.lean: error: unknown constant 'Admininstr.Instr'
+SpecTec.lean: error: unknown constant 'Admininstr.Instr'
 ```

From 3a8f3179433b407d7860e4a534f6d42d098e0b87 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 5 Apr 2023 23:46:40 +0200
Subject: [PATCH 32/98] More keywords

---
 spectec/src/backend-lean4/gen.ml | 2 +-
 spectec/test-lean4/TEST.md       | 9 ++++-----
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 972383967a..ab955f5935 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -191,7 +191,7 @@ let rec render_def (d : def) =
     end
   | DecD (id, typ1, typ2, clauses, hints) ->
     show_input d ^
-    "def " ^ id.it ^ " : " ^ render_typ typ1 ^ " -> " ^ render_typ typ2 ^
+    "def " ^ render_id id ^ " : " ^ render_typ typ1 ^ " -> " ^ render_typ typ2 ^
     String.concat "" (List.map (render_clause id) clauses) ^
     (if (List.exists (fun h -> h.hintid.it = "partial") hints)
     then "\n  | _ => default" else "") (* Could use no_error_if_unused% as well *)
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 6e916d8f28..4478e37ccb 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -892,10 +892,10 @@ def funcinst : State -> (List Funcinst)
 def func : (State × Funcidx) -> Funcinst
   | ((s, f), x) => (s.FUNC.get! (f.MODULE.FUNC.get! x))
 
-def local : (State × Localidx) -> Val
+def «local» : (State × Localidx) -> Val
   | ((s, f), x) => (f.LOCAL.get! x)
 
-def global : (State × Globalidx) -> Globalinst
+def «global» : (State × Globalidx) -> Globalinst
   | ((s, f), x) => (s.GLOBAL.get! (f.MODULE.GLOBAL.get! x))
 
 def table : (State × Tableidx) -> Tableinst
@@ -1313,8 +1313,7 @@ but is expected to have type
   List Datatype : Type
 SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `f` [linter.unusedVariables]
-SpecTec.lean: error: expected identifier
-SpecTec.lean: error: expected 'elab', 'elab_rules', 'infix', 'infixl', 'infixr', 'instance', 'macro', 'macro_rules', 'notation', 'postfix', 'prefix', 'syntax' or 'unif_hint'
+SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `f` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `v` [linter.unusedVariables]
@@ -1361,7 +1360,7 @@ has type
 but is expected to have type
   Valtype : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Val) Val ?m.172081
+  HAppend (List Val) Val ?m.172363
 SpecTec.lean: error: unknown constant 'Admininstr.Instr'
 SpecTec.lean: error: unknown constant 'Admininstr.Ref'
 SpecTec.lean: error: unknown constant 'Admininstr.Val'

From 9750a791a99b0ebdf7f55624c415023bec108106 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Thu, 6 Apr 2023 00:17:17 +0200
Subject: [PATCH 33/98] Generate some variant injections

---
 spectec/src/backend-lean4/gen.ml |  12 +-
 spectec/src/il/flat.ml           |  49 ++-
 spectec/test-haskell/TEST.md     |  67 ++++
 spectec/test-lean4/TEST.md       | 603 +++++++++++++++++++++++--------
 4 files changed, 559 insertions(+), 172 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index ab955f5935..5993fbc96e 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -80,17 +80,15 @@ let rec prepend first rest = function
   | (x::xs) -> first ^ x ^ prepend rest rest xs
 
 
-let render_variant_inj qual id1 id2 =
-  (if qual then render_type_name id1 ^ "." else "" ) ^
-  render_type_name id2
+let render_variant_inj (id1 : id) (id2 : id) =
+  make_id (id1.it ^ "_" ^ id2.it)
 
 let render_variant_inj' (typ1 : typ) (typ2 : typ) = match typ1.it, typ2.it with
-  | VarT id1, VarT id2 -> render_variant_inj true id1 id2
+  | VarT id1, VarT id2 -> render_variant_inj id1 id2
   | _, _ -> "_ {- render_variant_inj': Typs not ids -}"
 
-let render_variant_inj_case id1 id2 =
-  render_variant_inj false id1 id2 ^ " : " ^
-  render_type_name id2 ^ " -> " ^ render_type_name id1
+let render_variant_inj_case _id1 _id2 =
+  "/- Incomplete Ir.Flat.transform? -/"
 
 let render_variant_case id ((a, ty, _hints) : typcase) =
   render_con_name false id a ^ " : " ^
diff --git a/spectec/src/il/flat.ml b/spectec/src/il/flat.ml
index 44636dac4b..cffcc779cb 100644
--- a/spectec/src/il/flat.ml
+++ b/spectec/src/il/flat.ml
@@ -41,33 +41,44 @@ let register_cons (env : env) (id :id) (cases : typcase list) =
   else
     env.variants <- Env.add id.it cases env.variants
 
-let rec transform_def env (def : def) : def = match def.it with
+let rec transform_def_rec env (def : def) : def * (def list) = match def.it with
   | RecD defs ->
-    { def with it = RecD (List.map (transform_def env) defs) }
+    let defs', new_defs = List.split (List.map (transform_def_rec env) defs) in
+    { def with it = RecD defs' },  List.concat new_defs
   | SynD (id, deftyp, hints) ->
     begin match deftyp.it with
     | VariantT (ids, cases) ->
       let cases' = List.concat_map (lookup_cons env) ids @ cases in
       register_cons env id cases';
-      { def with it = SynD (id, { deftyp with it = VariantT ([], cases') }, hints) }
-    | _ -> def
+      { def with it = SynD (id, { deftyp with it = VariantT ([], cases') }, hints) },
+      (* Also generate conversion functions *)
+      List.map (fun sid ->
+        let name = (id.it ^ "_" ^ sid.it) $ no_region in
+        let ty = VarT id $ no_region in
+        let sty = VarT sid $ no_region in
+        let clauses = List.map (fun (a, arg_typ, _hints) ->
+          if arg_typ.it = TupT []
+          then DefD ([],
+                CaseE (a, TupE [] $ no_region, sty) $ no_region,
+                CaseE (a, TupE [] $ no_region, ty) $ no_region, []) $ no_region
+          else
+            let x = "x" $ no_region in
+            DefD ([(x, arg_typ, [])],
+                CaseE (a, VarE x $ no_region, sty) $ no_region,
+                CaseE (a, VarE x $ no_region, ty) $ no_region, []) $ no_region
+        ) (lookup_cons env sid) in
+        DecD (name, VarT sid $ no_region, VarT id $ no_region, clauses, []) $ no_region
+      ) ids
+    | _ -> def, []
     end
-  (* Giving up on this translation
-  | DecD  (id, ty1, ty2, clauses, hints) -> 
-    let clauses' = List.concat_map (fun clause ->
-      match clause.it with
-      | DefD ([(id1, ty1, [])],
-              {it = SubE ({it = VarE id2} as ide, ty2, ty3)} as lhs,
-              rhs, []) when id1.it = id2.it and Eq.eq_typ t1 t2 ->
-        (* This clause has to be duplicated *)
-        (* Lets assume nullary constructors only *)
-        List.map (fun con ->
-          { clause with it = DefD ([], { lhs with it = CaseE (con, 
-   *)
-  | _ ->  
-  def (* TODO: look inside *)
+  | _ ->
+  def, [] (* TODO: look inside *)
+
+and transform_def env (def : def) : def list =
+  let def', new_defs = transform_def_rec env def in
+  def' :: new_defs
 
 let transform (defs : script) =
   let env = new_env () in
-  List.map (transform_def env) defs
+  List.concat_map (transform_def env) defs
 
diff --git a/spectec/test-haskell/TEST.md b/spectec/test-haskell/TEST.md
index 8f80603c84..0ad9e8ab54 100644
--- a/spectec/test-haskell/TEST.md
+++ b/spectec/test-haskell/TEST.md
@@ -57,6 +57,19 @@ data Valtype
  | Valtype_EXTERNREF
  | Valtype_BOT
 
+valtype_numtype :: Numtype -> Valtype
+valtype_numtype Numtype_I32 = Valtype_I32
+valtype_numtype Numtype_I64 = Valtype_I64
+valtype_numtype Numtype_F32 = Valtype_F32
+valtype_numtype Numtype_F64 = Valtype_F64
+
+valtype_vectype :: Vectype -> Valtype
+valtype_vectype Vectype_V128 = Valtype_V128
+
+valtype_reftype :: Reftype -> Valtype
+valtype_reftype Reftype_FUNCREF = Valtype_FUNCREF
+valtype_reftype Reftype_EXTERNREF = Valtype_EXTERNREF
+
 data In
  = In_I32
  | In_I64
@@ -391,6 +404,14 @@ data Val
  | Val_REF_FUNC_ADDR Funcaddr
  | Val_REF_HOST_ADDR Hostaddr
 
+val_num :: Num -> Val
+val_num (Num_CONST x) = (Val_CONST x)
+
+val_ref :: Ref -> Val
+val_ref (Ref_REF_NULL x) = (Val_REF_NULL x)
+val_ref (Ref_REF_FUNC_ADDR x) = (Val_REF_FUNC_ADDR x)
+val_ref (Ref_REF_HOST_ADDR x) = (Val_REF_HOST_ADDR x)
+
 data Result
  = Result_VALS [Val]
  | Result_TRAP
@@ -501,6 +522,52 @@ data Admininstr
  | Admininstr_FRAME_ (N, Frame, [Admininstr])
  | Admininstr_TRAP
 
+admininstr_instr :: Instr -> Admininstr
+admininstr_instr Instr_UNREACHABLE = Admininstr_UNREACHABLE
+admininstr_instr Instr_NOP = Admininstr_NOP
+admininstr_instr Instr_DROP = Admininstr_DROP
+admininstr_instr (Instr_SELECT x) = (Admininstr_SELECT x)
+admininstr_instr (Instr_BLOCK x) = (Admininstr_BLOCK x)
+admininstr_instr (Instr_LOOP x) = (Admininstr_LOOP x)
+admininstr_instr (Instr_IF x) = (Admininstr_IF x)
+admininstr_instr (Instr_BR x) = (Admininstr_BR x)
+admininstr_instr (Instr_BR_IF x) = (Admininstr_BR_IF x)
+admininstr_instr (Instr_BR_TABLE x) = (Admininstr_BR_TABLE x)
+admininstr_instr (Instr_CALL x) = (Admininstr_CALL x)
+admininstr_instr (Instr_CALL_INDIRECT x) = (Admininstr_CALL_INDIRECT x)
+admininstr_instr Instr_RETURN = Admininstr_RETURN
+admininstr_instr (Instr_CONST x) = (Admininstr_CONST x)
+admininstr_instr (Instr_UNOP x) = (Admininstr_UNOP x)
+admininstr_instr (Instr_BINOP x) = (Admininstr_BINOP x)
+admininstr_instr (Instr_TESTOP x) = (Admininstr_TESTOP x)
+admininstr_instr (Instr_RELOP x) = (Admininstr_RELOP x)
+admininstr_instr (Instr_EXTEND x) = (Admininstr_EXTEND x)
+admininstr_instr (Instr_CVTOP x) = (Admininstr_CVTOP x)
+admininstr_instr (Instr_REF_NULL x) = (Admininstr_REF_NULL x)
+admininstr_instr (Instr_REF_FUNC x) = (Admininstr_REF_FUNC x)
+admininstr_instr Instr_REF_IS_NULL = Admininstr_REF_IS_NULL
+admininstr_instr (Instr_LOCAL_GET x) = (Admininstr_LOCAL_GET x)
+admininstr_instr (Instr_LOCAL_SET x) = (Admininstr_LOCAL_SET x)
+admininstr_instr (Instr_LOCAL_TEE x) = (Admininstr_LOCAL_TEE x)
+admininstr_instr (Instr_GLOBAL_GET x) = (Admininstr_GLOBAL_GET x)
+admininstr_instr (Instr_GLOBAL_SET x) = (Admininstr_GLOBAL_SET x)
+admininstr_instr (Instr_TABLE_GET x) = (Admininstr_TABLE_GET x)
+admininstr_instr (Instr_TABLE_SET x) = (Admininstr_TABLE_SET x)
+admininstr_instr (Instr_TABLE_SIZE x) = (Admininstr_TABLE_SIZE x)
+admininstr_instr (Instr_TABLE_GROW x) = (Admininstr_TABLE_GROW x)
+admininstr_instr (Instr_TABLE_FILL x) = (Admininstr_TABLE_FILL x)
+admininstr_instr (Instr_TABLE_COPY x) = (Admininstr_TABLE_COPY x)
+admininstr_instr (Instr_TABLE_INIT x) = (Admininstr_TABLE_INIT x)
+admininstr_instr (Instr_ELEM_DROP x) = (Admininstr_ELEM_DROP x)
+admininstr_instr Instr_MEMORY_SIZE = Admininstr_MEMORY_SIZE
+admininstr_instr Instr_MEMORY_GROW = Admininstr_MEMORY_GROW
+admininstr_instr Instr_MEMORY_FILL = Admininstr_MEMORY_FILL
+admininstr_instr Instr_MEMORY_COPY = Admininstr_MEMORY_COPY
+admininstr_instr (Instr_MEMORY_INIT x) = (Admininstr_MEMORY_INIT x)
+admininstr_instr (Instr_DATA_DROP x) = (Admininstr_DATA_DROP x)
+admininstr_instr (Instr_LOAD x) = (Admininstr_LOAD x)
+admininstr_instr (Instr_STORE x) = (Admininstr_STORE x)
+
 type Config = {- mixop: `%;%` -} (State, [Admininstr])
 
 funcaddr :: State -> [Funcaddr]
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 4478e37ccb..2cd1038551 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -61,6 +61,19 @@ inductive Valtype where
  | BOT : Valtype
   deriving Inhabited, BEq
 
+def valtype_numtype : Numtype -> Valtype
+  | Numtype.I32 => Valtype.I32
+  | Numtype.I64 => Valtype.I64
+  | Numtype.F32 => Valtype.F32
+  | Numtype.F64 => Valtype.F64
+
+def valtype_vectype : Vectype -> Valtype
+  | Vectype.V128 => Valtype.V128
+
+def valtype_reftype : Reftype -> Valtype
+  | Reftype.FUNCREF => Valtype.FUNCREF
+  | Reftype.EXTERNREF => Valtype.EXTERNREF
+
 inductive In where
  | I32 : In
  | I64 : In
@@ -428,14 +441,14 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     ((C.MEM.get! 0) == mt) ->
     ((((Nat.pow 2) n_A)) <= (((Nat.div (size t)) 8))) ->
     (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div (size t)) 8)))) ->
-    ((n == none) || (nt == (Numtype.In «in»))) ->
-    (Instr_ok (C, (Instr.STORE (nt, n, n_A, n_O)), ([Valtype.I32, (Valtype.Numtype nt)], [])))
+    ((n == none) || (nt == (numtype_in «in»))) ->
+    (Instr_ok (C, (Instr.STORE (nt, n, n_A, n_O)), ([Valtype.I32, (valtype_numtype nt)], [])))
   | load (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (sx : (Option Sx)) (t : Valtype) :
     ((C.MEM.get! 0) == mt) ->
     ((((Nat.pow 2) n_A)) <= (((Nat.div (size t)) 8))) ->
     (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div (size t)) 8)))) ->
-    ((n == none) || (nt == (Numtype.In «in»))) ->
-    (Instr_ok (C, (Instr.LOAD (nt, (n, sx) /- ? -/, n_A, n_O)), ([Valtype.I32], [(Valtype.Numtype nt)])))
+    ((n == none) || (nt == (numtype_in «in»))) ->
+    (Instr_ok (C, (Instr.LOAD (nt, (n, sx) /- ? -/, n_A, n_O)), ([Valtype.I32], [(valtype_numtype nt)])))
   | data_drop (C : Context) (x : Idx) :
     ((C.DATA.get! x) == ()) ->
     (Instr_ok (C, (Instr.DATA_DROP x), ([], [])))
@@ -468,19 +481,19 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (Instr_ok (C, (Instr.TABLE_COPY (x_1, x_2)), ([Valtype.I32, Valtype.I32, Valtype.I32], [])))
   | table_fill (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
     ((C.TABLE.get! x) == (lim, rt)) ->
-    (Instr_ok (C, (Instr.TABLE_FILL x), ([Valtype.I32, (Valtype.Reftype rt), Valtype.I32], [])))
+    (Instr_ok (C, (Instr.TABLE_FILL x), ([Valtype.I32, (valtype_reftype rt), Valtype.I32], [])))
   | table_grow (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
     ((C.TABLE.get! x) == (lim, rt)) ->
-    (Instr_ok (C, (Instr.TABLE_GROW x), ([(Valtype.Reftype rt), Valtype.I32], [Valtype.I32])))
+    (Instr_ok (C, (Instr.TABLE_GROW x), ([(valtype_reftype rt), Valtype.I32], [Valtype.I32])))
   | table_size (C : Context) (tt : Tabletype) (x : Idx) :
     ((C.TABLE.get! x) == tt) ->
     (Instr_ok (C, (Instr.TABLE_SIZE x), ([], [Valtype.I32])))
   | table_set (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
     ((C.TABLE.get! x) == (lim, rt)) ->
-    (Instr_ok (C, (Instr.TABLE_SET x), ([Valtype.I32, (Valtype.Reftype rt)], [])))
+    (Instr_ok (C, (Instr.TABLE_SET x), ([Valtype.I32, (valtype_reftype rt)], [])))
   | table_get (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
     ((C.TABLE.get! x) == (lim, rt)) ->
-    (Instr_ok (C, (Instr.TABLE_GET x), ([Valtype.I32], [(Valtype.Reftype rt)])))
+    (Instr_ok (C, (Instr.TABLE_GET x), ([Valtype.I32], [(valtype_reftype rt)])))
   | global_set (C : Context) (t : Valtype) (x : Idx) :
     ((C.GLOBAL.get! x) == ((some ()), t)) ->
     (Instr_ok (C, (Instr.GLOBAL_SET x), ([t], [])))
@@ -497,36 +510,36 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     ((C.LOCAL.get! x) == t) ->
     (Instr_ok (C, (Instr.LOCAL_GET x), ([], [t])))
   | ref_is_null (C : Context) (rt : Reftype) :
-    (Instr_ok (C, Instr.REF_IS_NULL, ([(Valtype.Reftype rt)], [Valtype.I32])))
+    (Instr_ok (C, Instr.REF_IS_NULL, ([(valtype_reftype rt)], [Valtype.I32])))
   | ref_func (C : Context) (ft : Functype) (x : Idx) :
     ((C.FUNC.get! x) == ft) ->
     (Instr_ok (C, (Instr.REF_FUNC x), ([], [Valtype.FUNCREF])))
   | ref_null (C : Context) (rt : Reftype) :
-    (Instr_ok (C, (Instr.REF_NULL rt), ([], [(Valtype.Reftype rt)])))
+    (Instr_ok (C, (Instr.REF_NULL rt), ([], [(valtype_reftype rt)])))
   | convert_f (C : Context) (fn_1 : Fn) (fn_2 : Fn) :
     (fn_1 != fn_2) ->
-    (Instr_ok (C, (Instr.CVTOP ((Numtype.Fn fn_1), Cvtop.CONVERT, (Numtype.Fn fn_2), none)), ([(Valtype.Fn fn_2)], [(Valtype.Fn fn_1)])))
+    (Instr_ok (C, (Instr.CVTOP ((numtype_fn fn_1), Cvtop.CONVERT, (numtype_fn fn_2), none)), ([(valtype_fn fn_2)], [(valtype_fn fn_1)])))
   | convert_i (C : Context) (in_1 : In) (in_2 : In) (sx : (Option Sx)) :
     (in_1 != in_2) ->
-    ((sx == none) = ((size (Valtype.In in_1)) > (size (Valtype.In in_2)))) ->
-    (Instr_ok (C, (Instr.CVTOP ((Numtype.In in_1), Cvtop.CONVERT, (Numtype.In in_2), sx)), ([(Valtype.In in_2)], [(Valtype.In in_1)])))
+    ((sx == none) = ((size (valtype_in in_1)) > (size (valtype_in in_2)))) ->
+    (Instr_ok (C, (Instr.CVTOP ((numtype_in in_1), Cvtop.CONVERT, (numtype_in in_2), sx)), ([(valtype_in in_2)], [(valtype_in in_1)])))
   | reinterpret (C : Context) (nt_1 : Numtype) (nt_2 : Numtype) :
     (nt_1 != nt_2) ->
-    ((size (Valtype.Numtype nt_1)) == (size (Valtype.Numtype nt_2))) ->
-    (Instr_ok (C, (Instr.CVTOP (nt_1, Cvtop.REINTERPRET, nt_2, none)), ([(Valtype.Numtype nt_2)], [(Valtype.Numtype nt_1)])))
+    ((size (valtype_numtype nt_1)) == (size (valtype_numtype nt_2))) ->
+    (Instr_ok (C, (Instr.CVTOP (nt_1, Cvtop.REINTERPRET, nt_2, none)), ([(valtype_numtype nt_2)], [(valtype_numtype nt_1)])))
   | extend (C : Context) (n : N) (nt : Numtype) :
-    (n <= (size (Valtype.Numtype nt))) ->
-    (Instr_ok (C, (Instr.EXTEND (nt, n)), ([(Valtype.Numtype nt)], [(Valtype.Numtype nt)])))
+    (n <= (size (valtype_numtype nt))) ->
+    (Instr_ok (C, (Instr.EXTEND (nt, n)), ([(valtype_numtype nt)], [(valtype_numtype nt)])))
   | relop (C : Context) (nt : Numtype) (relop : Relop_numtype) :
-    (Instr_ok (C, (Instr.RELOP (nt, relop)), ([(Valtype.Numtype nt), (Valtype.Numtype nt)], [Valtype.I32])))
+    (Instr_ok (C, (Instr.RELOP (nt, relop)), ([(valtype_numtype nt), (valtype_numtype nt)], [Valtype.I32])))
   | testop (C : Context) (nt : Numtype) (testop : Testop_numtype) :
-    (Instr_ok (C, (Instr.TESTOP (nt, testop)), ([(Valtype.Numtype nt)], [Valtype.I32])))
+    (Instr_ok (C, (Instr.TESTOP (nt, testop)), ([(valtype_numtype nt)], [Valtype.I32])))
   | binop (C : Context) (binop : Binop_numtype) (nt : Numtype) :
-    (Instr_ok (C, (Instr.BINOP (nt, binop)), ([(Valtype.Numtype nt), (Valtype.Numtype nt)], [(Valtype.Numtype nt)])))
+    (Instr_ok (C, (Instr.BINOP (nt, binop)), ([(valtype_numtype nt), (valtype_numtype nt)], [(valtype_numtype nt)])))
   | unop (C : Context) (nt : Numtype) (unop : Unop_numtype) :
-    (Instr_ok (C, (Instr.UNOP (nt, unop)), ([(Valtype.Numtype nt)], [(Valtype.Numtype nt)])))
+    (Instr_ok (C, (Instr.UNOP (nt, unop)), ([(valtype_numtype nt)], [(valtype_numtype nt)])))
   | const (C : Context) (c_nt : C_numtype) (nt : Numtype) :
-    (Instr_ok (C, (Instr.CONST (nt, c_nt)), ([], [(Valtype.Numtype nt)])))
+    (Instr_ok (C, (Instr.CONST (nt, c_nt)), ([], [(valtype_numtype nt)])))
   | call_indirect (C : Context) (ft : Functype) (lim : Limits) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (x : Idx) :
     ((C.TABLE.get! x) == (lim, Reftype.FUNCREF)) ->
     (ft == (t_1, t_2)) ->
@@ -562,7 +575,7 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (Instr_ok (C, (Instr.BLOCK (bt, instr)), (t_1, t_2)))
   | select_impl (C : Context) (numtype : Numtype) (t : Valtype) (t' : Valtype) (vectype : Vectype) :
     (Valtype_sub (t, t')) ->
-    ((t' == (Valtype.Numtype numtype)) || (t' == (Valtype.Vectype vectype))) ->
+    ((t' == (valtype_numtype numtype)) || (t' == (valtype_vectype vectype))) ->
     (Instr_ok (C, (Instr.SELECT none), ([t, t, Valtype.I32], [t])))
   | select_expl (C : Context) (t : Valtype) :
     (Instr_ok (C, (Instr.SELECT (some t)), ([t, t, Valtype.I32], [t])))
@@ -650,7 +663,7 @@ inductive Elemmode_ok : (Context × Elemmode × Reftype) -> Prop where
 
 inductive Elem_ok : (Context × Elem × Reftype) -> Prop where
   | rule_0 (C : Context) (elemmode : (Option Elemmode)) (expr : (List Expr)) (rt : Reftype) :
-    (Expr_ok (C, expr, [(Valtype.Reftype rt)])) /- * -/ ->
+    (Expr_ok (C, expr, [(valtype_reftype rt)])) /- * -/ ->
     (Elemmode_ok (C, elemmode, rt)) /- ? -/ ->
     (Elem_ok (C, (rt, expr, elemmode), rt))
 
@@ -743,6 +756,14 @@ inductive Val where
  | REF_HOST_ADDR : Hostaddr -> Val
   deriving Inhabited, BEq
 
+def val_num : Num -> Val
+  | (Num.CONST x) => (Val.CONST x)
+
+def val_ref : Ref -> Val
+  | (Ref.REF_NULL x) => (Val.REF_NULL x)
+  | (Ref.REF_FUNC_ADDR x) => (Val.REF_FUNC_ADDR x)
+  | (Ref.REF_HOST_ADDR x) => (Val.REF_HOST_ADDR x)
+
 inductive Result where
  | _VALS : (List Val) -> Result
  | TRAP : Result
@@ -881,6 +902,52 @@ inductive Admininstr where
  | TRAP : Admininstr
   deriving Inhabited, BEq
 
+def admininstr_instr : Instr -> Admininstr
+  | Instr.UNREACHABLE => Admininstr.UNREACHABLE
+  | Instr.NOP => Admininstr.NOP
+  | Instr.DROP => Admininstr.DROP
+  | (Instr.SELECT x) => (Admininstr.SELECT x)
+  | (Instr.BLOCK x) => (Admininstr.BLOCK x)
+  | (Instr.LOOP x) => (Admininstr.LOOP x)
+  | (Instr.IF x) => (Admininstr.IF x)
+  | (Instr.BR x) => (Admininstr.BR x)
+  | (Instr.BR_IF x) => (Admininstr.BR_IF x)
+  | (Instr.BR_TABLE x) => (Admininstr.BR_TABLE x)
+  | (Instr.CALL x) => (Admininstr.CALL x)
+  | (Instr.CALL_INDIRECT x) => (Admininstr.CALL_INDIRECT x)
+  | Instr.RETURN => Admininstr.RETURN
+  | (Instr.CONST x) => (Admininstr.CONST x)
+  | (Instr.UNOP x) => (Admininstr.UNOP x)
+  | (Instr.BINOP x) => (Admininstr.BINOP x)
+  | (Instr.TESTOP x) => (Admininstr.TESTOP x)
+  | (Instr.RELOP x) => (Admininstr.RELOP x)
+  | (Instr.EXTEND x) => (Admininstr.EXTEND x)
+  | (Instr.CVTOP x) => (Admininstr.CVTOP x)
+  | (Instr.REF_NULL x) => (Admininstr.REF_NULL x)
+  | (Instr.REF_FUNC x) => (Admininstr.REF_FUNC x)
+  | Instr.REF_IS_NULL => Admininstr.REF_IS_NULL
+  | (Instr.LOCAL_GET x) => (Admininstr.LOCAL_GET x)
+  | (Instr.LOCAL_SET x) => (Admininstr.LOCAL_SET x)
+  | (Instr.LOCAL_TEE x) => (Admininstr.LOCAL_TEE x)
+  | (Instr.GLOBAL_GET x) => (Admininstr.GLOBAL_GET x)
+  | (Instr.GLOBAL_SET x) => (Admininstr.GLOBAL_SET x)
+  | (Instr.TABLE_GET x) => (Admininstr.TABLE_GET x)
+  | (Instr.TABLE_SET x) => (Admininstr.TABLE_SET x)
+  | (Instr.TABLE_SIZE x) => (Admininstr.TABLE_SIZE x)
+  | (Instr.TABLE_GROW x) => (Admininstr.TABLE_GROW x)
+  | (Instr.TABLE_FILL x) => (Admininstr.TABLE_FILL x)
+  | (Instr.TABLE_COPY x) => (Admininstr.TABLE_COPY x)
+  | (Instr.TABLE_INIT x) => (Admininstr.TABLE_INIT x)
+  | (Instr.ELEM_DROP x) => (Admininstr.ELEM_DROP x)
+  | Instr.MEMORY_SIZE => Admininstr.MEMORY_SIZE
+  | Instr.MEMORY_GROW => Admininstr.MEMORY_GROW
+  | Instr.MEMORY_FILL => Admininstr.MEMORY_FILL
+  | Instr.MEMORY_COPY => Admininstr.MEMORY_COPY
+  | (Instr.MEMORY_INIT x) => (Admininstr.MEMORY_INIT x)
+  | (Instr.DATA_DROP x) => (Admininstr.DATA_DROP x)
+  | (Instr.LOAD x) => (Admininstr.LOAD x)
+  | (Instr.STORE x) => (Admininstr.STORE x)
+
 @[reducible] def Config := /- mixop: `%;%` -/ (State × (List Admininstr))
 
 def funcaddr : State -> (List Funcaddr)
@@ -933,9 +1000,9 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (c != 0) ->
     (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.BR_IF l)], [(Admininstr.BR l)]))
   | br_succ (instr : (List Instr)) (instr' : (List Instr)) (l : Labelidx) (n : N) (val : (List Val)) :
-    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((Admininstr.Val val) /- * -/ ++ ([(Admininstr.BR (l + 1))] ++ (Admininstr.Instr instr) /- * -/))))], ((Admininstr.Val val) /- * -/ ++ [(Admininstr.BR l)])))
+    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((admininstr_val val) /- * -/ ++ ([(Admininstr.BR (l + 1))] ++ (admininstr_instr instr) /- * -/))))], ((admininstr_val val) /- * -/ ++ [(Admininstr.BR l)])))
   | br_zero (instr : (List Instr)) (instr' : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) :
-    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((Admininstr.Val val') /- * -/ ++ ((Admininstr.Val val) /- ^n -/ ++ ([(Admininstr.BR 0)] ++ (Admininstr.Instr instr) /- * -/)))))], ((Admininstr.Val val) /- ^n -/ ++ (Admininstr.Instr instr') /- * -/)))
+    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((admininstr_val val') /- * -/ ++ ((admininstr_val val) /- ^n -/ ++ ([(Admininstr.BR 0)] ++ (admininstr_instr instr) /- * -/)))))], ((admininstr_val val) /- ^n -/ ++ (admininstr_instr instr') /- * -/)))
   | if_false (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) :
     (c == 0) ->
     (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.IF (bt, instr_1, instr_2))], [(Admininstr.BLOCK (bt, instr_2))]))
@@ -944,35 +1011,35 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.IF (bt, instr_1, instr_2))], [(Admininstr.BLOCK (bt, instr_1))]))
   | loop (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
     (bt == (t_1, t_2)) ->
-    (Step_pure (((Admininstr.Val val) /- ^k -/ ++ [(Admininstr.LOOP (bt, instr))]), [(Admininstr.LABEL_ (n, [(Instr.LOOP (bt, instr))], ((Admininstr.Val val) /- ^k -/ ++ (Admininstr.Instr instr) /- * -/)))]))
+    (Step_pure (((admininstr_val val) /- ^k -/ ++ [(Admininstr.LOOP (bt, instr))]), [(Admininstr.LABEL_ (n, [(Instr.LOOP (bt, instr))], ((admininstr_val val) /- ^k -/ ++ (admininstr_instr instr) /- * -/)))]))
   | block (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
     (bt == (t_1, t_2)) ->
-    (Step_pure (((Admininstr.Val val) /- ^k -/ ++ [(Admininstr.BLOCK (bt, instr))]), [(Admininstr.LABEL_ (n, [], ((Admininstr.Val val) /- ^k -/ ++ (Admininstr.Instr instr) /- * -/)))]))
+    (Step_pure (((admininstr_val val) /- ^k -/ ++ [(Admininstr.BLOCK (bt, instr))]), [(Admininstr.LABEL_ (n, [], ((admininstr_val val) /- ^k -/ ++ (admininstr_instr instr) /- * -/)))]))
   | local_tee (val : Val) (x : Idx) :
-    (Step_pure ([(Admininstr.Val val), (Admininstr.LOCAL_TEE x)], [(Admininstr.Val val), (Admininstr.Val val), (Admininstr.LOCAL_SET x)]))
+    (Step_pure ([(admininstr_val val), (Admininstr.LOCAL_TEE x)], [(admininstr_val val), (admininstr_val val), (Admininstr.LOCAL_SET x)]))
   | select_false (c : C_numtype) (t : (Option Valtype)) (val_1 : Val) (val_2 : Val) :
     (c == 0) ->
-    (Step_pure ([(Admininstr.Val val_1), (Admininstr.Val val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)], [(Admininstr.Val val_2)]))
+    (Step_pure ([(admininstr_val val_1), (admininstr_val val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)], [(admininstr_val val_2)]))
   | select_true (c : C_numtype) (t : (Option Valtype)) (val_1 : Val) (val_2 : Val) :
     (c != 0) ->
-    (Step_pure ([(Admininstr.Val val_1), (Admininstr.Val val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)], [(Admininstr.Val val_1)]))
+    (Step_pure ([(admininstr_val val_1), (admininstr_val val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)], [(admininstr_val val_1)]))
   | drop (val : Val) :
-    (Step_pure ([(Admininstr.Val val), Admininstr.DROP], []))
+    (Step_pure ([(admininstr_val val), Admininstr.DROP], []))
   | nop  :
     (Step_pure ([Admininstr.NOP], []))
   | unreachable  :
     (Step_pure ([Admininstr.UNREACHABLE], [Admininstr.TRAP]))
   | ref_is_null_false (val : Val) :
     True /- Else? -/ ->
-    (Step_pure ([(Admininstr.Val val), Admininstr.REF_IS_NULL], [(Admininstr.CONST (Numtype.I32, 0))]))
+    (Step_pure ([(admininstr_val val), Admininstr.REF_IS_NULL], [(Admininstr.CONST (Numtype.I32, 0))]))
   | ref_is_null_true (rt : Reftype) (val : Val) :
     (val == (Val.REF_NULL rt)) ->
-    (Step_pure ([(Admininstr.Val val), Admininstr.REF_IS_NULL], [(Admininstr.CONST (Numtype.I32, 1))]))
+    (Step_pure ([(admininstr_val val), Admininstr.REF_IS_NULL], [(Admininstr.CONST (Numtype.I32, 1))]))
 
 inductive Step_read : (Config × (List Admininstr)) -> Prop where
   | call_addr (a : Addr) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
     (((funcinst z).get! a) == (m, ((t_1, t_2), t, instr))) ->
-    (Step_read ((z, ((Admininstr.Val val) /- ^k -/ ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, {LOCAL := (val ++ (default_ t) /- * -/), MODULE := m}, [(Admininstr.LABEL_ (n, [], (Admininstr.Instr instr) /- * -/))]))]))
+    (Step_read ((z, ((admininstr_val val) /- ^k -/ ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, {LOCAL := (val ++ (default_ t) /- * -/), MODULE := m}, [(Admininstr.LABEL_ (n, [], (admininstr_instr instr) /- * -/))]))]))
   | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
     True /- Else? -/ ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [Admininstr.TRAP]))
@@ -984,7 +1051,7 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (Step_read ((z, [(Admininstr.CALL x)]), [(Admininstr.CALL_ADDR ((funcaddr z).get! x))]))
   | table_init_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     True /- Else? -/ ->
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, (n + 1))), (Admininstr.TABLE_INIT (x, y))]), [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.Ref ((elem (z, y)).get! i)), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, (n + 1))), (Admininstr.TABLE_INIT (x, y))]), [(Admininstr.CONST (Numtype.I32, j)), (admininstr_ref ((elem (z, y)).get! i)), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))
   | table_init_zero (i : Nat) (j : Nat) (x : Idx) (y : Idx) (z : State) :
     True /- Else? -/ ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, 0)), (Admininstr.TABLE_INIT (x, y))]), []))
@@ -1005,51 +1072,51 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]), [Admininstr.TRAP]))
   | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
     True /- Else? -/ ->
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.Val val), (Admininstr.CONST (Numtype.I32, (n + 1))), (Admininstr.TABLE_FILL x)]), [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.Val val), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.Val val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_val val), (Admininstr.CONST (Numtype.I32, (n + 1))), (Admininstr.TABLE_FILL x)]), [(Admininstr.CONST (Numtype.I32, i)), (admininstr_val val), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (i + 1))), (admininstr_val val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
   | table_fill_zero (i : Nat) (val : Val) (x : Idx) (z : State) :
     True /- Else? -/ ->
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.Val val), (Admininstr.CONST (Numtype.I32, 0)), (Admininstr.TABLE_FILL x)]), []))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_val val), (Admininstr.CONST (Numtype.I32, 0)), (Admininstr.TABLE_FILL x)]), []))
   | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
     ((i + n) > (table (z, x)).length) ->
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.Val val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), [Admininstr.TRAP]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_val val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), [Admininstr.TRAP]))
   | table_size (n : N) (x : Idx) (z : State) :
     ((table (z, x)).length == n) ->
     (Step_read ((z, [(Admininstr.TABLE_SIZE x)]), [(Admininstr.CONST (Numtype.I32, n))]))
   | table_get_lt (i : Nat) (x : Idx) (z : State) :
     (i < (table (z, x)).length) ->
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]), [(Admininstr.Ref ((table (z, x)).get! i))]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]), [(admininstr_ref ((table (z, x)).get! i))]))
   | table_get_ge (i : Nat) (x : Idx) (z : State) :
     (i >= (table (z, x)).length) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]), [Admininstr.TRAP]))
   | global_get (x : Idx) (z : State) :
-    (Step_read ((z, [(Admininstr.GLOBAL_GET x)]), [(Admininstr.Globalinst («global» (z, x)))]))
+    (Step_read ((z, [(Admininstr.GLOBAL_GET x)]), [(admininstr_globalinst («global» (z, x)))]))
   | local_get (x : Idx) (z : State) :
-    (Step_read ((z, [(Admininstr.LOCAL_GET x)]), [(Admininstr.Val («local» (z, x)))]))
+    (Step_read ((z, [(Admininstr.LOCAL_GET x)]), [(admininstr_val («local» (z, x)))]))
   | ref_func (x : Idx) (z : State) :
     (Step_read ((z, [(Admininstr.REF_FUNC x)]), [(Admininstr.REF_FUNC_ADDR ((funcaddr z).get! x))]))
 
 inductive Step_write : (Config × Config) -> Prop where
   | table_set_ge (i : Nat) (ref : Ref) (x : Idx) (z : State) :
     (i >= (table (z, x)).length) ->
-    (Step_write ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.Ref ref), (Admininstr.TABLE_GET x)]), (z, [Admininstr.TRAP])))
+    (Step_write ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_ref ref), (Admininstr.TABLE_GET x)]), (z, [Admininstr.TRAP])))
   | table_set_lt (i : Nat) (ref : Ref) (x : Idx) (z : State) :
     (i < (table (z, x)).length) ->
-    (Step_write ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.Ref ref), (Admininstr.TABLE_GET x)]), ((with_table (z, x, i, ref)), [])))
+    (Step_write ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_ref ref), (Admininstr.TABLE_GET x)]), ((with_table (z, x, i, ref)), [])))
   | global_set (val : Val) (x : Idx) (z : State) :
-    (Step_write ((z, [(Admininstr.Val val), (Admininstr.GLOBAL_SET x)]), ((with_global (z, x, val)), [])))
+    (Step_write ((z, [(admininstr_val val), (Admininstr.GLOBAL_SET x)]), ((with_global (z, x, val)), [])))
   | local_set (val : Val) (x : Idx) (z : State) :
-    (Step_write ((z, [(Admininstr.Val val), (Admininstr.LOCAL_SET x)]), ((with_local (z, x, val)), [])))
+    (Step_write ((z, [(admininstr_val val), (Admininstr.LOCAL_SET x)]), ((with_local (z, x, val)), [])))
 
 inductive Step : (Config × Config) -> Prop where
   | write (instr : (List Instr)) (instr' : (List Instr)) (z : State) (z' : State) :
-    (Step_write ((z, (Admininstr.Instr instr) /- * -/), (z', (Admininstr.Instr instr') /- * -/))) ->
-    (Step ((z, (Admininstr.Instr instr) /- * -/), (z', (Admininstr.Instr instr') /- * -/)))
+    (Step_write ((z, (admininstr_instr instr) /- * -/), (z', (admininstr_instr instr') /- * -/))) ->
+    (Step ((z, (admininstr_instr instr) /- * -/), (z', (admininstr_instr instr') /- * -/)))
   | read (instr : (List Instr)) (instr' : (List Instr)) (z : State) :
-    (Step_read ((z, (Admininstr.Instr instr) /- * -/), (Admininstr.Instr instr') /- * -/)) ->
-    (Step ((z, (Admininstr.Instr instr) /- * -/), (z, (Admininstr.Instr instr') /- * -/)))
+    (Step_read ((z, (admininstr_instr instr) /- * -/), (admininstr_instr instr') /- * -/)) ->
+    (Step ((z, (admininstr_instr instr) /- * -/), (z, (admininstr_instr instr') /- * -/)))
   | pure (instr : (List Instr)) (instr' : (List Instr)) (z : State) :
-    (Step_pure ((Admininstr.Instr instr) /- * -/, (Admininstr.Instr instr') /- * -/)) ->
-    (Step ((z, (Admininstr.Instr instr) /- * -/), (z, (Admininstr.Instr instr') /- * -/)))
+    (Step_pure ((admininstr_instr instr) /- * -/, (admininstr_instr instr') /- * -/)) ->
+    (Step ((z, (admininstr_instr instr) /- * -/), (z, (admininstr_instr instr') /- * -/)))
 $ lean SpecTec.lean 2>&1 | sed -e 's,/[^ ]*/toolchains,.../toolchains`,g' | sed -e 's,SpecTec.lean:[0-9]\+:[0-9]\+,SpecTec.lean,'
 SpecTec.lean: warning: unused variable `n_3_ATOM_y` [linter.unusedVariables]
 SpecTec.lean: error: application type mismatch
@@ -1076,8 +1143,10 @@ has type
   Option N : Type
 but is expected to have type
   Nat : Type
-SpecTec.lean: error: unknown constant 'Numtype.In'
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: function expected at
+  numtype_in
+term has type
+  ?m.72247
 SpecTec.lean: error: application type mismatch
   Nat.div n
 argument
@@ -1094,7 +1163,6 @@ has type
   Option N : Type
 but is expected to have type
   Nat : Type
-SpecTec.lean: error: unknown constant 'Numtype.In'
 SpecTec.lean: error: application type mismatch
   Prod.mk (n, sx)
 argument
@@ -1103,45 +1171,56 @@ has type
   Option N × Option Sx : Type
 but is expected to have type
   Option (N × Sx) : Type
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
-SpecTec.lean: error: unknown constant 'Valtype.Reftype'
-SpecTec.lean: error: unknown constant 'Valtype.Reftype'
-SpecTec.lean: error: unknown constant 'Valtype.Reftype'
-SpecTec.lean: error: unknown constant 'Valtype.Reftype'
+SpecTec.lean: error: function expected at
+  numtype_in
+term has type
+  ?m.72849
 SpecTec.lean: error: type mismatch
   ((), t)
 has type
   Unit × Valtype : Type
 but is expected to have type
   Globaltype : Type
-SpecTec.lean: error: unknown constant 'Valtype.Reftype'
-SpecTec.lean: error: unknown constant 'Valtype.Reftype'
-SpecTec.lean: error: unknown constant 'Numtype.Fn'
-SpecTec.lean: error: unknown constant 'Numtype.Fn'
-SpecTec.lean: error: unknown constant 'Valtype.Fn'
-SpecTec.lean: error: unknown constant 'Valtype.Fn'
-SpecTec.lean: error: unknown constant 'Valtype.In'
-SpecTec.lean: error: unknown constant 'Valtype.In'
-SpecTec.lean: error: unknown constant 'Numtype.In'
-SpecTec.lean: error: unknown constant 'Numtype.In'
-SpecTec.lean: error: unknown constant 'Valtype.In'
-SpecTec.lean: error: unknown constant 'Valtype.In'
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
+SpecTec.lean: error: function expected at
+  numtype_fn
+term has type
+  ?m.75195
+SpecTec.lean: error: function expected at
+  numtype_fn
+term has type
+  ?m.75195
+SpecTec.lean: error: function expected at
+  valtype_fn
+term has type
+  ?m.75260
+SpecTec.lean: error: function expected at
+  valtype_fn
+term has type
+  ?m.75260
+SpecTec.lean: error: function expected at
+  valtype_in
+term has type
+  ?m.75476
+SpecTec.lean: error: function expected at
+  valtype_in
+term has type
+  ?m.75476
+SpecTec.lean: error: function expected at
+  numtype_in
+term has type
+  ?m.75775
+SpecTec.lean: error: function expected at
+  numtype_in
+term has type
+  ?m.75775
+SpecTec.lean: error: function expected at
+  valtype_in
+term has type
+  ?m.75476
+SpecTec.lean: error: function expected at
+  valtype_in
+term has type
+  ?m.75476
 SpecTec.lean: error: application type mismatch
   List.get! C.LABEL l
 argument
@@ -1198,8 +1277,6 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-SpecTec.lean: error: unknown constant 'Valtype.Numtype'
-SpecTec.lean: error: unknown constant 'Valtype.Vectype'
 SpecTec.lean: error: application type mismatch
   Prod.mk t'_1
 argument
@@ -1209,7 +1286,7 @@ has type
 but is expected to have type
   List Valtype : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Instr) Instr ?m.76839
+  HAppend (List Instr) Instr ?m.78431
 SpecTec.lean: error: application type mismatch
   (C, instr)
 argument
@@ -1232,7 +1309,6 @@ has type
   List Expr : Type
 but is expected to have type
   Expr : Type
-SpecTec.lean: error: unknown constant 'Valtype.Reftype'
 SpecTec.lean: error: application type mismatch
   Prod.mk elemmode
 argument
@@ -1324,33 +1400,134 @@ SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `i` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `r` [linter.unusedVariables]
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Instr'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Instr'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Instr'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Instr'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Instr'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
+SpecTec.lean: error: application type mismatch
+  admininstr_instr instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend (List Admininstr) Admininstr ?m.175603
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.175212
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.175212
+SpecTec.lean: error: application type mismatch
+  admininstr_instr instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend (List Admininstr) Admininstr ?m.176064
+SpecTec.lean: error: application type mismatch
+  admininstr_instr instr'
+argument
+  instr'
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.175729
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.175729
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.175729
+SpecTec.lean: error: application type mismatch
+  admininstr_instr instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.176692
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.176692
+SpecTec.lean: error: application type mismatch
+  admininstr_instr instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.177230
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.177230
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.177726
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.177726
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.177726
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.177846
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.177846
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.177846
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.178009
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.178009
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.178009
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.178135
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.178206
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.178286
 SpecTec.lean: error: application type mismatch
   default_ t
 argument
@@ -1360,31 +1537,165 @@ has type
 but is expected to have type
   Valtype : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Val) Val ?m.172363
-SpecTec.lean: error: unknown constant 'Admininstr.Instr'
-SpecTec.lean: error: unknown constant 'Admininstr.Ref'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Ref'
-SpecTec.lean: error: unknown constant 'Admininstr.Globalinst'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Ref'
-SpecTec.lean: error: unknown constant 'Admininstr.Ref'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Val'
-SpecTec.lean: error: unknown constant 'Admininstr.Instr'
-SpecTec.lean: error: unknown constant 'Admininstr.Instr'
-SpecTec.lean: error: unknown constant 'Admininstr.Instr'
-SpecTec.lean: error: unknown constant 'Admininstr.Instr'
-SpecTec.lean: error: unknown constant 'Admininstr.Instr'
-SpecTec.lean: error: unknown constant 'Admininstr.Instr'
-SpecTec.lean: error: unknown constant 'Admininstr.Instr'
-SpecTec.lean: error: unknown constant 'Admininstr.Instr'
-SpecTec.lean: error: unknown constant 'Admininstr.Instr'
-SpecTec.lean: error: unknown constant 'Admininstr.Instr'
-SpecTec.lean: error: unknown constant 'Admininstr.Instr'
-SpecTec.lean: error: unknown constant 'Admininstr.Instr'
+  HAppend (List Val) Val ?m.179079
+SpecTec.lean: error: application type mismatch
+  admininstr_instr instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.178646
+SpecTec.lean: error: function expected at
+  admininstr_ref
+term has type
+  ?m.179615
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.180815
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.180815
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.180815
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.181036
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.181166
+SpecTec.lean: error: function expected at
+  admininstr_ref
+term has type
+  ?m.181369
+SpecTec.lean: error: function expected at
+  admininstr_globalinst
+term has type
+  ?m.181504
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.181566
+SpecTec.lean: error: function expected at
+  admininstr_ref
+term has type
+  ?m.181820
+SpecTec.lean: error: function expected at
+  admininstr_ref
+term has type
+  ?m.181937
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.182041
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.182116
+SpecTec.lean: error: application type mismatch
+  admininstr_instr instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
+  admininstr_instr instr'
+argument
+  instr'
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
+  admininstr_instr instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
+  admininstr_instr instr'
+argument
+  instr'
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
+  admininstr_instr instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
+  admininstr_instr instr'
+argument
+  instr'
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
+  admininstr_instr instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
+  admininstr_instr instr'
+argument
+  instr'
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
+  admininstr_instr instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
+  admininstr_instr instr'
+argument
+  instr'
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
+  admininstr_instr instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
+  admininstr_instr instr'
+argument
+  instr'
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
 ```

From 89238e9f4cf77fd6305f6bc3070efbe3b1380658 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Thu, 6 Apr 2023 00:25:19 +0200
Subject: [PATCH 34/98] Generate some more using hints

---
 spectec/spec/4-runtime.watsup |   2 +-
 spectec/src/il/flat.ml        |   5 +-
 spectec/test-haskell/TEST.md  |   6 +
 spectec/test-lean4/TEST.md    | 236 ++++++++++++++++------------------
 4 files changed, 119 insertions(+), 130 deletions(-)

diff --git a/spectec/spec/4-runtime.watsup b/spectec/spec/4-runtime.watsup
index 76c6b6ad8e..d4ad168fcb 100644
--- a/spectec/spec/4-runtime.watsup
+++ b/spectec/spec/4-runtime.watsup
@@ -128,7 +128,7 @@ def $with_table((s; f), x, i, r) = s[.TABLE[f.MODULE.TABLE[x]][i]=r]; f
 
 ;; Administrative Instructions
 
-syntax admininstr hint(show instr) hint(desc "administrative instruction") =
+syntax admininstr hint(show instr) hint(desc "administrative instruction") hint(subtype val) hint(subtype ref) =
   | instr
   | REF.FUNC_ADDR funcaddr         hint(show REF.FUNC %)
   | REF.HOST_ADDR hostaddr         hint(show REF.EXTERN %)
diff --git a/spectec/src/il/flat.ml b/spectec/src/il/flat.ml
index cffcc779cb..9424613cc9 100644
--- a/spectec/src/il/flat.ml
+++ b/spectec/src/il/flat.ml
@@ -52,6 +52,9 @@ let rec transform_def_rec env (def : def) : def * (def list) = match def.it with
       register_cons env id cases';
       { def with it = SynD (id, { deftyp with it = VariantT ([], cases') }, hints) },
       (* Also generate conversion functions *)
+      let sids = ids @ List.concat_map (fun {hintid; hintexp} ->
+          if hintid.it = "subtype" then List.map (fun s -> s $ no_region) hintexp else []
+      ) hints in
       List.map (fun sid ->
         let name = (id.it ^ "_" ^ sid.it) $ no_region in
         let ty = VarT id $ no_region in
@@ -68,7 +71,7 @@ let rec transform_def_rec env (def : def) : def * (def list) = match def.it with
                 CaseE (a, VarE x $ no_region, ty) $ no_region, []) $ no_region
         ) (lookup_cons env sid) in
         DecD (name, VarT sid $ no_region, VarT id $ no_region, clauses, []) $ no_region
-      ) ids
+      ) sids
     | _ -> def, []
     end
   | _ ->
diff --git a/spectec/test-haskell/TEST.md b/spectec/test-haskell/TEST.md
index 0ad9e8ab54..b5e9a00d1c 100644
--- a/spectec/test-haskell/TEST.md
+++ b/spectec/test-haskell/TEST.md
@@ -568,6 +568,12 @@ admininstr_instr (Instr_DATA_DROP x) = (Admininstr_DATA_DROP x)
 admininstr_instr (Instr_LOAD x) = (Admininstr_LOAD x)
 admininstr_instr (Instr_STORE x) = (Admininstr_STORE x)
 
+admininstr_val :: Val -> Admininstr
+admininstr_val (Val_CONST x) = (Admininstr_CONST x)
+admininstr_val (Val_REF_NULL x) = (Admininstr_REF_NULL x)
+admininstr_val (Val_REF_FUNC_ADDR x) = (Admininstr_REF_FUNC_ADDR x)
+admininstr_val (Val_REF_HOST_ADDR x) = (Admininstr_REF_HOST_ADDR x)
+
 type Config = {- mixop: `%;%` -} (State, [Admininstr])
 
 funcaddr :: State -> [Funcaddr]
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 2cd1038551..b7ac683879 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -948,6 +948,12 @@ def admininstr_instr : Instr -> Admininstr
   | (Instr.LOAD x) => (Admininstr.LOAD x)
   | (Instr.STORE x) => (Admininstr.STORE x)
 
+def admininstr_val : Val -> Admininstr
+  | (Val.CONST x) => (Admininstr.CONST x)
+  | (Val.REF_NULL x) => (Admininstr.REF_NULL x)
+  | (Val.REF_FUNC_ADDR x) => (Admininstr.REF_FUNC_ADDR x)
+  | (Val.REF_HOST_ADDR x) => (Admininstr.REF_HOST_ADDR x)
+
 @[reducible] def Config := /- mixop: `%;%` -/ (State × (List Admininstr))
 
 def funcaddr : State -> (List Funcaddr)
@@ -1400,6 +1406,14 @@ SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `i` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `r` [linter.unusedVariables]
+SpecTec.lean: error: application type mismatch
+  admininstr_val val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
 SpecTec.lean: error: application type mismatch
   admininstr_instr instr
 argument
@@ -1409,15 +1423,33 @@ has type
 but is expected to have type
   Instr : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Admininstr) Admininstr ?m.175603
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.175212
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.175212
+  HAppend (List Admininstr) Admininstr ?m.175910
+SpecTec.lean: error: application type mismatch
+  admininstr_val val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend Admininstr (List Admininstr) ?m.176117
+SpecTec.lean: error: application type mismatch
+  admininstr_val val'
+argument
+  val'
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: application type mismatch
+  admininstr_val val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
 SpecTec.lean: error: application type mismatch
   admininstr_instr instr
 argument
@@ -1427,7 +1459,15 @@ has type
 but is expected to have type
   Instr : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Admininstr) Admininstr ?m.176064
+  HAppend (List Admininstr) Admininstr ?m.176643
+SpecTec.lean: error: application type mismatch
+  admininstr_val val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
 SpecTec.lean: error: application type mismatch
   admininstr_instr instr'
 argument
@@ -1436,18 +1476,26 @@ has type
   List Instr : Type
 but is expected to have type
   Instr : Type
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.175729
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.175729
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.175729
+SpecTec.lean: error: failed to synthesize instance
+  HAppend Admininstr Admininstr ?m.176938
+SpecTec.lean: error: application type mismatch
+  admininstr_val val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend Admininstr (List Admininstr) ?m.177461
+SpecTec.lean: error: application type mismatch
+  admininstr_val val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
 SpecTec.lean: error: application type mismatch
   admininstr_instr instr
 argument
@@ -1456,14 +1504,26 @@ has type
   List Instr : Type
 but is expected to have type
   Instr : Type
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.176692
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.176692
+SpecTec.lean: error: failed to synthesize instance
+  HAppend Admininstr Admininstr ?m.177772
+SpecTec.lean: error: application type mismatch
+  admininstr_val val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend Admininstr (List Admininstr) ?m.178129
+SpecTec.lean: error: application type mismatch
+  admininstr_val val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
 SpecTec.lean: error: application type mismatch
   admininstr_instr instr
 argument
@@ -1472,62 +1532,18 @@ has type
   List Instr : Type
 but is expected to have type
   Instr : Type
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.177230
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.177230
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.177726
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.177726
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.177726
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.177846
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.177846
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.177846
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.178009
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.178009
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.178009
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.178135
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.178206
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.178286
+SpecTec.lean: error: failed to synthesize instance
+  HAppend Admininstr Admininstr ?m.178434
+SpecTec.lean: error: application type mismatch
+  admininstr_val val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend Admininstr (List Admininstr) ?m.179306
 SpecTec.lean: error: application type mismatch
   default_ t
 argument
@@ -1537,7 +1553,7 @@ has type
 but is expected to have type
   Valtype : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Val) Val ?m.179079
+  HAppend (List Val) Val ?m.179609
 SpecTec.lean: error: application type mismatch
   admininstr_instr instr
 argument
@@ -1546,62 +1562,26 @@ has type
   List Instr : Type
 but is expected to have type
   Instr : Type
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.178646
 SpecTec.lean: error: function expected at
   admininstr_ref
 term has type
-  ?m.179615
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.180815
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.180815
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.180815
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.181036
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.181166
+  ?m.180129
 SpecTec.lean: error: function expected at
   admininstr_ref
 term has type
-  ?m.181369
+  ?m.181676
 SpecTec.lean: error: function expected at
   admininstr_globalinst
 term has type
-  ?m.181504
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.181566
+  ?m.181811
 SpecTec.lean: error: function expected at
   admininstr_ref
 term has type
-  ?m.181820
+  ?m.182082
 SpecTec.lean: error: function expected at
   admininstr_ref
 term has type
-  ?m.181937
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.182041
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.182116
+  ?m.182199
 SpecTec.lean: error: application type mismatch
   admininstr_instr instr
 argument

From e102bccb5b083ca721b6286abd94948d54b82d11 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Thu, 6 Apr 2023 11:58:09 +0200
Subject: [PATCH 35/98] Namespace functions separately

---
 spectec/src/backend-lean4/gen.ml |   8 +-
 spectec/test-lean4/TEST.md       | 838 ++++++++++++++++---------------
 2 files changed, 430 insertions(+), 416 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 6a81978b5e..3d0b627d0d 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -32,6 +32,8 @@ let make_id s = match s with
 
 let render_id (id : id) = make_id id.it
 
+let render_fun_id (id : id) = make_id (id.it ^ "_f") (* Hack to namespace the functions *)
+
 let render_rule_name _qual _ty_id (rule_id : id) (i : int) :  string =
   if rule_id.it = ""
   then "rule_" ^ string_of_int i
@@ -119,7 +121,7 @@ let rec render_exp (exp : exp) = match exp.it with
   | DotE (_ty, e, a) -> render_exp e ^ "." ^ render_field_name a
   | IdxE (e1, e2) -> parens (render_exp e1 ^ ".get! " ^ render_exp e2)
   | LenE e -> render_exp e ^ ".length"
-  | CallE (id, e) -> render_id id $$ render_exp e
+  | CallE (id, e) -> render_fun_id id $$ render_exp e
   | BinE (AddOp, e1, e2)   -> parens (render_exp e1 ^ " + " ^ render_exp e2)
   | BinE (SubOp, e1, e2)   -> parens (render_exp e1 ^ " - " ^ render_exp e2)
   | BinE (ExpOp, e1, e2)   -> parens ("Nat.pow" $$ render_exp e1 $$ render_exp e2)
@@ -189,10 +191,12 @@ let rec render_def (d : def) =
     end
   | DecD (id, typ1, typ2, clauses, hints) ->
     show_input d ^
-    "def " ^ render_id id ^ " : " ^ render_typ typ1 ^ " -> " ^ render_typ typ2 ^
+    "def " ^ render_fun_id id ^ " : " ^ render_typ typ1 ^ " -> " ^ render_typ typ2 ^
+    begin if clauses = [] then " := default" else
     String.concat "" (List.map (render_clause id) clauses) ^
     (if (List.exists (fun h -> h.hintid.it = "partial") hints)
     then "\n  | _ => default" else "") (* Could use no_error_if_unused% as well *)
+    end
 
   | RelD (id, _mixop, typ, rules, _hints) ->
     show_input d ^
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 668c111a72..e7e4755cf9 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -61,16 +61,16 @@ inductive Valtype where
  | BOT : Valtype
   deriving Inhabited, BEq
 
-def valtype_numtype : Numtype -> Valtype
+def valtype_numtype_f : Numtype -> Valtype
   | Numtype.I32 => Valtype.I32
   | Numtype.I64 => Valtype.I64
   | Numtype.F32 => Valtype.F32
   | Numtype.F64 => Valtype.F64
 
-def valtype_vectype : Vectype -> Valtype
+def valtype_vectype_f : Vectype -> Valtype
   | Vectype.V128 => Valtype.V128
 
-def valtype_reftype : Reftype -> Valtype
+def valtype_reftype_f : Reftype -> Valtype
   | Reftype.FUNCREF => Valtype.FUNCREF
   | Reftype.EXTERNREF => Valtype.EXTERNREF
 
@@ -294,7 +294,7 @@ inductive Externuse where
 
 @[reducible] def Module := /- mixop: `MODULE%*%*%*%*%*%*%*%*%*` -/ ((List Import) × (List Func) × (List Global) × (List Table) × (List Mem) × (List Elem) × (List Data) × (List Start) × (List Export))
 
-def size : Valtype -> Nat
+def size_f : Valtype -> Nat
   | Valtype.V128 => 128
   | Valtype.F64 => 64
   | Valtype.F32 => 32
@@ -302,10 +302,10 @@ def size : Valtype -> Nat
   | Valtype.I32 => 32
   | _ => default
 
-def test_sub_ATOM_22 : N -> Nat
+def test_sub_ATOM_22_f : N -> Nat
   | n_3_ATOM_y => 0
 
-def curried_ : (N × N) -> Nat
+def curried__f : (N × N) -> Nat
   | (n_1, n_2) => (n_1 + n_2)
 
 inductive Testfuse where
@@ -439,14 +439,14 @@ mutual
 inductive Instr_ok : (Context × Instr × Functype) -> Prop where
   | store (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (t : Valtype) :
     ((C.MEM.get! 0) == mt) ->
-    ((((Nat.pow 2) n_A)) <= (((Nat.div (size t)) 8))) ->
-    (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div (size t)) 8)))) ->
+    ((((Nat.pow 2) n_A)) <= (((Nat.div (size_f t)) 8))) ->
+    (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div (size_f t)) 8)))) ->
     ((n == none) || (nt == (numtype_in «in»))) ->
     (Instr_ok (C, (Instr.STORE (nt, n, n_A, n_O)), ([Valtype.I32, (valtype_numtype nt)], [])))
   | load (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (sx : (Option Sx)) (t : Valtype) :
     ((C.MEM.get! 0) == mt) ->
-    ((((Nat.pow 2) n_A)) <= (((Nat.div (size t)) 8))) ->
-    (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div (size t)) 8)))) ->
+    ((((Nat.pow 2) n_A)) <= (((Nat.div (size_f t)) 8))) ->
+    (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div (size_f t)) 8)))) ->
     ((n == none) || (nt == (numtype_in «in»))) ->
     (Instr_ok (C, (Instr.LOAD (nt, (n, sx) /- ? -/, n_A, n_O)), ([Valtype.I32], [(valtype_numtype nt)])))
   | data_drop (C : Context) (x : Idx) :
@@ -521,14 +521,14 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (Instr_ok (C, (Instr.CVTOP ((numtype_fn fn_1), Cvtop.CONVERT, (numtype_fn fn_2), none)), ([(valtype_fn fn_2)], [(valtype_fn fn_1)])))
   | convert_i (C : Context) (in_1 : In) (in_2 : In) (sx : (Option Sx)) :
     (in_1 != in_2) ->
-    ((sx == none) = ((size (valtype_in in_1)) > (size (valtype_in in_2)))) ->
+    ((sx == none) = ((size_f (valtype_in in_1)) > (size_f (valtype_in in_2)))) ->
     (Instr_ok (C, (Instr.CVTOP ((numtype_in in_1), Cvtop.CONVERT, (numtype_in in_2), sx)), ([(valtype_in in_2)], [(valtype_in in_1)])))
   | reinterpret (C : Context) (nt_1 : Numtype) (nt_2 : Numtype) :
     (nt_1 != nt_2) ->
-    ((size (valtype_numtype nt_1)) == (size (valtype_numtype nt_2))) ->
+    ((size_f (valtype_numtype nt_1)) == (size_f (valtype_numtype nt_2))) ->
     (Instr_ok (C, (Instr.CVTOP (nt_1, Cvtop.REINTERPRET, nt_2, none)), ([(valtype_numtype nt_2)], [(valtype_numtype nt_1)])))
   | extend (C : Context) (n : N) (nt : Numtype) :
-    (n <= (size (valtype_numtype nt))) ->
+    (n <= (size_f (valtype_numtype nt))) ->
     (Instr_ok (C, (Instr.EXTEND (nt, n)), ([(valtype_numtype nt)], [(valtype_numtype nt)])))
   | relop (C : Context) (nt : Numtype) (relop : Relop_numtype) :
     (Instr_ok (C, (Instr.RELOP (nt, relop)), ([(valtype_numtype nt), (valtype_numtype nt)], [Valtype.I32])))
@@ -756,10 +756,10 @@ inductive Val where
  | REF_HOST_ADDR : Hostaddr -> Val
   deriving Inhabited, BEq
 
-def val_num : Num -> Val
+def val_num_f : Num -> Val
   | (Num.CONST x) => (Val.CONST x)
 
-def val_ref : Ref -> Val
+def val_ref_f : Ref -> Val
   | (Ref.REF_NULL x) => (Val.REF_NULL x)
   | (Ref.REF_FUNC_ADDR x) => (Val.REF_FUNC_ADDR x)
   | (Ref.REF_HOST_ADDR x) => (Val.REF_HOST_ADDR x)
@@ -776,7 +776,7 @@ inductive Externval where
  | MEM : Memaddr -> Externval
   deriving Inhabited, BEq
 
-def default_ : Valtype -> Val
+def default__f : Valtype -> Val
   | Valtype.EXTERNREF => (Val.REF_NULL Reftype.EXTERNREF)
   | Valtype.FUNCREF => (Val.REF_NULL Reftype.FUNCREF)
   | Valtype.F64 => (Val.CONST (Numtype.F64, 0))
@@ -902,7 +902,7 @@ inductive Admininstr where
  | TRAP : Admininstr
   deriving Inhabited, BEq
 
-def admininstr_instr : Instr -> Admininstr
+def admininstr_instr_f : Instr -> Admininstr
   | Instr.UNREACHABLE => Admininstr.UNREACHABLE
   | Instr.NOP => Admininstr.NOP
   | Instr.DROP => Admininstr.DROP
@@ -948,59 +948,59 @@ def admininstr_instr : Instr -> Admininstr
   | (Instr.LOAD x) => (Admininstr.LOAD x)
   | (Instr.STORE x) => (Admininstr.STORE x)
 
-def admininstr_val : Val -> Admininstr
+def admininstr_val_f : Val -> Admininstr
   | (Val.CONST x) => (Admininstr.CONST x)
   | (Val.REF_NULL x) => (Admininstr.REF_NULL x)
   | (Val.REF_FUNC_ADDR x) => (Admininstr.REF_FUNC_ADDR x)
   | (Val.REF_HOST_ADDR x) => (Admininstr.REF_HOST_ADDR x)
 
-def admininstr_ref : Ref -> Admininstr
+def admininstr_ref_f : Ref -> Admininstr
   | (Ref.REF_NULL x) => (Admininstr.REF_NULL x)
   | (Ref.REF_FUNC_ADDR x) => (Admininstr.REF_FUNC_ADDR x)
   | (Ref.REF_HOST_ADDR x) => (Admininstr.REF_HOST_ADDR x)
 
 @[reducible] def Config := /- mixop: `%;%*` -/ (State × (List Admininstr))
 
-def funcaddr : State -> (List Funcaddr)
+def funcaddr_f : State -> (List Funcaddr)
   | (s, f) => f.MODULE.FUNC
 
-def funcinst : State -> (List Funcinst)
+def funcinst_f : State -> (List Funcinst)
   | (s, f) => s.FUNC
 
-def func : (State × Funcidx) -> Funcinst
+def func_f : (State × Funcidx) -> Funcinst
   | ((s, f), x) => (s.FUNC.get! (f.MODULE.FUNC.get! x))
 
-def «global» : (State × Globalidx) -> Globalinst
+def global_f : (State × Globalidx) -> Globalinst
   | ((s, f), x) => (s.GLOBAL.get! (f.MODULE.GLOBAL.get! x))
 
-def table : (State × Tableidx) -> Tableinst
+def table_f : (State × Tableidx) -> Tableinst
   | ((s, f), x) => (s.TABLE.get! (f.MODULE.TABLE.get! x))
 
-def mem : (State × Memidx) -> Meminst
+def mem_f : (State × Memidx) -> Meminst
   | ((s, f), x) => (s.MEM.get! (f.MODULE.MEM.get! x))
 
-def elem : (State × Tableidx) -> Eleminst
+def elem_f : (State × Tableidx) -> Eleminst
   | ((s, f), x) => (s.ELEM.get! (f.MODULE.ELEM.get! x))
 
-def data : (State × Dataidx) -> Datainst
+def data_f : (State × Dataidx) -> Datainst
   | ((s, f), x) => (s.DATA.get! (f.MODULE.DATA.get! x))
 
-def «local» : (State × Localidx) -> Val
+def local_f : (State × Localidx) -> Val
   | ((s, f), x) => (f.LOCAL.get! x)
 
-def with_local : (State × Localidx × Val) -> State
+def with_local_f : (State × Localidx × Val) -> State
   | ((s, f), x, v) => (s, default /- f[LOCAL[x] = v] -/)
 
-def with_global : (State × Globalidx × Val) -> State
+def with_global_f : (State × Globalidx × Val) -> State
   | ((s, f), x, v) => (default /- s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v] -/, f)
 
-def with_table : (State × Tableidx × N × Ref) -> State
+def with_table_f : (State × Tableidx × N × Ref) -> State
   | ((s, f), x, i, r) => (default /- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r] -/, f)
 
-def with_tableext : (State × Tableidx × (List Ref)) -> State
+def with_tableext_f : (State × Tableidx × (List Ref)) -> State
   | ((s, f), x, r) => (default /- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*] -/, f)
 
-def with_elem : (State × Elemidx × (List Ref)) -> State
+def with_elem_f : (State × Elemidx × (List Ref)) -> State
   | ((s, f), x, r) => (default /- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*] -/, f)
 
 inductive E where
@@ -1009,17 +1009,17 @@ inductive E where
  | LABEL_ : (N × (List Instr) × E) -> E
   deriving Inhabited, BEq
 
-def unop : (Unop_numtype × Numtype × C_numtype) -> (List C_numtype)
+def unop_f : (Unop_numtype × Numtype × C_numtype) -> (List C_numtype) := default
 
-def binop : (Binop_numtype × Numtype × C_numtype × C_numtype) -> (List C_numtype)
+def binop_f : (Binop_numtype × Numtype × C_numtype × C_numtype) -> (List C_numtype) := default
 
-def testop : (Testop_numtype × Numtype × C_numtype) -> C_numtype
+def testop_f : (Testop_numtype × Numtype × C_numtype) -> C_numtype := default
 
-def relop : (Relop_numtype × Numtype × C_numtype × C_numtype) -> C_numtype
+def relop_f : (Relop_numtype × Numtype × C_numtype × C_numtype) -> C_numtype := default
 
-def ext : (Nat × Nat × Sx × C_numtype) -> C_numtype
+def ext_f : (Nat × Nat × Sx × C_numtype) -> C_numtype := default
 
-def cvtop : (Numtype × Cvtop × Numtype × (Option Sx) × C_numtype) -> (List C_numtype)
+def cvtop_f : (Numtype × Cvtop × Numtype × (Option Sx) × C_numtype) -> (List C_numtype) := default
 
 inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
   | local_tee (val : Val) (x : Idx) :
@@ -1031,30 +1031,30 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (val == (Val.REF_NULL rt)) ->
     (Step_pure ([(admininstr_val val), Admininstr.REF_IS_NULL], [(Admininstr.CONST (Numtype.I32, 1))]))
   | cvtop_trap (c_1 : C_numtype) (cvtop : Cvtop) (nt : Numtype) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) :
-    ((cvtop (nt_1, cvtop, nt_2, sx, c_1)) == []) ->
+    ((cvtop_f (nt_1, cvtop, nt_2, sx, c_1)) == []) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CVTOP (nt_1, cvtop, nt_2, sx))], [Admininstr.TRAP]))
   | cvtop_val (c : C_numtype) (c_1 : C_numtype) (cvtop : Cvtop) (nt : Numtype) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) :
-    ((cvtop (nt_1, cvtop, nt_2, sx, c_1)) == [c]) ->
+    ((cvtop_f (nt_1, cvtop, nt_2, sx, c_1)) == [c]) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CVTOP (nt_1, cvtop, nt_2, sx))], [(Admininstr.CONST (nt, c))]))
   | extend (c : C_numtype) (n : N) (nt : Numtype) :
-    (Step_pure ([(Admininstr.CONST (nt, c)), (Admininstr.EXTEND (nt, n))], [(Admininstr.CONST (nt, (ext (n, (size (valtype_numtype nt)), Sx.S, c))))]))
+    (Step_pure ([(Admininstr.CONST (nt, c)), (Admininstr.EXTEND (nt, n))], [(Admininstr.CONST (nt, (ext_f (n, (size_f (valtype_numtype nt)), Sx.S, c))))]))
   | relop (c : C_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) (relop : Relop_numtype) :
-    (c == (relop (relop, nt, c_1, c_2))) ->
+    (c == (relop_f (relop, nt, c_1, c_2))) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.RELOP (nt, relop))], [(Admininstr.CONST (Numtype.I32, c))]))
   | testop (c : C_numtype) (c_1 : C_numtype) (nt : Numtype) (testop : Testop_numtype) :
-    (c == (testop (testop, nt, c_1))) ->
+    (c == (testop_f (testop, nt, c_1))) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.TESTOP (nt, testop))], [(Admininstr.CONST (Numtype.I32, c))]))
   | binop_trap (binop : Binop_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) :
-    ((binop (binop, nt, c_1, c_2)) == []) ->
+    ((binop_f (binop, nt, c_1, c_2)) == []) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.BINOP (nt, binop))], [Admininstr.TRAP]))
   | binop_val (binop : Binop_numtype) (c : C_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) :
-    ((binop (binop, nt, c_1, c_2)) == [c]) ->
+    ((binop_f (binop, nt, c_1, c_2)) == [c]) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.BINOP (nt, binop))], [(Admininstr.CONST (nt, c))]))
   | unop_trap (c_1 : C_numtype) (nt : Numtype) (unop : Unop_numtype) :
-    ((unop (unop, nt, c_1)) == []) ->
+    ((unop_f (unop, nt, c_1)) == []) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.UNOP (nt, unop))], [Admininstr.TRAP]))
   | unop_val (c : C_numtype) (c_1 : C_numtype) (nt : Numtype) (unop : Unop_numtype) :
-    ((unop (unop, nt, c_1)) == [c]) ->
+    ((unop_f (unop, nt, c_1)) == [c]) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.UNOP (nt, unop))], [(Admininstr.CONST (nt, c))]))
   | return_label (instr : (List Instr)) (instr' : (List Instr)) (k : Nat) (val : (List Val)) :
     (Step_pure ([(Admininstr.LABEL_ (k, instr', ((admininstr_val val) /- * -/ ++ ([Admininstr.RETURN] ++ (admininstr_instr instr) /- * -/))))], ((admininstr_val val) /- * -/ ++ [Admininstr.RETURN])))
@@ -1108,13 +1108,13 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
 inductive Step_read : (Config × (List Admininstr)) -> Prop where
   | table_init_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     True /- Else? -/ ->
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), [(Admininstr.CONST (Numtype.I32, j)), (admininstr_ref ((elem (z, y)).get! i)), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_INIT (x, y))]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), [(Admininstr.CONST (Numtype.I32, j)), (admininstr_ref ((elem_f (z, y)).get! i)), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_INIT (x, y))]))
   | table_init_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     True /- Else? -/ ->
     (n == 0) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), []))
   | table_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (((i + n) > (elem (z, y)).length) || ((j + n) > (table (z, x)).length)) ->
+    (((i + n) > (elem_f (z, y)).length) || ((j + n) > (table_f (z, x)).length)) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), [Admininstr.TRAP]))
   | table_copy_gt (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     True /- Else? -/ ->
@@ -1128,7 +1128,7 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (n == 0) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]), []))
   | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (((i + n) > (table (z, y)).length) || ((j + n) > (table (z, x)).length)) ->
+    (((i + n) > (table_f (z, y)).length) || ((j + n) > (table_f (z, x)).length)) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]), [Admininstr.TRAP]))
   | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
     True /- Else? -/ ->
@@ -1138,54 +1138,54 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (n == 0) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_val val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), []))
   | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    ((i + n) > (table (z, x)).length) ->
+    ((i + n) > (table_f (z, x)).length) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_val val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), [Admininstr.TRAP]))
   | table_grow_fail (n : N) (x : Idx) (z : State) :
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), [(Admininstr.CONST (Numtype.I32, default /- - 1 -/))]))
   | table_size (n : N) (x : Idx) (z : State) :
-    ((table (z, x)).length == n) ->
+    ((table_f (z, x)).length == n) ->
     (Step_read ((z, [(Admininstr.TABLE_SIZE x)]), [(Admininstr.CONST (Numtype.I32, n))]))
   | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) :
-    (i >= (table (z, x)).length) ->
+    (i >= (table_f (z, x)).length) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_ref ref), (Admininstr.TABLE_GET x)]), [Admininstr.TRAP]))
   | table_get_val (i : Nat) (x : Idx) (z : State) :
-    (i < (table (z, x)).length) ->
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]), [(admininstr_ref ((table (z, x)).get! i))]))
+    (i < (table_f (z, x)).length) ->
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]), [(admininstr_ref ((table_f (z, x)).get! i))]))
   | table_get_trap (i : Nat) (x : Idx) (z : State) :
-    (i >= (table (z, x)).length) ->
+    (i >= (table_f (z, x)).length) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]), [Admininstr.TRAP]))
   | global_get (x : Idx) (z : State) :
-    (Step_read ((z, [(Admininstr.GLOBAL_GET x)]), [(admininstr_globalinst («global» (z, x)))]))
+    (Step_read ((z, [(Admininstr.GLOBAL_GET x)]), [(admininstr_globalinst (global_f (z, x)))]))
   | local_get (x : Idx) (z : State) :
-    (Step_read ((z, [(Admininstr.LOCAL_GET x)]), [(admininstr_val («local» (z, x)))]))
+    (Step_read ((z, [(Admininstr.LOCAL_GET x)]), [(admininstr_val (local_f (z, x)))]))
   | ref_func (x : Idx) (z : State) :
-    (Step_read ((z, [(Admininstr.REF_FUNC x)]), [(Admininstr.REF_FUNC_ADDR ((funcaddr z).get! x))]))
+    (Step_read ((z, [(Admininstr.REF_FUNC x)]), [(Admininstr.REF_FUNC_ADDR ((funcaddr_f z).get! x))]))
   | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
-    (((funcinst z).get! a) == (m, ((t_1, t_2), t, instr))) ->
-    (f == {LOCAL := (val ++ (default_ t) /- * -/), MODULE := m}) ->
+    (((funcinst_f z).get! a) == (m, ((t_1, t_2), t, instr))) ->
+    (f == {LOCAL := (val ++ (default__f t) /- * -/), MODULE := m}) ->
     (Step_read ((z, ((admininstr_val val) /- ^k -/ ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, f, [(Admininstr.LABEL_ (n, [], (admininstr_instr instr) /- * -/))]))]))
   | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
     True /- Else? -/ ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [Admininstr.TRAP]))
   | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
-    (((table (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
-    (((funcinst z).get! a) == (m, func)) ->
+    (((table_f (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
+    (((funcinst_f z).get! a) == (m, func)) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [(Admininstr.CALL_ADDR a)]))
   | call (x : Idx) (z : State) :
-    (Step_read ((z, [(Admininstr.CALL x)]), [(Admininstr.CALL_ADDR ((funcaddr z).get! x))]))
+    (Step_read ((z, [(Admininstr.CALL x)]), [(Admininstr.CALL_ADDR ((funcaddr_f z).get! x))]))
 
 inductive Step : (Config × Config) -> Prop where
   | elem_drop (x : Idx) (z : State) :
-    (Step ((z, [(Admininstr.ELEM_DROP x)]), ((with_elem (z, x, [])), [])))
+    (Step ((z, [(Admininstr.ELEM_DROP x)]), ((with_elem_f (z, x, [])), [])))
   | table_grow_succeed (n : N) (ref : Ref) (x : Idx) (z : State) :
-    (Step ((z, [(admininstr_ref ref), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), ((with_tableext (z, x, ref)), [(Admininstr.CONST (Numtype.I32, (table (z, x)).length))])))
+    (Step ((z, [(admininstr_ref ref), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), ((with_tableext_f (z, x, ref)), [(Admininstr.CONST (Numtype.I32, (table_f (z, x)).length))])))
   | table_set_val (i : Nat) (ref : Ref) (x : Idx) (z : State) :
-    (i < (table (z, x)).length) ->
-    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_ref ref), (Admininstr.TABLE_GET x)]), ((with_table (z, x, i, ref)), [])))
+    (i < (table_f (z, x)).length) ->
+    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_ref ref), (Admininstr.TABLE_GET x)]), ((with_table_f (z, x, i, ref)), [])))
   | global_set (val : Val) (x : Idx) (z : State) :
-    (Step ((z, [(admininstr_val val), (Admininstr.GLOBAL_SET x)]), ((with_global (z, x, val)), [])))
+    (Step ((z, [(admininstr_val val), (Admininstr.GLOBAL_SET x)]), ((with_global_f (z, x, val)), [])))
   | local_set (val : Val) (x : Idx) (z : State) :
-    (Step ((z, [(admininstr_val val), (Admininstr.LOCAL_SET x)]), ((with_local (z, x, val)), [])))
+    (Step ((z, [(admininstr_val val), (Admininstr.LOCAL_SET x)]), ((with_local_f (z, x, val)), [])))
   | read (instr : (List Instr)) (instr' : (List Instr)) (z : State) :
     (Step_read ((z, (admininstr_instr instr) /- * -/), (admininstr_instr instr') /- * -/)) ->
     (Step ((z, (admininstr_instr instr) /- * -/), (z, (admininstr_instr instr') /- * -/)))
@@ -1222,6 +1222,10 @@ SpecTec.lean: error: function expected at
   numtype_in
 term has type
   ?m.72247
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.72553
 SpecTec.lean: error: application type mismatch
   Nat.div n
 argument
@@ -1249,61 +1253,153 @@ but is expected to have type
 SpecTec.lean: error: function expected at
   numtype_in
 term has type
-  ?m.72849
+  ?m.73168
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.73618
+SpecTec.lean: error: function expected at
+  valtype_reftype
+term has type
+  ?m.74881
+SpecTec.lean: error: function expected at
+  valtype_reftype
+term has type
+  ?m.75018
+SpecTec.lean: error: function expected at
+  valtype_reftype
+term has type
+  ?m.75212
+SpecTec.lean: error: function expected at
+  valtype_reftype
+term has type
+  ?m.75351
 SpecTec.lean: error: type mismatch
   ((), t)
 has type
   Unit × Valtype : Type
 but is expected to have type
   Globaltype : Type
+SpecTec.lean: error: function expected at
+  valtype_reftype
+term has type
+  ?m.76088
+SpecTec.lean: error: function expected at
+  valtype_reftype
+term has type
+  ?m.76238
 SpecTec.lean: error: function expected at
   numtype_fn
 term has type
-  ?m.75195
+  ?m.76329
 SpecTec.lean: error: function expected at
   numtype_fn
 term has type
-  ?m.75195
+  ?m.76329
 SpecTec.lean: error: function expected at
   valtype_fn
 term has type
-  ?m.75260
+  ?m.76394
 SpecTec.lean: error: function expected at
   valtype_fn
 term has type
-  ?m.75260
+  ?m.76394
 SpecTec.lean: error: function expected at
   valtype_in
 term has type
-  ?m.75476
+  ?m.76610
 SpecTec.lean: error: function expected at
   valtype_in
 term has type
-  ?m.75476
+  ?m.76610
 SpecTec.lean: error: function expected at
   numtype_in
 term has type
-  ?m.75775
+  ?m.76909
 SpecTec.lean: error: function expected at
   numtype_in
 term has type
-  ?m.75775
+  ?m.76909
 SpecTec.lean: error: function expected at
   valtype_in
 term has type
-  ?m.75476
+  ?m.76610
 SpecTec.lean: error: function expected at
   valtype_in
 term has type
-  ?m.75476
+  ?m.76610
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.77363
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.77363
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.77363
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.77363
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.77531
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.77531
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.77531
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.77650
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.77650
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.77746
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.77825
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.77825
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.77825
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.77936
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.77936
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.78032
 SpecTec.lean: error: function expected at
   valtype_resulttype
 term has type
-  ?m.76805
+  ?m.78384
 SpecTec.lean: error: function expected at
   valtype_resulttype
 term has type
-  ?m.76805
+  ?m.78384
 SpecTec.lean: error: application type mismatch
   (t_1, t_2)
 argument
@@ -1352,6 +1448,14 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
+SpecTec.lean: error: function expected at
+  valtype_numtype
+term has type
+  ?m.79302
+SpecTec.lean: error: function expected at
+  valtype_vectype
+term has type
+  ?m.79330
 SpecTec.lean: error: application type mismatch
   Prod.mk t'_1
 argument
@@ -1361,7 +1465,7 @@ has type
 but is expected to have type
   List Valtype : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Instr) Instr ?m.78392
+  HAppend (List Instr) Instr ?m.80059
 SpecTec.lean: error: application type mismatch
   (C, instr)
 argument
@@ -1392,6 +1496,10 @@ has type
   Option Elemmode : Type
 but is expected to have type
   Elemmode : Type
+SpecTec.lean: error: function expected at
+  valtype_reftype
+term has type
+  ?m.99302
 SpecTec.lean: error: application type mismatch
   (C, datamode)
 argument
@@ -1481,272 +1589,200 @@ SpecTec.lean: warning: unused variable `r` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `r` [linter.unusedVariables]
-SpecTec.lean: error: expected ':=', 'where' or '|'
-SpecTec.lean: error: expected ':=', 'where' or '|'
-SpecTec.lean: error: expected ':=', 'where' or '|'
-SpecTec.lean: error: expected ':=', 'where' or '|'
-SpecTec.lean: error: expected ':=', 'where' or '|'
-SpecTec.lean: error: expected ':=', 'where' or '|'
 SpecTec.lean: error: function expected at
-  cvtop
+  admininstr_val
 term has type
-  Cvtop
+  ?m.180557
 SpecTec.lean: error: function expected at
-  cvtop
+  admininstr_val
 term has type
-  Cvtop
+  ?m.180557
 SpecTec.lean: error: function expected at
-  relop
+  admininstr_val
 term has type
-  Relop_numtype
+  ?m.180557
 SpecTec.lean: error: function expected at
-  testop
+  admininstr_val
 term has type
-  Testop_numtype
+  ?m.180643
 SpecTec.lean: error: function expected at
-  binop
+  admininstr_val
 term has type
-  Binop_numtype
+  ?m.180732
 SpecTec.lean: error: function expected at
-  binop
+  valtype_numtype
 term has type
-  Binop_numtype
+  ?m.181062
 SpecTec.lean: error: function expected at
-  unop
+  admininstr_val
 term has type
-  Unop_numtype
+  ?m.181652
 SpecTec.lean: error: function expected at
-  unop
+  admininstr_instr
 term has type
-  Unop_numtype
-SpecTec.lean: error: application type mismatch
-  admininstr_val val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Admininstr) Admininstr ?m.178901
-SpecTec.lean: error: application type mismatch
-  admininstr_val val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr (List Admininstr) ?m.179108
-SpecTec.lean: error: application type mismatch
-  admininstr_val val'
-argument
-  val'
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_val val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Admininstr) Admininstr ?m.179627
-SpecTec.lean: error: application type mismatch
-  admininstr_val val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_val val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_val val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_val val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Admininstr) Admininstr ?m.180531
-SpecTec.lean: error: application type mismatch
-  admininstr_val val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr (List Admininstr) ?m.180738
-SpecTec.lean: error: application type mismatch
-  admininstr_val val'
-argument
-  val'
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_val val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Admininstr) Admininstr ?m.181264
-SpecTec.lean: error: application type mismatch
-  admininstr_val val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_instr instr'
-argument
-  instr'
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr Admininstr ?m.181559
-SpecTec.lean: error: application type mismatch
-  admininstr_val val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_val val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_val val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr (List Admininstr) ?m.182200
-SpecTec.lean: error: application type mismatch
-  admininstr_val val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr Admininstr ?m.182511
-SpecTec.lean: error: application type mismatch
-  admininstr_val val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr (List Admininstr) ?m.182868
-SpecTec.lean: error: application type mismatch
-  admininstr_val val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr Admininstr ?m.183173
+  ?m.181694
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.181652
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.181907
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.181907
+SpecTec.lean: error: function expected at
+  admininstr_instr
+term has type
+  ?m.181957
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.181907
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.182160
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.182160
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.182470
+SpecTec.lean: error: function expected at
+  admininstr_instr
+term has type
+  ?m.182561
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.182470
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.182798
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.182798
+SpecTec.lean: error: function expected at
+  admininstr_instr
+term has type
+  ?m.182854
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.182798
+SpecTec.lean: error: function expected at
+  admininstr_instr
+term has type
+  ?m.182854
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.183104
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.183104
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.183382
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.183382
+SpecTec.lean: error: function expected at
+  admininstr_instr
+term has type
+  ?m.183487
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.183720
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.183720
+SpecTec.lean: error: function expected at
+  admininstr_instr
+term has type
+  ?m.183819
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.184044
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.184044
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.184044
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.184206
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.184206
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.184206
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.184332
+SpecTec.lean: error: function expected at
+  admininstr_ref
+term has type
+  ?m.184640
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.186018
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.186018
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.186018
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.186270
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.186432
+SpecTec.lean: error: function expected at
+  admininstr_ref
+term has type
+  ?m.186720
+SpecTec.lean: error: function expected at
+  admininstr_ref
+term has type
+  ?m.186833
 SpecTec.lean: error: function expected at
   admininstr_globalinst
 term has type
-  ?m.185503
+  ?m.186968
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.187030
 SpecTec.lean: error: application type mismatch
-  default_ t
+  default__f t
 argument
   t
 has type
@@ -1754,25 +1790,15 @@ has type
 but is expected to have type
   Valtype : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Val) Val ?m.186077
-SpecTec.lean: error: application type mismatch
-  admininstr_val val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr (List Admininstr) ?m.186395
-SpecTec.lean: error: application type mismatch
-  admininstr_instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
+  HAppend (List Val) Val ?m.188431
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.187612
+SpecTec.lean: error: function expected at
+  admininstr_instr
+term has type
+  ?m.188071
 SpecTec.lean: error: application type mismatch
   (x, ref)
 argument
@@ -1781,68 +1807,52 @@ has type
   Ref : Type
 but is expected to have type
   List Ref : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_instr instr'
-argument
-  instr'
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_instr instr'
-argument
-  instr'
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_instr instr'
-argument
-  instr'
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_instr instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  admininstr_instr instr'
-argument
-  instr'
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
+SpecTec.lean: error: function expected at
+  admininstr_ref
+term has type
+  ?m.188974
+SpecTec.lean: error: function expected at
+  admininstr_ref
+term has type
+  ?m.189206
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.189310
+SpecTec.lean: error: function expected at
+  admininstr_val
+term has type
+  ?m.189385
+SpecTec.lean: error: function expected at
+  admininstr_instr
+term has type
+  ?m.189471
+SpecTec.lean: error: function expected at
+  admininstr_instr
+term has type
+  ?m.189471
+SpecTec.lean: error: function expected at
+  admininstr_instr
+term has type
+  ?m.189471
+SpecTec.lean: error: function expected at
+  admininstr_instr
+term has type
+  ?m.189471
+SpecTec.lean: error: function expected at
+  admininstr_instr
+term has type
+  ?m.189618
+SpecTec.lean: error: function expected at
+  admininstr_instr
+term has type
+  ?m.189618
+SpecTec.lean: error: function expected at
+  admininstr_instr
+term has type
+  ?m.189618
+SpecTec.lean: error: function expected at
+  admininstr_instr
+term has type
+  ?m.189618
 ```

From b44d2bcff19e929ea1717a4bd4cf758d83239314 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Thu, 6 Apr 2023 12:00:12 +0200
Subject: [PATCH 36/98] Escape functions differently

---
 spectec/src/backend-lean4/gen.ml |   2 +-
 spectec/test-lean4/TEST.md       | 144 +++++++++++++++----------------
 2 files changed, 73 insertions(+), 73 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 3d0b627d0d..9a09cc84e1 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -32,7 +32,7 @@ let make_id s = match s with
 
 let render_id (id : id) = make_id id.it
 
-let render_fun_id (id : id) = make_id (id.it ^ "_f") (* Hack to namespace the functions *)
+let render_fun_id (id : id) = "«$" ^ id.it ^ "»"
 
 let render_rule_name _qual _ty_id (rule_id : id) (i : int) :  string =
   if rule_id.it = ""
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index e7e4755cf9..03060e6995 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -61,16 +61,16 @@ inductive Valtype where
  | BOT : Valtype
   deriving Inhabited, BEq
 
-def valtype_numtype_f : Numtype -> Valtype
+def «$valtype_numtype» : Numtype -> Valtype
   | Numtype.I32 => Valtype.I32
   | Numtype.I64 => Valtype.I64
   | Numtype.F32 => Valtype.F32
   | Numtype.F64 => Valtype.F64
 
-def valtype_vectype_f : Vectype -> Valtype
+def «$valtype_vectype» : Vectype -> Valtype
   | Vectype.V128 => Valtype.V128
 
-def valtype_reftype_f : Reftype -> Valtype
+def «$valtype_reftype» : Reftype -> Valtype
   | Reftype.FUNCREF => Valtype.FUNCREF
   | Reftype.EXTERNREF => Valtype.EXTERNREF
 
@@ -294,7 +294,7 @@ inductive Externuse where
 
 @[reducible] def Module := /- mixop: `MODULE%*%*%*%*%*%*%*%*%*` -/ ((List Import) × (List Func) × (List Global) × (List Table) × (List Mem) × (List Elem) × (List Data) × (List Start) × (List Export))
 
-def size_f : Valtype -> Nat
+def «$size» : Valtype -> Nat
   | Valtype.V128 => 128
   | Valtype.F64 => 64
   | Valtype.F32 => 32
@@ -302,10 +302,10 @@ def size_f : Valtype -> Nat
   | Valtype.I32 => 32
   | _ => default
 
-def test_sub_ATOM_22_f : N -> Nat
+def «$test_sub_ATOM_22» : N -> Nat
   | n_3_ATOM_y => 0
 
-def curried__f : (N × N) -> Nat
+def «$curried_» : (N × N) -> Nat
   | (n_1, n_2) => (n_1 + n_2)
 
 inductive Testfuse where
@@ -439,14 +439,14 @@ mutual
 inductive Instr_ok : (Context × Instr × Functype) -> Prop where
   | store (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (t : Valtype) :
     ((C.MEM.get! 0) == mt) ->
-    ((((Nat.pow 2) n_A)) <= (((Nat.div (size_f t)) 8))) ->
-    (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div (size_f t)) 8)))) ->
+    ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» t)) 8))) ->
+    (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» t)) 8)))) ->
     ((n == none) || (nt == (numtype_in «in»))) ->
     (Instr_ok (C, (Instr.STORE (nt, n, n_A, n_O)), ([Valtype.I32, (valtype_numtype nt)], [])))
   | load (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (sx : (Option Sx)) (t : Valtype) :
     ((C.MEM.get! 0) == mt) ->
-    ((((Nat.pow 2) n_A)) <= (((Nat.div (size_f t)) 8))) ->
-    (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div (size_f t)) 8)))) ->
+    ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» t)) 8))) ->
+    (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» t)) 8)))) ->
     ((n == none) || (nt == (numtype_in «in»))) ->
     (Instr_ok (C, (Instr.LOAD (nt, (n, sx) /- ? -/, n_A, n_O)), ([Valtype.I32], [(valtype_numtype nt)])))
   | data_drop (C : Context) (x : Idx) :
@@ -521,14 +521,14 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (Instr_ok (C, (Instr.CVTOP ((numtype_fn fn_1), Cvtop.CONVERT, (numtype_fn fn_2), none)), ([(valtype_fn fn_2)], [(valtype_fn fn_1)])))
   | convert_i (C : Context) (in_1 : In) (in_2 : In) (sx : (Option Sx)) :
     (in_1 != in_2) ->
-    ((sx == none) = ((size_f (valtype_in in_1)) > (size_f (valtype_in in_2)))) ->
+    ((sx == none) = ((«$size» (valtype_in in_1)) > («$size» (valtype_in in_2)))) ->
     (Instr_ok (C, (Instr.CVTOP ((numtype_in in_1), Cvtop.CONVERT, (numtype_in in_2), sx)), ([(valtype_in in_2)], [(valtype_in in_1)])))
   | reinterpret (C : Context) (nt_1 : Numtype) (nt_2 : Numtype) :
     (nt_1 != nt_2) ->
-    ((size_f (valtype_numtype nt_1)) == (size_f (valtype_numtype nt_2))) ->
+    ((«$size» (valtype_numtype nt_1)) == («$size» (valtype_numtype nt_2))) ->
     (Instr_ok (C, (Instr.CVTOP (nt_1, Cvtop.REINTERPRET, nt_2, none)), ([(valtype_numtype nt_2)], [(valtype_numtype nt_1)])))
   | extend (C : Context) (n : N) (nt : Numtype) :
-    (n <= (size_f (valtype_numtype nt))) ->
+    (n <= («$size» (valtype_numtype nt))) ->
     (Instr_ok (C, (Instr.EXTEND (nt, n)), ([(valtype_numtype nt)], [(valtype_numtype nt)])))
   | relop (C : Context) (nt : Numtype) (relop : Relop_numtype) :
     (Instr_ok (C, (Instr.RELOP (nt, relop)), ([(valtype_numtype nt), (valtype_numtype nt)], [Valtype.I32])))
@@ -756,10 +756,10 @@ inductive Val where
  | REF_HOST_ADDR : Hostaddr -> Val
   deriving Inhabited, BEq
 
-def val_num_f : Num -> Val
+def «$val_num» : Num -> Val
   | (Num.CONST x) => (Val.CONST x)
 
-def val_ref_f : Ref -> Val
+def «$val_ref» : Ref -> Val
   | (Ref.REF_NULL x) => (Val.REF_NULL x)
   | (Ref.REF_FUNC_ADDR x) => (Val.REF_FUNC_ADDR x)
   | (Ref.REF_HOST_ADDR x) => (Val.REF_HOST_ADDR x)
@@ -776,7 +776,7 @@ inductive Externval where
  | MEM : Memaddr -> Externval
   deriving Inhabited, BEq
 
-def default__f : Valtype -> Val
+def «$default_» : Valtype -> Val
   | Valtype.EXTERNREF => (Val.REF_NULL Reftype.EXTERNREF)
   | Valtype.FUNCREF => (Val.REF_NULL Reftype.FUNCREF)
   | Valtype.F64 => (Val.CONST (Numtype.F64, 0))
@@ -902,7 +902,7 @@ inductive Admininstr where
  | TRAP : Admininstr
   deriving Inhabited, BEq
 
-def admininstr_instr_f : Instr -> Admininstr
+def «$admininstr_instr» : Instr -> Admininstr
   | Instr.UNREACHABLE => Admininstr.UNREACHABLE
   | Instr.NOP => Admininstr.NOP
   | Instr.DROP => Admininstr.DROP
@@ -948,59 +948,59 @@ def admininstr_instr_f : Instr -> Admininstr
   | (Instr.LOAD x) => (Admininstr.LOAD x)
   | (Instr.STORE x) => (Admininstr.STORE x)
 
-def admininstr_val_f : Val -> Admininstr
+def «$admininstr_val» : Val -> Admininstr
   | (Val.CONST x) => (Admininstr.CONST x)
   | (Val.REF_NULL x) => (Admininstr.REF_NULL x)
   | (Val.REF_FUNC_ADDR x) => (Admininstr.REF_FUNC_ADDR x)
   | (Val.REF_HOST_ADDR x) => (Admininstr.REF_HOST_ADDR x)
 
-def admininstr_ref_f : Ref -> Admininstr
+def «$admininstr_ref» : Ref -> Admininstr
   | (Ref.REF_NULL x) => (Admininstr.REF_NULL x)
   | (Ref.REF_FUNC_ADDR x) => (Admininstr.REF_FUNC_ADDR x)
   | (Ref.REF_HOST_ADDR x) => (Admininstr.REF_HOST_ADDR x)
 
 @[reducible] def Config := /- mixop: `%;%*` -/ (State × (List Admininstr))
 
-def funcaddr_f : State -> (List Funcaddr)
+def «$funcaddr» : State -> (List Funcaddr)
   | (s, f) => f.MODULE.FUNC
 
-def funcinst_f : State -> (List Funcinst)
+def «$funcinst» : State -> (List Funcinst)
   | (s, f) => s.FUNC
 
-def func_f : (State × Funcidx) -> Funcinst
+def «$func» : (State × Funcidx) -> Funcinst
   | ((s, f), x) => (s.FUNC.get! (f.MODULE.FUNC.get! x))
 
-def global_f : (State × Globalidx) -> Globalinst
+def «$global» : (State × Globalidx) -> Globalinst
   | ((s, f), x) => (s.GLOBAL.get! (f.MODULE.GLOBAL.get! x))
 
-def table_f : (State × Tableidx) -> Tableinst
+def «$table» : (State × Tableidx) -> Tableinst
   | ((s, f), x) => (s.TABLE.get! (f.MODULE.TABLE.get! x))
 
-def mem_f : (State × Memidx) -> Meminst
+def «$mem» : (State × Memidx) -> Meminst
   | ((s, f), x) => (s.MEM.get! (f.MODULE.MEM.get! x))
 
-def elem_f : (State × Tableidx) -> Eleminst
+def «$elem» : (State × Tableidx) -> Eleminst
   | ((s, f), x) => (s.ELEM.get! (f.MODULE.ELEM.get! x))
 
-def data_f : (State × Dataidx) -> Datainst
+def «$data» : (State × Dataidx) -> Datainst
   | ((s, f), x) => (s.DATA.get! (f.MODULE.DATA.get! x))
 
-def local_f : (State × Localidx) -> Val
+def «$local» : (State × Localidx) -> Val
   | ((s, f), x) => (f.LOCAL.get! x)
 
-def with_local_f : (State × Localidx × Val) -> State
+def «$with_local» : (State × Localidx × Val) -> State
   | ((s, f), x, v) => (s, default /- f[LOCAL[x] = v] -/)
 
-def with_global_f : (State × Globalidx × Val) -> State
+def «$with_global» : (State × Globalidx × Val) -> State
   | ((s, f), x, v) => (default /- s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v] -/, f)
 
-def with_table_f : (State × Tableidx × N × Ref) -> State
+def «$with_table» : (State × Tableidx × N × Ref) -> State
   | ((s, f), x, i, r) => (default /- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r] -/, f)
 
-def with_tableext_f : (State × Tableidx × (List Ref)) -> State
+def «$with_tableext» : (State × Tableidx × (List Ref)) -> State
   | ((s, f), x, r) => (default /- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*] -/, f)
 
-def with_elem_f : (State × Elemidx × (List Ref)) -> State
+def «$with_elem» : (State × Elemidx × (List Ref)) -> State
   | ((s, f), x, r) => (default /- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*] -/, f)
 
 inductive E where
@@ -1009,17 +1009,17 @@ inductive E where
  | LABEL_ : (N × (List Instr) × E) -> E
   deriving Inhabited, BEq
 
-def unop_f : (Unop_numtype × Numtype × C_numtype) -> (List C_numtype) := default
+def «$unop» : (Unop_numtype × Numtype × C_numtype) -> (List C_numtype) := default
 
-def binop_f : (Binop_numtype × Numtype × C_numtype × C_numtype) -> (List C_numtype) := default
+def «$binop» : (Binop_numtype × Numtype × C_numtype × C_numtype) -> (List C_numtype) := default
 
-def testop_f : (Testop_numtype × Numtype × C_numtype) -> C_numtype := default
+def «$testop» : (Testop_numtype × Numtype × C_numtype) -> C_numtype := default
 
-def relop_f : (Relop_numtype × Numtype × C_numtype × C_numtype) -> C_numtype := default
+def «$relop» : (Relop_numtype × Numtype × C_numtype × C_numtype) -> C_numtype := default
 
-def ext_f : (Nat × Nat × Sx × C_numtype) -> C_numtype := default
+def «$ext» : (Nat × Nat × Sx × C_numtype) -> C_numtype := default
 
-def cvtop_f : (Numtype × Cvtop × Numtype × (Option Sx) × C_numtype) -> (List C_numtype) := default
+def «$cvtop» : (Numtype × Cvtop × Numtype × (Option Sx) × C_numtype) -> (List C_numtype) := default
 
 inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
   | local_tee (val : Val) (x : Idx) :
@@ -1031,30 +1031,30 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (val == (Val.REF_NULL rt)) ->
     (Step_pure ([(admininstr_val val), Admininstr.REF_IS_NULL], [(Admininstr.CONST (Numtype.I32, 1))]))
   | cvtop_trap (c_1 : C_numtype) (cvtop : Cvtop) (nt : Numtype) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) :
-    ((cvtop_f (nt_1, cvtop, nt_2, sx, c_1)) == []) ->
+    ((«$cvtop» (nt_1, cvtop, nt_2, sx, c_1)) == []) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CVTOP (nt_1, cvtop, nt_2, sx))], [Admininstr.TRAP]))
   | cvtop_val (c : C_numtype) (c_1 : C_numtype) (cvtop : Cvtop) (nt : Numtype) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) :
-    ((cvtop_f (nt_1, cvtop, nt_2, sx, c_1)) == [c]) ->
+    ((«$cvtop» (nt_1, cvtop, nt_2, sx, c_1)) == [c]) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CVTOP (nt_1, cvtop, nt_2, sx))], [(Admininstr.CONST (nt, c))]))
   | extend (c : C_numtype) (n : N) (nt : Numtype) :
-    (Step_pure ([(Admininstr.CONST (nt, c)), (Admininstr.EXTEND (nt, n))], [(Admininstr.CONST (nt, (ext_f (n, (size_f (valtype_numtype nt)), Sx.S, c))))]))
+    (Step_pure ([(Admininstr.CONST (nt, c)), (Admininstr.EXTEND (nt, n))], [(Admininstr.CONST (nt, («$ext» (n, («$size» (valtype_numtype nt)), Sx.S, c))))]))
   | relop (c : C_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) (relop : Relop_numtype) :
-    (c == (relop_f (relop, nt, c_1, c_2))) ->
+    (c == («$relop» (relop, nt, c_1, c_2))) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.RELOP (nt, relop))], [(Admininstr.CONST (Numtype.I32, c))]))
   | testop (c : C_numtype) (c_1 : C_numtype) (nt : Numtype) (testop : Testop_numtype) :
-    (c == (testop_f (testop, nt, c_1))) ->
+    (c == («$testop» (testop, nt, c_1))) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.TESTOP (nt, testop))], [(Admininstr.CONST (Numtype.I32, c))]))
   | binop_trap (binop : Binop_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) :
-    ((binop_f (binop, nt, c_1, c_2)) == []) ->
+    ((«$binop» (binop, nt, c_1, c_2)) == []) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.BINOP (nt, binop))], [Admininstr.TRAP]))
   | binop_val (binop : Binop_numtype) (c : C_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) :
-    ((binop_f (binop, nt, c_1, c_2)) == [c]) ->
+    ((«$binop» (binop, nt, c_1, c_2)) == [c]) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.BINOP (nt, binop))], [(Admininstr.CONST (nt, c))]))
   | unop_trap (c_1 : C_numtype) (nt : Numtype) (unop : Unop_numtype) :
-    ((unop_f (unop, nt, c_1)) == []) ->
+    ((«$unop» (unop, nt, c_1)) == []) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.UNOP (nt, unop))], [Admininstr.TRAP]))
   | unop_val (c : C_numtype) (c_1 : C_numtype) (nt : Numtype) (unop : Unop_numtype) :
-    ((unop_f (unop, nt, c_1)) == [c]) ->
+    ((«$unop» (unop, nt, c_1)) == [c]) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.UNOP (nt, unop))], [(Admininstr.CONST (nt, c))]))
   | return_label (instr : (List Instr)) (instr' : (List Instr)) (k : Nat) (val : (List Val)) :
     (Step_pure ([(Admininstr.LABEL_ (k, instr', ((admininstr_val val) /- * -/ ++ ([Admininstr.RETURN] ++ (admininstr_instr instr) /- * -/))))], ((admininstr_val val) /- * -/ ++ [Admininstr.RETURN])))
@@ -1108,13 +1108,13 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
 inductive Step_read : (Config × (List Admininstr)) -> Prop where
   | table_init_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     True /- Else? -/ ->
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), [(Admininstr.CONST (Numtype.I32, j)), (admininstr_ref ((elem_f (z, y)).get! i)), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_INIT (x, y))]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), [(Admininstr.CONST (Numtype.I32, j)), (admininstr_ref ((«$elem» (z, y)).get! i)), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_INIT (x, y))]))
   | table_init_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     True /- Else? -/ ->
     (n == 0) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), []))
   | table_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (((i + n) > (elem_f (z, y)).length) || ((j + n) > (table_f (z, x)).length)) ->
+    (((i + n) > («$elem» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), [Admininstr.TRAP]))
   | table_copy_gt (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     True /- Else? -/ ->
@@ -1128,7 +1128,7 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (n == 0) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]), []))
   | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (((i + n) > (table_f (z, y)).length) || ((j + n) > (table_f (z, x)).length)) ->
+    (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]), [Admininstr.TRAP]))
   | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
     True /- Else? -/ ->
@@ -1138,54 +1138,54 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (n == 0) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_val val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), []))
   | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    ((i + n) > (table_f (z, x)).length) ->
+    ((i + n) > («$table» (z, x)).length) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_val val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), [Admininstr.TRAP]))
   | table_grow_fail (n : N) (x : Idx) (z : State) :
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), [(Admininstr.CONST (Numtype.I32, default /- - 1 -/))]))
   | table_size (n : N) (x : Idx) (z : State) :
-    ((table_f (z, x)).length == n) ->
+    ((«$table» (z, x)).length == n) ->
     (Step_read ((z, [(Admininstr.TABLE_SIZE x)]), [(Admininstr.CONST (Numtype.I32, n))]))
   | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) :
-    (i >= (table_f (z, x)).length) ->
+    (i >= («$table» (z, x)).length) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_ref ref), (Admininstr.TABLE_GET x)]), [Admininstr.TRAP]))
   | table_get_val (i : Nat) (x : Idx) (z : State) :
-    (i < (table_f (z, x)).length) ->
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]), [(admininstr_ref ((table_f (z, x)).get! i))]))
+    (i < («$table» (z, x)).length) ->
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]), [(admininstr_ref ((«$table» (z, x)).get! i))]))
   | table_get_trap (i : Nat) (x : Idx) (z : State) :
-    (i >= (table_f (z, x)).length) ->
+    (i >= («$table» (z, x)).length) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]), [Admininstr.TRAP]))
   | global_get (x : Idx) (z : State) :
-    (Step_read ((z, [(Admininstr.GLOBAL_GET x)]), [(admininstr_globalinst (global_f (z, x)))]))
+    (Step_read ((z, [(Admininstr.GLOBAL_GET x)]), [(admininstr_globalinst («$global» (z, x)))]))
   | local_get (x : Idx) (z : State) :
-    (Step_read ((z, [(Admininstr.LOCAL_GET x)]), [(admininstr_val (local_f (z, x)))]))
+    (Step_read ((z, [(Admininstr.LOCAL_GET x)]), [(admininstr_val («$local» (z, x)))]))
   | ref_func (x : Idx) (z : State) :
-    (Step_read ((z, [(Admininstr.REF_FUNC x)]), [(Admininstr.REF_FUNC_ADDR ((funcaddr_f z).get! x))]))
+    (Step_read ((z, [(Admininstr.REF_FUNC x)]), [(Admininstr.REF_FUNC_ADDR ((«$funcaddr» z).get! x))]))
   | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
-    (((funcinst_f z).get! a) == (m, ((t_1, t_2), t, instr))) ->
-    (f == {LOCAL := (val ++ (default__f t) /- * -/), MODULE := m}) ->
+    (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
+    (f == {LOCAL := (val ++ («$default_» t) /- * -/), MODULE := m}) ->
     (Step_read ((z, ((admininstr_val val) /- ^k -/ ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, f, [(Admininstr.LABEL_ (n, [], (admininstr_instr instr) /- * -/))]))]))
   | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
     True /- Else? -/ ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [Admininstr.TRAP]))
   | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
-    (((table_f (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
-    (((funcinst_f z).get! a) == (m, func)) ->
+    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
+    (((«$funcinst» z).get! a) == (m, func)) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [(Admininstr.CALL_ADDR a)]))
   | call (x : Idx) (z : State) :
-    (Step_read ((z, [(Admininstr.CALL x)]), [(Admininstr.CALL_ADDR ((funcaddr_f z).get! x))]))
+    (Step_read ((z, [(Admininstr.CALL x)]), [(Admininstr.CALL_ADDR ((«$funcaddr» z).get! x))]))
 
 inductive Step : (Config × Config) -> Prop where
   | elem_drop (x : Idx) (z : State) :
-    (Step ((z, [(Admininstr.ELEM_DROP x)]), ((with_elem_f (z, x, [])), [])))
+    (Step ((z, [(Admininstr.ELEM_DROP x)]), ((«$with_elem» (z, x, [])), [])))
   | table_grow_succeed (n : N) (ref : Ref) (x : Idx) (z : State) :
-    (Step ((z, [(admininstr_ref ref), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), ((with_tableext_f (z, x, ref)), [(Admininstr.CONST (Numtype.I32, (table_f (z, x)).length))])))
+    (Step ((z, [(admininstr_ref ref), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), ((«$with_tableext» (z, x, ref)), [(Admininstr.CONST (Numtype.I32, («$table» (z, x)).length))])))
   | table_set_val (i : Nat) (ref : Ref) (x : Idx) (z : State) :
-    (i < (table_f (z, x)).length) ->
-    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_ref ref), (Admininstr.TABLE_GET x)]), ((with_table_f (z, x, i, ref)), [])))
+    (i < («$table» (z, x)).length) ->
+    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_ref ref), (Admininstr.TABLE_GET x)]), ((«$with_table» (z, x, i, ref)), [])))
   | global_set (val : Val) (x : Idx) (z : State) :
-    (Step ((z, [(admininstr_val val), (Admininstr.GLOBAL_SET x)]), ((with_global_f (z, x, val)), [])))
+    (Step ((z, [(admininstr_val val), (Admininstr.GLOBAL_SET x)]), ((«$with_global» (z, x, val)), [])))
   | local_set (val : Val) (x : Idx) (z : State) :
-    (Step ((z, [(admininstr_val val), (Admininstr.LOCAL_SET x)]), ((with_local_f (z, x, val)), [])))
+    (Step ((z, [(admininstr_val val), (Admininstr.LOCAL_SET x)]), ((«$with_local» (z, x, val)), [])))
   | read (instr : (List Instr)) (instr' : (List Instr)) (z : State) :
     (Step_read ((z, (admininstr_instr instr) /- * -/), (admininstr_instr instr') /- * -/)) ->
     (Step ((z, (admininstr_instr instr) /- * -/), (z, (admininstr_instr instr') /- * -/)))
@@ -1782,7 +1782,7 @@ SpecTec.lean: error: function expected at
 term has type
   ?m.187030
 SpecTec.lean: error: application type mismatch
-  default__f t
+  «$default_» t
 argument
   t
 has type

From c7188db38990481b7ed58a2dd6fa0370b6bc7b2b Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Thu, 6 Apr 2023 12:12:02 +0200
Subject: [PATCH 37/98] More variant injections

---
 spectec/spec/1-syntax.watsup       |   4 +-
 spectec/src/backend-haskell/gen.ml |  16 +-
 spectec/src/backend-lean4/gen.ml   |   2 +-
 spectec/src/il/flat.ml             |  13 +-
 spectec/test-frontend/TEST.md      |   4 +-
 spectec/test-haskell/TEST.md       |  12 +-
 spectec/test-lean4/TEST.md         | 844 +++++++++++++----------------
 7 files changed, 425 insertions(+), 470 deletions(-)

diff --git a/spectec/spec/1-syntax.watsup b/spectec/spec/1-syntax.watsup
index 41f7619b0a..3f9522436a 100644
--- a/spectec/spec/1-syntax.watsup
+++ b/spectec/spec/1-syntax.watsup
@@ -45,8 +45,8 @@ syntax reftype hint(desc "reference type") =
 syntax valtype hint(desc "value type") =
   | numtype | vectype | reftype | BOT
 
-syntax in hint(show I#n) = | I32 | I64
-syntax fn hint(show F#n) = | F32 | F64
+syntax in hint(show I#n) hint(supertype numtype) = | I32 | I64
+syntax fn hint(show F#n) hint(supertype numtype) = | F32 | F64
 
 var t : valtype
 var nt : numtype
diff --git a/spectec/src/backend-haskell/gen.ml b/spectec/src/backend-haskell/gen.ml
index aaf5ede896..b6ac9cde2a 100644
--- a/spectec/src/backend-haskell/gen.ml
+++ b/spectec/src/backend-haskell/gen.ml
@@ -10,10 +10,18 @@ let render_type_name (id : id) = String.capitalize_ascii id.it
 
 let render_rec_con (id : id) = "Mk" ^ render_type_name id
 
-let make_id = String.map (function
-  | '.' -> '_'
-  | c -> c
-  )
+let is_reserved = function
+ | "data"
+ -> true
+ | _ -> false
+
+let make_id s = match s with
+ | s when is_reserved s ->  s ^ "_"
+ | s -> String.map (function
+    | '.' -> '_'
+    | '-' -> '_'
+    | c -> c
+    ) s
 
 let render_con_name id : atom -> string = function
   | Atom s ->
diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 9a09cc84e1..294ccf631a 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -83,7 +83,7 @@ let rec prepend first rest = function
 
 
 let render_variant_inj (id1 : id) (id2 : id) =
-  make_id (id1.it ^ "_" ^ id2.it)
+  "«$" ^ id1.it ^ "_" ^ id2.it ^ "»"
 
 let render_variant_inj' (typ1 : typ) (typ2 : typ) = match typ1.it, typ2.it with
   | VarT id1, VarT id2 -> render_variant_inj id1 id2
diff --git a/spectec/src/il/flat.ml b/spectec/src/il/flat.ml
index 9424613cc9..09ea017ef3 100644
--- a/spectec/src/il/flat.ml
+++ b/spectec/src/il/flat.ml
@@ -52,10 +52,13 @@ let rec transform_def_rec env (def : def) : def * (def list) = match def.it with
       register_cons env id cases';
       { def with it = SynD (id, { deftyp with it = VariantT ([], cases') }, hints) },
       (* Also generate conversion functions *)
-      let sids = ids @ List.concat_map (fun {hintid; hintexp} ->
-          if hintid.it = "subtype" then List.map (fun s -> s $ no_region) hintexp else []
-      ) hints in
-      List.map (fun sid ->
+      let pairs =
+        List.map (fun sid -> (id, sid)) ids @
+        List.concat_map (fun {hintid; hintexp} ->
+          (if hintid.it = "subtype" then List.map (fun s -> (id, s $ no_region)) hintexp else []) @
+          (if hintid.it = "supertype" then List.map (fun s -> (s $ no_region, id)) hintexp else [])
+        ) hints in
+      List.map (fun (id, sid) ->
         let name = (id.it ^ "_" ^ sid.it) $ no_region in
         let ty = VarT id $ no_region in
         let sty = VarT sid $ no_region in
@@ -71,7 +74,7 @@ let rec transform_def_rec env (def : def) : def * (def list) = match def.it with
                 CaseE (a, VarE x $ no_region, ty) $ no_region, []) $ no_region
         ) (lookup_cons env sid) in
         DecD (name, VarT sid $ no_region, VarT id $ no_region, clauses, []) $ no_region
-      ) sids
+      ) pairs
     | _ -> def, []
     end
   | _ ->
diff --git a/spectec/test-frontend/TEST.md b/spectec/test-frontend/TEST.md
index fe3d3655c7..301f4d0af4 100644
--- a/spectec/test-frontend/TEST.md
+++ b/spectec/test-frontend/TEST.md
@@ -69,12 +69,12 @@ syntax valtype =
   | reftype
   | BOT
 
-;; 1-syntax.watsup:48.1-48.39
+;; 1-syntax.watsup:48.1-48.63
 syntax in =
   | I32
   | I64
 
-;; 1-syntax.watsup:49.1-49.39
+;; 1-syntax.watsup:49.1-49.63
 syntax fn =
   | F32
   | F64
diff --git a/spectec/test-haskell/TEST.md b/spectec/test-haskell/TEST.md
index 48c3d31a23..b911042412 100644
--- a/spectec/test-haskell/TEST.md
+++ b/spectec/test-haskell/TEST.md
@@ -74,10 +74,18 @@ data In
  = In_I32
  | In_I64
 
+numtype_in :: In -> Numtype
+numtype_in In_I32 = Numtype_I32
+numtype_in In_I64 = Numtype_I64
+
 data Fn
  = Fn_F32
  | Fn_F64
 
+numtype_fn :: Fn -> Numtype
+numtype_fn Fn_F32 = Numtype_F32
+numtype_fn Fn_F64 = Numtype_F64
+
 type Resulttype = [Valtype]
 
 type Limits = {- mixop: `[%..%]` -} (U32, U32)
@@ -652,9 +660,9 @@ cvtop :: (Numtype, Cvtop, Numtype, (Maybe Sx), C_numtype) -> [C_numtype]
 
 $ ghc -c Test.hs
 
-Test.hs:600:6: error: parse error on input ‘::’
+Test.hs:608:6: error: parse error on input ‘::’
     |
-600 | data :: (State, Dataidx) -> Datainst
+608 | data :: (State, Dataidx) -> Datainst
     |      ^^
 [1]
 ```
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 03060e6995..f4eb8065b8 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -79,11 +79,19 @@ inductive In where
  | I64 : In
   deriving Inhabited, BEq
 
+def «$numtype_in» : In -> Numtype
+  | In.I32 => Numtype.I32
+  | In.I64 => Numtype.I64
+
 inductive Fn where
  | F32 : Fn
  | F64 : Fn
   deriving Inhabited, BEq
 
+def «$numtype_fn» : Fn -> Numtype
+  | Fn.F32 => Numtype.F32
+  | Fn.F64 => Numtype.F64
+
 @[reducible] def Resulttype := (List Valtype)
 
 @[reducible] def Limits := /- mixop: `[%..%]` -/ (U32 × U32)
@@ -441,14 +449,14 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     ((C.MEM.get! 0) == mt) ->
     ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» t)) 8))) ->
     (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» t)) 8)))) ->
-    ((n == none) || (nt == (numtype_in «in»))) ->
-    (Instr_ok (C, (Instr.STORE (nt, n, n_A, n_O)), ([Valtype.I32, (valtype_numtype nt)], [])))
+    ((n == none) || (nt == («$numtype_in» «in»))) ->
+    (Instr_ok (C, (Instr.STORE (nt, n, n_A, n_O)), ([Valtype.I32, («$valtype_numtype» nt)], [])))
   | load (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (sx : (Option Sx)) (t : Valtype) :
     ((C.MEM.get! 0) == mt) ->
     ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» t)) 8))) ->
     (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» t)) 8)))) ->
-    ((n == none) || (nt == (numtype_in «in»))) ->
-    (Instr_ok (C, (Instr.LOAD (nt, (n, sx) /- ? -/, n_A, n_O)), ([Valtype.I32], [(valtype_numtype nt)])))
+    ((n == none) || (nt == («$numtype_in» «in»))) ->
+    (Instr_ok (C, (Instr.LOAD (nt, (n, sx) /- ? -/, n_A, n_O)), ([Valtype.I32], [(«$valtype_numtype» nt)])))
   | data_drop (C : Context) (x : Idx) :
     ((C.DATA.get! x) == ()) ->
     (Instr_ok (C, (Instr.DATA_DROP x), ([], [])))
@@ -481,19 +489,19 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (Instr_ok (C, (Instr.TABLE_COPY (x_1, x_2)), ([Valtype.I32, Valtype.I32, Valtype.I32], [])))
   | table_fill (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
     ((C.TABLE.get! x) == (lim, rt)) ->
-    (Instr_ok (C, (Instr.TABLE_FILL x), ([Valtype.I32, (valtype_reftype rt), Valtype.I32], [])))
+    (Instr_ok (C, (Instr.TABLE_FILL x), ([Valtype.I32, («$valtype_reftype» rt), Valtype.I32], [])))
   | table_grow (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
     ((C.TABLE.get! x) == (lim, rt)) ->
-    (Instr_ok (C, (Instr.TABLE_GROW x), ([(valtype_reftype rt), Valtype.I32], [Valtype.I32])))
+    (Instr_ok (C, (Instr.TABLE_GROW x), ([(«$valtype_reftype» rt), Valtype.I32], [Valtype.I32])))
   | table_size (C : Context) (tt : Tabletype) (x : Idx) :
     ((C.TABLE.get! x) == tt) ->
     (Instr_ok (C, (Instr.TABLE_SIZE x), ([], [Valtype.I32])))
   | table_set (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
     ((C.TABLE.get! x) == (lim, rt)) ->
-    (Instr_ok (C, (Instr.TABLE_SET x), ([Valtype.I32, (valtype_reftype rt)], [])))
+    (Instr_ok (C, (Instr.TABLE_SET x), ([Valtype.I32, («$valtype_reftype» rt)], [])))
   | table_get (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
     ((C.TABLE.get! x) == (lim, rt)) ->
-    (Instr_ok (C, (Instr.TABLE_GET x), ([Valtype.I32], [(valtype_reftype rt)])))
+    (Instr_ok (C, (Instr.TABLE_GET x), ([Valtype.I32], [(«$valtype_reftype» rt)])))
   | global_set (C : Context) (t : Valtype) (x : Idx) :
     ((C.GLOBAL.get! x) == ((some ()), t)) ->
     (Instr_ok (C, (Instr.GLOBAL_SET x), ([t], [])))
@@ -510,36 +518,36 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     ((C.LOCAL.get! x) == t) ->
     (Instr_ok (C, (Instr.LOCAL_GET x), ([], [t])))
   | ref_is_null (C : Context) (rt : Reftype) :
-    (Instr_ok (C, Instr.REF_IS_NULL, ([(valtype_reftype rt)], [Valtype.I32])))
+    (Instr_ok (C, Instr.REF_IS_NULL, ([(«$valtype_reftype» rt)], [Valtype.I32])))
   | ref_func (C : Context) (ft : Functype) (x : Idx) :
     ((C.FUNC.get! x) == ft) ->
     (Instr_ok (C, (Instr.REF_FUNC x), ([], [Valtype.FUNCREF])))
   | ref_null (C : Context) (rt : Reftype) :
-    (Instr_ok (C, (Instr.REF_NULL rt), ([], [(valtype_reftype rt)])))
+    (Instr_ok (C, (Instr.REF_NULL rt), ([], [(«$valtype_reftype» rt)])))
   | convert_f (C : Context) (fn_1 : Fn) (fn_2 : Fn) :
     (fn_1 != fn_2) ->
-    (Instr_ok (C, (Instr.CVTOP ((numtype_fn fn_1), Cvtop.CONVERT, (numtype_fn fn_2), none)), ([(valtype_fn fn_2)], [(valtype_fn fn_1)])))
+    (Instr_ok (C, (Instr.CVTOP ((«$numtype_fn» fn_1), Cvtop.CONVERT, («$numtype_fn» fn_2), none)), ([(«$valtype_fn» fn_2)], [(«$valtype_fn» fn_1)])))
   | convert_i (C : Context) (in_1 : In) (in_2 : In) (sx : (Option Sx)) :
     (in_1 != in_2) ->
-    ((sx == none) = ((«$size» (valtype_in in_1)) > («$size» (valtype_in in_2)))) ->
-    (Instr_ok (C, (Instr.CVTOP ((numtype_in in_1), Cvtop.CONVERT, (numtype_in in_2), sx)), ([(valtype_in in_2)], [(valtype_in in_1)])))
+    ((sx == none) = ((«$size» («$valtype_in» in_1)) > («$size» («$valtype_in» in_2)))) ->
+    (Instr_ok (C, (Instr.CVTOP ((«$numtype_in» in_1), Cvtop.CONVERT, («$numtype_in» in_2), sx)), ([(«$valtype_in» in_2)], [(«$valtype_in» in_1)])))
   | reinterpret (C : Context) (nt_1 : Numtype) (nt_2 : Numtype) :
     (nt_1 != nt_2) ->
-    ((«$size» (valtype_numtype nt_1)) == («$size» (valtype_numtype nt_2))) ->
-    (Instr_ok (C, (Instr.CVTOP (nt_1, Cvtop.REINTERPRET, nt_2, none)), ([(valtype_numtype nt_2)], [(valtype_numtype nt_1)])))
+    ((«$size» («$valtype_numtype» nt_1)) == («$size» («$valtype_numtype» nt_2))) ->
+    (Instr_ok (C, (Instr.CVTOP (nt_1, Cvtop.REINTERPRET, nt_2, none)), ([(«$valtype_numtype» nt_2)], [(«$valtype_numtype» nt_1)])))
   | extend (C : Context) (n : N) (nt : Numtype) :
-    (n <= («$size» (valtype_numtype nt))) ->
-    (Instr_ok (C, (Instr.EXTEND (nt, n)), ([(valtype_numtype nt)], [(valtype_numtype nt)])))
+    (n <= («$size» («$valtype_numtype» nt))) ->
+    (Instr_ok (C, (Instr.EXTEND (nt, n)), ([(«$valtype_numtype» nt)], [(«$valtype_numtype» nt)])))
   | relop (C : Context) (nt : Numtype) (relop : Relop_numtype) :
-    (Instr_ok (C, (Instr.RELOP (nt, relop)), ([(valtype_numtype nt), (valtype_numtype nt)], [Valtype.I32])))
+    (Instr_ok (C, (Instr.RELOP (nt, relop)), ([(«$valtype_numtype» nt), («$valtype_numtype» nt)], [Valtype.I32])))
   | testop (C : Context) (nt : Numtype) (testop : Testop_numtype) :
-    (Instr_ok (C, (Instr.TESTOP (nt, testop)), ([(valtype_numtype nt)], [Valtype.I32])))
+    (Instr_ok (C, (Instr.TESTOP (nt, testop)), ([(«$valtype_numtype» nt)], [Valtype.I32])))
   | binop (C : Context) (binop : Binop_numtype) (nt : Numtype) :
-    (Instr_ok (C, (Instr.BINOP (nt, binop)), ([(valtype_numtype nt), (valtype_numtype nt)], [(valtype_numtype nt)])))
+    (Instr_ok (C, (Instr.BINOP (nt, binop)), ([(«$valtype_numtype» nt), («$valtype_numtype» nt)], [(«$valtype_numtype» nt)])))
   | unop (C : Context) (nt : Numtype) (unop : Unop_numtype) :
-    (Instr_ok (C, (Instr.UNOP (nt, unop)), ([(valtype_numtype nt)], [(valtype_numtype nt)])))
+    (Instr_ok (C, (Instr.UNOP (nt, unop)), ([(«$valtype_numtype» nt)], [(«$valtype_numtype» nt)])))
   | const (C : Context) (c_nt : C_numtype) (nt : Numtype) :
-    (Instr_ok (C, (Instr.CONST (nt, c_nt)), ([], [(valtype_numtype nt)])))
+    (Instr_ok (C, (Instr.CONST (nt, c_nt)), ([], [(«$valtype_numtype» nt)])))
   | call_indirect (C : Context) (ft : Functype) (lim : Limits) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (x : Idx) :
     ((C.TABLE.get! x) == (lim, Reftype.FUNCREF)) ->
     (ft == (t_1, t_2)) ->
@@ -551,8 +559,8 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (C.RETURN == (some t)) ->
     (Instr_ok (C, Instr.RETURN, ((t_1 ++ t), t_2)))
   | br_table (C : Context) (l : (List Labelidx)) (l' : Labelidx) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
-    (Resulttype_sub (t, [(valtype_resulttype (C.LABEL.get! l))])) /- * -/ ->
-    (Resulttype_sub (t, [(valtype_resulttype (C.LABEL.get! l'))])) ->
+    (Resulttype_sub (t, [(«$valtype_resulttype» (C.LABEL.get! l))])) /- * -/ ->
+    (Resulttype_sub (t, [(«$valtype_resulttype» (C.LABEL.get! l'))])) ->
     (Instr_ok (C, (Instr.BR_TABLE (l, l')), ((t_1 ++ t), t_2)))
   | br_if (C : Context) (l : Labelidx) (t : (List Valtype)) :
     ((C.LABEL.get! l) == t) ->
@@ -575,7 +583,7 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (Instr_ok (C, (Instr.BLOCK (bt, instr)), (t_1, t_2)))
   | select_impl (C : Context) (numtype : Numtype) (t : Valtype) (t' : Valtype) (vectype : Vectype) :
     (Valtype_sub (t, t')) ->
-    ((t' == (valtype_numtype numtype)) || (t' == (valtype_vectype vectype))) ->
+    ((t' == («$valtype_numtype» numtype)) || (t' == («$valtype_vectype» vectype))) ->
     (Instr_ok (C, (Instr.SELECT none), ([t, t, Valtype.I32], [t])))
   | select_expl (C : Context) (t : Valtype) :
     (Instr_ok (C, (Instr.SELECT (some t)), ([t, t, Valtype.I32], [t])))
@@ -663,7 +671,7 @@ inductive Elemmode_ok : (Context × Elemmode × Reftype) -> Prop where
 
 inductive Elem_ok : (Context × Elem × Reftype) -> Prop where
   | rule_0 (C : Context) (elemmode : (Option Elemmode)) (expr : (List Expr)) (rt : Reftype) :
-    (Expr_ok (C, expr, [(valtype_reftype rt)])) /- * -/ ->
+    (Expr_ok (C, expr, [(«$valtype_reftype» rt)])) /- * -/ ->
     (Elemmode_ok (C, elemmode, rt)) /- ? -/ ->
     (Elem_ok (C, (rt, expr, elemmode), rt))
 
@@ -1023,13 +1031,13 @@ def «$cvtop» : (Numtype × Cvtop × Numtype × (Option Sx) × C_numtype) -> (L
 
 inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
   | local_tee (val : Val) (x : Idx) :
-    (Step_pure ([(admininstr_val val), (Admininstr.LOCAL_TEE x)], [(admininstr_val val), (admininstr_val val), (Admininstr.LOCAL_SET x)]))
+    (Step_pure ([(«$admininstr_val» val), (Admininstr.LOCAL_TEE x)], [(«$admininstr_val» val), («$admininstr_val» val), (Admininstr.LOCAL_SET x)]))
   | ref_is_null_false (val : Val) :
     True /- Else? -/ ->
-    (Step_pure ([(admininstr_val val), Admininstr.REF_IS_NULL], [(Admininstr.CONST (Numtype.I32, 0))]))
+    (Step_pure ([(«$admininstr_val» val), Admininstr.REF_IS_NULL], [(Admininstr.CONST (Numtype.I32, 0))]))
   | ref_is_null_true (rt : Reftype) (val : Val) :
     (val == (Val.REF_NULL rt)) ->
-    (Step_pure ([(admininstr_val val), Admininstr.REF_IS_NULL], [(Admininstr.CONST (Numtype.I32, 1))]))
+    (Step_pure ([(«$admininstr_val» val), Admininstr.REF_IS_NULL], [(Admininstr.CONST (Numtype.I32, 1))]))
   | cvtop_trap (c_1 : C_numtype) (cvtop : Cvtop) (nt : Numtype) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) :
     ((«$cvtop» (nt_1, cvtop, nt_2, sx, c_1)) == []) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CVTOP (nt_1, cvtop, nt_2, sx))], [Admininstr.TRAP]))
@@ -1037,7 +1045,7 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     ((«$cvtop» (nt_1, cvtop, nt_2, sx, c_1)) == [c]) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CVTOP (nt_1, cvtop, nt_2, sx))], [(Admininstr.CONST (nt, c))]))
   | extend (c : C_numtype) (n : N) (nt : Numtype) :
-    (Step_pure ([(Admininstr.CONST (nt, c)), (Admininstr.EXTEND (nt, n))], [(Admininstr.CONST (nt, («$ext» (n, («$size» (valtype_numtype nt)), Sx.S, c))))]))
+    (Step_pure ([(Admininstr.CONST (nt, c)), (Admininstr.EXTEND (nt, n))], [(Admininstr.CONST (nt, («$ext» (n, («$size» («$valtype_numtype» nt)), Sx.S, c))))]))
   | relop (c : C_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) (relop : Relop_numtype) :
     (c == («$relop» (relop, nt, c_1, c_2))) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.RELOP (nt, relop))], [(Admininstr.CONST (Numtype.I32, c))]))
@@ -1057,11 +1065,11 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     ((«$unop» (unop, nt, c_1)) == [c]) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.UNOP (nt, unop))], [(Admininstr.CONST (nt, c))]))
   | return_label (instr : (List Instr)) (instr' : (List Instr)) (k : Nat) (val : (List Val)) :
-    (Step_pure ([(Admininstr.LABEL_ (k, instr', ((admininstr_val val) /- * -/ ++ ([Admininstr.RETURN] ++ (admininstr_instr instr) /- * -/))))], ((admininstr_val val) /- * -/ ++ [Admininstr.RETURN])))
+    (Step_pure ([(Admininstr.LABEL_ (k, instr', ((«$admininstr_val» val) /- * -/ ++ ([Admininstr.RETURN] ++ («$admininstr_instr» instr) /- * -/))))], ((«$admininstr_val» val) /- * -/ ++ [Admininstr.RETURN])))
   | return_frame (f : Frame) (instr : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) :
-    (Step_pure ([(Admininstr.FRAME_ (n, f, ((admininstr_val val') /- * -/ ++ ((admininstr_val val) /- ^n -/ ++ ([Admininstr.RETURN] ++ (admininstr_instr instr) /- * -/)))))], (admininstr_val val) /- ^n -/))
+    (Step_pure ([(Admininstr.FRAME_ (n, f, ((«$admininstr_val» val') /- * -/ ++ ((«$admininstr_val» val) /- ^n -/ ++ ([Admininstr.RETURN] ++ («$admininstr_instr» instr) /- * -/)))))], («$admininstr_val» val) /- ^n -/))
   | frame_vals (f : Frame) (n : N) (val : (List Val)) :
-    (Step_pure ([(Admininstr.FRAME_ (n, f, (admininstr_val val) /- ^n -/))], (admininstr_val val) /- ^n -/))
+    (Step_pure ([(Admininstr.FRAME_ (n, f, («$admininstr_val» val) /- ^n -/))], («$admininstr_val» val) /- ^n -/))
   | br_table_ge (i : Nat) (l : (List Labelidx)) (l' : Labelidx) :
     (i >= l.length) ->
     (Step_pure ([(Admininstr.CONST (Numtype.I32, i)), (Admininstr.BR_TABLE (l, l'))], [(Admininstr.BR l')]))
@@ -1075,11 +1083,11 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (c != 0) ->
     (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.BR_IF l)], [(Admininstr.BR l)]))
   | br_succ (instr : (List Instr)) (instr' : (List Instr)) (l : Labelidx) (n : N) (val : (List Val)) :
-    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((admininstr_val val) /- * -/ ++ ([(Admininstr.BR (l + 1))] ++ (admininstr_instr instr) /- * -/))))], ((admininstr_val val) /- * -/ ++ [(Admininstr.BR l)])))
+    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((«$admininstr_val» val) /- * -/ ++ ([(Admininstr.BR (l + 1))] ++ («$admininstr_instr» instr) /- * -/))))], ((«$admininstr_val» val) /- * -/ ++ [(Admininstr.BR l)])))
   | br_zero (instr : (List Instr)) (instr' : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) :
-    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((admininstr_val val') /- * -/ ++ ((admininstr_val val) /- ^n -/ ++ ([(Admininstr.BR 0)] ++ (admininstr_instr instr) /- * -/)))))], ((admininstr_val val) /- ^n -/ ++ (admininstr_instr instr') /- * -/)))
+    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((«$admininstr_val» val') /- * -/ ++ ((«$admininstr_val» val) /- ^n -/ ++ ([(Admininstr.BR 0)] ++ («$admininstr_instr» instr) /- * -/)))))], ((«$admininstr_val» val) /- ^n -/ ++ («$admininstr_instr» instr') /- * -/)))
   | label_vals (instr : (List Instr)) (n : N) (val : (List Val)) :
-    (Step_pure ([(Admininstr.LABEL_ (n, instr, (admininstr_val val) /- * -/))], (admininstr_val val) /- * -/))
+    (Step_pure ([(Admininstr.LABEL_ (n, instr, («$admininstr_val» val) /- * -/))], («$admininstr_val» val) /- * -/))
   | if_false (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) :
     (c == 0) ->
     (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.IF (bt, instr_1, instr_2))], [(Admininstr.BLOCK (bt, instr_2))]))
@@ -1088,18 +1096,18 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.IF (bt, instr_1, instr_2))], [(Admininstr.BLOCK (bt, instr_1))]))
   | loop (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
     (bt == (t_1, t_2)) ->
-    (Step_pure (((admininstr_val val) /- ^k -/ ++ [(Admininstr.LOOP (bt, instr))]), [(Admininstr.LABEL_ (n, [(Instr.LOOP (bt, instr))], ((admininstr_val val) /- ^k -/ ++ (admininstr_instr instr) /- * -/)))]))
+    (Step_pure (((«$admininstr_val» val) /- ^k -/ ++ [(Admininstr.LOOP (bt, instr))]), [(Admininstr.LABEL_ (n, [(Instr.LOOP (bt, instr))], ((«$admininstr_val» val) /- ^k -/ ++ («$admininstr_instr» instr) /- * -/)))]))
   | block (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
     (bt == (t_1, t_2)) ->
-    (Step_pure (((admininstr_val val) /- ^k -/ ++ [(Admininstr.BLOCK (bt, instr))]), [(Admininstr.LABEL_ (n, [], ((admininstr_val val) /- ^k -/ ++ (admininstr_instr instr) /- * -/)))]))
+    (Step_pure (((«$admininstr_val» val) /- ^k -/ ++ [(Admininstr.BLOCK (bt, instr))]), [(Admininstr.LABEL_ (n, [], ((«$admininstr_val» val) /- ^k -/ ++ («$admininstr_instr» instr) /- * -/)))]))
   | select_false (c : C_numtype) (t : (Option Valtype)) (val_1 : Val) (val_2 : Val) :
     (c == 0) ->
-    (Step_pure ([(admininstr_val val_1), (admininstr_val val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)], [(admininstr_val val_2)]))
+    (Step_pure ([(«$admininstr_val» val_1), («$admininstr_val» val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)], [(«$admininstr_val» val_2)]))
   | select_true (c : C_numtype) (t : (Option Valtype)) (val_1 : Val) (val_2 : Val) :
     (c != 0) ->
-    (Step_pure ([(admininstr_val val_1), (admininstr_val val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)], [(admininstr_val val_1)]))
+    (Step_pure ([(«$admininstr_val» val_1), («$admininstr_val» val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)], [(«$admininstr_val» val_1)]))
   | drop (val : Val) :
-    (Step_pure ([(admininstr_val val), Admininstr.DROP], []))
+    (Step_pure ([(«$admininstr_val» val), Admininstr.DROP], []))
   | nop  :
     (Step_pure ([Admininstr.NOP], []))
   | unreachable  :
@@ -1108,7 +1116,7 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
 inductive Step_read : (Config × (List Admininstr)) -> Prop where
   | table_init_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     True /- Else? -/ ->
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), [(Admininstr.CONST (Numtype.I32, j)), (admininstr_ref ((«$elem» (z, y)).get! i)), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_INIT (x, y))]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), [(Admininstr.CONST (Numtype.I32, j)), («$admininstr_ref» ((«$elem» (z, y)).get! i)), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_INIT (x, y))]))
   | table_init_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     True /- Else? -/ ->
     (n == 0) ->
@@ -1132,14 +1140,14 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]), [Admininstr.TRAP]))
   | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
     True /- Else? -/ ->
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_val val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), [(Admininstr.CONST (Numtype.I32, i)), (admininstr_val val), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (i + 1))), (admininstr_val val), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_FILL x)]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (i + 1))), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_FILL x)]))
   | table_fill_zero (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
     True /- Else? -/ ->
     (n == 0) ->
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_val val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), []))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), []))
   | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
     ((i + n) > («$table» (z, x)).length) ->
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_val val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), [Admininstr.TRAP]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), [Admininstr.TRAP]))
   | table_grow_fail (n : N) (x : Idx) (z : State) :
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), [(Admininstr.CONST (Numtype.I32, default /- - 1 -/))]))
   | table_size (n : N) (x : Idx) (z : State) :
@@ -1147,23 +1155,23 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (Step_read ((z, [(Admininstr.TABLE_SIZE x)]), [(Admininstr.CONST (Numtype.I32, n))]))
   | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) :
     (i >= («$table» (z, x)).length) ->
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_ref ref), (Admininstr.TABLE_GET x)]), [Admininstr.TRAP]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]), [Admininstr.TRAP]))
   | table_get_val (i : Nat) (x : Idx) (z : State) :
     (i < («$table» (z, x)).length) ->
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]), [(admininstr_ref ((«$table» (z, x)).get! i))]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]), [(«$admininstr_ref» ((«$table» (z, x)).get! i))]))
   | table_get_trap (i : Nat) (x : Idx) (z : State) :
     (i >= («$table» (z, x)).length) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]), [Admininstr.TRAP]))
   | global_get (x : Idx) (z : State) :
-    (Step_read ((z, [(Admininstr.GLOBAL_GET x)]), [(admininstr_globalinst («$global» (z, x)))]))
+    (Step_read ((z, [(Admininstr.GLOBAL_GET x)]), [(«$admininstr_globalinst» («$global» (z, x)))]))
   | local_get (x : Idx) (z : State) :
-    (Step_read ((z, [(Admininstr.LOCAL_GET x)]), [(admininstr_val («$local» (z, x)))]))
+    (Step_read ((z, [(Admininstr.LOCAL_GET x)]), [(«$admininstr_val» («$local» (z, x)))]))
   | ref_func (x : Idx) (z : State) :
     (Step_read ((z, [(Admininstr.REF_FUNC x)]), [(Admininstr.REF_FUNC_ADDR ((«$funcaddr» z).get! x))]))
   | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
     (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
     (f == {LOCAL := (val ++ («$default_» t) /- * -/), MODULE := m}) ->
-    (Step_read ((z, ((admininstr_val val) /- ^k -/ ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, f, [(Admininstr.LABEL_ (n, [], (admininstr_instr instr) /- * -/))]))]))
+    (Step_read ((z, ((«$admininstr_val» val) /- ^k -/ ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, f, [(Admininstr.LABEL_ (n, [], («$admininstr_instr» instr) /- * -/))]))]))
   | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
     True /- Else? -/ ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [Admininstr.TRAP]))
@@ -1178,20 +1186,20 @@ inductive Step : (Config × Config) -> Prop where
   | elem_drop (x : Idx) (z : State) :
     (Step ((z, [(Admininstr.ELEM_DROP x)]), ((«$with_elem» (z, x, [])), [])))
   | table_grow_succeed (n : N) (ref : Ref) (x : Idx) (z : State) :
-    (Step ((z, [(admininstr_ref ref), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), ((«$with_tableext» (z, x, ref)), [(Admininstr.CONST (Numtype.I32, («$table» (z, x)).length))])))
+    (Step ((z, [(«$admininstr_ref» ref), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), ((«$with_tableext» (z, x, ref)), [(Admininstr.CONST (Numtype.I32, («$table» (z, x)).length))])))
   | table_set_val (i : Nat) (ref : Ref) (x : Idx) (z : State) :
     (i < («$table» (z, x)).length) ->
-    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), (admininstr_ref ref), (Admininstr.TABLE_GET x)]), ((«$with_table» (z, x, i, ref)), [])))
+    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]), ((«$with_table» (z, x, i, ref)), [])))
   | global_set (val : Val) (x : Idx) (z : State) :
-    (Step ((z, [(admininstr_val val), (Admininstr.GLOBAL_SET x)]), ((«$with_global» (z, x, val)), [])))
+    (Step ((z, [(«$admininstr_val» val), (Admininstr.GLOBAL_SET x)]), ((«$with_global» (z, x, val)), [])))
   | local_set (val : Val) (x : Idx) (z : State) :
-    (Step ((z, [(admininstr_val val), (Admininstr.LOCAL_SET x)]), ((«$with_local» (z, x, val)), [])))
+    (Step ((z, [(«$admininstr_val» val), (Admininstr.LOCAL_SET x)]), ((«$with_local» (z, x, val)), [])))
   | read (instr : (List Instr)) (instr' : (List Instr)) (z : State) :
-    (Step_read ((z, (admininstr_instr instr) /- * -/), (admininstr_instr instr') /- * -/)) ->
-    (Step ((z, (admininstr_instr instr) /- * -/), (z, (admininstr_instr instr') /- * -/)))
+    (Step_read ((z, («$admininstr_instr» instr) /- * -/), («$admininstr_instr» instr') /- * -/)) ->
+    (Step ((z, («$admininstr_instr» instr) /- * -/), (z, («$admininstr_instr» instr') /- * -/)))
   | pure (instr : (List Instr)) (instr' : (List Instr)) (z : State) :
-    (Step_pure ((admininstr_instr instr) /- * -/, (admininstr_instr instr') /- * -/)) ->
-    (Step ((z, (admininstr_instr instr) /- * -/), (z, (admininstr_instr instr') /- * -/)))
+    (Step_pure ((«$admininstr_instr» instr) /- * -/, («$admininstr_instr» instr') /- * -/)) ->
+    (Step ((z, («$admininstr_instr» instr) /- * -/), (z, («$admininstr_instr» instr') /- * -/)))
 $ lean SpecTec.lean 2>&1 | sed -e 's,/[^ ]*/toolchains,.../toolchains`,g' | sed -e 's,SpecTec.lean:[0-9]\+:[0-9]\+,SpecTec.lean,'
 SpecTec.lean: warning: unused variable `n_3_ATOM_y` [linter.unusedVariables]
 SpecTec.lean: error: application type mismatch
@@ -1218,14 +1226,6 @@ has type
   Option N : Type
 but is expected to have type
   Nat : Type
-SpecTec.lean: error: function expected at
-  numtype_in
-term has type
-  ?m.72247
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.72553
 SpecTec.lean: error: application type mismatch
   Nat.div n
 argument
@@ -1250,30 +1250,6 @@ has type
   Option N × Option Sx : Type
 but is expected to have type
   Option (N × Sx) : Type
-SpecTec.lean: error: function expected at
-  numtype_in
-term has type
-  ?m.73168
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.73618
-SpecTec.lean: error: function expected at
-  valtype_reftype
-term has type
-  ?m.74881
-SpecTec.lean: error: function expected at
-  valtype_reftype
-term has type
-  ?m.75018
-SpecTec.lean: error: function expected at
-  valtype_reftype
-term has type
-  ?m.75212
-SpecTec.lean: error: function expected at
-  valtype_reftype
-term has type
-  ?m.75351
 SpecTec.lean: error: type mismatch
   ((), t)
 has type
@@ -1281,125 +1257,37 @@ has type
 but is expected to have type
   Globaltype : Type
 SpecTec.lean: error: function expected at
-  valtype_reftype
-term has type
-  ?m.76088
-SpecTec.lean: error: function expected at
-  valtype_reftype
-term has type
-  ?m.76238
-SpecTec.lean: error: function expected at
-  numtype_fn
+  «$valtype_fn»
 term has type
-  ?m.76329
+  ?m.74906
 SpecTec.lean: error: function expected at
-  numtype_fn
+  «$valtype_fn»
 term has type
-  ?m.76329
+  ?m.74906
 SpecTec.lean: error: function expected at
-  valtype_fn
+  «$valtype_in»
 term has type
-  ?m.76394
+  ?m.75090
 SpecTec.lean: error: function expected at
-  valtype_fn
+  «$valtype_in»
 term has type
-  ?m.76394
+  ?m.75090
 SpecTec.lean: error: function expected at
-  valtype_in
+  «$valtype_in»
 term has type
-  ?m.76610
+  ?m.75090
 SpecTec.lean: error: function expected at
-  valtype_in
+  «$valtype_in»
 term has type
-  ?m.76610
+  ?m.75090
 SpecTec.lean: error: function expected at
-  numtype_in
+  «$valtype_resulttype»
 term has type
-  ?m.76909
+  ?m.76089
 SpecTec.lean: error: function expected at
-  numtype_in
+  «$valtype_resulttype»
 term has type
-  ?m.76909
-SpecTec.lean: error: function expected at
-  valtype_in
-term has type
-  ?m.76610
-SpecTec.lean: error: function expected at
-  valtype_in
-term has type
-  ?m.76610
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.77363
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.77363
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.77363
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.77363
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.77531
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.77531
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.77531
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.77650
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.77650
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.77746
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.77825
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.77825
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.77825
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.77936
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.77936
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.78032
-SpecTec.lean: error: function expected at
-  valtype_resulttype
-term has type
-  ?m.78384
-SpecTec.lean: error: function expected at
-  valtype_resulttype
-term has type
-  ?m.78384
+  ?m.76089
 SpecTec.lean: error: application type mismatch
   (t_1, t_2)
 argument
@@ -1448,14 +1336,6 @@ has type
   Valtype : Type
 but is expected to have type
   Resulttype : Type
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.79302
-SpecTec.lean: error: function expected at
-  valtype_vectype
-term has type
-  ?m.79330
 SpecTec.lean: error: application type mismatch
   Prod.mk t'_1
 argument
@@ -1465,7 +1345,7 @@ has type
 but is expected to have type
   List Valtype : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Instr) Instr ?m.80059
+  HAppend (List Instr) Instr ?m.77676
 SpecTec.lean: error: application type mismatch
   (C, instr)
 argument
@@ -1496,10 +1376,6 @@ has type
   Option Elemmode : Type
 but is expected to have type
   Elemmode : Type
-SpecTec.lean: error: function expected at
-  valtype_reftype
-term has type
-  ?m.99302
 SpecTec.lean: error: application type mismatch
   (C, datamode)
 argument
@@ -1589,198 +1465,232 @@ SpecTec.lean: warning: unused variable `r` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `r` [linter.unusedVariables]
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_instr» instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend (List Admininstr) Admininstr ?m.178431
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend Admininstr (List Admininstr) ?m.178638
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val'
+argument
+  val'
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_instr» instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend (List Admininstr) Admininstr ?m.179157
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_instr» instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend (List Admininstr) Admininstr ?m.180061
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend Admininstr (List Admininstr) ?m.180268
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val'
+argument
+  val'
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_instr» instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend (List Admininstr) Admininstr ?m.180794
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_instr» instr'
+argument
+  instr'
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend Admininstr Admininstr ?m.181089
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend Admininstr (List Admininstr) ?m.181730
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_instr» instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend Admininstr Admininstr ?m.182041
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend Admininstr (List Admininstr) ?m.182398
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_instr» instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend Admininstr Admininstr ?m.182703
 SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.180557
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.180557
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.180557
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.180643
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.180732
-SpecTec.lean: error: function expected at
-  valtype_numtype
-term has type
-  ?m.181062
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.181652
-SpecTec.lean: error: function expected at
-  admininstr_instr
-term has type
-  ?m.181694
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.181652
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.181907
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.181907
-SpecTec.lean: error: function expected at
-  admininstr_instr
-term has type
-  ?m.181957
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.181907
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.182160
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.182160
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.182470
-SpecTec.lean: error: function expected at
-  admininstr_instr
-term has type
-  ?m.182561
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.182470
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.182798
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.182798
-SpecTec.lean: error: function expected at
-  admininstr_instr
-term has type
-  ?m.182854
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.182798
-SpecTec.lean: error: function expected at
-  admininstr_instr
-term has type
-  ?m.182854
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.183104
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.183104
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.183382
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.183382
-SpecTec.lean: error: function expected at
-  admininstr_instr
-term has type
-  ?m.183487
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.183720
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.183720
-SpecTec.lean: error: function expected at
-  admininstr_instr
-term has type
-  ?m.183819
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.184044
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.184044
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.184044
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.184206
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.184206
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.184206
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.184332
-SpecTec.lean: error: function expected at
-  admininstr_ref
-term has type
-  ?m.184640
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.186018
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.186018
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.186018
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.186270
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.186432
-SpecTec.lean: error: function expected at
-  admininstr_ref
-term has type
-  ?m.186720
-SpecTec.lean: error: function expected at
-  admininstr_ref
-term has type
-  ?m.186833
-SpecTec.lean: error: function expected at
-  admininstr_globalinst
-term has type
-  ?m.186968
-SpecTec.lean: error: function expected at
-  admininstr_val
+  «$admininstr_globalinst»
 term has type
-  ?m.187030
+  ?m.185027
 SpecTec.lean: error: application type mismatch
   «$default_» t
 argument
@@ -1790,15 +1700,25 @@ has type
 but is expected to have type
   Valtype : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Val) Val ?m.188431
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.187612
-SpecTec.lean: error: function expected at
-  admininstr_instr
-term has type
-  ?m.188071
+  HAppend (List Val) Val ?m.185601
+SpecTec.lean: error: application type mismatch
+  «$admininstr_val» val
+argument
+  val
+has type
+  List Val : Type
+but is expected to have type
+  Val : Type
+SpecTec.lean: error: failed to synthesize instance
+  HAppend Admininstr (List Admininstr) ?m.185919
+SpecTec.lean: error: application type mismatch
+  «$admininstr_instr» instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
 SpecTec.lean: error: application type mismatch
   (x, ref)
 argument
@@ -1807,52 +1727,68 @@ has type
   Ref : Type
 but is expected to have type
   List Ref : Type
-SpecTec.lean: error: function expected at
-  admininstr_ref
-term has type
-  ?m.188974
-SpecTec.lean: error: function expected at
-  admininstr_ref
-term has type
-  ?m.189206
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.189310
-SpecTec.lean: error: function expected at
-  admininstr_val
-term has type
-  ?m.189385
-SpecTec.lean: error: function expected at
-  admininstr_instr
-term has type
-  ?m.189471
-SpecTec.lean: error: function expected at
-  admininstr_instr
-term has type
-  ?m.189471
-SpecTec.lean: error: function expected at
-  admininstr_instr
-term has type
-  ?m.189471
-SpecTec.lean: error: function expected at
-  admininstr_instr
-term has type
-  ?m.189471
-SpecTec.lean: error: function expected at
-  admininstr_instr
-term has type
-  ?m.189618
-SpecTec.lean: error: function expected at
-  admininstr_instr
-term has type
-  ?m.189618
-SpecTec.lean: error: function expected at
-  admininstr_instr
-term has type
-  ?m.189618
-SpecTec.lean: error: function expected at
-  admininstr_instr
-term has type
-  ?m.189618
+SpecTec.lean: error: application type mismatch
+  «$admininstr_instr» instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_instr» instr'
+argument
+  instr'
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_instr» instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_instr» instr'
+argument
+  instr'
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_instr» instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_instr» instr'
+argument
+  instr'
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_instr» instr
+argument
+  instr
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
+SpecTec.lean: error: application type mismatch
+  «$admininstr_instr» instr'
+argument
+  instr'
+has type
+  List Instr : Type
+but is expected to have type
+  Instr : Type
 ```

From f52b26c69135051c6b1ab86d55d9bfdc60338bcc Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Thu, 6 Apr 2023 12:32:06 +0200
Subject: [PATCH 38/98] More injections

---
 spectec/spec/1-syntax.watsup  |  4 +--
 spectec/test-frontend/TEST.md |  4 +--
 spectec/test-haskell/TEST.md  | 12 +++++--
 spectec/test-lean4/TEST.md    | 66 +++++++++++++----------------------
 4 files changed, 39 insertions(+), 47 deletions(-)

diff --git a/spectec/spec/1-syntax.watsup b/spectec/spec/1-syntax.watsup
index 3f9522436a..88898037ee 100644
--- a/spectec/spec/1-syntax.watsup
+++ b/spectec/spec/1-syntax.watsup
@@ -45,8 +45,8 @@ syntax reftype hint(desc "reference type") =
 syntax valtype hint(desc "value type") =
   | numtype | vectype | reftype | BOT
 
-syntax in hint(show I#n) hint(supertype numtype) = | I32 | I64
-syntax fn hint(show F#n) hint(supertype numtype) = | F32 | F64
+syntax in hint(show I#n) hint(supertype numtype valtype) = | I32 | I64
+syntax fn hint(show F#n) hint(supertype numtype valtype) = | F32 | F64
 
 var t : valtype
 var nt : numtype
diff --git a/spectec/test-frontend/TEST.md b/spectec/test-frontend/TEST.md
index 301f4d0af4..436ae4b157 100644
--- a/spectec/test-frontend/TEST.md
+++ b/spectec/test-frontend/TEST.md
@@ -69,12 +69,12 @@ syntax valtype =
   | reftype
   | BOT
 
-;; 1-syntax.watsup:48.1-48.63
+;; 1-syntax.watsup:48.1-48.71
 syntax in =
   | I32
   | I64
 
-;; 1-syntax.watsup:49.1-49.63
+;; 1-syntax.watsup:49.1-49.71
 syntax fn =
   | F32
   | F64
diff --git a/spectec/test-haskell/TEST.md b/spectec/test-haskell/TEST.md
index b911042412..b187692388 100644
--- a/spectec/test-haskell/TEST.md
+++ b/spectec/test-haskell/TEST.md
@@ -78,6 +78,10 @@ numtype_in :: In -> Numtype
 numtype_in In_I32 = Numtype_I32
 numtype_in In_I64 = Numtype_I64
 
+valtype_in :: In -> Valtype
+valtype_in In_I32 = Valtype_I32
+valtype_in In_I64 = Valtype_I64
+
 data Fn
  = Fn_F32
  | Fn_F64
@@ -86,6 +90,10 @@ numtype_fn :: Fn -> Numtype
 numtype_fn Fn_F32 = Numtype_F32
 numtype_fn Fn_F64 = Numtype_F64
 
+valtype_fn :: Fn -> Valtype
+valtype_fn Fn_F32 = Valtype_F32
+valtype_fn Fn_F64 = Valtype_F64
+
 type Resulttype = [Valtype]
 
 type Limits = {- mixop: `[%..%]` -} (U32, U32)
@@ -660,9 +668,9 @@ cvtop :: (Numtype, Cvtop, Numtype, (Maybe Sx), C_numtype) -> [C_numtype]
 
 $ ghc -c Test.hs
 
-Test.hs:608:6: error: parse error on input ‘::’
+Test.hs:616:6: error: parse error on input ‘::’
     |
-608 | data :: (State, Dataidx) -> Datainst
+616 | data :: (State, Dataidx) -> Datainst
     |      ^^
 [1]
 ```
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index f4eb8065b8..e8716177c5 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -83,6 +83,10 @@ def «$numtype_in» : In -> Numtype
   | In.I32 => Numtype.I32
   | In.I64 => Numtype.I64
 
+def «$valtype_in» : In -> Valtype
+  | In.I32 => Valtype.I32
+  | In.I64 => Valtype.I64
+
 inductive Fn where
  | F32 : Fn
  | F64 : Fn
@@ -92,6 +96,10 @@ def «$numtype_fn» : Fn -> Numtype
   | Fn.F32 => Numtype.F32
   | Fn.F64 => Numtype.F64
 
+def «$valtype_fn» : Fn -> Valtype
+  | Fn.F32 => Valtype.F32
+  | Fn.F64 => Valtype.F64
+
 @[reducible] def Resulttype := (List Valtype)
 
 @[reducible] def Limits := /- mixop: `[%..%]` -/ (U32 × U32)
@@ -1256,38 +1264,14 @@ has type
   Unit × Valtype : Type
 but is expected to have type
   Globaltype : Type
-SpecTec.lean: error: function expected at
-  «$valtype_fn»
-term has type
-  ?m.74906
-SpecTec.lean: error: function expected at
-  «$valtype_fn»
-term has type
-  ?m.74906
-SpecTec.lean: error: function expected at
-  «$valtype_in»
-term has type
-  ?m.75090
-SpecTec.lean: error: function expected at
-  «$valtype_in»
-term has type
-  ?m.75090
-SpecTec.lean: error: function expected at
-  «$valtype_in»
-term has type
-  ?m.75090
-SpecTec.lean: error: function expected at
-  «$valtype_in»
-term has type
-  ?m.75090
 SpecTec.lean: error: function expected at
   «$valtype_resulttype»
 term has type
-  ?m.76089
+  ?m.76086
 SpecTec.lean: error: function expected at
   «$valtype_resulttype»
 term has type
-  ?m.76089
+  ?m.76086
 SpecTec.lean: error: application type mismatch
   (t_1, t_2)
 argument
@@ -1345,7 +1329,7 @@ has type
 but is expected to have type
   List Valtype : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Instr) Instr ?m.77676
+  HAppend (List Instr) Instr ?m.77673
 SpecTec.lean: error: application type mismatch
   (C, instr)
 argument
@@ -1482,7 +1466,7 @@ has type
 but is expected to have type
   Instr : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Admininstr) Admininstr ?m.178431
+  HAppend (List Admininstr) Admininstr ?m.178360
 SpecTec.lean: error: application type mismatch
   «$admininstr_val» val
 argument
@@ -1492,7 +1476,7 @@ has type
 but is expected to have type
   Val : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr (List Admininstr) ?m.178638
+  HAppend Admininstr (List Admininstr) ?m.178567
 SpecTec.lean: error: application type mismatch
   «$admininstr_val» val'
 argument
@@ -1518,7 +1502,7 @@ has type
 but is expected to have type
   Instr : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Admininstr) Admininstr ?m.179157
+  HAppend (List Admininstr) Admininstr ?m.179086
 SpecTec.lean: error: application type mismatch
   «$admininstr_val» val
 argument
@@ -1560,7 +1544,7 @@ has type
 but is expected to have type
   Instr : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Admininstr) Admininstr ?m.180061
+  HAppend (List Admininstr) Admininstr ?m.179990
 SpecTec.lean: error: application type mismatch
   «$admininstr_val» val
 argument
@@ -1570,7 +1554,7 @@ has type
 but is expected to have type
   Val : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr (List Admininstr) ?m.180268
+  HAppend Admininstr (List Admininstr) ?m.180197
 SpecTec.lean: error: application type mismatch
   «$admininstr_val» val'
 argument
@@ -1596,7 +1580,7 @@ has type
 but is expected to have type
   Instr : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Admininstr) Admininstr ?m.180794
+  HAppend (List Admininstr) Admininstr ?m.180723
 SpecTec.lean: error: application type mismatch
   «$admininstr_val» val
 argument
@@ -1614,7 +1598,7 @@ has type
 but is expected to have type
   Instr : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr Admininstr ?m.181089
+  HAppend Admininstr Admininstr ?m.181018
 SpecTec.lean: error: application type mismatch
   «$admininstr_val» val
 argument
@@ -1640,7 +1624,7 @@ has type
 but is expected to have type
   Val : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr (List Admininstr) ?m.181730
+  HAppend Admininstr (List Admininstr) ?m.181659
 SpecTec.lean: error: application type mismatch
   «$admininstr_val» val
 argument
@@ -1658,7 +1642,7 @@ has type
 but is expected to have type
   Instr : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr Admininstr ?m.182041
+  HAppend Admininstr Admininstr ?m.181970
 SpecTec.lean: error: application type mismatch
   «$admininstr_val» val
 argument
@@ -1668,7 +1652,7 @@ has type
 but is expected to have type
   Val : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr (List Admininstr) ?m.182398
+  HAppend Admininstr (List Admininstr) ?m.182327
 SpecTec.lean: error: application type mismatch
   «$admininstr_val» val
 argument
@@ -1686,11 +1670,11 @@ has type
 but is expected to have type
   Instr : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr Admininstr ?m.182703
+  HAppend Admininstr Admininstr ?m.182632
 SpecTec.lean: error: function expected at
   «$admininstr_globalinst»
 term has type
-  ?m.185027
+  ?m.184956
 SpecTec.lean: error: application type mismatch
   «$default_» t
 argument
@@ -1700,7 +1684,7 @@ has type
 but is expected to have type
   Valtype : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Val) Val ?m.185601
+  HAppend (List Val) Val ?m.185530
 SpecTec.lean: error: application type mismatch
   «$admininstr_val» val
 argument
@@ -1710,7 +1694,7 @@ has type
 but is expected to have type
   Val : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr (List Admininstr) ?m.185919
+  HAppend Admininstr (List Admininstr) ?m.185848
 SpecTec.lean: error: application type mismatch
   «$admininstr_instr» instr
 argument

From dfc4c62ca655885388cd5d1357418b3d9921f9cf Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Fri, 7 Apr 2023 14:14:21 +0200
Subject: [PATCH 39/98] Normalize better

---
 spectec/test-lean4/TEST.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 485c7d80ba..fdb561aa10 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -1208,7 +1208,7 @@ inductive Step : (Config × Config) -> Prop where
   | pure (instr : (List Instr)) (instr' : (List Instr)) (z : State) :
     (Step_pure ((«$admininstr_instr» instr) /- *{instr} -/, («$admininstr_instr» instr') /- *{instr'} -/)) ->
     (Step ((z, («$admininstr_instr» instr) /- *{instr} -/), (z, («$admininstr_instr» instr') /- *{instr'} -/)))
-$ lean SpecTec.lean 2>&1 | sed -e 's,/[^ ]*/toolchains,.../toolchains`,g' | sed -e 's,SpecTec.lean:[0-9]\+:[0-9]\+,SpecTec.lean,'
+$ lean SpecTec.lean 2>&1 | sed -e 's,/[^ ]*/toolchains,.../toolchains`,g' | sed -e 's,SpecTec.lean:[0-9]\+:[0-9]\+,SpecTec.lean,' | sed -e 's,\?m\.[0-9]\+,?m,g'
 SpecTec.lean: warning: unused variable `n_3_ATOM_y` [linter.unusedVariables]
 SpecTec.lean: error: application type mismatch
   Prod.mk t_1

From 7147fc77eb1a95c874e1bd2a3d1f6cbac5221d65 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Fri, 7 Apr 2023 14:14:27 +0200
Subject: [PATCH 40/98] Unary IterE

---
 spectec/src/backend-lean4/gen.ml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index bcb1538cab..111d0f9e86 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -109,9 +109,13 @@ let rec render_exp (exp : exp) = match exp.it with
   | ListE es -> render_list render_exp es
   | OptE None -> "none"
   | OptE (Some e) -> "some" $$ render_exp e
-  | IterE (e, iter) -> begin match e.it with
+  | IterE (e, (iter, vs)) -> begin match e.it with
     | VarE v -> render_id v (* Short-ciruit this common form *)
-    | _ -> render_exp e ^ " /- " ^ Il.Print.string_of_iterexp iter ^ " -/"
+    | _ -> match iter, vs with
+      | (List|List1|ListN _), [v] ->
+        "(List.map (λ " ^ render_id v ^ " ↦ " ^ render_exp e ^ ") " ^ render_id v ^ ")"
+      | _, _ ->
+      render_exp e ^ " /- " ^ Il.Print.string_of_iter iter ^ " -/"
   end
   | CaseE (a, e, typ) -> render_case a e typ
   | StrE fields -> braces ( String.concat ", " (List.map (fun (a, e) ->

From f5d5788d6a070417fc3bae9e4ce8fcc2e135161f Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Fri, 7 Apr 2023 14:35:03 +0200
Subject: [PATCH 41/98] Some promoted premises

---
 spectec/src/backend-lean4/gen.ml |  23 +-
 spectec/test-lean4/TEST.md       | 480 ++++---------------------------
 2 files changed, 70 insertions(+), 433 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 111d0f9e86..0b27da78c4 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -114,6 +114,8 @@ let rec render_exp (exp : exp) = match exp.it with
     | _ -> match iter, vs with
       | (List|List1|ListN _), [v] ->
         "(List.map (λ " ^ render_id v ^ " ↦ " ^ render_exp e ^ ") " ^ render_id v ^ ")"
+      | (List|List1|ListN _), [v1; v2] ->
+        "(List.zipWith (λ " ^ render_id v1 ^ " " ^ render_id v2 ^ " ↦ " ^ render_exp e ^ ") " ^ render_id v1 ^ " " ^ render_id v2 ^ ")"
       | _, _ ->
       render_exp e ^ " /- " ^ Il.Print.string_of_iter iter ^ " -/"
   end
@@ -164,7 +166,14 @@ let rec render_prem (prem : premise) =
     match prem.it with
     | RulePr (pid, _mixops, pexp) -> render_type_name pid $$ render_exp pexp
     | IfPr (pexp) -> render_exp pexp
-    | IterPr (prem, iter) -> render_prem prem ^ " /- " ^ Il.Print.string_of_iterexp iter ^ " -/"
+    | IterPr (prem, iterexp) ->
+    begin match iterexp with
+      | (List|List1|ListN _), [v] ->
+        "(Forall (λ " ^ render_id v ^ " ↦ " ^ render_prem prem ^ ") " ^ render_id v ^ ")"
+      | (List|List1|ListN _), [v1; v2] ->
+        "(Forall₂ (λ " ^ render_id v1 ^ " " ^ render_id v2 ^ " ↦ " ^ render_prem prem ^ ") " ^ render_id v1 ^ " " ^ render_id v2 ^ ")"
+      | _,_ -> render_prem prem ^ " /- " ^ Il.Print.string_of_iterexp iterexp ^ " -/"
+    end
     | ElsePr -> "True /- Else? -/"
 
 let rec render_def (d : def) =
@@ -240,6 +249,18 @@ let gen_string (el : script) =
   "/- Lean 4 export -/\n\n" ^
   "instance : Append (Option a) where\n" ^
   "  append := fun o1 o2 => match o1 with | none => o2 | _ => o1\n\n" ^
+  "\n" ^
+  (* Really not in the default distribution? *)
+  "inductive Forall (R : α → Prop) : List α → Prop\n" ^
+  "  | nil : Forall R []\n" ^
+  "  | cons {a l₁} : R a → Forall R l₁ → Forall R (a :: l₁)\n" ^
+  "attribute [simp] Forall.nil\n" ^
+  "variable {r : α → β → Prop} {p : γ → δ → Prop}\n" ^
+  "inductive Forall₂ (R : α → β → Prop) : List α → List β → Prop\n" ^
+  "  | nil : Forall₂ R [] []\n" ^
+  "  | cons {a b l₁ l₂} : R a b → Forall₂ R l₁ l₂ → Forall₂ R (a :: l₁) (b :: l₂)\n" ^
+  "attribute [simp] Forall₂.nil\n" ^
+
   render_script el
 
 
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index fdb561aa10..b485871a8e 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -8,6 +8,16 @@ $ cat SpecTec.lean
 instance : Append (Option a) where
   append := fun o1 o2 => match o1 with | none => o2 | _ => o1
 
+
+inductive Forall (R : α → Prop) : List α → Prop
+  | nil : Forall R []
+  | cons {a l₁} : R a → Forall R l₁ → Forall R (a :: l₁)
+attribute [simp] Forall.nil
+variable {r : α → β → Prop} {p : γ → δ → Prop}
+inductive Forall₂ (R : α → β → Prop) : List α → List β → Prop
+  | nil : Forall₂ R [] []
+  | cons {a b l₁ l₂} : R a b → Forall₂ R l₁ l₂ → Forall₂ R (a :: l₁) (b :: l₂)
+attribute [simp] Forall₂.nil
 @[reducible] def N := Nat
 
 @[reducible] def Name := String
@@ -405,7 +415,7 @@ inductive Valtype_sub : (Valtype × Valtype) -> Prop where
 
 inductive Resulttype_sub : ((List Valtype) × (List Valtype)) -> Prop where
   | rule_0 (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
-    (Valtype_sub (t_1, t_2)) /- *{t_1 t_2} -/ ->
+    (Forall₂ (λ t_1 t_2 ↦ (Valtype_sub (t_1, t_2))) t_1 t_2) ->
     (Resulttype_sub (t_1, t_2))
 
 inductive Limits_sub : (Limits × Limits) -> Prop where
@@ -464,7 +474,7 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» t)) 8))) ->
     (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» t)) 8)))) /- ?{n} -/ ->
     ((n == none) || (nt == («$numtype_in» «in»))) ->
-    (Instr_ok (C, (Instr.LOAD (nt, (n, sx) /- ?{n sx} -/, n_A, n_O)), ([Valtype.I32], [(«$valtype_numtype» nt)])))
+    (Instr_ok (C, (Instr.LOAD (nt, (n, sx) /- ? -/, n_A, n_O)), ([Valtype.I32], [(«$valtype_numtype» nt)])))
   | data_drop (C : Context) (x : Idx) :
     ((C.DATA.get! x) == ()) ->
     (Instr_ok (C, (Instr.DATA_DROP x), ([], [])))
@@ -514,7 +524,7 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     ((C.GLOBAL.get! x) == ((some ()), t)) ->
     (Instr_ok (C, (Instr.GLOBAL_SET x), ([t], [])))
   | global_get (C : Context) (t : Valtype) (x : Idx) :
-    ((C.GLOBAL.get! x) == (() /- ?{} -/, t)) ->
+    ((C.GLOBAL.get! x) == (() /- ? -/, t)) ->
     (Instr_ok (C, (Instr.GLOBAL_GET x), ([], [t])))
   | local_tee (C : Context) (t : Valtype) (x : Idx) :
     ((C.LOCAL.get! x) == t) ->
@@ -567,7 +577,7 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (C.RETURN == (some t)) ->
     (Instr_ok (C, Instr.RETURN, ((t_1 ++ t), t_2)))
   | br_table (C : Context) (l : (List Labelidx)) (l' : Labelidx) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
-    (Resulttype_sub (t, [(«$valtype_resulttype» (C.LABEL.get! l))])) /- *{l} -/ ->
+    (Forall (λ l ↦ (Resulttype_sub (t, [(«$valtype_resulttype» (C.LABEL.get! l))]))) l) ->
     (Resulttype_sub (t, [(«$valtype_resulttype» (C.LABEL.get! l'))])) ->
     (Instr_ok (C, (Instr.BR_TABLE (l, l')), ((t_1 ++ t), t_2)))
   | br_if (C : Context) (l : Labelidx) (t : (List Valtype)) :
@@ -578,16 +588,16 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (Instr_ok (C, (Instr.BR l), ((t_1 ++ t), t_2)))
   | if (C : Context) (bt : Blocktype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) (t_1 : (List Valtype)) (t_2 : Valtype) :
     (Blocktype_ok (C, bt, (t_1, [t_2]))) ->
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2] /- *{} -/, RETURN := none}), instr_1, (t_1, t_2))) ->
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2] /- *{} -/, RETURN := none}), instr_2, (t_1, t_2))) ->
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2] /- * -/, RETURN := none}), instr_1, (t_1, t_2))) ->
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2] /- * -/, RETURN := none}), instr_2, (t_1, t_2))) ->
     (Instr_ok (C, (Instr.IF (bt, instr_1, instr_2)), (t_1, [t_2])))
   | loop (C : Context) (bt : Blocktype) (instr : (List Instr)) (t_1 : (List Valtype)) (t_2 : Valtype) :
     (Blocktype_ok (C, bt, (t_1, t_2))) ->
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_1] /- *{t_1} -/, RETURN := none}), instr, (t_1, [t_2]))) ->
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_1 ↦ [t_1]) t_1), RETURN := none}), instr, (t_1, [t_2]))) ->
     (Instr_ok (C, (Instr.LOOP (bt, instr)), (t_1, t_2)))
   | block (C : Context) (bt : Blocktype) (instr : (List Instr)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
     (Blocktype_ok (C, bt, (t_1, t_2))) ->
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2] /- *{t_2} -/, RETURN := none}), instr, (t_1, t_2))) ->
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_2 ↦ [t_2]) t_2), RETURN := none}), instr, (t_1, t_2))) ->
     (Instr_ok (C, (Instr.BLOCK (bt, instr)), (t_1, t_2)))
   | select_impl (C : Context) (numtype : Numtype) (t : Valtype) (t' : Valtype) (vectype : Vectype) :
     (Valtype_sub (t, t')) ->
@@ -636,7 +646,7 @@ inductive Instr_const : (Context × Instr) -> Prop where
 
 inductive Expr_const : (Context × Expr) -> Prop where
   | rule_0 (C : Context) (instr : (List Instr)) :
-    (Instr_const (C, instr)) /- *{instr} -/ ->
+    (Forall (λ instr ↦ (Instr_const (C, instr))) instr) ->
     (Expr_const (C, instr))
 
 inductive Expr_ok_const : (Context × Expr × Valtype) -> Prop where
@@ -655,7 +665,7 @@ inductive Func_ok : (Context × Func × Functype) -> Prop where
 inductive Global_ok : (Context × Global × Globaltype) -> Prop where
   | rule_0 (C : Context) (expr : Expr) (gt : Globaltype) (t : Valtype) :
     (Globaltype_ok gt) ->
-    (gt == (() /- ?{} -/, t)) ->
+    (gt == (() /- ? -/, t)) ->
     (Expr_ok_const (C, expr, t)) ->
     (Global_ok (C, (gt, expr), gt))
 
@@ -679,7 +689,7 @@ inductive Elemmode_ok : (Context × Elemmode × Reftype) -> Prop where
 
 inductive Elem_ok : (Context × Elem × Reftype) -> Prop where
   | rule_0 (C : Context) (elemmode : (Option Elemmode)) (expr : (List Expr)) (rt : Reftype) :
-    (Expr_ok (C, expr, [(«$valtype_reftype» rt)])) /- *{expr} -/ ->
+    (Forall (λ expr ↦ (Expr_ok (C, expr, [(«$valtype_reftype» rt)]))) expr) ->
     (Elemmode_ok (C, elemmode, rt)) /- ?{elemmode} -/ ->
     (Elem_ok (C, (rt, expr, elemmode), rt))
 
@@ -692,7 +702,7 @@ inductive Datamode_ok : (Context × Datamode) -> Prop where
 inductive Data_ok : (Context × Data) -> Prop where
   | rule_0 (C : Context) (b : (List (List Byte))) (datamode : (Option Datamode)) :
     (Datamode_ok (C, datamode)) /- ?{datamode} -/ ->
-    (Data_ok (C, (b /- *{b} -/, datamode)))
+    (Data_ok (C, ((List.map (λ b ↦ b) b), datamode)))
 
 inductive Start_ok : (Context × Start) -> Prop where
   | rule_0 (C : Context) (x : Idx) :
@@ -725,14 +735,14 @@ inductive Export_ok : (Context × Export × Externtype) -> Prop where
 
 inductive Module_ok : Module -> Prop where
   | rule_0 (C : Context) (data : (List Data)) (elem : (List Elem)) («export» : (List Export)) (ft : (List Functype)) (func : (List Func)) («global» : (List Global)) (gt : (List Globaltype)) («import» : (List Import)) (mem : (List Mem)) (mt : (List Memtype)) (n : N) (rt : (List Reftype)) (start : (List Start)) (table : (List Table)) (tt : (List Tabletype)) :
-    (C == {FUNC := ft, GLOBAL := gt, TABLE := tt, MEM := mt, ELEM := rt, DATA := () /- ^n{} -/, LOCAL := [], LABEL := [], RETURN := none}) ->
-    (Func_ok (C, func, ft)) /- *{ft func} -/ ->
-    (Global_ok (C, «global», gt)) /- *{global gt} -/ ->
-    (Table_ok (C, table, tt)) /- *{table tt} -/ ->
-    (Mem_ok (C, mem, mt)) /- *{mem mt} -/ ->
-    (Elem_ok (C, elem, rt)) /- *{elem rt} -/ ->
-    (Data_ok (C, data)) /- ^n{data} -/ ->
-    (Start_ok (C, start)) /- *{start} -/ ->
+    (C == {FUNC := ft, GLOBAL := gt, TABLE := tt, MEM := mt, ELEM := rt, DATA := () /- ^n -/, LOCAL := [], LABEL := [], RETURN := none}) ->
+    (Forall₂ (λ ft func ↦ (Func_ok (C, func, ft))) ft func) ->
+    (Forall₂ (λ «global» gt ↦ (Global_ok (C, «global», gt))) «global» gt) ->
+    (Forall₂ (λ table tt ↦ (Table_ok (C, table, tt))) table tt) ->
+    (Forall₂ (λ mem mt ↦ (Mem_ok (C, mem, mt))) mem mt) ->
+    (Forall₂ (λ elem rt ↦ (Elem_ok (C, elem, rt))) elem rt) ->
+    (Forall (λ data ↦ (Data_ok (C, data))) data) ->
+    (Forall (λ start ↦ (Start_ok (C, start))) start) ->
     (mem.length <= 1) ->
     (start.length <= 1) ->
     (Module_ok («import», func, «global», table, mem, elem, data, start, «export»))
@@ -1073,11 +1083,11 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     ((«$unop» (unop, nt, c_1)) == [c]) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.UNOP (nt, unop))], [(Admininstr.CONST (nt, c))]))
   | return_label (instr : (List Instr)) (instr' : (List Instr)) (k : Nat) (val : (List Val)) :
-    (Step_pure ([(Admininstr.LABEL_ (k, instr', ((«$admininstr_val» val) /- *{val} -/ ++ ([Admininstr.RETURN] ++ («$admininstr_instr» instr) /- *{instr} -/))))], ((«$admininstr_val» val) /- *{val} -/ ++ [Admininstr.RETURN])))
+    (Step_pure ([(Admininstr.LABEL_ (k, instr', ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([Admininstr.RETURN] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)))))], ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [Admininstr.RETURN])))
   | return_frame (f : Frame) (instr : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) :
-    (Step_pure ([(Admininstr.FRAME_ (n, f, ((«$admininstr_val» val') /- *{val'} -/ ++ ((«$admininstr_val» val) /- ^n{val} -/ ++ ([Admininstr.RETURN] ++ («$admininstr_instr» instr) /- *{instr} -/)))))], («$admininstr_val» val) /- ^n{val} -/))
+    (Step_pure ([(Admininstr.FRAME_ (n, f, ((List.map (λ val' ↦ («$admininstr_val» val')) val') ++ ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([Admininstr.RETURN] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr))))))], (List.map (λ val ↦ («$admininstr_val» val)) val)))
   | frame_vals (f : Frame) (n : N) (val : (List Val)) :
-    (Step_pure ([(Admininstr.FRAME_ (n, f, («$admininstr_val» val) /- ^n{val} -/))], («$admininstr_val» val) /- ^n{val} -/))
+    (Step_pure ([(Admininstr.FRAME_ (n, f, (List.map (λ val ↦ («$admininstr_val» val)) val)))], (List.map (λ val ↦ («$admininstr_val» val)) val)))
   | br_table_ge (i : Nat) (l : (List Labelidx)) (l' : Labelidx) :
     (i >= l.length) ->
     (Step_pure ([(Admininstr.CONST (Numtype.I32, i)), (Admininstr.BR_TABLE (l, l'))], [(Admininstr.BR l')]))
@@ -1091,11 +1101,11 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (c != 0) ->
     (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.BR_IF l)], [(Admininstr.BR l)]))
   | br_succ (instr : (List Instr)) (instr' : (List Instr)) (l : Labelidx) (n : N) (val : (List Val)) :
-    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((«$admininstr_val» val) /- *{val} -/ ++ ([(Admininstr.BR (l + 1))] ++ («$admininstr_instr» instr) /- *{instr} -/))))], ((«$admininstr_val» val) /- *{val} -/ ++ [(Admininstr.BR l)])))
+    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([(Admininstr.BR (l + 1))] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)))))], ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.BR l)])))
   | br_zero (instr : (List Instr)) (instr' : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) :
-    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((«$admininstr_val» val') /- *{val'} -/ ++ ((«$admininstr_val» val) /- ^n{val} -/ ++ ([(Admininstr.BR 0)] ++ («$admininstr_instr» instr) /- *{instr} -/)))))], ((«$admininstr_val» val) /- ^n{val} -/ ++ («$admininstr_instr» instr') /- *{instr'} -/)))
+    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((List.map (λ val' ↦ («$admininstr_val» val')) val') ++ ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([(Admininstr.BR 0)] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr))))))], ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ (List.map (λ instr' ↦ («$admininstr_instr» instr')) instr'))))
   | label_vals (instr : (List Instr)) (n : N) (val : (List Val)) :
-    (Step_pure ([(Admininstr.LABEL_ (n, instr, («$admininstr_val» val) /- *{val} -/))], («$admininstr_val» val) /- *{val} -/))
+    (Step_pure ([(Admininstr.LABEL_ (n, instr, (List.map (λ val ↦ («$admininstr_val» val)) val)))], (List.map (λ val ↦ («$admininstr_val» val)) val)))
   | if_false (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) :
     (c == 0) ->
     (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.IF (bt, instr_1, instr_2))], [(Admininstr.BLOCK (bt, instr_2))]))
@@ -1104,10 +1114,10 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.IF (bt, instr_1, instr_2))], [(Admininstr.BLOCK (bt, instr_1))]))
   | loop (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
     (bt == (t_1, t_2)) ->
-    (Step_pure (((«$admininstr_val» val) /- ^k{val} -/ ++ [(Admininstr.LOOP (bt, instr))]), [(Admininstr.LABEL_ (n, [(Instr.LOOP (bt, instr))], ((«$admininstr_val» val) /- ^k{val} -/ ++ («$admininstr_instr» instr) /- *{instr} -/)))]))
+    (Step_pure (((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.LOOP (bt, instr))]), [(Admininstr.LABEL_ (n, [(Instr.LOOP (bt, instr))], ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr))))]))
   | block (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
     (bt == (t_1, t_2)) ->
-    (Step_pure (((«$admininstr_val» val) /- ^k{val} -/ ++ [(Admininstr.BLOCK (bt, instr))]), [(Admininstr.LABEL_ (n, [], ((«$admininstr_val» val) /- ^k{val} -/ ++ («$admininstr_instr» instr) /- *{instr} -/)))]))
+    (Step_pure (((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.BLOCK (bt, instr))]), [(Admininstr.LABEL_ (n, [], ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr))))]))
   | select_false (c : C_numtype) (t : (Option Valtype)) (val_1 : Val) (val_2 : Val) :
     (c == 0) ->
     (Step_pure ([(«$admininstr_val» val_1), («$admininstr_val» val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)], [(«$admininstr_val» val_2)]))
@@ -1178,8 +1188,8 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (Step_read ((z, [(Admininstr.REF_FUNC x)]), [(Admininstr.REF_FUNC_ADDR ((«$funcaddr» z).get! x))]))
   | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
     (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
-    (f == {LOCAL := (val ++ («$default_» t) /- *{t} -/), MODULE := m}) ->
-    (Step_read ((z, ((«$admininstr_val» val) /- ^k{val} -/ ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, f, [(Admininstr.LABEL_ (n, [], («$admininstr_instr» instr) /- *{instr} -/))]))]))
+    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t)) t)), MODULE := m}) ->
+    (Step_read ((z, ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, f, [(Admininstr.LABEL_ (n, [], (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)))]))]))
   | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
     True /- Else? -/ ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [Admininstr.TRAP]))
@@ -1203,21 +1213,13 @@ inductive Step : (Config × Config) -> Prop where
   | local_set (val : Val) (x : Idx) (z : State) :
     (Step ((z, [(«$admininstr_val» val), (Admininstr.LOCAL_SET x)]), ((«$with_local» (z, x, val)), [])))
   | read (instr : (List Instr)) (instr' : (List Instr)) (z : State) :
-    (Step_read ((z, («$admininstr_instr» instr) /- *{instr} -/), («$admininstr_instr» instr') /- *{instr'} -/)) ->
-    (Step ((z, («$admininstr_instr» instr) /- *{instr} -/), (z, («$admininstr_instr» instr') /- *{instr'} -/)))
+    (Step_read ((z, (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)), (List.map (λ instr' ↦ («$admininstr_instr» instr')) instr'))) ->
+    (Step ((z, (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)), (z, (List.map (λ instr' ↦ («$admininstr_instr» instr')) instr'))))
   | pure (instr : (List Instr)) (instr' : (List Instr)) (z : State) :
-    (Step_pure ((«$admininstr_instr» instr) /- *{instr} -/, («$admininstr_instr» instr') /- *{instr'} -/)) ->
-    (Step ((z, («$admininstr_instr» instr) /- *{instr} -/), (z, («$admininstr_instr» instr') /- *{instr'} -/)))
+    (Step_pure ((List.map (λ instr ↦ («$admininstr_instr» instr)) instr), (List.map (λ instr' ↦ («$admininstr_instr» instr')) instr'))) ->
+    (Step ((z, (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)), (z, (List.map (λ instr' ↦ («$admininstr_instr» instr')) instr'))))
 $ lean SpecTec.lean 2>&1 | sed -e 's,/[^ ]*/toolchains,.../toolchains`,g' | sed -e 's,SpecTec.lean:[0-9]\+:[0-9]\+,SpecTec.lean,' | sed -e 's,\?m\.[0-9]\+,?m,g'
 SpecTec.lean: warning: unused variable `n_3_ATOM_y` [linter.unusedVariables]
-SpecTec.lean: error: application type mismatch
-  Prod.mk t_1
-argument
-  t_1
-has type
-  List Valtype : Type
-but is expected to have type
-  Valtype : Type
 SpecTec.lean: error: application type mismatch
   Nat.div n
 argument
@@ -1267,11 +1269,11 @@ but is expected to have type
 SpecTec.lean: error: function expected at
   «$valtype_resulttype»
 term has type
-  ?m.76086
+  ?m
 SpecTec.lean: error: function expected at
   «$valtype_resulttype»
 term has type
-  ?m.76086
+  ?m
 SpecTec.lean: error: application type mismatch
   (t_1, t_2)
 argument
@@ -1329,29 +1331,13 @@ has type
 but is expected to have type
   List Valtype : Type
 SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Instr) Instr ?m.77673
-SpecTec.lean: error: application type mismatch
-  (C, instr)
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
+  HAppend (List Instr) Instr ?m
 SpecTec.lean: error: type mismatch
   ((), t)
 has type
   Unit × Valtype : Type
 but is expected to have type
   Globaltype : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk expr
-argument
-  expr
-has type
-  List Expr : Type
-but is expected to have type
-  Expr : Type
 SpecTec.lean: error: application type mismatch
   Prod.mk elemmode
 argument
@@ -1374,62 +1360,6 @@ has type
   Unit : Type
 but is expected to have type
   List Datatype : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk func
-argument
-  func
-has type
-  List Func : Type
-but is expected to have type
-  Func : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk global
-argument
-  global
-has type
-  List Global : Type
-but is expected to have type
-  Global : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk table
-argument
-  table
-has type
-  List Table : Type
-but is expected to have type
-  Table : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk mem
-argument
-  mem
-has type
-  List Mem : Type
-but is expected to have type
-  Mem : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk elem
-argument
-  elem
-has type
-  List Elem : Type
-but is expected to have type
-  Elem : Type
-SpecTec.lean: error: application type mismatch
-  (C, data)
-argument
-  data
-has type
-  List Data : Type
-but is expected to have type
-  Data : Type
-SpecTec.lean: error: application type mismatch
-  (C, start)
-argument
-  start
-has type
-  List Start : Type
-but is expected to have type
-  Start : Type
 SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `f` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
@@ -1449,260 +1379,10 @@ SpecTec.lean: warning: unused variable `r` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `r` [linter.unusedVariables]
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_instr» instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Admininstr) Admininstr ?m.178360
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr (List Admininstr) ?m.178567
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val'
-argument
-  val'
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_instr» instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Admininstr) Admininstr ?m.179086
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_instr» instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Admininstr) Admininstr ?m.179990
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr (List Admininstr) ?m.180197
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val'
-argument
-  val'
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_instr» instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Admininstr) Admininstr ?m.180723
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_instr» instr'
-argument
-  instr'
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr Admininstr ?m.181018
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr (List Admininstr) ?m.181659
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_instr» instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr Admininstr ?m.181970
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr (List Admininstr) ?m.182327
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_instr» instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr Admininstr ?m.182632
 SpecTec.lean: error: function expected at
   «$admininstr_globalinst»
 term has type
-  ?m.184956
-SpecTec.lean: error: application type mismatch
-  «$default_» t
-argument
-  t
-has type
-  List Valtype : Type
-but is expected to have type
-  Valtype : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Val) Val ?m.185530
-SpecTec.lean: error: application type mismatch
-  «$admininstr_val» val
-argument
-  val
-has type
-  List Val : Type
-but is expected to have type
-  Val : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend Admininstr (List Admininstr) ?m.185848
-SpecTec.lean: error: application type mismatch
-  «$admininstr_instr» instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
+  ?m
 SpecTec.lean: error: application type mismatch
   (x, ref)
 argument
@@ -1711,68 +1391,4 @@ has type
   Ref : Type
 but is expected to have type
   List Ref : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_instr» instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_instr» instr'
-argument
-  instr'
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_instr» instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_instr» instr'
-argument
-  instr'
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_instr» instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_instr» instr'
-argument
-  instr'
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_instr» instr
-argument
-  instr
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
-SpecTec.lean: error: application type mismatch
-  «$admininstr_instr» instr'
-argument
-  instr'
-has type
-  List Instr : Type
-but is expected to have type
-  Instr : Type
 ```

From 5dc8377d17ac43d34a243cabad939c1cabc94a63 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Fri, 7 Apr 2023 17:23:05 +0200
Subject: [PATCH 42/98] More option iteration

---
 spectec/src/backend-lean4/gen.ml | 15 ++++++
 spectec/test-lean4/TEST.md       | 88 +++++---------------------------
 2 files changed, 28 insertions(+), 75 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 0b27da78c4..2a5e001493 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -116,6 +116,11 @@ let rec render_exp (exp : exp) = match exp.it with
         "(List.map (λ " ^ render_id v ^ " ↦ " ^ render_exp e ^ ") " ^ render_id v ^ ")"
       | (List|List1|ListN _), [v1; v2] ->
         "(List.zipWith (λ " ^ render_id v1 ^ " " ^ render_id v2 ^ " ↦ " ^ render_exp e ^ ") " ^ render_id v1 ^ " " ^ render_id v2 ^ ")"
+      | Opt, [] -> "some" $$ render_exp e
+      | Opt, [v] ->
+        "(Option.map (λ " ^ render_id v ^ " ↦ " ^ render_exp e ^ ") " ^ render_id v ^ ")"
+      | Opt, [v1; v2] ->
+        "(Option.zipWith (λ " ^ render_id v1 ^ " " ^ render_id v2 ^ " ↦ " ^ render_exp e ^ ") " ^ render_id v1 ^ " " ^ render_id v2 ^ ")"
       | _, _ ->
       render_exp e ^ " /- " ^ Il.Print.string_of_iter iter ^ " -/"
   end
@@ -172,6 +177,10 @@ let rec render_prem (prem : premise) =
         "(Forall (λ " ^ render_id v ^ " ↦ " ^ render_prem prem ^ ") " ^ render_id v ^ ")"
       | (List|List1|ListN _), [v1; v2] ->
         "(Forall₂ (λ " ^ render_id v1 ^ " " ^ render_id v2 ^ " ↦ " ^ render_prem prem ^ ") " ^ render_id v1 ^ " " ^ render_id v2 ^ ")"
+      | Opt, [v] ->
+        "(Forall (λ " ^ render_id v ^ " ↦ " ^ render_prem prem ^ ") " ^ render_id v ^ ".toList)"
+      | Opt, [v1; v2] ->
+        "(Forall₂ (λ " ^ render_id v1 ^ " " ^ render_id v2 ^ " ↦ " ^ render_prem prem ^ ") " ^ render_id v1 ^ ".toList " ^ render_id v2 ^ ".toList)"
       | _,_ -> render_prem prem ^ " /- " ^ Il.Print.string_of_iterexp iterexp ^ " -/"
     end
     | ElsePr -> "True /- Else? -/"
@@ -260,6 +269,12 @@ let gen_string (el : script) =
   "  | nil : Forall₂ R [] []\n" ^
   "  | cons {a b l₁ l₂} : R a b → Forall₂ R l₁ l₂ → Forall₂ R (a :: l₁) (b :: l₂)\n" ^
   "attribute [simp] Forall₂.nil\n" ^
+  "def Option.zipWith : (α → β → γ) → Option α → Option β → Option γ\n" ^
+  "  | f,  (some x), (some y) => some (f x y)\n" ^
+  "  | _, _, _ => none\n" ^
+  "def Option.toList : Option α → List α\n" ^
+  "  | none => List.nil\n" ^
+  "  | some x => [x]\n" ^
 
   render_script el
 
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index b485871a8e..5f2939ad72 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -18,6 +18,12 @@ inductive Forall₂ (R : α → β → Prop) : List α → List β → Prop
   | nil : Forall₂ R [] []
   | cons {a b l₁ l₂} : R a b → Forall₂ R l₁ l₂ → Forall₂ R (a :: l₁) (b :: l₂)
 attribute [simp] Forall₂.nil
+def Option.zipWith : (α → β → γ) → Option α → Option β → Option γ
+  | f,  (some x), (some y) => some (f x y)
+  | _, _, _ => none
+def Option.toList : Option α → List α
+  | none => List.nil
+  | some x => [x]
 @[reducible] def N := Nat
 
 @[reducible] def Name := String
@@ -466,15 +472,15 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
   | store (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (t : Valtype) :
     ((C.MEM.get! 0) == mt) ->
     ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» t)) 8))) ->
-    (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» t)) 8)))) /- ?{n} -/ ->
+    (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» t)) 8))))) n.toList) ->
     ((n == none) || (nt == («$numtype_in» «in»))) ->
     (Instr_ok (C, (Instr.STORE (nt, n, n_A, n_O)), ([Valtype.I32, («$valtype_numtype» nt)], [])))
   | load (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (sx : (Option Sx)) (t : Valtype) :
     ((C.MEM.get! 0) == mt) ->
     ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» t)) 8))) ->
-    (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» t)) 8)))) /- ?{n} -/ ->
+    (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» t)) 8))))) n.toList) ->
     ((n == none) || (nt == («$numtype_in» «in»))) ->
-    (Instr_ok (C, (Instr.LOAD (nt, (n, sx) /- ? -/, n_A, n_O)), ([Valtype.I32], [(«$valtype_numtype» nt)])))
+    (Instr_ok (C, (Instr.LOAD (nt, (Option.zipWith (λ n sx ↦ (n, sx)) n sx), n_A, n_O)), ([Valtype.I32], [(«$valtype_numtype» nt)])))
   | data_drop (C : Context) (x : Idx) :
     ((C.DATA.get! x) == ()) ->
     (Instr_ok (C, (Instr.DATA_DROP x), ([], [])))
@@ -524,7 +530,7 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     ((C.GLOBAL.get! x) == ((some ()), t)) ->
     (Instr_ok (C, (Instr.GLOBAL_SET x), ([t], [])))
   | global_get (C : Context) (t : Valtype) (x : Idx) :
-    ((C.GLOBAL.get! x) == (() /- ? -/, t)) ->
+    ((C.GLOBAL.get! x) == ((some ()), t)) ->
     (Instr_ok (C, (Instr.GLOBAL_GET x), ([], [t])))
   | local_tee (C : Context) (t : Valtype) (x : Idx) :
     ((C.LOCAL.get! x) == t) ->
@@ -665,7 +671,7 @@ inductive Func_ok : (Context × Func × Functype) -> Prop where
 inductive Global_ok : (Context × Global × Globaltype) -> Prop where
   | rule_0 (C : Context) (expr : Expr) (gt : Globaltype) (t : Valtype) :
     (Globaltype_ok gt) ->
-    (gt == (() /- ? -/, t)) ->
+    (gt == ((some ()), t)) ->
     (Expr_ok_const (C, expr, t)) ->
     (Global_ok (C, (gt, expr), gt))
 
@@ -690,7 +696,7 @@ inductive Elemmode_ok : (Context × Elemmode × Reftype) -> Prop where
 inductive Elem_ok : (Context × Elem × Reftype) -> Prop where
   | rule_0 (C : Context) (elemmode : (Option Elemmode)) (expr : (List Expr)) (rt : Reftype) :
     (Forall (λ expr ↦ (Expr_ok (C, expr, [(«$valtype_reftype» rt)]))) expr) ->
-    (Elemmode_ok (C, elemmode, rt)) /- ?{elemmode} -/ ->
+    (Forall (λ elemmode ↦ (Elemmode_ok (C, elemmode, rt))) elemmode.toList) ->
     (Elem_ok (C, (rt, expr, elemmode), rt))
 
 inductive Datamode_ok : (Context × Datamode) -> Prop where
@@ -701,7 +707,7 @@ inductive Datamode_ok : (Context × Datamode) -> Prop where
 
 inductive Data_ok : (Context × Data) -> Prop where
   | rule_0 (C : Context) (b : (List (List Byte))) (datamode : (Option Datamode)) :
-    (Datamode_ok (C, datamode)) /- ?{datamode} -/ ->
+    (Forall (λ datamode ↦ (Datamode_ok (C, datamode))) datamode.toList) ->
     (Data_ok (C, ((List.map (λ b ↦ b) b), datamode)))
 
 inductive Start_ok : (Context × Start) -> Prop where
@@ -1220,52 +1226,6 @@ inductive Step : (Config × Config) -> Prop where
     (Step ((z, (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)), (z, (List.map (λ instr' ↦ («$admininstr_instr» instr')) instr'))))
 $ lean SpecTec.lean 2>&1 | sed -e 's,/[^ ]*/toolchains,.../toolchains`,g' | sed -e 's,SpecTec.lean:[0-9]\+:[0-9]\+,SpecTec.lean,' | sed -e 's,\?m\.[0-9]\+,?m,g'
 SpecTec.lean: warning: unused variable `n_3_ATOM_y` [linter.unusedVariables]
-SpecTec.lean: error: application type mismatch
-  Nat.div n
-argument
-  n
-has type
-  Option N : Type
-but is expected to have type
-  Nat : Type
-SpecTec.lean: error: application type mismatch
-  Nat.div n
-argument
-  n
-has type
-  Option N : Type
-but is expected to have type
-  Nat : Type
-SpecTec.lean: error: application type mismatch
-  Nat.div n
-argument
-  n
-has type
-  Option N : Type
-but is expected to have type
-  Nat : Type
-SpecTec.lean: error: application type mismatch
-  Nat.div n
-argument
-  n
-has type
-  Option N : Type
-but is expected to have type
-  Nat : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk (n, sx)
-argument
-  (n, sx)
-has type
-  Option N × Option Sx : Type
-but is expected to have type
-  Option (N × Sx) : Type
-SpecTec.lean: error: type mismatch
-  ((), t)
-has type
-  Unit × Valtype : Type
-but is expected to have type
-  Globaltype : Type
 SpecTec.lean: error: function expected at
   «$valtype_resulttype»
 term has type
@@ -1332,28 +1292,6 @@ but is expected to have type
   List Valtype : Type
 SpecTec.lean: error: failed to synthesize instance
   HAppend (List Instr) Instr ?m
-SpecTec.lean: error: type mismatch
-  ((), t)
-has type
-  Unit × Valtype : Type
-but is expected to have type
-  Globaltype : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk elemmode
-argument
-  elemmode
-has type
-  Option Elemmode : Type
-but is expected to have type
-  Elemmode : Type
-SpecTec.lean: error: application type mismatch
-  (C, datamode)
-argument
-  datamode
-has type
-  Option Datamode : Type
-but is expected to have type
-  Datamode : Type
 SpecTec.lean: error: type mismatch
   ()
 has type

From 73d074badd3489a07e042d33c1dafdad2e78b9e9 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Fri, 7 Apr 2023 17:40:17 +0200
Subject: [PATCH 43/98] Work around iteration over no variables

https://github.com/orgs/Wasm-DSL/discussions/13
---
 spectec/spec/1-syntax.watsup     |   5 +-
 spectec/spec/3-typing.watsup     |   2 +-
 spectec/src/backend-lean4/gen.ml |   1 +
 spectec/test-frontend/TEST.md    | 100 ++++++++++++++++---------------
 spectec/test-haskell/TEST.md     |   8 ++-
 spectec/test-latex/TEST.md       |   1 +
 spectec/test-lean4/TEST.md       |   8 ++-
 7 files changed, 69 insertions(+), 56 deletions(-)

diff --git a/spectec/spec/1-syntax.watsup b/spectec/spec/1-syntax.watsup
index 88898037ee..4e03eb22fd 100644
--- a/spectec/spec/1-syntax.watsup
+++ b/spectec/spec/1-syntax.watsup
@@ -58,8 +58,10 @@ syntax resulttype hint(desc "result type") =
 
 syntax limits hint(desc "limits") =
   `[u32 .. u32]
+syntax mutflag hint(desc "mutability flag") =
+  MUT
 syntax globaltype hint(desc "global type") =
-  MUT? valtype
+  mutflag? valtype
 syntax functype hint(desc "function type") =
   resulttype -> resulttype
 syntax tabletype hint(desc "table type") =
@@ -76,6 +78,7 @@ syntax externtype hint(desc "external type") =
 var lim : limits
 var ft : functype
 var gt : globaltype
+var mut : mutflag
 var tt : tabletype
 var mt : memtype
 var xt : externtype
diff --git a/spectec/spec/3-typing.watsup b/spectec/spec/3-typing.watsup
index fdbcc9d8d6..e39845f338 100644
--- a/spectec/spec/3-typing.watsup
+++ b/spectec/spec/3-typing.watsup
@@ -280,7 +280,7 @@ rule Instr_ok/local.tee:
 
 rule Instr_ok/global.get:
   C |- GLOBAL.GET x : epsilon -> t
-  -- if C.GLOBAL[x] = MUT? t
+  -- if C.GLOBAL[x] = mut? t
 
 rule Instr_ok/global.set:
   C |- GLOBAL.SET x : t -> epsilon
diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 2a5e001493..dc848e53af 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -19,6 +19,7 @@ let is_reserved = function
  | "import"
  | "global"
  | "local"
+ | "mut"
  -> true
  | _ -> false
 
diff --git a/spectec/test-frontend/TEST.md b/spectec/test-frontend/TEST.md
index 563a3d4941..ad67bdb7ee 100644
--- a/spectec/test-frontend/TEST.md
+++ b/spectec/test-frontend/TEST.md
@@ -85,43 +85,46 @@ syntax resulttype = valtype*
 ;; 1-syntax.watsup:59.1-60.16
 syntax limits = `[%..%]`(u32, u32)
 
-;; 1-syntax.watsup:61.1-62.15
-syntax globaltype = `MUT%?%`(()?, valtype)
+;; 1-syntax.watsup:61.1-62.6
+syntax mutflag = MUT
 
-;; 1-syntax.watsup:63.1-64.27
+;; 1-syntax.watsup:63.1-64.19
+syntax globaltype = `%?%`(mutflag?, valtype)
+
+;; 1-syntax.watsup:65.1-66.27
 syntax functype = `%->%`(resulttype, resulttype)
 
-;; 1-syntax.watsup:65.1-66.17
+;; 1-syntax.watsup:67.1-68.17
 syntax tabletype = `%%`(limits, reftype)
 
-;; 1-syntax.watsup:67.1-68.12
+;; 1-syntax.watsup:69.1-70.12
 syntax memtype = `%I8`(limits)
 
-;; 1-syntax.watsup:69.1-70.10
+;; 1-syntax.watsup:71.1-72.10
 syntax elemtype = reftype
 
-;; 1-syntax.watsup:71.1-72.5
+;; 1-syntax.watsup:73.1-74.5
 syntax datatype = OK
 
-;; 1-syntax.watsup:73.1-74.69
+;; 1-syntax.watsup:75.1-76.69
 syntax externtype =
   | GLOBAL(globaltype)
   | FUNC(functype)
   | TABLE(tabletype)
   | MEMORY(memtype)
 
-;; 1-syntax.watsup:86.1-86.44
+;; 1-syntax.watsup:89.1-89.44
 syntax sx =
   | U
   | S
 
-;; 1-syntax.watsup:88.1-88.39
+;; 1-syntax.watsup:91.1-91.39
 syntax unop_IXX =
   | CLZ
   | CTZ
   | POPCNT
 
-;; 1-syntax.watsup:89.1-89.70
+;; 1-syntax.watsup:92.1-92.70
 syntax unop_FXX =
   | ABS
   | NEG
@@ -131,7 +134,7 @@ syntax unop_FXX =
   | TRUNC
   | NEAREST
 
-;; 1-syntax.watsup:91.1-93.62
+;; 1-syntax.watsup:94.1-96.62
 syntax binop_IXX =
   | ADD
   | SUB
@@ -146,7 +149,7 @@ syntax binop_IXX =
   | ROTL
   | ROTR
 
-;; 1-syntax.watsup:94.1-94.66
+;; 1-syntax.watsup:97.1-97.66
 syntax binop_FXX =
   | ADD
   | SUB
@@ -156,15 +159,15 @@ syntax binop_FXX =
   | MAX
   | COPYSIGN
 
-;; 1-syntax.watsup:96.1-96.26
+;; 1-syntax.watsup:99.1-99.26
 syntax testop_IXX =
   | EQZ
 
-;; 1-syntax.watsup:97.1-97.22
+;; 1-syntax.watsup:100.1-100.22
 syntax testop_FXX =
   |
 
-;; 1-syntax.watsup:99.1-100.108
+;; 1-syntax.watsup:102.1-103.108
 syntax relop_IXX =
   | EQ
   | NE
@@ -173,7 +176,7 @@ syntax relop_IXX =
   | LE(sx)
   | GE(sx)
 
-;; 1-syntax.watsup:101.1-101.49
+;; 1-syntax.watsup:104.1-104.49
 syntax relop_FXX =
   | EQ
   | NE
@@ -182,44 +185,44 @@ syntax relop_FXX =
   | LE
   | GE
 
-;; 1-syntax.watsup:103.1-103.50
+;; 1-syntax.watsup:106.1-106.50
 syntax unop_numtype =
   | _I(unop_IXX)
   | _F(unop_FXX)
 
-;; 1-syntax.watsup:104.1-104.53
+;; 1-syntax.watsup:107.1-107.53
 syntax binop_numtype =
   | _I(binop_IXX)
   | _F(binop_FXX)
 
-;; 1-syntax.watsup:105.1-105.56
+;; 1-syntax.watsup:108.1-108.56
 syntax testop_numtype =
   | _I(testop_IXX)
   | _F(testop_FXX)
 
-;; 1-syntax.watsup:106.1-106.53
+;; 1-syntax.watsup:109.1-109.53
 syntax relop_numtype =
   | _I(relop_IXX)
   | _F(relop_FXX)
 
-;; 1-syntax.watsup:107.1-107.39
+;; 1-syntax.watsup:110.1-110.39
 syntax cvtop =
   | CONVERT
   | REINTERPRET
 
-;; 1-syntax.watsup:117.1-117.23
+;; 1-syntax.watsup:120.1-120.23
 syntax c_numtype = nat
 
-;; 1-syntax.watsup:118.1-118.23
+;; 1-syntax.watsup:121.1-121.23
 syntax c_vectype = nat
 
-;; 1-syntax.watsup:121.1-121.52
+;; 1-syntax.watsup:124.1-124.52
 syntax blocktype = functype
 
-;; 1-syntax.watsup:156.1-177.55
+;; 1-syntax.watsup:159.1-180.55
 rec {
 
-;; 1-syntax.watsup:156.1-177.55
+;; 1-syntax.watsup:159.1-180.55
 syntax instr =
   | UNREACHABLE
   | NOP
@@ -267,53 +270,53 @@ syntax instr =
   | STORE(numtype, n?, nat, nat)
 }
 
-;; 1-syntax.watsup:179.1-180.9
+;; 1-syntax.watsup:182.1-183.9
 syntax expr = instr*
 
-;; 1-syntax.watsup:185.1-185.50
+;; 1-syntax.watsup:188.1-188.50
 syntax elemmode =
   | TABLE(tableidx, expr)
   | DECLARE
 
-;; 1-syntax.watsup:186.1-186.39
+;; 1-syntax.watsup:189.1-189.39
 syntax datamode =
   | MEMORY(memidx, expr)
 
-;; 1-syntax.watsup:188.1-189.30
+;; 1-syntax.watsup:191.1-192.30
 syntax func = `FUNC%%*%`(functype, valtype*, expr)
 
-;; 1-syntax.watsup:190.1-191.25
+;; 1-syntax.watsup:193.1-194.25
 syntax global = GLOBAL(globaltype, expr)
 
-;; 1-syntax.watsup:192.1-193.18
+;; 1-syntax.watsup:195.1-196.18
 syntax table = TABLE(tabletype)
 
-;; 1-syntax.watsup:194.1-195.17
+;; 1-syntax.watsup:197.1-198.17
 syntax mem = MEMORY(memtype)
 
-;; 1-syntax.watsup:196.1-197.31
+;; 1-syntax.watsup:199.1-200.31
 syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
 
-;; 1-syntax.watsup:198.1-199.26
+;; 1-syntax.watsup:201.1-202.26
 syntax data = `DATA(*)%*%?`(byte**, datamode?)
 
-;; 1-syntax.watsup:200.1-201.16
+;; 1-syntax.watsup:203.1-204.16
 syntax start = START(funcidx)
 
-;; 1-syntax.watsup:203.1-204.65
+;; 1-syntax.watsup:206.1-207.65
 syntax externuse =
   | FUNC(funcidx)
   | GLOBAL(globalidx)
   | TABLE(tableidx)
   | MEMORY(memidx)
 
-;; 1-syntax.watsup:205.1-206.24
+;; 1-syntax.watsup:208.1-209.24
 syntax export = EXPORT(name, externuse)
 
-;; 1-syntax.watsup:207.1-208.30
+;; 1-syntax.watsup:210.1-211.30
 syntax import = IMPORT(name, name, externtype)
 
-;; 1-syntax.watsup:210.1-211.70
+;; 1-syntax.watsup:213.1-214.70
 syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
 
 ;; 2-aux.watsup:5.1-5.55
@@ -586,12 +589,12 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
   ;; 3-typing.watsup:285.1-287.28
   rule global.set {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
+    -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
 
   ;; 3-typing.watsup:281.1-283.29
-  rule global.get {C : context, t : valtype, x : idx}:
+  rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(()?{}, t))
+    -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
 
   ;; 3-typing.watsup:276.1-278.23
   rule local.tee {C : context, t : valtype, x : idx}:
@@ -773,7 +776,7 @@ relation Instr_const: `%|-%CONST`(context, instr)
   ;; 3-typing.watsup:380.1-382.32
   rule global.get {C : context, t : valtype, x : idx}:
     `%|-%CONST`(C, GLOBAL.GET_instr(x))
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(), t))
+    -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
 
   ;; 3-typing.watsup:377.1-378.26
   rule ref.func {C : context, x : idx}:
@@ -817,7 +820,7 @@ relation Global_ok: `%|-%:%`(context, global, globaltype)
   rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
     `%|-%:%`(C, GLOBAL(gt, expr), gt)
     -- Globaltype_ok: `|-%:OK`(gt)
-    -- if (gt = `MUT%?%`(()?{}, t))
+    -- if (gt = `%?%`(MUT?{}, t))
     -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
 
 ;; 3-typing.watsup:399.1-399.74
@@ -1493,7 +1496,8 @@ $$
 \begin{array}{@{}lrrl@{}}
 \mbox{(result type)} & \mathit{resulttype} &::=& {\mathit{valtype}^\ast} \\
 \mbox{(limits)} & \mathit{limits} &::=& [\mathit{u{\scriptstyle32}} .. \mathit{u{\scriptstyle32}}] \\
-\mbox{(global type)} & \mathit{globaltype} &::=& {\mathsf{mut}^?}~\mathit{valtype} \\
+\mbox{(mutability flag)} & \mathit{mutflag} &::=& \mathsf{mut} \\
+\mbox{(global type)} & \mathit{globaltype} &::=& {\mathit{mutflag}^?}~\mathit{valtype} \\
 \mbox{(function type)} & \mathit{functype} &::=& \mathit{resulttype} \rightarrow \mathit{resulttype} \\
 \mbox{(table type)} & \mathit{tabletype} &::=& \mathit{limits}~\mathit{reftype} \\
 \mbox{(memory type)} & \mathit{memtype} &::=& \mathit{limits}~\mathsf{i{\scriptstyle8}} \\
@@ -2355,7 +2359,7 @@ $$
 $$
 \begin{array}{@{}c@{}}\displaystyle
 \frac{
-\mathit{C}.\mathsf{global}[\mathit{x}] = {\mathsf{mut}^?}~\mathit{t}
+\mathit{C}.\mathsf{global}[\mathit{x}] = {\mathit{mut}^?}~\mathit{t}
 }{
 \mathit{C} \vdash \mathsf{global.get}~\mathit{x} : \epsilon \rightarrow \mathit{t}
 } \, {[\textsc{\scriptsize T{-}global.get}]}
diff --git a/spectec/test-haskell/TEST.md b/spectec/test-haskell/TEST.md
index 8da0021d82..4e2d73beac 100644
--- a/spectec/test-haskell/TEST.md
+++ b/spectec/test-haskell/TEST.md
@@ -98,7 +98,9 @@ type Resulttype = [Valtype]
 
 type Limits = {- mixop: `[%..%]` -} (U32, U32)
 
-type Globaltype = {- mixop: `MUT%?%` -} ((Maybe ()), Valtype)
+type Mutflag = {- mixop: MUT -} ()
+
+type Globaltype = {- mixop: `%?%` -} ((Maybe Mutflag), Valtype)
 
 type Functype = {- mixop: `%->%` -} (Resulttype, Resulttype)
 
@@ -668,9 +670,9 @@ cvtop :: (Numtype, Cvtop, Numtype, (Maybe Sx), C_numtype) -> [C_numtype]
 
 $ ghc -c Test.hs
 
-Test.hs:616:6: error: parse error on input ‘::’
+Test.hs:618:6: error: parse error on input ‘::’
     |
-616 | data :: (State, Dataidx) -> Datainst
+618 | data :: (State, Dataidx) -> Datainst
     |      ^^
 [1]
 ```
diff --git a/spectec/test-latex/TEST.md b/spectec/test-latex/TEST.md
index c09f99719a..930837eb85 100644
--- a/spectec/test-latex/TEST.md
+++ b/spectec/test-latex/TEST.md
@@ -58,6 +58,7 @@ warning: syntax `memidx` was never spliced
 warning: syntax `meminst` was never spliced
 warning: syntax `module` was never spliced
 warning: syntax `moduleinst` was never spliced
+warning: syntax `mutflag` was never spliced
 warning: syntax `n` was never spliced
 warning: syntax `name` was never spliced
 warning: syntax `num` was never spliced
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 5f2939ad72..72208d6fc6 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -120,7 +120,9 @@ def «$valtype_fn» : Fn -> Valtype
 
 @[reducible] def Limits := /- mixop: `[%..%]` -/ (U32 × U32)
 
-@[reducible] def Globaltype := /- mixop: `MUT%?%` -/ ((Option Unit) × Valtype)
+@[reducible] def Mutflag := /- mixop: MUT -/ Unit
+
+@[reducible] def Globaltype := /- mixop: `%?%` -/ ((Option Mutflag) × Valtype)
 
 @[reducible] def Functype := /- mixop: `%->%` -/ (Resulttype × Resulttype)
 
@@ -529,8 +531,8 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
   | global_set (C : Context) (t : Valtype) (x : Idx) :
     ((C.GLOBAL.get! x) == ((some ()), t)) ->
     (Instr_ok (C, (Instr.GLOBAL_SET x), ([t], [])))
-  | global_get (C : Context) (t : Valtype) (x : Idx) :
-    ((C.GLOBAL.get! x) == ((some ()), t)) ->
+  | global_get (C : Context) («mut» : (Option Mutflag)) (t : Valtype) (x : Idx) :
+    ((C.GLOBAL.get! x) == («mut», t)) ->
     (Instr_ok (C, (Instr.GLOBAL_GET x), ([], [t])))
   | local_tee (C : Context) (t : Valtype) (x : Idx) :
     ((C.LOCAL.get! x) == t) ->

From da8b2dc151f6b887c4ad9545a08b8b82d2cde48c Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Fri, 7 Apr 2023 18:03:21 +0200
Subject: [PATCH 44/98] More debug printing

---
 spectec/src/backend-lean4/gen.ml | 6 +++---
 spectec/test-lean4/TEST.md       | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index dc848e53af..396ce88829 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -110,9 +110,9 @@ let rec render_exp (exp : exp) = match exp.it with
   | ListE es -> render_list render_exp es
   | OptE None -> "none"
   | OptE (Some e) -> "some" $$ render_exp e
-  | IterE (e, (iter, vs)) -> begin match e.it with
+  | IterE (e, iterexp) -> begin match e.it with
     | VarE v -> render_id v (* Short-ciruit this common form *)
-    | _ -> match iter, vs with
+    | _ -> match iterexp with
       | (List|List1|ListN _), [v] ->
         "(List.map (λ " ^ render_id v ^ " ↦ " ^ render_exp e ^ ") " ^ render_id v ^ ")"
       | (List|List1|ListN _), [v1; v2] ->
@@ -123,7 +123,7 @@ let rec render_exp (exp : exp) = match exp.it with
       | Opt, [v1; v2] ->
         "(Option.zipWith (λ " ^ render_id v1 ^ " " ^ render_id v2 ^ " ↦ " ^ render_exp e ^ ") " ^ render_id v1 ^ " " ^ render_id v2 ^ ")"
       | _, _ ->
-      render_exp e ^ " /- " ^ Il.Print.string_of_iter iter ^ " -/"
+      render_exp e ^ " /- " ^ Il.Print.string_of_iterexp iterexp ^ " -/"
   end
   | CaseE (a, e, typ) -> render_case a e typ
   | StrE fields -> braces ( String.concat ", " (List.map (fun (a, e) ->
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 72208d6fc6..918355713a 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -596,8 +596,8 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (Instr_ok (C, (Instr.BR l), ((t_1 ++ t), t_2)))
   | if (C : Context) (bt : Blocktype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) (t_1 : (List Valtype)) (t_2 : Valtype) :
     (Blocktype_ok (C, bt, (t_1, [t_2]))) ->
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2] /- * -/, RETURN := none}), instr_1, (t_1, t_2))) ->
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2] /- * -/, RETURN := none}), instr_2, (t_1, t_2))) ->
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2] /- *{} -/, RETURN := none}), instr_1, (t_1, t_2))) ->
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2] /- *{} -/, RETURN := none}), instr_2, (t_1, t_2))) ->
     (Instr_ok (C, (Instr.IF (bt, instr_1, instr_2)), (t_1, [t_2])))
   | loop (C : Context) (bt : Blocktype) (instr : (List Instr)) (t_1 : (List Valtype)) (t_2 : Valtype) :
     (Blocktype_ok (C, bt, (t_1, t_2))) ->
@@ -743,7 +743,7 @@ inductive Export_ok : (Context × Export × Externtype) -> Prop where
 
 inductive Module_ok : Module -> Prop where
   | rule_0 (C : Context) (data : (List Data)) (elem : (List Elem)) («export» : (List Export)) (ft : (List Functype)) (func : (List Func)) («global» : (List Global)) (gt : (List Globaltype)) («import» : (List Import)) (mem : (List Mem)) (mt : (List Memtype)) (n : N) (rt : (List Reftype)) (start : (List Start)) (table : (List Table)) (tt : (List Tabletype)) :
-    (C == {FUNC := ft, GLOBAL := gt, TABLE := tt, MEM := mt, ELEM := rt, DATA := () /- ^n -/, LOCAL := [], LABEL := [], RETURN := none}) ->
+    (C == {FUNC := ft, GLOBAL := gt, TABLE := tt, MEM := mt, ELEM := rt, DATA := () /- ^n{} -/, LOCAL := [], LABEL := [], RETURN := none}) ->
     (Forall₂ (λ ft func ↦ (Func_ok (C, func, ft))) ft func) ->
     (Forall₂ (λ «global» gt ↦ (Global_ok (C, «global», gt))) «global» gt) ->
     (Forall₂ (λ table tt ↦ (Table_ok (C, table, tt))) table tt) ->

From ba84926a184b991cd1f737dba3d828512f77653a Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Fri, 7 Apr 2023 18:27:52 +0200
Subject: [PATCH 45/98] Treat e*{} as list injection

---
 spectec/src/backend-lean4/gen.ml | 10 ++--
 spectec/src/il/eq.ml             |  6 ++-
 spectec/src/il/eq.mli            |  1 +
 spectec/test-lean4/TEST.md       | 88 +++-----------------------------
 4 files changed, 20 insertions(+), 85 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 396ce88829..06ddfba1c2 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -110,9 +110,11 @@ let rec render_exp (exp : exp) = match exp.it with
   | ListE es -> render_list render_exp es
   | OptE None -> "none"
   | OptE (Some e) -> "some" $$ render_exp e
-  | IterE (e, iterexp) -> begin match e.it with
-    | VarE v -> render_id v (* Short-ciruit this common form *)
-    | _ -> match iterexp with
+  | IterE (e, (iter, vs)) -> begin match e.it with
+    | VarE v when List.length vs = 1 && List.for_all (Il.Eq.eq_id v) vs  -> render_id v (* Short-ciruit this common form *)
+    | _ -> match iter, vs with
+      | (List|List1|ListN _), [] ->
+        "[" ^ render_exp e ^ "]"
       | (List|List1|ListN _), [v] ->
         "(List.map (λ " ^ render_id v ^ " ↦ " ^ render_exp e ^ ") " ^ render_id v ^ ")"
       | (List|List1|ListN _), [v1; v2] ->
@@ -123,7 +125,7 @@ let rec render_exp (exp : exp) = match exp.it with
       | Opt, [v1; v2] ->
         "(Option.zipWith (λ " ^ render_id v1 ^ " " ^ render_id v2 ^ " ↦ " ^ render_exp e ^ ") " ^ render_id v1 ^ " " ^ render_id v2 ^ ")"
       | _, _ ->
-      render_exp e ^ " /- " ^ Il.Print.string_of_iterexp iterexp ^ " -/"
+      render_exp e ^ " /- " ^ Il.Print.string_of_iterexp (iter, vs) ^ " -/"
   end
   | CaseE (a, e, typ) -> render_case a e typ
   | StrE fields -> braces ( String.concat ", " (List.map (fun (a, e) ->
diff --git a/spectec/src/il/eq.ml b/spectec/src/il/eq.ml
index 90c097b306..59411a5d33 100644
--- a/spectec/src/il/eq.ml
+++ b/spectec/src/il/eq.ml
@@ -12,6 +12,10 @@ let eq_opt eq_x xo1 xo2 =
 let eq_list eq_x xs1 xs2 =
   List.length xs1 = List.length xs2 && List.for_all2 eq_x xs1 xs2
 
+(* Ids *)
+
+let eq_id i1 i2 =
+  i1.it = i2.it
 
 (* Iteration *)
 
@@ -32,7 +36,7 @@ and eq_typ t1 t2 =
   *)
   t1.it = t2.it ||
   match t1.it, t2.it with
-  | VarT id1, VarT id2 -> id1.it = id2.it
+  | VarT id1, VarT id2 -> eq_id id1 id2
   | TupT ts1, TupT ts2 -> eq_list eq_typ ts1 ts2
   | IterT (t11, iter1), IterT (t21, iter2) ->
     eq_typ t11 t21 && eq_iter iter1 iter2
diff --git a/spectec/src/il/eq.mli b/spectec/src/il/eq.mli
index f93fec6167..f9816c14a0 100644
--- a/spectec/src/il/eq.mli
+++ b/spectec/src/il/eq.mli
@@ -1,5 +1,6 @@
 open Ast
 
+val eq_id : id -> id -> bool
 val eq_iter : iter -> iter -> bool
 val eq_typ : typ -> typ -> bool
 val eq_exp : exp -> exp -> bool
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 918355713a..898cb6cdb7 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -596,13 +596,13 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (Instr_ok (C, (Instr.BR l), ((t_1 ++ t), t_2)))
   | if (C : Context) (bt : Blocktype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) (t_1 : (List Valtype)) (t_2 : Valtype) :
     (Blocktype_ok (C, bt, (t_1, [t_2]))) ->
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2] /- *{} -/, RETURN := none}), instr_1, (t_1, t_2))) ->
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2] /- *{} -/, RETURN := none}), instr_2, (t_1, t_2))) ->
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [[t_2]], RETURN := none}), instr_1, (t_1, [t_2]))) ->
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [[t_2]], RETURN := none}), instr_2, (t_1, [t_2]))) ->
     (Instr_ok (C, (Instr.IF (bt, instr_1, instr_2)), (t_1, [t_2])))
   | loop (C : Context) (bt : Blocktype) (instr : (List Instr)) (t_1 : (List Valtype)) (t_2 : Valtype) :
-    (Blocktype_ok (C, bt, (t_1, t_2))) ->
+    (Blocktype_ok (C, bt, (t_1, [t_2]))) ->
     (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_1 ↦ [t_1]) t_1), RETURN := none}), instr, (t_1, [t_2]))) ->
-    (Instr_ok (C, (Instr.LOOP (bt, instr)), (t_1, t_2)))
+    (Instr_ok (C, (Instr.LOOP (bt, instr)), (t_1, [t_2])))
   | block (C : Context) (bt : Blocktype) (instr : (List Instr)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
     (Blocktype_ok (C, bt, (t_1, t_2))) ->
     (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_2 ↦ [t_2]) t_2), RETURN := none}), instr, (t_1, t_2))) ->
@@ -625,13 +625,13 @@ inductive InstrSeq_ok : (Context × (List Instr) × Functype) -> Prop where
     (InstrSeq_ok (C, instr, ((t ++ t_1), (t ++ t_2))))
   | weak (C : Context) (instr : (List Instr)) (t'_1 : Valtype) (t'_2 : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
     (InstrSeq_ok (C, instr, (t_1, t_2))) ->
-    (Resulttype_sub (t'_1, t_1)) ->
+    (Resulttype_sub ([t'_1], t_1)) ->
     (Resulttype_sub (t_2, t'_2)) ->
     (InstrSeq_ok (C, instr, ([t'_1], t'_2)))
   | seq (C : Context) (instr_1 : Instr) (instr_2 : Instr) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (t_3 : (List Valtype)) :
     (Instr_ok (C, instr_1, (t_1, t_2))) ->
     (InstrSeq_ok (C, [instr_2], (t_2, t_3))) ->
-    (InstrSeq_ok (C, ([instr_1] ++ instr_2), (t_1, t_3)))
+    (InstrSeq_ok (C, ([instr_1] ++ [instr_2]), (t_1, t_3)))
   | empty (C : Context) :
     (InstrSeq_ok (C, [], ([], [])))end
 
@@ -743,7 +743,7 @@ inductive Export_ok : (Context × Export × Externtype) -> Prop where
 
 inductive Module_ok : Module -> Prop where
   | rule_0 (C : Context) (data : (List Data)) (elem : (List Elem)) («export» : (List Export)) (ft : (List Functype)) (func : (List Func)) («global» : (List Global)) (gt : (List Globaltype)) («import» : (List Import)) (mem : (List Mem)) (mt : (List Memtype)) (n : N) (rt : (List Reftype)) (start : (List Start)) (table : (List Table)) (tt : (List Tabletype)) :
-    (C == {FUNC := ft, GLOBAL := gt, TABLE := tt, MEM := mt, ELEM := rt, DATA := () /- ^n{} -/, LOCAL := [], LABEL := [], RETURN := none}) ->
+    (C == {FUNC := ft, GLOBAL := gt, TABLE := tt, MEM := mt, ELEM := rt, DATA := [()], LOCAL := [], LABEL := [], RETURN := none}) ->
     (Forall₂ (λ ft func ↦ (Func_ok (C, func, ft))) ft func) ->
     (Forall₂ (λ «global» gt ↦ (Global_ok (C, «global», gt))) «global» gt) ->
     (Forall₂ (λ table tt ↦ (Table_ok (C, table, tt))) table tt) ->
@@ -1212,7 +1212,7 @@ inductive Step : (Config × Config) -> Prop where
   | elem_drop (x : Idx) (z : State) :
     (Step ((z, [(Admininstr.ELEM_DROP x)]), ((«$with_elem» (z, x, [])), [])))
   | table_grow_succeed (n : N) (ref : Ref) (x : Idx) (z : State) :
-    (Step ((z, [(«$admininstr_ref» ref), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), ((«$with_tableext» (z, x, ref)), [(Admininstr.CONST (Numtype.I32, («$table» (z, x)).length))])))
+    (Step ((z, [(«$admininstr_ref» ref), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), ((«$with_tableext» (z, x, [ref])), [(Admininstr.CONST (Numtype.I32, («$table» (z, x)).length))])))
   | table_set_val (i : Nat) (ref : Ref) (x : Idx) (z : State) :
     (i < («$table» (z, x)).length) ->
     (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]), ((«$with_table» (z, x, i, ref)), [])))
@@ -1236,70 +1236,6 @@ SpecTec.lean: error: function expected at
   «$valtype_resulttype»
 term has type
   ?m
-SpecTec.lean: error: application type mismatch
-  (t_1, t_2)
-argument
-  t_2
-has type
-  Valtype : Type
-but is expected to have type
-  Resulttype : Type
-SpecTec.lean: error: application type mismatch
-  List.cons t_2
-argument
-  t_2
-has type
-  Valtype : Type
-but is expected to have type
-  Resulttype : Type
-SpecTec.lean: error: application type mismatch
-  (t_1, t_2)
-argument
-  t_2
-has type
-  Valtype : Type
-but is expected to have type
-  Resulttype : Type
-SpecTec.lean: error: application type mismatch
-  List.cons t_2
-argument
-  t_2
-has type
-  Valtype : Type
-but is expected to have type
-  Resulttype : Type
-SpecTec.lean: error: application type mismatch
-  (t_1, t_2)
-argument
-  t_2
-has type
-  Valtype : Type
-but is expected to have type
-  Resulttype : Type
-SpecTec.lean: error: application type mismatch
-  (t_1, t_2)
-argument
-  t_2
-has type
-  Valtype : Type
-but is expected to have type
-  Resulttype : Type
-SpecTec.lean: error: application type mismatch
-  Prod.mk t'_1
-argument
-  t'_1
-has type
-  Valtype : Type
-but is expected to have type
-  List Valtype : Type
-SpecTec.lean: error: failed to synthesize instance
-  HAppend (List Instr) Instr ?m
-SpecTec.lean: error: type mismatch
-  ()
-has type
-  Unit : Type
-but is expected to have type
-  List Datatype : Type
 SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `f` [linter.unusedVariables]
 SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
@@ -1323,12 +1259,4 @@ SpecTec.lean: error: function expected at
   «$admininstr_globalinst»
 term has type
   ?m
-SpecTec.lean: error: application type mismatch
-  (x, ref)
-argument
-  ref
-has type
-  Ref : Type
-but is expected to have type
-  List Ref : Type
 ```

From 8a97b51feb368da1fb26403ccfba29fb8bf1e397 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Fri, 7 Apr 2023 18:30:23 +0200
Subject: [PATCH 46/98] Do not warn about unused variables. Down to three
 errors!

---
 spectec/src/backend-lean4/gen.ml |  1 +
 spectec/test-lean4/TEST.md       | 21 +--------------------
 2 files changed, 2 insertions(+), 20 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 06ddfba1c2..3083a162c1 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -278,6 +278,7 @@ let gen_string (el : script) =
   "def Option.toList : Option α → List α\n" ^
   "  | none => List.nil\n" ^
   "  | some x => [x]\n" ^
+  "set_option linter.unusedVariables false\n" ^
 
   render_script el
 
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 898cb6cdb7..21760e9262 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -24,6 +24,7 @@ def Option.zipWith : (α → β → γ) → Option α → Option β → Option 
 def Option.toList : Option α → List α
   | none => List.nil
   | some x => [x]
+set_option linter.unusedVariables false
 @[reducible] def N := Nat
 
 @[reducible] def Name := String
@@ -1227,7 +1228,6 @@ inductive Step : (Config × Config) -> Prop where
     (Step_pure ((List.map (λ instr ↦ («$admininstr_instr» instr)) instr), (List.map (λ instr' ↦ («$admininstr_instr» instr')) instr'))) ->
     (Step ((z, (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)), (z, (List.map (λ instr' ↦ («$admininstr_instr» instr')) instr'))))
 $ lean SpecTec.lean 2>&1 | sed -e 's,/[^ ]*/toolchains,.../toolchains`,g' | sed -e 's,SpecTec.lean:[0-9]\+:[0-9]\+,SpecTec.lean,' | sed -e 's,\?m\.[0-9]\+,?m,g'
-SpecTec.lean: warning: unused variable `n_3_ATOM_y` [linter.unusedVariables]
 SpecTec.lean: error: function expected at
   «$valtype_resulttype»
 term has type
@@ -1236,25 +1236,6 @@ SpecTec.lean: error: function expected at
   «$valtype_resulttype»
 term has type
   ?m
-SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `f` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `f` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `v` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `v` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `i` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `r` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `r` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `s` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `x` [linter.unusedVariables]
-SpecTec.lean: warning: unused variable `r` [linter.unusedVariables]
 SpecTec.lean: error: function expected at
   «$admininstr_globalinst»
 term has type

From 53fcc98d4a0d0ce68a8f7e52eaf43cf9561faa2b Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Fri, 7 Apr 2023 18:48:51 +0200
Subject: [PATCH 47/98] =?UTF-8?q?Work=20around=20=C2=AB$admininstr=5Fgloba?=
 =?UTF-8?q?linst=C2=BB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 spectec/spec/4-runtime.watsup |  2 +-
 spectec/src/il/flat.ml        | 18 +++++++++++++++++-
 spectec/test-haskell/TEST.md  |  7 +++++--
 spectec/test-lean4/TEST.md    |  7 +++----
 4 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/spectec/spec/4-runtime.watsup b/spectec/spec/4-runtime.watsup
index 030698dd03..7c06dbdc56 100644
--- a/spectec/spec/4-runtime.watsup
+++ b/spectec/spec/4-runtime.watsup
@@ -137,7 +137,7 @@ def $with_elem((s; f), x, r*) = s[.TABLE[f.MODULE.TABLE[x]] = r*]; f
 
 ;; Administrative Instructions
 
-syntax admininstr hint(show instr) hint(desc "administrative instruction") hint(subtype val) hint(subtype ref) =
+syntax admininstr hint(show instr) hint(desc "administrative instruction") hint(subtype val) hint(subtype ref) hint(subtype_alias globalinst val)=
   | instr
   | REF.FUNC_ADDR funcaddr         hint(show REF.FUNC %)
   | REF.HOST_ADDR hostaddr         hint(show REF.EXTERN %)
diff --git a/spectec/src/il/flat.ml b/spectec/src/il/flat.ml
index 09ea017ef3..731ad9596d 100644
--- a/spectec/src/il/flat.ml
+++ b/spectec/src/il/flat.ml
@@ -74,7 +74,23 @@ let rec transform_def_rec env (def : def) : def * (def list) = match def.it with
                 CaseE (a, VarE x $ no_region, ty) $ no_region, []) $ no_region
         ) (lookup_cons env sid) in
         DecD (name, VarT sid $ no_region, VarT id $ no_region, clauses, []) $ no_region
-      ) pairs
+      ) pairs @
+      List.concat_map (fun {hintid; hintexp} ->
+        match hintid.it, hintexp with
+        | "subtype_alias", [s1; s2] ->
+          let id1 = s1 $ no_region in
+          let id2 = s2 $ no_region in
+          let name = (id.it ^ "_" ^ id1.it) $ no_region in
+          let name2 = (id.it ^ "_" ^ id2.it) $ no_region in
+          let x = "x" $ no_region in
+          let clauses = [
+            DefD ([(x, VarT id1 $ no_region, [])],
+                  VarE x $ no_region,
+                  CallE (name2, VarE x $ no_region) $ no_region, []) $ no_region
+          ] in
+          [ DecD (name, VarT id1 $ no_region, VarT id $ no_region, clauses, []) $ no_region ]
+        | _, _ -> []
+      ) hints
     | _ -> def, []
     end
   | _ ->
diff --git a/spectec/test-haskell/TEST.md b/spectec/test-haskell/TEST.md
index 4e2d73beac..2ca65d6acf 100644
--- a/spectec/test-haskell/TEST.md
+++ b/spectec/test-haskell/TEST.md
@@ -597,6 +597,9 @@ admininstr_ref (Ref_REF_NULL x) = (Admininstr_REF_NULL x)
 admininstr_ref (Ref_REF_FUNC_ADDR x) = (Admininstr_REF_FUNC_ADDR x)
 admininstr_ref (Ref_REF_HOST_ADDR x) = (Admininstr_REF_HOST_ADDR x)
 
+admininstr_globalinst :: Globalinst -> Admininstr
+admininstr_globalinst x = undefined {- $admininstr_val(x) -}
+
 type Config = {- mixop: `%;%*` -} (State, [Admininstr])
 
 funcaddr :: State -> [Funcaddr]
@@ -670,9 +673,9 @@ cvtop :: (Numtype, Cvtop, Numtype, (Maybe Sx), C_numtype) -> [C_numtype]
 
 $ ghc -c Test.hs
 
-Test.hs:618:6: error: parse error on input ‘::’
+Test.hs:621:6: error: parse error on input ‘::’
     |
-618 | data :: (State, Dataidx) -> Datainst
+621 | data :: (State, Dataidx) -> Datainst
     |      ^^
 [1]
 ```
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 21760e9262..dc1162772f 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -994,6 +994,9 @@ def «$admininstr_ref» : Ref -> Admininstr
   | (Ref.REF_FUNC_ADDR x) => (Admininstr.REF_FUNC_ADDR x)
   | (Ref.REF_HOST_ADDR x) => (Admininstr.REF_HOST_ADDR x)
 
+def «$admininstr_globalinst» : Globalinst -> Admininstr
+  | x => («$admininstr_val» x)
+
 @[reducible] def Config := /- mixop: `%;%*` -/ (State × (List Admininstr))
 
 def «$funcaddr» : State -> (List Funcaddr)
@@ -1236,8 +1239,4 @@ SpecTec.lean: error: function expected at
   «$valtype_resulttype»
 term has type
   ?m
-SpecTec.lean: error: function expected at
-  «$admininstr_globalinst»
-term has type
-  ?m
 ```

From 158c1c5e02f803ee33eb9369bcd05e733c613d1c Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Fri, 7 Apr 2023 18:53:50 +0200
Subject: [PATCH 48/98] Fix haskell escaping

---
 spectec/src/backend-haskell/gen.ml |  4 +--
 spectec/test-haskell/TEST.md       | 41 ++++++++++++++++++++++++++----
 2 files changed, 38 insertions(+), 7 deletions(-)

diff --git a/spectec/src/backend-haskell/gen.ml b/spectec/src/backend-haskell/gen.ml
index b6ac9cde2a..5390c5346f 100644
--- a/spectec/src/backend-haskell/gen.ml
+++ b/spectec/src/backend-haskell/gen.ml
@@ -101,7 +101,7 @@ and render_case a e typ =
 let render_clause (id : id) (clause : clause) = match clause.it with
   | DefD (_binds, lhs, rhs, premise) ->
    (if premise <> [] then "-- Premises ignored! \n" else "") ^
-   id.it ^ " " ^ render_exp lhs ^ " = " ^ render_exp rhs
+   make_id id.it ^ " " ^ render_exp lhs ^ " = " ^ render_exp rhs
 
 let rec render_def (d : def) =
   begin
@@ -134,7 +134,7 @@ let rec render_def (d : def) =
       ) ^ "\n }"
     end
   | DecD (id, typ1, typ2, clauses, _hints) ->
-    id.it ^ " :: " ^ render_typ typ1 ^ " -> " ^ render_typ typ2 ^ "\n" ^
+    make_id id.it ^ " :: " ^ render_typ typ1 ^ " -> " ^ render_typ typ2 ^ "\n" ^
     String.concat "\n" (List.map (render_clause id) clauses)
 
   | RecD defs ->
diff --git a/spectec/test-haskell/TEST.md b/spectec/test-haskell/TEST.md
index 2ca65d6acf..ddd489f083 100644
--- a/spectec/test-haskell/TEST.md
+++ b/spectec/test-haskell/TEST.md
@@ -623,8 +623,8 @@ mem ((s, f), x) = (s.mEM !! (fromIntegral (f.mODULE.mEM !! (fromIntegral x))))
 elem :: (State, Tableidx) -> Eleminst
 elem ((s, f), x) = (s.eLEM !! (fromIntegral (f.mODULE.eLEM !! (fromIntegral x))))
 
-data :: (State, Dataidx) -> Datainst
-data ((s, f), x) = (s.dATA !! (fromIntegral (f.mODULE.dATA !! (fromIntegral x))))
+data_ :: (State, Dataidx) -> Datainst
+data_ ((s, f), x) = (s.dATA !! (fromIntegral (f.mODULE.dATA !! (fromIntegral x))))
 
 local :: (State, Localidx) -> Val
 local ((s, f), x) = (f.lOCAL !! (fromIntegral x))
@@ -673,9 +673,40 @@ cvtop :: (Numtype, Cvtop, Numtype, (Maybe Sx), C_numtype) -> [C_numtype]
 
 $ ghc -c Test.hs
 
-Test.hs:621:6: error: parse error on input ‘::’
+Test.hs:647:1: error:
+    The type signature for ‘unop’ lacks an accompanying binding
     |
-621 | data :: (State, Dataidx) -> Datainst
-    |      ^^
+647 | unop :: (Unop_numtype, Numtype, C_numtype) -> [C_numtype]
+    | ^^^^
+
+Test.hs:650:1: error:
+    The type signature for ‘binop’ lacks an accompanying binding
+    |
+650 | binop :: (Binop_numtype, Numtype, C_numtype, C_numtype) -> [C_numtype]
+    | ^^^^^
+
+Test.hs:653:1: error:
+    The type signature for ‘testop’ lacks an accompanying binding
+    |
+653 | testop :: (Testop_numtype, Numtype, C_numtype) -> C_numtype
+    | ^^^^^^
+
+Test.hs:656:1: error:
+    The type signature for ‘relop’ lacks an accompanying binding
+    |
+656 | relop :: (Relop_numtype, Numtype, C_numtype, C_numtype) -> C_numtype
+    | ^^^^^
+
+Test.hs:659:1: error:
+    The type signature for ‘ext’ lacks an accompanying binding
+    |
+659 | ext :: (Natural, Natural, Sx, C_numtype) -> C_numtype
+    | ^^^
+
+Test.hs:662:1: error:
+    The type signature for ‘cvtop’ lacks an accompanying binding
+    |
+662 | cvtop :: (Numtype, Cvtop, Numtype, (Maybe Sx), C_numtype) -> [C_numtype]
+    | ^^^^^
 [1]
 ```

From 5f77afdf0cca48b71035475e90e59dc661f418e4 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Fri, 7 Apr 2023 22:22:29 +0200
Subject: [PATCH 49/98] Haskell: Handle declartions without clauses

---
 spectec/src/backend-haskell/gen.ml |  7 ++--
 spectec/test-haskell/TEST.md       | 51 ++++--------------------------
 2 files changed, 11 insertions(+), 47 deletions(-)

diff --git a/spectec/src/backend-haskell/gen.ml b/spectec/src/backend-haskell/gen.ml
index 5390c5346f..0333e59af0 100644
--- a/spectec/src/backend-haskell/gen.ml
+++ b/spectec/src/backend-haskell/gen.ml
@@ -135,8 +135,9 @@ let rec render_def (d : def) =
     end
   | DecD (id, typ1, typ2, clauses, _hints) ->
     make_id id.it ^ " :: " ^ render_typ typ1 ^ " -> " ^ render_typ typ2 ^ "\n" ^
-    String.concat "\n" (List.map (render_clause id) clauses)
-
+    if clauses = []
+    then make_id id.it ^ " = error \"function without clauses\""
+    else String.concat "\n" (List.map (render_clause id) clauses)
   | RecD defs ->
     String.concat "\n" (List.map render_def defs)
   | _ -> ""
@@ -148,7 +149,7 @@ let gen_string (el : script) =
   "{-# LANGUAGE OverloadedRecordDot #-}\n" ^
   "{-# LANGUAGE DuplicateRecordFields #-}\n" ^
   "module Test where\n" ^
-  "import Prelude (Bool, String, undefined, Maybe, fromIntegral, (+), (!!))\n" ^
+  "import Prelude (Bool, String, undefined, error, Maybe, fromIntegral, (+), (!!))\n" ^
   "import Numeric.Natural (Natural)\n" ^
   render_script el
 
diff --git a/spectec/test-haskell/TEST.md b/spectec/test-haskell/TEST.md
index ddd489f083..9bda006855 100644
--- a/spectec/test-haskell/TEST.md
+++ b/spectec/test-haskell/TEST.md
@@ -6,7 +6,7 @@ $ cat Test.hs
 {-# LANGUAGE OverloadedRecordDot #-}
 {-# LANGUAGE DuplicateRecordFields #-}
 module Test where
-import Prelude (Bool, String, undefined, Maybe, fromIntegral, (+), (!!))
+import Prelude (Bool, String, undefined, error, Maybe, fromIntegral, (+), (!!))
 import Numeric.Natural (Natural)
 type N = Natural
 
@@ -650,63 +650,26 @@ data E
  | E_LABEL_ (N, [Instr], E)
 
 unop :: (Unop_numtype, Numtype, C_numtype) -> [C_numtype]
-
+unop = error "function without clauses"
 
 binop :: (Binop_numtype, Numtype, C_numtype, C_numtype) -> [C_numtype]
-
+binop = error "function without clauses"
 
 testop :: (Testop_numtype, Numtype, C_numtype) -> C_numtype
-
+testop = error "function without clauses"
 
 relop :: (Relop_numtype, Numtype, C_numtype, C_numtype) -> C_numtype
-
+relop = error "function without clauses"
 
 ext :: (Natural, Natural, Sx, C_numtype) -> C_numtype
-
+ext = error "function without clauses"
 
 cvtop :: (Numtype, Cvtop, Numtype, (Maybe Sx), C_numtype) -> [C_numtype]
-
+cvtop = error "function without clauses"
 
 
 
 
 
 $ ghc -c Test.hs
-
-Test.hs:647:1: error:
-    The type signature for ‘unop’ lacks an accompanying binding
-    |
-647 | unop :: (Unop_numtype, Numtype, C_numtype) -> [C_numtype]
-    | ^^^^
-
-Test.hs:650:1: error:
-    The type signature for ‘binop’ lacks an accompanying binding
-    |
-650 | binop :: (Binop_numtype, Numtype, C_numtype, C_numtype) -> [C_numtype]
-    | ^^^^^
-
-Test.hs:653:1: error:
-    The type signature for ‘testop’ lacks an accompanying binding
-    |
-653 | testop :: (Testop_numtype, Numtype, C_numtype) -> C_numtype
-    | ^^^^^^
-
-Test.hs:656:1: error:
-    The type signature for ‘relop’ lacks an accompanying binding
-    |
-656 | relop :: (Relop_numtype, Numtype, C_numtype, C_numtype) -> C_numtype
-    | ^^^^^
-
-Test.hs:659:1: error:
-    The type signature for ‘ext’ lacks an accompanying binding
-    |
-659 | ext :: (Natural, Natural, Sx, C_numtype) -> C_numtype
-    | ^^^
-
-Test.hs:662:1: error:
-    The type signature for ‘cvtop’ lacks an accompanying binding
-    |
-662 | cvtop :: (Numtype, Cvtop, Numtype, (Maybe Sx), C_numtype) -> [C_numtype]
-    | ^^^^^
-[1]
 ```

From 747c56123a9513b442f24bde2b2fc57a83c1e9cc Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Fri, 7 Apr 2023 22:24:01 +0200
Subject: [PATCH 50/98] Update output

---
 spectec/test-lean4/TEST.md | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index dc1162772f..cef01d9894 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -586,8 +586,8 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (C.RETURN == (some t)) ->
     (Instr_ok (C, Instr.RETURN, ((t_1 ++ t), t_2)))
   | br_table (C : Context) (l : (List Labelidx)) (l' : Labelidx) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
-    (Forall (λ l ↦ (Resulttype_sub (t, [(«$valtype_resulttype» (C.LABEL.get! l))]))) l) ->
-    (Resulttype_sub (t, [(«$valtype_resulttype» (C.LABEL.get! l'))])) ->
+    (Forall (λ l ↦ (Resulttype_sub (t, (C.LABEL.get! l)))) l) ->
+    (Resulttype_sub (t, (C.LABEL.get! l'))) ->
     (Instr_ok (C, (Instr.BR_TABLE (l, l')), ((t_1 ++ t), t_2)))
   | br_if (C : Context) (l : Labelidx) (t : (List Valtype)) :
     ((C.LABEL.get! l) == t) ->
@@ -1231,12 +1231,4 @@ inductive Step : (Config × Config) -> Prop where
     (Step_pure ((List.map (λ instr ↦ («$admininstr_instr» instr)) instr), (List.map (λ instr' ↦ («$admininstr_instr» instr')) instr'))) ->
     (Step ((z, (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)), (z, (List.map (λ instr' ↦ («$admininstr_instr» instr')) instr'))))
 $ lean SpecTec.lean 2>&1 | sed -e 's,/[^ ]*/toolchains,.../toolchains`,g' | sed -e 's,SpecTec.lean:[0-9]\+:[0-9]\+,SpecTec.lean,' | sed -e 's,\?m\.[0-9]\+,?m,g'
-SpecTec.lean: error: function expected at
-  «$valtype_resulttype»
-term has type
-  ?m
-SpecTec.lean: error: function expected at
-  «$valtype_resulttype»
-term has type
-  ?m
 ```

From 6c323eae4c710a095dd56680c31646c08738a8ea Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sat, 8 Apr 2023 11:13:07 +0200
Subject: [PATCH 51/98] Add more hints until we infer SubE occurrences

---
 spectec/spec/1-syntax.watsup       |  2 +-
 spectec/spec/4-runtime.watsup      |  4 ++--
 spectec/src/backend-haskell/gen.ml |  6 +-----
 spectec/src/backend-lean4/gen.ml   | 10 +++-------
 spectec/src/il/flat.ml             | 12 ++++++------
 spectec/test-haskell/TEST.md       | 18 +++++++++---------
 spectec/test-lean4/TEST.md         | 14 +++++++-------
 7 files changed, 29 insertions(+), 37 deletions(-)

diff --git a/spectec/spec/1-syntax.watsup b/spectec/spec/1-syntax.watsup
index 4e03eb22fd..b97113d201 100644
--- a/spectec/spec/1-syntax.watsup
+++ b/spectec/spec/1-syntax.watsup
@@ -42,7 +42,7 @@ syntax vectype hint(desc "vector type") =
   | V128
 syntax reftype hint(desc "reference type") =
   | FUNCREF | EXTERNREF
-syntax valtype hint(desc "value type") =
+syntax valtype hint(desc "value type") hint(subtype numtype vectype reftype) =
   | numtype | vectype | reftype | BOT
 
 syntax in hint(show I#n) hint(supertype numtype valtype) = | I32 | I64
diff --git a/spectec/spec/4-runtime.watsup b/spectec/spec/4-runtime.watsup
index 7c06dbdc56..4038bf1862 100644
--- a/spectec/spec/4-runtime.watsup
+++ b/spectec/spec/4-runtime.watsup
@@ -25,7 +25,7 @@ syntax num hint(desc "number") =
   | CONST numtype c_numtype
 syntax ref hint(desc "reference") =
   | REF.NULL reftype | REF.FUNC_ADDR funcaddr | REF.HOST_ADDR hostaddr
-syntax val hint(desc "value") =
+syntax val hint(desc "value") hint(subtype num ref) =
   | num | ref
 
 syntax result hint(desc "result") =
@@ -137,7 +137,7 @@ def $with_elem((s; f), x, r*) = s[.TABLE[f.MODULE.TABLE[x]] = r*]; f
 
 ;; Administrative Instructions
 
-syntax admininstr hint(show instr) hint(desc "administrative instruction") hint(subtype val) hint(subtype ref) hint(subtype_alias globalinst val)=
+syntax admininstr hint(show instr) hint(desc "administrative instruction") hint(subtype instr val ref) hint(subtype_alias globalinst val)=
   | instr
   | REF.FUNC_ADDR funcaddr         hint(show REF.FUNC %)
   | REF.HOST_ADDR hostaddr         hint(show REF.EXTERN %)
diff --git a/spectec/src/backend-haskell/gen.ml b/spectec/src/backend-haskell/gen.ml
index 0333e59af0..cc945d5e28 100644
--- a/spectec/src/backend-haskell/gen.ml
+++ b/spectec/src/backend-haskell/gen.ml
@@ -70,9 +70,6 @@ let render_variant_inj' (typ1 : typ) (typ2 : typ) = match typ1.it, typ2.it with
   | VarT id1, VarT id2 -> render_variant_inj id1 id2
   | _, _ -> "_ {- render_variant_inj': Typs not ids -}"
 
-let render_variant_inj_case id1 id2 =
-  render_variant_inj id1 id2 ^ " " ^ render_type_name id2
-
 let render_variant_case id (case : typcase) = match case with
   | (a, {it = TupT [];_}, _hints) -> render_con_name id a
   | (a, ty, _hints) -> render_con_name id a ^ " " ^ render_typ ty
@@ -118,9 +115,8 @@ let rec render_def (d : def) =
       "type " ^ render_type_name id ^ " = " ^ render_typ ty
     | NotationT (mop, ty) ->
       "type " ^ render_type_name id ^ " = {- mixop: " ^ Il.Print.string_of_mixop mop ^ " -} " ^ render_typ ty
-    | VariantT (ids, cases) ->
+    | VariantT cases ->
       "data " ^ render_type_name id ^ prepend "\n = " "\n | " (
-        List.map (render_variant_inj_case id) ids @
         List.map (render_variant_case id) cases
       )
     | StructT fields ->
diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 3083a162c1..033907171f 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -90,9 +90,6 @@ let render_variant_inj' (typ1 : typ) (typ2 : typ) = match typ1.it, typ2.it with
   | VarT id1, VarT id2 -> render_variant_inj id1 id2
   | _, _ -> "_ {- render_variant_inj': Typs not ids -}"
 
-let render_variant_inj_case _id1 _id2 =
-  "/- Incomplete Ir.Flat.transform? -/"
-
 let render_variant_case id ((a, ty, _hints) : typcase) =
   render_con_name false id a ^ " : " ^
   if ty.it = TupT []
@@ -196,13 +193,12 @@ let rec render_def (d : def) =
     | AliasT ty ->
       "@[reducible] def " ^ render_type_name id ^ " := " ^ render_typ ty 
     | NotationT (mop, ty) ->
-      "@[reducible] def " ^ render_type_name id ^ " := /- mixop: " ^ Il.Print.string_of_mixop mop ^ " -/ " ^ render_typ ty 
-    | VariantT (ids, cases) ->
+      "@[reducible] def " ^ render_type_name id ^ " := /- mixop: " ^ Il.Print.string_of_mixop mop ^ " -/ " ^ render_typ ty
+    | VariantT cases ->
       "inductive " ^ render_type_name id ^ " where" ^ prepend "\n | " "\n | " (
-        List.map (render_variant_inj_case id) ids @
         List.map (render_variant_case id) cases
       ) ^
-      (if ids = [] && cases = [] then "\n  deriving BEq" else "\n  deriving Inhabited, BEq")
+      (if cases = [] then "\n  deriving BEq" else "\n  deriving Inhabited, BEq")
     | StructT fields ->
       (*
       "type " ^ render_type_name id ^ " = " ^ render_tuple render_typ (
diff --git a/spectec/src/il/flat.ml b/spectec/src/il/flat.ml
index 731ad9596d..45bc1ff580 100644
--- a/spectec/src/il/flat.ml
+++ b/spectec/src/il/flat.ml
@@ -1,9 +1,11 @@
 (*
 This transformation
- * replaces variant extension with copies of the constructors
  * generates functions for all occurring subtype coercions
+   (not yet: relies on hints so far)
  * uses these functions
+   (not yet: done in the backend so far)
  * duplicates cases in functions as needed
+   (not yet: $default_ rewritten in spec)
 *)
 
 open Util
@@ -47,13 +49,11 @@ let rec transform_def_rec env (def : def) : def * (def list) = match def.it with
     { def with it = RecD defs' },  List.concat new_defs
   | SynD (id, deftyp, hints) ->
     begin match deftyp.it with
-    | VariantT (ids, cases) ->
-      let cases' = List.concat_map (lookup_cons env) ids @ cases in
-      register_cons env id cases';
-      { def with it = SynD (id, { deftyp with it = VariantT ([], cases') }, hints) },
+    | VariantT cases ->
+      register_cons env id cases;
+      def,
       (* Also generate conversion functions *)
       let pairs =
-        List.map (fun sid -> (id, sid)) ids @
         List.concat_map (fun {hintid; hintexp} ->
           (if hintid.it = "subtype" then List.map (fun s -> (id, s $ no_region)) hintexp else []) @
           (if hintid.it = "supertype" then List.map (fun s -> (s $ no_region, id)) hintexp else [])
diff --git a/spectec/test-haskell/TEST.md b/spectec/test-haskell/TEST.md
index a0ba938118..ae3980ade1 100644
--- a/spectec/test-haskell/TEST.md
+++ b/spectec/test-haskell/TEST.md
@@ -48,14 +48,14 @@ data Reftype
  | Reftype_EXTERNREF
 
 data Valtype
- = Valtype_I32
+ = Valtype_BOT
+ | Valtype_I32
  | Valtype_I64
  | Valtype_F32
  | Valtype_F64
  | Valtype_V128
  | Valtype_FUNCREF
  | Valtype_EXTERNREF
- | Valtype_BOT
 
 valtype_numtype :: Numtype -> Valtype
 valtype_numtype Numtype_I32 = Valtype_I32
@@ -489,7 +489,13 @@ data Frame = MkFrame
 type State = {- mixop: `%;%` -} (Store, Frame)
 
 data Admininstr
- = Admininstr_UNREACHABLE
+ = Admininstr_REF_FUNC_ADDR Funcaddr
+ | Admininstr_REF_HOST_ADDR Hostaddr
+ | Admininstr_CALL_ADDR Funcaddr
+ | Admininstr_LABEL_ (N, [Instr], [Admininstr])
+ | Admininstr_FRAME_ (N, Frame, [Admininstr])
+ | Admininstr_TRAP
+ | Admininstr_UNREACHABLE
  | Admininstr_NOP
  | Admininstr_DROP
  | Admininstr_SELECT (Maybe Valtype)
@@ -533,12 +539,6 @@ data Admininstr
  | Admininstr_DATA_DROP Dataidx
  | Admininstr_LOAD (Numtype, (Maybe (N, Sx)), Natural, Natural)
  | Admininstr_STORE (Numtype, (Maybe N), Natural, Natural)
- | Admininstr_REF_FUNC_ADDR Funcaddr
- | Admininstr_REF_HOST_ADDR Hostaddr
- | Admininstr_CALL_ADDR Funcaddr
- | Admininstr_LABEL_ (N, [Instr], [Admininstr])
- | Admininstr_FRAME_ (N, Frame, [Admininstr])
- | Admininstr_TRAP
 
 admininstr_instr :: Instr -> Admininstr
 admininstr_instr Instr_UNREACHABLE = Admininstr_UNREACHABLE
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 8432eadc71..bfc91ec09a 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -68,6 +68,7 @@ inductive Reftype where
   deriving Inhabited, BEq
 
 inductive Valtype where
+ | BOT : Valtype
  | I32 : Valtype
  | I64 : Valtype
  | F32 : Valtype
@@ -75,7 +76,6 @@ inductive Valtype where
  | V128 : Valtype
  | FUNCREF : Valtype
  | EXTERNREF : Valtype
- | BOT : Valtype
   deriving Inhabited, BEq
 
 def «$valtype_numtype» : Numtype -> Valtype
@@ -885,6 +885,12 @@ instance : Append Frame where
 @[reducible] def State := /- mixop: `%;%` -/ (Store × Frame)
 
 inductive Admininstr where
+ | REF_FUNC_ADDR : Funcaddr -> Admininstr
+ | REF_HOST_ADDR : Hostaddr -> Admininstr
+ | CALL_ADDR : Funcaddr -> Admininstr
+ | LABEL_ : (N × (List Instr) × (List Admininstr)) -> Admininstr
+ | FRAME_ : (N × Frame × (List Admininstr)) -> Admininstr
+ | TRAP : Admininstr
  | UNREACHABLE : Admininstr
  | NOP : Admininstr
  | DROP : Admininstr
@@ -929,12 +935,6 @@ inductive Admininstr where
  | DATA_DROP : Dataidx -> Admininstr
  | LOAD : (Numtype × (Option (N × Sx)) × Nat × Nat) -> Admininstr
  | STORE : (Numtype × (Option N) × Nat × Nat) -> Admininstr
- | REF_FUNC_ADDR : Funcaddr -> Admininstr
- | REF_HOST_ADDR : Hostaddr -> Admininstr
- | CALL_ADDR : Funcaddr -> Admininstr
- | LABEL_ : (N × (List Instr) × (List Admininstr)) -> Admininstr
- | FRAME_ : (N × Frame × (List Admininstr)) -> Admininstr
- | TRAP : Admininstr
   deriving Inhabited, BEq
 
 def «$admininstr_instr» : Instr -> Admininstr

From 572c691357b350f37f4f767a7ce540fb374bb6a3 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sat, 8 Apr 2023 13:48:03 +0200
Subject: [PATCH 52/98] A pass to totalize functions. Introduces TheE

---
 spectec/src/backend-lean4/gen.ml     |   1 +
 spectec/src/exe-lean4/main.ml        |   4 +
 spectec/src/frontend/multiplicity.ml |   3 +
 spectec/src/il/ast.ml                |   1 +
 spectec/src/il/dune                  |   2 +-
 spectec/src/il/free.ml               |   1 +
 spectec/src/il/print.ml              |   1 +
 spectec/src/il/totalize.ml           | 147 +++++++++++++++++++++++++++
 spectec/src/il/totalize.mli          |   1 +
 spectec/src/il/validation.ml         |   3 +
 spectec/test-lean4/TEST.md           |  48 ++++-----
 11 files changed, 187 insertions(+), 25 deletions(-)
 create mode 100644 spectec/src/il/totalize.ml
 create mode 100644 spectec/src/il/totalize.mli

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 033907171f..9ae0ab0d2b 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -107,6 +107,7 @@ let rec render_exp (exp : exp) = match exp.it with
   | ListE es -> render_list render_exp es
   | OptE None -> "none"
   | OptE (Some e) -> "some" $$ render_exp e
+  | TheE e  -> render_exp e ^ ".get!"
   | IterE (e, (iter, vs)) -> begin match e.it with
     | VarE v when List.length vs = 1 && List.for_all (Il.Eq.eq_id v) vs  -> render_id v (* Short-ciruit this common form *)
     | _ -> match iter, vs with
diff --git a/spectec/src/exe-lean4/main.ml b/spectec/src/exe-lean4/main.ml
index 6876d7f84b..0590968cc1 100644
--- a/spectec/src/exe-lean4/main.ml
+++ b/spectec/src/exe-lean4/main.ml
@@ -54,6 +54,10 @@ let () =
     Il.Validation.valid il;
     log "Variant flattening";
     let il = Il.Flat.transform il in
+    Il.Validation.valid il;
+    log "Function totalization";
+    let il = Il.Totalize.transform il in
+    Il.Validation.valid il;
     log "Lean4 Generation...";
     if !odst = "" && !dsts = [] then
       print_endline (Backend_lean4.Gen.gen_string il);
diff --git a/spectec/src/frontend/multiplicity.ml b/spectec/src/frontend/multiplicity.ml
index 7733ad03b2..ba70431902 100644
--- a/spectec/src/frontend/multiplicity.ml
+++ b/spectec/src/frontend/multiplicity.ml
@@ -241,6 +241,9 @@ and annot_exp env e : Il.Ast.exp * occur =
   | SubE (e1, t1, t2) ->
     let e1', occur1 = annot_exp env e1 in
     SubE (e1', t1, t2) $ e.at, occur1
+  | TheE e1 ->
+    let e1', occur1 = annot_exp env e1 in
+    TheE e1' $ e.at, occur1
 
 and annot_expfield env (atom, e) : Il.Ast.expfield * occur =
   let e', occur = annot_exp env e in
diff --git a/spectec/src/il/ast.ml b/spectec/src/il/ast.ml
index 05c29aaea2..07ba34e77f 100644
--- a/spectec/src/il/ast.ml
+++ b/spectec/src/il/ast.ml
@@ -115,6 +115,7 @@ and exp' =
   | CatE of exp * exp            (* exp :: exp *)
   | CaseE of atom * exp * typ    (* atom exp : typ *)
   | SubE of exp * typ * typ      (* exp : typ1 <: typ2 *)
+  | TheE of exp                  (* THE exp *)
 
 and expfield = atom * exp        (* atom exp *)
 
diff --git a/spectec/src/il/dune b/spectec/src/il/dune
index 0ee500d741..adaaff5c95 100644
--- a/spectec/src/il/dune
+++ b/spectec/src/il/dune
@@ -1,5 +1,5 @@
 (library
   (name il)
   (libraries util)
-  (modules ast eq free print validation flat)
+  (modules ast eq free print validation flat totalize)
 )
diff --git a/spectec/src/il/free.ml b/spectec/src/il/free.ml
index c1137c6bb0..dfed95bd89 100644
--- a/spectec/src/il/free.ml
+++ b/spectec/src/il/free.ml
@@ -91,6 +91,7 @@ and free_exp e =
   | CallE (id, e1) -> union (free_defid id) (free_exp e1)
   | IterE (e1, iter) -> union (free_exp e1) (free_iterexp iter)
   | DotE (t, e1, _) | CaseE (_, e1, t) -> union (free_exp e1) (free_typ t)
+  | TheE e -> free_exp e
 
 and free_expfield (_, e) = free_exp e
 
diff --git a/spectec/src/il/print.ml b/spectec/src/il/print.ml
index a705ee69b7..7bffaa50f8 100644
--- a/spectec/src/il/print.ml
+++ b/spectec/src/il/print.ml
@@ -154,6 +154,7 @@ and string_of_exp e =
     string_of_atom atom ^ "_" ^ string_of_typ t ^ string_of_exp_args e1
   | SubE (e1, _t1, t2) ->
     "(" ^ string_of_exp e1 ^ " <: " ^ string_of_typ t2 ^ ")"
+  | TheE e -> "THE(" ^ string_of_exp e ^ ")"
 
 and string_of_exp_args e =
   match e.it with
diff --git a/spectec/src/il/totalize.ml b/spectec/src/il/totalize.ml
new file mode 100644
index 0000000000..f5c18bb2ac
--- /dev/null
+++ b/spectec/src/il/totalize.ml
@@ -0,0 +1,147 @@
+(*
+This transformation totalizes partial functions.
+
+Partial functions are recognized by the partial flag hint (for now, inference
+would be possible).
+
+The declarations are changed:
+
+ * the return type is wrapped in the option type `?`
+ * all clauses rhs' are wrapped in the option type injection `?(…)`
+ * a catch-all clause is added returning `null`
+
+All calls to such functions are wrapped in option projection `THE e`.
+
+(Until the AST has that we’ll use `CallE (THE, e)`.)
+
+*)
+
+open Util
+open Source
+open Ast
+
+(* Errors *)
+
+let error at msg = Source.error at "totalize" msg
+
+(* Environment *)
+
+module S = Set.Make(String)
+
+type env =
+  { mutable total_funs : S.t;
+  }
+
+let new_env () : env =
+  { total_funs = S.empty;
+  }
+
+let is_partial (env : env) (id : id) = S.mem id.it env.total_funs
+
+let register (env : env) (id :id) =
+  env.total_funs <- S.add id.it env.total_funs
+
+(* Transformation *)
+
+(* The main transformation case *)
+let rec t_exp env exp =
+  let exp' = t_exp2 env exp in
+  match exp'.it with
+  | CallE (f, _) when is_partial env f ->
+    TheE exp' $ no_region
+  | _ -> exp'
+
+and t_exp2 env x = { x with it = t_exp' env x.at x.it }
+
+(* Expr traversal *)
+and t_exp' env at = function
+  | (VarE _ | BoolE _ | NatE _ | TextE _) as e -> e
+  | UnE (unop, exp) -> UnE (unop, t_exp env exp)
+  | BinE (binop, exp1, exp2) -> BinE (binop, t_exp env exp1, t_exp env exp2)
+  | CmpE (cmpop, exp1, exp2) -> CmpE (cmpop, t_exp env exp1, t_exp env exp2)
+  | IdxE (exp1, exp2) -> IdxE (t_exp env exp1, t_exp env exp2)
+  | SliceE (exp1, exp2, exp3) -> SliceE (t_exp env exp1, t_exp env exp2, t_exp env exp3)
+  | UpdE (exp1, path, exp2) -> UpdE (t_exp env exp1, t_path env path, t_exp env exp2)
+  | ExtE (exp1, path, exp2) -> ExtE (t_exp env exp1, t_path env path, t_exp env exp2)
+  | StrE fields -> StrE (List.map (fun (a, e) -> a, t_exp env e) fields)
+  | DotE (t, e, a) -> DotE (t, t_exp env e, a)
+  | CompE (exp1, exp2) -> CompE (t_exp env exp1, t_exp env exp2)
+  | LenE exp -> LenE exp
+  | TupE es -> TupE (List.map (t_exp env) es)
+  | MixE (mixop, exp) -> MixE (mixop, t_exp env exp)
+  | CallE (a, exp) -> CallE (a, t_exp env exp)
+  | IterE (e, iterexp) -> IterE (t_exp env e, t_iterexp env iterexp)
+  | OptE None -> OptE None
+  | OptE (Some exp) -> OptE (Some exp)
+  | ListE es -> ListE (List.map (t_exp env) es)
+  | CatE (exp1, exp2) -> CatE (t_exp env exp1, t_exp env exp2)
+  | CaseE (a, e, t) -> CaseE (a, t_exp env e, t)
+  | SubE (e, t1, t2) -> SubE (e, t1, t2)
+  | e -> error at ("t_exp: unsupported: " ^ Print.string_of_exp (e $ no_region))
+
+and t_iter env = function
+  | ListN e -> ListN (t_exp env e)
+  | i -> i
+
+and t_iterexp env (iter, vs) = (t_iter env iter, vs)
+
+and t_path' env = function
+  | RootP -> RootP
+  | IdxP (path, e) -> IdxP (t_path env path, t_exp env e)
+  | DotP (path, a) -> DotP (t_path env path, a)
+
+and t_path env x = { x with it = t_path' env x.it }
+
+let rec t_prem' env = function
+  | RulePr (id, mixop, exp) -> RulePr (id, mixop, t_exp env exp)
+  | IfPr e -> IfPr (t_exp env e)
+  | ElsePr -> ElsePr
+  | IterPr (prem, iterexp) -> IterPr (t_prem env prem, t_iterexp env iterexp)
+
+and t_prem env x = { x with it = t_prem' env x.it }
+
+let t_prems env = List.map (t_prem env)
+
+let t_clause' env = function
+ | DefD (binds, lhs, rhs, prems) ->
+  DefD (binds, t_exp env lhs, t_exp env rhs, t_prems env prems)
+
+let t_clause env (clause : clause) = { clause with it = t_clause' env clause.it }
+
+let is_partial_hint hint = hint.hintid.it = "partial"
+
+let t_rule' env = function
+  | RuleD (id, binds, mixop, exp, prems) ->
+    RuleD (id, binds, mixop, t_exp env exp, t_prems env prems)
+
+let t_rule env x = { x with it = t_rule' env x.it }
+
+let rec t_def' env = function
+  | RecD defs -> RecD (List.map (t_def env) defs)
+  | DecD (id, typ1, typ2, clauses, hints) ->
+    let clauses' = List.map (t_clause env) clauses in
+    if List.exists is_partial_hint hints
+    then
+      let typ2' = IterT (typ2, Opt) $ no_region in
+      let clauses'' = List.map (fun clause -> match clause.it with
+        DefD (binds, lhs, rhs, prems) ->
+          { clause with it = DefD (binds, lhs, OptE (Some rhs) $ no_region, prems) }
+        ) clauses' in
+      let x = "x" $ no_region in
+      let catch_all = DefD ([(x, typ1, [])], VarE x $ no_region, OptE None $ no_region, []) $ no_region in
+      let hints' = List.filter (fun hint -> not (is_partial_hint hint)) hints in
+      register env id;
+      DecD (id, typ1, typ2', clauses'' @ [ catch_all ], hints')
+    else
+      DecD (id, typ1, typ2, clauses', hints)
+  | RelD (id, mixop, typ, rules, hints) ->
+    RelD (id, mixop, typ, List.map (t_rule env) rules, hints)
+  | def -> def
+
+and t_def env x = { x with it = t_def' env x.it }
+
+
+let transform (defs : script) =
+  let env = new_env () in
+  List.map (t_def env) defs
+
diff --git a/spectec/src/il/totalize.mli b/spectec/src/il/totalize.mli
new file mode 100644
index 0000000000..c1cea3cf98
--- /dev/null
+++ b/spectec/src/il/totalize.mli
@@ -0,0 +1 @@
+val transform : Ast.script -> Ast.script
diff --git a/spectec/src/il/validation.ml b/spectec/src/il/validation.ml
index 821f99ef05..f8fff5a163 100644
--- a/spectec/src/il/validation.ml
+++ b/spectec/src/il/validation.ml
@@ -321,6 +321,7 @@ and infer_exp env e : typ =
   | CatE _ -> error e.at "cannot infer type of concatenation"
   | CaseE _ -> error e.at "cannot infer type of case constructor"
   | SubE (_, _, t) -> t
+  | TheE e -> as_iter_typ Opt "option" env Check (infer_exp env e) e.at
 
 
 and valid_exp env e t =
@@ -431,6 +432,8 @@ and valid_exp env e t =
     valid_exp env e1 t1;
     equiv_typ env t2 t e.at;
     sub_typ env t1 t2 e.at
+  | TheE e ->
+    valid_exp env e (IterT (t, Opt) $ e.at)
 
 and valid_expmix env mixop e (mixop', t) at =
   if mixop <> mixop' then
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index bfc91ec09a..7d91174ec3 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -329,13 +329,13 @@ inductive Externuse where
 
 @[reducible] def Module := /- mixop: `MODULE%*%*%*%*%*%*%*%*%*` -/ ((List Import) × (List Func) × (List Global) × (List Table) × (List Mem) × (List Elem) × (List Data) × (List Start) × (List Export))
 
-def «$size» : Valtype -> Nat
-  | Valtype.I32 => 32
-  | Valtype.I64 => 64
-  | Valtype.F32 => 32
-  | Valtype.F64 => 64
-  | Valtype.V128 => 128
-  | _ => default
+def «$size» : Valtype -> (Option Nat)
+  | Valtype.I32 => (some 32)
+  | Valtype.I64 => (some 64)
+  | Valtype.F32 => (some 32)
+  | Valtype.F64 => (some 64)
+  | Valtype.V128 => (some 128)
+  | x => none
 
 def «$test_sub_ATOM_22» : N -> Nat
   | n_3_ATOM_y => 0
@@ -528,15 +528,15 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
   | relop (C : Context) (nt : Numtype) (relop : Relop_numtype) :
     (Instr_ok (C, (Instr.RELOP (nt, relop)), ([(«$valtype_numtype» nt), («$valtype_numtype» nt)], [Valtype.I32])))
   | extend (C : Context) (n : N) (nt : Numtype) :
-    (n <= («$size» («$valtype_numtype» nt))) ->
+    (n <= («$size» («$valtype_numtype» nt)).get!) ->
     (Instr_ok (C, (Instr.EXTEND (nt, n)), ([(«$valtype_numtype» nt)], [(«$valtype_numtype» nt)])))
   | reinterpret (C : Context) (nt_1 : Numtype) (nt_2 : Numtype) :
     (nt_1 != nt_2) ->
-    ((«$size» («$valtype_numtype» nt_1)) == («$size» («$valtype_numtype» nt_2))) ->
+    ((«$size» («$valtype_numtype» nt_1)).get! == («$size» («$valtype_numtype» nt_2)).get!) ->
     (Instr_ok (C, (Instr.CVTOP (nt_1, Cvtop.REINTERPRET, nt_2, none)), ([(«$valtype_numtype» nt_2)], [(«$valtype_numtype» nt_1)])))
   | convert_i (C : Context) (in_1 : In) (in_2 : In) (sx : (Option Sx)) :
     (in_1 != in_2) ->
-    ((sx == none) = ((«$size» («$valtype_in» in_1)) > («$size» («$valtype_in» in_2)))) ->
+    ((sx == none) = ((«$size» («$valtype_in» in_1)).get! > («$size» («$valtype_in» in_2)).get!)) ->
     (Instr_ok (C, (Instr.CVTOP ((«$numtype_in» in_1), Cvtop.CONVERT, («$numtype_in» in_2), sx)), ([(«$valtype_in» in_2)], [(«$valtype_in» in_1)])))
   | convert_f (C : Context) (fn_1 : Fn) (fn_2 : Fn) :
     (fn_1 != fn_2) ->
@@ -610,14 +610,14 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (Instr_ok (C, (Instr.DATA_DROP x), ([], [])))
   | load (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (sx : (Option Sx)) (t : Valtype) :
     ((C.MEM.get! 0) == mt) ->
-    ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» t)) 8))) ->
-    (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» t)) 8))))) n.toList) ->
+    ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» t).get!) 8))) ->
+    (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» t).get!) 8))))) n.toList) ->
     ((n == none) || (nt == («$numtype_in» «in»))) ->
     (Instr_ok (C, (Instr.LOAD (nt, (Option.zipWith (λ n sx ↦ (n, sx)) n sx), n_A, n_O)), ([Valtype.I32], [(«$valtype_numtype» nt)])))
   | store (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (t : Valtype) :
     ((C.MEM.get! 0) == mt) ->
-    ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» t)) 8))) ->
-    (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» t)) 8))))) n.toList) ->
+    ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» t).get!) 8))) ->
+    (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» t).get!) 8))))) n.toList) ->
     ((n == none) || (nt == («$numtype_in» «in»))) ->
     (Instr_ok (C, (Instr.STORE (nt, n, n_A, n_O)), ([Valtype.I32, («$valtype_numtype» nt)], [])))
 inductive InstrSeq_ok : (Context × (List Instr) × Functype) -> Prop where
@@ -811,14 +811,14 @@ inductive Externval where
  | MEM : Memaddr -> Externval
   deriving Inhabited, BEq
 
-def «$default_» : Valtype -> Val
-  | Valtype.I32 => (Val.CONST (Numtype.I32, 0))
-  | Valtype.I64 => (Val.CONST (Numtype.I64, 0))
-  | Valtype.F32 => (Val.CONST (Numtype.F32, 0))
-  | Valtype.F64 => (Val.CONST (Numtype.F64, 0))
-  | Valtype.FUNCREF => (Val.REF_NULL Reftype.FUNCREF)
-  | Valtype.EXTERNREF => (Val.REF_NULL Reftype.EXTERNREF)
-  | _ => default
+def «$default_» : Valtype -> (Option Val)
+  | Valtype.I32 => (some (Val.CONST (Numtype.I32, 0)))
+  | Valtype.I64 => (some (Val.CONST (Numtype.I64, 0)))
+  | Valtype.F32 => (some (Val.CONST (Numtype.F32, 0)))
+  | Valtype.F64 => (some (Val.CONST (Numtype.F64, 0)))
+  | Valtype.FUNCREF => (some (Val.REF_NULL Reftype.FUNCREF))
+  | Valtype.EXTERNREF => (some (Val.REF_NULL Reftype.EXTERNREF))
+  | x => none
 
 @[reducible] def Exportinst := /- mixop: EXPORT -/ (Name × Externval)
 
@@ -1127,7 +1127,7 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (c == («$relop» (relop, nt, c_1, c_2))) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.RELOP (nt, relop))], [(Admininstr.CONST (Numtype.I32, c))]))
   | extend (c : C_numtype) (n : N) (nt : Numtype) :
-    (Step_pure ([(Admininstr.CONST (nt, c)), (Admininstr.EXTEND (nt, n))], [(Admininstr.CONST (nt, («$ext» (n, («$size» («$valtype_numtype» nt)), Sx.S, c))))]))
+    (Step_pure ([(Admininstr.CONST (nt, c)), (Admininstr.EXTEND (nt, n))], [(Admininstr.CONST (nt, («$ext» (n, («$size» («$valtype_numtype» nt)).get!, Sx.S, c))))]))
   | cvtop_val (c : C_numtype) (c_1 : C_numtype) (cvtop : Cvtop) (nt : Numtype) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) :
     ((«$cvtop» (nt_1, cvtop, nt_2, sx, c_1)) == [c]) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CVTOP (nt_1, cvtop, nt_2, sx))], [(Admininstr.CONST (nt, c))]))
@@ -1155,7 +1155,7 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [Admininstr.TRAP]))
   | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
     (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
-    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t)) t)), MODULE := m}) ->
+    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->
     (Step_read ((z, ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, f, [(Admininstr.LABEL_ (n, [], (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)))]))]))
   | ref_func (x : Idx) (z : State) :
     (Step_read ((z, [(Admininstr.REF_FUNC x)]), [(Admininstr.REF_FUNC_ADDR ((«$funcaddr» z).get! x))]))

From 27d31ca52dd462e141cb7bb751afa18ca921c05b Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sat, 8 Apr 2023 16:43:29 +0200
Subject: [PATCH 53/98] Introduce middlend

---
 spectec/src/dune                         | 1 +
 spectec/src/exe-haskell/main.ml          | 2 +-
 spectec/src/exe-lean4/main.ml            | 4 ++--
 spectec/src/il/dune                      | 2 +-
 spectec/src/il/flat.mli                  | 1 -
 spectec/src/il/totalize.mli              | 1 -
 spectec/src/middlend/dune                | 5 +++++
 spectec/src/{il => middlend}/flat.ml     | 2 +-
 spectec/src/middlend/flat.mli            | 1 +
 spectec/src/{il => middlend}/totalize.ml | 6 ++----
 spectec/src/middlend/totalize.mli        | 1 +
 11 files changed, 15 insertions(+), 11 deletions(-)
 delete mode 100644 spectec/src/il/flat.mli
 delete mode 100644 spectec/src/il/totalize.mli
 create mode 100644 spectec/src/middlend/dune
 rename spectec/src/{il => middlend}/flat.ml (99%)
 create mode 100644 spectec/src/middlend/flat.mli
 rename spectec/src/{il => middlend}/totalize.ml (96%)
 create mode 100644 spectec/src/middlend/totalize.mli

diff --git a/spectec/src/dune b/spectec/src/dune
index 87184f6a84..34ad7118af 100644
--- a/spectec/src/dune
+++ b/spectec/src/dune
@@ -6,6 +6,7 @@
     (re_export el)
     (re_export il)
     (re_export frontend)
+    (re_export middlend)
     (re_export backend_latex)
     (re_export backend_prose)
     (re_export backend_haskell)
diff --git a/spectec/src/exe-haskell/main.ml b/spectec/src/exe-haskell/main.ml
index 283bd0a1c1..d2f9c96391 100644
--- a/spectec/src/exe-haskell/main.ml
+++ b/spectec/src/exe-haskell/main.ml
@@ -53,7 +53,7 @@ let () =
     log "IL Validation...";
     Il.Validation.valid il;
     log "Variant flattening";
-    let il = Il.Flat.transform il in
+    let il = Middlend.Flat.transform il in
     log "Haskell Generation...";
     if !odst = "" && !dsts = [] then
       print_endline (Backend_haskell.Gen.gen_string il);
diff --git a/spectec/src/exe-lean4/main.ml b/spectec/src/exe-lean4/main.ml
index 0590968cc1..e9cccc8198 100644
--- a/spectec/src/exe-lean4/main.ml
+++ b/spectec/src/exe-lean4/main.ml
@@ -53,10 +53,10 @@ let () =
     log "IL Validation...";
     Il.Validation.valid il;
     log "Variant flattening";
-    let il = Il.Flat.transform il in
+    let il = Middlend.Flat.transform il in
     Il.Validation.valid il;
     log "Function totalization";
-    let il = Il.Totalize.transform il in
+    let il = Middlend.Totalize.transform il in
     Il.Validation.valid il;
     log "Lean4 Generation...";
     if !odst = "" && !dsts = [] then
diff --git a/spectec/src/il/dune b/spectec/src/il/dune
index adaaff5c95..38b4366dee 100644
--- a/spectec/src/il/dune
+++ b/spectec/src/il/dune
@@ -1,5 +1,5 @@
 (library
   (name il)
   (libraries util)
-  (modules ast eq free print validation flat totalize)
+  (modules ast eq free print validation)
 )
diff --git a/spectec/src/il/flat.mli b/spectec/src/il/flat.mli
deleted file mode 100644
index c1cea3cf98..0000000000
--- a/spectec/src/il/flat.mli
+++ /dev/null
@@ -1 +0,0 @@
-val transform : Ast.script -> Ast.script
diff --git a/spectec/src/il/totalize.mli b/spectec/src/il/totalize.mli
deleted file mode 100644
index c1cea3cf98..0000000000
--- a/spectec/src/il/totalize.mli
+++ /dev/null
@@ -1 +0,0 @@
-val transform : Ast.script -> Ast.script
diff --git a/spectec/src/middlend/dune b/spectec/src/middlend/dune
new file mode 100644
index 0000000000..505fc9912e
--- /dev/null
+++ b/spectec/src/middlend/dune
@@ -0,0 +1,5 @@
+(library
+  (name middlend)
+  (libraries util il)
+  (modules flat totalize)
+)
diff --git a/spectec/src/il/flat.ml b/spectec/src/middlend/flat.ml
similarity index 99%
rename from spectec/src/il/flat.ml
rename to spectec/src/middlend/flat.ml
index 45bc1ff580..ad2f4c0a5f 100644
--- a/spectec/src/il/flat.ml
+++ b/spectec/src/middlend/flat.ml
@@ -10,7 +10,7 @@ This transformation
 
 open Util
 open Source
-open Ast
+open Il.Ast
 
 (* Errors *)
 
diff --git a/spectec/src/middlend/flat.mli b/spectec/src/middlend/flat.mli
new file mode 100644
index 0000000000..542bbf8052
--- /dev/null
+++ b/spectec/src/middlend/flat.mli
@@ -0,0 +1 @@
+val transform : Il.Ast.script -> Il.Ast.script
diff --git a/spectec/src/il/totalize.ml b/spectec/src/middlend/totalize.ml
similarity index 96%
rename from spectec/src/il/totalize.ml
rename to spectec/src/middlend/totalize.ml
index f5c18bb2ac..0dc7df5051 100644
--- a/spectec/src/il/totalize.ml
+++ b/spectec/src/middlend/totalize.ml
@@ -12,13 +12,11 @@ The declarations are changed:
 
 All calls to such functions are wrapped in option projection `THE e`.
 
-(Until the AST has that we’ll use `CallE (THE, e)`.)
-
 *)
 
 open Util
 open Source
-open Ast
+open Il.Ast
 
 (* Errors *)
 
@@ -77,7 +75,7 @@ and t_exp' env at = function
   | CatE (exp1, exp2) -> CatE (t_exp env exp1, t_exp env exp2)
   | CaseE (a, e, t) -> CaseE (a, t_exp env e, t)
   | SubE (e, t1, t2) -> SubE (e, t1, t2)
-  | e -> error at ("t_exp: unsupported: " ^ Print.string_of_exp (e $ no_region))
+  | e -> error at ("t_exp: unsupported: " ^ Il.Print.string_of_exp (e $ no_region))
 
 and t_iter env = function
   | ListN e -> ListN (t_exp env e)
diff --git a/spectec/src/middlend/totalize.mli b/spectec/src/middlend/totalize.mli
new file mode 100644
index 0000000000..542bbf8052
--- /dev/null
+++ b/spectec/src/middlend/totalize.mli
@@ -0,0 +1 @@
+val transform : Il.Ast.script -> Il.Ast.script

From 4ee9b5750751ab12aae278f620ab61011d12261c Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sat, 8 Apr 2023 16:46:28 +0200
Subject: [PATCH 54/98] Remove nix files (until they are welcome on main)
 easier to switch branches this way

---
 spectec/.envrc     |  1 -
 spectec/flake.lock | 26 --------------------------
 spectec/flake.nix  | 24 ------------------------
 3 files changed, 51 deletions(-)
 delete mode 100644 spectec/.envrc
 delete mode 100644 spectec/flake.lock
 delete mode 100644 spectec/flake.nix

diff --git a/spectec/.envrc b/spectec/.envrc
deleted file mode 100644
index 3550a30f2d..0000000000
--- a/spectec/.envrc
+++ /dev/null
@@ -1 +0,0 @@
-use flake
diff --git a/spectec/flake.lock b/spectec/flake.lock
deleted file mode 100644
index a958875734..0000000000
--- a/spectec/flake.lock
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  "nodes": {
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1680503963,
-        "narHash": "sha256-UN+DpGcuczv2DS1aR7dJ1Reci7TlY0+dvPOEs6BgHkA=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "b50b1cce7a7900d1721850f61c506823e64173d6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "nixpkgs": "nixpkgs"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}
diff --git a/spectec/flake.nix b/spectec/flake.nix
deleted file mode 100644
index 8f27f3605b..0000000000
--- a/spectec/flake.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  inputs.nixpkgs.url = "github:NixOS/nixpkgs";
-#  inputs.lean.url = "github:leanprover/lean4";
-
-  description = "Nix infrastructure for spectec";
-  outputs = { self, nixpkgs }:
-    let
-      system = "x86_64-linux";
-      pkgs = nixpkgs.legacyPackages.${system};
-    in {
-      devShells.${system}.default =
-        pkgs.mkShell {
-          packages = with pkgs; [
-            #lean.packages.${system}.lean-all
-            dune_3
-            ocamlPackages.ocaml
-            ocamlPackages.menhir
-            ocamlPackages.mdx
-            ocamlPackages.merlin
-            ghc
-          ];
-        };
-    };
-}

From b0c87a15d6b6460d368e099fbd2f87c2af99c7f1 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sat, 8 Apr 2023 16:49:59 +0200
Subject: [PATCH 55/98] Move TheE near OptE

---
 spectec/src/frontend/multiplicity.ml | 6 +++---
 spectec/src/il/ast.ml                | 2 +-
 spectec/src/il/free.ml               | 2 +-
 spectec/src/il/print.ml              | 2 +-
 spectec/src/il/validation.ml         | 6 +++---
 spectec/src/middlend/totalize.ml     | 8 ++++----
 6 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/spectec/src/frontend/multiplicity.ml b/spectec/src/frontend/multiplicity.ml
index ba70431902..e9e716b0ef 100644
--- a/spectec/src/frontend/multiplicity.ml
+++ b/spectec/src/frontend/multiplicity.ml
@@ -228,6 +228,9 @@ and annot_exp env e : Il.Ast.exp * occur =
   | OptE (Some e1) ->
     let e1', occur1 = annot_exp env e1 in
     OptE (Some e1') $ e.at, occur1
+  | TheE e1 ->
+    let e1', occur1 = annot_exp env e1 in
+    TheE e1' $ e.at, occur1
   | ListE es ->
     let es', occurs = List.split (List.map (annot_exp env) es) in
     ListE es' $ e.at, List.fold_left union Env.empty occurs
@@ -241,9 +244,6 @@ and annot_exp env e : Il.Ast.exp * occur =
   | SubE (e1, t1, t2) ->
     let e1', occur1 = annot_exp env e1 in
     SubE (e1', t1, t2) $ e.at, occur1
-  | TheE e1 ->
-    let e1', occur1 = annot_exp env e1 in
-    TheE e1' $ e.at, occur1
 
 and annot_expfield env (atom, e) : Il.Ast.expfield * occur =
   let e', occur = annot_exp env e in
diff --git a/spectec/src/il/ast.ml b/spectec/src/il/ast.ml
index 07ba34e77f..2730a0cd9f 100644
--- a/spectec/src/il/ast.ml
+++ b/spectec/src/il/ast.ml
@@ -111,11 +111,11 @@ and exp' =
   | CallE of id * exp            (* defid exp? *)
   | IterE of exp * iterexp       (* exp iter *)
   | OptE of exp option           (* exp? : typ? *)
+  | TheE of exp                  (* THE exp *)
   | ListE of exp list            (* [exp ... exp] *)
   | CatE of exp * exp            (* exp :: exp *)
   | CaseE of atom * exp * typ    (* atom exp : typ *)
   | SubE of exp * typ * typ      (* exp : typ1 <: typ2 *)
-  | TheE of exp                  (* THE exp *)
 
 and expfield = atom * exp        (* atom exp *)
 
diff --git a/spectec/src/il/free.ml b/spectec/src/il/free.ml
index dfed95bd89..be4d50a623 100644
--- a/spectec/src/il/free.ml
+++ b/spectec/src/il/free.ml
@@ -84,6 +84,7 @@ and free_exp e =
     free_list free_exp [e1; e2]
   | SliceE (e1, e2, e3) -> free_list free_exp [e1; e2; e3]
   | OptE eo -> free_opt free_exp eo
+  | TheE e -> free_exp e
   | TupE es | ListE es -> free_list free_exp es
   | UpdE (e1, p, e2) | ExtE (e1, p, e2) ->
     union (free_list free_exp [e1; e2]) (free_path p)
@@ -91,7 +92,6 @@ and free_exp e =
   | CallE (id, e1) -> union (free_defid id) (free_exp e1)
   | IterE (e1, iter) -> union (free_exp e1) (free_iterexp iter)
   | DotE (t, e1, _) | CaseE (_, e1, t) -> union (free_exp e1) (free_typ t)
-  | TheE e -> free_exp e
 
 and free_expfield (_, e) = free_exp e
 
diff --git a/spectec/src/il/print.ml b/spectec/src/il/print.ml
index 7bffaa50f8..fb15188429 100644
--- a/spectec/src/il/print.ml
+++ b/spectec/src/il/print.ml
@@ -148,13 +148,13 @@ and string_of_exp e =
   | CallE (id, e) -> "$" ^ id.it ^ string_of_exp_args e
   | IterE (e1, iter) -> string_of_exp e1 ^ string_of_iterexp iter
   | OptE eo -> "?(" ^ string_of_exps "" (Option.to_list eo) ^ ")"
+  | TheE e -> "THE(" ^ string_of_exp e ^ ")"
   | ListE es -> "[" ^ string_of_exps " " es ^ "]"
   | CatE (e1, e2) -> string_of_exp e1 ^ " :: " ^ string_of_exp e2
   | CaseE (atom, e1, t) ->
     string_of_atom atom ^ "_" ^ string_of_typ t ^ string_of_exp_args e1
   | SubE (e1, _t1, t2) ->
     "(" ^ string_of_exp e1 ^ " <: " ^ string_of_typ t2 ^ ")"
-  | TheE e -> "THE(" ^ string_of_exp e ^ ")"
 
 and string_of_exp_args e =
   match e.it with
diff --git a/spectec/src/il/validation.ml b/spectec/src/il/validation.ml
index f8fff5a163..dcd77e8e90 100644
--- a/spectec/src/il/validation.ml
+++ b/spectec/src/il/validation.ml
@@ -317,11 +317,11 @@ and infer_exp env e : typ =
     let iter' = match fst iter with ListN _ -> List | iter' -> iter' in
     IterT (infer_exp env e1, iter') $ e.at
   | OptE _ -> error e.at "cannot infer type of option"
+  | TheE e -> as_iter_typ Opt "option" env Check (infer_exp env e) e.at
   | ListE _ -> error e.at "cannot infer type of list"
   | CatE _ -> error e.at "cannot infer type of concatenation"
   | CaseE _ -> error e.at "cannot infer type of case constructor"
   | SubE (_, _, t) -> t
-  | TheE e -> as_iter_typ Opt "option" env Check (infer_exp env e) e.at
 
 
 and valid_exp env e t =
@@ -413,6 +413,8 @@ and valid_exp env e t =
   | OptE eo ->
     let t1 = as_iter_typ Opt "option" env Check t e.at in
     Option.iter (fun e1 -> valid_exp env e1 t1) eo
+  | TheE e ->
+    valid_exp env e (IterT (t, Opt) $ e.at)
   | ListE es ->
     let t1 = as_iter_typ List "list" env Check t e.at in
     List.iter (fun eI -> valid_exp env eI t1) es
@@ -432,8 +434,6 @@ and valid_exp env e t =
     valid_exp env e1 t1;
     equiv_typ env t2 t e.at;
     sub_typ env t1 t2 e.at
-  | TheE e ->
-    valid_exp env e (IterT (t, Opt) $ e.at)
 
 and valid_expmix env mixop e (mixop', t) at =
   if mixop <> mixop' then
diff --git a/spectec/src/middlend/totalize.ml b/spectec/src/middlend/totalize.ml
index 0dc7df5051..f291c0173f 100644
--- a/spectec/src/middlend/totalize.ml
+++ b/spectec/src/middlend/totalize.ml
@@ -20,7 +20,7 @@ open Il.Ast
 
 (* Errors *)
 
-let error at msg = Source.error at "totalize" msg
+let _error at msg = Source.error at "totalize" msg
 
 (* Environment *)
 
@@ -49,10 +49,10 @@ let rec t_exp env exp =
     TheE exp' $ no_region
   | _ -> exp'
 
-and t_exp2 env x = { x with it = t_exp' env x.at x.it }
+and t_exp2 env x = { x with it = t_exp' env x.it }
 
 (* Expr traversal *)
-and t_exp' env at = function
+and t_exp' env = function
   | (VarE _ | BoolE _ | NatE _ | TextE _) as e -> e
   | UnE (unop, exp) -> UnE (unop, t_exp env exp)
   | BinE (binop, exp1, exp2) -> BinE (binop, t_exp env exp1, t_exp env exp2)
@@ -71,11 +71,11 @@ and t_exp' env at = function
   | IterE (e, iterexp) -> IterE (t_exp env e, t_iterexp env iterexp)
   | OptE None -> OptE None
   | OptE (Some exp) -> OptE (Some exp)
+  | TheE exp -> TheE exp
   | ListE es -> ListE (List.map (t_exp env) es)
   | CatE (exp1, exp2) -> CatE (t_exp env exp1, t_exp env exp2)
   | CaseE (a, e, t) -> CaseE (a, t_exp env e, t)
   | SubE (e, t1, t2) -> SubE (e, t1, t2)
-  | e -> error at ("t_exp: unsupported: " ^ Il.Print.string_of_exp (e $ no_region))
 
 and t_iter env = function
   | ListN e -> ListN (t_exp env e)

From 6ec28e3732d1a84c0591a83a7b5f1fef321e8e4d Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sat, 8 Apr 2023 21:54:36 +0200
Subject: [PATCH 56/98] New Middleend pass: Making side-conditions explicit

---
 spectec/src/exe-lean4/main.ml           |   3 +
 spectec/src/il/eq.ml                    |  14 +++-
 spectec/src/il/eq.mli                   |   1 +
 spectec/src/middlend/dune               |   2 +-
 spectec/src/middlend/sideconditions.ml  | 104 ++++++++++++++++++++++++
 spectec/src/middlend/sideconditions.mli |   1 +
 spectec/src/util/lib.ml                 |   4 +
 spectec/src/util/lib.mli                |   1 +
 spectec/test-lean4/TEST.md              |  56 +++++++++++++
 9 files changed, 184 insertions(+), 2 deletions(-)
 create mode 100644 spectec/src/middlend/sideconditions.ml
 create mode 100644 spectec/src/middlend/sideconditions.mli

diff --git a/spectec/src/exe-lean4/main.ml b/spectec/src/exe-lean4/main.ml
index e9cccc8198..6f733c7b83 100644
--- a/spectec/src/exe-lean4/main.ml
+++ b/spectec/src/exe-lean4/main.ml
@@ -58,6 +58,9 @@ let () =
     log "Function totalization";
     let il = Middlend.Totalize.transform il in
     Il.Validation.valid il;
+    log "Side condition inference";
+    let il = Middlend.Sideconditions.transform il in
+    Il.Validation.valid il;
     log "Lean4 Generation...";
     if !odst = "" && !dsts = [] then
       print_endline (Backend_lean4.Gen.gen_string il);
diff --git a/spectec/src/il/eq.ml b/spectec/src/il/eq.ml
index 59411a5d33..d54a4494f4 100644
--- a/spectec/src/il/eq.ml
+++ b/spectec/src/il/eq.ml
@@ -70,10 +70,11 @@ and eq_exp e1 e2 =
   | DotE (t1, e11, atom1), DotE (t2, e21, atom2) ->
     eq_typ t1 t2 && eq_exp e11 e21 && atom1 = atom2
   | MixE (op1, e1), MixE (op2, e2) -> op1 = op2 && eq_exp e1 e2
-  | CallE (id1, e1), CallE (id2, e2) -> id1 = id2 && eq_exp e1 e2
+  | CallE (id1, e1), CallE (id2, e2) -> eq_id id1 id2 && eq_exp e1 e2
   | IterE (e11, iter1), IterE (e21, iter2) ->
     eq_exp e11 e21 && eq_iterexp iter1 iter2
   | OptE eo1, OptE eo2 -> eq_opt eq_exp eo1 eo2
+  | TheE e1, TheE e2 -> eq_exp e1 e2
   | CaseE (atom1, e1, t1), CaseE (atom2, e2, t2) ->
     atom1 = atom2 && eq_exp e1 e2 && eq_typ t1 t2
   | SubE (e1, t11, t12), SubE (e2, t21, t22) ->
@@ -92,3 +93,14 @@ and eq_path p1 p2 =
 
 and eq_iterexp (iter1, ids1) (iter2, ids2) =
   eq_iter iter1 iter2 && eq_list (fun id1 id2 -> id1.it = id2.it) ids1 ids2
+
+let rec eq_prem prem1 prem2 =
+  prem1.it = prem2.it ||
+  match prem1.it, prem2.it with
+  | RulePr (id1, op1, e1), RulePr (id2, op2, e2) ->
+    eq_id id1 id2 && op1 = op2 && eq_exp e1 e2
+  | IfPr e1, IfPr e2 -> eq_exp e1 e2
+  | ElsePr, ElsePr -> true
+  | IterPr (prem1, iterexp1), IterPr (prem2, iterexp2) ->
+  eq_prem prem1 prem2 && eq_iterexp iterexp1 iterexp2
+  | _, _ -> false
diff --git a/spectec/src/il/eq.mli b/spectec/src/il/eq.mli
index f9816c14a0..e045a14257 100644
--- a/spectec/src/il/eq.mli
+++ b/spectec/src/il/eq.mli
@@ -4,3 +4,4 @@ val eq_id : id -> id -> bool
 val eq_iter : iter -> iter -> bool
 val eq_typ : typ -> typ -> bool
 val eq_exp : exp -> exp -> bool
+val eq_prem : premise -> premise -> bool
diff --git a/spectec/src/middlend/dune b/spectec/src/middlend/dune
index 505fc9912e..550f1fe5c7 100644
--- a/spectec/src/middlend/dune
+++ b/spectec/src/middlend/dune
@@ -1,5 +1,5 @@
 (library
   (name middlend)
   (libraries util il)
-  (modules flat totalize)
+  (modules flat totalize sideconditions)
 )
diff --git a/spectec/src/middlend/sideconditions.ml b/spectec/src/middlend/sideconditions.ml
new file mode 100644
index 0000000000..8bd128f44b
--- /dev/null
+++ b/spectec/src/middlend/sideconditions.ml
@@ -0,0 +1,104 @@
+(*
+This transformation make explicit the following implicit side conditions
+of terms in premises and conclusions:
+
+ * Array access          a[i]         i < |a|
+ * Joint iteration       e*{v1,v2}    |v1*| = |v2*|
+ * Option projection     !(e)         e =!= null
+
+(The option projection would probably be nicer by rewriting !(e) to a fresh
+variable x and require e=?x. Maybe later.)
+*)
+
+open Util
+open Source
+open Il.Ast
+
+(* Errors *)
+
+let _error at msg = Source.error at "sideconditions" msg
+
+(* Expr traversal *)
+let rec t_exp e : premise list =
+  (* First the conditions to be generated here *)
+  begin match e.it with
+  | IdxE (exp1, exp2) ->
+    [IfPr (CmpE (LtOp, exp2, LenE exp1 $ no_region) $ no_region) $ no_region]
+  | TheE exp ->
+    [IfPr (CmpE (NeOp, exp, OptE None $ no_region) $ no_region) $ no_region]
+  | _ -> []
+  end @
+  (* And now decend *)
+  match e.it with
+  | VarE _ | BoolE _ | NatE _ | TextE _ | OptE None
+  -> []
+  | UnE (_, exp)
+  | DotE (_, exp, _)
+  | LenE exp
+  | MixE (_, exp)
+  | CallE (_, exp)
+  | OptE (Some exp)
+  | TheE exp
+  | CaseE (_, exp, _)
+  | SubE (exp, _, _)
+  -> t_exp exp
+  | BinE (_, exp1, exp2)
+  | CmpE (_, exp1, exp2)
+  | IdxE (exp1, exp2)
+  | CompE (exp1, exp2)
+  | CatE (exp1, exp2)
+  -> t_exp exp1 @ t_exp exp2
+  | SliceE (exp1, exp2, exp3)
+  -> t_exp exp1 @ t_exp exp2 @ t_exp exp3
+  | UpdE (exp1, path, exp2)
+  | ExtE (exp1, path, exp2)
+  -> t_exp exp1 @ t_path path @ t_exp exp2
+  | StrE fields
+  -> List.concat_map (fun (_, e) -> t_exp e) fields
+  | TupE es | ListE es
+  -> List.concat_map t_exp es
+  | IterE (e, iterexp)
+  -> List.map (fun pr -> IterPr (pr, iterexp) $ no_region) (t_exp e) @ t_iterexp iterexp
+
+and t_iterexp (iter, _) = t_iter iter
+
+and t_iter = function
+  | ListN e -> t_exp e
+  | _ -> []
+
+and t_path path = match path.it with
+  | RootP -> []
+  | IdxP (path, e) -> t_path path @ t_exp e
+  | DotP (path, _) -> t_path path
+
+
+let rec t_prem prem = match prem.it with
+  | RulePr (_, _, exp) -> t_exp exp
+  | IfPr e -> t_exp e
+  | ElsePr -> []
+  | IterPr (prem, iterexp)
+  -> List.map (fun pr -> IterPr (pr, iterexp) $ no_region) (t_prem prem) @ t_iterexp iterexp
+
+let t_prems = List.concat_map t_prem
+
+let t_rule' = function
+  | RuleD (id, binds, mixop, exp, prems) ->
+    let extra_prems = t_prems prems @ t_exp exp in
+    let prems' = Util.Lib.List.nub Il.Eq.eq_prem (extra_prems @ prems) in
+    RuleD (id, binds, mixop, exp, prems')
+
+let t_rule x = { x with it = t_rule' x.it }
+
+let t_rules = List.map t_rule
+
+let rec t_def' = function
+  | RecD defs -> RecD (List.map t_def defs)
+  | RelD (id, mixop, typ, rules, hints) ->
+    RelD (id, mixop, typ, t_rules rules, hints)
+  | def -> def
+
+and t_def x = { x with it = t_def' x.it }
+
+let transform (defs : script) =
+  List.map t_def defs
+
diff --git a/spectec/src/middlend/sideconditions.mli b/spectec/src/middlend/sideconditions.mli
new file mode 100644
index 0000000000..542bbf8052
--- /dev/null
+++ b/spectec/src/middlend/sideconditions.mli
@@ -0,0 +1 @@
+val transform : Il.Ast.script -> Il.Ast.script
diff --git a/spectec/src/util/lib.ml b/spectec/src/util/lib.ml
index 3fbb4cd8f4..e681b2beef 100644
--- a/spectec/src/util/lib.ml
+++ b/spectec/src/util/lib.ml
@@ -10,6 +10,10 @@ struct
     | x::[] -> [], x
     | x::xs -> let ys, y = split_last xs in x::ys, y
     | [] -> failwith "split_last"
+
+  let rec nub pred = function
+    | [] -> []
+    | x::xs -> x :: nub pred (List.filter (fun y -> not (pred x y)) xs)
 end
 
 module String =
diff --git a/spectec/src/util/lib.mli b/spectec/src/util/lib.mli
index 69f0b55445..873e2e9f3c 100644
--- a/spectec/src/util/lib.mli
+++ b/spectec/src/util/lib.mli
@@ -4,6 +4,7 @@ module List :
 sig
   val split_hd : 'a list -> 'a * 'a list (* raises Failure *)
   val split_last : 'a list -> 'a list * 'a (* raises Failure *)
+  val nub : ('a -> 'a -> bool) -> 'a list -> 'a list
 end
 
 module String :
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 260cb15864..24f9f25f84 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -498,12 +498,16 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_2 ↦ [t_2]) t_2), RETURN := none}), instr_2, (t_1, t_2))) ->
     (Instr_ok (C, (Instr.IF (bt, instr_1, instr_2)), (t_1, t_2)))
   | br (C : Context) (l : Labelidx) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
+    (l < C.LABEL.length) ->
     ((C.LABEL.get! l) == t) ->
     (Instr_ok (C, (Instr.BR l), ((t_1 ++ t), t_2)))
   | br_if (C : Context) (l : Labelidx) (t : (List Valtype)) :
+    (l < C.LABEL.length) ->
     ((C.LABEL.get! l) == t) ->
     (Instr_ok (C, (Instr.BR_IF l), ((t ++ [Valtype.I32]), t)))
   | br_table (C : Context) (l : (List Labelidx)) (l' : Labelidx) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
+    (Forall (λ l ↦ (l < C.LABEL.length)) l) ->
+    (l' < C.LABEL.length) ->
     (Forall (λ l ↦ (Resulttype_sub (t, (C.LABEL.get! l)))) l) ->
     (Resulttype_sub (t, (C.LABEL.get! l'))) ->
     (Instr_ok (C, (Instr.BR_TABLE (l, l')), ((t_1 ++ t), t_2)))
@@ -511,9 +515,11 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (C.RETURN == (some t)) ->
     (Instr_ok (C, Instr.RETURN, ((t_1 ++ t), t_2)))
   | call (C : Context) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (x : Idx) :
+    (x < C.FUNC.length) ->
     ((C.FUNC.get! x) == (t_1, t_2)) ->
     (Instr_ok (C, (Instr.CALL x), (t_1, t_2)))
   | call_indirect (C : Context) (ft : Functype) (lim : Limits) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (x : Idx) :
+    (x < C.TABLE.length) ->
     ((C.TABLE.get! x) == (lim, Reftype.FUNCREF)) ->
     (ft == (t_1, t_2)) ->
     (Instr_ok (C, (Instr.CALL_INDIRECT (x, ft)), ((t_1 ++ [Valtype.I32]), t_2)))
@@ -528,13 +534,18 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
   | relop (C : Context) (nt : Numtype) (relop : Relop_numtype) :
     (Instr_ok (C, (Instr.RELOP (nt, relop)), ([(«$valtype_numtype» nt), («$valtype_numtype» nt)], [Valtype.I32])))
   | extend (C : Context) (n : N) (nt : Numtype) :
+    ((«$size» («$valtype_numtype» nt)) != none) ->
     (n <= («$size» («$valtype_numtype» nt)).get!) ->
     (Instr_ok (C, (Instr.EXTEND (nt, n)), ([(«$valtype_numtype» nt)], [(«$valtype_numtype» nt)])))
   | reinterpret (C : Context) (nt_1 : Numtype) (nt_2 : Numtype) :
+    ((«$size» («$valtype_numtype» nt_1)) != none) ->
+    ((«$size» («$valtype_numtype» nt_2)) != none) ->
     (nt_1 != nt_2) ->
     ((«$size» («$valtype_numtype» nt_1)).get! == («$size» («$valtype_numtype» nt_2)).get!) ->
     (Instr_ok (C, (Instr.CVTOP (nt_1, Cvtop.REINTERPRET, nt_2, none)), ([(«$valtype_numtype» nt_2)], [(«$valtype_numtype» nt_1)])))
   | convert_i (C : Context) (in_1 : In) (in_2 : In) (sx : (Option Sx)) :
+    ((«$size» («$valtype_in» in_1)) != none) ->
+    ((«$size» («$valtype_in» in_2)) != none) ->
     (in_1 != in_2) ->
     ((sx == none) = ((«$size» («$valtype_in» in_1)).get! > («$size» («$valtype_in» in_2)).get!)) ->
     (Instr_ok (C, (Instr.CVTOP ((«$numtype_in» in_1), Cvtop.CONVERT, («$numtype_in» in_2), sx)), ([(«$valtype_in» in_2)], [(«$valtype_in» in_1)])))
@@ -544,77 +555,106 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
   | ref_null (C : Context) (rt : Reftype) :
     (Instr_ok (C, (Instr.REF_NULL rt), ([], [(«$valtype_reftype» rt)])))
   | ref_func (C : Context) (ft : Functype) (x : Idx) :
+    (x < C.FUNC.length) ->
     ((C.FUNC.get! x) == ft) ->
     (Instr_ok (C, (Instr.REF_FUNC x), ([], [Valtype.FUNCREF])))
   | ref_is_null (C : Context) (rt : Reftype) :
     (Instr_ok (C, Instr.REF_IS_NULL, ([(«$valtype_reftype» rt)], [Valtype.I32])))
   | local_get (C : Context) (t : Valtype) (x : Idx) :
+    (x < C.LOCAL.length) ->
     ((C.LOCAL.get! x) == t) ->
     (Instr_ok (C, (Instr.LOCAL_GET x), ([], [t])))
   | local_set (C : Context) (t : Valtype) (x : Idx) :
+    (x < C.LOCAL.length) ->
     ((C.LOCAL.get! x) == t) ->
     (Instr_ok (C, (Instr.LOCAL_SET x), ([t], [])))
   | local_tee (C : Context) (t : Valtype) (x : Idx) :
+    (x < C.LOCAL.length) ->
     ((C.LOCAL.get! x) == t) ->
     (Instr_ok (C, (Instr.LOCAL_TEE x), ([t], [t])))
   | global_get (C : Context) («mut» : (Option Mutflag)) (t : Valtype) (x : Idx) :
+    (x < C.GLOBAL.length) ->
     ((C.GLOBAL.get! x) == («mut», t)) ->
     (Instr_ok (C, (Instr.GLOBAL_GET x), ([], [t])))
   | global_set (C : Context) (t : Valtype) (x : Idx) :
+    (x < C.GLOBAL.length) ->
     ((C.GLOBAL.get! x) == ((some ()), t)) ->
     (Instr_ok (C, (Instr.GLOBAL_SET x), ([t], [])))
   | table_get (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
+    (x < C.TABLE.length) ->
     ((C.TABLE.get! x) == (lim, rt)) ->
     (Instr_ok (C, (Instr.TABLE_GET x), ([Valtype.I32], [(«$valtype_reftype» rt)])))
   | table_set (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
+    (x < C.TABLE.length) ->
     ((C.TABLE.get! x) == (lim, rt)) ->
     (Instr_ok (C, (Instr.TABLE_SET x), ([Valtype.I32, («$valtype_reftype» rt)], [])))
   | table_size (C : Context) (tt : Tabletype) (x : Idx) :
+    (x < C.TABLE.length) ->
     ((C.TABLE.get! x) == tt) ->
     (Instr_ok (C, (Instr.TABLE_SIZE x), ([], [Valtype.I32])))
   | table_grow (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
+    (x < C.TABLE.length) ->
     ((C.TABLE.get! x) == (lim, rt)) ->
     (Instr_ok (C, (Instr.TABLE_GROW x), ([(«$valtype_reftype» rt), Valtype.I32], [Valtype.I32])))
   | table_fill (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
+    (x < C.TABLE.length) ->
     ((C.TABLE.get! x) == (lim, rt)) ->
     (Instr_ok (C, (Instr.TABLE_FILL x), ([Valtype.I32, («$valtype_reftype» rt), Valtype.I32], [])))
   | table_copy (C : Context) (lim_1 : Limits) (lim_2 : Limits) (rt : Reftype) (x_1 : Idx) (x_2 : Idx) :
+    (x_1 < C.TABLE.length) ->
+    (x_2 < C.TABLE.length) ->
     ((C.TABLE.get! x_1) == (lim_1, rt)) ->
     ((C.TABLE.get! x_2) == (lim_2, rt)) ->
     (Instr_ok (C, (Instr.TABLE_COPY (x_1, x_2)), ([Valtype.I32, Valtype.I32, Valtype.I32], [])))
   | table_init (C : Context) (lim : Limits) (rt : Reftype) (x_1 : Idx) (x_2 : Idx) :
+    (x_1 < C.TABLE.length) ->
+    (x_2 < C.ELEM.length) ->
     ((C.TABLE.get! x_1) == (lim, rt)) ->
     ((C.ELEM.get! x_2) == rt) ->
     (Instr_ok (C, (Instr.TABLE_INIT (x_1, x_2)), ([Valtype.I32, Valtype.I32, Valtype.I32], [])))
   | elem_drop (C : Context) (rt : Reftype) (x : Idx) :
+    (x < C.ELEM.length) ->
     ((C.ELEM.get! x) == rt) ->
     (Instr_ok (C, (Instr.ELEM_DROP x), ([], [])))
   | memory_size (C : Context) (mt : Memtype) :
+    (0 < C.MEM.length) ->
     ((C.MEM.get! 0) == mt) ->
     (Instr_ok (C, Instr.MEMORY_SIZE, ([], [Valtype.I32])))
   | memory_grow (C : Context) (mt : Memtype) :
+    (0 < C.MEM.length) ->
     ((C.MEM.get! 0) == mt) ->
     (Instr_ok (C, Instr.MEMORY_GROW, ([Valtype.I32], [Valtype.I32])))
   | memory_fill (C : Context) (mt : Memtype) :
+    (0 < C.MEM.length) ->
     ((C.MEM.get! 0) == mt) ->
     (Instr_ok (C, Instr.MEMORY_FILL, ([Valtype.I32, Valtype.I32, Valtype.I32], [Valtype.I32])))
   | memory_copy (C : Context) (mt : Memtype) :
+    (0 < C.MEM.length) ->
     ((C.MEM.get! 0) == mt) ->
     (Instr_ok (C, Instr.MEMORY_COPY, ([Valtype.I32, Valtype.I32, Valtype.I32], [Valtype.I32])))
   | memory_init (C : Context) (mt : Memtype) (x : Idx) :
+    (0 < C.MEM.length) ->
+    (x < C.DATA.length) ->
     ((C.MEM.get! 0) == mt) ->
     ((C.DATA.get! x) == ()) ->
     (Instr_ok (C, (Instr.MEMORY_INIT x), ([Valtype.I32, Valtype.I32, Valtype.I32], [Valtype.I32])))
   | data_drop (C : Context) (x : Idx) :
+    (x < C.DATA.length) ->
     ((C.DATA.get! x) == ()) ->
     (Instr_ok (C, (Instr.DATA_DROP x), ([], [])))
   | load (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (sx : (Option Sx)) (t : Valtype) :
+    (0 < C.MEM.length) ->
+    ((«$size» t) != none) ->
+    (Forall (λ n ↦ ((«$size» t) != none)) n.toList) ->
     ((C.MEM.get! 0) == mt) ->
     ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» t).get!) 8))) ->
     (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» t).get!) 8))))) n.toList) ->
     ((n == none) || (nt == («$numtype_in» «in»))) ->
     (Instr_ok (C, (Instr.LOAD (nt, (Option.zipWith (λ n sx ↦ (n, sx)) n sx), n_A, n_O)), ([Valtype.I32], [(«$valtype_numtype» nt)])))
   | store (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (t : Valtype) :
+    (0 < C.MEM.length) ->
+    ((«$size» t) != none) ->
+    (Forall (λ n ↦ ((«$size» t) != none)) n.toList) ->
     ((C.MEM.get! 0) == mt) ->
     ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» t).get!) 8))) ->
     (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» t).get!) 8))))) n.toList) ->
@@ -650,6 +690,7 @@ inductive Instr_const : (Context × Instr) -> Prop where
   | ref_func (C : Context) (x : Idx) :
     (Instr_const (C, (Instr.REF_FUNC x)))
   | global_get (C : Context) (t : Valtype) (x : Idx) :
+    (x < C.GLOBAL.length) ->
     ((C.GLOBAL.get! x) == (none, t)) ->
     (Instr_const (C, (Instr.GLOBAL_GET x)))
 
@@ -690,6 +731,7 @@ inductive Mem_ok : (Context × Mem × Memtype) -> Prop where
 
 inductive Elemmode_ok : (Context × Elemmode × Reftype) -> Prop where
   | active (C : Context) (expr : Expr) (lim : Limits) (rt : Reftype) (x : Idx) :
+    (x < C.TABLE.length) ->
     ((C.TABLE.get! x) == (lim, rt)) ->
     (Expr_ok_const (C, expr, Valtype.I32)) /- *{} -/ ->
     (Elemmode_ok (C, (Elemmode.TABLE (x, expr)), rt))
@@ -704,6 +746,7 @@ inductive Elem_ok : (Context × Elem × Reftype) -> Prop where
 
 inductive Datamode_ok : (Context × Datamode) -> Prop where
   | rule_0 (C : Context) (expr : Expr) (mt : Memtype) :
+    (0 < C.MEM.length) ->
     ((C.MEM.get! 0) == mt) ->
     (Expr_ok_const (C, expr, Valtype.I32)) /- *{} -/ ->
     (Datamode_ok (C, (Datamode.MEMORY (0, expr))))
@@ -715,6 +758,7 @@ inductive Data_ok : (Context × Data) -> Prop where
 
 inductive Start_ok : (Context × Start) -> Prop where
   | rule_0 (C : Context) (x : Idx) :
+    (x < C.FUNC.length) ->
     ((C.FUNC.get! x) == ([], [])) ->
     (Start_ok (C, x))
 
@@ -725,15 +769,19 @@ inductive Import_ok : (Context × Import × Externtype) -> Prop where
 
 inductive Externuse_ok : (Context × Externuse × Externtype) -> Prop where
   | func (C : Context) (ft : Functype) (x : Idx) :
+    (x < C.FUNC.length) ->
     ((C.FUNC.get! x) == ft) ->
     (Externuse_ok (C, (Externuse.FUNC x), (Externtype.FUNC ft)))
   | «global» (C : Context) (gt : Globaltype) (x : Idx) :
+    (x < C.GLOBAL.length) ->
     ((C.GLOBAL.get! x) == gt) ->
     (Externuse_ok (C, (Externuse.GLOBAL x), (Externtype.GLOBAL gt)))
   | table (C : Context) (tt : Tabletype) (x : Idx) :
+    (x < C.TABLE.length) ->
     ((C.TABLE.get! x) == tt) ->
     (Externuse_ok (C, (Externuse.TABLE x), (Externtype.TABLE tt)))
   | mem (C : Context) (mt : Memtype) (x : Idx) :
+    (x < C.MEM.length) ->
     ((C.MEM.get! x) == mt) ->
     (Externuse_ok (C, (Externuse.MEMORY x), (Externtype.MEMORY mt)))
 
@@ -1127,6 +1175,7 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (c == («$relop» (relop, nt, c_1, c_2))) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.RELOP (nt, relop))], [(Admininstr.CONST (Numtype.I32, c))]))
   | extend (c : C_numtype) (n : N) (nt : Numtype) :
+    ((«$size» («$valtype_numtype» nt)) != none) ->
     (Step_pure ([(Admininstr.CONST (nt, c)), (Admininstr.EXTEND (nt, n))], [(Admininstr.CONST (nt, («$ext» (n, («$size» («$valtype_numtype» nt)).get!, Sx.S, c))))]))
   | cvtop_val (c : C_numtype) (c_1 : C_numtype) (cvtop : Cvtop) (nt : Numtype) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) :
     ((«$cvtop» (nt_1, cvtop, nt_2, sx, c_1)) == [c]) ->
@@ -1145,8 +1194,11 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
 
 inductive Step_read : (Config × (List Admininstr)) -> Prop where
   | call (x : Idx) (z : State) :
+    (x < («$funcaddr» z).length) ->
     (Step_read ((z, [(Admininstr.CALL x)]), [(Admininstr.CALL_ADDR ((«$funcaddr» z).get! x))]))
   | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
+    (i < («$table» (z, x)).length) ->
+    (a < («$funcinst» z).length) ->
     (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
     (((«$funcinst» z).get! a) == (m, func)) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [(Admininstr.CALL_ADDR a)]))
@@ -1154,10 +1206,13 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     True /- Else? -/ ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [Admininstr.TRAP]))
   | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
+    (a < («$funcinst» z).length) ->
+    (Forall (λ t ↦ ((«$default_» t) != none)) t) ->
     (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
     (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->
     (Step_read ((z, ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, f, [(Admininstr.LABEL_ (n, [], (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)))]))]))
   | ref_func (x : Idx) (z : State) :
+    (x < («$funcaddr» z).length) ->
     (Step_read ((z, [(Admininstr.REF_FUNC x)]), [(Admininstr.REF_FUNC_ADDR ((«$funcaddr» z).get! x))]))
   | local_get (x : Idx) (z : State) :
     (Step_read ((z, [(Admininstr.LOCAL_GET x)]), [(«$admininstr_val» («$local» (z, x)))]))
@@ -1209,6 +1264,7 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (n == 0) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), []))
   | table_init_succ (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (i < («$elem» (z, y)).length) ->
     True /- Else? -/ ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), [(Admininstr.CONST (Numtype.I32, j)), («$admininstr_ref» ((«$elem» (z, y)).get! i)), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_INIT (x, y))]))
 

From 50661c75d033f946cc76c9e39f45bb820991f724 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sun, 9 Apr 2023 13:58:06 +0200
Subject: [PATCH 57/98] Update output post-merge

---
 spectec/test-lean4/TEST.md | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 24f9f25f84..90527d9b65 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -642,22 +642,22 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (x < C.DATA.length) ->
     ((C.DATA.get! x) == ()) ->
     (Instr_ok (C, (Instr.DATA_DROP x), ([], [])))
-  | load (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (sx : (Option Sx)) (t : Valtype) :
+  | load (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (sx : (Option Sx)) :
     (0 < C.MEM.length) ->
-    ((«$size» t) != none) ->
-    (Forall (λ n ↦ ((«$size» t) != none)) n.toList) ->
+    ((«$size» («$valtype_numtype» nt)) != none) ->
+    (Forall (λ n ↦ ((«$size» («$valtype_numtype» nt)) != none)) n.toList) ->
     ((C.MEM.get! 0) == mt) ->
-    ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» t).get!) 8))) ->
-    (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» t).get!) 8))))) n.toList) ->
+    ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))) ->
+    (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))))) n.toList) ->
     ((n == none) || (nt == («$numtype_in» «in»))) ->
     (Instr_ok (C, (Instr.LOAD (nt, (Option.zipWith (λ n sx ↦ (n, sx)) n sx), n_A, n_O)), ([Valtype.I32], [(«$valtype_numtype» nt)])))
-  | store (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (t : Valtype) :
+  | store (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) :
     (0 < C.MEM.length) ->
-    ((«$size» t) != none) ->
-    (Forall (λ n ↦ ((«$size» t) != none)) n.toList) ->
+    ((«$size» («$valtype_numtype» nt)) != none) ->
+    (Forall (λ n ↦ ((«$size» («$valtype_numtype» nt)) != none)) n.toList) ->
     ((C.MEM.get! 0) == mt) ->
-    ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» t).get!) 8))) ->
-    (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» t).get!) 8))))) n.toList) ->
+    ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))) ->
+    (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))))) n.toList) ->
     ((n == none) || (nt == («$numtype_in» «in»))) ->
     (Instr_ok (C, (Instr.STORE (nt, n, n_A, n_O)), ([Valtype.I32, («$valtype_numtype» nt)], [])))
 inductive InstrSeq_ok : (Context × (List Instr) × Functype) -> Prop where

From ac2dbcd145c285a133f928ac12d96be6b8aa2ab0 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sun, 9 Apr 2023 14:28:17 +0200
Subject: [PATCH 58/98] Run middle end as part of test-frontend

---
 spectec/src/exe-watsup/main.ml  |   37 +
 spectec/test-frontend/PASSES.md | 8027 +++++++++++++++++++++++++++++++
 spectec/test-frontend/dune      |    2 +-
 3 files changed, 8065 insertions(+), 1 deletion(-)
 create mode 100644 spectec/test-frontend/PASSES.md

diff --git a/spectec/src/exe-watsup/main.ml b/spectec/src/exe-watsup/main.ml
index ae87e815b9..b2253c9c2f 100644
--- a/spectec/src/exe-watsup/main.ml
+++ b/spectec/src/exe-watsup/main.ml
@@ -20,6 +20,9 @@ let srcs = ref []    (* src file arguments *)
 let dsts = ref []    (* destination file arguments *)
 let odst = ref ""    (* generation file argument *)
 
+let pass_flat = ref false
+let pass_totalize = ref false
+let pass_sideconditions = ref false
 
 (* Argument parsing *)
 
@@ -39,6 +42,9 @@ let argspec = Arg.align
   "-d", Arg.Set dry, " Dry run";
   "-l", Arg.Set log, " Log execution steps";
   "-w", Arg.Set warn, " Warn about unsed or multiply used splices";
+  "--flat", Arg.Set pass_flat, "Run variant flattening";
+  "--totalize", Arg.Set pass_totalize, "Run function totalization";
+  "--sideconditions", Arg.Set pass_sideconditions, "Infer side conditoins";
   "--latex", Arg.Unit (fun () -> config := Backend_latex.Config.latex),
     " Use Latex settings (default)";
   "--sphinx", Arg.Unit (fun () -> config := Backend_latex.Config.sphinx),
@@ -66,6 +72,37 @@ let () =
     );
     log "IL Validation...";
     Il.Validation.valid il;
+
+    let _il = if !pass_flat then begin
+      log "Variant flattening...";
+      let il = Middlend.Sideconditions.transform il in
+      log "Printing...";
+      Printf.printf "%s\n%!" (Il.Print.string_of_script il);
+      log "IL Validation...";
+      Il.Validation.valid il;
+      il
+    end else il in
+
+    let il = if !pass_totalize then begin
+      log "Function totalization...";
+      let il = Middlend.Totalize.transform il in
+      log "Printing...";
+      Printf.printf "%s\n%!" (Il.Print.string_of_script il);
+      log "IL Validation...";
+      Il.Validation.valid il;
+      il
+    end else il in
+
+    let _il = if !pass_sideconditions then begin
+      log "Side condition inference";
+      let il = Middlend.Sideconditions.transform il in
+      log "Printing...";
+      Printf.printf "%s\n%!" (Il.Print.string_of_script il);
+      log "IL Validation...";
+      Il.Validation.valid il;
+      il
+    end else il in
+
     log "Latex Generation...";
     if !odst = "" && !dsts = [] then
       print_endline (Backend_latex.Gen.gen_string el);
diff --git a/spectec/test-frontend/PASSES.md b/spectec/test-frontend/PASSES.md
new file mode 100644
index 0000000000..d8189ce557
--- /dev/null
+++ b/spectec/test-frontend/PASSES.md
@@ -0,0 +1,8027 @@
+# Preview
+
+```sh
+$ (cd ../spec && ../src/exe-watsup/main.exe *.watsup -l --flat --totalize --sideconditions)
+== Parsing...
+== Elaboration...
+== Printing...
+
+;; 1-syntax.watsup:3.1-3.15
+syntax n = nat
+
+;; 1-syntax.watsup:9.1-9.37
+syntax name = text
+
+;; 1-syntax.watsup:14.1-14.36
+syntax byte = nat
+
+;; 1-syntax.watsup:15.1-15.45
+syntax u32 = nat
+
+;; 1-syntax.watsup:22.1-22.36
+syntax idx = nat
+
+;; 1-syntax.watsup:23.1-23.49
+syntax funcidx = idx
+
+;; 1-syntax.watsup:24.1-24.49
+syntax globalidx = idx
+
+;; 1-syntax.watsup:25.1-25.47
+syntax tableidx = idx
+
+;; 1-syntax.watsup:26.1-26.46
+syntax memidx = idx
+
+;; 1-syntax.watsup:27.1-27.45
+syntax elemidx = idx
+
+;; 1-syntax.watsup:28.1-28.45
+syntax dataidx = idx
+
+;; 1-syntax.watsup:29.1-29.47
+syntax labelidx = idx
+
+;; 1-syntax.watsup:30.1-30.47
+syntax localidx = idx
+
+;; 1-syntax.watsup:39.1-40.22
+syntax numtype =
+  | I32
+  | I64
+  | F32
+  | F64
+
+;; 1-syntax.watsup:41.1-42.5
+syntax vectype =
+  | V128
+
+;; 1-syntax.watsup:43.1-44.20
+syntax reftype =
+  | FUNCREF
+  | EXTERNREF
+
+;; 1-syntax.watsup:45.1-46.34
+syntax valtype =
+  | I32
+  | I64
+  | F32
+  | F64
+  | V128
+  | FUNCREF
+  | EXTERNREF
+  | BOT
+
+;; 1-syntax.watsup:48.1-48.71
+syntax in =
+  | I32
+  | I64
+
+;; 1-syntax.watsup:49.1-49.71
+syntax fn =
+  | F32
+  | F64
+
+;; 1-syntax.watsup:56.1-57.11
+syntax resulttype = valtype*
+
+;; 1-syntax.watsup:59.1-60.16
+syntax limits = `[%..%]`(u32, u32)
+
+;; 1-syntax.watsup:61.1-62.6
+syntax mutflag = MUT
+
+;; 1-syntax.watsup:63.1-64.19
+syntax globaltype = `%?%`(mutflag?, valtype)
+
+;; 1-syntax.watsup:65.1-66.27
+syntax functype = `%->%`(resulttype, resulttype)
+
+;; 1-syntax.watsup:67.1-68.17
+syntax tabletype = `%%`(limits, reftype)
+
+;; 1-syntax.watsup:69.1-70.12
+syntax memtype = `%I8`(limits)
+
+;; 1-syntax.watsup:71.1-72.10
+syntax elemtype = reftype
+
+;; 1-syntax.watsup:73.1-74.5
+syntax datatype = OK
+
+;; 1-syntax.watsup:75.1-76.69
+syntax externtype =
+  | GLOBAL(globaltype)
+  | FUNC(functype)
+  | TABLE(tabletype)
+  | MEMORY(memtype)
+
+;; 1-syntax.watsup:89.1-89.44
+syntax sx =
+  | U
+  | S
+
+;; 1-syntax.watsup:91.1-91.39
+syntax unop_IXX =
+  | CLZ
+  | CTZ
+  | POPCNT
+
+;; 1-syntax.watsup:92.1-92.70
+syntax unop_FXX =
+  | ABS
+  | NEG
+  | SQRT
+  | CEIL
+  | FLOOR
+  | TRUNC
+  | NEAREST
+
+;; 1-syntax.watsup:94.1-96.62
+syntax binop_IXX =
+  | ADD
+  | SUB
+  | MUL
+  | DIV(sx)
+  | REM(sx)
+  | AND
+  | OR
+  | XOR
+  | SHL
+  | SHR(sx)
+  | ROTL
+  | ROTR
+
+;; 1-syntax.watsup:97.1-97.66
+syntax binop_FXX =
+  | ADD
+  | SUB
+  | MUL
+  | DIV
+  | MIN
+  | MAX
+  | COPYSIGN
+
+;; 1-syntax.watsup:99.1-99.26
+syntax testop_IXX =
+  | EQZ
+
+;; 1-syntax.watsup:100.1-100.22
+syntax testop_FXX =
+  |
+
+;; 1-syntax.watsup:102.1-103.108
+syntax relop_IXX =
+  | EQ
+  | NE
+  | LT(sx)
+  | GT(sx)
+  | LE(sx)
+  | GE(sx)
+
+;; 1-syntax.watsup:104.1-104.49
+syntax relop_FXX =
+  | EQ
+  | NE
+  | LT
+  | GT
+  | LE
+  | GE
+
+;; 1-syntax.watsup:106.1-106.50
+syntax unop_numtype =
+  | _I(unop_IXX)
+  | _F(unop_FXX)
+
+;; 1-syntax.watsup:107.1-107.53
+syntax binop_numtype =
+  | _I(binop_IXX)
+  | _F(binop_FXX)
+
+;; 1-syntax.watsup:108.1-108.56
+syntax testop_numtype =
+  | _I(testop_IXX)
+  | _F(testop_FXX)
+
+;; 1-syntax.watsup:109.1-109.53
+syntax relop_numtype =
+  | _I(relop_IXX)
+  | _F(relop_FXX)
+
+;; 1-syntax.watsup:110.1-110.39
+syntax cvtop =
+  | CONVERT
+  | REINTERPRET
+
+;; 1-syntax.watsup:120.1-120.23
+syntax c_numtype = nat
+
+;; 1-syntax.watsup:121.1-121.23
+syntax c_vectype = nat
+
+;; 1-syntax.watsup:124.1-124.52
+syntax blocktype = functype
+
+;; 1-syntax.watsup:159.1-180.55
+rec {
+
+;; 1-syntax.watsup:159.1-180.55
+syntax instr =
+  | UNREACHABLE
+  | NOP
+  | DROP
+  | SELECT(valtype?)
+  | BLOCK(blocktype, instr*)
+  | LOOP(blocktype, instr*)
+  | IF(blocktype, instr*, instr*)
+  | BR(labelidx)
+  | BR_IF(labelidx)
+  | BR_TABLE(labelidx*, labelidx)
+  | CALL(funcidx)
+  | CALL_INDIRECT(tableidx, functype)
+  | RETURN
+  | CONST(numtype, c_numtype)
+  | UNOP(numtype, unop_numtype)
+  | BINOP(numtype, binop_numtype)
+  | TESTOP(numtype, testop_numtype)
+  | RELOP(numtype, relop_numtype)
+  | EXTEND(numtype, n)
+  | CVTOP(numtype, cvtop, numtype, sx?)
+  | REF.NULL(reftype)
+  | REF.FUNC(funcidx)
+  | REF.IS_NULL
+  | LOCAL.GET(localidx)
+  | LOCAL.SET(localidx)
+  | LOCAL.TEE(localidx)
+  | GLOBAL.GET(globalidx)
+  | GLOBAL.SET(globalidx)
+  | TABLE.GET(tableidx)
+  | TABLE.SET(tableidx)
+  | TABLE.SIZE(tableidx)
+  | TABLE.GROW(tableidx)
+  | TABLE.FILL(tableidx)
+  | TABLE.COPY(tableidx, tableidx)
+  | TABLE.INIT(tableidx, elemidx)
+  | ELEM.DROP(elemidx)
+  | MEMORY.SIZE
+  | MEMORY.GROW
+  | MEMORY.FILL
+  | MEMORY.COPY
+  | MEMORY.INIT(dataidx)
+  | DATA.DROP(dataidx)
+  | LOAD(numtype, (n, sx)?, nat, nat)
+  | STORE(numtype, n?, nat, nat)
+}
+
+;; 1-syntax.watsup:182.1-183.9
+syntax expr = instr*
+
+;; 1-syntax.watsup:188.1-188.50
+syntax elemmode =
+  | TABLE(tableidx, expr)
+  | DECLARE
+
+;; 1-syntax.watsup:189.1-189.39
+syntax datamode =
+  | MEMORY(memidx, expr)
+
+;; 1-syntax.watsup:191.1-192.30
+syntax func = `FUNC%%*%`(functype, valtype*, expr)
+
+;; 1-syntax.watsup:193.1-194.25
+syntax global = GLOBAL(globaltype, expr)
+
+;; 1-syntax.watsup:195.1-196.18
+syntax table = TABLE(tabletype)
+
+;; 1-syntax.watsup:197.1-198.17
+syntax mem = MEMORY(memtype)
+
+;; 1-syntax.watsup:199.1-200.31
+syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
+
+;; 1-syntax.watsup:201.1-202.26
+syntax data = `DATA(*)%*%?`(byte**, datamode?)
+
+;; 1-syntax.watsup:203.1-204.16
+syntax start = START(funcidx)
+
+;; 1-syntax.watsup:206.1-207.65
+syntax externuse =
+  | FUNC(funcidx)
+  | GLOBAL(globalidx)
+  | TABLE(tableidx)
+  | MEMORY(memidx)
+
+;; 1-syntax.watsup:208.1-209.24
+syntax export = EXPORT(name, externuse)
+
+;; 1-syntax.watsup:210.1-211.30
+syntax import = IMPORT(name, name, externtype)
+
+;; 1-syntax.watsup:213.1-214.70
+syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
+
+;; 2-aux.watsup:5.1-5.55
+def size : valtype -> nat
+  ;; 2-aux.watsup:6.1-6.20
+  def size(I32_valtype) = 32
+  ;; 2-aux.watsup:7.1-7.20
+  def size(I64_valtype) = 64
+  ;; 2-aux.watsup:8.1-8.20
+  def size(F32_valtype) = 32
+  ;; 2-aux.watsup:9.1-9.20
+  def size(F64_valtype) = 64
+  ;; 2-aux.watsup:10.1-10.22
+  def size(V128_valtype) = 128
+
+;; 2-aux.watsup:15.1-15.40
+def test_sub_ATOM_22 : n -> nat
+  ;; 2-aux.watsup:16.1-16.38
+  def {n_3_ATOM_y : n} test_sub_ATOM_22(n_3_ATOM_y) = 0
+
+;; 2-aux.watsup:18.1-18.26
+def curried_ : (n, n) -> nat
+  ;; 2-aux.watsup:19.1-19.39
+  def {n_1 : n, n_2 : n} curried_(n_1, n_2) = (n_1 + n_2)
+
+;; 2-aux.watsup:21.1-30.39
+syntax testfuse =
+  | AB_(nat, nat, nat)
+  | CD(nat, nat, nat)
+  | EF(nat, nat, nat)
+  | GH(nat, nat, nat)
+  | IJ(nat, nat, nat)
+  | KL(nat, nat, nat)
+  | MN(nat, nat, nat)
+  | OP(nat, nat, nat)
+  | QR(nat, nat, nat)
+
+;; 3-typing.watsup:3.1-6.60
+syntax context = {FUNC functype*, GLOBAL globaltype*, TABLE tabletype*, MEM memtype*, ELEM elemtype*, DATA datatype*, LOCAL valtype*, LABEL resulttype*, RETURN resulttype?}
+
+;; 3-typing.watsup:14.1-14.66
+relation Limits_ok: `|-%:%`(limits, nat)
+  ;; 3-typing.watsup:22.1-24.24
+  rule _ {k : nat, n_1 : n, n_2 : n}:
+    `|-%:%`(`[%..%]`(n_1, n_2), k)
+    -- if ((n_1 <= n_2) /\ (n_2 <= k))
+
+;; 3-typing.watsup:15.1-15.64
+relation Functype_ok: `|-%:OK`(functype)
+  ;; 3-typing.watsup:26.1-27.13
+  rule _ {ft : functype}:
+    `|-%:OK`(ft)
+
+;; 3-typing.watsup:16.1-16.66
+relation Globaltype_ok: `|-%:OK`(globaltype)
+  ;; 3-typing.watsup:29.1-30.13
+  rule _ {gt : globaltype}:
+    `|-%:OK`(gt)
+
+;; 3-typing.watsup:17.1-17.65
+relation Tabletype_ok: `|-%:OK`(tabletype)
+  ;; 3-typing.watsup:32.1-34.35
+  rule _ {lim : limits, rt : reftype}:
+    `|-%:OK`(`%%`(lim, rt))
+    -- Limits_ok: `|-%:%`(lim, ((2 ^ 32) - 1))
+
+;; 3-typing.watsup:18.1-18.63
+relation Memtype_ok: `|-%:OK`(memtype)
+  ;; 3-typing.watsup:36.1-38.33
+  rule _ {lim : limits}:
+    `|-%:OK`(`%I8`(lim))
+    -- Limits_ok: `|-%:%`(lim, (2 ^ 16))
+
+;; 3-typing.watsup:19.1-19.66
+relation Externtype_ok: `|-%:OK`(externtype)
+  ;; 3-typing.watsup:41.1-43.35
+  rule func {functype : functype}:
+    `|-%:OK`(FUNC_externtype(functype))
+    -- Functype_ok: `|-%:OK`(functype)
+
+  ;; 3-typing.watsup:45.1-47.39
+  rule global {globaltype : globaltype}:
+    `|-%:OK`(GLOBAL_externtype(globaltype))
+    -- Globaltype_ok: `|-%:OK`(globaltype)
+
+  ;; 3-typing.watsup:49.1-51.37
+  rule table {tabletype : tabletype}:
+    `|-%:OK`(TABLE_externtype(tabletype))
+    -- Tabletype_ok: `|-%:OK`(tabletype)
+
+  ;; 3-typing.watsup:53.1-55.33
+  rule mem {memtype : memtype}:
+    `|-%:OK`(MEMORY_externtype(memtype))
+    -- Memtype_ok: `|-%:OK`(memtype)
+
+;; 3-typing.watsup:61.1-61.65
+relation Valtype_sub: `|-%<:%`(valtype, valtype)
+  ;; 3-typing.watsup:64.1-65.12
+  rule refl {t : valtype}:
+    `|-%<:%`(t, t)
+
+  ;; 3-typing.watsup:67.1-68.14
+  rule bot {t : valtype}:
+    `|-%<:%`(BOT_valtype, t)
+
+;; 3-typing.watsup:62.1-62.72
+relation Resulttype_sub: `|-%*<:%*`(valtype*, valtype*)
+  ;; 3-typing.watsup:70.1-72.35
+  rule _ {t_1* : valtype*, t_2* : valtype*}:
+    `|-%*<:%*`(t_1*{t_1}, t_2*{t_2})
+    -- (Valtype_sub: `|-%<:%`(t_1, t_2))*{t_1 t_2}
+
+;; 3-typing.watsup:75.1-75.75
+relation Limits_sub: `|-%<:%`(limits, limits)
+  ;; 3-typing.watsup:83.1-86.21
+  rule _ {n_11 : n, n_12 : n, n_21 : n, n_22 : n}:
+    `|-%<:%`(`[%..%]`(n_11, n_12), `[%..%]`(n_21, n_22))
+    -- if (n_11 >= n_21)
+    -- if (n_12 <= n_22)
+
+;; 3-typing.watsup:76.1-76.73
+relation Functype_sub: `|-%<:%`(functype, functype)
+  ;; 3-typing.watsup:88.1-89.14
+  rule _ {ft : functype}:
+    `|-%<:%`(ft, ft)
+
+;; 3-typing.watsup:77.1-77.75
+relation Globaltype_sub: `|-%<:%`(globaltype, globaltype)
+  ;; 3-typing.watsup:91.1-92.14
+  rule _ {gt : globaltype}:
+    `|-%<:%`(gt, gt)
+
+;; 3-typing.watsup:78.1-78.74
+relation Tabletype_sub: `|-%<:%`(tabletype, tabletype)
+  ;; 3-typing.watsup:94.1-96.35
+  rule _ {lim_1 : limits, lim_2 : limits, rt : reftype}:
+    `|-%<:%`(`%%`(lim_1, rt), `%%`(lim_2, rt))
+    -- Limits_sub: `|-%<:%`(lim_1, lim_2)
+
+;; 3-typing.watsup:79.1-79.72
+relation Memtype_sub: `|-%<:%`(memtype, memtype)
+  ;; 3-typing.watsup:98.1-100.35
+  rule _ {lim_1 : limits, lim_2 : limits}:
+    `|-%<:%`(`%I8`(lim_1), `%I8`(lim_2))
+    -- Limits_sub: `|-%<:%`(lim_1, lim_2)
+
+;; 3-typing.watsup:80.1-80.75
+relation Externtype_sub: `|-%<:%`(externtype, externtype)
+  ;; 3-typing.watsup:103.1-105.35
+  rule func {ft_1 : functype, ft_2 : functype}:
+    `|-%<:%`(FUNC_externtype(ft_1), FUNC_externtype(ft_2))
+    -- Functype_sub: `|-%<:%`(ft_1, ft_2)
+
+  ;; 3-typing.watsup:107.1-109.37
+  rule global {gt_1 : globaltype, gt_2 : globaltype}:
+    `|-%<:%`(GLOBAL_externtype(gt_1), GLOBAL_externtype(gt_2))
+    -- Globaltype_sub: `|-%<:%`(gt_1, gt_2)
+
+  ;; 3-typing.watsup:111.1-113.36
+  rule table {tt_1 : tabletype, tt_2 : tabletype}:
+    `|-%<:%`(TABLE_externtype(tt_1), TABLE_externtype(tt_2))
+    -- Tabletype_sub: `|-%<:%`(tt_1, tt_2)
+
+  ;; 3-typing.watsup:115.1-117.34
+  rule mem {mt_1 : memtype, mt_2 : memtype}:
+    `|-%<:%`(MEMORY_externtype(mt_1), MEMORY_externtype(mt_2))
+    -- Memtype_sub: `|-%<:%`(mt_1, mt_2)
+
+;; 3-typing.watsup:172.1-172.76
+relation Blocktype_ok: `%|-%:%`(context, blocktype, functype)
+  ;; 3-typing.watsup:174.1-176.29
+  rule _ {C : context, ft : functype}:
+    `%|-%:%`(C, ft, ft)
+    -- Functype_ok: `|-%:OK`(ft)
+
+;; 3-typing.watsup:123.1-124.67
+rec {
+
+;; 3-typing.watsup:123.1-123.66
+relation Instr_ok: `%|-%:%`(context, instr, functype)
+  ;; 3-typing.watsup:153.1-154.34
+  rule unreachable {C : context, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, UNREACHABLE_instr, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:156.1-157.32
+  rule nop {C : context}:
+    `%|-%:%`(C, NOP_instr, `%->%`([], []))
+
+  ;; 3-typing.watsup:159.1-160.27
+  rule drop {C : context, t : valtype}:
+    `%|-%:%`(C, DROP_instr, `%->%`([t], []))
+
+  ;; 3-typing.watsup:163.1-164.31
+  rule select-expl {C : context, t : valtype}:
+    `%|-%:%`(C, SELECT_instr(?(t)), `%->%`([t t I32_valtype], [t]))
+
+  ;; 3-typing.watsup:166.1-169.37
+  rule select-impl {C : context, numtype : numtype, t : valtype, t' : valtype, vectype : vectype}:
+    `%|-%:%`(C, SELECT_instr(?()), `%->%`([t t I32_valtype], [t]))
+    -- Valtype_sub: `|-%<:%`(t, t')
+    -- if ((t' = (numtype <: valtype)) \/ (t' = (vectype <: valtype)))
+
+  ;; 3-typing.watsup:178.1-181.57
+  rule block {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BLOCK_instr(bt, instr*{instr}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:183.1-186.57
+  rule loop {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, LOOP_instr(bt, instr*{instr}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_1]*{t_1}, RETURN ?()}, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:188.1-192.59
+  rule if {C : context, bt : blocktype, instr_1* : instr*, instr_2* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, IF_instr(bt, instr_1*{instr_1}, instr_2*{instr_2}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr_1*{instr_1}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr_2*{instr_2}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:195.1-197.24
+  rule br {C : context, l : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BR_instr(l), `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- if (C.LABEL_context[l] = t*{t})
+
+  ;; 3-typing.watsup:199.1-201.24
+  rule br_if {C : context, l : labelidx, t* : valtype*}:
+    `%|-%:%`(C, BR_IF_instr(l), `%->%`(t*{t} :: [I32_valtype], t*{t}))
+    -- if (C.LABEL_context[l] = t*{t})
+
+  ;; 3-typing.watsup:203.1-206.42
+  rule br_table {C : context, l* : labelidx*, l' : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BR_TABLE_instr(l*{l}, l'), `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- (Resulttype_sub: `|-%*<:%*`(t*{t}, C.LABEL_context[l]))*{l}
+    -- Resulttype_sub: `|-%*<:%*`(t*{t}, C.LABEL_context[l'])
+
+  ;; 3-typing.watsup:208.1-210.24
+  rule return {C : context, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, RETURN_instr, `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- if (C.RETURN_context = ?(t*{t}))
+
+  ;; 3-typing.watsup:212.1-214.33
+  rule call {C : context, t_1* : valtype*, t_2* : valtype*, x : idx}:
+    `%|-%:%`(C, CALL_instr(x), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- if (C.FUNC_context[x] = `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:216.1-219.26
+  rule call_indirect {C : context, ft : functype, lim : limits, t_1* : valtype*, t_2* : valtype*, x : idx}:
+    `%|-%:%`(C, CALL_INDIRECT_instr(x, ft), `%->%`(t_1*{t_1} :: [I32_valtype], t_2*{t_2}))
+    -- if (C.TABLE_context[x] = `%%`(lim, FUNCREF_reftype))
+    -- if (ft = `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:222.1-223.37
+  rule const {C : context, c_nt : c_numtype, nt : numtype}:
+    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [(nt <: valtype)]))
+
+  ;; 3-typing.watsup:225.1-226.31
+  rule unop {C : context, nt : numtype, unop : unop_numtype}:
+    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
+
+  ;; 3-typing.watsup:228.1-229.36
+  rule binop {C : context, binop : binop_numtype, nt : numtype}:
+    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([(nt <: valtype) (nt <: valtype)], [(nt <: valtype)]))
+
+  ;; 3-typing.watsup:231.1-232.36
+  rule testop {C : context, nt : numtype, testop : testop_numtype}:
+    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([(nt <: valtype)], [I32_valtype]))
+
+  ;; 3-typing.watsup:234.1-235.37
+  rule relop {C : context, nt : numtype, relop : relop_numtype}:
+    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([(nt <: valtype) (nt <: valtype)], [I32_valtype]))
+
+  ;; 3-typing.watsup:238.1-240.23
+  rule extend {C : context, n : n, nt : numtype}:
+    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
+    -- if (n <= $size(nt <: valtype))
+
+  ;; 3-typing.watsup:242.1-245.34
+  rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype}:
+    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([(nt_2 <: valtype)], [(nt_1 <: valtype)]))
+    -- if (nt_1 =/= nt_2)
+    -- if ($size(nt_1 <: valtype) = $size(nt_2 <: valtype))
+
+  ;; 3-typing.watsup:247.1-250.52
+  rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?}:
+    `%|-%:%`(C, CVTOP_instr((in_1 <: numtype), CONVERT_cvtop, (in_2 <: numtype), sx?{sx}), `%->%`([(in_2 <: valtype)], [(in_1 <: valtype)]))
+    -- if (in_1 =/= in_2)
+    -- if ((sx?{sx} = ?()) <=> ($size(in_1 <: valtype) > $size(in_2 <: valtype)))
+
+  ;; 3-typing.watsup:252.1-254.22
+  rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
+    `%|-%:%`(C, CVTOP_instr((fn_1 <: numtype), CONVERT_cvtop, (fn_2 <: numtype), ?()), `%->%`([(fn_2 <: valtype)], [(fn_1 <: valtype)]))
+    -- if (fn_1 =/= fn_2)
+
+  ;; 3-typing.watsup:257.1-258.35
+  rule ref.null {C : context, rt : reftype}:
+    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [(rt <: valtype)]))
+
+  ;; 3-typing.watsup:260.1-262.23
+  rule ref.func {C : context, ft : functype, x : idx}:
+    `%|-%:%`(C, REF.FUNC_instr(x), `%->%`([], [FUNCREF_valtype]))
+    -- if (C.FUNC_context[x] = ft)
+
+  ;; 3-typing.watsup:264.1-265.31
+  rule ref.is_null {C : context, rt : reftype}:
+    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([(rt <: valtype)], [I32_valtype]))
+
+  ;; 3-typing.watsup:268.1-270.23
+  rule local.get {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.GET_instr(x), `%->%`([], [t]))
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:272.1-274.23
+  rule local.set {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.SET_instr(x), `%->%`([t], []))
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:276.1-278.23
+  rule local.tee {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.TEE_instr(x), `%->%`([t], [t]))
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:281.1-283.29
+  rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
+    `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
+    -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
+
+  ;; 3-typing.watsup:285.1-287.28
+  rule global.set {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
+    -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
+
+  ;; 3-typing.watsup:290.1-292.28
+  rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [(rt <: valtype)]))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:294.1-296.28
+  rule table.set {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype (rt <: valtype)], []))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:298.1-300.24
+  rule table.size {C : context, tt : tabletype, x : idx}:
+    `%|-%:%`(C, TABLE.SIZE_instr(x), `%->%`([], [I32_valtype]))
+    -- if (C.TABLE_context[x] = tt)
+
+  ;; 3-typing.watsup:302.1-304.28
+  rule table.grow {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([(rt <: valtype) I32_valtype], [I32_valtype]))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:306.1-308.28
+  rule table.fill {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype (rt <: valtype) I32_valtype], []))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:310.1-313.32
+  rule table.copy {C : context, lim_1 : limits, lim_2 : limits, rt : reftype, x_1 : idx, x_2 : idx}:
+    `%|-%:%`(C, TABLE.COPY_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (C.TABLE_context[x_1] = `%%`(lim_1, rt))
+    -- if (C.TABLE_context[x_2] = `%%`(lim_2, rt))
+
+  ;; 3-typing.watsup:315.1-318.25
+  rule table.init {C : context, lim : limits, rt : reftype, x_1 : idx, x_2 : idx}:
+    `%|-%:%`(C, TABLE.INIT_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (C.TABLE_context[x_1] = `%%`(lim, rt))
+    -- if (C.ELEM_context[x_2] = rt)
+
+  ;; 3-typing.watsup:320.1-322.23
+  rule elem.drop {C : context, rt : reftype, x : idx}:
+    `%|-%:%`(C, ELEM.DROP_instr(x), `%->%`([], []))
+    -- if (C.ELEM_context[x] = rt)
+
+  ;; 3-typing.watsup:325.1-327.22
+  rule memory.size {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.SIZE_instr, `%->%`([], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:329.1-331.22
+  rule memory.grow {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.GROW_instr, `%->%`([I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:333.1-335.22
+  rule memory.fill {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.FILL_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:337.1-339.22
+  rule memory.copy {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.COPY_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:341.1-344.23
+  rule memory.init {C : context, mt : memtype, x : idx}:
+    `%|-%:%`(C, MEMORY.INIT_instr(x), `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+    -- if (C.DATA_context[x] = OK)
+
+  ;; 3-typing.watsup:346.1-348.23
+  rule data.drop {C : context, x : idx}:
+    `%|-%:%`(C, DATA.DROP_instr(x), `%->%`([], []))
+    -- if (C.DATA_context[x] = OK)
+
+  ;; 3-typing.watsup:350.1-355.32
+  rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?}:
+    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
+    -- if (C.MEM_context[0] = mt)
+    -- if ((2 ^ n_A) <= ($size(nt <: valtype) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(nt <: valtype) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = (in <: numtype)))
+
+  ;; 3-typing.watsup:357.1-362.32
+  rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype}:
+    `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype (nt <: valtype)], []))
+    -- if (C.MEM_context[0] = mt)
+    -- if ((2 ^ n_A) <= ($size(nt <: valtype) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(nt <: valtype) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = (in <: numtype)))
+
+;; 3-typing.watsup:124.1-124.67
+relation InstrSeq_ok: `%|-%*:%`(context, instr*, functype)
+  ;; 3-typing.watsup:133.1-134.36
+  rule empty {C : context}:
+    `%|-%*:%`(C, [], `%->%`([], []))
+
+  ;; 3-typing.watsup:136.1-139.46
+  rule seq {C : context, instr_1 : instr, instr_2 : instr, t_1* : valtype*, t_2* : valtype*, t_3* : valtype*}:
+    `%|-%*:%`(C, [instr_1] :: instr_2*{}, `%->%`(t_1*{t_1}, t_3*{t_3}))
+    -- Instr_ok: `%|-%:%`(C, instr_1, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, [instr_2], `%->%`(t_2*{t_2}, t_3*{t_3}))
+
+  ;; 3-typing.watsup:141.1-146.38
+  rule weak {C : context, instr* : instr*, t'_1 : valtype, t'_2* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%*:%`(C, instr*{instr}, `%->%`([t'_1], t'_2*{t'_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Resulttype_sub: `|-%*<:%*`(t'_1*{}, t_1*{t_1})
+    -- Resulttype_sub: `|-%*<:%*`(t_2*{t_2}, t'_2*{t'_2})
+
+  ;; 3-typing.watsup:148.1-150.45
+  rule frame {C : context, instr* : instr*, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%*:%`(C, instr*{instr}, `%->%`(t*{t} :: t_1*{t_1}, t*{t} :: t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+}
+
+;; 3-typing.watsup:125.1-125.71
+relation Expr_ok: `%|-%:%`(context, expr, resulttype)
+  ;; 3-typing.watsup:128.1-130.46
+  rule _ {C : context, instr* : instr*, t* : valtype*}:
+    `%|-%:%`(C, instr*{instr}, t*{t})
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`([], t*{t}))
+
+;; 3-typing.watsup:367.1-367.78
+relation Instr_const: `%|-%CONST`(context, instr)
+  ;; 3-typing.watsup:371.1-372.26
+  rule const {C : context, c : c_numtype, nt : numtype}:
+    `%|-%CONST`(C, CONST_instr(nt, c))
+
+  ;; 3-typing.watsup:374.1-375.27
+  rule ref.null {C : context, rt : reftype}:
+    `%|-%CONST`(C, REF.NULL_instr(rt))
+
+  ;; 3-typing.watsup:377.1-378.26
+  rule ref.func {C : context, x : idx}:
+    `%|-%CONST`(C, REF.FUNC_instr(x))
+
+  ;; 3-typing.watsup:380.1-382.32
+  rule global.get {C : context, t : valtype, x : idx}:
+    `%|-%CONST`(C, GLOBAL.GET_instr(x))
+    -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
+
+;; 3-typing.watsup:368.1-368.77
+relation Expr_const: `%|-%CONST`(context, expr)
+  ;; 3-typing.watsup:385.1-386.38
+  rule _ {C : context, instr* : instr*}:
+    `%|-%CONST`(C, instr*{instr})
+    -- (Instr_const: `%|-%CONST`(C, instr))*{instr}
+
+;; 3-typing.watsup:369.1-369.78
+relation Expr_ok_const: `%|-%:%CONST`(context, expr, valtype)
+  ;; 3-typing.watsup:389.1-392.33
+  rule _ {C : context, expr : expr, t : valtype}:
+    `%|-%:%CONST`(C, expr, t)
+    -- Expr_ok: `%|-%:%`(C, expr, [t])
+    -- Expr_const: `%|-%CONST`(C, expr)
+
+;; 3-typing.watsup:397.1-397.73
+relation Func_ok: `%|-%:%`(context, func, functype)
+  ;; 3-typing.watsup:408.1-412.75
+  rule _ {C : context, expr : expr, ft : functype, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, `FUNC%%*%`(ft, t*{t}, expr), ft)
+    -- if (ft = `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Functype_ok: `|-%:OK`(ft)
+    -- Expr_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL t_1*{t_1} :: t*{t}, LABEL [], RETURN ?()} ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2*{t_2}], RETURN ?()} ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [], RETURN ?(t_2*{t_2})}, expr, t_2*{t_2})
+
+;; 3-typing.watsup:398.1-398.75
+relation Global_ok: `%|-%:%`(context, global, globaltype)
+  ;; 3-typing.watsup:414.1-418.40
+  rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
+    `%|-%:%`(C, GLOBAL(gt, expr), gt)
+    -- Globaltype_ok: `|-%:OK`(gt)
+    -- if (gt = `%?%`(MUT?{}, t))
+    -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
+
+;; 3-typing.watsup:399.1-399.74
+relation Table_ok: `%|-%:%`(context, table, tabletype)
+  ;; 3-typing.watsup:420.1-422.30
+  rule _ {C : context, tt : tabletype}:
+    `%|-%:%`(C, TABLE(tt), tt)
+    -- Tabletype_ok: `|-%:OK`(tt)
+
+;; 3-typing.watsup:400.1-400.72
+relation Mem_ok: `%|-%:%`(context, mem, memtype)
+  ;; 3-typing.watsup:424.1-426.28
+  rule _ {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY(mt), mt)
+    -- Memtype_ok: `|-%:OK`(mt)
+
+;; 3-typing.watsup:403.1-403.77
+relation Elemmode_ok: `%|-%:%`(context, elemmode, reftype)
+  ;; 3-typing.watsup:437.1-440.45
+  rule active {C : context, expr : expr, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE_elemmode(x, expr), rt)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+    -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*{}
+
+  ;; 3-typing.watsup:442.1-443.20
+  rule declare {C : context, rt : reftype}:
+    `%|-%:%`(C, DECLARE_elemmode, rt)
+
+;; 3-typing.watsup:401.1-401.73
+relation Elem_ok: `%|-%:%`(context, elem, reftype)
+  ;; 3-typing.watsup:428.1-431.40
+  rule _ {C : context, elemmode? : elemmode?, expr* : expr*, rt : reftype}:
+    `%|-%:%`(C, `ELEM%%*%?`(rt, expr*{expr}, elemmode?{elemmode}), rt)
+    -- (Expr_ok: `%|-%:%`(C, expr, [(rt <: valtype)]))*{expr}
+    -- (Elemmode_ok: `%|-%:%`(C, elemmode, rt))?{elemmode}
+
+;; 3-typing.watsup:404.1-404.77
+relation Datamode_ok: `%|-%:OK`(context, datamode)
+  ;; 3-typing.watsup:445.1-448.45
+  rule _ {C : context, expr : expr, mt : memtype}:
+    `%|-%:OK`(C, MEMORY_datamode(0, expr))
+    -- if (C.MEM_context[0] = mt)
+    -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*{}
+
+;; 3-typing.watsup:402.1-402.73
+relation Data_ok: `%|-%:OK`(context, data)
+  ;; 3-typing.watsup:433.1-435.40
+  rule _ {C : context, b** : byte**, datamode? : datamode?}:
+    `%|-%:OK`(C, `DATA(*)%*%?`(b*{b}*{b}, datamode?{datamode}))
+    -- (Datamode_ok: `%|-%:OK`(C, datamode))?{datamode}
+
+;; 3-typing.watsup:405.1-405.74
+relation Start_ok: `%|-%:OK`(context, start)
+  ;; 3-typing.watsup:450.1-452.39
+  rule _ {C : context, x : idx}:
+    `%|-%:OK`(C, START(x))
+    -- if (C.FUNC_context[x] = `%->%`([], []))
+
+;; 3-typing.watsup:455.1-455.80
+relation Import_ok: `%|-%:%`(context, import, externtype)
+  ;; 3-typing.watsup:459.1-461.31
+  rule _ {C : context, name_1 : name, name_2 : name, xt : externtype}:
+    `%|-%:%`(C, IMPORT(name_1, name_2, xt), xt)
+    -- Externtype_ok: `|-%:OK`(xt)
+
+;; 3-typing.watsup:457.1-457.83
+relation Externuse_ok: `%|-%:%`(context, externuse, externtype)
+  ;; 3-typing.watsup:467.1-469.23
+  rule func {C : context, ft : functype, x : idx}:
+    `%|-%:%`(C, FUNC_externuse(x), FUNC_externtype(ft))
+    -- if (C.FUNC_context[x] = ft)
+
+  ;; 3-typing.watsup:471.1-473.25
+  rule global {C : context, gt : globaltype, x : idx}:
+    `%|-%:%`(C, GLOBAL_externuse(x), GLOBAL_externtype(gt))
+    -- if (C.GLOBAL_context[x] = gt)
+
+  ;; 3-typing.watsup:475.1-477.24
+  rule table {C : context, tt : tabletype, x : idx}:
+    `%|-%:%`(C, TABLE_externuse(x), TABLE_externtype(tt))
+    -- if (C.TABLE_context[x] = tt)
+
+  ;; 3-typing.watsup:479.1-481.22
+  rule mem {C : context, mt : memtype, x : idx}:
+    `%|-%:%`(C, MEMORY_externuse(x), MEMORY_externtype(mt))
+    -- if (C.MEM_context[x] = mt)
+
+;; 3-typing.watsup:456.1-456.80
+relation Export_ok: `%|-%:%`(context, export, externtype)
+  ;; 3-typing.watsup:463.1-465.39
+  rule _ {C : context, externuse : externuse, name : name, xt : externtype}:
+    `%|-%:%`(C, EXPORT(name, externuse), xt)
+    -- Externuse_ok: `%|-%:%`(C, externuse, xt)
+
+;; 3-typing.watsup:484.1-484.62
+relation Module_ok: `|-%:OK`(module)
+  ;; 3-typing.watsup:486.1-501.22
+  rule _ {C : context, data^n : data^n, elem* : elem*, export* : export*, ft* : functype*, func* : func*, global* : global*, gt* : globaltype*, import* : import*, mem* : mem*, mt* : memtype*, n : n, rt* : reftype*, start* : start*, table* : table*, tt* : tabletype*}:
+    `|-%:OK`(`MODULE%*%*%*%*%*%*%*%*%*`(import*{import}, func*{func}, global*{global}, table*{table}, mem*{mem}, elem*{elem}, data^n{data}, start*{start}, export*{export}))
+    -- if (C = {FUNC ft*{ft}, GLOBAL gt*{gt}, TABLE tt*{tt}, MEM mt*{mt}, ELEM rt*{rt}, DATA OK^n{}, LOCAL [], LABEL [], RETURN ?()})
+    -- (Func_ok: `%|-%:%`(C, func, ft))*{ft func}
+    -- (Global_ok: `%|-%:%`(C, global, gt))*{global gt}
+    -- (Table_ok: `%|-%:%`(C, table, tt))*{table tt}
+    -- (Mem_ok: `%|-%:%`(C, mem, mt))*{mem mt}
+    -- (Elem_ok: `%|-%:%`(C, elem, rt))*{elem rt}
+    -- (Data_ok: `%|-%:OK`(C, data))^n{data}
+    -- (Start_ok: `%|-%:OK`(C, start))*{start}
+    -- if (|mem*{mem}| <= 1)
+    -- if (|start*{start}| <= 1)
+
+;; 4-runtime.watsup:3.1-3.39
+syntax addr = nat
+
+;; 4-runtime.watsup:4.1-4.53
+syntax funcaddr = addr
+
+;; 4-runtime.watsup:5.1-5.53
+syntax globaladdr = addr
+
+;; 4-runtime.watsup:6.1-6.51
+syntax tableaddr = addr
+
+;; 4-runtime.watsup:7.1-7.50
+syntax memaddr = addr
+
+;; 4-runtime.watsup:8.1-8.49
+syntax elemaddr = addr
+
+;; 4-runtime.watsup:9.1-9.49
+syntax dataaddr = addr
+
+;; 4-runtime.watsup:10.1-10.51
+syntax labeladdr = addr
+
+;; 4-runtime.watsup:11.1-11.49
+syntax hostaddr = addr
+
+;; 4-runtime.watsup:24.1-25.24
+syntax num =
+  | CONST(numtype, c_numtype)
+
+;; 4-runtime.watsup:26.1-27.67
+syntax ref =
+  | REF.NULL(reftype)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+
+;; 4-runtime.watsup:28.1-29.10
+syntax val =
+  | CONST(numtype, c_numtype)
+  | REF.NULL(reftype)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+
+;; 4-runtime.watsup:31.1-32.18
+syntax result =
+  | _VALS(val*)
+  | TRAP
+
+;; 4-runtime.watsup:38.1-39.66
+syntax externval =
+  | FUNC(funcaddr)
+  | GLOBAL(globaladdr)
+  | TABLE(tableaddr)
+  | MEM(memaddr)
+
+;; 4-runtime.watsup:44.1-44.44
+def default_ : valtype -> val
+  ;; 4-runtime.watsup:45.1-45.35
+  def default_(I32_valtype) = CONST_val(I32_numtype, 0)
+  ;; 4-runtime.watsup:46.1-46.35
+  def default_(I64_valtype) = CONST_val(I64_numtype, 0)
+  ;; 4-runtime.watsup:47.1-47.35
+  def default_(F32_valtype) = CONST_val(F32_numtype, 0)
+  ;; 4-runtime.watsup:48.1-48.35
+  def default_(F64_valtype) = CONST_val(F64_numtype, 0)
+  ;; 4-runtime.watsup:49.1-49.44
+  def default_(FUNCREF_valtype) = REF.NULL_val(FUNCREF_reftype)
+  ;; 4-runtime.watsup:50.1-50.48
+  def default_(EXTERNREF_valtype) = REF.NULL_val(EXTERNREF_reftype)
+
+;; 4-runtime.watsup:61.1-61.71
+syntax exportinst = EXPORT(name, externval)
+
+;; 4-runtime.watsup:71.1-78.25
+syntax moduleinst = {FUNC funcaddr*, GLOBAL globaladdr*, TABLE tableaddr*, MEM memaddr*, ELEM elemaddr*, DATA dataaddr*, EXPORT exportinst*}
+
+;; 4-runtime.watsup:55.1-55.66
+syntax funcinst = `%;%`(moduleinst, func)
+
+;; 4-runtime.watsup:56.1-56.53
+syntax globalinst = val
+
+;; 4-runtime.watsup:57.1-57.52
+syntax tableinst = ref*
+
+;; 4-runtime.watsup:58.1-58.52
+syntax meminst = byte*
+
+;; 4-runtime.watsup:59.1-59.53
+syntax eleminst = ref*
+
+;; 4-runtime.watsup:60.1-60.51
+syntax datainst = byte*
+
+;; 4-runtime.watsup:63.1-69.21
+syntax store = {FUNC funcinst*, GLOBAL globalinst*, TABLE tableinst*, MEM meminst*, ELEM eleminst*, DATA datainst*}
+
+;; 4-runtime.watsup:80.1-82.24
+syntax frame = {LOCAL val*, MODULE moduleinst}
+
+;; 4-runtime.watsup:83.1-83.47
+syntax state = `%;%`(store, frame)
+
+;; 4-runtime.watsup:140.1-147.5
+rec {
+
+;; 4-runtime.watsup:140.1-147.5
+syntax admininstr =
+  | UNREACHABLE
+  | NOP
+  | DROP
+  | SELECT(valtype?)
+  | BLOCK(blocktype, instr*)
+  | LOOP(blocktype, instr*)
+  | IF(blocktype, instr*, instr*)
+  | BR(labelidx)
+  | BR_IF(labelidx)
+  | BR_TABLE(labelidx*, labelidx)
+  | CALL(funcidx)
+  | CALL_INDIRECT(tableidx, functype)
+  | RETURN
+  | CONST(numtype, c_numtype)
+  | UNOP(numtype, unop_numtype)
+  | BINOP(numtype, binop_numtype)
+  | TESTOP(numtype, testop_numtype)
+  | RELOP(numtype, relop_numtype)
+  | EXTEND(numtype, n)
+  | CVTOP(numtype, cvtop, numtype, sx?)
+  | REF.NULL(reftype)
+  | REF.FUNC(funcidx)
+  | REF.IS_NULL
+  | LOCAL.GET(localidx)
+  | LOCAL.SET(localidx)
+  | LOCAL.TEE(localidx)
+  | GLOBAL.GET(globalidx)
+  | GLOBAL.SET(globalidx)
+  | TABLE.GET(tableidx)
+  | TABLE.SET(tableidx)
+  | TABLE.SIZE(tableidx)
+  | TABLE.GROW(tableidx)
+  | TABLE.FILL(tableidx)
+  | TABLE.COPY(tableidx, tableidx)
+  | TABLE.INIT(tableidx, elemidx)
+  | ELEM.DROP(elemidx)
+  | MEMORY.SIZE
+  | MEMORY.GROW
+  | MEMORY.FILL
+  | MEMORY.COPY
+  | MEMORY.INIT(dataidx)
+  | DATA.DROP(dataidx)
+  | LOAD(numtype, (n, sx)?, nat, nat)
+  | STORE(numtype, n?, nat, nat)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+  | CALL_ADDR(funcaddr)
+  | LABEL_(n, instr*, admininstr*)
+  | FRAME_(n, frame, admininstr*)
+  | TRAP
+}
+
+;; 4-runtime.watsup:84.1-84.62
+syntax config = `%;%*`(state, admininstr*)
+
+;; 4-runtime.watsup:102.1-102.59
+def funcaddr : state -> funcaddr*
+  ;; 4-runtime.watsup:103.1-103.38
+  def {f : frame, s : store} funcaddr(`%;%`(s, f)) = f.MODULE_frame.FUNC_moduleinst
+
+;; 4-runtime.watsup:105.1-105.52
+def funcinst : state -> funcinst*
+  ;; 4-runtime.watsup:106.1-106.31
+  def {f : frame, s : store} funcinst(`%;%`(s, f)) = s.FUNC_store
+
+;; 4-runtime.watsup:108.1-108.67
+def func : (state, funcidx) -> funcinst
+  ;; 4-runtime.watsup:116.1-116.48
+  def {f : frame, s : store, x : idx} func(`%;%`(s, f), x) = s.FUNC_store[f.MODULE_frame.FUNC_moduleinst[x]]
+
+;; 4-runtime.watsup:109.1-109.69
+def global : (state, globalidx) -> globalinst
+  ;; 4-runtime.watsup:117.1-117.54
+  def {f : frame, s : store, x : idx} global(`%;%`(s, f), x) = s.GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]]
+
+;; 4-runtime.watsup:110.1-110.68
+def table : (state, tableidx) -> tableinst
+  ;; 4-runtime.watsup:118.1-118.51
+  def {f : frame, s : store, x : idx} table(`%;%`(s, f), x) = s.TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]]
+
+;; 4-runtime.watsup:111.1-111.66
+def mem : (state, memidx) -> meminst
+  ;; 4-runtime.watsup:119.1-119.45
+  def {f : frame, s : store, x : idx} mem(`%;%`(s, f), x) = s.MEM_store[f.MODULE_frame.MEM_moduleinst[x]]
+
+;; 4-runtime.watsup:112.1-112.67
+def elem : (state, tableidx) -> eleminst
+  ;; 4-runtime.watsup:120.1-120.48
+  def {f : frame, s : store, x : idx} elem(`%;%`(s, f), x) = s.ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]]
+
+;; 4-runtime.watsup:113.1-113.67
+def data : (state, dataidx) -> datainst
+  ;; 4-runtime.watsup:121.1-121.48
+  def {f : frame, s : store, x : idx} data(`%;%`(s, f), x) = s.DATA_store[f.MODULE_frame.DATA_moduleinst[x]]
+
+;; 4-runtime.watsup:114.1-114.68
+def local : (state, localidx) -> val
+  ;; 4-runtime.watsup:122.1-122.35
+  def {f : frame, s : store, x : idx} local(`%;%`(s, f), x) = f.LOCAL_frame[x]
+
+;; 4-runtime.watsup:125.1-125.78
+def with_local : (state, localidx, val) -> state
+  ;; 4-runtime.watsup:131.1-131.52
+  def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL[x] = v])
+
+;; 4-runtime.watsup:126.1-126.79
+def with_global : (state, globalidx, val) -> state
+  ;; 4-runtime.watsup:132.1-132.71
+  def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
+
+;; 4-runtime.watsup:127.1-127.81
+def with_table : (state, tableidx, n, ref) -> state
+  ;; 4-runtime.watsup:133.1-133.74
+  def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
+
+;; 4-runtime.watsup:128.1-128.80
+def with_tableext : (state, tableidx, ref*) -> state
+  ;; 4-runtime.watsup:134.1-134.75
+  def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
+
+;; 4-runtime.watsup:129.1-129.77
+def with_elem : (state, elemidx, ref*) -> state
+  ;; 4-runtime.watsup:135.1-135.69
+  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
+
+;; 4-runtime.watsup:149.1-152.21
+rec {
+
+;; 4-runtime.watsup:149.1-152.21
+syntax E =
+  | _HOLE
+  | _SEQ(val*, E, instr*)
+  | LABEL_(n, instr*, E)
+}
+
+;; 5-numerics.watsup:3.1-3.76
+def unop : (unop_numtype, numtype, c_numtype) -> c_numtype*
+
+;; 5-numerics.watsup:4.1-4.79
+def binop : (binop_numtype, numtype, c_numtype, c_numtype) -> c_numtype*
+
+;; 5-numerics.watsup:5.1-5.76
+def testop : (testop_numtype, numtype, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:6.1-6.79
+def relop : (relop_numtype, numtype, c_numtype, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:8.1-8.84
+def ext : (nat, nat, sx, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:9.1-9.84
+def cvtop : (numtype, cvtop, numtype, sx?, c_numtype) -> c_numtype*
+
+;; 6-reduction.watsup:4.1-4.63
+relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
+  ;; 6-reduction.watsup:16.1-17.24
+  rule unreachable:
+    `%*~>%*`([UNREACHABLE_admininstr], [TRAP_admininstr])
+
+  ;; 6-reduction.watsup:19.1-20.19
+  rule nop:
+    `%*~>%*`([NOP_admininstr], [])
+
+  ;; 6-reduction.watsup:22.1-23.24
+  rule drop {val : val}:
+    `%*~>%*`([(val <: admininstr) DROP_admininstr], [])
+
+  ;; 6-reduction.watsup:26.1-28.16
+  rule select-true {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
+    `%*~>%*`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [(val_1 <: admininstr)])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:30.1-32.14
+  rule select-false {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
+    `%*~>%*`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [(val_2 <: admininstr)])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:35.1-37.28
+  rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
+    `%*~>%*`((val <: admininstr)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
+
+  ;; 6-reduction.watsup:39.1-41.28
+  rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
+    `%*~>%*`((val <: admininstr)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [LOOP_instr(bt, instr*{instr})], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
+
+  ;; 6-reduction.watsup:43.1-45.16
+  rule if-true {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*{instr_1}, instr_2*{instr_2})], [BLOCK_admininstr(bt, instr_1*{instr_1})])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:47.1-49.14
+  rule if-false {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*{instr_1}, instr_2*{instr_2})], [BLOCK_admininstr(bt, instr_2*{instr_2})])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:52.1-53.38
+  rule label-vals {instr* : instr*, n : n, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr*{instr}, (val <: admininstr)*{val})], (val <: admininstr)*{val})
+
+  ;; 6-reduction.watsup:57.1-58.69
+  rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [BR_admininstr(0)] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val} :: (instr' <: admininstr)*{instr'})
+
+  ;; 6-reduction.watsup:60.1-61.65
+  rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val <: admininstr)*{val} :: [BR_admininstr(l + 1)] :: (instr <: admininstr)*{instr})], (val <: admininstr)*{val} :: [BR_admininstr(l)])
+
+  ;; 6-reduction.watsup:64.1-66.16
+  rule br_if-true {c : c_numtype, l : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)], [BR_admininstr(l)])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:68.1-70.14
+  rule br_if-false {c : c_numtype, l : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)], [])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:73.1-75.17
+  rule br_table-lt {i : nat, l* : labelidx*, l' : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')], [BR_admininstr(l*{l}[i])])
+    -- if (i < |l*{l}|)
+
+  ;; 6-reduction.watsup:77.1-79.18
+  rule br_table-ge {i : nat, l* : labelidx*, l' : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')], [BR_admininstr(l')])
+    -- if (i >= |l*{l}|)
+
+  ;; 6-reduction.watsup:100.1-101.35
+  rule frame-vals {f : frame, n : n, val^n : val^n}:
+    `%*~>%*`([FRAME__admininstr(n, f, (val <: admininstr)^n{val})], (val <: admininstr)^n{val})
+
+  ;; 6-reduction.watsup:103.1-104.55
+  rule return-frame {f : frame, instr* : instr*, n : n, val^n : val^n, val'* : val*}:
+    `%*~>%*`([FRAME__admininstr(n, f, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val})
+
+  ;; 6-reduction.watsup:106.1-107.60
+  rule return-label {instr* : instr*, instr'* : instr*, k : nat, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(k, instr'*{instr'}, (val <: admininstr)*{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)*{val} :: [RETURN_admininstr])
+
+  ;; 6-reduction.watsup:110.1-112.33
+  rule unop-val {c : c_numtype, c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)], [CONST_admininstr(nt, c)])
+    -- if ($unop(unop, nt, c_1) = [c])
+
+  ;; 6-reduction.watsup:114.1-116.39
+  rule unop-trap {c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)], [TRAP_admininstr])
+    -- if ($unop(unop, nt, c_1) = [])
+
+  ;; 6-reduction.watsup:119.1-121.40
+  rule binop-val {binop : binop_numtype, c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)], [CONST_admininstr(nt, c)])
+    -- if ($binop(binop, nt, c_1, c_2) = [c])
+
+  ;; 6-reduction.watsup:123.1-125.46
+  rule binop-trap {binop : binop_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)], [TRAP_admininstr])
+    -- if ($binop(binop, nt, c_1, c_2) = [])
+
+  ;; 6-reduction.watsup:128.1-130.37
+  rule testop {c : c_numtype, c_1 : c_numtype, nt : numtype, testop : testop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) TESTOP_admininstr(nt, testop)], [CONST_admininstr(I32_numtype, c)])
+    -- if (c = $testop(testop, nt, c_1))
+
+  ;; 6-reduction.watsup:132.1-134.40
+  rule relop {c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype, relop : relop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) RELOP_admininstr(nt, relop)], [CONST_admininstr(I32_numtype, c)])
+    -- if (c = $relop(relop, nt, c_1, c_2))
+
+  ;; 6-reduction.watsup:137.1-138.70
+  rule extend {c : c_numtype, n : n, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, $size(nt <: valtype), S_sx, c))])
+
+  ;; 6-reduction.watsup:141.1-143.48
+  rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CVTOP_admininstr(nt_1, cvtop, nt_2, sx?{sx})], [CONST_admininstr(nt, c)])
+    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [c])
+
+  ;; 6-reduction.watsup:145.1-147.54
+  rule cvtop-trap {c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CVTOP_admininstr(nt_1, cvtop, nt_2, sx?{sx})], [TRAP_admininstr])
+    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [])
+
+  ;; 6-reduction.watsup:154.1-156.28
+  rule ref.is_null-true {rt : reftype, val : val}:
+    `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
+    -- if (val = REF.NULL_val(rt))
+
+  ;; 6-reduction.watsup:158.1-160.15
+  rule ref.is_null-false {val : val}:
+    `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:169.1-170.47
+  rule local.tee {val : val, x : idx}:
+    `%*~>%*`([(val <: admininstr) LOCAL.TEE_admininstr(x)], [(val <: admininstr) (val <: admininstr) LOCAL.SET_admininstr(x)])
+
+;; 6-reduction.watsup:5.1-5.63
+relation Step_read: `%~>%*`(config, admininstr*)
+  ;; 6-reduction.watsup:82.1-83.47
+  rule call {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CALL_admininstr(x)]), [CALL_ADDR_admininstr($funcaddr(z)[x])])
+
+  ;; 6-reduction.watsup:85.1-88.34
+  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [CALL_ADDR_admininstr(a)])
+    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
+    -- if ($funcinst(z)[a] = `%;%`(m, func))
+
+  ;; 6-reduction.watsup:90.1-92.15
+  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [TRAP_admininstr])
+    -- otherwise
+
+  ;; 6-reduction.watsup:94.1-97.52
+  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
+    `%~>%*`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], (instr <: admininstr)*{instr})])])
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
+    -- if (f = {LOCAL val^k{val} :: $default_(t)*{t}, MODULE m})
+
+  ;; 6-reduction.watsup:150.1-151.53
+  rule ref.func {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [REF.FUNC_admininstr(x)]), [REF.FUNC_ADDR_admininstr($funcaddr(z)[x])])
+
+  ;; 6-reduction.watsup:163.1-164.37
+  rule local.get {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [LOCAL.GET_admininstr(x)]), [($local(z, x) <: admininstr)])
+
+  ;; 6-reduction.watsup:173.1-174.39
+  rule global.get {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]), [($global(z, x) <: admininstr)])
+
+  ;; 6-reduction.watsup:180.1-182.28
+  rule table.get-trap {i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:184.1-186.27
+  rule table.get-val {i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [($table(z, x)[i] <: admininstr)])
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:188.1-190.28
+  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:197.1-199.27
+  rule table.size {n : n, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]), [CONST_admininstr(I32_numtype, n)])
+    -- if (|$table(z, x)| = n)
+
+  ;; 6-reduction.watsup:205.1-206.57
+  rule table.grow-fail {n : n, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), [CONST_admininstr(I32_numtype, - 1)])
+
+  ;; 6-reduction.watsup:209.1-211.34
+  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
+    -- if ((i + n) > |$table(z, x)|)
+
+  ;; 6-reduction.watsup:213.1-216.14
+  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:218.1-222.15
+  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) (val <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) (val <: admininstr) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:225.1-227.63
+  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [TRAP_admininstr])
+    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:229.1-232.14
+  rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:234.1-239.15
+  rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
+    -- otherwise
+    -- if (j <= i)
+
+  ;; 6-reduction.watsup:241.1-245.15
+  rule table.copy-gt {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, ((j + n) - 1)) CONST_admininstr(I32_numtype, ((i + n) - 1)) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:248.1-250.62
+  rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [TRAP_admininstr])
+    -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:252.1-255.14
+  rule table.init-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:257.1-261.15
+  rule table.init-succ {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) ($elem(z, y)[i] <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
+    -- otherwise
+
+;; 6-reduction.watsup:3.1-3.63
+relation Step: `%~>%`(config, config)
+  ;; 6-reduction.watsup:7.1-9.34
+  rule pure {instr* : instr*, instr'* : instr*, z : state}:
+    `%~>%`(`%;%*`(z, (instr <: admininstr)*{instr}), `%;%*`(z, (instr' <: admininstr)*{instr'}))
+    -- Step_pure: `%*~>%*`((instr <: admininstr)*{instr}, (instr' <: admininstr)*{instr'})
+
+  ;; 6-reduction.watsup:11.1-13.37
+  rule read {instr* : instr*, instr'* : instr*, z : state}:
+    `%~>%`(`%;%*`(z, (instr <: admininstr)*{instr}), `%;%*`(z, (instr' <: admininstr)*{instr'}))
+    -- Step_read: `%~>%*`(`%;%*`(z, (instr <: admininstr)*{instr}), (instr' <: admininstr)*{instr'})
+
+  ;; 6-reduction.watsup:166.1-167.60
+  rule local.set {val : val, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [(val <: admininstr) LOCAL.SET_admininstr(x)]), `%;%*`($with_local(z, x, val), []))
+
+  ;; 6-reduction.watsup:176.1-177.62
+  rule global.set {val : val, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [(val <: admininstr) GLOBAL.SET_admininstr(x)]), `%;%*`($with_global(z, x, val), []))
+
+  ;; 6-reduction.watsup:192.1-194.27
+  rule table.set-val {i : nat, ref : ref, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), `%;%*`($with_table(z, x, i, ref), []))
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:202.1-203.102
+  rule table.grow-succeed {n : n, ref : ref, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [(ref <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), `%;%*`($with_tableext(z, x, ref^n{}), [CONST_admininstr(I32_numtype, |$table(z, x)|)]))
+
+  ;; 6-reduction.watsup:264.1-265.59
+  rule elem.drop {x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [ELEM.DROP_admininstr(x)]), `%;%*`($with_elem(z, x, []), []))
+
+== IL Validation...
+== Variant flattening...
+== Printing...
+
+;; 1-syntax.watsup:3.1-3.15
+syntax n = nat
+
+;; 1-syntax.watsup:9.1-9.37
+syntax name = text
+
+;; 1-syntax.watsup:14.1-14.36
+syntax byte = nat
+
+;; 1-syntax.watsup:15.1-15.45
+syntax u32 = nat
+
+;; 1-syntax.watsup:22.1-22.36
+syntax idx = nat
+
+;; 1-syntax.watsup:23.1-23.49
+syntax funcidx = idx
+
+;; 1-syntax.watsup:24.1-24.49
+syntax globalidx = idx
+
+;; 1-syntax.watsup:25.1-25.47
+syntax tableidx = idx
+
+;; 1-syntax.watsup:26.1-26.46
+syntax memidx = idx
+
+;; 1-syntax.watsup:27.1-27.45
+syntax elemidx = idx
+
+;; 1-syntax.watsup:28.1-28.45
+syntax dataidx = idx
+
+;; 1-syntax.watsup:29.1-29.47
+syntax labelidx = idx
+
+;; 1-syntax.watsup:30.1-30.47
+syntax localidx = idx
+
+;; 1-syntax.watsup:39.1-40.22
+syntax numtype =
+  | I32
+  | I64
+  | F32
+  | F64
+
+;; 1-syntax.watsup:41.1-42.5
+syntax vectype =
+  | V128
+
+;; 1-syntax.watsup:43.1-44.20
+syntax reftype =
+  | FUNCREF
+  | EXTERNREF
+
+;; 1-syntax.watsup:45.1-46.34
+syntax valtype =
+  | I32
+  | I64
+  | F32
+  | F64
+  | V128
+  | FUNCREF
+  | EXTERNREF
+  | BOT
+
+;; 1-syntax.watsup:48.1-48.71
+syntax in =
+  | I32
+  | I64
+
+;; 1-syntax.watsup:49.1-49.71
+syntax fn =
+  | F32
+  | F64
+
+;; 1-syntax.watsup:56.1-57.11
+syntax resulttype = valtype*
+
+;; 1-syntax.watsup:59.1-60.16
+syntax limits = `[%..%]`(u32, u32)
+
+;; 1-syntax.watsup:61.1-62.6
+syntax mutflag = MUT
+
+;; 1-syntax.watsup:63.1-64.19
+syntax globaltype = `%?%`(mutflag?, valtype)
+
+;; 1-syntax.watsup:65.1-66.27
+syntax functype = `%->%`(resulttype, resulttype)
+
+;; 1-syntax.watsup:67.1-68.17
+syntax tabletype = `%%`(limits, reftype)
+
+;; 1-syntax.watsup:69.1-70.12
+syntax memtype = `%I8`(limits)
+
+;; 1-syntax.watsup:71.1-72.10
+syntax elemtype = reftype
+
+;; 1-syntax.watsup:73.1-74.5
+syntax datatype = OK
+
+;; 1-syntax.watsup:75.1-76.69
+syntax externtype =
+  | GLOBAL(globaltype)
+  | FUNC(functype)
+  | TABLE(tabletype)
+  | MEMORY(memtype)
+
+;; 1-syntax.watsup:89.1-89.44
+syntax sx =
+  | U
+  | S
+
+;; 1-syntax.watsup:91.1-91.39
+syntax unop_IXX =
+  | CLZ
+  | CTZ
+  | POPCNT
+
+;; 1-syntax.watsup:92.1-92.70
+syntax unop_FXX =
+  | ABS
+  | NEG
+  | SQRT
+  | CEIL
+  | FLOOR
+  | TRUNC
+  | NEAREST
+
+;; 1-syntax.watsup:94.1-96.62
+syntax binop_IXX =
+  | ADD
+  | SUB
+  | MUL
+  | DIV(sx)
+  | REM(sx)
+  | AND
+  | OR
+  | XOR
+  | SHL
+  | SHR(sx)
+  | ROTL
+  | ROTR
+
+;; 1-syntax.watsup:97.1-97.66
+syntax binop_FXX =
+  | ADD
+  | SUB
+  | MUL
+  | DIV
+  | MIN
+  | MAX
+  | COPYSIGN
+
+;; 1-syntax.watsup:99.1-99.26
+syntax testop_IXX =
+  | EQZ
+
+;; 1-syntax.watsup:100.1-100.22
+syntax testop_FXX =
+  |
+
+;; 1-syntax.watsup:102.1-103.108
+syntax relop_IXX =
+  | EQ
+  | NE
+  | LT(sx)
+  | GT(sx)
+  | LE(sx)
+  | GE(sx)
+
+;; 1-syntax.watsup:104.1-104.49
+syntax relop_FXX =
+  | EQ
+  | NE
+  | LT
+  | GT
+  | LE
+  | GE
+
+;; 1-syntax.watsup:106.1-106.50
+syntax unop_numtype =
+  | _I(unop_IXX)
+  | _F(unop_FXX)
+
+;; 1-syntax.watsup:107.1-107.53
+syntax binop_numtype =
+  | _I(binop_IXX)
+  | _F(binop_FXX)
+
+;; 1-syntax.watsup:108.1-108.56
+syntax testop_numtype =
+  | _I(testop_IXX)
+  | _F(testop_FXX)
+
+;; 1-syntax.watsup:109.1-109.53
+syntax relop_numtype =
+  | _I(relop_IXX)
+  | _F(relop_FXX)
+
+;; 1-syntax.watsup:110.1-110.39
+syntax cvtop =
+  | CONVERT
+  | REINTERPRET
+
+;; 1-syntax.watsup:120.1-120.23
+syntax c_numtype = nat
+
+;; 1-syntax.watsup:121.1-121.23
+syntax c_vectype = nat
+
+;; 1-syntax.watsup:124.1-124.52
+syntax blocktype = functype
+
+;; 1-syntax.watsup:159.1-180.55
+rec {
+
+;; 1-syntax.watsup:159.1-180.55
+syntax instr =
+  | UNREACHABLE
+  | NOP
+  | DROP
+  | SELECT(valtype?)
+  | BLOCK(blocktype, instr*)
+  | LOOP(blocktype, instr*)
+  | IF(blocktype, instr*, instr*)
+  | BR(labelidx)
+  | BR_IF(labelidx)
+  | BR_TABLE(labelidx*, labelidx)
+  | CALL(funcidx)
+  | CALL_INDIRECT(tableidx, functype)
+  | RETURN
+  | CONST(numtype, c_numtype)
+  | UNOP(numtype, unop_numtype)
+  | BINOP(numtype, binop_numtype)
+  | TESTOP(numtype, testop_numtype)
+  | RELOP(numtype, relop_numtype)
+  | EXTEND(numtype, n)
+  | CVTOP(numtype, cvtop, numtype, sx?)
+  | REF.NULL(reftype)
+  | REF.FUNC(funcidx)
+  | REF.IS_NULL
+  | LOCAL.GET(localidx)
+  | LOCAL.SET(localidx)
+  | LOCAL.TEE(localidx)
+  | GLOBAL.GET(globalidx)
+  | GLOBAL.SET(globalidx)
+  | TABLE.GET(tableidx)
+  | TABLE.SET(tableidx)
+  | TABLE.SIZE(tableidx)
+  | TABLE.GROW(tableidx)
+  | TABLE.FILL(tableidx)
+  | TABLE.COPY(tableidx, tableidx)
+  | TABLE.INIT(tableidx, elemidx)
+  | ELEM.DROP(elemidx)
+  | MEMORY.SIZE
+  | MEMORY.GROW
+  | MEMORY.FILL
+  | MEMORY.COPY
+  | MEMORY.INIT(dataidx)
+  | DATA.DROP(dataidx)
+  | LOAD(numtype, (n, sx)?, nat, nat)
+  | STORE(numtype, n?, nat, nat)
+}
+
+;; 1-syntax.watsup:182.1-183.9
+syntax expr = instr*
+
+;; 1-syntax.watsup:188.1-188.50
+syntax elemmode =
+  | TABLE(tableidx, expr)
+  | DECLARE
+
+;; 1-syntax.watsup:189.1-189.39
+syntax datamode =
+  | MEMORY(memidx, expr)
+
+;; 1-syntax.watsup:191.1-192.30
+syntax func = `FUNC%%*%`(functype, valtype*, expr)
+
+;; 1-syntax.watsup:193.1-194.25
+syntax global = GLOBAL(globaltype, expr)
+
+;; 1-syntax.watsup:195.1-196.18
+syntax table = TABLE(tabletype)
+
+;; 1-syntax.watsup:197.1-198.17
+syntax mem = MEMORY(memtype)
+
+;; 1-syntax.watsup:199.1-200.31
+syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
+
+;; 1-syntax.watsup:201.1-202.26
+syntax data = `DATA(*)%*%?`(byte**, datamode?)
+
+;; 1-syntax.watsup:203.1-204.16
+syntax start = START(funcidx)
+
+;; 1-syntax.watsup:206.1-207.65
+syntax externuse =
+  | FUNC(funcidx)
+  | GLOBAL(globalidx)
+  | TABLE(tableidx)
+  | MEMORY(memidx)
+
+;; 1-syntax.watsup:208.1-209.24
+syntax export = EXPORT(name, externuse)
+
+;; 1-syntax.watsup:210.1-211.30
+syntax import = IMPORT(name, name, externtype)
+
+;; 1-syntax.watsup:213.1-214.70
+syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
+
+;; 2-aux.watsup:5.1-5.55
+def size : valtype -> nat
+  ;; 2-aux.watsup:6.1-6.20
+  def size(I32_valtype) = 32
+  ;; 2-aux.watsup:7.1-7.20
+  def size(I64_valtype) = 64
+  ;; 2-aux.watsup:8.1-8.20
+  def size(F32_valtype) = 32
+  ;; 2-aux.watsup:9.1-9.20
+  def size(F64_valtype) = 64
+  ;; 2-aux.watsup:10.1-10.22
+  def size(V128_valtype) = 128
+
+;; 2-aux.watsup:15.1-15.40
+def test_sub_ATOM_22 : n -> nat
+  ;; 2-aux.watsup:16.1-16.38
+  def {n_3_ATOM_y : n} test_sub_ATOM_22(n_3_ATOM_y) = 0
+
+;; 2-aux.watsup:18.1-18.26
+def curried_ : (n, n) -> nat
+  ;; 2-aux.watsup:19.1-19.39
+  def {n_1 : n, n_2 : n} curried_(n_1, n_2) = (n_1 + n_2)
+
+;; 2-aux.watsup:21.1-30.39
+syntax testfuse =
+  | AB_(nat, nat, nat)
+  | CD(nat, nat, nat)
+  | EF(nat, nat, nat)
+  | GH(nat, nat, nat)
+  | IJ(nat, nat, nat)
+  | KL(nat, nat, nat)
+  | MN(nat, nat, nat)
+  | OP(nat, nat, nat)
+  | QR(nat, nat, nat)
+
+;; 3-typing.watsup:3.1-6.60
+syntax context = {FUNC functype*, GLOBAL globaltype*, TABLE tabletype*, MEM memtype*, ELEM elemtype*, DATA datatype*, LOCAL valtype*, LABEL resulttype*, RETURN resulttype?}
+
+;; 3-typing.watsup:14.1-14.66
+relation Limits_ok: `|-%:%`(limits, nat)
+  ;; 3-typing.watsup:22.1-24.24
+  rule _ {k : nat, n_1 : n, n_2 : n}:
+    `|-%:%`(`[%..%]`(n_1, n_2), k)
+    -- if ((n_1 <= n_2) /\ (n_2 <= k))
+
+;; 3-typing.watsup:15.1-15.64
+relation Functype_ok: `|-%:OK`(functype)
+  ;; 3-typing.watsup:26.1-27.13
+  rule _ {ft : functype}:
+    `|-%:OK`(ft)
+
+;; 3-typing.watsup:16.1-16.66
+relation Globaltype_ok: `|-%:OK`(globaltype)
+  ;; 3-typing.watsup:29.1-30.13
+  rule _ {gt : globaltype}:
+    `|-%:OK`(gt)
+
+;; 3-typing.watsup:17.1-17.65
+relation Tabletype_ok: `|-%:OK`(tabletype)
+  ;; 3-typing.watsup:32.1-34.35
+  rule _ {lim : limits, rt : reftype}:
+    `|-%:OK`(`%%`(lim, rt))
+    -- Limits_ok: `|-%:%`(lim, ((2 ^ 32) - 1))
+
+;; 3-typing.watsup:18.1-18.63
+relation Memtype_ok: `|-%:OK`(memtype)
+  ;; 3-typing.watsup:36.1-38.33
+  rule _ {lim : limits}:
+    `|-%:OK`(`%I8`(lim))
+    -- Limits_ok: `|-%:%`(lim, (2 ^ 16))
+
+;; 3-typing.watsup:19.1-19.66
+relation Externtype_ok: `|-%:OK`(externtype)
+  ;; 3-typing.watsup:41.1-43.35
+  rule func {functype : functype}:
+    `|-%:OK`(FUNC_externtype(functype))
+    -- Functype_ok: `|-%:OK`(functype)
+
+  ;; 3-typing.watsup:45.1-47.39
+  rule global {globaltype : globaltype}:
+    `|-%:OK`(GLOBAL_externtype(globaltype))
+    -- Globaltype_ok: `|-%:OK`(globaltype)
+
+  ;; 3-typing.watsup:49.1-51.37
+  rule table {tabletype : tabletype}:
+    `|-%:OK`(TABLE_externtype(tabletype))
+    -- Tabletype_ok: `|-%:OK`(tabletype)
+
+  ;; 3-typing.watsup:53.1-55.33
+  rule mem {memtype : memtype}:
+    `|-%:OK`(MEMORY_externtype(memtype))
+    -- Memtype_ok: `|-%:OK`(memtype)
+
+;; 3-typing.watsup:61.1-61.65
+relation Valtype_sub: `|-%<:%`(valtype, valtype)
+  ;; 3-typing.watsup:64.1-65.12
+  rule refl {t : valtype}:
+    `|-%<:%`(t, t)
+
+  ;; 3-typing.watsup:67.1-68.14
+  rule bot {t : valtype}:
+    `|-%<:%`(BOT_valtype, t)
+
+;; 3-typing.watsup:62.1-62.72
+relation Resulttype_sub: `|-%*<:%*`(valtype*, valtype*)
+  ;; 3-typing.watsup:70.1-72.35
+  rule _ {t_1* : valtype*, t_2* : valtype*}:
+    `|-%*<:%*`(t_1*{t_1}, t_2*{t_2})
+    -- (Valtype_sub: `|-%<:%`(t_1, t_2))*{t_1 t_2}
+
+;; 3-typing.watsup:75.1-75.75
+relation Limits_sub: `|-%<:%`(limits, limits)
+  ;; 3-typing.watsup:83.1-86.21
+  rule _ {n_11 : n, n_12 : n, n_21 : n, n_22 : n}:
+    `|-%<:%`(`[%..%]`(n_11, n_12), `[%..%]`(n_21, n_22))
+    -- if (n_11 >= n_21)
+    -- if (n_12 <= n_22)
+
+;; 3-typing.watsup:76.1-76.73
+relation Functype_sub: `|-%<:%`(functype, functype)
+  ;; 3-typing.watsup:88.1-89.14
+  rule _ {ft : functype}:
+    `|-%<:%`(ft, ft)
+
+;; 3-typing.watsup:77.1-77.75
+relation Globaltype_sub: `|-%<:%`(globaltype, globaltype)
+  ;; 3-typing.watsup:91.1-92.14
+  rule _ {gt : globaltype}:
+    `|-%<:%`(gt, gt)
+
+;; 3-typing.watsup:78.1-78.74
+relation Tabletype_sub: `|-%<:%`(tabletype, tabletype)
+  ;; 3-typing.watsup:94.1-96.35
+  rule _ {lim_1 : limits, lim_2 : limits, rt : reftype}:
+    `|-%<:%`(`%%`(lim_1, rt), `%%`(lim_2, rt))
+    -- Limits_sub: `|-%<:%`(lim_1, lim_2)
+
+;; 3-typing.watsup:79.1-79.72
+relation Memtype_sub: `|-%<:%`(memtype, memtype)
+  ;; 3-typing.watsup:98.1-100.35
+  rule _ {lim_1 : limits, lim_2 : limits}:
+    `|-%<:%`(`%I8`(lim_1), `%I8`(lim_2))
+    -- Limits_sub: `|-%<:%`(lim_1, lim_2)
+
+;; 3-typing.watsup:80.1-80.75
+relation Externtype_sub: `|-%<:%`(externtype, externtype)
+  ;; 3-typing.watsup:103.1-105.35
+  rule func {ft_1 : functype, ft_2 : functype}:
+    `|-%<:%`(FUNC_externtype(ft_1), FUNC_externtype(ft_2))
+    -- Functype_sub: `|-%<:%`(ft_1, ft_2)
+
+  ;; 3-typing.watsup:107.1-109.37
+  rule global {gt_1 : globaltype, gt_2 : globaltype}:
+    `|-%<:%`(GLOBAL_externtype(gt_1), GLOBAL_externtype(gt_2))
+    -- Globaltype_sub: `|-%<:%`(gt_1, gt_2)
+
+  ;; 3-typing.watsup:111.1-113.36
+  rule table {tt_1 : tabletype, tt_2 : tabletype}:
+    `|-%<:%`(TABLE_externtype(tt_1), TABLE_externtype(tt_2))
+    -- Tabletype_sub: `|-%<:%`(tt_1, tt_2)
+
+  ;; 3-typing.watsup:115.1-117.34
+  rule mem {mt_1 : memtype, mt_2 : memtype}:
+    `|-%<:%`(MEMORY_externtype(mt_1), MEMORY_externtype(mt_2))
+    -- Memtype_sub: `|-%<:%`(mt_1, mt_2)
+
+;; 3-typing.watsup:172.1-172.76
+relation Blocktype_ok: `%|-%:%`(context, blocktype, functype)
+  ;; 3-typing.watsup:174.1-176.29
+  rule _ {C : context, ft : functype}:
+    `%|-%:%`(C, ft, ft)
+    -- Functype_ok: `|-%:OK`(ft)
+
+;; 3-typing.watsup:123.1-124.67
+rec {
+
+;; 3-typing.watsup:123.1-123.66
+relation Instr_ok: `%|-%:%`(context, instr, functype)
+  ;; 3-typing.watsup:153.1-154.34
+  rule unreachable {C : context, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, UNREACHABLE_instr, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:156.1-157.32
+  rule nop {C : context}:
+    `%|-%:%`(C, NOP_instr, `%->%`([], []))
+
+  ;; 3-typing.watsup:159.1-160.27
+  rule drop {C : context, t : valtype}:
+    `%|-%:%`(C, DROP_instr, `%->%`([t], []))
+
+  ;; 3-typing.watsup:163.1-164.31
+  rule select-expl {C : context, t : valtype}:
+    `%|-%:%`(C, SELECT_instr(?(t)), `%->%`([t t I32_valtype], [t]))
+
+  ;; 3-typing.watsup:166.1-169.37
+  rule select-impl {C : context, numtype : numtype, t : valtype, t' : valtype, vectype : vectype}:
+    `%|-%:%`(C, SELECT_instr(?()), `%->%`([t t I32_valtype], [t]))
+    -- Valtype_sub: `|-%<:%`(t, t')
+    -- if ((t' = (numtype <: valtype)) \/ (t' = (vectype <: valtype)))
+
+  ;; 3-typing.watsup:178.1-181.57
+  rule block {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BLOCK_instr(bt, instr*{instr}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:183.1-186.57
+  rule loop {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, LOOP_instr(bt, instr*{instr}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_1]*{t_1}, RETURN ?()}, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:188.1-192.59
+  rule if {C : context, bt : blocktype, instr_1* : instr*, instr_2* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, IF_instr(bt, instr_1*{instr_1}, instr_2*{instr_2}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr_1*{instr_1}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr_2*{instr_2}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:195.1-197.24
+  rule br {C : context, l : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BR_instr(l), `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- if (l < |C.LABEL_context|)
+    -- if (C.LABEL_context[l] = t*{t})
+
+  ;; 3-typing.watsup:199.1-201.24
+  rule br_if {C : context, l : labelidx, t* : valtype*}:
+    `%|-%:%`(C, BR_IF_instr(l), `%->%`(t*{t} :: [I32_valtype], t*{t}))
+    -- if (l < |C.LABEL_context|)
+    -- if (C.LABEL_context[l] = t*{t})
+
+  ;; 3-typing.watsup:203.1-206.42
+  rule br_table {C : context, l* : labelidx*, l' : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BR_TABLE_instr(l*{l}, l'), `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- (if (l < |C.LABEL_context|))*{l}
+    -- if (l' < |C.LABEL_context|)
+    -- (Resulttype_sub: `|-%*<:%*`(t*{t}, C.LABEL_context[l]))*{l}
+    -- Resulttype_sub: `|-%*<:%*`(t*{t}, C.LABEL_context[l'])
+
+  ;; 3-typing.watsup:208.1-210.24
+  rule return {C : context, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, RETURN_instr, `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- if (C.RETURN_context = ?(t*{t}))
+
+  ;; 3-typing.watsup:212.1-214.33
+  rule call {C : context, t_1* : valtype*, t_2* : valtype*, x : idx}:
+    `%|-%:%`(C, CALL_instr(x), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- if (x < |C.FUNC_context|)
+    -- if (C.FUNC_context[x] = `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:216.1-219.26
+  rule call_indirect {C : context, ft : functype, lim : limits, t_1* : valtype*, t_2* : valtype*, x : idx}:
+    `%|-%:%`(C, CALL_INDIRECT_instr(x, ft), `%->%`(t_1*{t_1} :: [I32_valtype], t_2*{t_2}))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = `%%`(lim, FUNCREF_reftype))
+    -- if (ft = `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:222.1-223.37
+  rule const {C : context, c_nt : c_numtype, nt : numtype}:
+    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [(nt <: valtype)]))
+
+  ;; 3-typing.watsup:225.1-226.31
+  rule unop {C : context, nt : numtype, unop : unop_numtype}:
+    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
+
+  ;; 3-typing.watsup:228.1-229.36
+  rule binop {C : context, binop : binop_numtype, nt : numtype}:
+    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([(nt <: valtype) (nt <: valtype)], [(nt <: valtype)]))
+
+  ;; 3-typing.watsup:231.1-232.36
+  rule testop {C : context, nt : numtype, testop : testop_numtype}:
+    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([(nt <: valtype)], [I32_valtype]))
+
+  ;; 3-typing.watsup:234.1-235.37
+  rule relop {C : context, nt : numtype, relop : relop_numtype}:
+    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([(nt <: valtype) (nt <: valtype)], [I32_valtype]))
+
+  ;; 3-typing.watsup:238.1-240.23
+  rule extend {C : context, n : n, nt : numtype}:
+    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
+    -- if (n <= $size(nt <: valtype))
+
+  ;; 3-typing.watsup:242.1-245.34
+  rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype}:
+    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([(nt_2 <: valtype)], [(nt_1 <: valtype)]))
+    -- if (nt_1 =/= nt_2)
+    -- if ($size(nt_1 <: valtype) = $size(nt_2 <: valtype))
+
+  ;; 3-typing.watsup:247.1-250.52
+  rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?}:
+    `%|-%:%`(C, CVTOP_instr((in_1 <: numtype), CONVERT_cvtop, (in_2 <: numtype), sx?{sx}), `%->%`([(in_2 <: valtype)], [(in_1 <: valtype)]))
+    -- if (in_1 =/= in_2)
+    -- if ((sx?{sx} = ?()) <=> ($size(in_1 <: valtype) > $size(in_2 <: valtype)))
+
+  ;; 3-typing.watsup:252.1-254.22
+  rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
+    `%|-%:%`(C, CVTOP_instr((fn_1 <: numtype), CONVERT_cvtop, (fn_2 <: numtype), ?()), `%->%`([(fn_2 <: valtype)], [(fn_1 <: valtype)]))
+    -- if (fn_1 =/= fn_2)
+
+  ;; 3-typing.watsup:257.1-258.35
+  rule ref.null {C : context, rt : reftype}:
+    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [(rt <: valtype)]))
+
+  ;; 3-typing.watsup:260.1-262.23
+  rule ref.func {C : context, ft : functype, x : idx}:
+    `%|-%:%`(C, REF.FUNC_instr(x), `%->%`([], [FUNCREF_valtype]))
+    -- if (x < |C.FUNC_context|)
+    -- if (C.FUNC_context[x] = ft)
+
+  ;; 3-typing.watsup:264.1-265.31
+  rule ref.is_null {C : context, rt : reftype}:
+    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([(rt <: valtype)], [I32_valtype]))
+
+  ;; 3-typing.watsup:268.1-270.23
+  rule local.get {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.GET_instr(x), `%->%`([], [t]))
+    -- if (x < |C.LOCAL_context|)
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:272.1-274.23
+  rule local.set {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.SET_instr(x), `%->%`([t], []))
+    -- if (x < |C.LOCAL_context|)
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:276.1-278.23
+  rule local.tee {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.TEE_instr(x), `%->%`([t], [t]))
+    -- if (x < |C.LOCAL_context|)
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:281.1-283.29
+  rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
+    `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
+    -- if (x < |C.GLOBAL_context|)
+    -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
+
+  ;; 3-typing.watsup:285.1-287.28
+  rule global.set {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
+    -- if (x < |C.GLOBAL_context|)
+    -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
+
+  ;; 3-typing.watsup:290.1-292.28
+  rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [(rt <: valtype)]))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:294.1-296.28
+  rule table.set {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype (rt <: valtype)], []))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:298.1-300.24
+  rule table.size {C : context, tt : tabletype, x : idx}:
+    `%|-%:%`(C, TABLE.SIZE_instr(x), `%->%`([], [I32_valtype]))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = tt)
+
+  ;; 3-typing.watsup:302.1-304.28
+  rule table.grow {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([(rt <: valtype) I32_valtype], [I32_valtype]))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:306.1-308.28
+  rule table.fill {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype (rt <: valtype) I32_valtype], []))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:310.1-313.32
+  rule table.copy {C : context, lim_1 : limits, lim_2 : limits, rt : reftype, x_1 : idx, x_2 : idx}:
+    `%|-%:%`(C, TABLE.COPY_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (x_1 < |C.TABLE_context|)
+    -- if (x_2 < |C.TABLE_context|)
+    -- if (C.TABLE_context[x_1] = `%%`(lim_1, rt))
+    -- if (C.TABLE_context[x_2] = `%%`(lim_2, rt))
+
+  ;; 3-typing.watsup:315.1-318.25
+  rule table.init {C : context, lim : limits, rt : reftype, x_1 : idx, x_2 : idx}:
+    `%|-%:%`(C, TABLE.INIT_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (x_1 < |C.TABLE_context|)
+    -- if (x_2 < |C.ELEM_context|)
+    -- if (C.TABLE_context[x_1] = `%%`(lim, rt))
+    -- if (C.ELEM_context[x_2] = rt)
+
+  ;; 3-typing.watsup:320.1-322.23
+  rule elem.drop {C : context, rt : reftype, x : idx}:
+    `%|-%:%`(C, ELEM.DROP_instr(x), `%->%`([], []))
+    -- if (x < |C.ELEM_context|)
+    -- if (C.ELEM_context[x] = rt)
+
+  ;; 3-typing.watsup:325.1-327.22
+  rule memory.size {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.SIZE_instr, `%->%`([], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:329.1-331.22
+  rule memory.grow {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.GROW_instr, `%->%`([I32_valtype], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:333.1-335.22
+  rule memory.fill {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.FILL_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:337.1-339.22
+  rule memory.copy {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.COPY_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:341.1-344.23
+  rule memory.init {C : context, mt : memtype, x : idx}:
+    `%|-%:%`(C, MEMORY.INIT_instr(x), `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
+    -- if (x < |C.DATA_context|)
+    -- if (C.MEM_context[0] = mt)
+    -- if (C.DATA_context[x] = OK)
+
+  ;; 3-typing.watsup:346.1-348.23
+  rule data.drop {C : context, x : idx}:
+    `%|-%:%`(C, DATA.DROP_instr(x), `%->%`([], []))
+    -- if (x < |C.DATA_context|)
+    -- if (C.DATA_context[x] = OK)
+
+  ;; 3-typing.watsup:350.1-355.32
+  rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?}:
+    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
+    -- if (0 < |C.MEM_context|)
+    -- if (C.MEM_context[0] = mt)
+    -- if ((2 ^ n_A) <= ($size(nt <: valtype) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(nt <: valtype) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = (in <: numtype)))
+
+  ;; 3-typing.watsup:357.1-362.32
+  rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype}:
+    `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype (nt <: valtype)], []))
+    -- if (0 < |C.MEM_context|)
+    -- if (C.MEM_context[0] = mt)
+    -- if ((2 ^ n_A) <= ($size(nt <: valtype) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(nt <: valtype) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = (in <: numtype)))
+
+;; 3-typing.watsup:124.1-124.67
+relation InstrSeq_ok: `%|-%*:%`(context, instr*, functype)
+  ;; 3-typing.watsup:133.1-134.36
+  rule empty {C : context}:
+    `%|-%*:%`(C, [], `%->%`([], []))
+
+  ;; 3-typing.watsup:136.1-139.46
+  rule seq {C : context, instr_1 : instr, instr_2 : instr, t_1* : valtype*, t_2* : valtype*, t_3* : valtype*}:
+    `%|-%*:%`(C, [instr_1] :: instr_2*{}, `%->%`(t_1*{t_1}, t_3*{t_3}))
+    -- Instr_ok: `%|-%:%`(C, instr_1, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, [instr_2], `%->%`(t_2*{t_2}, t_3*{t_3}))
+
+  ;; 3-typing.watsup:141.1-146.38
+  rule weak {C : context, instr* : instr*, t'_1 : valtype, t'_2* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%*:%`(C, instr*{instr}, `%->%`([t'_1], t'_2*{t'_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Resulttype_sub: `|-%*<:%*`(t'_1*{}, t_1*{t_1})
+    -- Resulttype_sub: `|-%*<:%*`(t_2*{t_2}, t'_2*{t'_2})
+
+  ;; 3-typing.watsup:148.1-150.45
+  rule frame {C : context, instr* : instr*, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%*:%`(C, instr*{instr}, `%->%`(t*{t} :: t_1*{t_1}, t*{t} :: t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+}
+
+;; 3-typing.watsup:125.1-125.71
+relation Expr_ok: `%|-%:%`(context, expr, resulttype)
+  ;; 3-typing.watsup:128.1-130.46
+  rule _ {C : context, instr* : instr*, t* : valtype*}:
+    `%|-%:%`(C, instr*{instr}, t*{t})
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`([], t*{t}))
+
+;; 3-typing.watsup:367.1-367.78
+relation Instr_const: `%|-%CONST`(context, instr)
+  ;; 3-typing.watsup:371.1-372.26
+  rule const {C : context, c : c_numtype, nt : numtype}:
+    `%|-%CONST`(C, CONST_instr(nt, c))
+
+  ;; 3-typing.watsup:374.1-375.27
+  rule ref.null {C : context, rt : reftype}:
+    `%|-%CONST`(C, REF.NULL_instr(rt))
+
+  ;; 3-typing.watsup:377.1-378.26
+  rule ref.func {C : context, x : idx}:
+    `%|-%CONST`(C, REF.FUNC_instr(x))
+
+  ;; 3-typing.watsup:380.1-382.32
+  rule global.get {C : context, t : valtype, x : idx}:
+    `%|-%CONST`(C, GLOBAL.GET_instr(x))
+    -- if (x < |C.GLOBAL_context|)
+    -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
+
+;; 3-typing.watsup:368.1-368.77
+relation Expr_const: `%|-%CONST`(context, expr)
+  ;; 3-typing.watsup:385.1-386.38
+  rule _ {C : context, instr* : instr*}:
+    `%|-%CONST`(C, instr*{instr})
+    -- (Instr_const: `%|-%CONST`(C, instr))*{instr}
+
+;; 3-typing.watsup:369.1-369.78
+relation Expr_ok_const: `%|-%:%CONST`(context, expr, valtype)
+  ;; 3-typing.watsup:389.1-392.33
+  rule _ {C : context, expr : expr, t : valtype}:
+    `%|-%:%CONST`(C, expr, t)
+    -- Expr_ok: `%|-%:%`(C, expr, [t])
+    -- Expr_const: `%|-%CONST`(C, expr)
+
+;; 3-typing.watsup:397.1-397.73
+relation Func_ok: `%|-%:%`(context, func, functype)
+  ;; 3-typing.watsup:408.1-412.75
+  rule _ {C : context, expr : expr, ft : functype, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, `FUNC%%*%`(ft, t*{t}, expr), ft)
+    -- if (ft = `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Functype_ok: `|-%:OK`(ft)
+    -- Expr_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL t_1*{t_1} :: t*{t}, LABEL [], RETURN ?()} ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2*{t_2}], RETURN ?()} ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [], RETURN ?(t_2*{t_2})}, expr, t_2*{t_2})
+
+;; 3-typing.watsup:398.1-398.75
+relation Global_ok: `%|-%:%`(context, global, globaltype)
+  ;; 3-typing.watsup:414.1-418.40
+  rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
+    `%|-%:%`(C, GLOBAL(gt, expr), gt)
+    -- Globaltype_ok: `|-%:OK`(gt)
+    -- if (gt = `%?%`(MUT?{}, t))
+    -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
+
+;; 3-typing.watsup:399.1-399.74
+relation Table_ok: `%|-%:%`(context, table, tabletype)
+  ;; 3-typing.watsup:420.1-422.30
+  rule _ {C : context, tt : tabletype}:
+    `%|-%:%`(C, TABLE(tt), tt)
+    -- Tabletype_ok: `|-%:OK`(tt)
+
+;; 3-typing.watsup:400.1-400.72
+relation Mem_ok: `%|-%:%`(context, mem, memtype)
+  ;; 3-typing.watsup:424.1-426.28
+  rule _ {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY(mt), mt)
+    -- Memtype_ok: `|-%:OK`(mt)
+
+;; 3-typing.watsup:403.1-403.77
+relation Elemmode_ok: `%|-%:%`(context, elemmode, reftype)
+  ;; 3-typing.watsup:437.1-440.45
+  rule active {C : context, expr : expr, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE_elemmode(x, expr), rt)
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+    -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*{}
+
+  ;; 3-typing.watsup:442.1-443.20
+  rule declare {C : context, rt : reftype}:
+    `%|-%:%`(C, DECLARE_elemmode, rt)
+
+;; 3-typing.watsup:401.1-401.73
+relation Elem_ok: `%|-%:%`(context, elem, reftype)
+  ;; 3-typing.watsup:428.1-431.40
+  rule _ {C : context, elemmode? : elemmode?, expr* : expr*, rt : reftype}:
+    `%|-%:%`(C, `ELEM%%*%?`(rt, expr*{expr}, elemmode?{elemmode}), rt)
+    -- (Expr_ok: `%|-%:%`(C, expr, [(rt <: valtype)]))*{expr}
+    -- (Elemmode_ok: `%|-%:%`(C, elemmode, rt))?{elemmode}
+
+;; 3-typing.watsup:404.1-404.77
+relation Datamode_ok: `%|-%:OK`(context, datamode)
+  ;; 3-typing.watsup:445.1-448.45
+  rule _ {C : context, expr : expr, mt : memtype}:
+    `%|-%:OK`(C, MEMORY_datamode(0, expr))
+    -- if (0 < |C.MEM_context|)
+    -- if (C.MEM_context[0] = mt)
+    -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*{}
+
+;; 3-typing.watsup:402.1-402.73
+relation Data_ok: `%|-%:OK`(context, data)
+  ;; 3-typing.watsup:433.1-435.40
+  rule _ {C : context, b** : byte**, datamode? : datamode?}:
+    `%|-%:OK`(C, `DATA(*)%*%?`(b*{b}*{b}, datamode?{datamode}))
+    -- (Datamode_ok: `%|-%:OK`(C, datamode))?{datamode}
+
+;; 3-typing.watsup:405.1-405.74
+relation Start_ok: `%|-%:OK`(context, start)
+  ;; 3-typing.watsup:450.1-452.39
+  rule _ {C : context, x : idx}:
+    `%|-%:OK`(C, START(x))
+    -- if (x < |C.FUNC_context|)
+    -- if (C.FUNC_context[x] = `%->%`([], []))
+
+;; 3-typing.watsup:455.1-455.80
+relation Import_ok: `%|-%:%`(context, import, externtype)
+  ;; 3-typing.watsup:459.1-461.31
+  rule _ {C : context, name_1 : name, name_2 : name, xt : externtype}:
+    `%|-%:%`(C, IMPORT(name_1, name_2, xt), xt)
+    -- Externtype_ok: `|-%:OK`(xt)
+
+;; 3-typing.watsup:457.1-457.83
+relation Externuse_ok: `%|-%:%`(context, externuse, externtype)
+  ;; 3-typing.watsup:467.1-469.23
+  rule func {C : context, ft : functype, x : idx}:
+    `%|-%:%`(C, FUNC_externuse(x), FUNC_externtype(ft))
+    -- if (x < |C.FUNC_context|)
+    -- if (C.FUNC_context[x] = ft)
+
+  ;; 3-typing.watsup:471.1-473.25
+  rule global {C : context, gt : globaltype, x : idx}:
+    `%|-%:%`(C, GLOBAL_externuse(x), GLOBAL_externtype(gt))
+    -- if (x < |C.GLOBAL_context|)
+    -- if (C.GLOBAL_context[x] = gt)
+
+  ;; 3-typing.watsup:475.1-477.24
+  rule table {C : context, tt : tabletype, x : idx}:
+    `%|-%:%`(C, TABLE_externuse(x), TABLE_externtype(tt))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = tt)
+
+  ;; 3-typing.watsup:479.1-481.22
+  rule mem {C : context, mt : memtype, x : idx}:
+    `%|-%:%`(C, MEMORY_externuse(x), MEMORY_externtype(mt))
+    -- if (x < |C.MEM_context|)
+    -- if (C.MEM_context[x] = mt)
+
+;; 3-typing.watsup:456.1-456.80
+relation Export_ok: `%|-%:%`(context, export, externtype)
+  ;; 3-typing.watsup:463.1-465.39
+  rule _ {C : context, externuse : externuse, name : name, xt : externtype}:
+    `%|-%:%`(C, EXPORT(name, externuse), xt)
+    -- Externuse_ok: `%|-%:%`(C, externuse, xt)
+
+;; 3-typing.watsup:484.1-484.62
+relation Module_ok: `|-%:OK`(module)
+  ;; 3-typing.watsup:486.1-501.22
+  rule _ {C : context, data^n : data^n, elem* : elem*, export* : export*, ft* : functype*, func* : func*, global* : global*, gt* : globaltype*, import* : import*, mem* : mem*, mt* : memtype*, n : n, rt* : reftype*, start* : start*, table* : table*, tt* : tabletype*}:
+    `|-%:OK`(`MODULE%*%*%*%*%*%*%*%*%*`(import*{import}, func*{func}, global*{global}, table*{table}, mem*{mem}, elem*{elem}, data^n{data}, start*{start}, export*{export}))
+    -- if (C = {FUNC ft*{ft}, GLOBAL gt*{gt}, TABLE tt*{tt}, MEM mt*{mt}, ELEM rt*{rt}, DATA OK^n{}, LOCAL [], LABEL [], RETURN ?()})
+    -- (Func_ok: `%|-%:%`(C, func, ft))*{ft func}
+    -- (Global_ok: `%|-%:%`(C, global, gt))*{global gt}
+    -- (Table_ok: `%|-%:%`(C, table, tt))*{table tt}
+    -- (Mem_ok: `%|-%:%`(C, mem, mt))*{mem mt}
+    -- (Elem_ok: `%|-%:%`(C, elem, rt))*{elem rt}
+    -- (Data_ok: `%|-%:OK`(C, data))^n{data}
+    -- (Start_ok: `%|-%:OK`(C, start))*{start}
+    -- if (|mem*{mem}| <= 1)
+    -- if (|start*{start}| <= 1)
+
+;; 4-runtime.watsup:3.1-3.39
+syntax addr = nat
+
+;; 4-runtime.watsup:4.1-4.53
+syntax funcaddr = addr
+
+;; 4-runtime.watsup:5.1-5.53
+syntax globaladdr = addr
+
+;; 4-runtime.watsup:6.1-6.51
+syntax tableaddr = addr
+
+;; 4-runtime.watsup:7.1-7.50
+syntax memaddr = addr
+
+;; 4-runtime.watsup:8.1-8.49
+syntax elemaddr = addr
+
+;; 4-runtime.watsup:9.1-9.49
+syntax dataaddr = addr
+
+;; 4-runtime.watsup:10.1-10.51
+syntax labeladdr = addr
+
+;; 4-runtime.watsup:11.1-11.49
+syntax hostaddr = addr
+
+;; 4-runtime.watsup:24.1-25.24
+syntax num =
+  | CONST(numtype, c_numtype)
+
+;; 4-runtime.watsup:26.1-27.67
+syntax ref =
+  | REF.NULL(reftype)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+
+;; 4-runtime.watsup:28.1-29.10
+syntax val =
+  | CONST(numtype, c_numtype)
+  | REF.NULL(reftype)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+
+;; 4-runtime.watsup:31.1-32.18
+syntax result =
+  | _VALS(val*)
+  | TRAP
+
+;; 4-runtime.watsup:38.1-39.66
+syntax externval =
+  | FUNC(funcaddr)
+  | GLOBAL(globaladdr)
+  | TABLE(tableaddr)
+  | MEM(memaddr)
+
+;; 4-runtime.watsup:44.1-44.44
+def default_ : valtype -> val
+  ;; 4-runtime.watsup:45.1-45.35
+  def default_(I32_valtype) = CONST_val(I32_numtype, 0)
+  ;; 4-runtime.watsup:46.1-46.35
+  def default_(I64_valtype) = CONST_val(I64_numtype, 0)
+  ;; 4-runtime.watsup:47.1-47.35
+  def default_(F32_valtype) = CONST_val(F32_numtype, 0)
+  ;; 4-runtime.watsup:48.1-48.35
+  def default_(F64_valtype) = CONST_val(F64_numtype, 0)
+  ;; 4-runtime.watsup:49.1-49.44
+  def default_(FUNCREF_valtype) = REF.NULL_val(FUNCREF_reftype)
+  ;; 4-runtime.watsup:50.1-50.48
+  def default_(EXTERNREF_valtype) = REF.NULL_val(EXTERNREF_reftype)
+
+;; 4-runtime.watsup:61.1-61.71
+syntax exportinst = EXPORT(name, externval)
+
+;; 4-runtime.watsup:71.1-78.25
+syntax moduleinst = {FUNC funcaddr*, GLOBAL globaladdr*, TABLE tableaddr*, MEM memaddr*, ELEM elemaddr*, DATA dataaddr*, EXPORT exportinst*}
+
+;; 4-runtime.watsup:55.1-55.66
+syntax funcinst = `%;%`(moduleinst, func)
+
+;; 4-runtime.watsup:56.1-56.53
+syntax globalinst = val
+
+;; 4-runtime.watsup:57.1-57.52
+syntax tableinst = ref*
+
+;; 4-runtime.watsup:58.1-58.52
+syntax meminst = byte*
+
+;; 4-runtime.watsup:59.1-59.53
+syntax eleminst = ref*
+
+;; 4-runtime.watsup:60.1-60.51
+syntax datainst = byte*
+
+;; 4-runtime.watsup:63.1-69.21
+syntax store = {FUNC funcinst*, GLOBAL globalinst*, TABLE tableinst*, MEM meminst*, ELEM eleminst*, DATA datainst*}
+
+;; 4-runtime.watsup:80.1-82.24
+syntax frame = {LOCAL val*, MODULE moduleinst}
+
+;; 4-runtime.watsup:83.1-83.47
+syntax state = `%;%`(store, frame)
+
+;; 4-runtime.watsup:140.1-147.5
+rec {
+
+;; 4-runtime.watsup:140.1-147.5
+syntax admininstr =
+  | UNREACHABLE
+  | NOP
+  | DROP
+  | SELECT(valtype?)
+  | BLOCK(blocktype, instr*)
+  | LOOP(blocktype, instr*)
+  | IF(blocktype, instr*, instr*)
+  | BR(labelidx)
+  | BR_IF(labelidx)
+  | BR_TABLE(labelidx*, labelidx)
+  | CALL(funcidx)
+  | CALL_INDIRECT(tableidx, functype)
+  | RETURN
+  | CONST(numtype, c_numtype)
+  | UNOP(numtype, unop_numtype)
+  | BINOP(numtype, binop_numtype)
+  | TESTOP(numtype, testop_numtype)
+  | RELOP(numtype, relop_numtype)
+  | EXTEND(numtype, n)
+  | CVTOP(numtype, cvtop, numtype, sx?)
+  | REF.NULL(reftype)
+  | REF.FUNC(funcidx)
+  | REF.IS_NULL
+  | LOCAL.GET(localidx)
+  | LOCAL.SET(localidx)
+  | LOCAL.TEE(localidx)
+  | GLOBAL.GET(globalidx)
+  | GLOBAL.SET(globalidx)
+  | TABLE.GET(tableidx)
+  | TABLE.SET(tableidx)
+  | TABLE.SIZE(tableidx)
+  | TABLE.GROW(tableidx)
+  | TABLE.FILL(tableidx)
+  | TABLE.COPY(tableidx, tableidx)
+  | TABLE.INIT(tableidx, elemidx)
+  | ELEM.DROP(elemidx)
+  | MEMORY.SIZE
+  | MEMORY.GROW
+  | MEMORY.FILL
+  | MEMORY.COPY
+  | MEMORY.INIT(dataidx)
+  | DATA.DROP(dataidx)
+  | LOAD(numtype, (n, sx)?, nat, nat)
+  | STORE(numtype, n?, nat, nat)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+  | CALL_ADDR(funcaddr)
+  | LABEL_(n, instr*, admininstr*)
+  | FRAME_(n, frame, admininstr*)
+  | TRAP
+}
+
+;; 4-runtime.watsup:84.1-84.62
+syntax config = `%;%*`(state, admininstr*)
+
+;; 4-runtime.watsup:102.1-102.59
+def funcaddr : state -> funcaddr*
+  ;; 4-runtime.watsup:103.1-103.38
+  def {f : frame, s : store} funcaddr(`%;%`(s, f)) = f.MODULE_frame.FUNC_moduleinst
+
+;; 4-runtime.watsup:105.1-105.52
+def funcinst : state -> funcinst*
+  ;; 4-runtime.watsup:106.1-106.31
+  def {f : frame, s : store} funcinst(`%;%`(s, f)) = s.FUNC_store
+
+;; 4-runtime.watsup:108.1-108.67
+def func : (state, funcidx) -> funcinst
+  ;; 4-runtime.watsup:116.1-116.48
+  def {f : frame, s : store, x : idx} func(`%;%`(s, f), x) = s.FUNC_store[f.MODULE_frame.FUNC_moduleinst[x]]
+
+;; 4-runtime.watsup:109.1-109.69
+def global : (state, globalidx) -> globalinst
+  ;; 4-runtime.watsup:117.1-117.54
+  def {f : frame, s : store, x : idx} global(`%;%`(s, f), x) = s.GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]]
+
+;; 4-runtime.watsup:110.1-110.68
+def table : (state, tableidx) -> tableinst
+  ;; 4-runtime.watsup:118.1-118.51
+  def {f : frame, s : store, x : idx} table(`%;%`(s, f), x) = s.TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]]
+
+;; 4-runtime.watsup:111.1-111.66
+def mem : (state, memidx) -> meminst
+  ;; 4-runtime.watsup:119.1-119.45
+  def {f : frame, s : store, x : idx} mem(`%;%`(s, f), x) = s.MEM_store[f.MODULE_frame.MEM_moduleinst[x]]
+
+;; 4-runtime.watsup:112.1-112.67
+def elem : (state, tableidx) -> eleminst
+  ;; 4-runtime.watsup:120.1-120.48
+  def {f : frame, s : store, x : idx} elem(`%;%`(s, f), x) = s.ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]]
+
+;; 4-runtime.watsup:113.1-113.67
+def data : (state, dataidx) -> datainst
+  ;; 4-runtime.watsup:121.1-121.48
+  def {f : frame, s : store, x : idx} data(`%;%`(s, f), x) = s.DATA_store[f.MODULE_frame.DATA_moduleinst[x]]
+
+;; 4-runtime.watsup:114.1-114.68
+def local : (state, localidx) -> val
+  ;; 4-runtime.watsup:122.1-122.35
+  def {f : frame, s : store, x : idx} local(`%;%`(s, f), x) = f.LOCAL_frame[x]
+
+;; 4-runtime.watsup:125.1-125.78
+def with_local : (state, localidx, val) -> state
+  ;; 4-runtime.watsup:131.1-131.52
+  def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL[x] = v])
+
+;; 4-runtime.watsup:126.1-126.79
+def with_global : (state, globalidx, val) -> state
+  ;; 4-runtime.watsup:132.1-132.71
+  def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
+
+;; 4-runtime.watsup:127.1-127.81
+def with_table : (state, tableidx, n, ref) -> state
+  ;; 4-runtime.watsup:133.1-133.74
+  def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
+
+;; 4-runtime.watsup:128.1-128.80
+def with_tableext : (state, tableidx, ref*) -> state
+  ;; 4-runtime.watsup:134.1-134.75
+  def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
+
+;; 4-runtime.watsup:129.1-129.77
+def with_elem : (state, elemidx, ref*) -> state
+  ;; 4-runtime.watsup:135.1-135.69
+  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
+
+;; 4-runtime.watsup:149.1-152.21
+rec {
+
+;; 4-runtime.watsup:149.1-152.21
+syntax E =
+  | _HOLE
+  | _SEQ(val*, E, instr*)
+  | LABEL_(n, instr*, E)
+}
+
+;; 5-numerics.watsup:3.1-3.76
+def unop : (unop_numtype, numtype, c_numtype) -> c_numtype*
+
+;; 5-numerics.watsup:4.1-4.79
+def binop : (binop_numtype, numtype, c_numtype, c_numtype) -> c_numtype*
+
+;; 5-numerics.watsup:5.1-5.76
+def testop : (testop_numtype, numtype, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:6.1-6.79
+def relop : (relop_numtype, numtype, c_numtype, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:8.1-8.84
+def ext : (nat, nat, sx, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:9.1-9.84
+def cvtop : (numtype, cvtop, numtype, sx?, c_numtype) -> c_numtype*
+
+;; 6-reduction.watsup:4.1-4.63
+relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
+  ;; 6-reduction.watsup:16.1-17.24
+  rule unreachable:
+    `%*~>%*`([UNREACHABLE_admininstr], [TRAP_admininstr])
+
+  ;; 6-reduction.watsup:19.1-20.19
+  rule nop:
+    `%*~>%*`([NOP_admininstr], [])
+
+  ;; 6-reduction.watsup:22.1-23.24
+  rule drop {val : val}:
+    `%*~>%*`([(val <: admininstr) DROP_admininstr], [])
+
+  ;; 6-reduction.watsup:26.1-28.16
+  rule select-true {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
+    `%*~>%*`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [(val_1 <: admininstr)])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:30.1-32.14
+  rule select-false {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
+    `%*~>%*`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [(val_2 <: admininstr)])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:35.1-37.28
+  rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
+    `%*~>%*`((val <: admininstr)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
+
+  ;; 6-reduction.watsup:39.1-41.28
+  rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
+    `%*~>%*`((val <: admininstr)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [LOOP_instr(bt, instr*{instr})], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
+
+  ;; 6-reduction.watsup:43.1-45.16
+  rule if-true {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*{instr_1}, instr_2*{instr_2})], [BLOCK_admininstr(bt, instr_1*{instr_1})])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:47.1-49.14
+  rule if-false {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*{instr_1}, instr_2*{instr_2})], [BLOCK_admininstr(bt, instr_2*{instr_2})])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:52.1-53.38
+  rule label-vals {instr* : instr*, n : n, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr*{instr}, (val <: admininstr)*{val})], (val <: admininstr)*{val})
+
+  ;; 6-reduction.watsup:57.1-58.69
+  rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [BR_admininstr(0)] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val} :: (instr' <: admininstr)*{instr'})
+
+  ;; 6-reduction.watsup:60.1-61.65
+  rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val <: admininstr)*{val} :: [BR_admininstr(l + 1)] :: (instr <: admininstr)*{instr})], (val <: admininstr)*{val} :: [BR_admininstr(l)])
+
+  ;; 6-reduction.watsup:64.1-66.16
+  rule br_if-true {c : c_numtype, l : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)], [BR_admininstr(l)])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:68.1-70.14
+  rule br_if-false {c : c_numtype, l : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)], [])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:73.1-75.17
+  rule br_table-lt {i : nat, l* : labelidx*, l' : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')], [BR_admininstr(l*{l}[i])])
+    -- if (i < |l*{l}|)
+
+  ;; 6-reduction.watsup:77.1-79.18
+  rule br_table-ge {i : nat, l* : labelidx*, l' : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')], [BR_admininstr(l')])
+    -- if (i >= |l*{l}|)
+
+  ;; 6-reduction.watsup:100.1-101.35
+  rule frame-vals {f : frame, n : n, val^n : val^n}:
+    `%*~>%*`([FRAME__admininstr(n, f, (val <: admininstr)^n{val})], (val <: admininstr)^n{val})
+
+  ;; 6-reduction.watsup:103.1-104.55
+  rule return-frame {f : frame, instr* : instr*, n : n, val^n : val^n, val'* : val*}:
+    `%*~>%*`([FRAME__admininstr(n, f, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val})
+
+  ;; 6-reduction.watsup:106.1-107.60
+  rule return-label {instr* : instr*, instr'* : instr*, k : nat, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(k, instr'*{instr'}, (val <: admininstr)*{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)*{val} :: [RETURN_admininstr])
+
+  ;; 6-reduction.watsup:110.1-112.33
+  rule unop-val {c : c_numtype, c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)], [CONST_admininstr(nt, c)])
+    -- if ($unop(unop, nt, c_1) = [c])
+
+  ;; 6-reduction.watsup:114.1-116.39
+  rule unop-trap {c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)], [TRAP_admininstr])
+    -- if ($unop(unop, nt, c_1) = [])
+
+  ;; 6-reduction.watsup:119.1-121.40
+  rule binop-val {binop : binop_numtype, c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)], [CONST_admininstr(nt, c)])
+    -- if ($binop(binop, nt, c_1, c_2) = [c])
+
+  ;; 6-reduction.watsup:123.1-125.46
+  rule binop-trap {binop : binop_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)], [TRAP_admininstr])
+    -- if ($binop(binop, nt, c_1, c_2) = [])
+
+  ;; 6-reduction.watsup:128.1-130.37
+  rule testop {c : c_numtype, c_1 : c_numtype, nt : numtype, testop : testop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) TESTOP_admininstr(nt, testop)], [CONST_admininstr(I32_numtype, c)])
+    -- if (c = $testop(testop, nt, c_1))
+
+  ;; 6-reduction.watsup:132.1-134.40
+  rule relop {c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype, relop : relop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) RELOP_admininstr(nt, relop)], [CONST_admininstr(I32_numtype, c)])
+    -- if (c = $relop(relop, nt, c_1, c_2))
+
+  ;; 6-reduction.watsup:137.1-138.70
+  rule extend {c : c_numtype, n : n, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, $size(nt <: valtype), S_sx, c))])
+
+  ;; 6-reduction.watsup:141.1-143.48
+  rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CVTOP_admininstr(nt_1, cvtop, nt_2, sx?{sx})], [CONST_admininstr(nt, c)])
+    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [c])
+
+  ;; 6-reduction.watsup:145.1-147.54
+  rule cvtop-trap {c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CVTOP_admininstr(nt_1, cvtop, nt_2, sx?{sx})], [TRAP_admininstr])
+    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [])
+
+  ;; 6-reduction.watsup:154.1-156.28
+  rule ref.is_null-true {rt : reftype, val : val}:
+    `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
+    -- if (val = REF.NULL_val(rt))
+
+  ;; 6-reduction.watsup:158.1-160.15
+  rule ref.is_null-false {val : val}:
+    `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:169.1-170.47
+  rule local.tee {val : val, x : idx}:
+    `%*~>%*`([(val <: admininstr) LOCAL.TEE_admininstr(x)], [(val <: admininstr) (val <: admininstr) LOCAL.SET_admininstr(x)])
+
+;; 6-reduction.watsup:5.1-5.63
+relation Step_read: `%~>%*`(config, admininstr*)
+  ;; 6-reduction.watsup:82.1-83.47
+  rule call {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CALL_admininstr(x)]), [CALL_ADDR_admininstr($funcaddr(z)[x])])
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:85.1-88.34
+  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [CALL_ADDR_admininstr(a)])
+    -- if (i < |$table(z, x)|)
+    -- if (a < |$funcinst(z)|)
+    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
+    -- if ($funcinst(z)[a] = `%;%`(m, func))
+
+  ;; 6-reduction.watsup:90.1-92.15
+  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [TRAP_admininstr])
+    -- otherwise
+
+  ;; 6-reduction.watsup:94.1-97.52
+  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
+    `%~>%*`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], (instr <: admininstr)*{instr})])])
+    -- if (a < |$funcinst(z)|)
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
+    -- if (f = {LOCAL val^k{val} :: $default_(t)*{t}, MODULE m})
+
+  ;; 6-reduction.watsup:150.1-151.53
+  rule ref.func {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [REF.FUNC_admininstr(x)]), [REF.FUNC_ADDR_admininstr($funcaddr(z)[x])])
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:163.1-164.37
+  rule local.get {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [LOCAL.GET_admininstr(x)]), [($local(z, x) <: admininstr)])
+
+  ;; 6-reduction.watsup:173.1-174.39
+  rule global.get {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]), [($global(z, x) <: admininstr)])
+
+  ;; 6-reduction.watsup:180.1-182.28
+  rule table.get-trap {i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:184.1-186.27
+  rule table.get-val {i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [($table(z, x)[i] <: admininstr)])
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:188.1-190.28
+  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:197.1-199.27
+  rule table.size {n : n, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]), [CONST_admininstr(I32_numtype, n)])
+    -- if (|$table(z, x)| = n)
+
+  ;; 6-reduction.watsup:205.1-206.57
+  rule table.grow-fail {n : n, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), [CONST_admininstr(I32_numtype, - 1)])
+
+  ;; 6-reduction.watsup:209.1-211.34
+  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
+    -- if ((i + n) > |$table(z, x)|)
+
+  ;; 6-reduction.watsup:213.1-216.14
+  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:218.1-222.15
+  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) (val <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) (val <: admininstr) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:225.1-227.63
+  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [TRAP_admininstr])
+    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:229.1-232.14
+  rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:234.1-239.15
+  rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
+    -- otherwise
+    -- if (j <= i)
+
+  ;; 6-reduction.watsup:241.1-245.15
+  rule table.copy-gt {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, ((j + n) - 1)) CONST_admininstr(I32_numtype, ((i + n) - 1)) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:248.1-250.62
+  rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [TRAP_admininstr])
+    -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:252.1-255.14
+  rule table.init-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:257.1-261.15
+  rule table.init-succ {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) ($elem(z, y)[i] <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
+    -- if (i < |$elem(z, y)|)
+    -- otherwise
+
+;; 6-reduction.watsup:3.1-3.63
+relation Step: `%~>%`(config, config)
+  ;; 6-reduction.watsup:7.1-9.34
+  rule pure {instr* : instr*, instr'* : instr*, z : state}:
+    `%~>%`(`%;%*`(z, (instr <: admininstr)*{instr}), `%;%*`(z, (instr' <: admininstr)*{instr'}))
+    -- Step_pure: `%*~>%*`((instr <: admininstr)*{instr}, (instr' <: admininstr)*{instr'})
+
+  ;; 6-reduction.watsup:11.1-13.37
+  rule read {instr* : instr*, instr'* : instr*, z : state}:
+    `%~>%`(`%;%*`(z, (instr <: admininstr)*{instr}), `%;%*`(z, (instr' <: admininstr)*{instr'}))
+    -- Step_read: `%~>%*`(`%;%*`(z, (instr <: admininstr)*{instr}), (instr' <: admininstr)*{instr'})
+
+  ;; 6-reduction.watsup:166.1-167.60
+  rule local.set {val : val, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [(val <: admininstr) LOCAL.SET_admininstr(x)]), `%;%*`($with_local(z, x, val), []))
+
+  ;; 6-reduction.watsup:176.1-177.62
+  rule global.set {val : val, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [(val <: admininstr) GLOBAL.SET_admininstr(x)]), `%;%*`($with_global(z, x, val), []))
+
+  ;; 6-reduction.watsup:192.1-194.27
+  rule table.set-val {i : nat, ref : ref, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), `%;%*`($with_table(z, x, i, ref), []))
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:202.1-203.102
+  rule table.grow-succeed {n : n, ref : ref, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [(ref <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), `%;%*`($with_tableext(z, x, ref^n{}), [CONST_admininstr(I32_numtype, |$table(z, x)|)]))
+
+  ;; 6-reduction.watsup:264.1-265.59
+  rule elem.drop {x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [ELEM.DROP_admininstr(x)]), `%;%*`($with_elem(z, x, []), []))
+
+== IL Validation...
+== Function totalization...
+== Printing...
+
+;; 1-syntax.watsup:3.1-3.15
+syntax n = nat
+
+;; 1-syntax.watsup:9.1-9.37
+syntax name = text
+
+;; 1-syntax.watsup:14.1-14.36
+syntax byte = nat
+
+;; 1-syntax.watsup:15.1-15.45
+syntax u32 = nat
+
+;; 1-syntax.watsup:22.1-22.36
+syntax idx = nat
+
+;; 1-syntax.watsup:23.1-23.49
+syntax funcidx = idx
+
+;; 1-syntax.watsup:24.1-24.49
+syntax globalidx = idx
+
+;; 1-syntax.watsup:25.1-25.47
+syntax tableidx = idx
+
+;; 1-syntax.watsup:26.1-26.46
+syntax memidx = idx
+
+;; 1-syntax.watsup:27.1-27.45
+syntax elemidx = idx
+
+;; 1-syntax.watsup:28.1-28.45
+syntax dataidx = idx
+
+;; 1-syntax.watsup:29.1-29.47
+syntax labelidx = idx
+
+;; 1-syntax.watsup:30.1-30.47
+syntax localidx = idx
+
+;; 1-syntax.watsup:39.1-40.22
+syntax numtype =
+  | I32
+  | I64
+  | F32
+  | F64
+
+;; 1-syntax.watsup:41.1-42.5
+syntax vectype =
+  | V128
+
+;; 1-syntax.watsup:43.1-44.20
+syntax reftype =
+  | FUNCREF
+  | EXTERNREF
+
+;; 1-syntax.watsup:45.1-46.34
+syntax valtype =
+  | I32
+  | I64
+  | F32
+  | F64
+  | V128
+  | FUNCREF
+  | EXTERNREF
+  | BOT
+
+;; 1-syntax.watsup:48.1-48.71
+syntax in =
+  | I32
+  | I64
+
+;; 1-syntax.watsup:49.1-49.71
+syntax fn =
+  | F32
+  | F64
+
+;; 1-syntax.watsup:56.1-57.11
+syntax resulttype = valtype*
+
+;; 1-syntax.watsup:59.1-60.16
+syntax limits = `[%..%]`(u32, u32)
+
+;; 1-syntax.watsup:61.1-62.6
+syntax mutflag = MUT
+
+;; 1-syntax.watsup:63.1-64.19
+syntax globaltype = `%?%`(mutflag?, valtype)
+
+;; 1-syntax.watsup:65.1-66.27
+syntax functype = `%->%`(resulttype, resulttype)
+
+;; 1-syntax.watsup:67.1-68.17
+syntax tabletype = `%%`(limits, reftype)
+
+;; 1-syntax.watsup:69.1-70.12
+syntax memtype = `%I8`(limits)
+
+;; 1-syntax.watsup:71.1-72.10
+syntax elemtype = reftype
+
+;; 1-syntax.watsup:73.1-74.5
+syntax datatype = OK
+
+;; 1-syntax.watsup:75.1-76.69
+syntax externtype =
+  | GLOBAL(globaltype)
+  | FUNC(functype)
+  | TABLE(tabletype)
+  | MEMORY(memtype)
+
+;; 1-syntax.watsup:89.1-89.44
+syntax sx =
+  | U
+  | S
+
+;; 1-syntax.watsup:91.1-91.39
+syntax unop_IXX =
+  | CLZ
+  | CTZ
+  | POPCNT
+
+;; 1-syntax.watsup:92.1-92.70
+syntax unop_FXX =
+  | ABS
+  | NEG
+  | SQRT
+  | CEIL
+  | FLOOR
+  | TRUNC
+  | NEAREST
+
+;; 1-syntax.watsup:94.1-96.62
+syntax binop_IXX =
+  | ADD
+  | SUB
+  | MUL
+  | DIV(sx)
+  | REM(sx)
+  | AND
+  | OR
+  | XOR
+  | SHL
+  | SHR(sx)
+  | ROTL
+  | ROTR
+
+;; 1-syntax.watsup:97.1-97.66
+syntax binop_FXX =
+  | ADD
+  | SUB
+  | MUL
+  | DIV
+  | MIN
+  | MAX
+  | COPYSIGN
+
+;; 1-syntax.watsup:99.1-99.26
+syntax testop_IXX =
+  | EQZ
+
+;; 1-syntax.watsup:100.1-100.22
+syntax testop_FXX =
+  |
+
+;; 1-syntax.watsup:102.1-103.108
+syntax relop_IXX =
+  | EQ
+  | NE
+  | LT(sx)
+  | GT(sx)
+  | LE(sx)
+  | GE(sx)
+
+;; 1-syntax.watsup:104.1-104.49
+syntax relop_FXX =
+  | EQ
+  | NE
+  | LT
+  | GT
+  | LE
+  | GE
+
+;; 1-syntax.watsup:106.1-106.50
+syntax unop_numtype =
+  | _I(unop_IXX)
+  | _F(unop_FXX)
+
+;; 1-syntax.watsup:107.1-107.53
+syntax binop_numtype =
+  | _I(binop_IXX)
+  | _F(binop_FXX)
+
+;; 1-syntax.watsup:108.1-108.56
+syntax testop_numtype =
+  | _I(testop_IXX)
+  | _F(testop_FXX)
+
+;; 1-syntax.watsup:109.1-109.53
+syntax relop_numtype =
+  | _I(relop_IXX)
+  | _F(relop_FXX)
+
+;; 1-syntax.watsup:110.1-110.39
+syntax cvtop =
+  | CONVERT
+  | REINTERPRET
+
+;; 1-syntax.watsup:120.1-120.23
+syntax c_numtype = nat
+
+;; 1-syntax.watsup:121.1-121.23
+syntax c_vectype = nat
+
+;; 1-syntax.watsup:124.1-124.52
+syntax blocktype = functype
+
+;; 1-syntax.watsup:159.1-180.55
+rec {
+
+;; 1-syntax.watsup:159.1-180.55
+syntax instr =
+  | UNREACHABLE
+  | NOP
+  | DROP
+  | SELECT(valtype?)
+  | BLOCK(blocktype, instr*)
+  | LOOP(blocktype, instr*)
+  | IF(blocktype, instr*, instr*)
+  | BR(labelidx)
+  | BR_IF(labelidx)
+  | BR_TABLE(labelidx*, labelidx)
+  | CALL(funcidx)
+  | CALL_INDIRECT(tableidx, functype)
+  | RETURN
+  | CONST(numtype, c_numtype)
+  | UNOP(numtype, unop_numtype)
+  | BINOP(numtype, binop_numtype)
+  | TESTOP(numtype, testop_numtype)
+  | RELOP(numtype, relop_numtype)
+  | EXTEND(numtype, n)
+  | CVTOP(numtype, cvtop, numtype, sx?)
+  | REF.NULL(reftype)
+  | REF.FUNC(funcidx)
+  | REF.IS_NULL
+  | LOCAL.GET(localidx)
+  | LOCAL.SET(localidx)
+  | LOCAL.TEE(localidx)
+  | GLOBAL.GET(globalidx)
+  | GLOBAL.SET(globalidx)
+  | TABLE.GET(tableidx)
+  | TABLE.SET(tableidx)
+  | TABLE.SIZE(tableidx)
+  | TABLE.GROW(tableidx)
+  | TABLE.FILL(tableidx)
+  | TABLE.COPY(tableidx, tableidx)
+  | TABLE.INIT(tableidx, elemidx)
+  | ELEM.DROP(elemidx)
+  | MEMORY.SIZE
+  | MEMORY.GROW
+  | MEMORY.FILL
+  | MEMORY.COPY
+  | MEMORY.INIT(dataidx)
+  | DATA.DROP(dataidx)
+  | LOAD(numtype, (n, sx)?, nat, nat)
+  | STORE(numtype, n?, nat, nat)
+}
+
+;; 1-syntax.watsup:182.1-183.9
+syntax expr = instr*
+
+;; 1-syntax.watsup:188.1-188.50
+syntax elemmode =
+  | TABLE(tableidx, expr)
+  | DECLARE
+
+;; 1-syntax.watsup:189.1-189.39
+syntax datamode =
+  | MEMORY(memidx, expr)
+
+;; 1-syntax.watsup:191.1-192.30
+syntax func = `FUNC%%*%`(functype, valtype*, expr)
+
+;; 1-syntax.watsup:193.1-194.25
+syntax global = GLOBAL(globaltype, expr)
+
+;; 1-syntax.watsup:195.1-196.18
+syntax table = TABLE(tabletype)
+
+;; 1-syntax.watsup:197.1-198.17
+syntax mem = MEMORY(memtype)
+
+;; 1-syntax.watsup:199.1-200.31
+syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
+
+;; 1-syntax.watsup:201.1-202.26
+syntax data = `DATA(*)%*%?`(byte**, datamode?)
+
+;; 1-syntax.watsup:203.1-204.16
+syntax start = START(funcidx)
+
+;; 1-syntax.watsup:206.1-207.65
+syntax externuse =
+  | FUNC(funcidx)
+  | GLOBAL(globalidx)
+  | TABLE(tableidx)
+  | MEMORY(memidx)
+
+;; 1-syntax.watsup:208.1-209.24
+syntax export = EXPORT(name, externuse)
+
+;; 1-syntax.watsup:210.1-211.30
+syntax import = IMPORT(name, name, externtype)
+
+;; 1-syntax.watsup:213.1-214.70
+syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
+
+;; 2-aux.watsup:5.1-5.55
+def size : valtype -> nat?
+  ;; 2-aux.watsup:6.1-6.20
+  def size(I32_valtype) = ?(32)
+  ;; 2-aux.watsup:7.1-7.20
+  def size(I64_valtype) = ?(64)
+  ;; 2-aux.watsup:8.1-8.20
+  def size(F32_valtype) = ?(32)
+  ;; 2-aux.watsup:9.1-9.20
+  def size(F64_valtype) = ?(64)
+  ;; 2-aux.watsup:10.1-10.22
+  def size(V128_valtype) = ?(128)
+  ;;
+  def {x : valtype} size(x) = ?()
+
+;; 2-aux.watsup:15.1-15.40
+def test_sub_ATOM_22 : n -> nat
+  ;; 2-aux.watsup:16.1-16.38
+  def {n_3_ATOM_y : n} test_sub_ATOM_22(n_3_ATOM_y) = 0
+
+;; 2-aux.watsup:18.1-18.26
+def curried_ : (n, n) -> nat
+  ;; 2-aux.watsup:19.1-19.39
+  def {n_1 : n, n_2 : n} curried_(n_1, n_2) = (n_1 + n_2)
+
+;; 2-aux.watsup:21.1-30.39
+syntax testfuse =
+  | AB_(nat, nat, nat)
+  | CD(nat, nat, nat)
+  | EF(nat, nat, nat)
+  | GH(nat, nat, nat)
+  | IJ(nat, nat, nat)
+  | KL(nat, nat, nat)
+  | MN(nat, nat, nat)
+  | OP(nat, nat, nat)
+  | QR(nat, nat, nat)
+
+;; 3-typing.watsup:3.1-6.60
+syntax context = {FUNC functype*, GLOBAL globaltype*, TABLE tabletype*, MEM memtype*, ELEM elemtype*, DATA datatype*, LOCAL valtype*, LABEL resulttype*, RETURN resulttype?}
+
+;; 3-typing.watsup:14.1-14.66
+relation Limits_ok: `|-%:%`(limits, nat)
+  ;; 3-typing.watsup:22.1-24.24
+  rule _ {k : nat, n_1 : n, n_2 : n}:
+    `|-%:%`(`[%..%]`(n_1, n_2), k)
+    -- if ((n_1 <= n_2) /\ (n_2 <= k))
+
+;; 3-typing.watsup:15.1-15.64
+relation Functype_ok: `|-%:OK`(functype)
+  ;; 3-typing.watsup:26.1-27.13
+  rule _ {ft : functype}:
+    `|-%:OK`(ft)
+
+;; 3-typing.watsup:16.1-16.66
+relation Globaltype_ok: `|-%:OK`(globaltype)
+  ;; 3-typing.watsup:29.1-30.13
+  rule _ {gt : globaltype}:
+    `|-%:OK`(gt)
+
+;; 3-typing.watsup:17.1-17.65
+relation Tabletype_ok: `|-%:OK`(tabletype)
+  ;; 3-typing.watsup:32.1-34.35
+  rule _ {lim : limits, rt : reftype}:
+    `|-%:OK`(`%%`(lim, rt))
+    -- Limits_ok: `|-%:%`(lim, ((2 ^ 32) - 1))
+
+;; 3-typing.watsup:18.1-18.63
+relation Memtype_ok: `|-%:OK`(memtype)
+  ;; 3-typing.watsup:36.1-38.33
+  rule _ {lim : limits}:
+    `|-%:OK`(`%I8`(lim))
+    -- Limits_ok: `|-%:%`(lim, (2 ^ 16))
+
+;; 3-typing.watsup:19.1-19.66
+relation Externtype_ok: `|-%:OK`(externtype)
+  ;; 3-typing.watsup:41.1-43.35
+  rule func {functype : functype}:
+    `|-%:OK`(FUNC_externtype(functype))
+    -- Functype_ok: `|-%:OK`(functype)
+
+  ;; 3-typing.watsup:45.1-47.39
+  rule global {globaltype : globaltype}:
+    `|-%:OK`(GLOBAL_externtype(globaltype))
+    -- Globaltype_ok: `|-%:OK`(globaltype)
+
+  ;; 3-typing.watsup:49.1-51.37
+  rule table {tabletype : tabletype}:
+    `|-%:OK`(TABLE_externtype(tabletype))
+    -- Tabletype_ok: `|-%:OK`(tabletype)
+
+  ;; 3-typing.watsup:53.1-55.33
+  rule mem {memtype : memtype}:
+    `|-%:OK`(MEMORY_externtype(memtype))
+    -- Memtype_ok: `|-%:OK`(memtype)
+
+;; 3-typing.watsup:61.1-61.65
+relation Valtype_sub: `|-%<:%`(valtype, valtype)
+  ;; 3-typing.watsup:64.1-65.12
+  rule refl {t : valtype}:
+    `|-%<:%`(t, t)
+
+  ;; 3-typing.watsup:67.1-68.14
+  rule bot {t : valtype}:
+    `|-%<:%`(BOT_valtype, t)
+
+;; 3-typing.watsup:62.1-62.72
+relation Resulttype_sub: `|-%*<:%*`(valtype*, valtype*)
+  ;; 3-typing.watsup:70.1-72.35
+  rule _ {t_1* : valtype*, t_2* : valtype*}:
+    `|-%*<:%*`(t_1*{t_1}, t_2*{t_2})
+    -- (Valtype_sub: `|-%<:%`(t_1, t_2))*{t_1 t_2}
+
+;; 3-typing.watsup:75.1-75.75
+relation Limits_sub: `|-%<:%`(limits, limits)
+  ;; 3-typing.watsup:83.1-86.21
+  rule _ {n_11 : n, n_12 : n, n_21 : n, n_22 : n}:
+    `|-%<:%`(`[%..%]`(n_11, n_12), `[%..%]`(n_21, n_22))
+    -- if (n_11 >= n_21)
+    -- if (n_12 <= n_22)
+
+;; 3-typing.watsup:76.1-76.73
+relation Functype_sub: `|-%<:%`(functype, functype)
+  ;; 3-typing.watsup:88.1-89.14
+  rule _ {ft : functype}:
+    `|-%<:%`(ft, ft)
+
+;; 3-typing.watsup:77.1-77.75
+relation Globaltype_sub: `|-%<:%`(globaltype, globaltype)
+  ;; 3-typing.watsup:91.1-92.14
+  rule _ {gt : globaltype}:
+    `|-%<:%`(gt, gt)
+
+;; 3-typing.watsup:78.1-78.74
+relation Tabletype_sub: `|-%<:%`(tabletype, tabletype)
+  ;; 3-typing.watsup:94.1-96.35
+  rule _ {lim_1 : limits, lim_2 : limits, rt : reftype}:
+    `|-%<:%`(`%%`(lim_1, rt), `%%`(lim_2, rt))
+    -- Limits_sub: `|-%<:%`(lim_1, lim_2)
+
+;; 3-typing.watsup:79.1-79.72
+relation Memtype_sub: `|-%<:%`(memtype, memtype)
+  ;; 3-typing.watsup:98.1-100.35
+  rule _ {lim_1 : limits, lim_2 : limits}:
+    `|-%<:%`(`%I8`(lim_1), `%I8`(lim_2))
+    -- Limits_sub: `|-%<:%`(lim_1, lim_2)
+
+;; 3-typing.watsup:80.1-80.75
+relation Externtype_sub: `|-%<:%`(externtype, externtype)
+  ;; 3-typing.watsup:103.1-105.35
+  rule func {ft_1 : functype, ft_2 : functype}:
+    `|-%<:%`(FUNC_externtype(ft_1), FUNC_externtype(ft_2))
+    -- Functype_sub: `|-%<:%`(ft_1, ft_2)
+
+  ;; 3-typing.watsup:107.1-109.37
+  rule global {gt_1 : globaltype, gt_2 : globaltype}:
+    `|-%<:%`(GLOBAL_externtype(gt_1), GLOBAL_externtype(gt_2))
+    -- Globaltype_sub: `|-%<:%`(gt_1, gt_2)
+
+  ;; 3-typing.watsup:111.1-113.36
+  rule table {tt_1 : tabletype, tt_2 : tabletype}:
+    `|-%<:%`(TABLE_externtype(tt_1), TABLE_externtype(tt_2))
+    -- Tabletype_sub: `|-%<:%`(tt_1, tt_2)
+
+  ;; 3-typing.watsup:115.1-117.34
+  rule mem {mt_1 : memtype, mt_2 : memtype}:
+    `|-%<:%`(MEMORY_externtype(mt_1), MEMORY_externtype(mt_2))
+    -- Memtype_sub: `|-%<:%`(mt_1, mt_2)
+
+;; 3-typing.watsup:172.1-172.76
+relation Blocktype_ok: `%|-%:%`(context, blocktype, functype)
+  ;; 3-typing.watsup:174.1-176.29
+  rule _ {C : context, ft : functype}:
+    `%|-%:%`(C, ft, ft)
+    -- Functype_ok: `|-%:OK`(ft)
+
+;; 3-typing.watsup:123.1-124.67
+rec {
+
+;; 3-typing.watsup:123.1-123.66
+relation Instr_ok: `%|-%:%`(context, instr, functype)
+  ;; 3-typing.watsup:153.1-154.34
+  rule unreachable {C : context, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, UNREACHABLE_instr, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:156.1-157.32
+  rule nop {C : context}:
+    `%|-%:%`(C, NOP_instr, `%->%`([], []))
+
+  ;; 3-typing.watsup:159.1-160.27
+  rule drop {C : context, t : valtype}:
+    `%|-%:%`(C, DROP_instr, `%->%`([t], []))
+
+  ;; 3-typing.watsup:163.1-164.31
+  rule select-expl {C : context, t : valtype}:
+    `%|-%:%`(C, SELECT_instr(?(t)), `%->%`([t t I32_valtype], [t]))
+
+  ;; 3-typing.watsup:166.1-169.37
+  rule select-impl {C : context, numtype : numtype, t : valtype, t' : valtype, vectype : vectype}:
+    `%|-%:%`(C, SELECT_instr(?()), `%->%`([t t I32_valtype], [t]))
+    -- Valtype_sub: `|-%<:%`(t, t')
+    -- if ((t' = (numtype <: valtype)) \/ (t' = (vectype <: valtype)))
+
+  ;; 3-typing.watsup:178.1-181.57
+  rule block {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BLOCK_instr(bt, instr*{instr}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:183.1-186.57
+  rule loop {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, LOOP_instr(bt, instr*{instr}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_1]*{t_1}, RETURN ?()}, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:188.1-192.59
+  rule if {C : context, bt : blocktype, instr_1* : instr*, instr_2* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, IF_instr(bt, instr_1*{instr_1}, instr_2*{instr_2}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr_1*{instr_1}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr_2*{instr_2}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:195.1-197.24
+  rule br {C : context, l : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BR_instr(l), `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- if (C.LABEL_context[l] = t*{t})
+
+  ;; 3-typing.watsup:199.1-201.24
+  rule br_if {C : context, l : labelidx, t* : valtype*}:
+    `%|-%:%`(C, BR_IF_instr(l), `%->%`(t*{t} :: [I32_valtype], t*{t}))
+    -- if (C.LABEL_context[l] = t*{t})
+
+  ;; 3-typing.watsup:203.1-206.42
+  rule br_table {C : context, l* : labelidx*, l' : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BR_TABLE_instr(l*{l}, l'), `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- (Resulttype_sub: `|-%*<:%*`(t*{t}, C.LABEL_context[l]))*{l}
+    -- Resulttype_sub: `|-%*<:%*`(t*{t}, C.LABEL_context[l'])
+
+  ;; 3-typing.watsup:208.1-210.24
+  rule return {C : context, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, RETURN_instr, `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- if (C.RETURN_context = ?(t*{t}))
+
+  ;; 3-typing.watsup:212.1-214.33
+  rule call {C : context, t_1* : valtype*, t_2* : valtype*, x : idx}:
+    `%|-%:%`(C, CALL_instr(x), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- if (C.FUNC_context[x] = `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:216.1-219.26
+  rule call_indirect {C : context, ft : functype, lim : limits, t_1* : valtype*, t_2* : valtype*, x : idx}:
+    `%|-%:%`(C, CALL_INDIRECT_instr(x, ft), `%->%`(t_1*{t_1} :: [I32_valtype], t_2*{t_2}))
+    -- if (C.TABLE_context[x] = `%%`(lim, FUNCREF_reftype))
+    -- if (ft = `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:222.1-223.37
+  rule const {C : context, c_nt : c_numtype, nt : numtype}:
+    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [(nt <: valtype)]))
+
+  ;; 3-typing.watsup:225.1-226.31
+  rule unop {C : context, nt : numtype, unop : unop_numtype}:
+    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
+
+  ;; 3-typing.watsup:228.1-229.36
+  rule binop {C : context, binop : binop_numtype, nt : numtype}:
+    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([(nt <: valtype) (nt <: valtype)], [(nt <: valtype)]))
+
+  ;; 3-typing.watsup:231.1-232.36
+  rule testop {C : context, nt : numtype, testop : testop_numtype}:
+    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([(nt <: valtype)], [I32_valtype]))
+
+  ;; 3-typing.watsup:234.1-235.37
+  rule relop {C : context, nt : numtype, relop : relop_numtype}:
+    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([(nt <: valtype) (nt <: valtype)], [I32_valtype]))
+
+  ;; 3-typing.watsup:238.1-240.23
+  rule extend {C : context, n : n, nt : numtype}:
+    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
+    -- if (n <= !($size(nt <: valtype)))
+
+  ;; 3-typing.watsup:242.1-245.34
+  rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype}:
+    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([(nt_2 <: valtype)], [(nt_1 <: valtype)]))
+    -- if (nt_1 =/= nt_2)
+    -- if (!($size(nt_1 <: valtype)) = !($size(nt_2 <: valtype)))
+
+  ;; 3-typing.watsup:247.1-250.52
+  rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?}:
+    `%|-%:%`(C, CVTOP_instr((in_1 <: numtype), CONVERT_cvtop, (in_2 <: numtype), sx?{sx}), `%->%`([(in_2 <: valtype)], [(in_1 <: valtype)]))
+    -- if (in_1 =/= in_2)
+    -- if ((sx?{sx} = ?()) <=> (!($size(in_1 <: valtype)) > !($size(in_2 <: valtype))))
+
+  ;; 3-typing.watsup:252.1-254.22
+  rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
+    `%|-%:%`(C, CVTOP_instr((fn_1 <: numtype), CONVERT_cvtop, (fn_2 <: numtype), ?()), `%->%`([(fn_2 <: valtype)], [(fn_1 <: valtype)]))
+    -- if (fn_1 =/= fn_2)
+
+  ;; 3-typing.watsup:257.1-258.35
+  rule ref.null {C : context, rt : reftype}:
+    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [(rt <: valtype)]))
+
+  ;; 3-typing.watsup:260.1-262.23
+  rule ref.func {C : context, ft : functype, x : idx}:
+    `%|-%:%`(C, REF.FUNC_instr(x), `%->%`([], [FUNCREF_valtype]))
+    -- if (C.FUNC_context[x] = ft)
+
+  ;; 3-typing.watsup:264.1-265.31
+  rule ref.is_null {C : context, rt : reftype}:
+    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([(rt <: valtype)], [I32_valtype]))
+
+  ;; 3-typing.watsup:268.1-270.23
+  rule local.get {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.GET_instr(x), `%->%`([], [t]))
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:272.1-274.23
+  rule local.set {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.SET_instr(x), `%->%`([t], []))
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:276.1-278.23
+  rule local.tee {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.TEE_instr(x), `%->%`([t], [t]))
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:281.1-283.29
+  rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
+    `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
+    -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
+
+  ;; 3-typing.watsup:285.1-287.28
+  rule global.set {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
+    -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
+
+  ;; 3-typing.watsup:290.1-292.28
+  rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [(rt <: valtype)]))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:294.1-296.28
+  rule table.set {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype (rt <: valtype)], []))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:298.1-300.24
+  rule table.size {C : context, tt : tabletype, x : idx}:
+    `%|-%:%`(C, TABLE.SIZE_instr(x), `%->%`([], [I32_valtype]))
+    -- if (C.TABLE_context[x] = tt)
+
+  ;; 3-typing.watsup:302.1-304.28
+  rule table.grow {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([(rt <: valtype) I32_valtype], [I32_valtype]))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:306.1-308.28
+  rule table.fill {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype (rt <: valtype) I32_valtype], []))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:310.1-313.32
+  rule table.copy {C : context, lim_1 : limits, lim_2 : limits, rt : reftype, x_1 : idx, x_2 : idx}:
+    `%|-%:%`(C, TABLE.COPY_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (C.TABLE_context[x_1] = `%%`(lim_1, rt))
+    -- if (C.TABLE_context[x_2] = `%%`(lim_2, rt))
+
+  ;; 3-typing.watsup:315.1-318.25
+  rule table.init {C : context, lim : limits, rt : reftype, x_1 : idx, x_2 : idx}:
+    `%|-%:%`(C, TABLE.INIT_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (C.TABLE_context[x_1] = `%%`(lim, rt))
+    -- if (C.ELEM_context[x_2] = rt)
+
+  ;; 3-typing.watsup:320.1-322.23
+  rule elem.drop {C : context, rt : reftype, x : idx}:
+    `%|-%:%`(C, ELEM.DROP_instr(x), `%->%`([], []))
+    -- if (C.ELEM_context[x] = rt)
+
+  ;; 3-typing.watsup:325.1-327.22
+  rule memory.size {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.SIZE_instr, `%->%`([], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:329.1-331.22
+  rule memory.grow {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.GROW_instr, `%->%`([I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:333.1-335.22
+  rule memory.fill {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.FILL_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:337.1-339.22
+  rule memory.copy {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.COPY_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:341.1-344.23
+  rule memory.init {C : context, mt : memtype, x : idx}:
+    `%|-%:%`(C, MEMORY.INIT_instr(x), `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+    -- if (C.DATA_context[x] = OK)
+
+  ;; 3-typing.watsup:346.1-348.23
+  rule data.drop {C : context, x : idx}:
+    `%|-%:%`(C, DATA.DROP_instr(x), `%->%`([], []))
+    -- if (C.DATA_context[x] = OK)
+
+  ;; 3-typing.watsup:350.1-355.32
+  rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?}:
+    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
+    -- if (C.MEM_context[0] = mt)
+    -- if ((2 ^ n_A) <= (!($size(nt <: valtype)) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size(nt <: valtype)) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = (in <: numtype)))
+
+  ;; 3-typing.watsup:357.1-362.32
+  rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype}:
+    `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype (nt <: valtype)], []))
+    -- if (C.MEM_context[0] = mt)
+    -- if ((2 ^ n_A) <= (!($size(nt <: valtype)) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size(nt <: valtype)) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = (in <: numtype)))
+
+;; 3-typing.watsup:124.1-124.67
+relation InstrSeq_ok: `%|-%*:%`(context, instr*, functype)
+  ;; 3-typing.watsup:133.1-134.36
+  rule empty {C : context}:
+    `%|-%*:%`(C, [], `%->%`([], []))
+
+  ;; 3-typing.watsup:136.1-139.46
+  rule seq {C : context, instr_1 : instr, instr_2 : instr, t_1* : valtype*, t_2* : valtype*, t_3* : valtype*}:
+    `%|-%*:%`(C, [instr_1] :: instr_2*{}, `%->%`(t_1*{t_1}, t_3*{t_3}))
+    -- Instr_ok: `%|-%:%`(C, instr_1, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, [instr_2], `%->%`(t_2*{t_2}, t_3*{t_3}))
+
+  ;; 3-typing.watsup:141.1-146.38
+  rule weak {C : context, instr* : instr*, t'_1 : valtype, t'_2* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%*:%`(C, instr*{instr}, `%->%`([t'_1], t'_2*{t'_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Resulttype_sub: `|-%*<:%*`(t'_1*{}, t_1*{t_1})
+    -- Resulttype_sub: `|-%*<:%*`(t_2*{t_2}, t'_2*{t'_2})
+
+  ;; 3-typing.watsup:148.1-150.45
+  rule frame {C : context, instr* : instr*, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%*:%`(C, instr*{instr}, `%->%`(t*{t} :: t_1*{t_1}, t*{t} :: t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+}
+
+;; 3-typing.watsup:125.1-125.71
+relation Expr_ok: `%|-%:%`(context, expr, resulttype)
+  ;; 3-typing.watsup:128.1-130.46
+  rule _ {C : context, instr* : instr*, t* : valtype*}:
+    `%|-%:%`(C, instr*{instr}, t*{t})
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`([], t*{t}))
+
+;; 3-typing.watsup:367.1-367.78
+relation Instr_const: `%|-%CONST`(context, instr)
+  ;; 3-typing.watsup:371.1-372.26
+  rule const {C : context, c : c_numtype, nt : numtype}:
+    `%|-%CONST`(C, CONST_instr(nt, c))
+
+  ;; 3-typing.watsup:374.1-375.27
+  rule ref.null {C : context, rt : reftype}:
+    `%|-%CONST`(C, REF.NULL_instr(rt))
+
+  ;; 3-typing.watsup:377.1-378.26
+  rule ref.func {C : context, x : idx}:
+    `%|-%CONST`(C, REF.FUNC_instr(x))
+
+  ;; 3-typing.watsup:380.1-382.32
+  rule global.get {C : context, t : valtype, x : idx}:
+    `%|-%CONST`(C, GLOBAL.GET_instr(x))
+    -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
+
+;; 3-typing.watsup:368.1-368.77
+relation Expr_const: `%|-%CONST`(context, expr)
+  ;; 3-typing.watsup:385.1-386.38
+  rule _ {C : context, instr* : instr*}:
+    `%|-%CONST`(C, instr*{instr})
+    -- (Instr_const: `%|-%CONST`(C, instr))*{instr}
+
+;; 3-typing.watsup:369.1-369.78
+relation Expr_ok_const: `%|-%:%CONST`(context, expr, valtype)
+  ;; 3-typing.watsup:389.1-392.33
+  rule _ {C : context, expr : expr, t : valtype}:
+    `%|-%:%CONST`(C, expr, t)
+    -- Expr_ok: `%|-%:%`(C, expr, [t])
+    -- Expr_const: `%|-%CONST`(C, expr)
+
+;; 3-typing.watsup:397.1-397.73
+relation Func_ok: `%|-%:%`(context, func, functype)
+  ;; 3-typing.watsup:408.1-412.75
+  rule _ {C : context, expr : expr, ft : functype, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, `FUNC%%*%`(ft, t*{t}, expr), ft)
+    -- if (ft = `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Functype_ok: `|-%:OK`(ft)
+    -- Expr_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL t_1*{t_1} :: t*{t}, LABEL [], RETURN ?()} ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2*{t_2}], RETURN ?()} ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [], RETURN ?(t_2*{t_2})}, expr, t_2*{t_2})
+
+;; 3-typing.watsup:398.1-398.75
+relation Global_ok: `%|-%:%`(context, global, globaltype)
+  ;; 3-typing.watsup:414.1-418.40
+  rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
+    `%|-%:%`(C, GLOBAL(gt, expr), gt)
+    -- Globaltype_ok: `|-%:OK`(gt)
+    -- if (gt = `%?%`(MUT?{}, t))
+    -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
+
+;; 3-typing.watsup:399.1-399.74
+relation Table_ok: `%|-%:%`(context, table, tabletype)
+  ;; 3-typing.watsup:420.1-422.30
+  rule _ {C : context, tt : tabletype}:
+    `%|-%:%`(C, TABLE(tt), tt)
+    -- Tabletype_ok: `|-%:OK`(tt)
+
+;; 3-typing.watsup:400.1-400.72
+relation Mem_ok: `%|-%:%`(context, mem, memtype)
+  ;; 3-typing.watsup:424.1-426.28
+  rule _ {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY(mt), mt)
+    -- Memtype_ok: `|-%:OK`(mt)
+
+;; 3-typing.watsup:403.1-403.77
+relation Elemmode_ok: `%|-%:%`(context, elemmode, reftype)
+  ;; 3-typing.watsup:437.1-440.45
+  rule active {C : context, expr : expr, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE_elemmode(x, expr), rt)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+    -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*{}
+
+  ;; 3-typing.watsup:442.1-443.20
+  rule declare {C : context, rt : reftype}:
+    `%|-%:%`(C, DECLARE_elemmode, rt)
+
+;; 3-typing.watsup:401.1-401.73
+relation Elem_ok: `%|-%:%`(context, elem, reftype)
+  ;; 3-typing.watsup:428.1-431.40
+  rule _ {C : context, elemmode? : elemmode?, expr* : expr*, rt : reftype}:
+    `%|-%:%`(C, `ELEM%%*%?`(rt, expr*{expr}, elemmode?{elemmode}), rt)
+    -- (Expr_ok: `%|-%:%`(C, expr, [(rt <: valtype)]))*{expr}
+    -- (Elemmode_ok: `%|-%:%`(C, elemmode, rt))?{elemmode}
+
+;; 3-typing.watsup:404.1-404.77
+relation Datamode_ok: `%|-%:OK`(context, datamode)
+  ;; 3-typing.watsup:445.1-448.45
+  rule _ {C : context, expr : expr, mt : memtype}:
+    `%|-%:OK`(C, MEMORY_datamode(0, expr))
+    -- if (C.MEM_context[0] = mt)
+    -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*{}
+
+;; 3-typing.watsup:402.1-402.73
+relation Data_ok: `%|-%:OK`(context, data)
+  ;; 3-typing.watsup:433.1-435.40
+  rule _ {C : context, b** : byte**, datamode? : datamode?}:
+    `%|-%:OK`(C, `DATA(*)%*%?`(b*{b}*{b}, datamode?{datamode}))
+    -- (Datamode_ok: `%|-%:OK`(C, datamode))?{datamode}
+
+;; 3-typing.watsup:405.1-405.74
+relation Start_ok: `%|-%:OK`(context, start)
+  ;; 3-typing.watsup:450.1-452.39
+  rule _ {C : context, x : idx}:
+    `%|-%:OK`(C, START(x))
+    -- if (C.FUNC_context[x] = `%->%`([], []))
+
+;; 3-typing.watsup:455.1-455.80
+relation Import_ok: `%|-%:%`(context, import, externtype)
+  ;; 3-typing.watsup:459.1-461.31
+  rule _ {C : context, name_1 : name, name_2 : name, xt : externtype}:
+    `%|-%:%`(C, IMPORT(name_1, name_2, xt), xt)
+    -- Externtype_ok: `|-%:OK`(xt)
+
+;; 3-typing.watsup:457.1-457.83
+relation Externuse_ok: `%|-%:%`(context, externuse, externtype)
+  ;; 3-typing.watsup:467.1-469.23
+  rule func {C : context, ft : functype, x : idx}:
+    `%|-%:%`(C, FUNC_externuse(x), FUNC_externtype(ft))
+    -- if (C.FUNC_context[x] = ft)
+
+  ;; 3-typing.watsup:471.1-473.25
+  rule global {C : context, gt : globaltype, x : idx}:
+    `%|-%:%`(C, GLOBAL_externuse(x), GLOBAL_externtype(gt))
+    -- if (C.GLOBAL_context[x] = gt)
+
+  ;; 3-typing.watsup:475.1-477.24
+  rule table {C : context, tt : tabletype, x : idx}:
+    `%|-%:%`(C, TABLE_externuse(x), TABLE_externtype(tt))
+    -- if (C.TABLE_context[x] = tt)
+
+  ;; 3-typing.watsup:479.1-481.22
+  rule mem {C : context, mt : memtype, x : idx}:
+    `%|-%:%`(C, MEMORY_externuse(x), MEMORY_externtype(mt))
+    -- if (C.MEM_context[x] = mt)
+
+;; 3-typing.watsup:456.1-456.80
+relation Export_ok: `%|-%:%`(context, export, externtype)
+  ;; 3-typing.watsup:463.1-465.39
+  rule _ {C : context, externuse : externuse, name : name, xt : externtype}:
+    `%|-%:%`(C, EXPORT(name, externuse), xt)
+    -- Externuse_ok: `%|-%:%`(C, externuse, xt)
+
+;; 3-typing.watsup:484.1-484.62
+relation Module_ok: `|-%:OK`(module)
+  ;; 3-typing.watsup:486.1-501.22
+  rule _ {C : context, data^n : data^n, elem* : elem*, export* : export*, ft* : functype*, func* : func*, global* : global*, gt* : globaltype*, import* : import*, mem* : mem*, mt* : memtype*, n : n, rt* : reftype*, start* : start*, table* : table*, tt* : tabletype*}:
+    `|-%:OK`(`MODULE%*%*%*%*%*%*%*%*%*`(import*{import}, func*{func}, global*{global}, table*{table}, mem*{mem}, elem*{elem}, data^n{data}, start*{start}, export*{export}))
+    -- if (C = {FUNC ft*{ft}, GLOBAL gt*{gt}, TABLE tt*{tt}, MEM mt*{mt}, ELEM rt*{rt}, DATA OK^n{}, LOCAL [], LABEL [], RETURN ?()})
+    -- (Func_ok: `%|-%:%`(C, func, ft))*{ft func}
+    -- (Global_ok: `%|-%:%`(C, global, gt))*{global gt}
+    -- (Table_ok: `%|-%:%`(C, table, tt))*{table tt}
+    -- (Mem_ok: `%|-%:%`(C, mem, mt))*{mem mt}
+    -- (Elem_ok: `%|-%:%`(C, elem, rt))*{elem rt}
+    -- (Data_ok: `%|-%:OK`(C, data))^n{data}
+    -- (Start_ok: `%|-%:OK`(C, start))*{start}
+    -- if (|mem*{mem}| <= 1)
+    -- if (|start*{start}| <= 1)
+
+;; 4-runtime.watsup:3.1-3.39
+syntax addr = nat
+
+;; 4-runtime.watsup:4.1-4.53
+syntax funcaddr = addr
+
+;; 4-runtime.watsup:5.1-5.53
+syntax globaladdr = addr
+
+;; 4-runtime.watsup:6.1-6.51
+syntax tableaddr = addr
+
+;; 4-runtime.watsup:7.1-7.50
+syntax memaddr = addr
+
+;; 4-runtime.watsup:8.1-8.49
+syntax elemaddr = addr
+
+;; 4-runtime.watsup:9.1-9.49
+syntax dataaddr = addr
+
+;; 4-runtime.watsup:10.1-10.51
+syntax labeladdr = addr
+
+;; 4-runtime.watsup:11.1-11.49
+syntax hostaddr = addr
+
+;; 4-runtime.watsup:24.1-25.24
+syntax num =
+  | CONST(numtype, c_numtype)
+
+;; 4-runtime.watsup:26.1-27.67
+syntax ref =
+  | REF.NULL(reftype)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+
+;; 4-runtime.watsup:28.1-29.10
+syntax val =
+  | CONST(numtype, c_numtype)
+  | REF.NULL(reftype)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+
+;; 4-runtime.watsup:31.1-32.18
+syntax result =
+  | _VALS(val*)
+  | TRAP
+
+;; 4-runtime.watsup:38.1-39.66
+syntax externval =
+  | FUNC(funcaddr)
+  | GLOBAL(globaladdr)
+  | TABLE(tableaddr)
+  | MEM(memaddr)
+
+;; 4-runtime.watsup:44.1-44.44
+def default_ : valtype -> val?
+  ;; 4-runtime.watsup:45.1-45.35
+  def default_(I32_valtype) = ?(CONST_val(I32_numtype, 0))
+  ;; 4-runtime.watsup:46.1-46.35
+  def default_(I64_valtype) = ?(CONST_val(I64_numtype, 0))
+  ;; 4-runtime.watsup:47.1-47.35
+  def default_(F32_valtype) = ?(CONST_val(F32_numtype, 0))
+  ;; 4-runtime.watsup:48.1-48.35
+  def default_(F64_valtype) = ?(CONST_val(F64_numtype, 0))
+  ;; 4-runtime.watsup:49.1-49.44
+  def default_(FUNCREF_valtype) = ?(REF.NULL_val(FUNCREF_reftype))
+  ;; 4-runtime.watsup:50.1-50.48
+  def default_(EXTERNREF_valtype) = ?(REF.NULL_val(EXTERNREF_reftype))
+  ;;
+  def {x : valtype} default_(x) = ?()
+
+;; 4-runtime.watsup:61.1-61.71
+syntax exportinst = EXPORT(name, externval)
+
+;; 4-runtime.watsup:71.1-78.25
+syntax moduleinst = {FUNC funcaddr*, GLOBAL globaladdr*, TABLE tableaddr*, MEM memaddr*, ELEM elemaddr*, DATA dataaddr*, EXPORT exportinst*}
+
+;; 4-runtime.watsup:55.1-55.66
+syntax funcinst = `%;%`(moduleinst, func)
+
+;; 4-runtime.watsup:56.1-56.53
+syntax globalinst = val
+
+;; 4-runtime.watsup:57.1-57.52
+syntax tableinst = ref*
+
+;; 4-runtime.watsup:58.1-58.52
+syntax meminst = byte*
+
+;; 4-runtime.watsup:59.1-59.53
+syntax eleminst = ref*
+
+;; 4-runtime.watsup:60.1-60.51
+syntax datainst = byte*
+
+;; 4-runtime.watsup:63.1-69.21
+syntax store = {FUNC funcinst*, GLOBAL globalinst*, TABLE tableinst*, MEM meminst*, ELEM eleminst*, DATA datainst*}
+
+;; 4-runtime.watsup:80.1-82.24
+syntax frame = {LOCAL val*, MODULE moduleinst}
+
+;; 4-runtime.watsup:83.1-83.47
+syntax state = `%;%`(store, frame)
+
+;; 4-runtime.watsup:140.1-147.5
+rec {
+
+;; 4-runtime.watsup:140.1-147.5
+syntax admininstr =
+  | UNREACHABLE
+  | NOP
+  | DROP
+  | SELECT(valtype?)
+  | BLOCK(blocktype, instr*)
+  | LOOP(blocktype, instr*)
+  | IF(blocktype, instr*, instr*)
+  | BR(labelidx)
+  | BR_IF(labelidx)
+  | BR_TABLE(labelidx*, labelidx)
+  | CALL(funcidx)
+  | CALL_INDIRECT(tableidx, functype)
+  | RETURN
+  | CONST(numtype, c_numtype)
+  | UNOP(numtype, unop_numtype)
+  | BINOP(numtype, binop_numtype)
+  | TESTOP(numtype, testop_numtype)
+  | RELOP(numtype, relop_numtype)
+  | EXTEND(numtype, n)
+  | CVTOP(numtype, cvtop, numtype, sx?)
+  | REF.NULL(reftype)
+  | REF.FUNC(funcidx)
+  | REF.IS_NULL
+  | LOCAL.GET(localidx)
+  | LOCAL.SET(localidx)
+  | LOCAL.TEE(localidx)
+  | GLOBAL.GET(globalidx)
+  | GLOBAL.SET(globalidx)
+  | TABLE.GET(tableidx)
+  | TABLE.SET(tableidx)
+  | TABLE.SIZE(tableidx)
+  | TABLE.GROW(tableidx)
+  | TABLE.FILL(tableidx)
+  | TABLE.COPY(tableidx, tableidx)
+  | TABLE.INIT(tableidx, elemidx)
+  | ELEM.DROP(elemidx)
+  | MEMORY.SIZE
+  | MEMORY.GROW
+  | MEMORY.FILL
+  | MEMORY.COPY
+  | MEMORY.INIT(dataidx)
+  | DATA.DROP(dataidx)
+  | LOAD(numtype, (n, sx)?, nat, nat)
+  | STORE(numtype, n?, nat, nat)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+  | CALL_ADDR(funcaddr)
+  | LABEL_(n, instr*, admininstr*)
+  | FRAME_(n, frame, admininstr*)
+  | TRAP
+}
+
+;; 4-runtime.watsup:84.1-84.62
+syntax config = `%;%*`(state, admininstr*)
+
+;; 4-runtime.watsup:102.1-102.59
+def funcaddr : state -> funcaddr*
+  ;; 4-runtime.watsup:103.1-103.38
+  def {f : frame, s : store} funcaddr(`%;%`(s, f)) = f.MODULE_frame.FUNC_moduleinst
+
+;; 4-runtime.watsup:105.1-105.52
+def funcinst : state -> funcinst*
+  ;; 4-runtime.watsup:106.1-106.31
+  def {f : frame, s : store} funcinst(`%;%`(s, f)) = s.FUNC_store
+
+;; 4-runtime.watsup:108.1-108.67
+def func : (state, funcidx) -> funcinst
+  ;; 4-runtime.watsup:116.1-116.48
+  def {f : frame, s : store, x : idx} func(`%;%`(s, f), x) = s.FUNC_store[f.MODULE_frame.FUNC_moduleinst[x]]
+
+;; 4-runtime.watsup:109.1-109.69
+def global : (state, globalidx) -> globalinst
+  ;; 4-runtime.watsup:117.1-117.54
+  def {f : frame, s : store, x : idx} global(`%;%`(s, f), x) = s.GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]]
+
+;; 4-runtime.watsup:110.1-110.68
+def table : (state, tableidx) -> tableinst
+  ;; 4-runtime.watsup:118.1-118.51
+  def {f : frame, s : store, x : idx} table(`%;%`(s, f), x) = s.TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]]
+
+;; 4-runtime.watsup:111.1-111.66
+def mem : (state, memidx) -> meminst
+  ;; 4-runtime.watsup:119.1-119.45
+  def {f : frame, s : store, x : idx} mem(`%;%`(s, f), x) = s.MEM_store[f.MODULE_frame.MEM_moduleinst[x]]
+
+;; 4-runtime.watsup:112.1-112.67
+def elem : (state, tableidx) -> eleminst
+  ;; 4-runtime.watsup:120.1-120.48
+  def {f : frame, s : store, x : idx} elem(`%;%`(s, f), x) = s.ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]]
+
+;; 4-runtime.watsup:113.1-113.67
+def data : (state, dataidx) -> datainst
+  ;; 4-runtime.watsup:121.1-121.48
+  def {f : frame, s : store, x : idx} data(`%;%`(s, f), x) = s.DATA_store[f.MODULE_frame.DATA_moduleinst[x]]
+
+;; 4-runtime.watsup:114.1-114.68
+def local : (state, localidx) -> val
+  ;; 4-runtime.watsup:122.1-122.35
+  def {f : frame, s : store, x : idx} local(`%;%`(s, f), x) = f.LOCAL_frame[x]
+
+;; 4-runtime.watsup:125.1-125.78
+def with_local : (state, localidx, val) -> state
+  ;; 4-runtime.watsup:131.1-131.52
+  def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL[x] = v])
+
+;; 4-runtime.watsup:126.1-126.79
+def with_global : (state, globalidx, val) -> state
+  ;; 4-runtime.watsup:132.1-132.71
+  def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
+
+;; 4-runtime.watsup:127.1-127.81
+def with_table : (state, tableidx, n, ref) -> state
+  ;; 4-runtime.watsup:133.1-133.74
+  def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
+
+;; 4-runtime.watsup:128.1-128.80
+def with_tableext : (state, tableidx, ref*) -> state
+  ;; 4-runtime.watsup:134.1-134.75
+  def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
+
+;; 4-runtime.watsup:129.1-129.77
+def with_elem : (state, elemidx, ref*) -> state
+  ;; 4-runtime.watsup:135.1-135.69
+  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
+
+;; 4-runtime.watsup:149.1-152.21
+rec {
+
+;; 4-runtime.watsup:149.1-152.21
+syntax E =
+  | _HOLE
+  | _SEQ(val*, E, instr*)
+  | LABEL_(n, instr*, E)
+}
+
+;; 5-numerics.watsup:3.1-3.76
+def unop : (unop_numtype, numtype, c_numtype) -> c_numtype*
+
+;; 5-numerics.watsup:4.1-4.79
+def binop : (binop_numtype, numtype, c_numtype, c_numtype) -> c_numtype*
+
+;; 5-numerics.watsup:5.1-5.76
+def testop : (testop_numtype, numtype, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:6.1-6.79
+def relop : (relop_numtype, numtype, c_numtype, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:8.1-8.84
+def ext : (nat, nat, sx, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:9.1-9.84
+def cvtop : (numtype, cvtop, numtype, sx?, c_numtype) -> c_numtype*
+
+;; 6-reduction.watsup:4.1-4.63
+relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
+  ;; 6-reduction.watsup:16.1-17.24
+  rule unreachable:
+    `%*~>%*`([UNREACHABLE_admininstr], [TRAP_admininstr])
+
+  ;; 6-reduction.watsup:19.1-20.19
+  rule nop:
+    `%*~>%*`([NOP_admininstr], [])
+
+  ;; 6-reduction.watsup:22.1-23.24
+  rule drop {val : val}:
+    `%*~>%*`([(val <: admininstr) DROP_admininstr], [])
+
+  ;; 6-reduction.watsup:26.1-28.16
+  rule select-true {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
+    `%*~>%*`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [(val_1 <: admininstr)])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:30.1-32.14
+  rule select-false {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
+    `%*~>%*`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [(val_2 <: admininstr)])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:35.1-37.28
+  rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
+    `%*~>%*`((val <: admininstr)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
+
+  ;; 6-reduction.watsup:39.1-41.28
+  rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
+    `%*~>%*`((val <: admininstr)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [LOOP_instr(bt, instr*{instr})], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
+
+  ;; 6-reduction.watsup:43.1-45.16
+  rule if-true {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*{instr_1}, instr_2*{instr_2})], [BLOCK_admininstr(bt, instr_1*{instr_1})])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:47.1-49.14
+  rule if-false {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*{instr_1}, instr_2*{instr_2})], [BLOCK_admininstr(bt, instr_2*{instr_2})])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:52.1-53.38
+  rule label-vals {instr* : instr*, n : n, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr*{instr}, (val <: admininstr)*{val})], (val <: admininstr)*{val})
+
+  ;; 6-reduction.watsup:57.1-58.69
+  rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [BR_admininstr(0)] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val} :: (instr' <: admininstr)*{instr'})
+
+  ;; 6-reduction.watsup:60.1-61.65
+  rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val <: admininstr)*{val} :: [BR_admininstr(l + 1)] :: (instr <: admininstr)*{instr})], (val <: admininstr)*{val} :: [BR_admininstr(l)])
+
+  ;; 6-reduction.watsup:64.1-66.16
+  rule br_if-true {c : c_numtype, l : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)], [BR_admininstr(l)])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:68.1-70.14
+  rule br_if-false {c : c_numtype, l : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)], [])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:73.1-75.17
+  rule br_table-lt {i : nat, l* : labelidx*, l' : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')], [BR_admininstr(l*{l}[i])])
+    -- if (i < |l*{l}|)
+
+  ;; 6-reduction.watsup:77.1-79.18
+  rule br_table-ge {i : nat, l* : labelidx*, l' : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')], [BR_admininstr(l')])
+    -- if (i >= |l*{l}|)
+
+  ;; 6-reduction.watsup:100.1-101.35
+  rule frame-vals {f : frame, n : n, val^n : val^n}:
+    `%*~>%*`([FRAME__admininstr(n, f, (val <: admininstr)^n{val})], (val <: admininstr)^n{val})
+
+  ;; 6-reduction.watsup:103.1-104.55
+  rule return-frame {f : frame, instr* : instr*, n : n, val^n : val^n, val'* : val*}:
+    `%*~>%*`([FRAME__admininstr(n, f, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val})
+
+  ;; 6-reduction.watsup:106.1-107.60
+  rule return-label {instr* : instr*, instr'* : instr*, k : nat, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(k, instr'*{instr'}, (val <: admininstr)*{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)*{val} :: [RETURN_admininstr])
+
+  ;; 6-reduction.watsup:110.1-112.33
+  rule unop-val {c : c_numtype, c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)], [CONST_admininstr(nt, c)])
+    -- if ($unop(unop, nt, c_1) = [c])
+
+  ;; 6-reduction.watsup:114.1-116.39
+  rule unop-trap {c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)], [TRAP_admininstr])
+    -- if ($unop(unop, nt, c_1) = [])
+
+  ;; 6-reduction.watsup:119.1-121.40
+  rule binop-val {binop : binop_numtype, c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)], [CONST_admininstr(nt, c)])
+    -- if ($binop(binop, nt, c_1, c_2) = [c])
+
+  ;; 6-reduction.watsup:123.1-125.46
+  rule binop-trap {binop : binop_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)], [TRAP_admininstr])
+    -- if ($binop(binop, nt, c_1, c_2) = [])
+
+  ;; 6-reduction.watsup:128.1-130.37
+  rule testop {c : c_numtype, c_1 : c_numtype, nt : numtype, testop : testop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) TESTOP_admininstr(nt, testop)], [CONST_admininstr(I32_numtype, c)])
+    -- if (c = $testop(testop, nt, c_1))
+
+  ;; 6-reduction.watsup:132.1-134.40
+  rule relop {c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype, relop : relop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) RELOP_admininstr(nt, relop)], [CONST_admininstr(I32_numtype, c)])
+    -- if (c = $relop(relop, nt, c_1, c_2))
+
+  ;; 6-reduction.watsup:137.1-138.70
+  rule extend {c : c_numtype, n : n, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, !($size(nt <: valtype)), S_sx, c))])
+
+  ;; 6-reduction.watsup:141.1-143.48
+  rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CVTOP_admininstr(nt_1, cvtop, nt_2, sx?{sx})], [CONST_admininstr(nt, c)])
+    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [c])
+
+  ;; 6-reduction.watsup:145.1-147.54
+  rule cvtop-trap {c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CVTOP_admininstr(nt_1, cvtop, nt_2, sx?{sx})], [TRAP_admininstr])
+    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [])
+
+  ;; 6-reduction.watsup:154.1-156.28
+  rule ref.is_null-true {rt : reftype, val : val}:
+    `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
+    -- if (val = REF.NULL_val(rt))
+
+  ;; 6-reduction.watsup:158.1-160.15
+  rule ref.is_null-false {val : val}:
+    `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:169.1-170.47
+  rule local.tee {val : val, x : idx}:
+    `%*~>%*`([(val <: admininstr) LOCAL.TEE_admininstr(x)], [(val <: admininstr) (val <: admininstr) LOCAL.SET_admininstr(x)])
+
+;; 6-reduction.watsup:5.1-5.63
+relation Step_read: `%~>%*`(config, admininstr*)
+  ;; 6-reduction.watsup:82.1-83.47
+  rule call {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CALL_admininstr(x)]), [CALL_ADDR_admininstr($funcaddr(z)[x])])
+
+  ;; 6-reduction.watsup:85.1-88.34
+  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [CALL_ADDR_admininstr(a)])
+    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
+    -- if ($funcinst(z)[a] = `%;%`(m, func))
+
+  ;; 6-reduction.watsup:90.1-92.15
+  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [TRAP_admininstr])
+    -- otherwise
+
+  ;; 6-reduction.watsup:94.1-97.52
+  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
+    `%~>%*`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], (instr <: admininstr)*{instr})])])
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
+    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
+
+  ;; 6-reduction.watsup:150.1-151.53
+  rule ref.func {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [REF.FUNC_admininstr(x)]), [REF.FUNC_ADDR_admininstr($funcaddr(z)[x])])
+
+  ;; 6-reduction.watsup:163.1-164.37
+  rule local.get {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [LOCAL.GET_admininstr(x)]), [($local(z, x) <: admininstr)])
+
+  ;; 6-reduction.watsup:173.1-174.39
+  rule global.get {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]), [($global(z, x) <: admininstr)])
+
+  ;; 6-reduction.watsup:180.1-182.28
+  rule table.get-trap {i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:184.1-186.27
+  rule table.get-val {i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [($table(z, x)[i] <: admininstr)])
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:188.1-190.28
+  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:197.1-199.27
+  rule table.size {n : n, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]), [CONST_admininstr(I32_numtype, n)])
+    -- if (|$table(z, x)| = n)
+
+  ;; 6-reduction.watsup:205.1-206.57
+  rule table.grow-fail {n : n, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), [CONST_admininstr(I32_numtype, - 1)])
+
+  ;; 6-reduction.watsup:209.1-211.34
+  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
+    -- if ((i + n) > |$table(z, x)|)
+
+  ;; 6-reduction.watsup:213.1-216.14
+  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:218.1-222.15
+  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) (val <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) (val <: admininstr) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:225.1-227.63
+  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [TRAP_admininstr])
+    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:229.1-232.14
+  rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:234.1-239.15
+  rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
+    -- otherwise
+    -- if (j <= i)
+
+  ;; 6-reduction.watsup:241.1-245.15
+  rule table.copy-gt {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, ((j + n) - 1)) CONST_admininstr(I32_numtype, ((i + n) - 1)) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:248.1-250.62
+  rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [TRAP_admininstr])
+    -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:252.1-255.14
+  rule table.init-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:257.1-261.15
+  rule table.init-succ {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) ($elem(z, y)[i] <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
+    -- otherwise
+
+;; 6-reduction.watsup:3.1-3.63
+relation Step: `%~>%`(config, config)
+  ;; 6-reduction.watsup:7.1-9.34
+  rule pure {instr* : instr*, instr'* : instr*, z : state}:
+    `%~>%`(`%;%*`(z, (instr <: admininstr)*{instr}), `%;%*`(z, (instr' <: admininstr)*{instr'}))
+    -- Step_pure: `%*~>%*`((instr <: admininstr)*{instr}, (instr' <: admininstr)*{instr'})
+
+  ;; 6-reduction.watsup:11.1-13.37
+  rule read {instr* : instr*, instr'* : instr*, z : state}:
+    `%~>%`(`%;%*`(z, (instr <: admininstr)*{instr}), `%;%*`(z, (instr' <: admininstr)*{instr'}))
+    -- Step_read: `%~>%*`(`%;%*`(z, (instr <: admininstr)*{instr}), (instr' <: admininstr)*{instr'})
+
+  ;; 6-reduction.watsup:166.1-167.60
+  rule local.set {val : val, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [(val <: admininstr) LOCAL.SET_admininstr(x)]), `%;%*`($with_local(z, x, val), []))
+
+  ;; 6-reduction.watsup:176.1-177.62
+  rule global.set {val : val, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [(val <: admininstr) GLOBAL.SET_admininstr(x)]), `%;%*`($with_global(z, x, val), []))
+
+  ;; 6-reduction.watsup:192.1-194.27
+  rule table.set-val {i : nat, ref : ref, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), `%;%*`($with_table(z, x, i, ref), []))
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:202.1-203.102
+  rule table.grow-succeed {n : n, ref : ref, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [(ref <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), `%;%*`($with_tableext(z, x, ref^n{}), [CONST_admininstr(I32_numtype, |$table(z, x)|)]))
+
+  ;; 6-reduction.watsup:264.1-265.59
+  rule elem.drop {x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [ELEM.DROP_admininstr(x)]), `%;%*`($with_elem(z, x, []), []))
+
+== IL Validation...
+== Side condition inference
+== Printing...
+
+;; 1-syntax.watsup:3.1-3.15
+syntax n = nat
+
+;; 1-syntax.watsup:9.1-9.37
+syntax name = text
+
+;; 1-syntax.watsup:14.1-14.36
+syntax byte = nat
+
+;; 1-syntax.watsup:15.1-15.45
+syntax u32 = nat
+
+;; 1-syntax.watsup:22.1-22.36
+syntax idx = nat
+
+;; 1-syntax.watsup:23.1-23.49
+syntax funcidx = idx
+
+;; 1-syntax.watsup:24.1-24.49
+syntax globalidx = idx
+
+;; 1-syntax.watsup:25.1-25.47
+syntax tableidx = idx
+
+;; 1-syntax.watsup:26.1-26.46
+syntax memidx = idx
+
+;; 1-syntax.watsup:27.1-27.45
+syntax elemidx = idx
+
+;; 1-syntax.watsup:28.1-28.45
+syntax dataidx = idx
+
+;; 1-syntax.watsup:29.1-29.47
+syntax labelidx = idx
+
+;; 1-syntax.watsup:30.1-30.47
+syntax localidx = idx
+
+;; 1-syntax.watsup:39.1-40.22
+syntax numtype =
+  | I32
+  | I64
+  | F32
+  | F64
+
+;; 1-syntax.watsup:41.1-42.5
+syntax vectype =
+  | V128
+
+;; 1-syntax.watsup:43.1-44.20
+syntax reftype =
+  | FUNCREF
+  | EXTERNREF
+
+;; 1-syntax.watsup:45.1-46.34
+syntax valtype =
+  | I32
+  | I64
+  | F32
+  | F64
+  | V128
+  | FUNCREF
+  | EXTERNREF
+  | BOT
+
+;; 1-syntax.watsup:48.1-48.71
+syntax in =
+  | I32
+  | I64
+
+;; 1-syntax.watsup:49.1-49.71
+syntax fn =
+  | F32
+  | F64
+
+;; 1-syntax.watsup:56.1-57.11
+syntax resulttype = valtype*
+
+;; 1-syntax.watsup:59.1-60.16
+syntax limits = `[%..%]`(u32, u32)
+
+;; 1-syntax.watsup:61.1-62.6
+syntax mutflag = MUT
+
+;; 1-syntax.watsup:63.1-64.19
+syntax globaltype = `%?%`(mutflag?, valtype)
+
+;; 1-syntax.watsup:65.1-66.27
+syntax functype = `%->%`(resulttype, resulttype)
+
+;; 1-syntax.watsup:67.1-68.17
+syntax tabletype = `%%`(limits, reftype)
+
+;; 1-syntax.watsup:69.1-70.12
+syntax memtype = `%I8`(limits)
+
+;; 1-syntax.watsup:71.1-72.10
+syntax elemtype = reftype
+
+;; 1-syntax.watsup:73.1-74.5
+syntax datatype = OK
+
+;; 1-syntax.watsup:75.1-76.69
+syntax externtype =
+  | GLOBAL(globaltype)
+  | FUNC(functype)
+  | TABLE(tabletype)
+  | MEMORY(memtype)
+
+;; 1-syntax.watsup:89.1-89.44
+syntax sx =
+  | U
+  | S
+
+;; 1-syntax.watsup:91.1-91.39
+syntax unop_IXX =
+  | CLZ
+  | CTZ
+  | POPCNT
+
+;; 1-syntax.watsup:92.1-92.70
+syntax unop_FXX =
+  | ABS
+  | NEG
+  | SQRT
+  | CEIL
+  | FLOOR
+  | TRUNC
+  | NEAREST
+
+;; 1-syntax.watsup:94.1-96.62
+syntax binop_IXX =
+  | ADD
+  | SUB
+  | MUL
+  | DIV(sx)
+  | REM(sx)
+  | AND
+  | OR
+  | XOR
+  | SHL
+  | SHR(sx)
+  | ROTL
+  | ROTR
+
+;; 1-syntax.watsup:97.1-97.66
+syntax binop_FXX =
+  | ADD
+  | SUB
+  | MUL
+  | DIV
+  | MIN
+  | MAX
+  | COPYSIGN
+
+;; 1-syntax.watsup:99.1-99.26
+syntax testop_IXX =
+  | EQZ
+
+;; 1-syntax.watsup:100.1-100.22
+syntax testop_FXX =
+  |
+
+;; 1-syntax.watsup:102.1-103.108
+syntax relop_IXX =
+  | EQ
+  | NE
+  | LT(sx)
+  | GT(sx)
+  | LE(sx)
+  | GE(sx)
+
+;; 1-syntax.watsup:104.1-104.49
+syntax relop_FXX =
+  | EQ
+  | NE
+  | LT
+  | GT
+  | LE
+  | GE
+
+;; 1-syntax.watsup:106.1-106.50
+syntax unop_numtype =
+  | _I(unop_IXX)
+  | _F(unop_FXX)
+
+;; 1-syntax.watsup:107.1-107.53
+syntax binop_numtype =
+  | _I(binop_IXX)
+  | _F(binop_FXX)
+
+;; 1-syntax.watsup:108.1-108.56
+syntax testop_numtype =
+  | _I(testop_IXX)
+  | _F(testop_FXX)
+
+;; 1-syntax.watsup:109.1-109.53
+syntax relop_numtype =
+  | _I(relop_IXX)
+  | _F(relop_FXX)
+
+;; 1-syntax.watsup:110.1-110.39
+syntax cvtop =
+  | CONVERT
+  | REINTERPRET
+
+;; 1-syntax.watsup:120.1-120.23
+syntax c_numtype = nat
+
+;; 1-syntax.watsup:121.1-121.23
+syntax c_vectype = nat
+
+;; 1-syntax.watsup:124.1-124.52
+syntax blocktype = functype
+
+;; 1-syntax.watsup:159.1-180.55
+rec {
+
+;; 1-syntax.watsup:159.1-180.55
+syntax instr =
+  | UNREACHABLE
+  | NOP
+  | DROP
+  | SELECT(valtype?)
+  | BLOCK(blocktype, instr*)
+  | LOOP(blocktype, instr*)
+  | IF(blocktype, instr*, instr*)
+  | BR(labelidx)
+  | BR_IF(labelidx)
+  | BR_TABLE(labelidx*, labelidx)
+  | CALL(funcidx)
+  | CALL_INDIRECT(tableidx, functype)
+  | RETURN
+  | CONST(numtype, c_numtype)
+  | UNOP(numtype, unop_numtype)
+  | BINOP(numtype, binop_numtype)
+  | TESTOP(numtype, testop_numtype)
+  | RELOP(numtype, relop_numtype)
+  | EXTEND(numtype, n)
+  | CVTOP(numtype, cvtop, numtype, sx?)
+  | REF.NULL(reftype)
+  | REF.FUNC(funcidx)
+  | REF.IS_NULL
+  | LOCAL.GET(localidx)
+  | LOCAL.SET(localidx)
+  | LOCAL.TEE(localidx)
+  | GLOBAL.GET(globalidx)
+  | GLOBAL.SET(globalidx)
+  | TABLE.GET(tableidx)
+  | TABLE.SET(tableidx)
+  | TABLE.SIZE(tableidx)
+  | TABLE.GROW(tableidx)
+  | TABLE.FILL(tableidx)
+  | TABLE.COPY(tableidx, tableidx)
+  | TABLE.INIT(tableidx, elemidx)
+  | ELEM.DROP(elemidx)
+  | MEMORY.SIZE
+  | MEMORY.GROW
+  | MEMORY.FILL
+  | MEMORY.COPY
+  | MEMORY.INIT(dataidx)
+  | DATA.DROP(dataidx)
+  | LOAD(numtype, (n, sx)?, nat, nat)
+  | STORE(numtype, n?, nat, nat)
+}
+
+;; 1-syntax.watsup:182.1-183.9
+syntax expr = instr*
+
+;; 1-syntax.watsup:188.1-188.50
+syntax elemmode =
+  | TABLE(tableidx, expr)
+  | DECLARE
+
+;; 1-syntax.watsup:189.1-189.39
+syntax datamode =
+  | MEMORY(memidx, expr)
+
+;; 1-syntax.watsup:191.1-192.30
+syntax func = `FUNC%%*%`(functype, valtype*, expr)
+
+;; 1-syntax.watsup:193.1-194.25
+syntax global = GLOBAL(globaltype, expr)
+
+;; 1-syntax.watsup:195.1-196.18
+syntax table = TABLE(tabletype)
+
+;; 1-syntax.watsup:197.1-198.17
+syntax mem = MEMORY(memtype)
+
+;; 1-syntax.watsup:199.1-200.31
+syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
+
+;; 1-syntax.watsup:201.1-202.26
+syntax data = `DATA(*)%*%?`(byte**, datamode?)
+
+;; 1-syntax.watsup:203.1-204.16
+syntax start = START(funcidx)
+
+;; 1-syntax.watsup:206.1-207.65
+syntax externuse =
+  | FUNC(funcidx)
+  | GLOBAL(globalidx)
+  | TABLE(tableidx)
+  | MEMORY(memidx)
+
+;; 1-syntax.watsup:208.1-209.24
+syntax export = EXPORT(name, externuse)
+
+;; 1-syntax.watsup:210.1-211.30
+syntax import = IMPORT(name, name, externtype)
+
+;; 1-syntax.watsup:213.1-214.70
+syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
+
+;; 2-aux.watsup:5.1-5.55
+def size : valtype -> nat?
+  ;; 2-aux.watsup:6.1-6.20
+  def size(I32_valtype) = ?(32)
+  ;; 2-aux.watsup:7.1-7.20
+  def size(I64_valtype) = ?(64)
+  ;; 2-aux.watsup:8.1-8.20
+  def size(F32_valtype) = ?(32)
+  ;; 2-aux.watsup:9.1-9.20
+  def size(F64_valtype) = ?(64)
+  ;; 2-aux.watsup:10.1-10.22
+  def size(V128_valtype) = ?(128)
+  ;;
+  def {x : valtype} size(x) = ?()
+
+;; 2-aux.watsup:15.1-15.40
+def test_sub_ATOM_22 : n -> nat
+  ;; 2-aux.watsup:16.1-16.38
+  def {n_3_ATOM_y : n} test_sub_ATOM_22(n_3_ATOM_y) = 0
+
+;; 2-aux.watsup:18.1-18.26
+def curried_ : (n, n) -> nat
+  ;; 2-aux.watsup:19.1-19.39
+  def {n_1 : n, n_2 : n} curried_(n_1, n_2) = (n_1 + n_2)
+
+;; 2-aux.watsup:21.1-30.39
+syntax testfuse =
+  | AB_(nat, nat, nat)
+  | CD(nat, nat, nat)
+  | EF(nat, nat, nat)
+  | GH(nat, nat, nat)
+  | IJ(nat, nat, nat)
+  | KL(nat, nat, nat)
+  | MN(nat, nat, nat)
+  | OP(nat, nat, nat)
+  | QR(nat, nat, nat)
+
+;; 3-typing.watsup:3.1-6.60
+syntax context = {FUNC functype*, GLOBAL globaltype*, TABLE tabletype*, MEM memtype*, ELEM elemtype*, DATA datatype*, LOCAL valtype*, LABEL resulttype*, RETURN resulttype?}
+
+;; 3-typing.watsup:14.1-14.66
+relation Limits_ok: `|-%:%`(limits, nat)
+  ;; 3-typing.watsup:22.1-24.24
+  rule _ {k : nat, n_1 : n, n_2 : n}:
+    `|-%:%`(`[%..%]`(n_1, n_2), k)
+    -- if ((n_1 <= n_2) /\ (n_2 <= k))
+
+;; 3-typing.watsup:15.1-15.64
+relation Functype_ok: `|-%:OK`(functype)
+  ;; 3-typing.watsup:26.1-27.13
+  rule _ {ft : functype}:
+    `|-%:OK`(ft)
+
+;; 3-typing.watsup:16.1-16.66
+relation Globaltype_ok: `|-%:OK`(globaltype)
+  ;; 3-typing.watsup:29.1-30.13
+  rule _ {gt : globaltype}:
+    `|-%:OK`(gt)
+
+;; 3-typing.watsup:17.1-17.65
+relation Tabletype_ok: `|-%:OK`(tabletype)
+  ;; 3-typing.watsup:32.1-34.35
+  rule _ {lim : limits, rt : reftype}:
+    `|-%:OK`(`%%`(lim, rt))
+    -- Limits_ok: `|-%:%`(lim, ((2 ^ 32) - 1))
+
+;; 3-typing.watsup:18.1-18.63
+relation Memtype_ok: `|-%:OK`(memtype)
+  ;; 3-typing.watsup:36.1-38.33
+  rule _ {lim : limits}:
+    `|-%:OK`(`%I8`(lim))
+    -- Limits_ok: `|-%:%`(lim, (2 ^ 16))
+
+;; 3-typing.watsup:19.1-19.66
+relation Externtype_ok: `|-%:OK`(externtype)
+  ;; 3-typing.watsup:41.1-43.35
+  rule func {functype : functype}:
+    `|-%:OK`(FUNC_externtype(functype))
+    -- Functype_ok: `|-%:OK`(functype)
+
+  ;; 3-typing.watsup:45.1-47.39
+  rule global {globaltype : globaltype}:
+    `|-%:OK`(GLOBAL_externtype(globaltype))
+    -- Globaltype_ok: `|-%:OK`(globaltype)
+
+  ;; 3-typing.watsup:49.1-51.37
+  rule table {tabletype : tabletype}:
+    `|-%:OK`(TABLE_externtype(tabletype))
+    -- Tabletype_ok: `|-%:OK`(tabletype)
+
+  ;; 3-typing.watsup:53.1-55.33
+  rule mem {memtype : memtype}:
+    `|-%:OK`(MEMORY_externtype(memtype))
+    -- Memtype_ok: `|-%:OK`(memtype)
+
+;; 3-typing.watsup:61.1-61.65
+relation Valtype_sub: `|-%<:%`(valtype, valtype)
+  ;; 3-typing.watsup:64.1-65.12
+  rule refl {t : valtype}:
+    `|-%<:%`(t, t)
+
+  ;; 3-typing.watsup:67.1-68.14
+  rule bot {t : valtype}:
+    `|-%<:%`(BOT_valtype, t)
+
+;; 3-typing.watsup:62.1-62.72
+relation Resulttype_sub: `|-%*<:%*`(valtype*, valtype*)
+  ;; 3-typing.watsup:70.1-72.35
+  rule _ {t_1* : valtype*, t_2* : valtype*}:
+    `|-%*<:%*`(t_1*{t_1}, t_2*{t_2})
+    -- (Valtype_sub: `|-%<:%`(t_1, t_2))*{t_1 t_2}
+
+;; 3-typing.watsup:75.1-75.75
+relation Limits_sub: `|-%<:%`(limits, limits)
+  ;; 3-typing.watsup:83.1-86.21
+  rule _ {n_11 : n, n_12 : n, n_21 : n, n_22 : n}:
+    `|-%<:%`(`[%..%]`(n_11, n_12), `[%..%]`(n_21, n_22))
+    -- if (n_11 >= n_21)
+    -- if (n_12 <= n_22)
+
+;; 3-typing.watsup:76.1-76.73
+relation Functype_sub: `|-%<:%`(functype, functype)
+  ;; 3-typing.watsup:88.1-89.14
+  rule _ {ft : functype}:
+    `|-%<:%`(ft, ft)
+
+;; 3-typing.watsup:77.1-77.75
+relation Globaltype_sub: `|-%<:%`(globaltype, globaltype)
+  ;; 3-typing.watsup:91.1-92.14
+  rule _ {gt : globaltype}:
+    `|-%<:%`(gt, gt)
+
+;; 3-typing.watsup:78.1-78.74
+relation Tabletype_sub: `|-%<:%`(tabletype, tabletype)
+  ;; 3-typing.watsup:94.1-96.35
+  rule _ {lim_1 : limits, lim_2 : limits, rt : reftype}:
+    `|-%<:%`(`%%`(lim_1, rt), `%%`(lim_2, rt))
+    -- Limits_sub: `|-%<:%`(lim_1, lim_2)
+
+;; 3-typing.watsup:79.1-79.72
+relation Memtype_sub: `|-%<:%`(memtype, memtype)
+  ;; 3-typing.watsup:98.1-100.35
+  rule _ {lim_1 : limits, lim_2 : limits}:
+    `|-%<:%`(`%I8`(lim_1), `%I8`(lim_2))
+    -- Limits_sub: `|-%<:%`(lim_1, lim_2)
+
+;; 3-typing.watsup:80.1-80.75
+relation Externtype_sub: `|-%<:%`(externtype, externtype)
+  ;; 3-typing.watsup:103.1-105.35
+  rule func {ft_1 : functype, ft_2 : functype}:
+    `|-%<:%`(FUNC_externtype(ft_1), FUNC_externtype(ft_2))
+    -- Functype_sub: `|-%<:%`(ft_1, ft_2)
+
+  ;; 3-typing.watsup:107.1-109.37
+  rule global {gt_1 : globaltype, gt_2 : globaltype}:
+    `|-%<:%`(GLOBAL_externtype(gt_1), GLOBAL_externtype(gt_2))
+    -- Globaltype_sub: `|-%<:%`(gt_1, gt_2)
+
+  ;; 3-typing.watsup:111.1-113.36
+  rule table {tt_1 : tabletype, tt_2 : tabletype}:
+    `|-%<:%`(TABLE_externtype(tt_1), TABLE_externtype(tt_2))
+    -- Tabletype_sub: `|-%<:%`(tt_1, tt_2)
+
+  ;; 3-typing.watsup:115.1-117.34
+  rule mem {mt_1 : memtype, mt_2 : memtype}:
+    `|-%<:%`(MEMORY_externtype(mt_1), MEMORY_externtype(mt_2))
+    -- Memtype_sub: `|-%<:%`(mt_1, mt_2)
+
+;; 3-typing.watsup:172.1-172.76
+relation Blocktype_ok: `%|-%:%`(context, blocktype, functype)
+  ;; 3-typing.watsup:174.1-176.29
+  rule _ {C : context, ft : functype}:
+    `%|-%:%`(C, ft, ft)
+    -- Functype_ok: `|-%:OK`(ft)
+
+;; 3-typing.watsup:123.1-124.67
+rec {
+
+;; 3-typing.watsup:123.1-123.66
+relation Instr_ok: `%|-%:%`(context, instr, functype)
+  ;; 3-typing.watsup:153.1-154.34
+  rule unreachable {C : context, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, UNREACHABLE_instr, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:156.1-157.32
+  rule nop {C : context}:
+    `%|-%:%`(C, NOP_instr, `%->%`([], []))
+
+  ;; 3-typing.watsup:159.1-160.27
+  rule drop {C : context, t : valtype}:
+    `%|-%:%`(C, DROP_instr, `%->%`([t], []))
+
+  ;; 3-typing.watsup:163.1-164.31
+  rule select-expl {C : context, t : valtype}:
+    `%|-%:%`(C, SELECT_instr(?(t)), `%->%`([t t I32_valtype], [t]))
+
+  ;; 3-typing.watsup:166.1-169.37
+  rule select-impl {C : context, numtype : numtype, t : valtype, t' : valtype, vectype : vectype}:
+    `%|-%:%`(C, SELECT_instr(?()), `%->%`([t t I32_valtype], [t]))
+    -- Valtype_sub: `|-%<:%`(t, t')
+    -- if ((t' = (numtype <: valtype)) \/ (t' = (vectype <: valtype)))
+
+  ;; 3-typing.watsup:178.1-181.57
+  rule block {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BLOCK_instr(bt, instr*{instr}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:183.1-186.57
+  rule loop {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, LOOP_instr(bt, instr*{instr}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_1]*{t_1}, RETURN ?()}, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:188.1-192.59
+  rule if {C : context, bt : blocktype, instr_1* : instr*, instr_2* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, IF_instr(bt, instr_1*{instr_1}, instr_2*{instr_2}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr_1*{instr_1}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr_2*{instr_2}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:195.1-197.24
+  rule br {C : context, l : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BR_instr(l), `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- if (l < |C.LABEL_context|)
+    -- if (C.LABEL_context[l] = t*{t})
+
+  ;; 3-typing.watsup:199.1-201.24
+  rule br_if {C : context, l : labelidx, t* : valtype*}:
+    `%|-%:%`(C, BR_IF_instr(l), `%->%`(t*{t} :: [I32_valtype], t*{t}))
+    -- if (l < |C.LABEL_context|)
+    -- if (C.LABEL_context[l] = t*{t})
+
+  ;; 3-typing.watsup:203.1-206.42
+  rule br_table {C : context, l* : labelidx*, l' : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BR_TABLE_instr(l*{l}, l'), `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- (if (l < |C.LABEL_context|))*{l}
+    -- if (l' < |C.LABEL_context|)
+    -- (Resulttype_sub: `|-%*<:%*`(t*{t}, C.LABEL_context[l]))*{l}
+    -- Resulttype_sub: `|-%*<:%*`(t*{t}, C.LABEL_context[l'])
+
+  ;; 3-typing.watsup:208.1-210.24
+  rule return {C : context, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, RETURN_instr, `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- if (C.RETURN_context = ?(t*{t}))
+
+  ;; 3-typing.watsup:212.1-214.33
+  rule call {C : context, t_1* : valtype*, t_2* : valtype*, x : idx}:
+    `%|-%:%`(C, CALL_instr(x), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- if (x < |C.FUNC_context|)
+    -- if (C.FUNC_context[x] = `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:216.1-219.26
+  rule call_indirect {C : context, ft : functype, lim : limits, t_1* : valtype*, t_2* : valtype*, x : idx}:
+    `%|-%:%`(C, CALL_INDIRECT_instr(x, ft), `%->%`(t_1*{t_1} :: [I32_valtype], t_2*{t_2}))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = `%%`(lim, FUNCREF_reftype))
+    -- if (ft = `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:222.1-223.37
+  rule const {C : context, c_nt : c_numtype, nt : numtype}:
+    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [(nt <: valtype)]))
+
+  ;; 3-typing.watsup:225.1-226.31
+  rule unop {C : context, nt : numtype, unop : unop_numtype}:
+    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
+
+  ;; 3-typing.watsup:228.1-229.36
+  rule binop {C : context, binop : binop_numtype, nt : numtype}:
+    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([(nt <: valtype) (nt <: valtype)], [(nt <: valtype)]))
+
+  ;; 3-typing.watsup:231.1-232.36
+  rule testop {C : context, nt : numtype, testop : testop_numtype}:
+    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([(nt <: valtype)], [I32_valtype]))
+
+  ;; 3-typing.watsup:234.1-235.37
+  rule relop {C : context, nt : numtype, relop : relop_numtype}:
+    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([(nt <: valtype) (nt <: valtype)], [I32_valtype]))
+
+  ;; 3-typing.watsup:238.1-240.23
+  rule extend {C : context, n : n, nt : numtype}:
+    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
+    -- if ($size(nt <: valtype) =/= ?())
+    -- if (n <= !($size(nt <: valtype)))
+
+  ;; 3-typing.watsup:242.1-245.34
+  rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype}:
+    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([(nt_2 <: valtype)], [(nt_1 <: valtype)]))
+    -- if ($size(nt_1 <: valtype) =/= ?())
+    -- if ($size(nt_2 <: valtype) =/= ?())
+    -- if (nt_1 =/= nt_2)
+    -- if (!($size(nt_1 <: valtype)) = !($size(nt_2 <: valtype)))
+
+  ;; 3-typing.watsup:247.1-250.52
+  rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?}:
+    `%|-%:%`(C, CVTOP_instr((in_1 <: numtype), CONVERT_cvtop, (in_2 <: numtype), sx?{sx}), `%->%`([(in_2 <: valtype)], [(in_1 <: valtype)]))
+    -- if ($size(in_1 <: valtype) =/= ?())
+    -- if ($size(in_2 <: valtype) =/= ?())
+    -- if (in_1 =/= in_2)
+    -- if ((sx?{sx} = ?()) <=> (!($size(in_1 <: valtype)) > !($size(in_2 <: valtype))))
+
+  ;; 3-typing.watsup:252.1-254.22
+  rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
+    `%|-%:%`(C, CVTOP_instr((fn_1 <: numtype), CONVERT_cvtop, (fn_2 <: numtype), ?()), `%->%`([(fn_2 <: valtype)], [(fn_1 <: valtype)]))
+    -- if (fn_1 =/= fn_2)
+
+  ;; 3-typing.watsup:257.1-258.35
+  rule ref.null {C : context, rt : reftype}:
+    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [(rt <: valtype)]))
+
+  ;; 3-typing.watsup:260.1-262.23
+  rule ref.func {C : context, ft : functype, x : idx}:
+    `%|-%:%`(C, REF.FUNC_instr(x), `%->%`([], [FUNCREF_valtype]))
+    -- if (x < |C.FUNC_context|)
+    -- if (C.FUNC_context[x] = ft)
+
+  ;; 3-typing.watsup:264.1-265.31
+  rule ref.is_null {C : context, rt : reftype}:
+    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([(rt <: valtype)], [I32_valtype]))
+
+  ;; 3-typing.watsup:268.1-270.23
+  rule local.get {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.GET_instr(x), `%->%`([], [t]))
+    -- if (x < |C.LOCAL_context|)
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:272.1-274.23
+  rule local.set {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.SET_instr(x), `%->%`([t], []))
+    -- if (x < |C.LOCAL_context|)
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:276.1-278.23
+  rule local.tee {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.TEE_instr(x), `%->%`([t], [t]))
+    -- if (x < |C.LOCAL_context|)
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:281.1-283.29
+  rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
+    `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
+    -- if (x < |C.GLOBAL_context|)
+    -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
+
+  ;; 3-typing.watsup:285.1-287.28
+  rule global.set {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
+    -- if (x < |C.GLOBAL_context|)
+    -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
+
+  ;; 3-typing.watsup:290.1-292.28
+  rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [(rt <: valtype)]))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:294.1-296.28
+  rule table.set {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype (rt <: valtype)], []))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:298.1-300.24
+  rule table.size {C : context, tt : tabletype, x : idx}:
+    `%|-%:%`(C, TABLE.SIZE_instr(x), `%->%`([], [I32_valtype]))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = tt)
+
+  ;; 3-typing.watsup:302.1-304.28
+  rule table.grow {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([(rt <: valtype) I32_valtype], [I32_valtype]))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:306.1-308.28
+  rule table.fill {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype (rt <: valtype) I32_valtype], []))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:310.1-313.32
+  rule table.copy {C : context, lim_1 : limits, lim_2 : limits, rt : reftype, x_1 : idx, x_2 : idx}:
+    `%|-%:%`(C, TABLE.COPY_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (x_1 < |C.TABLE_context|)
+    -- if (x_2 < |C.TABLE_context|)
+    -- if (C.TABLE_context[x_1] = `%%`(lim_1, rt))
+    -- if (C.TABLE_context[x_2] = `%%`(lim_2, rt))
+
+  ;; 3-typing.watsup:315.1-318.25
+  rule table.init {C : context, lim : limits, rt : reftype, x_1 : idx, x_2 : idx}:
+    `%|-%:%`(C, TABLE.INIT_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (x_1 < |C.TABLE_context|)
+    -- if (x_2 < |C.ELEM_context|)
+    -- if (C.TABLE_context[x_1] = `%%`(lim, rt))
+    -- if (C.ELEM_context[x_2] = rt)
+
+  ;; 3-typing.watsup:320.1-322.23
+  rule elem.drop {C : context, rt : reftype, x : idx}:
+    `%|-%:%`(C, ELEM.DROP_instr(x), `%->%`([], []))
+    -- if (x < |C.ELEM_context|)
+    -- if (C.ELEM_context[x] = rt)
+
+  ;; 3-typing.watsup:325.1-327.22
+  rule memory.size {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.SIZE_instr, `%->%`([], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:329.1-331.22
+  rule memory.grow {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.GROW_instr, `%->%`([I32_valtype], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:333.1-335.22
+  rule memory.fill {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.FILL_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:337.1-339.22
+  rule memory.copy {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.COPY_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:341.1-344.23
+  rule memory.init {C : context, mt : memtype, x : idx}:
+    `%|-%:%`(C, MEMORY.INIT_instr(x), `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
+    -- if (x < |C.DATA_context|)
+    -- if (C.MEM_context[0] = mt)
+    -- if (C.DATA_context[x] = OK)
+
+  ;; 3-typing.watsup:346.1-348.23
+  rule data.drop {C : context, x : idx}:
+    `%|-%:%`(C, DATA.DROP_instr(x), `%->%`([], []))
+    -- if (x < |C.DATA_context|)
+    -- if (C.DATA_context[x] = OK)
+
+  ;; 3-typing.watsup:350.1-355.32
+  rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?}:
+    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
+    -- if (0 < |C.MEM_context|)
+    -- if ($size(nt <: valtype) =/= ?())
+    -- (if ($size(nt <: valtype) =/= ?()))?{n}
+    -- if (C.MEM_context[0] = mt)
+    -- if ((2 ^ n_A) <= (!($size(nt <: valtype)) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size(nt <: valtype)) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = (in <: numtype)))
+
+  ;; 3-typing.watsup:357.1-362.32
+  rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype}:
+    `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype (nt <: valtype)], []))
+    -- if (0 < |C.MEM_context|)
+    -- if ($size(nt <: valtype) =/= ?())
+    -- (if ($size(nt <: valtype) =/= ?()))?{n}
+    -- if (C.MEM_context[0] = mt)
+    -- if ((2 ^ n_A) <= (!($size(nt <: valtype)) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size(nt <: valtype)) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = (in <: numtype)))
+
+;; 3-typing.watsup:124.1-124.67
+relation InstrSeq_ok: `%|-%*:%`(context, instr*, functype)
+  ;; 3-typing.watsup:133.1-134.36
+  rule empty {C : context}:
+    `%|-%*:%`(C, [], `%->%`([], []))
+
+  ;; 3-typing.watsup:136.1-139.46
+  rule seq {C : context, instr_1 : instr, instr_2 : instr, t_1* : valtype*, t_2* : valtype*, t_3* : valtype*}:
+    `%|-%*:%`(C, [instr_1] :: instr_2*{}, `%->%`(t_1*{t_1}, t_3*{t_3}))
+    -- Instr_ok: `%|-%:%`(C, instr_1, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, [instr_2], `%->%`(t_2*{t_2}, t_3*{t_3}))
+
+  ;; 3-typing.watsup:141.1-146.38
+  rule weak {C : context, instr* : instr*, t'_1 : valtype, t'_2* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%*:%`(C, instr*{instr}, `%->%`([t'_1], t'_2*{t'_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Resulttype_sub: `|-%*<:%*`(t'_1*{}, t_1*{t_1})
+    -- Resulttype_sub: `|-%*<:%*`(t_2*{t_2}, t'_2*{t'_2})
+
+  ;; 3-typing.watsup:148.1-150.45
+  rule frame {C : context, instr* : instr*, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%*:%`(C, instr*{instr}, `%->%`(t*{t} :: t_1*{t_1}, t*{t} :: t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+}
+
+;; 3-typing.watsup:125.1-125.71
+relation Expr_ok: `%|-%:%`(context, expr, resulttype)
+  ;; 3-typing.watsup:128.1-130.46
+  rule _ {C : context, instr* : instr*, t* : valtype*}:
+    `%|-%:%`(C, instr*{instr}, t*{t})
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`([], t*{t}))
+
+;; 3-typing.watsup:367.1-367.78
+relation Instr_const: `%|-%CONST`(context, instr)
+  ;; 3-typing.watsup:371.1-372.26
+  rule const {C : context, c : c_numtype, nt : numtype}:
+    `%|-%CONST`(C, CONST_instr(nt, c))
+
+  ;; 3-typing.watsup:374.1-375.27
+  rule ref.null {C : context, rt : reftype}:
+    `%|-%CONST`(C, REF.NULL_instr(rt))
+
+  ;; 3-typing.watsup:377.1-378.26
+  rule ref.func {C : context, x : idx}:
+    `%|-%CONST`(C, REF.FUNC_instr(x))
+
+  ;; 3-typing.watsup:380.1-382.32
+  rule global.get {C : context, t : valtype, x : idx}:
+    `%|-%CONST`(C, GLOBAL.GET_instr(x))
+    -- if (x < |C.GLOBAL_context|)
+    -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
+
+;; 3-typing.watsup:368.1-368.77
+relation Expr_const: `%|-%CONST`(context, expr)
+  ;; 3-typing.watsup:385.1-386.38
+  rule _ {C : context, instr* : instr*}:
+    `%|-%CONST`(C, instr*{instr})
+    -- (Instr_const: `%|-%CONST`(C, instr))*{instr}
+
+;; 3-typing.watsup:369.1-369.78
+relation Expr_ok_const: `%|-%:%CONST`(context, expr, valtype)
+  ;; 3-typing.watsup:389.1-392.33
+  rule _ {C : context, expr : expr, t : valtype}:
+    `%|-%:%CONST`(C, expr, t)
+    -- Expr_ok: `%|-%:%`(C, expr, [t])
+    -- Expr_const: `%|-%CONST`(C, expr)
+
+;; 3-typing.watsup:397.1-397.73
+relation Func_ok: `%|-%:%`(context, func, functype)
+  ;; 3-typing.watsup:408.1-412.75
+  rule _ {C : context, expr : expr, ft : functype, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, `FUNC%%*%`(ft, t*{t}, expr), ft)
+    -- if (ft = `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Functype_ok: `|-%:OK`(ft)
+    -- Expr_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL t_1*{t_1} :: t*{t}, LABEL [], RETURN ?()} ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2*{t_2}], RETURN ?()} ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [], RETURN ?(t_2*{t_2})}, expr, t_2*{t_2})
+
+;; 3-typing.watsup:398.1-398.75
+relation Global_ok: `%|-%:%`(context, global, globaltype)
+  ;; 3-typing.watsup:414.1-418.40
+  rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
+    `%|-%:%`(C, GLOBAL(gt, expr), gt)
+    -- Globaltype_ok: `|-%:OK`(gt)
+    -- if (gt = `%?%`(MUT?{}, t))
+    -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
+
+;; 3-typing.watsup:399.1-399.74
+relation Table_ok: `%|-%:%`(context, table, tabletype)
+  ;; 3-typing.watsup:420.1-422.30
+  rule _ {C : context, tt : tabletype}:
+    `%|-%:%`(C, TABLE(tt), tt)
+    -- Tabletype_ok: `|-%:OK`(tt)
+
+;; 3-typing.watsup:400.1-400.72
+relation Mem_ok: `%|-%:%`(context, mem, memtype)
+  ;; 3-typing.watsup:424.1-426.28
+  rule _ {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY(mt), mt)
+    -- Memtype_ok: `|-%:OK`(mt)
+
+;; 3-typing.watsup:403.1-403.77
+relation Elemmode_ok: `%|-%:%`(context, elemmode, reftype)
+  ;; 3-typing.watsup:437.1-440.45
+  rule active {C : context, expr : expr, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE_elemmode(x, expr), rt)
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+    -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*{}
+
+  ;; 3-typing.watsup:442.1-443.20
+  rule declare {C : context, rt : reftype}:
+    `%|-%:%`(C, DECLARE_elemmode, rt)
+
+;; 3-typing.watsup:401.1-401.73
+relation Elem_ok: `%|-%:%`(context, elem, reftype)
+  ;; 3-typing.watsup:428.1-431.40
+  rule _ {C : context, elemmode? : elemmode?, expr* : expr*, rt : reftype}:
+    `%|-%:%`(C, `ELEM%%*%?`(rt, expr*{expr}, elemmode?{elemmode}), rt)
+    -- (Expr_ok: `%|-%:%`(C, expr, [(rt <: valtype)]))*{expr}
+    -- (Elemmode_ok: `%|-%:%`(C, elemmode, rt))?{elemmode}
+
+;; 3-typing.watsup:404.1-404.77
+relation Datamode_ok: `%|-%:OK`(context, datamode)
+  ;; 3-typing.watsup:445.1-448.45
+  rule _ {C : context, expr : expr, mt : memtype}:
+    `%|-%:OK`(C, MEMORY_datamode(0, expr))
+    -- if (0 < |C.MEM_context|)
+    -- if (C.MEM_context[0] = mt)
+    -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*{}
+
+;; 3-typing.watsup:402.1-402.73
+relation Data_ok: `%|-%:OK`(context, data)
+  ;; 3-typing.watsup:433.1-435.40
+  rule _ {C : context, b** : byte**, datamode? : datamode?}:
+    `%|-%:OK`(C, `DATA(*)%*%?`(b*{b}*{b}, datamode?{datamode}))
+    -- (Datamode_ok: `%|-%:OK`(C, datamode))?{datamode}
+
+;; 3-typing.watsup:405.1-405.74
+relation Start_ok: `%|-%:OK`(context, start)
+  ;; 3-typing.watsup:450.1-452.39
+  rule _ {C : context, x : idx}:
+    `%|-%:OK`(C, START(x))
+    -- if (x < |C.FUNC_context|)
+    -- if (C.FUNC_context[x] = `%->%`([], []))
+
+;; 3-typing.watsup:455.1-455.80
+relation Import_ok: `%|-%:%`(context, import, externtype)
+  ;; 3-typing.watsup:459.1-461.31
+  rule _ {C : context, name_1 : name, name_2 : name, xt : externtype}:
+    `%|-%:%`(C, IMPORT(name_1, name_2, xt), xt)
+    -- Externtype_ok: `|-%:OK`(xt)
+
+;; 3-typing.watsup:457.1-457.83
+relation Externuse_ok: `%|-%:%`(context, externuse, externtype)
+  ;; 3-typing.watsup:467.1-469.23
+  rule func {C : context, ft : functype, x : idx}:
+    `%|-%:%`(C, FUNC_externuse(x), FUNC_externtype(ft))
+    -- if (x < |C.FUNC_context|)
+    -- if (C.FUNC_context[x] = ft)
+
+  ;; 3-typing.watsup:471.1-473.25
+  rule global {C : context, gt : globaltype, x : idx}:
+    `%|-%:%`(C, GLOBAL_externuse(x), GLOBAL_externtype(gt))
+    -- if (x < |C.GLOBAL_context|)
+    -- if (C.GLOBAL_context[x] = gt)
+
+  ;; 3-typing.watsup:475.1-477.24
+  rule table {C : context, tt : tabletype, x : idx}:
+    `%|-%:%`(C, TABLE_externuse(x), TABLE_externtype(tt))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = tt)
+
+  ;; 3-typing.watsup:479.1-481.22
+  rule mem {C : context, mt : memtype, x : idx}:
+    `%|-%:%`(C, MEMORY_externuse(x), MEMORY_externtype(mt))
+    -- if (x < |C.MEM_context|)
+    -- if (C.MEM_context[x] = mt)
+
+;; 3-typing.watsup:456.1-456.80
+relation Export_ok: `%|-%:%`(context, export, externtype)
+  ;; 3-typing.watsup:463.1-465.39
+  rule _ {C : context, externuse : externuse, name : name, xt : externtype}:
+    `%|-%:%`(C, EXPORT(name, externuse), xt)
+    -- Externuse_ok: `%|-%:%`(C, externuse, xt)
+
+;; 3-typing.watsup:484.1-484.62
+relation Module_ok: `|-%:OK`(module)
+  ;; 3-typing.watsup:486.1-501.22
+  rule _ {C : context, data^n : data^n, elem* : elem*, export* : export*, ft* : functype*, func* : func*, global* : global*, gt* : globaltype*, import* : import*, mem* : mem*, mt* : memtype*, n : n, rt* : reftype*, start* : start*, table* : table*, tt* : tabletype*}:
+    `|-%:OK`(`MODULE%*%*%*%*%*%*%*%*%*`(import*{import}, func*{func}, global*{global}, table*{table}, mem*{mem}, elem*{elem}, data^n{data}, start*{start}, export*{export}))
+    -- if (C = {FUNC ft*{ft}, GLOBAL gt*{gt}, TABLE tt*{tt}, MEM mt*{mt}, ELEM rt*{rt}, DATA OK^n{}, LOCAL [], LABEL [], RETURN ?()})
+    -- (Func_ok: `%|-%:%`(C, func, ft))*{ft func}
+    -- (Global_ok: `%|-%:%`(C, global, gt))*{global gt}
+    -- (Table_ok: `%|-%:%`(C, table, tt))*{table tt}
+    -- (Mem_ok: `%|-%:%`(C, mem, mt))*{mem mt}
+    -- (Elem_ok: `%|-%:%`(C, elem, rt))*{elem rt}
+    -- (Data_ok: `%|-%:OK`(C, data))^n{data}
+    -- (Start_ok: `%|-%:OK`(C, start))*{start}
+    -- if (|mem*{mem}| <= 1)
+    -- if (|start*{start}| <= 1)
+
+;; 4-runtime.watsup:3.1-3.39
+syntax addr = nat
+
+;; 4-runtime.watsup:4.1-4.53
+syntax funcaddr = addr
+
+;; 4-runtime.watsup:5.1-5.53
+syntax globaladdr = addr
+
+;; 4-runtime.watsup:6.1-6.51
+syntax tableaddr = addr
+
+;; 4-runtime.watsup:7.1-7.50
+syntax memaddr = addr
+
+;; 4-runtime.watsup:8.1-8.49
+syntax elemaddr = addr
+
+;; 4-runtime.watsup:9.1-9.49
+syntax dataaddr = addr
+
+;; 4-runtime.watsup:10.1-10.51
+syntax labeladdr = addr
+
+;; 4-runtime.watsup:11.1-11.49
+syntax hostaddr = addr
+
+;; 4-runtime.watsup:24.1-25.24
+syntax num =
+  | CONST(numtype, c_numtype)
+
+;; 4-runtime.watsup:26.1-27.67
+syntax ref =
+  | REF.NULL(reftype)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+
+;; 4-runtime.watsup:28.1-29.10
+syntax val =
+  | CONST(numtype, c_numtype)
+  | REF.NULL(reftype)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+
+;; 4-runtime.watsup:31.1-32.18
+syntax result =
+  | _VALS(val*)
+  | TRAP
+
+;; 4-runtime.watsup:38.1-39.66
+syntax externval =
+  | FUNC(funcaddr)
+  | GLOBAL(globaladdr)
+  | TABLE(tableaddr)
+  | MEM(memaddr)
+
+;; 4-runtime.watsup:44.1-44.44
+def default_ : valtype -> val?
+  ;; 4-runtime.watsup:45.1-45.35
+  def default_(I32_valtype) = ?(CONST_val(I32_numtype, 0))
+  ;; 4-runtime.watsup:46.1-46.35
+  def default_(I64_valtype) = ?(CONST_val(I64_numtype, 0))
+  ;; 4-runtime.watsup:47.1-47.35
+  def default_(F32_valtype) = ?(CONST_val(F32_numtype, 0))
+  ;; 4-runtime.watsup:48.1-48.35
+  def default_(F64_valtype) = ?(CONST_val(F64_numtype, 0))
+  ;; 4-runtime.watsup:49.1-49.44
+  def default_(FUNCREF_valtype) = ?(REF.NULL_val(FUNCREF_reftype))
+  ;; 4-runtime.watsup:50.1-50.48
+  def default_(EXTERNREF_valtype) = ?(REF.NULL_val(EXTERNREF_reftype))
+  ;;
+  def {x : valtype} default_(x) = ?()
+
+;; 4-runtime.watsup:61.1-61.71
+syntax exportinst = EXPORT(name, externval)
+
+;; 4-runtime.watsup:71.1-78.25
+syntax moduleinst = {FUNC funcaddr*, GLOBAL globaladdr*, TABLE tableaddr*, MEM memaddr*, ELEM elemaddr*, DATA dataaddr*, EXPORT exportinst*}
+
+;; 4-runtime.watsup:55.1-55.66
+syntax funcinst = `%;%`(moduleinst, func)
+
+;; 4-runtime.watsup:56.1-56.53
+syntax globalinst = val
+
+;; 4-runtime.watsup:57.1-57.52
+syntax tableinst = ref*
+
+;; 4-runtime.watsup:58.1-58.52
+syntax meminst = byte*
+
+;; 4-runtime.watsup:59.1-59.53
+syntax eleminst = ref*
+
+;; 4-runtime.watsup:60.1-60.51
+syntax datainst = byte*
+
+;; 4-runtime.watsup:63.1-69.21
+syntax store = {FUNC funcinst*, GLOBAL globalinst*, TABLE tableinst*, MEM meminst*, ELEM eleminst*, DATA datainst*}
+
+;; 4-runtime.watsup:80.1-82.24
+syntax frame = {LOCAL val*, MODULE moduleinst}
+
+;; 4-runtime.watsup:83.1-83.47
+syntax state = `%;%`(store, frame)
+
+;; 4-runtime.watsup:140.1-147.5
+rec {
+
+;; 4-runtime.watsup:140.1-147.5
+syntax admininstr =
+  | UNREACHABLE
+  | NOP
+  | DROP
+  | SELECT(valtype?)
+  | BLOCK(blocktype, instr*)
+  | LOOP(blocktype, instr*)
+  | IF(blocktype, instr*, instr*)
+  | BR(labelidx)
+  | BR_IF(labelidx)
+  | BR_TABLE(labelidx*, labelidx)
+  | CALL(funcidx)
+  | CALL_INDIRECT(tableidx, functype)
+  | RETURN
+  | CONST(numtype, c_numtype)
+  | UNOP(numtype, unop_numtype)
+  | BINOP(numtype, binop_numtype)
+  | TESTOP(numtype, testop_numtype)
+  | RELOP(numtype, relop_numtype)
+  | EXTEND(numtype, n)
+  | CVTOP(numtype, cvtop, numtype, sx?)
+  | REF.NULL(reftype)
+  | REF.FUNC(funcidx)
+  | REF.IS_NULL
+  | LOCAL.GET(localidx)
+  | LOCAL.SET(localidx)
+  | LOCAL.TEE(localidx)
+  | GLOBAL.GET(globalidx)
+  | GLOBAL.SET(globalidx)
+  | TABLE.GET(tableidx)
+  | TABLE.SET(tableidx)
+  | TABLE.SIZE(tableidx)
+  | TABLE.GROW(tableidx)
+  | TABLE.FILL(tableidx)
+  | TABLE.COPY(tableidx, tableidx)
+  | TABLE.INIT(tableidx, elemidx)
+  | ELEM.DROP(elemidx)
+  | MEMORY.SIZE
+  | MEMORY.GROW
+  | MEMORY.FILL
+  | MEMORY.COPY
+  | MEMORY.INIT(dataidx)
+  | DATA.DROP(dataidx)
+  | LOAD(numtype, (n, sx)?, nat, nat)
+  | STORE(numtype, n?, nat, nat)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+  | CALL_ADDR(funcaddr)
+  | LABEL_(n, instr*, admininstr*)
+  | FRAME_(n, frame, admininstr*)
+  | TRAP
+}
+
+;; 4-runtime.watsup:84.1-84.62
+syntax config = `%;%*`(state, admininstr*)
+
+;; 4-runtime.watsup:102.1-102.59
+def funcaddr : state -> funcaddr*
+  ;; 4-runtime.watsup:103.1-103.38
+  def {f : frame, s : store} funcaddr(`%;%`(s, f)) = f.MODULE_frame.FUNC_moduleinst
+
+;; 4-runtime.watsup:105.1-105.52
+def funcinst : state -> funcinst*
+  ;; 4-runtime.watsup:106.1-106.31
+  def {f : frame, s : store} funcinst(`%;%`(s, f)) = s.FUNC_store
+
+;; 4-runtime.watsup:108.1-108.67
+def func : (state, funcidx) -> funcinst
+  ;; 4-runtime.watsup:116.1-116.48
+  def {f : frame, s : store, x : idx} func(`%;%`(s, f), x) = s.FUNC_store[f.MODULE_frame.FUNC_moduleinst[x]]
+
+;; 4-runtime.watsup:109.1-109.69
+def global : (state, globalidx) -> globalinst
+  ;; 4-runtime.watsup:117.1-117.54
+  def {f : frame, s : store, x : idx} global(`%;%`(s, f), x) = s.GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]]
+
+;; 4-runtime.watsup:110.1-110.68
+def table : (state, tableidx) -> tableinst
+  ;; 4-runtime.watsup:118.1-118.51
+  def {f : frame, s : store, x : idx} table(`%;%`(s, f), x) = s.TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]]
+
+;; 4-runtime.watsup:111.1-111.66
+def mem : (state, memidx) -> meminst
+  ;; 4-runtime.watsup:119.1-119.45
+  def {f : frame, s : store, x : idx} mem(`%;%`(s, f), x) = s.MEM_store[f.MODULE_frame.MEM_moduleinst[x]]
+
+;; 4-runtime.watsup:112.1-112.67
+def elem : (state, tableidx) -> eleminst
+  ;; 4-runtime.watsup:120.1-120.48
+  def {f : frame, s : store, x : idx} elem(`%;%`(s, f), x) = s.ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]]
+
+;; 4-runtime.watsup:113.1-113.67
+def data : (state, dataidx) -> datainst
+  ;; 4-runtime.watsup:121.1-121.48
+  def {f : frame, s : store, x : idx} data(`%;%`(s, f), x) = s.DATA_store[f.MODULE_frame.DATA_moduleinst[x]]
+
+;; 4-runtime.watsup:114.1-114.68
+def local : (state, localidx) -> val
+  ;; 4-runtime.watsup:122.1-122.35
+  def {f : frame, s : store, x : idx} local(`%;%`(s, f), x) = f.LOCAL_frame[x]
+
+;; 4-runtime.watsup:125.1-125.78
+def with_local : (state, localidx, val) -> state
+  ;; 4-runtime.watsup:131.1-131.52
+  def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL[x] = v])
+
+;; 4-runtime.watsup:126.1-126.79
+def with_global : (state, globalidx, val) -> state
+  ;; 4-runtime.watsup:132.1-132.71
+  def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
+
+;; 4-runtime.watsup:127.1-127.81
+def with_table : (state, tableidx, n, ref) -> state
+  ;; 4-runtime.watsup:133.1-133.74
+  def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
+
+;; 4-runtime.watsup:128.1-128.80
+def with_tableext : (state, tableidx, ref*) -> state
+  ;; 4-runtime.watsup:134.1-134.75
+  def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
+
+;; 4-runtime.watsup:129.1-129.77
+def with_elem : (state, elemidx, ref*) -> state
+  ;; 4-runtime.watsup:135.1-135.69
+  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
+
+;; 4-runtime.watsup:149.1-152.21
+rec {
+
+;; 4-runtime.watsup:149.1-152.21
+syntax E =
+  | _HOLE
+  | _SEQ(val*, E, instr*)
+  | LABEL_(n, instr*, E)
+}
+
+;; 5-numerics.watsup:3.1-3.76
+def unop : (unop_numtype, numtype, c_numtype) -> c_numtype*
+
+;; 5-numerics.watsup:4.1-4.79
+def binop : (binop_numtype, numtype, c_numtype, c_numtype) -> c_numtype*
+
+;; 5-numerics.watsup:5.1-5.76
+def testop : (testop_numtype, numtype, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:6.1-6.79
+def relop : (relop_numtype, numtype, c_numtype, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:8.1-8.84
+def ext : (nat, nat, sx, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:9.1-9.84
+def cvtop : (numtype, cvtop, numtype, sx?, c_numtype) -> c_numtype*
+
+;; 6-reduction.watsup:4.1-4.63
+relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
+  ;; 6-reduction.watsup:16.1-17.24
+  rule unreachable:
+    `%*~>%*`([UNREACHABLE_admininstr], [TRAP_admininstr])
+
+  ;; 6-reduction.watsup:19.1-20.19
+  rule nop:
+    `%*~>%*`([NOP_admininstr], [])
+
+  ;; 6-reduction.watsup:22.1-23.24
+  rule drop {val : val}:
+    `%*~>%*`([(val <: admininstr) DROP_admininstr], [])
+
+  ;; 6-reduction.watsup:26.1-28.16
+  rule select-true {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
+    `%*~>%*`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [(val_1 <: admininstr)])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:30.1-32.14
+  rule select-false {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
+    `%*~>%*`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [(val_2 <: admininstr)])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:35.1-37.28
+  rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
+    `%*~>%*`((val <: admininstr)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
+
+  ;; 6-reduction.watsup:39.1-41.28
+  rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
+    `%*~>%*`((val <: admininstr)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [LOOP_instr(bt, instr*{instr})], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
+
+  ;; 6-reduction.watsup:43.1-45.16
+  rule if-true {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*{instr_1}, instr_2*{instr_2})], [BLOCK_admininstr(bt, instr_1*{instr_1})])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:47.1-49.14
+  rule if-false {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*{instr_1}, instr_2*{instr_2})], [BLOCK_admininstr(bt, instr_2*{instr_2})])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:52.1-53.38
+  rule label-vals {instr* : instr*, n : n, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr*{instr}, (val <: admininstr)*{val})], (val <: admininstr)*{val})
+
+  ;; 6-reduction.watsup:57.1-58.69
+  rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [BR_admininstr(0)] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val} :: (instr' <: admininstr)*{instr'})
+
+  ;; 6-reduction.watsup:60.1-61.65
+  rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val <: admininstr)*{val} :: [BR_admininstr(l + 1)] :: (instr <: admininstr)*{instr})], (val <: admininstr)*{val} :: [BR_admininstr(l)])
+
+  ;; 6-reduction.watsup:64.1-66.16
+  rule br_if-true {c : c_numtype, l : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)], [BR_admininstr(l)])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:68.1-70.14
+  rule br_if-false {c : c_numtype, l : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)], [])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:73.1-75.17
+  rule br_table-lt {i : nat, l* : labelidx*, l' : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')], [BR_admininstr(l*{l}[i])])
+    -- if (i < |l*{l}|)
+
+  ;; 6-reduction.watsup:77.1-79.18
+  rule br_table-ge {i : nat, l* : labelidx*, l' : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')], [BR_admininstr(l')])
+    -- if (i >= |l*{l}|)
+
+  ;; 6-reduction.watsup:100.1-101.35
+  rule frame-vals {f : frame, n : n, val^n : val^n}:
+    `%*~>%*`([FRAME__admininstr(n, f, (val <: admininstr)^n{val})], (val <: admininstr)^n{val})
+
+  ;; 6-reduction.watsup:103.1-104.55
+  rule return-frame {f : frame, instr* : instr*, n : n, val^n : val^n, val'* : val*}:
+    `%*~>%*`([FRAME__admininstr(n, f, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val})
+
+  ;; 6-reduction.watsup:106.1-107.60
+  rule return-label {instr* : instr*, instr'* : instr*, k : nat, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(k, instr'*{instr'}, (val <: admininstr)*{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)*{val} :: [RETURN_admininstr])
+
+  ;; 6-reduction.watsup:110.1-112.33
+  rule unop-val {c : c_numtype, c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)], [CONST_admininstr(nt, c)])
+    -- if ($unop(unop, nt, c_1) = [c])
+
+  ;; 6-reduction.watsup:114.1-116.39
+  rule unop-trap {c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)], [TRAP_admininstr])
+    -- if ($unop(unop, nt, c_1) = [])
+
+  ;; 6-reduction.watsup:119.1-121.40
+  rule binop-val {binop : binop_numtype, c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)], [CONST_admininstr(nt, c)])
+    -- if ($binop(binop, nt, c_1, c_2) = [c])
+
+  ;; 6-reduction.watsup:123.1-125.46
+  rule binop-trap {binop : binop_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)], [TRAP_admininstr])
+    -- if ($binop(binop, nt, c_1, c_2) = [])
+
+  ;; 6-reduction.watsup:128.1-130.37
+  rule testop {c : c_numtype, c_1 : c_numtype, nt : numtype, testop : testop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) TESTOP_admininstr(nt, testop)], [CONST_admininstr(I32_numtype, c)])
+    -- if (c = $testop(testop, nt, c_1))
+
+  ;; 6-reduction.watsup:132.1-134.40
+  rule relop {c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype, relop : relop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) RELOP_admininstr(nt, relop)], [CONST_admininstr(I32_numtype, c)])
+    -- if (c = $relop(relop, nt, c_1, c_2))
+
+  ;; 6-reduction.watsup:137.1-138.70
+  rule extend {c : c_numtype, n : n, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, !($size(nt <: valtype)), S_sx, c))])
+    -- if ($size(nt <: valtype) =/= ?())
+
+  ;; 6-reduction.watsup:141.1-143.48
+  rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CVTOP_admininstr(nt_1, cvtop, nt_2, sx?{sx})], [CONST_admininstr(nt, c)])
+    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [c])
+
+  ;; 6-reduction.watsup:145.1-147.54
+  rule cvtop-trap {c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CVTOP_admininstr(nt_1, cvtop, nt_2, sx?{sx})], [TRAP_admininstr])
+    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [])
+
+  ;; 6-reduction.watsup:154.1-156.28
+  rule ref.is_null-true {rt : reftype, val : val}:
+    `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
+    -- if (val = REF.NULL_val(rt))
+
+  ;; 6-reduction.watsup:158.1-160.15
+  rule ref.is_null-false {val : val}:
+    `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:169.1-170.47
+  rule local.tee {val : val, x : idx}:
+    `%*~>%*`([(val <: admininstr) LOCAL.TEE_admininstr(x)], [(val <: admininstr) (val <: admininstr) LOCAL.SET_admininstr(x)])
+
+;; 6-reduction.watsup:5.1-5.63
+relation Step_read: `%~>%*`(config, admininstr*)
+  ;; 6-reduction.watsup:82.1-83.47
+  rule call {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CALL_admininstr(x)]), [CALL_ADDR_admininstr($funcaddr(z)[x])])
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:85.1-88.34
+  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [CALL_ADDR_admininstr(a)])
+    -- if (i < |$table(z, x)|)
+    -- if (a < |$funcinst(z)|)
+    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
+    -- if ($funcinst(z)[a] = `%;%`(m, func))
+
+  ;; 6-reduction.watsup:90.1-92.15
+  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [TRAP_admininstr])
+    -- otherwise
+
+  ;; 6-reduction.watsup:94.1-97.52
+  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
+    `%~>%*`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], (instr <: admininstr)*{instr})])])
+    -- if (a < |$funcinst(z)|)
+    -- (if ($default_(t) =/= ?()))*{t}
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
+    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
+
+  ;; 6-reduction.watsup:150.1-151.53
+  rule ref.func {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [REF.FUNC_admininstr(x)]), [REF.FUNC_ADDR_admininstr($funcaddr(z)[x])])
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:163.1-164.37
+  rule local.get {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [LOCAL.GET_admininstr(x)]), [($local(z, x) <: admininstr)])
+
+  ;; 6-reduction.watsup:173.1-174.39
+  rule global.get {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]), [($global(z, x) <: admininstr)])
+
+  ;; 6-reduction.watsup:180.1-182.28
+  rule table.get-trap {i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:184.1-186.27
+  rule table.get-val {i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [($table(z, x)[i] <: admininstr)])
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:188.1-190.28
+  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:197.1-199.27
+  rule table.size {n : n, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]), [CONST_admininstr(I32_numtype, n)])
+    -- if (|$table(z, x)| = n)
+
+  ;; 6-reduction.watsup:205.1-206.57
+  rule table.grow-fail {n : n, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), [CONST_admininstr(I32_numtype, - 1)])
+
+  ;; 6-reduction.watsup:209.1-211.34
+  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
+    -- if ((i + n) > |$table(z, x)|)
+
+  ;; 6-reduction.watsup:213.1-216.14
+  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:218.1-222.15
+  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) (val <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) (val <: admininstr) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:225.1-227.63
+  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [TRAP_admininstr])
+    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:229.1-232.14
+  rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:234.1-239.15
+  rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
+    -- otherwise
+    -- if (j <= i)
+
+  ;; 6-reduction.watsup:241.1-245.15
+  rule table.copy-gt {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, ((j + n) - 1)) CONST_admininstr(I32_numtype, ((i + n) - 1)) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:248.1-250.62
+  rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [TRAP_admininstr])
+    -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:252.1-255.14
+  rule table.init-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:257.1-261.15
+  rule table.init-succ {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) ($elem(z, y)[i] <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
+    -- if (i < |$elem(z, y)|)
+    -- otherwise
+
+;; 6-reduction.watsup:3.1-3.63
+relation Step: `%~>%`(config, config)
+  ;; 6-reduction.watsup:7.1-9.34
+  rule pure {instr* : instr*, instr'* : instr*, z : state}:
+    `%~>%`(`%;%*`(z, (instr <: admininstr)*{instr}), `%;%*`(z, (instr' <: admininstr)*{instr'}))
+    -- Step_pure: `%*~>%*`((instr <: admininstr)*{instr}, (instr' <: admininstr)*{instr'})
+
+  ;; 6-reduction.watsup:11.1-13.37
+  rule read {instr* : instr*, instr'* : instr*, z : state}:
+    `%~>%`(`%;%*`(z, (instr <: admininstr)*{instr}), `%;%*`(z, (instr' <: admininstr)*{instr'}))
+    -- Step_read: `%~>%*`(`%;%*`(z, (instr <: admininstr)*{instr}), (instr' <: admininstr)*{instr'})
+
+  ;; 6-reduction.watsup:166.1-167.60
+  rule local.set {val : val, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [(val <: admininstr) LOCAL.SET_admininstr(x)]), `%;%*`($with_local(z, x, val), []))
+
+  ;; 6-reduction.watsup:176.1-177.62
+  rule global.set {val : val, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [(val <: admininstr) GLOBAL.SET_admininstr(x)]), `%;%*`($with_global(z, x, val), []))
+
+  ;; 6-reduction.watsup:192.1-194.27
+  rule table.set-val {i : nat, ref : ref, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), `%;%*`($with_table(z, x, i, ref), []))
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:202.1-203.102
+  rule table.grow-succeed {n : n, ref : ref, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [(ref <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), `%;%*`($with_tableext(z, x, ref^n{}), [CONST_admininstr(I32_numtype, |$table(z, x)|)]))
+
+  ;; 6-reduction.watsup:264.1-265.59
+  rule elem.drop {x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [ELEM.DROP_admininstr(x)]), `%;%*`($with_elem(z, x, []), []))
+
+== IL Validation...
+== Latex Generation...
+$$
+\begin{array}{@{}lrrl@{}}
+& \mathit{n} &::=& \mathit{nat} \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lrrl@{}}
+\mbox{(name)} & \mathit{name} &::=& \mathit{text} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}lrrl@{}}
+\mbox{(byte)} & \mathit{byte} &::=& \mathit{nat} \\
+\mbox{(32-bit integer)} & \mathit{u{\scriptstyle32}} &::=& \mathit{nat} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}lrrl@{}}
+\mbox{(index)} & \mathit{idx} &::=& \mathit{nat} \\
+\mbox{(function index)} & \mathit{funcidx} &::=& \mathit{idx} \\
+\mbox{(global index)} & \mathit{globalidx} &::=& \mathit{idx} \\
+\mbox{(table index)} & \mathit{tableidx} &::=& \mathit{idx} \\
+\mbox{(memory index)} & \mathit{memidx} &::=& \mathit{idx} \\
+\mbox{(elem index)} & \mathit{elemidx} &::=& \mathit{idx} \\
+\mbox{(data index)} & \mathit{dataidx} &::=& \mathit{idx} \\
+\mbox{(label index)} & \mathit{labelidx} &::=& \mathit{idx} \\
+\mbox{(local index)} & \mathit{localidx} &::=& \mathit{idx} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}lrrl@{}}
+\mbox{(number type)} & \mathit{numtype} &::=& \mathsf{i{\scriptstyle32}} ~|~ \mathsf{i{\scriptstyle64}} ~|~ \mathsf{f{\scriptstyle32}} ~|~ \mathsf{f{\scriptstyle64}} \\
+\mbox{(vector type)} & \mathit{vectype} &::=& \mathsf{v{\scriptstyle128}} \\
+\mbox{(reference type)} & \mathit{reftype} &::=& \mathsf{funcref} ~|~ \mathsf{externref} \\
+\mbox{(value type)} & \mathit{valtype} &::=& \mathit{numtype} ~|~ \mathit{vectype} ~|~ \mathit{reftype} ~|~ \mathsf{bot} \\
+& {\mathsf{i}}{\mathit{n}} &::=& \mathsf{i{\scriptstyle32}} ~|~ \mathsf{i{\scriptstyle64}} \\
+& {\mathsf{f}}{\mathit{n}} &::=& \mathsf{f{\scriptstyle32}} ~|~ \mathsf{f{\scriptstyle64}} \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lrrl@{}}
+\mbox{(result type)} & \mathit{resulttype} &::=& {\mathit{valtype}^\ast} \\
+\mbox{(limits)} & \mathit{limits} &::=& [\mathit{u{\scriptstyle32}} .. \mathit{u{\scriptstyle32}}] \\
+\mbox{(mutability flag)} & \mathit{mutflag} &::=& \mathsf{mut} \\
+\mbox{(global type)} & \mathit{globaltype} &::=& {\mathit{mutflag}^?}~\mathit{valtype} \\
+\mbox{(function type)} & \mathit{functype} &::=& \mathit{resulttype} \rightarrow \mathit{resulttype} \\
+\mbox{(table type)} & \mathit{tabletype} &::=& \mathit{limits}~\mathit{reftype} \\
+\mbox{(memory type)} & \mathit{memtype} &::=& \mathit{limits}~\mathsf{i{\scriptstyle8}} \\
+\mbox{(element type)} & \mathit{elemtype} &::=& \mathit{reftype} \\
+\mbox{(data type)} & \mathit{datatype} &::=& \mathsf{ok} \\
+\mbox{(external type)} & \mathit{externtype} &::=& \mathsf{global}~\mathit{globaltype} ~|~ \mathsf{func}~\mathit{functype} ~|~ \mathsf{table}~\mathit{tabletype} ~|~ \mathsf{memory}~\mathit{memtype} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}lrrl@{}}
+\mbox{(signedness)} & \mathit{sx} &::=& \mathsf{u} ~|~ \mathsf{s} \\
+& \mathit{unop}_{\mathsf{ixx}} &::=& \mathsf{clz} ~|~ \mathsf{ctz} ~|~ \mathsf{popcnt} \\
+& \mathit{unop}_{\mathsf{fxx}} &::=& \mathsf{abs} ~|~ \mathsf{neg} ~|~ \mathsf{sqrt} ~|~ \mathsf{ceil} ~|~ \mathsf{floor} ~|~ \mathsf{trunc} ~|~ \mathsf{nearest} \\
+& \mathit{binop}_{\mathsf{ixx}} &::=& \mathsf{add} ~|~ \mathsf{sub} ~|~ \mathsf{mul} ~|~ {\mathsf{div\_}}{\mathsf{\mathit{sx}}} ~|~ {\mathsf{rem\_}}{\mathsf{\mathit{sx}}} \\ &&|&
+\mathsf{and} ~|~ \mathsf{or} ~|~ \mathsf{xor} ~|~ \mathsf{shl} ~|~ {\mathsf{shr\_}}{\mathsf{\mathit{sx}}} ~|~ \mathsf{rotl} ~|~ \mathsf{rotr} \\
+& \mathit{binop}_{\mathsf{fxx}} &::=& \mathsf{add} ~|~ \mathsf{sub} ~|~ \mathsf{mul} ~|~ \mathsf{div} ~|~ \mathsf{min} ~|~ \mathsf{max} ~|~ \mathsf{copysign} \\
+& \mathit{testop}_{\mathsf{ixx}} &::=& \mathsf{eqz} \\
+& \mathit{testop}_{\mathsf{fxx}} &::=&  \\
+& \mathit{relop}_{\mathsf{ixx}} &::=& \mathsf{eq} ~|~ \mathsf{ne} ~|~ {\mathsf{lt\_}}{\mathsf{\mathit{sx}}} ~|~ {\mathsf{gt\_}}{\mathsf{\mathit{sx}}} ~|~ {\mathsf{le\_}}{\mathsf{\mathit{sx}}} ~|~ {\mathsf{ge\_}}{\mathsf{\mathit{sx}}} \\
+& \mathit{relop}_{\mathsf{fxx}} &::=& \mathsf{eq} ~|~ \mathsf{ne} ~|~ \mathsf{lt} ~|~ \mathsf{gt} ~|~ \mathsf{le} ~|~ \mathsf{ge} \\
+& \mathit{unop}_{\mathit{numtype}} &::=& \mathit{unop}_{\mathsf{ixx}} ~|~ \mathit{unop}_{\mathsf{fxx}} \\
+& \mathit{binop}_{\mathit{numtype}} &::=& \mathit{binop}_{\mathsf{ixx}} ~|~ \mathit{binop}_{\mathsf{fxx}} \\
+& \mathit{testop}_{\mathit{numtype}} &::=& \mathit{testop}_{\mathsf{ixx}} ~|~ \mathit{testop}_{\mathsf{fxx}} \\
+& \mathit{relop}_{\mathit{numtype}} &::=& \mathit{relop}_{\mathsf{ixx}} ~|~ \mathit{relop}_{\mathsf{fxx}} \\
+& \mathit{cvtop} &::=& \mathsf{convert} ~|~ \mathsf{reinterpret} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}lrrl@{}}
+& \mathit{c}_{\mathit{numtype}} &::=& \mathit{nat} \\
+& \mathit{c}_{\mathit{vectype}} &::=& \mathit{nat} \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lrrl@{}}
+\mbox{(block type)} & \mathit{blocktype} &::=& \mathit{functype} \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lrrl@{}}
+& \mathit{instr} &::=& \mathsf{unreachable} \\ &&|&
+\mathsf{nop} \\ &&|&
+\mathsf{drop} \\ &&|&
+\mathsf{select}~{\mathit{valtype}^?} \\ &&|&
+\mathsf{block}~\mathit{blocktype}~{\mathit{instr}^\ast} \\ &&|&
+\mathsf{loop}~\mathit{blocktype}~{\mathit{instr}^\ast} \\ &&|&
+\mathsf{if}~\mathit{blocktype}~{\mathit{instr}^\ast}~\mathsf{else}~{\mathit{instr}^\ast} \\ &&|&
+\mathsf{br}~\mathit{labelidx} \\ &&|&
+\mathsf{br\_if}~\mathit{labelidx} \\ &&|&
+\mathsf{br\_table}~{\mathit{labelidx}^\ast}~\mathit{labelidx} \\ &&|&
+\mathsf{call}~\mathit{funcidx} \\ &&|&
+\mathsf{call\_indirect}~\mathit{tableidx}~\mathit{functype} \\ &&|&
+\mathsf{return} \\ &&|&
+\mathsf{\mathit{numtype}}.\mathsf{const}~\mathsf{\mathit{c}\_{\mathit{numtype}}} \\ &&|&
+\mathsf{\mathit{numtype}} . \mathsf{\mathit{unop}\_{\mathit{numtype}}} \\ &&|&
+\mathsf{\mathit{numtype}} . \mathsf{\mathit{binop}\_{\mathit{numtype}}} \\ &&|&
+\mathsf{\mathit{numtype}} . \mathsf{\mathit{testop}\_{\mathit{numtype}}} \\ &&|&
+\mathsf{\mathit{numtype}} . \mathsf{\mathit{relop}\_{\mathit{numtype}}} \\ &&|&
+{\mathsf{\mathit{numtype}}.\mathsf{extend}}{\mathsf{\mathit{n}}} \\ &&|&
+\mathsf{\mathit{numtype}} . {{{{\mathsf{\mathit{cvtop}}}{\mathsf{\_}}}{\mathsf{\mathit{numtype}}}}{\mathsf{\_}}}{\mathsf{{\mathit{sx}^?}}} \\ &&|&
+\mathsf{ref.null}~\mathit{reftype} \\ &&|&
+\mathsf{ref.func}~\mathit{funcidx} \\ &&|&
+\mathsf{ref.is\_null} \\ &&|&
+\mathsf{local.get}~\mathit{localidx} \\ &&|&
+\mathsf{local.set}~\mathit{localidx} \\ &&|&
+\mathsf{local.tee}~\mathit{localidx} \\ &&|&
+\mathsf{global.get}~\mathit{globalidx} \\ &&|&
+\mathsf{global.set}~\mathit{globalidx} \\ &&|&
+\mathsf{table.get}~\mathit{tableidx} \\ &&|&
+\mathsf{table.set}~\mathit{tableidx} \\ &&|&
+\mathsf{table.size}~\mathit{tableidx} \\ &&|&
+\mathsf{table.grow}~\mathit{tableidx} \\ &&|&
+\mathsf{table.fill}~\mathit{tableidx} \\ &&|&
+\mathsf{table.copy}~\mathit{tableidx}~\mathit{tableidx} \\ &&|&
+\mathsf{table.init}~\mathit{tableidx}~\mathit{elemidx} \\ &&|&
+\mathsf{elem.drop}~\mathit{elemidx} \\ &&|&
+\mathsf{memory.size} \\ &&|&
+\mathsf{memory.grow} \\ &&|&
+\mathsf{memory.fill} \\ &&|&
+\mathsf{memory.copy} \\ &&|&
+\mathsf{memory.init}~\mathit{dataidx} \\ &&|&
+\mathsf{data.drop}~\mathit{dataidx} \\ &&|&
+{\mathsf{\mathit{numtype}}.\mathsf{load}}{\mathsf{{(\mathit{n}~\mathit{sx})^?}}~\mathsf{\mathit{nat}}~\mathsf{\mathit{nat}}} \\ &&|&
+{\mathsf{\mathit{numtype}}.\mathsf{store}}{\mathsf{{\mathit{n}^?}}~\mathsf{\mathit{nat}}~\mathsf{\mathit{nat}}} \\
+\mbox{(expression)} & \mathit{expr} &::=& {\mathit{instr}^\ast} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}lrrl@{}}
+& \mathit{elemmode} &::=& \mathsf{table}~\mathit{tableidx}~\mathit{expr} ~|~ \mathsf{declare} \\
+& \mathit{datamode} &::=& \mathsf{memory}~\mathit{memidx}~\mathit{expr} \\
+\mbox{(function)} & \mathit{func} &::=& \mathsf{func}~\mathit{functype}~{\mathit{valtype}^\ast}~\mathit{expr} \\
+\mbox{(global)} & \mathit{global} &::=& \mathsf{global}~\mathit{globaltype}~\mathit{expr} \\
+\mbox{(table)} & \mathit{table} &::=& \mathsf{table}~\mathit{tabletype} \\
+\mbox{(memory)} & \mathit{mem} &::=& \mathsf{memory}~\mathit{memtype} \\
+\mbox{(table segment)} & \mathit{elem} &::=& \mathsf{elem}~\mathit{reftype}~{\mathit{expr}^\ast}~{\mathit{elemmode}^?} \\
+\mbox{(memory segment)} & \mathit{data} &::=& \mathsf{data}~{({\mathit{byte}^\ast})^\ast}~{\mathit{datamode}^?} \\
+\mbox{(start function)} & \mathit{start} &::=& \mathsf{start}~\mathit{funcidx} \\
+\mbox{(external use)} & \mathit{externuse} &::=& \mathsf{func}~\mathit{funcidx} ~|~ \mathsf{global}~\mathit{globalidx} ~|~ \mathsf{table}~\mathit{tableidx} ~|~ \mathsf{memory}~\mathit{memidx} \\
+\mbox{(export)} & \mathit{export} &::=& \mathsf{export}~\mathit{name}~\mathit{externuse} \\
+\mbox{(import)} & \mathit{import} &::=& \mathsf{import}~\mathit{name}~\mathit{name}~\mathit{externtype} \\
+\mbox{(module)} & \mathit{module} &::=& \mathsf{module}~{\mathit{import}^\ast}~{\mathit{func}^\ast}~{\mathit{global}^\ast}~{\mathit{table}^\ast}~{\mathit{mem}^\ast}~{\mathit{elem}^\ast}~{\mathit{data}^\ast}~{\mathit{start}^\ast}~{\mathit{export}^\ast} \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lcl@{}l@{}}
+{|\mathsf{i{\scriptstyle32}}|} &=& 32 &  \\
+{|\mathsf{i{\scriptstyle64}}|} &=& 64 &  \\
+{|\mathsf{f{\scriptstyle32}}|} &=& 32 &  \\
+{|\mathsf{f{\scriptstyle64}}|} &=& 64 &  \\
+{|\mathsf{v{\scriptstyle128}}|} &=& 128 &  \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}lcl@{}l@{}}
+\mathrm{test}_{\mathit{sub}_{\mathsf{atom}_{22}}}(\mathit{n}_{3_{\mathsf{atom}_{\mathit{y}}}}) &=& 0 &  \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lcl@{}l@{}}
+{\mathrm{curried}}_{\mathit{n}_{1}}(\mathit{n}_{2}) &=& \mathit{n}_{1} + \mathit{n}_{2} &  \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lrrl@{}}
+& \mathit{testfuse} &::=& {\mathsf{ab}}_{\mathit{nat}}\,\,\mathit{nat}~\mathit{nat} \\ &&|&
+{\mathsf{cd}}_{\mathsf{\mathit{nat}}}\,\mathsf{\mathit{nat}}~\mathsf{\mathit{nat}} \\ &&|&
+{\mathsf{ef\_}}{\mathsf{\mathit{nat}}~\mathsf{\mathit{nat}}~\mathsf{\mathit{nat}}} \\ &&|&
+{{\mathsf{gh}}_{\mathsf{\mathit{nat}}}}{\mathsf{\mathit{nat}}~\mathsf{\mathit{nat}}} \\ &&|&
+{{\mathsf{ij}}_{\mathsf{\mathit{nat}}}}{\mathsf{\mathit{nat}}~\mathsf{\mathit{nat}}} \\ &&|&
+{\mathsf{kl\_ab}}{\mathsf{\mathit{nat}}~\mathsf{\mathit{nat}}~\mathsf{\mathit{nat}}} \\ &&|&
+{\mathsf{mn\_}}{\mathsf{ab}~\mathsf{\mathit{nat}}~\mathsf{\mathit{nat}}~\mathsf{\mathit{nat}}} \\ &&|&
+{{\mathsf{op\_}}{\mathsf{ab}}}{\mathsf{\mathit{nat}}~\mathsf{\mathit{nat}}~\mathsf{\mathit{nat}}} \\ &&|&
+{{\mathsf{qr}}_{\mathsf{\mathit{nat}}}}{\mathsf{ab}~\mathsf{\mathit{nat}}~\mathsf{\mathit{nat}}} \\
+\mbox{(context)} & \mathit{context} &::=& \{\; \begin{array}[t]{@{}l@{}}
+\mathsf{func}~{\mathit{functype}^\ast},\; \mathsf{global}~{\mathit{globaltype}^\ast},\; \mathsf{table}~{\mathit{tabletype}^\ast},\; \mathsf{mem}~{\mathit{memtype}^\ast},\; \\
+  \mathsf{elem}~{\mathit{elemtype}^\ast},\; \mathsf{data}~{\mathit{datatype}^\ast},\; \\
+  \mathsf{local}~{\mathit{valtype}^\ast},\; \mathsf{label}~{\mathit{resulttype}^\ast},\; \mathsf{return}~{\mathit{resulttype}^?} \;\}\end{array} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$\boxed{{ \vdash }\;\mathit{limits} : \mathit{nat}}$
+
+$\boxed{{ \vdash }\;\mathit{functype} : \mathsf{ok}}$
+
+$\boxed{{ \vdash }\;\mathit{globaltype} : \mathsf{ok}}$
+
+$\boxed{{ \vdash }\;\mathit{tabletype} : \mathsf{ok}}$
+
+$\boxed{{ \vdash }\;\mathit{memtype} : \mathsf{ok}}$
+
+$\boxed{{ \vdash }\;\mathit{externtype} : \mathsf{ok}}$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{n}_{1} \leq \mathit{n}_{2} \leq \mathit{k}
+}{
+{ \vdash }\;[\mathit{n}_{1} .. \mathit{n}_{2}] : \mathit{k}
+} \, {[\textsc{\scriptsize K{-}limits}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+{ \vdash }\;\mathit{ft} : \mathsf{ok}
+} \, {[\textsc{\scriptsize K{-}func}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+{ \vdash }\;\mathit{gt} : \mathsf{ok}
+} \, {[\textsc{\scriptsize K{-}global}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{ \vdash }\;\mathit{lim} : {2^{32}} - 1
+}{
+{ \vdash }\;\mathit{lim}~\mathit{rt} : \mathsf{ok}
+} \, {[\textsc{\scriptsize K{-}table}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{ \vdash }\;\mathit{lim} : {2^{16}}
+}{
+{ \vdash }\;\mathit{lim}~\mathsf{i{\scriptstyle8}} : \mathsf{ok}
+} \, {[\textsc{\scriptsize K{-}mem}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{ \vdash }\;\mathit{functype} : \mathsf{ok}
+}{
+{ \vdash }\;\mathsf{func}~\mathit{functype} : \mathsf{ok}
+} \, {[\textsc{\scriptsize K{-}extern{-}func}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{ \vdash }\;\mathit{globaltype} : \mathsf{ok}
+}{
+{ \vdash }\;\mathsf{global}~\mathit{globaltype} : \mathsf{ok}
+} \, {[\textsc{\scriptsize K{-}extern{-}global}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{ \vdash }\;\mathit{tabletype} : \mathsf{ok}
+}{
+{ \vdash }\;\mathsf{table}~\mathit{tabletype} : \mathsf{ok}
+} \, {[\textsc{\scriptsize K{-}extern{-}table}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{ \vdash }\;\mathit{memtype} : \mathsf{ok}
+}{
+{ \vdash }\;\mathsf{memory}~\mathit{memtype} : \mathsf{ok}
+} \, {[\textsc{\scriptsize K{-}extern{-}mem}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$\boxed{{ \vdash }\;\mathit{valtype} \leq \mathit{valtype}}$
+
+$\boxed{{ \vdash }\;{\mathit{valtype}^\ast} \leq {\mathit{valtype}^\ast}}$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+{ \vdash }\;\mathit{t} \leq \mathit{t}
+} \, {[\textsc{\scriptsize S{-}refl}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+{ \vdash }\;\mathsf{bot} \leq \mathit{t}
+} \, {[\textsc{\scriptsize S{-}bot}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+({ \vdash }\;\mathit{t}_{1} \leq \mathit{t}_{2})^\ast
+}{
+{ \vdash }\;{\mathit{t}_{1}^\ast} \leq {\mathit{t}_{2}^\ast}
+} \, {[\textsc{\scriptsize S{-}result}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$\boxed{{ \vdash }\;\mathit{limits} \leq \mathit{limits}}$
+
+$\boxed{{ \vdash }\;\mathit{functype} \leq \mathit{functype}}$
+
+$\boxed{{ \vdash }\;\mathit{globaltype} \leq \mathit{globaltype}}$
+
+$\boxed{{ \vdash }\;\mathit{tabletype} \leq \mathit{tabletype}}$
+
+$\boxed{{ \vdash }\;\mathit{memtype} \leq \mathit{memtype}}$
+
+$\boxed{{ \vdash }\;\mathit{externtype} \leq \mathit{externtype}}$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{n}_{11} \geq \mathit{n}_{21}
+ \qquad
+\mathit{n}_{12} \leq \mathit{n}_{22}
+}{
+{ \vdash }\;[\mathit{n}_{11} .. \mathit{n}_{12}] \leq [\mathit{n}_{21} .. \mathit{n}_{22}]
+} \, {[\textsc{\scriptsize S{-}limits}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+{ \vdash }\;\mathit{ft} \leq \mathit{ft}
+} \, {[\textsc{\scriptsize S{-}func}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+{ \vdash }\;\mathit{gt} \leq \mathit{gt}
+} \, {[\textsc{\scriptsize S{-}global}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{ \vdash }\;\mathit{lim}_{1} \leq \mathit{lim}_{2}
+}{
+{ \vdash }\;\mathit{lim}_{1}~\mathit{rt} \leq \mathit{lim}_{2}~\mathit{rt}
+} \, {[\textsc{\scriptsize S{-}table}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{ \vdash }\;\mathit{lim}_{1} \leq \mathit{lim}_{2}
+}{
+{ \vdash }\;\mathit{lim}_{1}~\mathsf{i{\scriptstyle8}} \leq \mathit{lim}_{2}~\mathsf{i{\scriptstyle8}}
+} \, {[\textsc{\scriptsize S{-}mem}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{ \vdash }\;\mathit{ft}_{1} \leq \mathit{ft}_{2}
+}{
+{ \vdash }\;\mathsf{func}~\mathit{ft}_{1} \leq \mathsf{func}~\mathit{ft}_{2}
+} \, {[\textsc{\scriptsize S{-}extern{-}func}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{ \vdash }\;\mathit{gt}_{1} \leq \mathit{gt}_{2}
+}{
+{ \vdash }\;\mathsf{global}~\mathit{gt}_{1} \leq \mathsf{global}~\mathit{gt}_{2}
+} \, {[\textsc{\scriptsize S{-}extern{-}global}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{ \vdash }\;\mathit{tt}_{1} \leq \mathit{tt}_{2}
+}{
+{ \vdash }\;\mathsf{table}~\mathit{tt}_{1} \leq \mathsf{table}~\mathit{tt}_{2}
+} \, {[\textsc{\scriptsize S{-}extern{-}table}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{ \vdash }\;\mathit{mt}_{1} \leq \mathit{mt}_{2}
+}{
+{ \vdash }\;\mathsf{memory}~\mathit{mt}_{1} \leq \mathsf{memory}~\mathit{mt}_{2}
+} \, {[\textsc{\scriptsize S{-}extern{-}mem}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$\boxed{\mathit{context} \vdash \mathit{instr} : \mathit{functype}}$
+
+$\boxed{\mathit{context} \vdash {\mathit{instr}^\ast} : \mathit{functype}}$
+
+$\boxed{\mathit{context} \vdash \mathit{expr} : \mathit{resulttype}}$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C} \vdash {\mathit{instr}^\ast} : \epsilon \rightarrow {\mathit{t}^\ast}
+}{
+\mathit{C} \vdash {\mathit{instr}^\ast} : {\mathit{t}^\ast}
+} \, {[\textsc{\scriptsize T{-}expr}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+\mathit{C} \vdash \epsilon : \epsilon \rightarrow \epsilon
+} \, {[\textsc{\scriptsize T*{-}empty}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C} \vdash \mathit{instr}_{1} : {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+ \qquad
+\mathit{C} \vdash \mathit{instr}_{2} : {\mathit{t}_{2}^\ast} \rightarrow {\mathit{t}_{3}^\ast}
+}{
+\mathit{C} \vdash \mathit{instr}_{1}~{\mathit{instr}_{2}^\ast} : {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{3}^\ast}
+} \, {[\textsc{\scriptsize T*{-}seq}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\begin{array}{@{}c@{}}
+\mathit{C} \vdash {\mathit{instr}^\ast} : {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+ \\
+{ \vdash }\;{{\mathit{t}'}_{1}^\ast} \leq {\mathit{t}_{1}^\ast}
+ \qquad
+{ \vdash }\;{\mathit{t}_{2}^\ast} \leq {{\mathit{t}'}_{2}^\ast}
+\end{array}
+}{
+\mathit{C} \vdash {\mathit{instr}^\ast} : {\mathit{t}'}_{1} \rightarrow {{\mathit{t}'}_{2}^\ast}
+} \, {[\textsc{\scriptsize T*{-}weak}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C} \vdash {\mathit{instr}^\ast} : {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+}{
+\mathit{C} \vdash {\mathit{instr}^\ast} : {\mathit{t}^\ast}~{\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}^\ast}~{\mathit{t}_{2}^\ast}
+} \, {[\textsc{\scriptsize T*{-}frame}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+\mathit{C} \vdash \mathsf{unreachable} : {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+} \, {[\textsc{\scriptsize T{-}unreachable}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+\mathit{C} \vdash \mathsf{nop} : \epsilon \rightarrow \epsilon
+} \, {[\textsc{\scriptsize T{-}nop}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+\mathit{C} \vdash \mathsf{drop} : \mathit{t} \rightarrow \epsilon
+} \, {[\textsc{\scriptsize T{-}drop}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+\mathit{C} \vdash \mathsf{select}~\mathit{t} : \mathit{t}~\mathit{t}~\mathsf{i{\scriptstyle32}} \rightarrow \mathit{t}
+} \, {[\textsc{\scriptsize T{-}select{-}expl}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{ \vdash }\;\mathit{t} \leq {\mathit{t}'}
+ \qquad
+{\mathit{t}'} = \mathit{numtype} \lor {\mathit{t}'} = \mathit{vectype}
+}{
+\mathit{C} \vdash \mathsf{select} : \mathit{t}~\mathit{t}~\mathsf{i{\scriptstyle32}} \rightarrow \mathit{t}
+} \, {[\textsc{\scriptsize T{-}select{-}impl}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$\boxed{\mathit{context} \vdash \mathit{blocktype} : \mathit{functype}}$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{ \vdash }\;\mathit{ft} : \mathsf{ok}
+}{
+\mathit{C} \vdash \mathit{ft} : \mathit{ft}
+} \, {[\textsc{\scriptsize K{-}block}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C} \vdash \mathit{bt} : {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+ \qquad
+\mathit{C}, \mathsf{label}~{\mathit{t}_{2}^\ast} \vdash {\mathit{instr}^\ast} : {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+}{
+\mathit{C} \vdash \mathsf{block}~\mathit{bt}~{\mathit{instr}^\ast} : {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+} \, {[\textsc{\scriptsize T{-}block}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C} \vdash \mathit{bt} : {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+ \qquad
+\mathit{C}, \mathsf{label}~{\mathit{t}_{1}^\ast} \vdash {\mathit{instr}^\ast} : {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+}{
+\mathit{C} \vdash \mathsf{loop}~\mathit{bt}~{\mathit{instr}^\ast} : {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+} \, {[\textsc{\scriptsize T{-}loop}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C} \vdash \mathit{bt} : {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+ \qquad
+\mathit{C}, \mathsf{label}~{\mathit{t}_{2}^\ast} \vdash {\mathit{instr}_{1}^\ast} : {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+ \qquad
+\mathit{C}, \mathsf{label}~{\mathit{t}_{2}^\ast} \vdash {\mathit{instr}_{2}^\ast} : {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+}{
+\mathit{C} \vdash \mathsf{if}~\mathit{bt}~{\mathit{instr}_{1}^\ast}~\mathsf{else}~{\mathit{instr}_{2}^\ast} : {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+} \, {[\textsc{\scriptsize T{-}if}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{label}[\mathit{l}] = {\mathit{t}^\ast}
+}{
+\mathit{C} \vdash \mathsf{br}~\mathit{l} : {\mathit{t}_{1}^\ast}~{\mathit{t}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+} \, {[\textsc{\scriptsize T{-}br}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{label}[\mathit{l}] = {\mathit{t}^\ast}
+}{
+\mathit{C} \vdash \mathsf{br\_if}~\mathit{l} : {\mathit{t}^\ast}~\mathsf{i{\scriptstyle32}} \rightarrow {\mathit{t}^\ast}
+} \, {[\textsc{\scriptsize T{-}br\_if}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+({ \vdash }\;{\mathit{t}^\ast} \leq \mathit{C}.\mathsf{label}[\mathit{l}])^\ast
+ \qquad
+{ \vdash }\;{\mathit{t}^\ast} \leq \mathit{C}.\mathsf{label}[{\mathit{l}'}]
+}{
+\mathit{C} \vdash \mathsf{br\_table}~{\mathit{l}^\ast}~{\mathit{l}'} : {\mathit{t}_{1}^\ast}~{\mathit{t}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+} \, {[\textsc{\scriptsize T{-}br\_table}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{return} = ({\mathit{t}^\ast})
+}{
+\mathit{C} \vdash \mathsf{return} : {\mathit{t}_{1}^\ast}~{\mathit{t}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+} \, {[\textsc{\scriptsize T{-}return}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{func}[\mathit{x}] = {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+}{
+\mathit{C} \vdash \mathsf{call}~\mathit{x} : {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+} \, {[\textsc{\scriptsize T{-}call}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{table}[\mathit{x}] = \mathit{lim}~\mathsf{funcref}
+ \qquad
+\mathit{ft} = {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+}{
+\mathit{C} \vdash \mathsf{call\_indirect}~\mathit{x}~\mathit{ft} : {\mathit{t}_{1}^\ast}~\mathsf{i{\scriptstyle32}} \rightarrow {\mathit{t}_{2}^\ast}
+} \, {[\textsc{\scriptsize T{-}call\_indirect}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+\mathit{C} \vdash \mathit{nt}.\mathsf{const}~\mathit{c}_{\mathit{nt}} : \epsilon \rightarrow \mathit{nt}
+} \, {[\textsc{\scriptsize T{-}const}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+\mathit{C} \vdash \mathit{nt} . \mathit{unop} : \mathit{nt} \rightarrow \mathit{nt}
+} \, {[\textsc{\scriptsize T{-}unop}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+\mathit{C} \vdash \mathit{nt} . \mathit{binop} : \mathit{nt}~\mathit{nt} \rightarrow \mathit{nt}
+} \, {[\textsc{\scriptsize T{-}binop}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+\mathit{C} \vdash \mathit{nt} . \mathit{testop} : \mathit{nt} \rightarrow \mathsf{i{\scriptstyle32}}
+} \, {[\textsc{\scriptsize T{-}testop}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+\mathit{C} \vdash \mathit{nt} . \mathit{relop} : \mathit{nt}~\mathit{nt} \rightarrow \mathsf{i{\scriptstyle32}}
+} \, {[\textsc{\scriptsize T{-}relop}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{n} \leq {|\mathit{nt}|}
+}{
+\mathit{C} \vdash {\mathit{nt}.\mathsf{extend}}{\mathit{n}} : \mathit{nt} \rightarrow \mathit{nt}
+} \, {[\textsc{\scriptsize T{-}extend}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{nt}_{1} \neq \mathit{nt}_{2}
+ \qquad
+{|\mathit{nt}_{1}|} = {|\mathit{nt}_{2}|}
+}{
+\mathit{C} \vdash \mathsf{cvtop}~\mathit{nt}_{1}~\mathsf{reinterpret}~\mathit{nt}_{2} : \mathit{nt}_{2} \rightarrow \mathit{nt}_{1}
+} \, {[\textsc{\scriptsize T{-}reinterpret}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{\mathsf{i}}{\mathit{n}}_{1} \neq {\mathsf{i}}{\mathit{n}}_{2}
+ \qquad
+{\mathit{sx}^?} = \epsilon \Leftrightarrow {|{\mathsf{i}}{\mathit{n}}_{1}|} > {|{\mathsf{i}}{\mathit{n}}_{2}|}
+}{
+\mathit{C} \vdash {\mathsf{i}}{\mathit{n}}_{1} . {{{{\mathsf{convert}}{\mathsf{\_}}}{{\mathsf{i}}{\mathit{n}}_{2}}}{\mathsf{\_}}}{{\mathit{sx}^?}} : {\mathsf{i}}{\mathit{n}}_{2} \rightarrow {\mathsf{i}}{\mathit{n}}_{1}
+} \, {[\textsc{\scriptsize T{-}convert{-}i}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{\mathsf{f}}{\mathit{n}}_{1} \neq {\mathsf{f}}{\mathit{n}}_{2}
+}{
+\mathit{C} \vdash \mathsf{cvtop}~{\mathsf{f}}{\mathit{n}}_{1}~\mathsf{convert}~{\mathsf{f}}{\mathit{n}}_{2} : {\mathsf{f}}{\mathit{n}}_{2} \rightarrow {\mathsf{f}}{\mathit{n}}_{1}
+} \, {[\textsc{\scriptsize T{-}convert{-}f}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+\mathit{C} \vdash \mathsf{ref.null}~\mathit{rt} : \epsilon \rightarrow \mathit{rt}
+} \, {[\textsc{\scriptsize T{-}ref.null}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{func}[\mathit{x}] = \mathit{ft}
+}{
+\mathit{C} \vdash \mathsf{ref.func}~\mathit{x} : \epsilon \rightarrow \mathsf{funcref}
+} \, {[\textsc{\scriptsize T{-}ref.func}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+\mathit{C} \vdash \mathsf{ref.is\_null} : \mathit{rt} \rightarrow \mathsf{i{\scriptstyle32}}
+} \, {[\textsc{\scriptsize T{-}ref.is\_null}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{local}[\mathit{x}] = \mathit{t}
+}{
+\mathit{C} \vdash \mathsf{local.get}~\mathit{x} : \epsilon \rightarrow \mathit{t}
+} \, {[\textsc{\scriptsize T{-}local.get}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{local}[\mathit{x}] = \mathit{t}
+}{
+\mathit{C} \vdash \mathsf{local.set}~\mathit{x} : \mathit{t} \rightarrow \epsilon
+} \, {[\textsc{\scriptsize T{-}local.set}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{local}[\mathit{x}] = \mathit{t}
+}{
+\mathit{C} \vdash \mathsf{local.tee}~\mathit{x} : \mathit{t} \rightarrow \mathit{t}
+} \, {[\textsc{\scriptsize T{-}local.tee}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{global}[\mathit{x}] = {\mathit{mut}^?}~\mathit{t}
+}{
+\mathit{C} \vdash \mathsf{global.get}~\mathit{x} : \epsilon \rightarrow \mathit{t}
+} \, {[\textsc{\scriptsize T{-}global.get}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{global}[\mathit{x}] = \mathsf{mut}~\mathit{t}
+}{
+\mathit{C} \vdash \mathsf{global.set}~\mathit{x} : \mathit{t} \rightarrow \epsilon
+} \, {[\textsc{\scriptsize T{-}global.set}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{table}[\mathit{x}] = \mathit{lim}~\mathit{rt}
+}{
+\mathit{C} \vdash \mathsf{table.get}~\mathit{x} : \mathsf{i{\scriptstyle32}} \rightarrow \mathit{rt}
+} \, {[\textsc{\scriptsize T{-}table.get}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{table}[\mathit{x}] = \mathit{lim}~\mathit{rt}
+}{
+\mathit{C} \vdash \mathsf{table.set}~\mathit{x} : \mathsf{i{\scriptstyle32}}~\mathit{rt} \rightarrow \epsilon
+} \, {[\textsc{\scriptsize T{-}table.set}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{table}[\mathit{x}] = \mathit{tt}
+}{
+\mathit{C} \vdash \mathsf{table.size}~\mathit{x} : \epsilon \rightarrow \mathsf{i{\scriptstyle32}}
+} \, {[\textsc{\scriptsize T{-}table.size}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{table}[\mathit{x}] = \mathit{lim}~\mathit{rt}
+}{
+\mathit{C} \vdash \mathsf{table.grow}~\mathit{x} : \mathit{rt}~\mathsf{i{\scriptstyle32}} \rightarrow \mathsf{i{\scriptstyle32}}
+} \, {[\textsc{\scriptsize T{-}table.grow}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{table}[\mathit{x}] = \mathit{lim}~\mathit{rt}
+}{
+\mathit{C} \vdash \mathsf{table.fill}~\mathit{x} : \mathsf{i{\scriptstyle32}}~\mathit{rt}~\mathsf{i{\scriptstyle32}} \rightarrow \epsilon
+} \, {[\textsc{\scriptsize T{-}table.fill}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{table}[\mathit{x}_{1}] = \mathit{lim}_{1}~\mathit{rt}
+ \qquad
+\mathit{C}.\mathsf{table}[\mathit{x}_{2}] = \mathit{lim}_{2}~\mathit{rt}
+}{
+\mathit{C} \vdash \mathsf{table.copy}~\mathit{x}_{1}~\mathit{x}_{2} : \mathsf{i{\scriptstyle32}}~\mathsf{i{\scriptstyle32}}~\mathsf{i{\scriptstyle32}} \rightarrow \epsilon
+} \, {[\textsc{\scriptsize T{-}table.copy}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{table}[\mathit{x}_{1}] = \mathit{lim}~\mathit{rt}
+ \qquad
+\mathit{C}.\mathsf{elem}[\mathit{x}_{2}] = \mathit{rt}
+}{
+\mathit{C} \vdash \mathsf{table.init}~\mathit{x}_{1}~\mathit{x}_{2} : \mathsf{i{\scriptstyle32}}~\mathsf{i{\scriptstyle32}}~\mathsf{i{\scriptstyle32}} \rightarrow \epsilon
+} \, {[\textsc{\scriptsize T{-}table.init}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{elem}[\mathit{x}] = \mathit{rt}
+}{
+\mathit{C} \vdash \mathsf{elem.drop}~\mathit{x} : \epsilon \rightarrow \epsilon
+} \, {[\textsc{\scriptsize T{-}elem.drop}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{mem}[0] = \mathit{mt}
+}{
+\mathit{C} \vdash \mathsf{memory.size} : \epsilon \rightarrow \mathsf{i{\scriptstyle32}}
+} \, {[\textsc{\scriptsize T{-}memory.size}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{mem}[0] = \mathit{mt}
+}{
+\mathit{C} \vdash \mathsf{memory.grow} : \mathsf{i{\scriptstyle32}} \rightarrow \mathsf{i{\scriptstyle32}}
+} \, {[\textsc{\scriptsize T{-}memory.grow}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{mem}[0] = \mathit{mt}
+}{
+\mathit{C} \vdash \mathsf{memory.fill} : \mathsf{i{\scriptstyle32}}~\mathsf{i{\scriptstyle32}}~\mathsf{i{\scriptstyle32}} \rightarrow \mathsf{i{\scriptstyle32}}
+} \, {[\textsc{\scriptsize T{-}memory.fill}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{mem}[0] = \mathit{mt}
+}{
+\mathit{C} \vdash \mathsf{memory.copy} : \mathsf{i{\scriptstyle32}}~\mathsf{i{\scriptstyle32}}~\mathsf{i{\scriptstyle32}} \rightarrow \mathsf{i{\scriptstyle32}}
+} \, {[\textsc{\scriptsize T{-}memory.copy}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{mem}[0] = \mathit{mt}
+ \qquad
+\mathit{C}.\mathsf{data}[\mathit{x}] = \mathsf{ok}
+}{
+\mathit{C} \vdash \mathsf{memory.init}~\mathit{x} : \mathsf{i{\scriptstyle32}}~\mathsf{i{\scriptstyle32}}~\mathsf{i{\scriptstyle32}} \rightarrow \mathsf{i{\scriptstyle32}}
+} \, {[\textsc{\scriptsize T{-}memory.init}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{data}[\mathit{x}] = \mathsf{ok}
+}{
+\mathit{C} \vdash \mathsf{data.drop}~\mathit{x} : \epsilon \rightarrow \epsilon
+} \, {[\textsc{\scriptsize T{-}data.drop}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{mem}[0] = \mathit{mt}
+ \qquad
+{2^{\mathit{n}_{\mathsf{a}}}} \leq {|\mathit{nt}|} / 8
+ \qquad
+({2^{\mathit{n}_{\mathsf{a}}}} \leq \mathit{n} / 8 < {|\mathit{nt}|} / 8)^?
+ \qquad
+{\mathit{n}^?} = \epsilon \lor \mathit{nt} = {\mathsf{i}}{\mathit{n}}
+}{
+\mathit{C} \vdash {\mathit{nt}.\mathsf{load}}{{(\mathit{n}~\mathit{sx})^?}~\mathit{n}_{\mathsf{a}}~\mathit{n}_{\mathsf{o}}} : \mathsf{i{\scriptstyle32}} \rightarrow \mathit{nt}
+} \, {[\textsc{\scriptsize T{-}load}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{mem}[0] = \mathit{mt}
+ \qquad
+{2^{\mathit{n}_{\mathsf{a}}}} \leq {|\mathit{nt}|} / 8
+ \qquad
+({2^{\mathit{n}_{\mathsf{a}}}} \leq \mathit{n} / 8 < {|\mathit{nt}|} / 8)^?
+ \qquad
+{\mathit{n}^?} = \epsilon \lor \mathit{nt} = {\mathsf{i}}{\mathit{n}}
+}{
+\mathit{C} \vdash {\mathit{nt}.\mathsf{store}}{{\mathit{n}^?}~\mathit{n}_{\mathsf{a}}~\mathit{n}_{\mathsf{o}}} : \mathsf{i{\scriptstyle32}}~\mathit{nt} \rightarrow \epsilon
+} \, {[\textsc{\scriptsize T{-}store}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$\boxed{\mathit{context} \vdash \mathit{instr}~\mathsf{const}}$
+
+$\boxed{\mathit{context} \vdash \mathit{expr}~\mathsf{const}}$
+
+$\boxed{\mathit{context} \vdash \mathit{expr} : \mathit{valtype}~\mathsf{const}}$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+\mathit{C} \vdash (\mathit{nt}.\mathsf{const}~\mathit{c})~\mathsf{const}
+} \, {[\textsc{\scriptsize C{-}instr{-}const}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+\mathit{C} \vdash (\mathsf{ref.null}~\mathit{rt})~\mathsf{const}
+} \, {[\textsc{\scriptsize C{-}instr{-}ref.null}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+\mathit{C} \vdash (\mathsf{ref.func}~\mathit{x})~\mathsf{const}
+} \, {[\textsc{\scriptsize C{-}instr{-}ref.func}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{global}[\mathit{x}] = \epsilon~\mathit{t}
+}{
+\mathit{C} \vdash (\mathsf{global.get}~\mathit{x})~\mathsf{const}
+} \, {[\textsc{\scriptsize C{-}instr{-}global.get}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+(\mathit{C} \vdash \mathit{instr}~\mathsf{const})^\ast
+}{
+\mathit{C} \vdash {\mathit{instr}^\ast}~\mathsf{const}
+} \, {[\textsc{\scriptsize C{-}expr}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C} \vdash \mathit{expr} : \mathit{t}
+ \qquad
+\mathit{C} \vdash \mathit{expr}~\mathsf{const}
+}{
+\mathit{C} \vdash \mathit{expr} : \mathit{t}~\mathsf{const}
+} \, {[\textsc{\scriptsize TC{-}expr}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$\boxed{\mathit{context} \vdash \mathit{func} : \mathit{functype}}$
+
+$\boxed{\mathit{context} \vdash \mathit{global} : \mathit{globaltype}}$
+
+$\boxed{\mathit{context} \vdash \mathit{table} : \mathit{tabletype}}$
+
+$\boxed{\mathit{context} \vdash \mathit{mem} : \mathit{memtype}}$
+
+$\boxed{\mathit{context} \vdash \mathit{elem} : \mathit{reftype}}$
+
+$\boxed{\mathit{context} \vdash \mathit{data} : \mathsf{ok}}$
+
+$\boxed{\mathit{context} \vdash \mathit{elemmode} : \mathit{reftype}}$
+
+$\boxed{\mathit{context} \vdash \mathit{datamode} : \mathsf{ok}}$
+
+$\boxed{\mathit{context} \vdash \mathit{start} : \mathsf{ok}}$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{ft} = {\mathit{t}_{1}^\ast} \rightarrow {\mathit{t}_{2}^\ast}
+ \qquad
+{ \vdash }\;\mathit{ft} : \mathsf{ok}
+ \qquad
+\mathit{C}, \mathsf{local}~{\mathit{t}_{1}^\ast}~{\mathit{t}^\ast}, \mathsf{label}~({\mathit{t}_{2}^\ast}), \mathsf{return}~({\mathit{t}_{2}^\ast}) \vdash \mathit{expr} : {\mathit{t}_{2}^\ast}
+}{
+\mathit{C} \vdash \mathsf{func}~\mathit{ft}~{\mathit{t}^\ast}~\mathit{expr} : \mathit{ft}
+} \, {[\textsc{\scriptsize T{-}func}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{ \vdash }\;\mathit{gt} : \mathsf{ok}
+ \qquad
+\mathit{gt} = {\mathsf{mut}^?}~\mathit{t}
+ \qquad
+\mathit{C} \vdash \mathit{expr} : \mathit{t}~\mathsf{const}
+}{
+\mathit{C} \vdash \mathsf{global}~\mathit{gt}~\mathit{expr} : \mathit{gt}
+} \, {[\textsc{\scriptsize T{-}global}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{ \vdash }\;\mathit{tt} : \mathsf{ok}
+}{
+\mathit{C} \vdash \mathsf{table}~\mathit{tt} : \mathit{tt}
+} \, {[\textsc{\scriptsize T{-}table}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{ \vdash }\;\mathit{mt} : \mathsf{ok}
+}{
+\mathit{C} \vdash \mathsf{memory}~\mathit{mt} : \mathit{mt}
+} \, {[\textsc{\scriptsize T{-}mem}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+(\mathit{C} \vdash \mathit{expr} : \mathit{rt})^\ast
+ \qquad
+(\mathit{C} \vdash \mathit{elemmode} : \mathit{rt})^?
+}{
+\mathit{C} \vdash \mathsf{elem}~\mathit{rt}~{\mathit{expr}^\ast}~{\mathit{elemmode}^?} : \mathit{rt}
+} \, {[\textsc{\scriptsize T{-}elem}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+(\mathit{C} \vdash \mathit{datamode} : \mathsf{ok})^?
+}{
+\mathit{C} \vdash \mathsf{data}~{({\mathit{b}^\ast})^\ast}~{\mathit{datamode}^?} : \mathsf{ok}
+} \, {[\textsc{\scriptsize T{-}data}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{table}[\mathit{x}] = \mathit{lim}~\mathit{rt}
+ \qquad
+(\mathit{C} \vdash \mathit{expr} : \mathsf{i{\scriptstyle32}}~\mathsf{const})^\ast
+}{
+\mathit{C} \vdash \mathsf{table}~\mathit{x}~\mathit{expr} : \mathit{rt}
+} \, {[\textsc{\scriptsize T{-}elemmode{-}active}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+}{
+\mathit{C} \vdash \mathsf{declare} : \mathit{rt}
+} \, {[\textsc{\scriptsize T{-}elemmode{-}declare}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{mem}[0] = \mathit{mt}
+ \qquad
+(\mathit{C} \vdash \mathit{expr} : \mathsf{i{\scriptstyle32}}~\mathsf{const})^\ast
+}{
+\mathit{C} \vdash \mathsf{memory}~0~\mathit{expr} : \mathsf{ok}
+} \, {[\textsc{\scriptsize T{-}datamode}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{func}[\mathit{x}] = \epsilon \rightarrow \epsilon
+}{
+\mathit{C} \vdash \mathsf{start}~\mathit{x} : \mathsf{ok}
+} \, {[\textsc{\scriptsize T{-}start}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$\boxed{\mathit{context} \vdash \mathit{import} : \mathit{externtype}}$
+
+$\boxed{\mathit{context} \vdash \mathit{export} : \mathit{externtype}}$
+
+$\boxed{\mathit{context} \vdash \mathit{externuse} : \mathit{externtype}}$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+{ \vdash }\;\mathit{xt} : \mathsf{ok}
+}{
+\mathit{C} \vdash \mathsf{import}~\mathit{name}_{1}~\mathit{name}_{2}~\mathit{xt} : \mathit{xt}
+} \, {[\textsc{\scriptsize T{-}import}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C} \vdash \mathit{externuse} : \mathit{xt}
+}{
+\mathit{C} \vdash \mathsf{export}~\mathit{name}~\mathit{externuse} : \mathit{xt}
+} \, {[\textsc{\scriptsize T{-}export}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{func}[\mathit{x}] = \mathit{ft}
+}{
+\mathit{C} \vdash \mathsf{func}~\mathit{x} : \mathsf{func}~\mathit{ft}
+} \, {[\textsc{\scriptsize T{-}externuse{-}func}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{global}[\mathit{x}] = \mathit{gt}
+}{
+\mathit{C} \vdash \mathsf{global}~\mathit{x} : \mathsf{global}~\mathit{gt}
+} \, {[\textsc{\scriptsize T{-}externuse{-}global}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{table}[\mathit{x}] = \mathit{tt}
+}{
+\mathit{C} \vdash \mathsf{table}~\mathit{x} : \mathsf{table}~\mathit{tt}
+} \, {[\textsc{\scriptsize T{-}externuse{-}table}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\mathit{C}.\mathsf{mem}[\mathit{x}] = \mathit{mt}
+}{
+\mathit{C} \vdash \mathsf{memory}~\mathit{x} : \mathsf{memory}~\mathit{mt}
+} \, {[\textsc{\scriptsize T{-}externuse{-}mem}]}
+\qquad
+\end{array}
+$$
+
+\vspace{1ex}
+
+$\boxed{{ \vdash }\;\mathit{module} : \mathsf{ok}}$
+
+$$
+\begin{array}{@{}c@{}}\displaystyle
+\frac{
+\begin{array}{@{}c@{}}
+\mathit{C} = \{ \begin{array}[t]{@{}l@{}}
+\mathsf{func}~{\mathit{ft}^\ast},\; \mathsf{global}~{\mathit{gt}^\ast},\; \mathsf{table}~{\mathit{tt}^\ast},\; \mathsf{mem}~{\mathit{mt}^\ast},\; \mathsf{elem}~{\mathit{rt}^\ast},\; \mathsf{data}~{\mathsf{ok}^{\mathit{n}}} \}\end{array}
+ \\
+(\mathit{C} \vdash \mathit{func} : \mathit{ft})^\ast
+ \qquad
+(\mathit{C} \vdash \mathit{global} : \mathit{gt})^\ast
+ \qquad
+(\mathit{C} \vdash \mathit{table} : \mathit{tt})^\ast
+ \qquad
+(\mathit{C} \vdash \mathit{mem} : \mathit{mt})^\ast
+ \\
+(\mathit{C} \vdash \mathit{elem} : \mathit{rt})^\ast
+ \qquad
+(\mathit{C} \vdash \mathit{data} : \mathsf{ok})^{\mathit{n}}
+ \qquad
+(\mathit{C} \vdash \mathit{start} : \mathsf{ok})^\ast
+ \\
+{|{\mathit{mem}^\ast}|} \leq 1
+ \qquad
+{|{\mathit{start}^\ast}|} \leq 1
+\end{array}
+}{
+{ \vdash }\;\mathsf{module}~{\mathit{import}^\ast}~{\mathit{func}^\ast}~{\mathit{global}^\ast}~{\mathit{table}^\ast}~{\mathit{mem}^\ast}~{\mathit{elem}^\ast}~{\mathit{data}^{\mathit{n}}}~{\mathit{start}^\ast}~{\mathit{export}^\ast} : \mathsf{ok}
+} \, {[\textsc{\scriptsize T{-}module}]}
+\qquad
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lrrl@{}}
+\mbox{(address)} & \mathit{addr} &::=& \mathit{nat} \\
+\mbox{(function address)} & \mathit{funcaddr} &::=& \mathit{addr} \\
+\mbox{(global address)} & \mathit{globaladdr} &::=& \mathit{addr} \\
+\mbox{(table address)} & \mathit{tableaddr} &::=& \mathit{addr} \\
+\mbox{(memory address)} & \mathit{memaddr} &::=& \mathit{addr} \\
+\mbox{(elem address)} & \mathit{elemaddr} &::=& \mathit{addr} \\
+\mbox{(data address)} & \mathit{dataaddr} &::=& \mathit{addr} \\
+\mbox{(label address)} & \mathit{labeladdr} &::=& \mathit{addr} \\
+\mbox{(host address)} & \mathit{hostaddr} &::=& \mathit{addr} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}lrrl@{}}
+\mbox{(number)} & \mathit{num} &::=& \mathsf{\mathit{numtype}}.\mathsf{const}~\mathsf{\mathit{c}\_{\mathit{numtype}}} \\
+\mbox{(reference)} & \mathit{ref} &::=& \mathsf{ref.null}~\mathit{reftype} ~|~ \mathsf{ref.func}~\mathsf{\mathit{funcaddr}} ~|~ \mathsf{ref.extern}~\mathsf{\mathit{hostaddr}} \\
+\mbox{(value)} & \mathit{val} &::=& \mathit{num} ~|~ \mathit{ref} \\
+\mbox{(result)} & \mathit{result} &::=& {\mathit{val}^\ast} ~|~ \mathsf{trap} \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lrrl@{}}
+\mbox{(external value)} & \mathit{externval} &::=& \mathsf{func}~\mathit{funcaddr} ~|~ \mathsf{global}~\mathit{globaladdr} ~|~ \mathsf{table}~\mathit{tableaddr} ~|~ \mathsf{mem}~\mathit{memaddr} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}lcl@{}l@{}}
+{\mathrm{default}}_{\mathsf{i{\scriptstyle32}}} &=& (\mathsf{i{\scriptstyle32}}.\mathsf{const}~0) &  \\
+{\mathrm{default}}_{\mathsf{i{\scriptstyle64}}} &=& (\mathsf{i{\scriptstyle64}}.\mathsf{const}~0) &  \\
+{\mathrm{default}}_{\mathsf{f{\scriptstyle32}}} &=& (\mathsf{f{\scriptstyle32}}.\mathsf{const}~0) &  \\
+{\mathrm{default}}_{\mathsf{f{\scriptstyle64}}} &=& (\mathsf{f{\scriptstyle64}}.\mathsf{const}~0) &  \\
+{\mathrm{default}}_{\mathsf{funcref}} &=& (\mathsf{ref.null}~\mathsf{funcref}) &  \\
+{\mathrm{default}}_{\mathsf{externref}} &=& (\mathsf{ref.null}~\mathsf{externref}) &  \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}lrrl@{}}
+\mbox{(function instance)} & \mathit{funcinst} &::=& \mathit{moduleinst} ; \mathit{func} \\
+\mbox{(global instance)} & \mathit{globalinst} &::=& \mathit{val} \\
+\mbox{(table instance)} & \mathit{tableinst} &::=& {\mathit{ref}^\ast} \\
+\mbox{(memory instance)} & \mathit{meminst} &::=& {\mathit{byte}^\ast} \\
+\mbox{(element instance)} & \mathit{eleminst} &::=& {\mathit{ref}^\ast} \\
+\mbox{(data instance)} & \mathit{datainst} &::=& {\mathit{byte}^\ast} \\
+\mbox{(export instance)} & \mathit{exportinst} &::=& \mathsf{export}~\mathit{name}~\mathit{externval} \\
+\mbox{(store)} & \mathit{store} &::=& \{\; \begin{array}[t]{@{}l@{}}
+\mathsf{func}~{\mathit{funcinst}^\ast},\; \\
+  \mathsf{global}~{\mathit{globalinst}^\ast},\; \\
+  \mathsf{table}~{\mathit{tableinst}^\ast},\; \\
+  \mathsf{mem}~{\mathit{meminst}^\ast},\; \\
+  \mathsf{elem}~{\mathit{eleminst}^\ast},\; \\
+  \mathsf{data}~{\mathit{datainst}^\ast} \;\}\end{array} \\
+\mbox{(module instance)} & \mathit{moduleinst} &::=& \{\; \begin{array}[t]{@{}l@{}}
+\mathsf{func}~{\mathit{funcaddr}^\ast},\; \\
+  \mathsf{global}~{\mathit{globaladdr}^\ast},\; \\
+  \mathsf{table}~{\mathit{tableaddr}^\ast},\; \\
+  \mathsf{mem}~{\mathit{memaddr}^\ast},\; \\
+  \mathsf{elem}~{\mathit{elemaddr}^\ast},\; \\
+  \mathsf{data}~{\mathit{dataaddr}^\ast},\; \\
+  \mathsf{export}~{\mathit{exportinst}^\ast} \;\}\end{array} \\
+\mbox{(frame)} & \mathit{frame} &::=& \{\; \begin{array}[t]{@{}l@{}}
+\mathsf{local}~{\mathit{val}^\ast},\; \\
+  \mathsf{module}~\mathit{moduleinst} \;\}\end{array} \\
+\mbox{(state)} & \mathit{state} &::=& \mathit{store} ; \mathit{frame} \\
+\mbox{(configuration)} & \mathit{config} &::=& \mathit{state} ; {\mathit{instr}^\ast} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}lcl@{}l@{}}
+(\mathit{s} ; \mathit{f}).\mathsf{module}.\mathsf{func} &=& \mathit{f}.\mathsf{module}.\mathsf{func} &  \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lcl@{}l@{}}
+(\mathit{s} ; \mathit{f}).\mathsf{func} &=& \mathit{s}.\mathsf{func} &  \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lcl@{}l@{}}
+{(\mathit{s} ; \mathit{f}).\mathsf{func}}{[\mathit{x}]} &=& \mathit{s}.\mathsf{func}[\mathit{f}.\mathsf{module}.\mathsf{func}[\mathit{x}]] &  \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lcl@{}l@{}}
+{(\mathit{s} ; \mathit{f}).\mathsf{global}}{[\mathit{x}]} &=& \mathit{s}.\mathsf{global}[\mathit{f}.\mathsf{module}.\mathsf{global}[\mathit{x}]] &  \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lcl@{}l@{}}
+{(\mathit{s} ; \mathit{f}).\mathsf{table}}{[\mathit{x}]} &=& \mathit{s}.\mathsf{table}[\mathit{f}.\mathsf{module}.\mathsf{table}[\mathit{x}]] &  \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lcl@{}l@{}}
+{(\mathit{s} ; \mathit{f}).\mathsf{mem}}{[\mathit{x}]} &=& \mathit{s}.\mathsf{mem}[\mathit{f}.\mathsf{module}.\mathsf{mem}[\mathit{x}]] &  \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lcl@{}l@{}}
+{(\mathit{s} ; \mathit{f}).\mathsf{elem}}{[\mathit{x}]} &=& \mathit{s}.\mathsf{elem}[\mathit{f}.\mathsf{module}.\mathsf{elem}[\mathit{x}]] &  \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lcl@{}l@{}}
+{(\mathit{s} ; \mathit{f}).\mathsf{data}}{[\mathit{x}]} &=& \mathit{s}.\mathsf{data}[\mathit{f}.\mathsf{module}.\mathsf{data}[\mathit{x}]] &  \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lcl@{}l@{}}
+{(\mathit{s} ; \mathit{f}).\mathsf{local}}{[\mathit{x}]} &=& \mathit{f}.\mathsf{local}[\mathit{x}] &  \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}lcl@{}l@{}}
+(\mathit{s} ; \mathit{f})[\mathsf{local}[\mathit{x}] = \mathit{v}] &=& \mathit{s} ; \mathit{f}[\mathsf{local}[\mathit{x}] = \mathit{v}] &  \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lcl@{}l@{}}
+(\mathit{s} ; \mathit{f})[\mathsf{global}[\mathit{x}] = \mathit{v}] &=& \mathit{s}[\mathsf{global}[\mathit{f}.\mathsf{module}.\mathsf{global}[\mathit{x}]] = \mathit{v}] ; \mathit{f} &  \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lcl@{}l@{}}
+(\mathit{s} ; \mathit{f})[\mathsf{table}[\mathit{x}][\mathit{i}] = \mathit{r}] &=& \mathit{s}[\mathsf{table}[\mathit{f}.\mathsf{module}.\mathsf{table}[\mathit{x}]][\mathit{i}] = \mathit{r}] ; \mathit{f} &  \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lcl@{}l@{}}
+(\mathit{s} ; \mathit{f})[\mathsf{table}[\mathit{x}] = ..{\mathit{r}^\ast}] &=& \mathit{s}[\mathsf{table}[\mathit{f}.\mathsf{module}.\mathsf{table}[\mathit{x}]] = ..{\mathit{r}^\ast}] ; \mathit{f} &  \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}lcl@{}l@{}}
+(\mathit{s} ; \mathit{f})[\mathsf{elem}[\mathit{x}] = {\mathit{r}^\ast}] &=& \mathit{s}[\mathsf{table}[\mathit{f}.\mathsf{module}.\mathsf{table}[\mathit{x}]] = {\mathit{r}^\ast}] ; \mathit{f} &  \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}lrrl@{}}
+\mbox{(administrative instruction)} & \mathit{instr} &::=& \mathit{instr} \\ &&|&
+\mathsf{ref.func}~\mathsf{\mathit{funcaddr}} \\ &&|&
+\mathsf{ref.extern}~\mathsf{\mathit{hostaddr}} \\ &&|&
+\mathsf{call}~\mathsf{\mathit{funcaddr}} \\ &&|&
+{{\mathsf{label}}_{\mathsf{\mathit{n}}}}{\mathsf{\{{\mathit{instr}^\ast}\}}~\mathsf{{\mathit{instr}^\ast}}} \\ &&|&
+{{\mathsf{frame}}_{\mathsf{\mathit{n}}}}{\mathsf{\{\mathit{frame}\}}~\mathsf{{\mathit{instr}^\ast}}} \\ &&|&
+\mathsf{trap} \\
+\mbox{(evaluation context)} & \mathit{E} &::=& [\mathsf{\_}] \\ &&|&
+{\mathit{val}^\ast}~\mathit{E}~{\mathit{instr}^\ast} \\ &&|&
+{{\mathsf{label}}_{\mathsf{\mathit{n}}}}{\mathsf{\{{\mathit{instr}^\ast}\}}~\mathsf{\mathit{e}}} \\
+\end{array}
+$$
+
+$\boxed{\mathit{config} \hookrightarrow \mathit{config}}$
+
+$\boxed{{\mathit{instr}^\ast} \hookrightarrow {\mathit{instr}^\ast}}$
+
+$\boxed{\mathit{config} \hookrightarrow {\mathit{instr}^\ast}}$
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}pure}]} \quad & \mathit{z} ; {\mathit{instr}^\ast} &\hookrightarrow& \mathit{z} ; {{\mathit{instr}'}^\ast} &\quad
+  \mbox{if}~{\mathit{instr}^\ast} \hookrightarrow {{\mathit{instr}'}^\ast} \\
+{[\textsc{\scriptsize E{-}read}]} \quad & \mathit{z} ; {\mathit{instr}^\ast} &\hookrightarrow& \mathit{z} ; {{\mathit{instr}'}^\ast} &\quad
+  \mbox{if}~\mathit{z} ; {\mathit{instr}^\ast} \hookrightarrow {{\mathit{instr}'}^\ast} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}unreachable}]} \quad & \mathsf{unreachable} &\hookrightarrow& \mathsf{trap} &  \\
+{[\textsc{\scriptsize E{-}nop}]} \quad & \mathsf{nop} &\hookrightarrow& \epsilon &  \\
+{[\textsc{\scriptsize E{-}drop}]} \quad & \mathit{val}~\mathsf{drop} &\hookrightarrow& \epsilon &  \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}select{-}true}]} \quad & \mathit{val}_{1}~\mathit{val}_{2}~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{c})~(\mathsf{select}~{\mathit{t}^?}) &\hookrightarrow& \mathit{val}_{1} &\quad
+  \mbox{if}~\mathit{c} \neq 0 \\
+{[\textsc{\scriptsize E{-}select{-}false}]} \quad & \mathit{val}_{1}~\mathit{val}_{2}~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{c})~(\mathsf{select}~{\mathit{t}^?}) &\hookrightarrow& \mathit{val}_{2} &\quad
+  \mbox{if}~\mathit{c} = 0 \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}block}]} \quad & {\mathit{val}^{\mathit{k}}}~(\mathsf{block}~\mathit{bt}~{\mathit{instr}^\ast}) &\hookrightarrow& ({{\mathsf{label}}_{\mathit{n}}}{\{\epsilon\}~{\mathit{val}^{\mathit{k}}}~{\mathit{instr}^\ast}}) &\quad
+  \mbox{if}~\mathit{bt} = {\mathit{t}_{1}^{\mathit{k}}} \rightarrow {\mathit{t}_{2}^{\mathit{n}}} \\
+{[\textsc{\scriptsize E{-}loop}]} \quad & {\mathit{val}^{\mathit{k}}}~(\mathsf{loop}~\mathit{bt}~{\mathit{instr}^\ast}) &\hookrightarrow& ({{\mathsf{label}}_{\mathit{n}}}{\{\mathsf{loop}~\mathit{bt}~{\mathit{instr}^\ast}\}~{\mathit{val}^{\mathit{k}}}~{\mathit{instr}^\ast}}) &\quad
+  \mbox{if}~\mathit{bt} = {\mathit{t}_{1}^{\mathit{k}}} \rightarrow {\mathit{t}_{2}^{\mathit{n}}} \\
+{[\textsc{\scriptsize E{-}if{-}true}]} \quad & (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{c})~(\mathsf{if}~\mathit{bt}~{\mathit{instr}_{1}^\ast}~\mathsf{else}~{\mathit{instr}_{2}^\ast}) &\hookrightarrow& (\mathsf{block}~\mathit{bt}~{\mathit{instr}_{1}^\ast}) &\quad
+  \mbox{if}~\mathit{c} \neq 0 \\
+{[\textsc{\scriptsize E{-}if{-}false}]} \quad & (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{c})~(\mathsf{if}~\mathit{bt}~{\mathit{instr}_{1}^\ast}~\mathsf{else}~{\mathit{instr}_{2}^\ast}) &\hookrightarrow& (\mathsf{block}~\mathit{bt}~{\mathit{instr}_{2}^\ast}) &\quad
+  \mbox{if}~\mathit{c} = 0 \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}label{-}vals}]} \quad & ({{\mathsf{label}}_{\mathit{n}}}{\{{\mathit{instr}^\ast}\}~{\mathit{val}^\ast}}) &\hookrightarrow& {\mathit{val}^\ast} &  \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}br{-}zero}]} \quad & ({{\mathsf{label}}_{\mathit{n}}}{\{{{\mathit{instr}'}^\ast}\}~{{\mathit{val}'}^\ast}~{\mathit{val}^{\mathit{n}}}~(\mathsf{br}~0)~{\mathit{instr}^\ast}}) &\hookrightarrow& {\mathit{val}^{\mathit{n}}}~{{\mathit{instr}'}^\ast} &  \\
+{[\textsc{\scriptsize E{-}br{-}succ}]} \quad & ({{\mathsf{label}}_{\mathit{n}}}{\{{{\mathit{instr}'}^\ast}\}~{\mathit{val}^\ast}~(\mathsf{br}~\mathit{l} + 1)~{\mathit{instr}^\ast}}) &\hookrightarrow& {\mathit{val}^\ast}~(\mathsf{br}~\mathit{l}) &  \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}br\_if{-}true}]} \quad & (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{c})~(\mathsf{br\_if}~\mathit{l}) &\hookrightarrow& (\mathsf{br}~\mathit{l}) &\quad
+  \mbox{if}~\mathit{c} \neq 0 \\
+{[\textsc{\scriptsize E{-}br\_if{-}false}]} \quad & (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{c})~(\mathsf{br\_if}~\mathit{l}) &\hookrightarrow& \epsilon &\quad
+  \mbox{if}~\mathit{c} = 0 \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}br\_table{-}lt}]} \quad & (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~(\mathsf{br\_table}~{\mathit{l}^\ast}~{\mathit{l}'}) &\hookrightarrow& (\mathsf{br}~{\mathit{l}^\ast}[\mathit{i}]) &\quad
+  \mbox{if}~\mathit{i} < {|{\mathit{l}^\ast}|} \\
+{[\textsc{\scriptsize E{-}br\_table{-}ge}]} \quad & (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~(\mathsf{br\_table}~{\mathit{l}^\ast}~{\mathit{l}'}) &\hookrightarrow& (\mathsf{br}~{\mathit{l}'}) &\quad
+  \mbox{if}~\mathit{i} \geq {|{\mathit{l}^\ast}|} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}call}]} \quad & \mathit{z} ; (\mathsf{call}~\mathit{x}) &\hookrightarrow& (\mathsf{call}~\mathit{z}.\mathsf{module}.\mathsf{func}[\mathit{x}]) &  \\
+{[\textsc{\scriptsize E{-}call\_indirect{-}call}]} \quad & \mathit{z} ; (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~(\mathsf{call\_indirect}~\mathit{x}~\mathit{ft}) &\hookrightarrow& (\mathsf{call}~\mathit{a}) &\quad
+  \mbox{if}~{\mathit{z}.\mathsf{table}}{[\mathit{x}]}[\mathit{i}] = (\mathsf{ref.func}~\mathit{a}) \\
+ &&&&\quad {\land}~\mathit{z}.\mathsf{func}[\mathit{a}] = \mathit{m} ; \mathit{func} \\
+{[\textsc{\scriptsize E{-}call\_indirect{-}trap}]} \quad & \mathit{z} ; (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~(\mathsf{call\_indirect}~\mathit{x}~\mathit{ft}) &\hookrightarrow& \mathsf{trap} &\quad
+  \mbox{otherwise} \\
+{[\textsc{\scriptsize E{-}call\_addr}]} \quad & \mathit{z} ; {\mathit{val}^{\mathit{k}}}~(\mathsf{call}~\mathit{a}) &\hookrightarrow& ({{\mathsf{frame}}_{\mathit{n}}}{\{\mathit{f}\}~({{\mathsf{label}}_{\mathit{n}}}{\{\epsilon\}~{\mathit{instr}^\ast}})}) &\quad
+  \mbox{if}~\mathit{z}.\mathsf{func}[\mathit{a}] = \mathit{m} ; \mathsf{func}~({\mathit{t}_{1}^{\mathit{k}}} \rightarrow {\mathit{t}_{2}^{\mathit{n}}})~{\mathit{t}^\ast}~{\mathit{instr}^\ast} \\
+ &&&&\quad {\land}~\mathit{f} = \{ \begin{array}[t]{@{}l@{}}
+\mathsf{local}~{\mathit{val}^{\mathit{k}}}~{({\mathrm{default}}_{\mathit{t}})^\ast},\; \mathsf{module}~\mathit{m} \}\end{array} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}frame{-}vals}]} \quad & ({{\mathsf{frame}}_{\mathit{n}}}{\{\mathit{f}\}~{\mathit{val}^{\mathit{n}}}}) &\hookrightarrow& {\mathit{val}^{\mathit{n}}} &  \\
+{[\textsc{\scriptsize E{-}return{-}frame}]} \quad & ({{\mathsf{frame}}_{\mathit{n}}}{\{\mathit{f}\}~{{\mathit{val}'}^\ast}~{\mathit{val}^{\mathit{n}}}~\mathsf{return}~{\mathit{instr}^\ast}}) &\hookrightarrow& {\mathit{val}^{\mathit{n}}} &  \\
+{[\textsc{\scriptsize E{-}return{-}label}]} \quad & ({{\mathsf{label}}_{\mathit{k}}}{\{{{\mathit{instr}'}^\ast}\}~{\mathit{val}^\ast}~\mathsf{return}~{\mathit{instr}^\ast}}) &\hookrightarrow& {\mathit{val}^\ast}~\mathsf{return} &  \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}unop{-}val}]} \quad & (\mathit{nt}.\mathsf{const}~\mathit{c}_{1})~(\mathit{nt} . \mathit{unop}) &\hookrightarrow& (\mathit{nt}.\mathsf{const}~\mathit{c}) &\quad
+  \mbox{if}~{\mathit{unop}}{{\mathsf{}}_{\mathit{nt}}\,(\mathit{c}_{1})} = \mathit{c} \\
+{[\textsc{\scriptsize E{-}unop{-}trap}]} \quad & (\mathit{nt}.\mathsf{const}~\mathit{c}_{1})~(\mathit{nt} . \mathit{unop}) &\hookrightarrow& \mathsf{trap} &\quad
+  \mbox{if}~{\mathit{unop}}{{\mathsf{}}_{\mathit{nt}}\,(\mathit{c}_{1})} = \epsilon \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}binop{-}val}]} \quad & (\mathit{nt}.\mathsf{const}~\mathit{c}_{1})~(\mathit{nt}.\mathsf{const}~\mathit{c}_{2})~(\mathit{nt} . \mathit{binop}) &\hookrightarrow& (\mathit{nt}.\mathsf{const}~\mathit{c}) &\quad
+  \mbox{if}~{\mathit{binop}}{{\mathsf{}}_{\mathit{nt}}\,(\mathit{c}_{1},\, \mathit{c}_{2})} = \mathit{c} \\
+{[\textsc{\scriptsize E{-}binop{-}trap}]} \quad & (\mathit{nt}.\mathsf{const}~\mathit{c}_{1})~(\mathit{nt}.\mathsf{const}~\mathit{c}_{2})~(\mathit{nt} . \mathit{binop}) &\hookrightarrow& \mathsf{trap} &\quad
+  \mbox{if}~{\mathit{binop}}{{\mathsf{}}_{\mathit{nt}}\,(\mathit{c}_{1},\, \mathit{c}_{2})} = \epsilon \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}testop}]} \quad & (\mathit{nt}.\mathsf{const}~\mathit{c}_{1})~(\mathit{nt} . \mathit{testop}) &\hookrightarrow& (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{c}) &\quad
+  \mbox{if}~\mathit{c} = {\mathit{testop}}{{\mathsf{}}_{\mathit{nt}}\,(\mathit{c}_{1})} \\
+{[\textsc{\scriptsize E{-}relop}]} \quad & (\mathit{nt}.\mathsf{const}~\mathit{c}_{1})~(\mathit{nt}.\mathsf{const}~\mathit{c}_{2})~(\mathit{nt} . \mathit{relop}) &\hookrightarrow& (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{c}) &\quad
+  \mbox{if}~\mathit{c} = {\mathit{relop}}{{\mathsf{}}_{\mathit{nt}}\,(\mathit{c}_{1},\, \mathit{c}_{2})} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}extend}]} \quad & (\mathit{nt}.\mathsf{const}~\mathit{c})~({\mathit{nt}.\mathsf{extend}}{\mathit{n}}) &\hookrightarrow& (\mathit{nt}.\mathsf{const}~{{\mathrm{ext}}_{\mathit{n}}({|\mathit{nt}|})^{\mathsf{s}}}~(\mathit{c})) &  \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}cvtop{-}val}]} \quad & (\mathit{nt}.\mathsf{const}~\mathit{c}_{1})~(\mathit{nt}_{1} . {{{{\mathit{cvtop}}{\mathsf{\_}}}{\mathit{nt}_{2}}}{\mathsf{\_}}}{{\mathit{sx}^?}}) &\hookrightarrow& (\mathit{nt}.\mathsf{const}~\mathit{c}) &\quad
+  \mbox{if}~\mathrm{cvtop}(\mathit{nt}_{1},\, \mathit{cvtop},\, \mathit{nt}_{2},\, {\mathit{sx}^?},\, \mathit{c}_{1}) = \mathit{c} \\
+{[\textsc{\scriptsize E{-}cvtop{-}trap}]} \quad & (\mathit{nt}.\mathsf{const}~\mathit{c}_{1})~(\mathit{nt}_{1} . {{{{\mathit{cvtop}}{\mathsf{\_}}}{\mathit{nt}_{2}}}{\mathsf{\_}}}{{\mathit{sx}^?}}) &\hookrightarrow& \mathsf{trap} &\quad
+  \mbox{if}~\mathrm{cvtop}(\mathit{nt}_{1},\, \mathit{cvtop},\, \mathit{nt}_{2},\, {\mathit{sx}^?},\, \mathit{c}_{1}) = \epsilon \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}ref.func}]} \quad & \mathit{z} ; (\mathsf{ref.func}~\mathit{x}) &\hookrightarrow& (\mathsf{ref.func}~\mathit{z}.\mathsf{module}.\mathsf{func}[\mathit{x}]) &  \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}ref.is\_null{-}true}]} \quad & \mathit{val}~\mathsf{ref.is\_null} &\hookrightarrow& (\mathsf{i{\scriptstyle32}}.\mathsf{const}~1) &\quad
+  \mbox{if}~\mathit{val} = (\mathsf{ref.null}~\mathit{rt}) \\
+{[\textsc{\scriptsize E{-}ref.is\_null{-}false}]} \quad & \mathit{val}~\mathsf{ref.is\_null} &\hookrightarrow& (\mathsf{i{\scriptstyle32}}.\mathsf{const}~0) &\quad
+  \mbox{otherwise} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}local.get}]} \quad & \mathit{z} ; (\mathsf{local.get}~\mathit{x}) &\hookrightarrow& {\mathit{z}.\mathsf{local}}{[\mathit{x}]} &  \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}local.set}]} \quad & \mathit{z} ; \mathit{val}~(\mathsf{local.set}~\mathit{x}) &\hookrightarrow& \mathit{z}[\mathsf{local}[\mathit{x}] = \mathit{val}] ; \epsilon &  \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}local.tee}]} \quad & \mathit{val}~(\mathsf{local.tee}~\mathit{x}) &\hookrightarrow& \mathit{val}~\mathit{val}~(\mathsf{local.set}~\mathit{x}) &  \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}global.get}]} \quad & \mathit{z} ; (\mathsf{global.get}~\mathit{x}) &\hookrightarrow& {\mathit{z}.\mathsf{global}}{[\mathit{x}]} &  \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}global.set}]} \quad & \mathit{z} ; \mathit{val}~(\mathsf{global.set}~\mathit{x}) &\hookrightarrow& \mathit{z}[\mathsf{global}[\mathit{x}] = \mathit{val}] ; \epsilon &  \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}table.get{-}trap}]} \quad & \mathit{z} ; (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~(\mathsf{table.get}~\mathit{x}) &\hookrightarrow& \mathsf{trap} &\quad
+  \mbox{if}~\mathit{i} \geq {|{\mathit{z}.\mathsf{table}}{[\mathit{x}]}|} \\
+{[\textsc{\scriptsize E{-}table.get{-}val}]} \quad & \mathit{z} ; (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~(\mathsf{table.get}~\mathit{x}) &\hookrightarrow& {\mathit{z}.\mathsf{table}}{[\mathit{x}]}[\mathit{i}] &\quad
+  \mbox{if}~\mathit{i} < {|{\mathit{z}.\mathsf{table}}{[\mathit{x}]}|} \\
+{[\textsc{\scriptsize E{-}table.set{-}trap}]} \quad & \mathit{z} ; (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~\mathit{ref}~(\mathsf{table.get}~\mathit{x}) &\hookrightarrow& \mathsf{trap} &\quad
+  \mbox{if}~\mathit{i} \geq {|{\mathit{z}.\mathsf{table}}{[\mathit{x}]}|} \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}table.set{-}val}]} \quad & \mathit{z} ; (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~\mathit{ref}~(\mathsf{table.get}~\mathit{x}) &\hookrightarrow& \mathit{z}[\mathsf{table}[\mathit{x}][\mathit{i}] = \mathit{ref}] ; \epsilon &\quad
+  \mbox{if}~\mathit{i} < {|{\mathit{z}.\mathsf{table}}{[\mathit{x}]}|} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}table.size}]} \quad & \mathit{z} ; (\mathsf{table.size}~\mathit{x}) &\hookrightarrow& (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{n}) &\quad
+  \mbox{if}~{|{\mathit{z}.\mathsf{table}}{[\mathit{x}]}|} = \mathit{n} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}table.grow{-}succeed}]} \quad & \mathit{z} ; \mathit{ref}~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{n})~(\mathsf{table.grow}~\mathit{x}) &\hookrightarrow& \mathit{z}[\mathsf{table}[\mathit{x}] = ..{\mathit{ref}^{\mathit{n}}}] ; (\mathsf{i{\scriptstyle32}}.\mathsf{const}~{|{\mathit{z}.\mathsf{table}}{[\mathit{x}]}|}) &  \\
+\end{array}
+$$
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}table.grow{-}fail}]} \quad & \mathit{z} ; (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{n})~(\mathsf{table.grow}~\mathit{x}) &\hookrightarrow& (\mathsf{i{\scriptstyle32}}.\mathsf{const}~-1) &  \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}table.fill{-}trap}]} \quad & \mathit{z} ; (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~\mathit{val}~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{n})~(\mathsf{table.fill}~\mathit{x}) &\hookrightarrow& \mathsf{trap} &\quad
+  \mbox{if}~\mathit{i} + \mathit{n} > {|{\mathit{z}.\mathsf{table}}{[\mathit{x}]}|} \\
+{[\textsc{\scriptsize E{-}table.fill{-}zero}]} \quad & \mathit{z} ; (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~\mathit{val}~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{n})~(\mathsf{table.fill}~\mathit{x}) &\hookrightarrow& \epsilon &\quad
+  \mbox{otherwise, if}~\mathit{n} = 0 \\
+{[\textsc{\scriptsize E{-}table.fill{-}succ}]} \quad & \mathit{z} ; (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~\mathit{val}~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{n})~(\mathsf{table.fill}~\mathit{x}) &\hookrightarrow& (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~\mathit{val}~(\mathsf{table.set}~\mathit{x})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i} + 1)~\mathit{val}~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{n} - 1)~(\mathsf{table.fill}~\mathit{x}) &\quad
+  \mbox{otherwise} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}table.copy{-}trap}]} \quad & \mathit{z} ; (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{j})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{n})~(\mathsf{table.copy}~\mathit{x}~\mathit{y}) &\hookrightarrow& \mathsf{trap} &\quad
+  \mbox{if}~\mathit{i} + \mathit{n} > {|{\mathit{z}.\mathsf{table}}{[\mathit{y}]}|} \lor \mathit{j} + \mathit{n} > {|{\mathit{z}.\mathsf{table}}{[\mathit{x}]}|} \\
+{[\textsc{\scriptsize E{-}table.copy{-}zero}]} \quad & \mathit{z} ; (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{j})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{n})~(\mathsf{table.copy}~\mathit{x}~\mathit{y}) &\hookrightarrow& \epsilon &\quad
+  \mbox{otherwise, if}~\mathit{n} = 0 \\
+{[\textsc{\scriptsize E{-}table.copy{-}le}]} \quad & \mathit{z} ; (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{j})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{n})~(\mathsf{table.copy}~\mathit{x}~\mathit{y}) &\hookrightarrow& (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{j})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~(\mathsf{table.get}~\mathit{y})~(\mathsf{table.set}~\mathit{x})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{j} + 1)~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i} + 1)~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{n} - 1)~(\mathsf{table.copy}~\mathit{x}~\mathit{y}) &\quad
+  \mbox{otherwise, if}~\mathit{j} \leq \mathit{i} \\
+{[\textsc{\scriptsize E{-}table.copy{-}gt}]} \quad & \mathit{z} ; (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{j})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{n})~(\mathsf{table.copy}~\mathit{x}~\mathit{y}) &\hookrightarrow& (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{j} + \mathit{n} - 1)~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i} + \mathit{n} - 1)~(\mathsf{table.get}~\mathit{y})~(\mathsf{table.set}~\mathit{x})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{j} + 1)~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i} + 1)~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{n} - 1)~(\mathsf{table.copy}~\mathit{x}~\mathit{y}) &\quad
+  \mbox{otherwise} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}table.init{-}trap}]} \quad & \mathit{z} ; (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{j})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{n})~(\mathsf{table.init}~\mathit{x}~\mathit{y}) &\hookrightarrow& \mathsf{trap} &\quad
+  \mbox{if}~\mathit{i} + \mathit{n} > {|{\mathit{z}.\mathsf{elem}}{[\mathit{y}]}|} \lor \mathit{j} + \mathit{n} > {|{\mathit{z}.\mathsf{table}}{[\mathit{x}]}|} \\
+{[\textsc{\scriptsize E{-}table.init{-}zero}]} \quad & \mathit{z} ; (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{j})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{n})~(\mathsf{table.init}~\mathit{x}~\mathit{y}) &\hookrightarrow& \epsilon &\quad
+  \mbox{otherwise, if}~\mathit{n} = 0 \\
+{[\textsc{\scriptsize E{-}table.init{-}succ}]} \quad & \mathit{z} ; (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{j})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{n})~(\mathsf{table.init}~\mathit{x}~\mathit{y}) &\hookrightarrow& (\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{j})~{\mathit{z}.\mathsf{elem}}{[\mathit{y}]}[\mathit{i}]~(\mathsf{table.set}~\mathit{x})~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{j} + 1)~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{i} + 1)~(\mathsf{i{\scriptstyle32}}.\mathsf{const}~\mathit{n} - 1)~(\mathsf{table.init}~\mathit{x}~\mathit{y}) &\quad
+  \mbox{otherwise} \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+$$
+\begin{array}{@{}l@{}lcl@{}l@{}}
+{[\textsc{\scriptsize E{-}elem.drop}]} \quad & \mathit{z} ; (\mathsf{elem.drop}~\mathit{x}) &\hookrightarrow& \mathit{z}[\mathsf{elem}[\mathit{x}] = \epsilon] ; \epsilon &  \\
+\end{array}
+$$
+
+\vspace{1ex}
+
+
+== Complete.
+```
diff --git a/spectec/test-frontend/dune b/spectec/test-frontend/dune
index 47035d055b..4236b979f3 100644
--- a/spectec/test-frontend/dune
+++ b/spectec/test-frontend/dune
@@ -4,5 +4,5 @@
     (file ../src/exe-watsup/main.exe)
     (glob_files ../spec/*.watsup)
   )
-  (files TEST.md)
+  (files TEST.md PASSES.md)
 )

From 7b8cd81ae3d5fe373d5e6511ff1af1f4dd99dad1 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sun, 9 Apr 2023 14:26:32 +0200
Subject: [PATCH 59/98] Side conditions: Now also side-conditions from
 iteration

---
 spectec/src/middlend/sideconditions.ml | 19 ++++++++++--
 spectec/test-frontend/PASSES.md        | 40 ++++++++++++++++++++++++++
 spectec/test-lean4/TEST.md             | 20 +++++++++++++
 3 files changed, 77 insertions(+), 2 deletions(-)

diff --git a/spectec/src/middlend/sideconditions.ml b/spectec/src/middlend/sideconditions.ml
index 8bd128f44b..8a168cc6f0 100644
--- a/spectec/src/middlend/sideconditions.ml
+++ b/spectec/src/middlend/sideconditions.ml
@@ -18,6 +18,19 @@ open Il.Ast
 
 let _error at msg = Source.error at "sideconditions" msg
 
+let is_null e = CmpE (EqOp, e, OptE None $ no_region) $ no_region
+let iffE e1 e2 = IfPr (BinE (EquivOp, e1, e2) $ no_region) $ no_region
+let same_len e1 e2 = IfPr (CmpE (EqOp, LenE e1 $ no_region, LenE e2 $ no_region) $ no_region) $ no_region
+let has_len ne e = IfPr (CmpE (EqOp, LenE e $ no_region, ne) $ no_region) $ no_region
+
+let iter_side_conditions ((iter, vs) : iterexp) : premise list =
+  let ves = List.map (fun v -> IterE (VarE v $ no_region, (iter, [v])) $ no_region) vs in
+ match iter, ves with
+  | _, [] -> []
+  | Opt, (e::es) -> List.map (fun e' -> iffE (is_null e) (is_null e')) es
+  | (List|List1), (e::es) -> List.map (same_len e) es
+  | ListN ne, es -> List.map (has_len ne) es
+
 (* Expr traversal *)
 let rec t_exp e : premise list =
   (* First the conditions to be generated here *)
@@ -26,9 +39,10 @@ let rec t_exp e : premise list =
     [IfPr (CmpE (LtOp, exp2, LenE exp1 $ no_region) $ no_region) $ no_region]
   | TheE exp ->
     [IfPr (CmpE (NeOp, exp, OptE None $ no_region) $ no_region) $ no_region]
+  | IterE (_exp, iterexp) -> iter_side_conditions iterexp
   | _ -> []
   end @
-  (* And now decend *)
+  (* And now descend *)
   match e.it with
   | VarE _ | BoolE _ | NatE _ | TextE _ | OptE None
   -> []
@@ -77,7 +91,8 @@ let rec t_prem prem = match prem.it with
   | IfPr e -> t_exp e
   | ElsePr -> []
   | IterPr (prem, iterexp)
-  -> List.map (fun pr -> IterPr (pr, iterexp) $ no_region) (t_prem prem) @ t_iterexp iterexp
+  -> iter_side_conditions iterexp @
+     List.map (fun pr -> IterPr (pr, iterexp) $ no_region) (t_prem prem) @ t_iterexp iterexp
 
 let t_prems = List.concat_map t_prem
 
diff --git a/spectec/test-frontend/PASSES.md b/spectec/test-frontend/PASSES.md
index d8189ce557..f69c609a8d 100644
--- a/spectec/test-frontend/PASSES.md
+++ b/spectec/test-frontend/PASSES.md
@@ -1916,6 +1916,7 @@ relation Resulttype_sub: `|-%*<:%*`(valtype*, valtype*)
   ;; 3-typing.watsup:70.1-72.35
   rule _ {t_1* : valtype*, t_2* : valtype*}:
     `|-%*<:%*`(t_1*{t_1}, t_2*{t_2})
+    -- if (|t_1*{t_1}| = |t_2*{t_2}|)
     -- (Valtype_sub: `|-%<:%`(t_1, t_2))*{t_1 t_2}
 
 ;; 3-typing.watsup:75.1-75.75
@@ -2245,6 +2246,7 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
   rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?}:
     `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
     -- if (0 < |C.MEM_context|)
+    -- if ((n?{n} = ?()) <=> (sx?{sx} = ?()))
     -- if (C.MEM_context[0] = mt)
     -- if ((2 ^ n_A) <= ($size(nt <: valtype) / 8))
     -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(nt <: valtype) / 8))))?{n}
@@ -2448,6 +2450,12 @@ relation Module_ok: `|-%:OK`(module)
   ;; 3-typing.watsup:486.1-501.22
   rule _ {C : context, data^n : data^n, elem* : elem*, export* : export*, ft* : functype*, func* : func*, global* : global*, gt* : globaltype*, import* : import*, mem* : mem*, mt* : memtype*, n : n, rt* : reftype*, start* : start*, table* : table*, tt* : tabletype*}:
     `|-%:OK`(`MODULE%*%*%*%*%*%*%*%*%*`(import*{import}, func*{func}, global*{global}, table*{table}, mem*{mem}, elem*{elem}, data^n{data}, start*{start}, export*{export}))
+    -- if (|ft*{ft}| = |func*{func}|)
+    -- if (|global*{global}| = |gt*{gt}|)
+    -- if (|table*{table}| = |tt*{tt}|)
+    -- if (|mem*{mem}| = |mt*{mt}|)
+    -- if (|elem*{elem}| = |rt*{rt}|)
+    -- if (|data^n{data}| = n)
     -- if (C = {FUNC ft*{ft}, GLOBAL gt*{gt}, TABLE tt*{tt}, MEM mt*{mt}, ELEM rt*{rt}, DATA OK^n{}, LOCAL [], LABEL [], RETURN ?()})
     -- (Func_ok: `%|-%:%`(C, func, ft))*{ft func}
     -- (Global_ok: `%|-%:%`(C, global, gt))*{global gt}
@@ -2748,11 +2756,17 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:35.1-37.28
   rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
     `%*~>%*`((val <: admininstr)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    -- if (|t_1^k{t_1}| = k)
+    -- if (|t_2^n{t_2}| = n)
+    -- if (|val^k{val}| = k)
     -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
 
   ;; 6-reduction.watsup:39.1-41.28
   rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
     `%*~>%*`((val <: admininstr)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [LOOP_instr(bt, instr*{instr})], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    -- if (|t_1^k{t_1}| = k)
+    -- if (|t_2^n{t_2}| = n)
+    -- if (|val^k{val}| = k)
     -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
 
   ;; 6-reduction.watsup:43.1-45.16
@@ -2772,6 +2786,7 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:57.1-58.69
   rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
     `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [BR_admininstr(0)] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val} :: (instr' <: admininstr)*{instr'})
+    -- if (|val^n{val}| = n)
 
   ;; 6-reduction.watsup:60.1-61.65
   rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
@@ -2800,10 +2815,12 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:100.1-101.35
   rule frame-vals {f : frame, n : n, val^n : val^n}:
     `%*~>%*`([FRAME__admininstr(n, f, (val <: admininstr)^n{val})], (val <: admininstr)^n{val})
+    -- if (|val^n{val}| = n)
 
   ;; 6-reduction.watsup:103.1-104.55
   rule return-frame {f : frame, instr* : instr*, n : n, val^n : val^n, val'* : val*}:
     `%*~>%*`([FRAME__admininstr(n, f, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val})
+    -- if (|val^n{val}| = n)
 
   ;; 6-reduction.watsup:106.1-107.60
   rule return-label {instr* : instr*, instr'* : instr*, k : nat, val* : val*}:
@@ -2891,6 +2908,9 @@ relation Step_read: `%~>%*`(config, admininstr*)
   rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
     `%~>%*`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], (instr <: admininstr)*{instr})])])
     -- if (a < |$funcinst(z)|)
+    -- if (|t_1^k{t_1}| = k)
+    -- if (|t_2^n{t_2}| = n)
+    -- if (|val^k{val}| = k)
     -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
     -- if (f = {LOCAL val^k{val} :: $default_(t)*{t}, MODULE m})
 
@@ -4939,6 +4959,7 @@ relation Resulttype_sub: `|-%*<:%*`(valtype*, valtype*)
   ;; 3-typing.watsup:70.1-72.35
   rule _ {t_1* : valtype*, t_2* : valtype*}:
     `|-%*<:%*`(t_1*{t_1}, t_2*{t_2})
+    -- if (|t_1*{t_1}| = |t_2*{t_2}|)
     -- (Valtype_sub: `|-%<:%`(t_1, t_2))*{t_1 t_2}
 
 ;; 3-typing.watsup:75.1-75.75
@@ -5275,6 +5296,7 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (0 < |C.MEM_context|)
     -- if ($size(nt <: valtype) =/= ?())
     -- (if ($size(nt <: valtype) =/= ?()))?{n}
+    -- if ((n?{n} = ?()) <=> (sx?{sx} = ?()))
     -- if (C.MEM_context[0] = mt)
     -- if ((2 ^ n_A) <= (!($size(nt <: valtype)) / 8))
     -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size(nt <: valtype)) / 8))))?{n}
@@ -5480,6 +5502,12 @@ relation Module_ok: `|-%:OK`(module)
   ;; 3-typing.watsup:486.1-501.22
   rule _ {C : context, data^n : data^n, elem* : elem*, export* : export*, ft* : functype*, func* : func*, global* : global*, gt* : globaltype*, import* : import*, mem* : mem*, mt* : memtype*, n : n, rt* : reftype*, start* : start*, table* : table*, tt* : tabletype*}:
     `|-%:OK`(`MODULE%*%*%*%*%*%*%*%*%*`(import*{import}, func*{func}, global*{global}, table*{table}, mem*{mem}, elem*{elem}, data^n{data}, start*{start}, export*{export}))
+    -- if (|ft*{ft}| = |func*{func}|)
+    -- if (|global*{global}| = |gt*{gt}|)
+    -- if (|table*{table}| = |tt*{tt}|)
+    -- if (|mem*{mem}| = |mt*{mt}|)
+    -- if (|elem*{elem}| = |rt*{rt}|)
+    -- if (|data^n{data}| = n)
     -- if (C = {FUNC ft*{ft}, GLOBAL gt*{gt}, TABLE tt*{tt}, MEM mt*{mt}, ELEM rt*{rt}, DATA OK^n{}, LOCAL [], LABEL [], RETURN ?()})
     -- (Func_ok: `%|-%:%`(C, func, ft))*{ft func}
     -- (Global_ok: `%|-%:%`(C, global, gt))*{global gt}
@@ -5782,11 +5810,17 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:35.1-37.28
   rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
     `%*~>%*`((val <: admininstr)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    -- if (|t_1^k{t_1}| = k)
+    -- if (|t_2^n{t_2}| = n)
+    -- if (|val^k{val}| = k)
     -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
 
   ;; 6-reduction.watsup:39.1-41.28
   rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
     `%*~>%*`((val <: admininstr)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [LOOP_instr(bt, instr*{instr})], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    -- if (|t_1^k{t_1}| = k)
+    -- if (|t_2^n{t_2}| = n)
+    -- if (|val^k{val}| = k)
     -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
 
   ;; 6-reduction.watsup:43.1-45.16
@@ -5806,6 +5840,7 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:57.1-58.69
   rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
     `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [BR_admininstr(0)] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val} :: (instr' <: admininstr)*{instr'})
+    -- if (|val^n{val}| = n)
 
   ;; 6-reduction.watsup:60.1-61.65
   rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
@@ -5834,10 +5869,12 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:100.1-101.35
   rule frame-vals {f : frame, n : n, val^n : val^n}:
     `%*~>%*`([FRAME__admininstr(n, f, (val <: admininstr)^n{val})], (val <: admininstr)^n{val})
+    -- if (|val^n{val}| = n)
 
   ;; 6-reduction.watsup:103.1-104.55
   rule return-frame {f : frame, instr* : instr*, n : n, val^n : val^n, val'* : val*}:
     `%*~>%*`([FRAME__admininstr(n, f, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val})
+    -- if (|val^n{val}| = n)
 
   ;; 6-reduction.watsup:106.1-107.60
   rule return-label {instr* : instr*, instr'* : instr*, k : nat, val* : val*}:
@@ -5926,6 +5963,9 @@ relation Step_read: `%~>%*`(config, admininstr*)
   rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
     `%~>%*`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], (instr <: admininstr)*{instr})])])
     -- if (a < |$funcinst(z)|)
+    -- if (|t_1^k{t_1}| = k)
+    -- if (|t_2^n{t_2}| = n)
+    -- if (|val^k{val}| = k)
     -- (if ($default_(t) =/= ?()))*{t}
     -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
     -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 90527d9b65..d61da5cebe 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -424,6 +424,7 @@ inductive Valtype_sub : (Valtype × Valtype) -> Prop where
 
 inductive Resulttype_sub : ((List Valtype) × (List Valtype)) -> Prop where
   | rule_0 (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
+    (t_1.length == t_2.length) ->
     (Forall₂ (λ t_1 t_2 ↦ (Valtype_sub (t_1, t_2))) t_1 t_2) ->
     (Resulttype_sub (t_1, t_2))
 
@@ -646,6 +647,7 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (0 < C.MEM.length) ->
     ((«$size» («$valtype_numtype» nt)) != none) ->
     (Forall (λ n ↦ ((«$size» («$valtype_numtype» nt)) != none)) n.toList) ->
+    ((n == none) = (sx == none)) ->
     ((C.MEM.get! 0) == mt) ->
     ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))) ->
     (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))))) n.toList) ->
@@ -792,6 +794,12 @@ inductive Export_ok : (Context × Export × Externtype) -> Prop where
 
 inductive Module_ok : Module -> Prop where
   | rule_0 (C : Context) (data : (List Data)) (elem : (List Elem)) («export» : (List Export)) (ft : (List Functype)) (func : (List Func)) («global» : (List Global)) (gt : (List Globaltype)) («import» : (List Import)) (mem : (List Mem)) (mt : (List Memtype)) (n : N) (rt : (List Reftype)) (start : (List Start)) (table : (List Table)) (tt : (List Tabletype)) :
+    (ft.length == func.length) ->
+    («global».length == gt.length) ->
+    (table.length == tt.length) ->
+    (mem.length == mt.length) ->
+    (elem.length == rt.length) ->
+    (data.length == n) ->
     (C == {FUNC := ft, GLOBAL := gt, TABLE := tt, MEM := mt, ELEM := rt, DATA := [()], LOCAL := [], LABEL := [], RETURN := none}) ->
     (Forall₂ (λ ft func ↦ (Func_ok (C, func, ft))) ft func) ->
     (Forall₂ (λ «global» gt ↦ (Global_ok (C, «global», gt))) «global» gt) ->
@@ -1121,9 +1129,15 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (c == 0) ->
     (Step_pure ([(«$admininstr_val» val_1), («$admininstr_val» val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)], [(«$admininstr_val» val_2)]))
   | block (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
+    (t_1.length == k) ->
+    (t_2.length == n) ->
+    (val.length == k) ->
     (bt == (t_1, t_2)) ->
     (Step_pure (((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.BLOCK (bt, instr))]), [(Admininstr.LABEL_ (n, [], ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr))))]))
   | loop (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
+    (t_1.length == k) ->
+    (t_2.length == n) ->
+    (val.length == k) ->
     (bt == (t_1, t_2)) ->
     (Step_pure (((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.LOOP (bt, instr))]), [(Admininstr.LABEL_ (n, [(Instr.LOOP (bt, instr))], ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr))))]))
   | if_true (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) :
@@ -1135,6 +1149,7 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
   | label_vals (instr : (List Instr)) (n : N) (val : (List Val)) :
     (Step_pure ([(Admininstr.LABEL_ (n, instr, (List.map (λ val ↦ («$admininstr_val» val)) val)))], (List.map (λ val ↦ («$admininstr_val» val)) val)))
   | br_zero (instr : (List Instr)) (instr' : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) :
+    (val.length == n) ->
     (Step_pure ([(Admininstr.LABEL_ (n, instr', ((List.map (λ val' ↦ («$admininstr_val» val')) val') ++ ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([(Admininstr.BR 0)] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr))))))], ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ (List.map (λ instr' ↦ («$admininstr_instr» instr')) instr'))))
   | br_succ (instr : (List Instr)) (instr' : (List Instr)) (l : Labelidx) (n : N) (val : (List Val)) :
     (Step_pure ([(Admininstr.LABEL_ (n, instr', ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([(Admininstr.BR (l + 1))] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)))))], ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.BR l)])))
@@ -1151,8 +1166,10 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (i >= l.length) ->
     (Step_pure ([(Admininstr.CONST (Numtype.I32, i)), (Admininstr.BR_TABLE (l, l'))], [(Admininstr.BR l')]))
   | frame_vals (f : Frame) (n : N) (val : (List Val)) :
+    (val.length == n) ->
     (Step_pure ([(Admininstr.FRAME_ (n, f, (List.map (λ val ↦ («$admininstr_val» val)) val)))], (List.map (λ val ↦ («$admininstr_val» val)) val)))
   | return_frame (f : Frame) (instr : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) :
+    (val.length == n) ->
     (Step_pure ([(Admininstr.FRAME_ (n, f, ((List.map (λ val' ↦ («$admininstr_val» val')) val') ++ ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([Admininstr.RETURN] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr))))))], (List.map (λ val ↦ («$admininstr_val» val)) val)))
   | return_label (instr : (List Instr)) (instr' : (List Instr)) (k : Nat) (val : (List Val)) :
     (Step_pure ([(Admininstr.LABEL_ (k, instr', ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([Admininstr.RETURN] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)))))], ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [Admininstr.RETURN])))
@@ -1207,6 +1224,9 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [Admininstr.TRAP]))
   | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
     (a < («$funcinst» z).length) ->
+    (t_1.length == k) ->
+    (t_2.length == n) ->
+    (val.length == k) ->
     (Forall (λ t ↦ ((«$default_» t) != none)) t) ->
     (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
     (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->

From e194c11a72ab027af1e16f24022f7dab8241f5b3 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sun, 9 Apr 2023 14:52:30 +0200
Subject: [PATCH 60/98] Unify binary

---
 spectec/Makefile                |   8 -
 spectec/src/exe-haskell/dune    |   4 -
 spectec/src/exe-haskell/main.ml |  72 ----
 spectec/src/exe-lean4/dune      |   4 -
 spectec/src/exe-lean4/main.ml   |  79 -----
 spectec/src/exe-watsup/main.ml  |  73 ++--
 spectec/test-frontend/PASSES.md | 611 ++++++++++++++++++++++++++++----
 spectec/test-haskell/TEST.md    |   2 +-
 spectec/test-haskell/dune       |   2 +-
 spectec/test-lean4/TEST.md      |   2 +-
 spectec/test-lean4/dune         |   2 +-
 11 files changed, 594 insertions(+), 265 deletions(-)
 delete mode 100644 spectec/src/exe-haskell/dune
 delete mode 100644 spectec/src/exe-haskell/main.ml
 delete mode 100644 spectec/src/exe-lean4/dune
 delete mode 100644 spectec/src/exe-lean4/main.ml

diff --git a/spectec/Makefile b/spectec/Makefile
index f21dd428a1..8de9a889bd 100644
--- a/spectec/Makefile
+++ b/spectec/Makefile
@@ -29,14 +29,6 @@ exe:
 	dune build $(DUNE_OPTS) $(SRCDIR)/$(EXE)
 	ln -sf $(OUTDIR)/$(EXE) ./$(NAME)
 
-exe-haskell:
-	dune build $(DUNE_OPTS) $(SRCDIR)/exe-haskell/main.exe
-	ln -sf $(OUTDIR)/exe-haskell/main.exe ./$(NAME)-haskell
-
-exe-lean4:
-	dune build $(DUNE_OPTS) $(SRCDIR)/exe-lean4/main.exe
-	ln -sf $(OUTDIR)/exe-lean4/main.exe ./$(NAME)-lean4
-
 # Latex
 
 .PHONY: latex
diff --git a/spectec/src/exe-haskell/dune b/spectec/src/exe-haskell/dune
deleted file mode 100644
index a9da47797c..0000000000
--- a/spectec/src/exe-haskell/dune
+++ /dev/null
@@ -1,4 +0,0 @@
-(executable
-  (name main)
-  (libraries spectec)
-)
diff --git a/spectec/src/exe-haskell/main.ml b/spectec/src/exe-haskell/main.ml
deleted file mode 100644
index d2f9c96391..0000000000
--- a/spectec/src/exe-haskell/main.ml
+++ /dev/null
@@ -1,72 +0,0 @@
-open Util
-
-
-(* Configuration *)
-
-let name = "watsup"
-let version = "0.3"
-
-
-(* Flags and parameters *)
-
-let log = ref false  (* log execution steps *)
-let dst = ref false  (* patch files *)
-
-let srcs = ref []    (* src file arguments *)
-let dsts = ref []    (* destination file arguments *)
-let odst = ref ""    (* generation file argument *)
-
-
-(* Argument parsing *)
-
-let banner () =
-  print_endline (name ^ " " ^ version ^ " generator")
-
-let usage = "Usage: " ^ name ^ " [option] [file ...] [-p file ...]"
-
-let add_arg source =
-  let args = if !dst then dsts else srcs in args := !args @ [source]
-
-let argspec = Arg.align
-[
-  "-v", Arg.Unit banner, " Show version";
-  "-o", Arg.String (fun s -> odst := s), " Generate file";
-  "-p", Arg.Set dst, " Patch files";
-  "-l", Arg.Set log, " Log execution steps";
-  "-help", Arg.Unit ignore, "";
-  "--help", Arg.Unit ignore, "";
-]
-
-
-(* Main *)
-
-let log s = if !log then Printf.printf "== %s\n%!" s
-
-let () =
-  Printexc.record_backtrace true;
-  try
-    Arg.parse argspec add_arg usage;
-    log "Parsing...";
-    let el = List.concat_map Frontend.Parse.parse_file !srcs in
-    log "Elaboration...";
-    let il = Frontend.Elab.elab el in
-    log "IL Validation...";
-    Il.Validation.valid il;
-    log "Variant flattening";
-    let il = Middlend.Flat.transform il in
-    log "Haskell Generation...";
-    if !odst = "" && !dsts = [] then
-      print_endline (Backend_haskell.Gen.gen_string il);
-    if !odst <> "" then
-      Backend_haskell.Gen.gen_file !odst il;
-    log "Complete."
-  with
-  | Source.Error (at, msg) ->
-    prerr_endline (Source.string_of_region at ^ ": " ^ msg);
-    exit 1
-  | exn ->
-    flush_all ();
-    prerr_endline
-      (Sys.argv.(0) ^ ": uncaught exception " ^ Printexc.to_string exn);
-    Printexc.print_backtrace stderr;
-    exit 2
diff --git a/spectec/src/exe-lean4/dune b/spectec/src/exe-lean4/dune
deleted file mode 100644
index a9da47797c..0000000000
--- a/spectec/src/exe-lean4/dune
+++ /dev/null
@@ -1,4 +0,0 @@
-(executable
-  (name main)
-  (libraries spectec)
-)
diff --git a/spectec/src/exe-lean4/main.ml b/spectec/src/exe-lean4/main.ml
deleted file mode 100644
index 6f733c7b83..0000000000
--- a/spectec/src/exe-lean4/main.ml
+++ /dev/null
@@ -1,79 +0,0 @@
-open Util
-
-
-(* Configuration *)
-
-let name = "watsup"
-let version = "0.3"
-
-
-(* Flags and parameters *)
-
-let log = ref false  (* log execution steps *)
-let dst = ref false  (* patch files *)
-
-let srcs = ref []    (* src file arguments *)
-let dsts = ref []    (* destination file arguments *)
-let odst = ref ""    (* generation file argument *)
-
-
-(* Argument parsing *)
-
-let banner () =
-  print_endline (name ^ " " ^ version ^ " generator")
-
-let usage = "Usage: " ^ name ^ " [option] [file ...] [-p file ...]"
-
-let add_arg source =
-  let args = if !dst then dsts else srcs in args := !args @ [source]
-
-let argspec = Arg.align
-[
-  "-v", Arg.Unit banner, " Show version";
-  "-o", Arg.String (fun s -> odst := s), " Generate file";
-  "-p", Arg.Set dst, " Patch files";
-  "-l", Arg.Set log, " Log execution steps";
-  "-help", Arg.Unit ignore, "";
-  "--help", Arg.Unit ignore, "";
-]
-
-
-(* Main *)
-
-let log s = if !log then Printf.printf "== %s\n%!" s
-
-let () =
-  Printexc.record_backtrace true;
-  try
-    Arg.parse argspec add_arg usage;
-    log "Parsing...";
-    let el = List.concat_map Frontend.Parse.parse_file !srcs in
-    log "Elaboration...";
-    let il = Frontend.Elab.elab el in
-    log "IL Validation...";
-    Il.Validation.valid il;
-    log "Variant flattening";
-    let il = Middlend.Flat.transform il in
-    Il.Validation.valid il;
-    log "Function totalization";
-    let il = Middlend.Totalize.transform il in
-    Il.Validation.valid il;
-    log "Side condition inference";
-    let il = Middlend.Sideconditions.transform il in
-    Il.Validation.valid il;
-    log "Lean4 Generation...";
-    if !odst = "" && !dsts = [] then
-      print_endline (Backend_lean4.Gen.gen_string il);
-    if !odst <> "" then
-      Backend_lean4.Gen.gen_file !odst il;
-    log "Complete."
-  with
-  | Source.Error (at, msg) ->
-    prerr_endline (Source.string_of_region at ^ ": " ^ msg);
-    exit 1
-  | exn ->
-    flush_all ();
-    prerr_endline
-      (Sys.argv.(0) ^ ": uncaught exception " ^ Printexc.to_string exn);
-    Printexc.print_backtrace stderr;
-    exit 2
diff --git a/spectec/src/exe-watsup/main.ml b/spectec/src/exe-watsup/main.ml
index b2253c9c2f..b5289f04c5 100644
--- a/spectec/src/exe-watsup/main.ml
+++ b/spectec/src/exe-watsup/main.ml
@@ -9,7 +9,13 @@ let version = "0.3"
 
 (* Flags and parameters *)
 
-let config = ref Backend_latex.Config.latex
+type target =
+ | None
+ | Latex of Backend_latex.Config.config
+ | Haskell
+ | Lean4
+
+ let target = ref (Latex Backend_latex.Config.latex)
 
 let log = ref false  (* log execution steps *)
 let dst = ref false  (* patch files *)
@@ -39,16 +45,20 @@ let argspec = Arg.align
   "-v", Arg.Unit banner, " Show version";
   "-o", Arg.String (fun s -> odst := s), " Generate file";
   "-p", Arg.Set dst, " Patch files";
-  "-d", Arg.Set dry, " Dry run";
+  "-d", Arg.Set dry, " Dry run (when -p) ";
   "-l", Arg.Set log, " Log execution steps";
   "-w", Arg.Set warn, " Warn about unsed or multiply used splices";
+
   "--flat", Arg.Set pass_flat, "Run variant flattening";
   "--totalize", Arg.Set pass_totalize, "Run function totalization";
   "--sideconditions", Arg.Set pass_sideconditions, "Infer side conditoins";
-  "--latex", Arg.Unit (fun () -> config := Backend_latex.Config.latex),
-    " Use Latex settings (default)";
-  "--sphinx", Arg.Unit (fun () -> config := Backend_latex.Config.sphinx),
-    " Use Sphinx settings";
+
+  "--check-only", Arg.Unit (fun () -> target := None), " No output (just checking)";
+  "--latex", Arg.Unit (fun () -> target := Latex Backend_latex.Config.latex), " Use Latex settings (default)";
+  "--sphinx", Arg.Unit (fun () -> target := Latex Backend_latex.Config.latex), " Use Sphinx settings";
+  "--haskell", Arg.Unit (fun () -> target := Haskell), " Produce Haskell code";
+  "--lean4", Arg.Unit (fun () -> target := Lean4), " Produce Lean4 code";
+
   "-help", Arg.Unit ignore, "";
   "--help", Arg.Unit ignore, "";
 ]
@@ -73,46 +83,57 @@ let () =
     log "IL Validation...";
     Il.Validation.valid il;
 
-    let _il = if !pass_flat then begin
+    let il = if !pass_flat || !target = Haskell || !target = Lean4 then begin
       log "Variant flattening...";
-      let il = Middlend.Sideconditions.transform il in
-      log "Printing...";
-      Printf.printf "%s\n%!" (Il.Print.string_of_script il);
+      let il = Middlend.Flat.transform il in
+      if !pass_flat then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
       log "IL Validation...";
       Il.Validation.valid il;
       il
     end else il in
 
-    let il = if !pass_totalize then begin
+    let il = if !pass_totalize || !target = Lean4 then begin
       log "Function totalization...";
       let il = Middlend.Totalize.transform il in
-      log "Printing...";
-      Printf.printf "%s\n%!" (Il.Print.string_of_script il);
+      if !pass_totalize then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
       log "IL Validation...";
       Il.Validation.valid il;
       il
     end else il in
 
-    let _il = if !pass_sideconditions then begin
+    let il = if !pass_sideconditions || !target = Haskell || !target = Lean4 then begin
       log "Side condition inference";
       let il = Middlend.Sideconditions.transform il in
-      log "Printing...";
-      Printf.printf "%s\n%!" (Il.Print.string_of_script il);
+      if !pass_sideconditions then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
       log "IL Validation...";
       Il.Validation.valid il;
       il
     end else il in
 
-    log "Latex Generation...";
-    if !odst = "" && !dsts = [] then
-      print_endline (Backend_latex.Gen.gen_string el);
-    if !odst <> "" then
-      Backend_latex.Gen.gen_file !odst el;
-    if !dsts <> [] then (
-      let env = Backend_latex.Splice.(env !config el) in
-      List.iter (Backend_latex.Splice.splice_file ~dry:!dry env) !dsts;
-      if !warn then Backend_latex.Splice.warn env;
-    );
+    begin match !target with
+    | None -> ()
+    | Latex config ->
+      log "Latex Generation...";
+      if !odst = "" && !dsts = [] then
+        print_endline (Backend_latex.Gen.gen_string el);
+      if !odst <> "" then
+        Backend_latex.Gen.gen_file !odst el;
+      if !dsts <> [] then (
+        let env = Backend_latex.Splice.(env config el) in
+        List.iter (Backend_latex.Splice.splice_file ~dry:!dry env) !dsts;
+        if !warn then Backend_latex.Splice.warn env;
+      );
+    | Haskell ->
+      if !odst = "" && !dsts = [] then
+        print_endline (Backend_haskell.Gen.gen_string il);
+      if !odst <> "" then
+        Backend_haskell.Gen.gen_file !odst il;
+    | Lean4 ->
+      if !odst = "" && !dsts = [] then
+        print_endline (Backend_haskell.Gen.gen_string il);
+      if !odst <> "" then
+        Backend_lean4.Gen.gen_file !odst il;
+    end;
 (*
     if !odst = "" && !dsts = [] then (
       log "Prose Generation...";
diff --git a/spectec/test-frontend/PASSES.md b/spectec/test-frontend/PASSES.md
index f69c609a8d..ebcf9c2c70 100644
--- a/spectec/test-frontend/PASSES.md
+++ b/spectec/test-frontend/PASSES.md
@@ -1490,7 +1490,6 @@ relation Step: `%~>%`(config, config)
 
 == IL Validation...
 == Variant flattening...
-== Printing...
 
 ;; 1-syntax.watsup:3.1-3.15
 syntax n = nat
@@ -1558,16 +1557,67 @@ syntax valtype =
   | EXTERNREF
   | BOT
 
+;;
+def valtype_numtype : numtype -> valtype
+  ;;
+  def valtype_numtype(I32_numtype) = I32_valtype
+  ;;
+  def valtype_numtype(I64_numtype) = I64_valtype
+  ;;
+  def valtype_numtype(F32_numtype) = F32_valtype
+  ;;
+  def valtype_numtype(F64_numtype) = F64_valtype
+
+;;
+def valtype_vectype : vectype -> valtype
+  ;;
+  def valtype_vectype(V128_vectype) = V128_valtype
+
+;;
+def valtype_reftype : reftype -> valtype
+  ;;
+  def valtype_reftype(FUNCREF_reftype) = FUNCREF_valtype
+  ;;
+  def valtype_reftype(EXTERNREF_reftype) = EXTERNREF_valtype
+
 ;; 1-syntax.watsup:48.1-48.71
 syntax in =
   | I32
   | I64
 
+;;
+def numtype_in : in -> numtype
+  ;;
+  def numtype_in(I32_in) = I32_numtype
+  ;;
+  def numtype_in(I64_in) = I64_numtype
+
+;;
+def valtype_in : in -> valtype
+  ;;
+  def valtype_in(I32_in) = I32_valtype
+  ;;
+  def valtype_in(I64_in) = I64_valtype
+
 ;; 1-syntax.watsup:49.1-49.71
 syntax fn =
   | F32
   | F64
 
+;;
+def numtype_fn : fn -> numtype
+  ;;
+  def numtype_fn(F32_fn) = F32_numtype
+  ;;
+  def numtype_fn(F64_fn) = F64_numtype
+
+;;
+def valtype_fn : fn -> valtype
+  ;;
+  def valtype_fn(F32_fn) = F32_valtype
+  ;;
+  def valtype_fn(F64_fn) = F64_valtype
+
 ;; 1-syntax.watsup:56.1-57.11
 syntax resulttype = valtype*
 
@@ -1916,7 +1966,6 @@ relation Resulttype_sub: `|-%*<:%*`(valtype*, valtype*)
   ;; 3-typing.watsup:70.1-72.35
   rule _ {t_1* : valtype*, t_2* : valtype*}:
     `|-%*<:%*`(t_1*{t_1}, t_2*{t_2})
-    -- if (|t_1*{t_1}| = |t_2*{t_2}|)
     -- (Valtype_sub: `|-%<:%`(t_1, t_2))*{t_1 t_2}
 
 ;; 3-typing.watsup:75.1-75.75
@@ -2031,20 +2080,16 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
   ;; 3-typing.watsup:195.1-197.24
   rule br {C : context, l : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, BR_instr(l), `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
-    -- if (l < |C.LABEL_context|)
     -- if (C.LABEL_context[l] = t*{t})
 
   ;; 3-typing.watsup:199.1-201.24
   rule br_if {C : context, l : labelidx, t* : valtype*}:
     `%|-%:%`(C, BR_IF_instr(l), `%->%`(t*{t} :: [I32_valtype], t*{t}))
-    -- if (l < |C.LABEL_context|)
     -- if (C.LABEL_context[l] = t*{t})
 
   ;; 3-typing.watsup:203.1-206.42
   rule br_table {C : context, l* : labelidx*, l' : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, BR_TABLE_instr(l*{l}, l'), `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
-    -- (if (l < |C.LABEL_context|))*{l}
-    -- if (l' < |C.LABEL_context|)
     -- (Resulttype_sub: `|-%*<:%*`(t*{t}, C.LABEL_context[l]))*{l}
     -- Resulttype_sub: `|-%*<:%*`(t*{t}, C.LABEL_context[l'])
 
@@ -2056,13 +2101,11 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
   ;; 3-typing.watsup:212.1-214.33
   rule call {C : context, t_1* : valtype*, t_2* : valtype*, x : idx}:
     `%|-%:%`(C, CALL_instr(x), `%->%`(t_1*{t_1}, t_2*{t_2}))
-    -- if (x < |C.FUNC_context|)
     -- if (C.FUNC_context[x] = `%->%`(t_1*{t_1}, t_2*{t_2}))
 
   ;; 3-typing.watsup:216.1-219.26
   rule call_indirect {C : context, ft : functype, lim : limits, t_1* : valtype*, t_2* : valtype*, x : idx}:
     `%|-%:%`(C, CALL_INDIRECT_instr(x, ft), `%->%`(t_1*{t_1} :: [I32_valtype], t_2*{t_2}))
-    -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, FUNCREF_reftype))
     -- if (ft = `%->%`(t_1*{t_1}, t_2*{t_2}))
 
@@ -2115,7 +2158,6 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
   ;; 3-typing.watsup:260.1-262.23
   rule ref.func {C : context, ft : functype, x : idx}:
     `%|-%:%`(C, REF.FUNC_instr(x), `%->%`([], [FUNCREF_valtype]))
-    -- if (x < |C.FUNC_context|)
     -- if (C.FUNC_context[x] = ft)
 
   ;; 3-typing.watsup:264.1-265.31
@@ -2125,128 +2167,104 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
   ;; 3-typing.watsup:268.1-270.23
   rule local.get {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, LOCAL.GET_instr(x), `%->%`([], [t]))
-    -- if (x < |C.LOCAL_context|)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:272.1-274.23
   rule local.set {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, LOCAL.SET_instr(x), `%->%`([t], []))
-    -- if (x < |C.LOCAL_context|)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:276.1-278.23
   rule local.tee {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, LOCAL.TEE_instr(x), `%->%`([t], [t]))
-    -- if (x < |C.LOCAL_context|)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:281.1-283.29
   rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
-    -- if (x < |C.GLOBAL_context|)
     -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
 
   ;; 3-typing.watsup:285.1-287.28
   rule global.set {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
-    -- if (x < |C.GLOBAL_context|)
     -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
 
   ;; 3-typing.watsup:290.1-292.28
   rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
     `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [(rt <: valtype)]))
-    -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:294.1-296.28
   rule table.set {C : context, lim : limits, rt : reftype, x : idx}:
     `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype (rt <: valtype)], []))
-    -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:298.1-300.24
   rule table.size {C : context, tt : tabletype, x : idx}:
     `%|-%:%`(C, TABLE.SIZE_instr(x), `%->%`([], [I32_valtype]))
-    -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = tt)
 
   ;; 3-typing.watsup:302.1-304.28
   rule table.grow {C : context, lim : limits, rt : reftype, x : idx}:
     `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([(rt <: valtype) I32_valtype], [I32_valtype]))
-    -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:306.1-308.28
   rule table.fill {C : context, lim : limits, rt : reftype, x : idx}:
     `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype (rt <: valtype) I32_valtype], []))
-    -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:310.1-313.32
   rule table.copy {C : context, lim_1 : limits, lim_2 : limits, rt : reftype, x_1 : idx, x_2 : idx}:
     `%|-%:%`(C, TABLE.COPY_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
-    -- if (x_1 < |C.TABLE_context|)
-    -- if (x_2 < |C.TABLE_context|)
     -- if (C.TABLE_context[x_1] = `%%`(lim_1, rt))
     -- if (C.TABLE_context[x_2] = `%%`(lim_2, rt))
 
   ;; 3-typing.watsup:315.1-318.25
   rule table.init {C : context, lim : limits, rt : reftype, x_1 : idx, x_2 : idx}:
     `%|-%:%`(C, TABLE.INIT_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
-    -- if (x_1 < |C.TABLE_context|)
-    -- if (x_2 < |C.ELEM_context|)
     -- if (C.TABLE_context[x_1] = `%%`(lim, rt))
     -- if (C.ELEM_context[x_2] = rt)
 
   ;; 3-typing.watsup:320.1-322.23
   rule elem.drop {C : context, rt : reftype, x : idx}:
     `%|-%:%`(C, ELEM.DROP_instr(x), `%->%`([], []))
-    -- if (x < |C.ELEM_context|)
     -- if (C.ELEM_context[x] = rt)
 
   ;; 3-typing.watsup:325.1-327.22
   rule memory.size {C : context, mt : memtype}:
     `%|-%:%`(C, MEMORY.SIZE_instr, `%->%`([], [I32_valtype]))
-    -- if (0 < |C.MEM_context|)
     -- if (C.MEM_context[0] = mt)
 
   ;; 3-typing.watsup:329.1-331.22
   rule memory.grow {C : context, mt : memtype}:
     `%|-%:%`(C, MEMORY.GROW_instr, `%->%`([I32_valtype], [I32_valtype]))
-    -- if (0 < |C.MEM_context|)
     -- if (C.MEM_context[0] = mt)
 
   ;; 3-typing.watsup:333.1-335.22
   rule memory.fill {C : context, mt : memtype}:
     `%|-%:%`(C, MEMORY.FILL_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
-    -- if (0 < |C.MEM_context|)
     -- if (C.MEM_context[0] = mt)
 
   ;; 3-typing.watsup:337.1-339.22
   rule memory.copy {C : context, mt : memtype}:
     `%|-%:%`(C, MEMORY.COPY_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
-    -- if (0 < |C.MEM_context|)
     -- if (C.MEM_context[0] = mt)
 
   ;; 3-typing.watsup:341.1-344.23
   rule memory.init {C : context, mt : memtype, x : idx}:
     `%|-%:%`(C, MEMORY.INIT_instr(x), `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
-    -- if (0 < |C.MEM_context|)
-    -- if (x < |C.DATA_context|)
     -- if (C.MEM_context[0] = mt)
     -- if (C.DATA_context[x] = OK)
 
   ;; 3-typing.watsup:346.1-348.23
   rule data.drop {C : context, x : idx}:
     `%|-%:%`(C, DATA.DROP_instr(x), `%->%`([], []))
-    -- if (x < |C.DATA_context|)
     -- if (C.DATA_context[x] = OK)
 
   ;; 3-typing.watsup:350.1-355.32
   rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?}:
     `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
-    -- if (0 < |C.MEM_context|)
-    -- if ((n?{n} = ?()) <=> (sx?{sx} = ?()))
     -- if (C.MEM_context[0] = mt)
     -- if ((2 ^ n_A) <= ($size(nt <: valtype) / 8))
     -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(nt <: valtype) / 8))))?{n}
@@ -2255,7 +2273,6 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
   ;; 3-typing.watsup:357.1-362.32
   rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype}:
     `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype (nt <: valtype)], []))
-    -- if (0 < |C.MEM_context|)
     -- if (C.MEM_context[0] = mt)
     -- if ((2 ^ n_A) <= ($size(nt <: valtype) / 8))
     -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(nt <: valtype) / 8))))?{n}
@@ -2310,7 +2327,6 @@ relation Instr_const: `%|-%CONST`(context, instr)
   ;; 3-typing.watsup:380.1-382.32
   rule global.get {C : context, t : valtype, x : idx}:
     `%|-%CONST`(C, GLOBAL.GET_instr(x))
-    -- if (x < |C.GLOBAL_context|)
     -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
 
 ;; 3-typing.watsup:368.1-368.77
@@ -2365,7 +2381,6 @@ relation Elemmode_ok: `%|-%:%`(context, elemmode, reftype)
   ;; 3-typing.watsup:437.1-440.45
   rule active {C : context, expr : expr, lim : limits, rt : reftype, x : idx}:
     `%|-%:%`(C, TABLE_elemmode(x, expr), rt)
-    -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
     -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*{}
 
@@ -2386,7 +2401,6 @@ relation Datamode_ok: `%|-%:OK`(context, datamode)
   ;; 3-typing.watsup:445.1-448.45
   rule _ {C : context, expr : expr, mt : memtype}:
     `%|-%:OK`(C, MEMORY_datamode(0, expr))
-    -- if (0 < |C.MEM_context|)
     -- if (C.MEM_context[0] = mt)
     -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*{}
 
@@ -2402,7 +2416,6 @@ relation Start_ok: `%|-%:OK`(context, start)
   ;; 3-typing.watsup:450.1-452.39
   rule _ {C : context, x : idx}:
     `%|-%:OK`(C, START(x))
-    -- if (x < |C.FUNC_context|)
     -- if (C.FUNC_context[x] = `%->%`([], []))
 
 ;; 3-typing.watsup:455.1-455.80
@@ -2417,25 +2430,21 @@ relation Externuse_ok: `%|-%:%`(context, externuse, externtype)
   ;; 3-typing.watsup:467.1-469.23
   rule func {C : context, ft : functype, x : idx}:
     `%|-%:%`(C, FUNC_externuse(x), FUNC_externtype(ft))
-    -- if (x < |C.FUNC_context|)
     -- if (C.FUNC_context[x] = ft)
 
   ;; 3-typing.watsup:471.1-473.25
   rule global {C : context, gt : globaltype, x : idx}:
     `%|-%:%`(C, GLOBAL_externuse(x), GLOBAL_externtype(gt))
-    -- if (x < |C.GLOBAL_context|)
     -- if (C.GLOBAL_context[x] = gt)
 
   ;; 3-typing.watsup:475.1-477.24
   rule table {C : context, tt : tabletype, x : idx}:
     `%|-%:%`(C, TABLE_externuse(x), TABLE_externtype(tt))
-    -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = tt)
 
   ;; 3-typing.watsup:479.1-481.22
   rule mem {C : context, mt : memtype, x : idx}:
     `%|-%:%`(C, MEMORY_externuse(x), MEMORY_externtype(mt))
-    -- if (x < |C.MEM_context|)
     -- if (C.MEM_context[x] = mt)
 
 ;; 3-typing.watsup:456.1-456.80
@@ -2450,12 +2459,6 @@ relation Module_ok: `|-%:OK`(module)
   ;; 3-typing.watsup:486.1-501.22
   rule _ {C : context, data^n : data^n, elem* : elem*, export* : export*, ft* : functype*, func* : func*, global* : global*, gt* : globaltype*, import* : import*, mem* : mem*, mt* : memtype*, n : n, rt* : reftype*, start* : start*, table* : table*, tt* : tabletype*}:
     `|-%:OK`(`MODULE%*%*%*%*%*%*%*%*%*`(import*{import}, func*{func}, global*{global}, table*{table}, mem*{mem}, elem*{elem}, data^n{data}, start*{start}, export*{export}))
-    -- if (|ft*{ft}| = |func*{func}|)
-    -- if (|global*{global}| = |gt*{gt}|)
-    -- if (|table*{table}| = |tt*{tt}|)
-    -- if (|mem*{mem}| = |mt*{mt}|)
-    -- if (|elem*{elem}| = |rt*{rt}|)
-    -- if (|data^n{data}| = n)
     -- if (C = {FUNC ft*{ft}, GLOBAL gt*{gt}, TABLE tt*{tt}, MEM mt*{mt}, ELEM rt*{rt}, DATA OK^n{}, LOCAL [], LABEL [], RETURN ?()})
     -- (Func_ok: `%|-%:%`(C, func, ft))*{ft func}
     -- (Global_ok: `%|-%:%`(C, global, gt))*{global gt}
@@ -2511,6 +2514,20 @@ syntax val =
   | REF.FUNC_ADDR(funcaddr)
   | REF.HOST_ADDR(hostaddr)
 
+;;
+def val_num : num -> val
+  ;;
+  def {x : (numtype, c_numtype)} val_num(CONST_num(x)) = CONST_val(x)
+
+;;
+def val_ref : ref -> val
+  ;;
+  def {x : reftype} val_ref(REF.NULL_ref(x)) = REF.NULL_val(x)
+  ;;
+  def {x : funcaddr} val_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_val(x)
+  ;;
+  def {x : hostaddr} val_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_val(x)
+
 ;; 4-runtime.watsup:31.1-32.18
 syntax result =
   | _VALS(val*)
@@ -2628,6 +2645,122 @@ syntax admininstr =
   | TRAP
 }
 
+;;
+def admininstr_instr : instr -> admininstr
+  ;;
+  def admininstr_instr(UNREACHABLE_instr) = UNREACHABLE_admininstr
+  ;;
+  def admininstr_instr(NOP_instr) = NOP_admininstr
+  ;;
+  def admininstr_instr(DROP_instr) = DROP_admininstr
+  ;;
+  def {x : valtype?} admininstr_instr(SELECT_instr(x)) = SELECT_admininstr(x)
+  ;;
+  def {x : (blocktype, instr*)} admininstr_instr(BLOCK_instr(x)) = BLOCK_admininstr(x)
+  ;;
+  def {x : (blocktype, instr*)} admininstr_instr(LOOP_instr(x)) = LOOP_admininstr(x)
+  ;;
+  def {x : (blocktype, instr*, instr*)} admininstr_instr(IF_instr(x)) = IF_admininstr(x)
+  ;;
+  def {x : labelidx} admininstr_instr(BR_instr(x)) = BR_admininstr(x)
+  ;;
+  def {x : labelidx} admininstr_instr(BR_IF_instr(x)) = BR_IF_admininstr(x)
+  ;;
+  def {x : (labelidx*, labelidx)} admininstr_instr(BR_TABLE_instr(x)) = BR_TABLE_admininstr(x)
+  ;;
+  def {x : funcidx} admininstr_instr(CALL_instr(x)) = CALL_admininstr(x)
+  ;;
+  def {x : (tableidx, functype)} admininstr_instr(CALL_INDIRECT_instr(x)) = CALL_INDIRECT_admininstr(x)
+  ;;
+  def admininstr_instr(RETURN_instr) = RETURN_admininstr
+  ;;
+  def {x : (numtype, c_numtype)} admininstr_instr(CONST_instr(x)) = CONST_admininstr(x)
+  ;;
+  def {x : (numtype, unop_numtype)} admininstr_instr(UNOP_instr(x)) = UNOP_admininstr(x)
+  ;;
+  def {x : (numtype, binop_numtype)} admininstr_instr(BINOP_instr(x)) = BINOP_admininstr(x)
+  ;;
+  def {x : (numtype, testop_numtype)} admininstr_instr(TESTOP_instr(x)) = TESTOP_admininstr(x)
+  ;;
+  def {x : (numtype, relop_numtype)} admininstr_instr(RELOP_instr(x)) = RELOP_admininstr(x)
+  ;;
+  def {x : (numtype, n)} admininstr_instr(EXTEND_instr(x)) = EXTEND_admininstr(x)
+  ;;
+  def {x : (numtype, cvtop, numtype, sx?)} admininstr_instr(CVTOP_instr(x)) = CVTOP_admininstr(x)
+  ;;
+  def {x : reftype} admininstr_instr(REF.NULL_instr(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcidx} admininstr_instr(REF.FUNC_instr(x)) = REF.FUNC_admininstr(x)
+  ;;
+  def admininstr_instr(REF.IS_NULL_instr) = REF.IS_NULL_admininstr
+  ;;
+  def {x : localidx} admininstr_instr(LOCAL.GET_instr(x)) = LOCAL.GET_admininstr(x)
+  ;;
+  def {x : localidx} admininstr_instr(LOCAL.SET_instr(x)) = LOCAL.SET_admininstr(x)
+  ;;
+  def {x : localidx} admininstr_instr(LOCAL.TEE_instr(x)) = LOCAL.TEE_admininstr(x)
+  ;;
+  def {x : globalidx} admininstr_instr(GLOBAL.GET_instr(x)) = GLOBAL.GET_admininstr(x)
+  ;;
+  def {x : globalidx} admininstr_instr(GLOBAL.SET_instr(x)) = GLOBAL.SET_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.GET_instr(x)) = TABLE.GET_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.SET_instr(x)) = TABLE.SET_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.SIZE_instr(x)) = TABLE.SIZE_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.GROW_instr(x)) = TABLE.GROW_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.FILL_instr(x)) = TABLE.FILL_admininstr(x)
+  ;;
+  def {x : (tableidx, tableidx)} admininstr_instr(TABLE.COPY_instr(x)) = TABLE.COPY_admininstr(x)
+  ;;
+  def {x : (tableidx, elemidx)} admininstr_instr(TABLE.INIT_instr(x)) = TABLE.INIT_admininstr(x)
+  ;;
+  def {x : elemidx} admininstr_instr(ELEM.DROP_instr(x)) = ELEM.DROP_admininstr(x)
+  ;;
+  def admininstr_instr(MEMORY.SIZE_instr) = MEMORY.SIZE_admininstr
+  ;;
+  def admininstr_instr(MEMORY.GROW_instr) = MEMORY.GROW_admininstr
+  ;;
+  def admininstr_instr(MEMORY.FILL_instr) = MEMORY.FILL_admininstr
+  ;;
+  def admininstr_instr(MEMORY.COPY_instr) = MEMORY.COPY_admininstr
+  ;;
+  def {x : dataidx} admininstr_instr(MEMORY.INIT_instr(x)) = MEMORY.INIT_admininstr(x)
+  ;;
+  def {x : dataidx} admininstr_instr(DATA.DROP_instr(x)) = DATA.DROP_admininstr(x)
+  ;;
+  def {x : (numtype, (n, sx)?, nat, nat)} admininstr_instr(LOAD_instr(x)) = LOAD_admininstr(x)
+  ;;
+  def {x : (numtype, n?, nat, nat)} admininstr_instr(STORE_instr(x)) = STORE_admininstr(x)
+
+;;
+def admininstr_val : val -> admininstr
+  ;;
+  def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
+  ;;
+  def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
+  ;;
+  def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
+
+;;
+def admininstr_ref : ref -> admininstr
+  ;;
+  def {x : reftype} admininstr_ref(REF.NULL_ref(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcaddr} admininstr_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_admininstr(x)
+  ;;
+  def {x : hostaddr} admininstr_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_admininstr(x)
+
+;;
+def admininstr_globalinst : globalinst -> admininstr
+  ;;
+  def {x : globalinst} admininstr_globalinst(x) = $admininstr_val(x)
+
 ;; 4-runtime.watsup:84.1-84.62
 syntax config = `%;%*`(state, admininstr*)
 
@@ -2756,17 +2889,11 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:35.1-37.28
   rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
     `%*~>%*`((val <: admininstr)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
-    -- if (|t_1^k{t_1}| = k)
-    -- if (|t_2^n{t_2}| = n)
-    -- if (|val^k{val}| = k)
     -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
 
   ;; 6-reduction.watsup:39.1-41.28
   rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
     `%*~>%*`((val <: admininstr)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [LOOP_instr(bt, instr*{instr})], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
-    -- if (|t_1^k{t_1}| = k)
-    -- if (|t_2^n{t_2}| = n)
-    -- if (|val^k{val}| = k)
     -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
 
   ;; 6-reduction.watsup:43.1-45.16
@@ -2786,7 +2913,6 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:57.1-58.69
   rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
     `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [BR_admininstr(0)] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val} :: (instr' <: admininstr)*{instr'})
-    -- if (|val^n{val}| = n)
 
   ;; 6-reduction.watsup:60.1-61.65
   rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
@@ -2815,12 +2941,10 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:100.1-101.35
   rule frame-vals {f : frame, n : n, val^n : val^n}:
     `%*~>%*`([FRAME__admininstr(n, f, (val <: admininstr)^n{val})], (val <: admininstr)^n{val})
-    -- if (|val^n{val}| = n)
 
   ;; 6-reduction.watsup:103.1-104.55
   rule return-frame {f : frame, instr* : instr*, n : n, val^n : val^n, val'* : val*}:
     `%*~>%*`([FRAME__admininstr(n, f, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val})
-    -- if (|val^n{val}| = n)
 
   ;; 6-reduction.watsup:106.1-107.60
   rule return-label {instr* : instr*, instr'* : instr*, k : nat, val* : val*}:
@@ -2889,13 +3013,10 @@ relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:82.1-83.47
   rule call {x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CALL_admininstr(x)]), [CALL_ADDR_admininstr($funcaddr(z)[x])])
-    -- if (x < |$funcaddr(z)|)
 
   ;; 6-reduction.watsup:85.1-88.34
   rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [CALL_ADDR_admininstr(a)])
-    -- if (i < |$table(z, x)|)
-    -- if (a < |$funcinst(z)|)
     -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
     -- if ($funcinst(z)[a] = `%;%`(m, func))
 
@@ -2907,17 +3028,12 @@ relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:94.1-97.52
   rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
     `%~>%*`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], (instr <: admininstr)*{instr})])])
-    -- if (a < |$funcinst(z)|)
-    -- if (|t_1^k{t_1}| = k)
-    -- if (|t_2^n{t_2}| = n)
-    -- if (|val^k{val}| = k)
     -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
     -- if (f = {LOCAL val^k{val} :: $default_(t)*{t}, MODULE m})
 
   ;; 6-reduction.watsup:150.1-151.53
   rule ref.func {x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [REF.FUNC_admininstr(x)]), [REF.FUNC_ADDR_admininstr($funcaddr(z)[x])])
-    -- if (x < |$funcaddr(z)|)
 
   ;; 6-reduction.watsup:163.1-164.37
   rule local.get {x : idx, z : state}:
@@ -3003,7 +3119,6 @@ relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:257.1-261.15
   rule table.init-succ {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) ($elem(z, y)[i] <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
-    -- if (i < |$elem(z, y)|)
     -- otherwise
 
 ;; 6-reduction.watsup:3.1-3.63
@@ -3041,7 +3156,6 @@ relation Step: `%~>%`(config, config)
 
 == IL Validation...
 == Function totalization...
-== Printing...
 
 ;; 1-syntax.watsup:3.1-3.15
 syntax n = nat
@@ -3109,16 +3223,67 @@ syntax valtype =
   | EXTERNREF
   | BOT
 
+;;
+def valtype_numtype : numtype -> valtype
+  ;;
+  def valtype_numtype(I32_numtype) = I32_valtype
+  ;;
+  def valtype_numtype(I64_numtype) = I64_valtype
+  ;;
+  def valtype_numtype(F32_numtype) = F32_valtype
+  ;;
+  def valtype_numtype(F64_numtype) = F64_valtype
+
+;;
+def valtype_vectype : vectype -> valtype
+  ;;
+  def valtype_vectype(V128_vectype) = V128_valtype
+
+;;
+def valtype_reftype : reftype -> valtype
+  ;;
+  def valtype_reftype(FUNCREF_reftype) = FUNCREF_valtype
+  ;;
+  def valtype_reftype(EXTERNREF_reftype) = EXTERNREF_valtype
+
 ;; 1-syntax.watsup:48.1-48.71
 syntax in =
   | I32
   | I64
 
+;;
+def numtype_in : in -> numtype
+  ;;
+  def numtype_in(I32_in) = I32_numtype
+  ;;
+  def numtype_in(I64_in) = I64_numtype
+
+;;
+def valtype_in : in -> valtype
+  ;;
+  def valtype_in(I32_in) = I32_valtype
+  ;;
+  def valtype_in(I64_in) = I64_valtype
+
 ;; 1-syntax.watsup:49.1-49.71
 syntax fn =
   | F32
   | F64
 
+;;
+def numtype_fn : fn -> numtype
+  ;;
+  def numtype_fn(F32_fn) = F32_numtype
+  ;;
+  def numtype_fn(F64_fn) = F64_numtype
+
+;;
+def valtype_fn : fn -> valtype
+  ;;
+  def valtype_fn(F32_fn) = F32_valtype
+  ;;
+  def valtype_fn(F64_fn) = F64_valtype
+
 ;; 1-syntax.watsup:56.1-57.11
 syntax resulttype = valtype*
 
@@ -4017,6 +4182,20 @@ syntax val =
   | REF.FUNC_ADDR(funcaddr)
   | REF.HOST_ADDR(hostaddr)
 
+;;
+def val_num : num -> val
+  ;;
+  def {x : (numtype, c_numtype)} val_num(CONST_num(x)) = CONST_val(x)
+
+;;
+def val_ref : ref -> val
+  ;;
+  def {x : reftype} val_ref(REF.NULL_ref(x)) = REF.NULL_val(x)
+  ;;
+  def {x : funcaddr} val_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_val(x)
+  ;;
+  def {x : hostaddr} val_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_val(x)
+
 ;; 4-runtime.watsup:31.1-32.18
 syntax result =
   | _VALS(val*)
@@ -4136,6 +4315,122 @@ syntax admininstr =
   | TRAP
 }
 
+;;
+def admininstr_instr : instr -> admininstr
+  ;;
+  def admininstr_instr(UNREACHABLE_instr) = UNREACHABLE_admininstr
+  ;;
+  def admininstr_instr(NOP_instr) = NOP_admininstr
+  ;;
+  def admininstr_instr(DROP_instr) = DROP_admininstr
+  ;;
+  def {x : valtype?} admininstr_instr(SELECT_instr(x)) = SELECT_admininstr(x)
+  ;;
+  def {x : (blocktype, instr*)} admininstr_instr(BLOCK_instr(x)) = BLOCK_admininstr(x)
+  ;;
+  def {x : (blocktype, instr*)} admininstr_instr(LOOP_instr(x)) = LOOP_admininstr(x)
+  ;;
+  def {x : (blocktype, instr*, instr*)} admininstr_instr(IF_instr(x)) = IF_admininstr(x)
+  ;;
+  def {x : labelidx} admininstr_instr(BR_instr(x)) = BR_admininstr(x)
+  ;;
+  def {x : labelidx} admininstr_instr(BR_IF_instr(x)) = BR_IF_admininstr(x)
+  ;;
+  def {x : (labelidx*, labelidx)} admininstr_instr(BR_TABLE_instr(x)) = BR_TABLE_admininstr(x)
+  ;;
+  def {x : funcidx} admininstr_instr(CALL_instr(x)) = CALL_admininstr(x)
+  ;;
+  def {x : (tableidx, functype)} admininstr_instr(CALL_INDIRECT_instr(x)) = CALL_INDIRECT_admininstr(x)
+  ;;
+  def admininstr_instr(RETURN_instr) = RETURN_admininstr
+  ;;
+  def {x : (numtype, c_numtype)} admininstr_instr(CONST_instr(x)) = CONST_admininstr(x)
+  ;;
+  def {x : (numtype, unop_numtype)} admininstr_instr(UNOP_instr(x)) = UNOP_admininstr(x)
+  ;;
+  def {x : (numtype, binop_numtype)} admininstr_instr(BINOP_instr(x)) = BINOP_admininstr(x)
+  ;;
+  def {x : (numtype, testop_numtype)} admininstr_instr(TESTOP_instr(x)) = TESTOP_admininstr(x)
+  ;;
+  def {x : (numtype, relop_numtype)} admininstr_instr(RELOP_instr(x)) = RELOP_admininstr(x)
+  ;;
+  def {x : (numtype, n)} admininstr_instr(EXTEND_instr(x)) = EXTEND_admininstr(x)
+  ;;
+  def {x : (numtype, cvtop, numtype, sx?)} admininstr_instr(CVTOP_instr(x)) = CVTOP_admininstr(x)
+  ;;
+  def {x : reftype} admininstr_instr(REF.NULL_instr(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcidx} admininstr_instr(REF.FUNC_instr(x)) = REF.FUNC_admininstr(x)
+  ;;
+  def admininstr_instr(REF.IS_NULL_instr) = REF.IS_NULL_admininstr
+  ;;
+  def {x : localidx} admininstr_instr(LOCAL.GET_instr(x)) = LOCAL.GET_admininstr(x)
+  ;;
+  def {x : localidx} admininstr_instr(LOCAL.SET_instr(x)) = LOCAL.SET_admininstr(x)
+  ;;
+  def {x : localidx} admininstr_instr(LOCAL.TEE_instr(x)) = LOCAL.TEE_admininstr(x)
+  ;;
+  def {x : globalidx} admininstr_instr(GLOBAL.GET_instr(x)) = GLOBAL.GET_admininstr(x)
+  ;;
+  def {x : globalidx} admininstr_instr(GLOBAL.SET_instr(x)) = GLOBAL.SET_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.GET_instr(x)) = TABLE.GET_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.SET_instr(x)) = TABLE.SET_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.SIZE_instr(x)) = TABLE.SIZE_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.GROW_instr(x)) = TABLE.GROW_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.FILL_instr(x)) = TABLE.FILL_admininstr(x)
+  ;;
+  def {x : (tableidx, tableidx)} admininstr_instr(TABLE.COPY_instr(x)) = TABLE.COPY_admininstr(x)
+  ;;
+  def {x : (tableidx, elemidx)} admininstr_instr(TABLE.INIT_instr(x)) = TABLE.INIT_admininstr(x)
+  ;;
+  def {x : elemidx} admininstr_instr(ELEM.DROP_instr(x)) = ELEM.DROP_admininstr(x)
+  ;;
+  def admininstr_instr(MEMORY.SIZE_instr) = MEMORY.SIZE_admininstr
+  ;;
+  def admininstr_instr(MEMORY.GROW_instr) = MEMORY.GROW_admininstr
+  ;;
+  def admininstr_instr(MEMORY.FILL_instr) = MEMORY.FILL_admininstr
+  ;;
+  def admininstr_instr(MEMORY.COPY_instr) = MEMORY.COPY_admininstr
+  ;;
+  def {x : dataidx} admininstr_instr(MEMORY.INIT_instr(x)) = MEMORY.INIT_admininstr(x)
+  ;;
+  def {x : dataidx} admininstr_instr(DATA.DROP_instr(x)) = DATA.DROP_admininstr(x)
+  ;;
+  def {x : (numtype, (n, sx)?, nat, nat)} admininstr_instr(LOAD_instr(x)) = LOAD_admininstr(x)
+  ;;
+  def {x : (numtype, n?, nat, nat)} admininstr_instr(STORE_instr(x)) = STORE_admininstr(x)
+
+;;
+def admininstr_val : val -> admininstr
+  ;;
+  def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
+  ;;
+  def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
+  ;;
+  def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
+
+;;
+def admininstr_ref : ref -> admininstr
+  ;;
+  def {x : reftype} admininstr_ref(REF.NULL_ref(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcaddr} admininstr_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_admininstr(x)
+  ;;
+  def {x : hostaddr} admininstr_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_admininstr(x)
+
+;;
+def admininstr_globalinst : globalinst -> admininstr
+  ;;
+  def {x : globalinst} admininstr_globalinst(x) = $admininstr_val(x)
+
 ;; 4-runtime.watsup:84.1-84.62
 syntax config = `%;%*`(state, admininstr*)
 
@@ -4531,7 +4826,6 @@ relation Step: `%~>%`(config, config)
 
 == IL Validation...
 == Side condition inference
-== Printing...
 
 ;; 1-syntax.watsup:3.1-3.15
 syntax n = nat
@@ -4599,16 +4893,67 @@ syntax valtype =
   | EXTERNREF
   | BOT
 
+;;
+def valtype_numtype : numtype -> valtype
+  ;;
+  def valtype_numtype(I32_numtype) = I32_valtype
+  ;;
+  def valtype_numtype(I64_numtype) = I64_valtype
+  ;;
+  def valtype_numtype(F32_numtype) = F32_valtype
+  ;;
+  def valtype_numtype(F64_numtype) = F64_valtype
+
+;;
+def valtype_vectype : vectype -> valtype
+  ;;
+  def valtype_vectype(V128_vectype) = V128_valtype
+
+;;
+def valtype_reftype : reftype -> valtype
+  ;;
+  def valtype_reftype(FUNCREF_reftype) = FUNCREF_valtype
+  ;;
+  def valtype_reftype(EXTERNREF_reftype) = EXTERNREF_valtype
+
 ;; 1-syntax.watsup:48.1-48.71
 syntax in =
   | I32
   | I64
 
+;;
+def numtype_in : in -> numtype
+  ;;
+  def numtype_in(I32_in) = I32_numtype
+  ;;
+  def numtype_in(I64_in) = I64_numtype
+
+;;
+def valtype_in : in -> valtype
+  ;;
+  def valtype_in(I32_in) = I32_valtype
+  ;;
+  def valtype_in(I64_in) = I64_valtype
+
 ;; 1-syntax.watsup:49.1-49.71
 syntax fn =
   | F32
   | F64
 
+;;
+def numtype_fn : fn -> numtype
+  ;;
+  def numtype_fn(F32_fn) = F32_numtype
+  ;;
+  def numtype_fn(F64_fn) = F64_numtype
+
+;;
+def valtype_fn : fn -> valtype
+  ;;
+  def valtype_fn(F32_fn) = F32_valtype
+  ;;
+  def valtype_fn(F64_fn) = F64_valtype
+
 ;; 1-syntax.watsup:56.1-57.11
 syntax resulttype = valtype*
 
@@ -5563,6 +5908,20 @@ syntax val =
   | REF.FUNC_ADDR(funcaddr)
   | REF.HOST_ADDR(hostaddr)
 
+;;
+def val_num : num -> val
+  ;;
+  def {x : (numtype, c_numtype)} val_num(CONST_num(x)) = CONST_val(x)
+
+;;
+def val_ref : ref -> val
+  ;;
+  def {x : reftype} val_ref(REF.NULL_ref(x)) = REF.NULL_val(x)
+  ;;
+  def {x : funcaddr} val_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_val(x)
+  ;;
+  def {x : hostaddr} val_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_val(x)
+
 ;; 4-runtime.watsup:31.1-32.18
 syntax result =
   | _VALS(val*)
@@ -5682,6 +6041,122 @@ syntax admininstr =
   | TRAP
 }
 
+;;
+def admininstr_instr : instr -> admininstr
+  ;;
+  def admininstr_instr(UNREACHABLE_instr) = UNREACHABLE_admininstr
+  ;;
+  def admininstr_instr(NOP_instr) = NOP_admininstr
+  ;;
+  def admininstr_instr(DROP_instr) = DROP_admininstr
+  ;;
+  def {x : valtype?} admininstr_instr(SELECT_instr(x)) = SELECT_admininstr(x)
+  ;;
+  def {x : (blocktype, instr*)} admininstr_instr(BLOCK_instr(x)) = BLOCK_admininstr(x)
+  ;;
+  def {x : (blocktype, instr*)} admininstr_instr(LOOP_instr(x)) = LOOP_admininstr(x)
+  ;;
+  def {x : (blocktype, instr*, instr*)} admininstr_instr(IF_instr(x)) = IF_admininstr(x)
+  ;;
+  def {x : labelidx} admininstr_instr(BR_instr(x)) = BR_admininstr(x)
+  ;;
+  def {x : labelidx} admininstr_instr(BR_IF_instr(x)) = BR_IF_admininstr(x)
+  ;;
+  def {x : (labelidx*, labelidx)} admininstr_instr(BR_TABLE_instr(x)) = BR_TABLE_admininstr(x)
+  ;;
+  def {x : funcidx} admininstr_instr(CALL_instr(x)) = CALL_admininstr(x)
+  ;;
+  def {x : (tableidx, functype)} admininstr_instr(CALL_INDIRECT_instr(x)) = CALL_INDIRECT_admininstr(x)
+  ;;
+  def admininstr_instr(RETURN_instr) = RETURN_admininstr
+  ;;
+  def {x : (numtype, c_numtype)} admininstr_instr(CONST_instr(x)) = CONST_admininstr(x)
+  ;;
+  def {x : (numtype, unop_numtype)} admininstr_instr(UNOP_instr(x)) = UNOP_admininstr(x)
+  ;;
+  def {x : (numtype, binop_numtype)} admininstr_instr(BINOP_instr(x)) = BINOP_admininstr(x)
+  ;;
+  def {x : (numtype, testop_numtype)} admininstr_instr(TESTOP_instr(x)) = TESTOP_admininstr(x)
+  ;;
+  def {x : (numtype, relop_numtype)} admininstr_instr(RELOP_instr(x)) = RELOP_admininstr(x)
+  ;;
+  def {x : (numtype, n)} admininstr_instr(EXTEND_instr(x)) = EXTEND_admininstr(x)
+  ;;
+  def {x : (numtype, cvtop, numtype, sx?)} admininstr_instr(CVTOP_instr(x)) = CVTOP_admininstr(x)
+  ;;
+  def {x : reftype} admininstr_instr(REF.NULL_instr(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcidx} admininstr_instr(REF.FUNC_instr(x)) = REF.FUNC_admininstr(x)
+  ;;
+  def admininstr_instr(REF.IS_NULL_instr) = REF.IS_NULL_admininstr
+  ;;
+  def {x : localidx} admininstr_instr(LOCAL.GET_instr(x)) = LOCAL.GET_admininstr(x)
+  ;;
+  def {x : localidx} admininstr_instr(LOCAL.SET_instr(x)) = LOCAL.SET_admininstr(x)
+  ;;
+  def {x : localidx} admininstr_instr(LOCAL.TEE_instr(x)) = LOCAL.TEE_admininstr(x)
+  ;;
+  def {x : globalidx} admininstr_instr(GLOBAL.GET_instr(x)) = GLOBAL.GET_admininstr(x)
+  ;;
+  def {x : globalidx} admininstr_instr(GLOBAL.SET_instr(x)) = GLOBAL.SET_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.GET_instr(x)) = TABLE.GET_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.SET_instr(x)) = TABLE.SET_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.SIZE_instr(x)) = TABLE.SIZE_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.GROW_instr(x)) = TABLE.GROW_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.FILL_instr(x)) = TABLE.FILL_admininstr(x)
+  ;;
+  def {x : (tableidx, tableidx)} admininstr_instr(TABLE.COPY_instr(x)) = TABLE.COPY_admininstr(x)
+  ;;
+  def {x : (tableidx, elemidx)} admininstr_instr(TABLE.INIT_instr(x)) = TABLE.INIT_admininstr(x)
+  ;;
+  def {x : elemidx} admininstr_instr(ELEM.DROP_instr(x)) = ELEM.DROP_admininstr(x)
+  ;;
+  def admininstr_instr(MEMORY.SIZE_instr) = MEMORY.SIZE_admininstr
+  ;;
+  def admininstr_instr(MEMORY.GROW_instr) = MEMORY.GROW_admininstr
+  ;;
+  def admininstr_instr(MEMORY.FILL_instr) = MEMORY.FILL_admininstr
+  ;;
+  def admininstr_instr(MEMORY.COPY_instr) = MEMORY.COPY_admininstr
+  ;;
+  def {x : dataidx} admininstr_instr(MEMORY.INIT_instr(x)) = MEMORY.INIT_admininstr(x)
+  ;;
+  def {x : dataidx} admininstr_instr(DATA.DROP_instr(x)) = DATA.DROP_admininstr(x)
+  ;;
+  def {x : (numtype, (n, sx)?, nat, nat)} admininstr_instr(LOAD_instr(x)) = LOAD_admininstr(x)
+  ;;
+  def {x : (numtype, n?, nat, nat)} admininstr_instr(STORE_instr(x)) = STORE_admininstr(x)
+
+;;
+def admininstr_val : val -> admininstr
+  ;;
+  def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
+  ;;
+  def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
+  ;;
+  def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
+
+;;
+def admininstr_ref : ref -> admininstr
+  ;;
+  def {x : reftype} admininstr_ref(REF.NULL_ref(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcaddr} admininstr_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_admininstr(x)
+  ;;
+  def {x : hostaddr} admininstr_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_admininstr(x)
+
+;;
+def admininstr_globalinst : globalinst -> admininstr
+  ;;
+  def {x : globalinst} admininstr_globalinst(x) = $admininstr_val(x)
+
 ;; 4-runtime.watsup:84.1-84.62
 syntax config = `%;%*`(state, admininstr*)
 
diff --git a/spectec/test-haskell/TEST.md b/spectec/test-haskell/TEST.md
index a0ba938118..95ed821e54 100644
--- a/spectec/test-haskell/TEST.md
+++ b/spectec/test-haskell/TEST.md
@@ -1,7 +1,7 @@
 # Preview
 
 ```sh
-$ dune exec ../src/exe-haskell/main.exe -- ../spec/*.watsup -o Test.hs
+$ dune exec ../src/exe-watsup/main.exe -- --haskell ../spec/*.watsup -o Test.hs
 $ cat Test.hs
 {-# LANGUAGE OverloadedRecordDot #-}
 {-# LANGUAGE DuplicateRecordFields #-}
diff --git a/spectec/test-haskell/dune b/spectec/test-haskell/dune
index 0fd2d4f0b0..47035d055b 100644
--- a/spectec/test-haskell/dune
+++ b/spectec/test-haskell/dune
@@ -1,7 +1,7 @@
 (mdx
   (libraries spectec)
   (deps
-    (file ../src/exe-haskell/main.exe)
+    (file ../src/exe-watsup/main.exe)
     (glob_files ../spec/*.watsup)
   )
   (files TEST.md)
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index d61da5cebe..8854d4ce01 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -1,7 +1,7 @@
 # Preview
 
 ```sh
-$ dune exec ../src/exe-lean4/main.exe -- ../spec/*.watsup -o SpecTec.lean
+$ dune exec ../src/exe-watsup/main.exe -- --lean4 ../spec/*.watsup -o SpecTec.lean
 $ cat SpecTec.lean
 /- Lean 4 export -/
 
diff --git a/spectec/test-lean4/dune b/spectec/test-lean4/dune
index cf53a32136..47035d055b 100644
--- a/spectec/test-lean4/dune
+++ b/spectec/test-lean4/dune
@@ -1,7 +1,7 @@
 (mdx
   (libraries spectec)
   (deps
-    (file ../src/exe-lean4/main.exe)
+    (file ../src/exe-watsup/main.exe)
     (glob_files ../spec/*.watsup)
   )
   (files TEST.md)

From 10857b0ccccd1f90f1759362680687262c628d96 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sun, 9 Apr 2023 17:41:28 +0200
Subject: [PATCH 61/98] Add printing flags

---
 spectec/src/exe-watsup/main.ml  | 21 ++++++++++++++-------
 spectec/test-frontend/PASSES.md |  3 +--
 spectec/test-frontend/TEST.md   |  3 +--
 3 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/spectec/src/exe-watsup/main.ml b/spectec/src/exe-watsup/main.ml
index b5289f04c5..0f283bcadb 100644
--- a/spectec/src/exe-watsup/main.ml
+++ b/spectec/src/exe-watsup/main.ml
@@ -26,6 +26,10 @@ let srcs = ref []    (* src file arguments *)
 let dsts = ref []    (* destination file arguments *)
 let odst = ref ""    (* generation file argument *)
 
+let print_elab_il = ref false
+let print_final_il = ref false
+let print_all_il = ref false
+
 let pass_flat = ref false
 let pass_totalize = ref false
 let pass_sideconditions = ref false
@@ -49,6 +53,10 @@ let argspec = Arg.align
   "-l", Arg.Set log, " Log execution steps";
   "-w", Arg.Set warn, " Warn about unsed or multiply used splices";
 
+  "--print-il", Arg.Set print_elab_il, "Print il (after elaboration)";
+  "--print-final-il", Arg.Set print_final_il, "Print final il";
+  "--print-all-il", Arg.Set print_all_il, "Print il after each step";
+
   "--flat", Arg.Set pass_flat, "Run variant flattening";
   "--totalize", Arg.Set pass_totalize, "Run function totalization";
   "--sideconditions", Arg.Set pass_sideconditions, "Infer side conditoins";
@@ -76,17 +84,14 @@ let () =
     let el = List.concat_map Frontend.Parse.parse_file !srcs in
     log "Elaboration...";
     let il = Frontend.Elab.elab el in
-    if !odst = "" && !dsts = [] then (
-      log "Printing...";
-      Printf.printf "%s\n%!" (Il.Print.string_of_script il);
-    );
+    if !print_elab_il || !print_all_il then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
     log "IL Validation...";
     Il.Validation.valid il;
 
     let il = if !pass_flat || !target = Haskell || !target = Lean4 then begin
       log "Variant flattening...";
       let il = Middlend.Flat.transform il in
-      if !pass_flat then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
+      if !print_all_il then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
       log "IL Validation...";
       Il.Validation.valid il;
       il
@@ -95,7 +100,7 @@ let () =
     let il = if !pass_totalize || !target = Lean4 then begin
       log "Function totalization...";
       let il = Middlend.Totalize.transform il in
-      if !pass_totalize then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
+      if !print_all_il then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
       log "IL Validation...";
       Il.Validation.valid il;
       il
@@ -104,12 +109,14 @@ let () =
     let il = if !pass_sideconditions || !target = Haskell || !target = Lean4 then begin
       log "Side condition inference";
       let il = Middlend.Sideconditions.transform il in
-      if !pass_sideconditions then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
+      if !print_all_il then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
       log "IL Validation...";
       Il.Validation.valid il;
       il
     end else il in
 
+    if !print_final_il && not !print_all_il then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
+
     begin match !target with
     | None -> ()
     | Latex config ->
diff --git a/spectec/test-frontend/PASSES.md b/spectec/test-frontend/PASSES.md
index ebcf9c2c70..6a632ad812 100644
--- a/spectec/test-frontend/PASSES.md
+++ b/spectec/test-frontend/PASSES.md
@@ -1,10 +1,9 @@
 # Preview
 
 ```sh
-$ (cd ../spec && ../src/exe-watsup/main.exe *.watsup -l --flat --totalize --sideconditions)
+$ (cd ../spec && ../src/exe-watsup/main.exe *.watsup -l --print-all-il --flat --totalize --sideconditions)
 == Parsing...
 == Elaboration...
-== Printing...
 
 ;; 1-syntax.watsup:3.1-3.15
 syntax n = nat
diff --git a/spectec/test-frontend/TEST.md b/spectec/test-frontend/TEST.md
index 07db7eef7f..5740c860e1 100644
--- a/spectec/test-frontend/TEST.md
+++ b/spectec/test-frontend/TEST.md
@@ -1,11 +1,10 @@
 # Preview
 
 ```sh
-$ (cd ../spec && dune exec ../src/exe-watsup/main.exe -- *.watsup -v -l)
+$ (cd ../spec && dune exec ../src/exe-watsup/main.exe -- *.watsup -v -l --print-il)
 watsup 0.3 generator
 == Parsing...
 == Elaboration...
-== Printing...
 
 ;; 1-syntax.watsup:3.1-3.15
 syntax n = nat

From 977a21a2924791e90f28a2782f56a2826ebb5b69 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sun, 9 Apr 2023 17:42:57 +0200
Subject: [PATCH 62/98] Separte test-middlend directory

---
 spectec/Makefile                              |  4 +--
 spectec/test-frontend/dune                    |  2 +-
 spectec/test-middlend/Makefile                | 34 +++++++++++++++++++
 .../PASSES.md => test-middlend/TEST.md}       |  0
 spectec/test-middlend/dune                    |  8 +++++
 5 files changed, 45 insertions(+), 3 deletions(-)
 create mode 100644 spectec/test-middlend/Makefile
 rename spectec/{test-frontend/PASSES.md => test-middlend/TEST.md} (100%)
 create mode 100644 spectec/test-middlend/dune

diff --git a/spectec/Makefile b/spectec/Makefile
index 8de9a889bd..702e37afd6 100644
--- a/spectec/Makefile
+++ b/spectec/Makefile
@@ -3,7 +3,7 @@
 NAME = watsup
 EXT = $(NAME)
 
-TESTDIRS = test-frontend test-latex
+TESTDIRS = test-frontend test-middlend test-latex
 
 
 DUNE_OPTS ?=
@@ -14,7 +14,7 @@ DUNE_OPTS ?=
 
 default: exe exe-haskell
 all: exe latex test
-ci: all test-frontend test-latex
+ci: all test-frontend test-middlend test-latex
 
 
 # Executable
diff --git a/spectec/test-frontend/dune b/spectec/test-frontend/dune
index 4236b979f3..47035d055b 100644
--- a/spectec/test-frontend/dune
+++ b/spectec/test-frontend/dune
@@ -4,5 +4,5 @@
     (file ../src/exe-watsup/main.exe)
     (glob_files ../spec/*.watsup)
   )
-  (files TEST.md PASSES.md)
+  (files TEST.md)
 )
diff --git a/spectec/test-middlend/Makefile b/spectec/test-middlend/Makefile
new file mode 100644
index 0000000000..c7f571191f
--- /dev/null
+++ b/spectec/test-middlend/Makefile
@@ -0,0 +1,34 @@
+# Configuration
+
+NAME = watsup
+EXE = $(PWD)/../$(NAME)
+EXT = $(NAME)
+
+OWNDIR = $(PWD)
+SPECDIR = ../spec
+SPECFILES = $(sh ls $(SPECDIR)/*.$(EXT))
+
+
+# Main targets
+
+.PHONY: all
+
+all: test
+
+
+# Test
+
+.PHONY: test
+
+test: $(EXE)
+	(cd $(SPECDIR) && $(EXE) *.$(EXT))
+
+
+# Cleanup
+
+.PHONY: clean distclean
+
+clean:
+	# Nothing so far
+
+distclean: clean
diff --git a/spectec/test-frontend/PASSES.md b/spectec/test-middlend/TEST.md
similarity index 100%
rename from spectec/test-frontend/PASSES.md
rename to spectec/test-middlend/TEST.md
diff --git a/spectec/test-middlend/dune b/spectec/test-middlend/dune
new file mode 100644
index 0000000000..b3de47b690
--- /dev/null
+++ b/spectec/test-middlend/dune
@@ -0,0 +1,8 @@
+(mdx
+  (libraries spectec)
+  (deps
+    (file ../src/exe-watsup/main.exe)
+    (glob_files ../spec/*.watsup)
+  )
+  (files PASSES.md)
+)

From cb22d249b11e46fdf1e3b23b6b6981dac4651cb1 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sun, 9 Apr 2023 18:33:17 +0200
Subject: [PATCH 63/98] No-change test output update

---
 spectec/test-middlend/TEST.md | 1748 ++++++++++++++++++++++++++++++++-
 1 file changed, 1747 insertions(+), 1 deletion(-)

diff --git a/spectec/test-middlend/TEST.md b/spectec/test-middlend/TEST.md
index 6a632ad812..ca98990263 100644
--- a/spectec/test-middlend/TEST.md
+++ b/spectec/test-middlend/TEST.md
@@ -1,7 +1,7 @@
 # Preview
 
 ```sh
-$ (cd ../spec && ../src/exe-watsup/main.exe *.watsup -l --print-all-il --flat --totalize --sideconditions)
+$ (cd ../spec && ../src/exe-watsup/main.exe *.watsup -l --print-all-il --flat --totalize --sideconditions --else-elimination)
 == Parsing...
 == Elaboration...
 
@@ -6569,6 +6569,1752 @@ relation Step: `%~>%`(config, config)
   rule elem.drop {x : idx, z : state}:
     `%~>%`(`%;%*`(z, [ELEM.DROP_admininstr(x)]), `%;%*`($with_elem(z, x, []), []))
 
+== IL Validation...
+== Else elimination
+
+;; 1-syntax.watsup:3.1-3.15
+syntax n = nat
+
+;; 1-syntax.watsup:9.1-9.37
+syntax name = text
+
+;; 1-syntax.watsup:14.1-14.36
+syntax byte = nat
+
+;; 1-syntax.watsup:15.1-15.45
+syntax u32 = nat
+
+;; 1-syntax.watsup:22.1-22.36
+syntax idx = nat
+
+;; 1-syntax.watsup:23.1-23.49
+syntax funcidx = idx
+
+;; 1-syntax.watsup:24.1-24.49
+syntax globalidx = idx
+
+;; 1-syntax.watsup:25.1-25.47
+syntax tableidx = idx
+
+;; 1-syntax.watsup:26.1-26.46
+syntax memidx = idx
+
+;; 1-syntax.watsup:27.1-27.45
+syntax elemidx = idx
+
+;; 1-syntax.watsup:28.1-28.45
+syntax dataidx = idx
+
+;; 1-syntax.watsup:29.1-29.47
+syntax labelidx = idx
+
+;; 1-syntax.watsup:30.1-30.47
+syntax localidx = idx
+
+;; 1-syntax.watsup:39.1-40.22
+syntax numtype =
+  | I32
+  | I64
+  | F32
+  | F64
+
+;; 1-syntax.watsup:41.1-42.5
+syntax vectype =
+  | V128
+
+;; 1-syntax.watsup:43.1-44.20
+syntax reftype =
+  | FUNCREF
+  | EXTERNREF
+
+;; 1-syntax.watsup:45.1-46.34
+syntax valtype =
+  | I32
+  | I64
+  | F32
+  | F64
+  | V128
+  | FUNCREF
+  | EXTERNREF
+  | BOT
+
+;;
+def valtype_numtype : numtype -> valtype
+  ;;
+  def valtype_numtype(I32_numtype) = I32_valtype
+  ;;
+  def valtype_numtype(I64_numtype) = I64_valtype
+  ;;
+  def valtype_numtype(F32_numtype) = F32_valtype
+  ;;
+  def valtype_numtype(F64_numtype) = F64_valtype
+
+;;
+def valtype_vectype : vectype -> valtype
+  ;;
+  def valtype_vectype(V128_vectype) = V128_valtype
+
+;;
+def valtype_reftype : reftype -> valtype
+  ;;
+  def valtype_reftype(FUNCREF_reftype) = FUNCREF_valtype
+  ;;
+  def valtype_reftype(EXTERNREF_reftype) = EXTERNREF_valtype
+
+;; 1-syntax.watsup:48.1-48.71
+syntax in =
+  | I32
+  | I64
+
+;;
+def numtype_in : in -> numtype
+  ;;
+  def numtype_in(I32_in) = I32_numtype
+  ;;
+  def numtype_in(I64_in) = I64_numtype
+
+;;
+def valtype_in : in -> valtype
+  ;;
+  def valtype_in(I32_in) = I32_valtype
+  ;;
+  def valtype_in(I64_in) = I64_valtype
+
+;; 1-syntax.watsup:49.1-49.71
+syntax fn =
+  | F32
+  | F64
+
+;;
+def numtype_fn : fn -> numtype
+  ;;
+  def numtype_fn(F32_fn) = F32_numtype
+  ;;
+  def numtype_fn(F64_fn) = F64_numtype
+
+;;
+def valtype_fn : fn -> valtype
+  ;;
+  def valtype_fn(F32_fn) = F32_valtype
+  ;;
+  def valtype_fn(F64_fn) = F64_valtype
+
+;; 1-syntax.watsup:56.1-57.11
+syntax resulttype = valtype*
+
+;; 1-syntax.watsup:59.1-60.16
+syntax limits = `[%..%]`(u32, u32)
+
+;; 1-syntax.watsup:61.1-62.6
+syntax mutflag = MUT
+
+;; 1-syntax.watsup:63.1-64.19
+syntax globaltype = `%?%`(mutflag?, valtype)
+
+;; 1-syntax.watsup:65.1-66.27
+syntax functype = `%->%`(resulttype, resulttype)
+
+;; 1-syntax.watsup:67.1-68.17
+syntax tabletype = `%%`(limits, reftype)
+
+;; 1-syntax.watsup:69.1-70.12
+syntax memtype = `%I8`(limits)
+
+;; 1-syntax.watsup:71.1-72.10
+syntax elemtype = reftype
+
+;; 1-syntax.watsup:73.1-74.5
+syntax datatype = OK
+
+;; 1-syntax.watsup:75.1-76.69
+syntax externtype =
+  | GLOBAL(globaltype)
+  | FUNC(functype)
+  | TABLE(tabletype)
+  | MEMORY(memtype)
+
+;; 1-syntax.watsup:89.1-89.44
+syntax sx =
+  | U
+  | S
+
+;; 1-syntax.watsup:91.1-91.39
+syntax unop_IXX =
+  | CLZ
+  | CTZ
+  | POPCNT
+
+;; 1-syntax.watsup:92.1-92.70
+syntax unop_FXX =
+  | ABS
+  | NEG
+  | SQRT
+  | CEIL
+  | FLOOR
+  | TRUNC
+  | NEAREST
+
+;; 1-syntax.watsup:94.1-96.62
+syntax binop_IXX =
+  | ADD
+  | SUB
+  | MUL
+  | DIV(sx)
+  | REM(sx)
+  | AND
+  | OR
+  | XOR
+  | SHL
+  | SHR(sx)
+  | ROTL
+  | ROTR
+
+;; 1-syntax.watsup:97.1-97.66
+syntax binop_FXX =
+  | ADD
+  | SUB
+  | MUL
+  | DIV
+  | MIN
+  | MAX
+  | COPYSIGN
+
+;; 1-syntax.watsup:99.1-99.26
+syntax testop_IXX =
+  | EQZ
+
+;; 1-syntax.watsup:100.1-100.22
+syntax testop_FXX =
+  |
+
+;; 1-syntax.watsup:102.1-103.108
+syntax relop_IXX =
+  | EQ
+  | NE
+  | LT(sx)
+  | GT(sx)
+  | LE(sx)
+  | GE(sx)
+
+;; 1-syntax.watsup:104.1-104.49
+syntax relop_FXX =
+  | EQ
+  | NE
+  | LT
+  | GT
+  | LE
+  | GE
+
+;; 1-syntax.watsup:106.1-106.50
+syntax unop_numtype =
+  | _I(unop_IXX)
+  | _F(unop_FXX)
+
+;; 1-syntax.watsup:107.1-107.53
+syntax binop_numtype =
+  | _I(binop_IXX)
+  | _F(binop_FXX)
+
+;; 1-syntax.watsup:108.1-108.56
+syntax testop_numtype =
+  | _I(testop_IXX)
+  | _F(testop_FXX)
+
+;; 1-syntax.watsup:109.1-109.53
+syntax relop_numtype =
+  | _I(relop_IXX)
+  | _F(relop_FXX)
+
+;; 1-syntax.watsup:110.1-110.39
+syntax cvtop =
+  | CONVERT
+  | REINTERPRET
+
+;; 1-syntax.watsup:120.1-120.23
+syntax c_numtype = nat
+
+;; 1-syntax.watsup:121.1-121.23
+syntax c_vectype = nat
+
+;; 1-syntax.watsup:124.1-124.52
+syntax blocktype = functype
+
+;; 1-syntax.watsup:159.1-180.55
+rec {
+
+;; 1-syntax.watsup:159.1-180.55
+syntax instr =
+  | UNREACHABLE
+  | NOP
+  | DROP
+  | SELECT(valtype?)
+  | BLOCK(blocktype, instr*)
+  | LOOP(blocktype, instr*)
+  | IF(blocktype, instr*, instr*)
+  | BR(labelidx)
+  | BR_IF(labelidx)
+  | BR_TABLE(labelidx*, labelidx)
+  | CALL(funcidx)
+  | CALL_INDIRECT(tableidx, functype)
+  | RETURN
+  | CONST(numtype, c_numtype)
+  | UNOP(numtype, unop_numtype)
+  | BINOP(numtype, binop_numtype)
+  | TESTOP(numtype, testop_numtype)
+  | RELOP(numtype, relop_numtype)
+  | EXTEND(numtype, n)
+  | CVTOP(numtype, cvtop, numtype, sx?)
+  | REF.NULL(reftype)
+  | REF.FUNC(funcidx)
+  | REF.IS_NULL
+  | LOCAL.GET(localidx)
+  | LOCAL.SET(localidx)
+  | LOCAL.TEE(localidx)
+  | GLOBAL.GET(globalidx)
+  | GLOBAL.SET(globalidx)
+  | TABLE.GET(tableidx)
+  | TABLE.SET(tableidx)
+  | TABLE.SIZE(tableidx)
+  | TABLE.GROW(tableidx)
+  | TABLE.FILL(tableidx)
+  | TABLE.COPY(tableidx, tableidx)
+  | TABLE.INIT(tableidx, elemidx)
+  | ELEM.DROP(elemidx)
+  | MEMORY.SIZE
+  | MEMORY.GROW
+  | MEMORY.FILL
+  | MEMORY.COPY
+  | MEMORY.INIT(dataidx)
+  | DATA.DROP(dataidx)
+  | LOAD(numtype, (n, sx)?, nat, nat)
+  | STORE(numtype, n?, nat, nat)
+}
+
+;; 1-syntax.watsup:182.1-183.9
+syntax expr = instr*
+
+;; 1-syntax.watsup:188.1-188.50
+syntax elemmode =
+  | TABLE(tableidx, expr)
+  | DECLARE
+
+;; 1-syntax.watsup:189.1-189.39
+syntax datamode =
+  | MEMORY(memidx, expr)
+
+;; 1-syntax.watsup:191.1-192.30
+syntax func = `FUNC%%*%`(functype, valtype*, expr)
+
+;; 1-syntax.watsup:193.1-194.25
+syntax global = GLOBAL(globaltype, expr)
+
+;; 1-syntax.watsup:195.1-196.18
+syntax table = TABLE(tabletype)
+
+;; 1-syntax.watsup:197.1-198.17
+syntax mem = MEMORY(memtype)
+
+;; 1-syntax.watsup:199.1-200.31
+syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
+
+;; 1-syntax.watsup:201.1-202.26
+syntax data = `DATA(*)%*%?`(byte**, datamode?)
+
+;; 1-syntax.watsup:203.1-204.16
+syntax start = START(funcidx)
+
+;; 1-syntax.watsup:206.1-207.65
+syntax externuse =
+  | FUNC(funcidx)
+  | GLOBAL(globalidx)
+  | TABLE(tableidx)
+  | MEMORY(memidx)
+
+;; 1-syntax.watsup:208.1-209.24
+syntax export = EXPORT(name, externuse)
+
+;; 1-syntax.watsup:210.1-211.30
+syntax import = IMPORT(name, name, externtype)
+
+;; 1-syntax.watsup:213.1-214.70
+syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
+
+;; 2-aux.watsup:5.1-5.55
+def size : valtype -> nat?
+  ;; 2-aux.watsup:6.1-6.20
+  def size(I32_valtype) = ?(32)
+  ;; 2-aux.watsup:7.1-7.20
+  def size(I64_valtype) = ?(64)
+  ;; 2-aux.watsup:8.1-8.20
+  def size(F32_valtype) = ?(32)
+  ;; 2-aux.watsup:9.1-9.20
+  def size(F64_valtype) = ?(64)
+  ;; 2-aux.watsup:10.1-10.22
+  def size(V128_valtype) = ?(128)
+  ;;
+  def {x : valtype} size(x) = ?()
+
+;; 2-aux.watsup:15.1-15.40
+def test_sub_ATOM_22 : n -> nat
+  ;; 2-aux.watsup:16.1-16.38
+  def {n_3_ATOM_y : n} test_sub_ATOM_22(n_3_ATOM_y) = 0
+
+;; 2-aux.watsup:18.1-18.26
+def curried_ : (n, n) -> nat
+  ;; 2-aux.watsup:19.1-19.39
+  def {n_1 : n, n_2 : n} curried_(n_1, n_2) = (n_1 + n_2)
+
+;; 2-aux.watsup:21.1-30.39
+syntax testfuse =
+  | AB_(nat, nat, nat)
+  | CD(nat, nat, nat)
+  | EF(nat, nat, nat)
+  | GH(nat, nat, nat)
+  | IJ(nat, nat, nat)
+  | KL(nat, nat, nat)
+  | MN(nat, nat, nat)
+  | OP(nat, nat, nat)
+  | QR(nat, nat, nat)
+
+;; 3-typing.watsup:3.1-6.60
+syntax context = {FUNC functype*, GLOBAL globaltype*, TABLE tabletype*, MEM memtype*, ELEM elemtype*, DATA datatype*, LOCAL valtype*, LABEL resulttype*, RETURN resulttype?}
+
+;; 3-typing.watsup:14.1-14.66
+relation Limits_ok: `|-%:%`(limits, nat)
+  ;; 3-typing.watsup:22.1-24.24
+  rule _ {k : nat, n_1 : n, n_2 : n}:
+    `|-%:%`(`[%..%]`(n_1, n_2), k)
+    -- if ((n_1 <= n_2) /\ (n_2 <= k))
+
+;; 3-typing.watsup:15.1-15.64
+relation Functype_ok: `|-%:OK`(functype)
+  ;; 3-typing.watsup:26.1-27.13
+  rule _ {ft : functype}:
+    `|-%:OK`(ft)
+
+;; 3-typing.watsup:16.1-16.66
+relation Globaltype_ok: `|-%:OK`(globaltype)
+  ;; 3-typing.watsup:29.1-30.13
+  rule _ {gt : globaltype}:
+    `|-%:OK`(gt)
+
+;; 3-typing.watsup:17.1-17.65
+relation Tabletype_ok: `|-%:OK`(tabletype)
+  ;; 3-typing.watsup:32.1-34.35
+  rule _ {lim : limits, rt : reftype}:
+    `|-%:OK`(`%%`(lim, rt))
+    -- Limits_ok: `|-%:%`(lim, ((2 ^ 32) - 1))
+
+;; 3-typing.watsup:18.1-18.63
+relation Memtype_ok: `|-%:OK`(memtype)
+  ;; 3-typing.watsup:36.1-38.33
+  rule _ {lim : limits}:
+    `|-%:OK`(`%I8`(lim))
+    -- Limits_ok: `|-%:%`(lim, (2 ^ 16))
+
+;; 3-typing.watsup:19.1-19.66
+relation Externtype_ok: `|-%:OK`(externtype)
+  ;; 3-typing.watsup:41.1-43.35
+  rule func {functype : functype}:
+    `|-%:OK`(FUNC_externtype(functype))
+    -- Functype_ok: `|-%:OK`(functype)
+
+  ;; 3-typing.watsup:45.1-47.39
+  rule global {globaltype : globaltype}:
+    `|-%:OK`(GLOBAL_externtype(globaltype))
+    -- Globaltype_ok: `|-%:OK`(globaltype)
+
+  ;; 3-typing.watsup:49.1-51.37
+  rule table {tabletype : tabletype}:
+    `|-%:OK`(TABLE_externtype(tabletype))
+    -- Tabletype_ok: `|-%:OK`(tabletype)
+
+  ;; 3-typing.watsup:53.1-55.33
+  rule mem {memtype : memtype}:
+    `|-%:OK`(MEMORY_externtype(memtype))
+    -- Memtype_ok: `|-%:OK`(memtype)
+
+;; 3-typing.watsup:61.1-61.65
+relation Valtype_sub: `|-%<:%`(valtype, valtype)
+  ;; 3-typing.watsup:64.1-65.12
+  rule refl {t : valtype}:
+    `|-%<:%`(t, t)
+
+  ;; 3-typing.watsup:67.1-68.14
+  rule bot {t : valtype}:
+    `|-%<:%`(BOT_valtype, t)
+
+;; 3-typing.watsup:62.1-62.72
+relation Resulttype_sub: `|-%*<:%*`(valtype*, valtype*)
+  ;; 3-typing.watsup:70.1-72.35
+  rule _ {t_1* : valtype*, t_2* : valtype*}:
+    `|-%*<:%*`(t_1*{t_1}, t_2*{t_2})
+    -- if (|t_1*{t_1}| = |t_2*{t_2}|)
+    -- (Valtype_sub: `|-%<:%`(t_1, t_2))*{t_1 t_2}
+
+;; 3-typing.watsup:75.1-75.75
+relation Limits_sub: `|-%<:%`(limits, limits)
+  ;; 3-typing.watsup:83.1-86.21
+  rule _ {n_11 : n, n_12 : n, n_21 : n, n_22 : n}:
+    `|-%<:%`(`[%..%]`(n_11, n_12), `[%..%]`(n_21, n_22))
+    -- if (n_11 >= n_21)
+    -- if (n_12 <= n_22)
+
+;; 3-typing.watsup:76.1-76.73
+relation Functype_sub: `|-%<:%`(functype, functype)
+  ;; 3-typing.watsup:88.1-89.14
+  rule _ {ft : functype}:
+    `|-%<:%`(ft, ft)
+
+;; 3-typing.watsup:77.1-77.75
+relation Globaltype_sub: `|-%<:%`(globaltype, globaltype)
+  ;; 3-typing.watsup:91.1-92.14
+  rule _ {gt : globaltype}:
+    `|-%<:%`(gt, gt)
+
+;; 3-typing.watsup:78.1-78.74
+relation Tabletype_sub: `|-%<:%`(tabletype, tabletype)
+  ;; 3-typing.watsup:94.1-96.35
+  rule _ {lim_1 : limits, lim_2 : limits, rt : reftype}:
+    `|-%<:%`(`%%`(lim_1, rt), `%%`(lim_2, rt))
+    -- Limits_sub: `|-%<:%`(lim_1, lim_2)
+
+;; 3-typing.watsup:79.1-79.72
+relation Memtype_sub: `|-%<:%`(memtype, memtype)
+  ;; 3-typing.watsup:98.1-100.35
+  rule _ {lim_1 : limits, lim_2 : limits}:
+    `|-%<:%`(`%I8`(lim_1), `%I8`(lim_2))
+    -- Limits_sub: `|-%<:%`(lim_1, lim_2)
+
+;; 3-typing.watsup:80.1-80.75
+relation Externtype_sub: `|-%<:%`(externtype, externtype)
+  ;; 3-typing.watsup:103.1-105.35
+  rule func {ft_1 : functype, ft_2 : functype}:
+    `|-%<:%`(FUNC_externtype(ft_1), FUNC_externtype(ft_2))
+    -- Functype_sub: `|-%<:%`(ft_1, ft_2)
+
+  ;; 3-typing.watsup:107.1-109.37
+  rule global {gt_1 : globaltype, gt_2 : globaltype}:
+    `|-%<:%`(GLOBAL_externtype(gt_1), GLOBAL_externtype(gt_2))
+    -- Globaltype_sub: `|-%<:%`(gt_1, gt_2)
+
+  ;; 3-typing.watsup:111.1-113.36
+  rule table {tt_1 : tabletype, tt_2 : tabletype}:
+    `|-%<:%`(TABLE_externtype(tt_1), TABLE_externtype(tt_2))
+    -- Tabletype_sub: `|-%<:%`(tt_1, tt_2)
+
+  ;; 3-typing.watsup:115.1-117.34
+  rule mem {mt_1 : memtype, mt_2 : memtype}:
+    `|-%<:%`(MEMORY_externtype(mt_1), MEMORY_externtype(mt_2))
+    -- Memtype_sub: `|-%<:%`(mt_1, mt_2)
+
+;; 3-typing.watsup:172.1-172.76
+relation Blocktype_ok: `%|-%:%`(context, blocktype, functype)
+  ;; 3-typing.watsup:174.1-176.29
+  rule _ {C : context, ft : functype}:
+    `%|-%:%`(C, ft, ft)
+    -- Functype_ok: `|-%:OK`(ft)
+
+;; 3-typing.watsup:123.1-124.67
+rec {
+
+;; 3-typing.watsup:123.1-123.66
+relation Instr_ok: `%|-%:%`(context, instr, functype)
+  ;; 3-typing.watsup:153.1-154.34
+  rule unreachable {C : context, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, UNREACHABLE_instr, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:156.1-157.32
+  rule nop {C : context}:
+    `%|-%:%`(C, NOP_instr, `%->%`([], []))
+
+  ;; 3-typing.watsup:159.1-160.27
+  rule drop {C : context, t : valtype}:
+    `%|-%:%`(C, DROP_instr, `%->%`([t], []))
+
+  ;; 3-typing.watsup:163.1-164.31
+  rule select-expl {C : context, t : valtype}:
+    `%|-%:%`(C, SELECT_instr(?(t)), `%->%`([t t I32_valtype], [t]))
+
+  ;; 3-typing.watsup:166.1-169.37
+  rule select-impl {C : context, numtype : numtype, t : valtype, t' : valtype, vectype : vectype}:
+    `%|-%:%`(C, SELECT_instr(?()), `%->%`([t t I32_valtype], [t]))
+    -- Valtype_sub: `|-%<:%`(t, t')
+    -- if ((t' = (numtype <: valtype)) \/ (t' = (vectype <: valtype)))
+
+  ;; 3-typing.watsup:178.1-181.57
+  rule block {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BLOCK_instr(bt, instr*{instr}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:183.1-186.57
+  rule loop {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, LOOP_instr(bt, instr*{instr}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_1]*{t_1}, RETURN ?()}, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:188.1-192.59
+  rule if {C : context, bt : blocktype, instr_1* : instr*, instr_2* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, IF_instr(bt, instr_1*{instr_1}, instr_2*{instr_2}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr_1*{instr_1}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr_2*{instr_2}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:195.1-197.24
+  rule br {C : context, l : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BR_instr(l), `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- if (l < |C.LABEL_context|)
+    -- if (C.LABEL_context[l] = t*{t})
+
+  ;; 3-typing.watsup:199.1-201.24
+  rule br_if {C : context, l : labelidx, t* : valtype*}:
+    `%|-%:%`(C, BR_IF_instr(l), `%->%`(t*{t} :: [I32_valtype], t*{t}))
+    -- if (l < |C.LABEL_context|)
+    -- if (C.LABEL_context[l] = t*{t})
+
+  ;; 3-typing.watsup:203.1-206.42
+  rule br_table {C : context, l* : labelidx*, l' : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BR_TABLE_instr(l*{l}, l'), `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- (if (l < |C.LABEL_context|))*{l}
+    -- if (l' < |C.LABEL_context|)
+    -- (Resulttype_sub: `|-%*<:%*`(t*{t}, C.LABEL_context[l]))*{l}
+    -- Resulttype_sub: `|-%*<:%*`(t*{t}, C.LABEL_context[l'])
+
+  ;; 3-typing.watsup:208.1-210.24
+  rule return {C : context, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, RETURN_instr, `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- if (C.RETURN_context = ?(t*{t}))
+
+  ;; 3-typing.watsup:212.1-214.33
+  rule call {C : context, t_1* : valtype*, t_2* : valtype*, x : idx}:
+    `%|-%:%`(C, CALL_instr(x), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- if (x < |C.FUNC_context|)
+    -- if (C.FUNC_context[x] = `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:216.1-219.26
+  rule call_indirect {C : context, ft : functype, lim : limits, t_1* : valtype*, t_2* : valtype*, x : idx}:
+    `%|-%:%`(C, CALL_INDIRECT_instr(x, ft), `%->%`(t_1*{t_1} :: [I32_valtype], t_2*{t_2}))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = `%%`(lim, FUNCREF_reftype))
+    -- if (ft = `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:222.1-223.37
+  rule const {C : context, c_nt : c_numtype, nt : numtype}:
+    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [(nt <: valtype)]))
+
+  ;; 3-typing.watsup:225.1-226.31
+  rule unop {C : context, nt : numtype, unop : unop_numtype}:
+    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
+
+  ;; 3-typing.watsup:228.1-229.36
+  rule binop {C : context, binop : binop_numtype, nt : numtype}:
+    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([(nt <: valtype) (nt <: valtype)], [(nt <: valtype)]))
+
+  ;; 3-typing.watsup:231.1-232.36
+  rule testop {C : context, nt : numtype, testop : testop_numtype}:
+    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([(nt <: valtype)], [I32_valtype]))
+
+  ;; 3-typing.watsup:234.1-235.37
+  rule relop {C : context, nt : numtype, relop : relop_numtype}:
+    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([(nt <: valtype) (nt <: valtype)], [I32_valtype]))
+
+  ;; 3-typing.watsup:238.1-240.23
+  rule extend {C : context, n : n, nt : numtype}:
+    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
+    -- if ($size(nt <: valtype) =/= ?())
+    -- if (n <= !($size(nt <: valtype)))
+
+  ;; 3-typing.watsup:242.1-245.34
+  rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype}:
+    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([(nt_2 <: valtype)], [(nt_1 <: valtype)]))
+    -- if ($size(nt_1 <: valtype) =/= ?())
+    -- if ($size(nt_2 <: valtype) =/= ?())
+    -- if (nt_1 =/= nt_2)
+    -- if (!($size(nt_1 <: valtype)) = !($size(nt_2 <: valtype)))
+
+  ;; 3-typing.watsup:247.1-250.52
+  rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?}:
+    `%|-%:%`(C, CVTOP_instr((in_1 <: numtype), CONVERT_cvtop, (in_2 <: numtype), sx?{sx}), `%->%`([(in_2 <: valtype)], [(in_1 <: valtype)]))
+    -- if ($size(in_1 <: valtype) =/= ?())
+    -- if ($size(in_2 <: valtype) =/= ?())
+    -- if (in_1 =/= in_2)
+    -- if ((sx?{sx} = ?()) <=> (!($size(in_1 <: valtype)) > !($size(in_2 <: valtype))))
+
+  ;; 3-typing.watsup:252.1-254.22
+  rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
+    `%|-%:%`(C, CVTOP_instr((fn_1 <: numtype), CONVERT_cvtop, (fn_2 <: numtype), ?()), `%->%`([(fn_2 <: valtype)], [(fn_1 <: valtype)]))
+    -- if (fn_1 =/= fn_2)
+
+  ;; 3-typing.watsup:257.1-258.35
+  rule ref.null {C : context, rt : reftype}:
+    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [(rt <: valtype)]))
+
+  ;; 3-typing.watsup:260.1-262.23
+  rule ref.func {C : context, ft : functype, x : idx}:
+    `%|-%:%`(C, REF.FUNC_instr(x), `%->%`([], [FUNCREF_valtype]))
+    -- if (x < |C.FUNC_context|)
+    -- if (C.FUNC_context[x] = ft)
+
+  ;; 3-typing.watsup:264.1-265.31
+  rule ref.is_null {C : context, rt : reftype}:
+    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([(rt <: valtype)], [I32_valtype]))
+
+  ;; 3-typing.watsup:268.1-270.23
+  rule local.get {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.GET_instr(x), `%->%`([], [t]))
+    -- if (x < |C.LOCAL_context|)
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:272.1-274.23
+  rule local.set {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.SET_instr(x), `%->%`([t], []))
+    -- if (x < |C.LOCAL_context|)
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:276.1-278.23
+  rule local.tee {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.TEE_instr(x), `%->%`([t], [t]))
+    -- if (x < |C.LOCAL_context|)
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:281.1-283.29
+  rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
+    `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
+    -- if (x < |C.GLOBAL_context|)
+    -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
+
+  ;; 3-typing.watsup:285.1-287.28
+  rule global.set {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
+    -- if (x < |C.GLOBAL_context|)
+    -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
+
+  ;; 3-typing.watsup:290.1-292.28
+  rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [(rt <: valtype)]))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:294.1-296.28
+  rule table.set {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype (rt <: valtype)], []))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:298.1-300.24
+  rule table.size {C : context, tt : tabletype, x : idx}:
+    `%|-%:%`(C, TABLE.SIZE_instr(x), `%->%`([], [I32_valtype]))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = tt)
+
+  ;; 3-typing.watsup:302.1-304.28
+  rule table.grow {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([(rt <: valtype) I32_valtype], [I32_valtype]))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:306.1-308.28
+  rule table.fill {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype (rt <: valtype) I32_valtype], []))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:310.1-313.32
+  rule table.copy {C : context, lim_1 : limits, lim_2 : limits, rt : reftype, x_1 : idx, x_2 : idx}:
+    `%|-%:%`(C, TABLE.COPY_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (x_1 < |C.TABLE_context|)
+    -- if (x_2 < |C.TABLE_context|)
+    -- if (C.TABLE_context[x_1] = `%%`(lim_1, rt))
+    -- if (C.TABLE_context[x_2] = `%%`(lim_2, rt))
+
+  ;; 3-typing.watsup:315.1-318.25
+  rule table.init {C : context, lim : limits, rt : reftype, x_1 : idx, x_2 : idx}:
+    `%|-%:%`(C, TABLE.INIT_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (x_1 < |C.TABLE_context|)
+    -- if (x_2 < |C.ELEM_context|)
+    -- if (C.TABLE_context[x_1] = `%%`(lim, rt))
+    -- if (C.ELEM_context[x_2] = rt)
+
+  ;; 3-typing.watsup:320.1-322.23
+  rule elem.drop {C : context, rt : reftype, x : idx}:
+    `%|-%:%`(C, ELEM.DROP_instr(x), `%->%`([], []))
+    -- if (x < |C.ELEM_context|)
+    -- if (C.ELEM_context[x] = rt)
+
+  ;; 3-typing.watsup:325.1-327.22
+  rule memory.size {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.SIZE_instr, `%->%`([], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:329.1-331.22
+  rule memory.grow {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.GROW_instr, `%->%`([I32_valtype], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:333.1-335.22
+  rule memory.fill {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.FILL_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:337.1-339.22
+  rule memory.copy {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.COPY_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:341.1-344.23
+  rule memory.init {C : context, mt : memtype, x : idx}:
+    `%|-%:%`(C, MEMORY.INIT_instr(x), `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
+    -- if (x < |C.DATA_context|)
+    -- if (C.MEM_context[0] = mt)
+    -- if (C.DATA_context[x] = OK)
+
+  ;; 3-typing.watsup:346.1-348.23
+  rule data.drop {C : context, x : idx}:
+    `%|-%:%`(C, DATA.DROP_instr(x), `%->%`([], []))
+    -- if (x < |C.DATA_context|)
+    -- if (C.DATA_context[x] = OK)
+
+  ;; 3-typing.watsup:350.1-355.32
+  rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?}:
+    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
+    -- if (0 < |C.MEM_context|)
+    -- if ($size(nt <: valtype) =/= ?())
+    -- (if ($size(nt <: valtype) =/= ?()))?{n}
+    -- if ((n?{n} = ?()) <=> (sx?{sx} = ?()))
+    -- if (C.MEM_context[0] = mt)
+    -- if ((2 ^ n_A) <= (!($size(nt <: valtype)) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size(nt <: valtype)) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = (in <: numtype)))
+
+  ;; 3-typing.watsup:357.1-362.32
+  rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype}:
+    `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype (nt <: valtype)], []))
+    -- if (0 < |C.MEM_context|)
+    -- if ($size(nt <: valtype) =/= ?())
+    -- (if ($size(nt <: valtype) =/= ?()))?{n}
+    -- if (C.MEM_context[0] = mt)
+    -- if ((2 ^ n_A) <= (!($size(nt <: valtype)) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size(nt <: valtype)) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = (in <: numtype)))
+
+;; 3-typing.watsup:124.1-124.67
+relation InstrSeq_ok: `%|-%*:%`(context, instr*, functype)
+  ;; 3-typing.watsup:133.1-134.36
+  rule empty {C : context}:
+    `%|-%*:%`(C, [], `%->%`([], []))
+
+  ;; 3-typing.watsup:136.1-139.46
+  rule seq {C : context, instr_1 : instr, instr_2 : instr, t_1* : valtype*, t_2* : valtype*, t_3* : valtype*}:
+    `%|-%*:%`(C, [instr_1] :: instr_2*{}, `%->%`(t_1*{t_1}, t_3*{t_3}))
+    -- Instr_ok: `%|-%:%`(C, instr_1, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, [instr_2], `%->%`(t_2*{t_2}, t_3*{t_3}))
+
+  ;; 3-typing.watsup:141.1-146.38
+  rule weak {C : context, instr* : instr*, t'_1 : valtype, t'_2* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%*:%`(C, instr*{instr}, `%->%`([t'_1], t'_2*{t'_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Resulttype_sub: `|-%*<:%*`(t'_1*{}, t_1*{t_1})
+    -- Resulttype_sub: `|-%*<:%*`(t_2*{t_2}, t'_2*{t'_2})
+
+  ;; 3-typing.watsup:148.1-150.45
+  rule frame {C : context, instr* : instr*, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%*:%`(C, instr*{instr}, `%->%`(t*{t} :: t_1*{t_1}, t*{t} :: t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+}
+
+;; 3-typing.watsup:125.1-125.71
+relation Expr_ok: `%|-%:%`(context, expr, resulttype)
+  ;; 3-typing.watsup:128.1-130.46
+  rule _ {C : context, instr* : instr*, t* : valtype*}:
+    `%|-%:%`(C, instr*{instr}, t*{t})
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`([], t*{t}))
+
+;; 3-typing.watsup:367.1-367.78
+relation Instr_const: `%|-%CONST`(context, instr)
+  ;; 3-typing.watsup:371.1-372.26
+  rule const {C : context, c : c_numtype, nt : numtype}:
+    `%|-%CONST`(C, CONST_instr(nt, c))
+
+  ;; 3-typing.watsup:374.1-375.27
+  rule ref.null {C : context, rt : reftype}:
+    `%|-%CONST`(C, REF.NULL_instr(rt))
+
+  ;; 3-typing.watsup:377.1-378.26
+  rule ref.func {C : context, x : idx}:
+    `%|-%CONST`(C, REF.FUNC_instr(x))
+
+  ;; 3-typing.watsup:380.1-382.32
+  rule global.get {C : context, t : valtype, x : idx}:
+    `%|-%CONST`(C, GLOBAL.GET_instr(x))
+    -- if (x < |C.GLOBAL_context|)
+    -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
+
+;; 3-typing.watsup:368.1-368.77
+relation Expr_const: `%|-%CONST`(context, expr)
+  ;; 3-typing.watsup:385.1-386.38
+  rule _ {C : context, instr* : instr*}:
+    `%|-%CONST`(C, instr*{instr})
+    -- (Instr_const: `%|-%CONST`(C, instr))*{instr}
+
+;; 3-typing.watsup:369.1-369.78
+relation Expr_ok_const: `%|-%:%CONST`(context, expr, valtype)
+  ;; 3-typing.watsup:389.1-392.33
+  rule _ {C : context, expr : expr, t : valtype}:
+    `%|-%:%CONST`(C, expr, t)
+    -- Expr_ok: `%|-%:%`(C, expr, [t])
+    -- Expr_const: `%|-%CONST`(C, expr)
+
+;; 3-typing.watsup:397.1-397.73
+relation Func_ok: `%|-%:%`(context, func, functype)
+  ;; 3-typing.watsup:408.1-412.75
+  rule _ {C : context, expr : expr, ft : functype, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, `FUNC%%*%`(ft, t*{t}, expr), ft)
+    -- if (ft = `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Functype_ok: `|-%:OK`(ft)
+    -- Expr_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL t_1*{t_1} :: t*{t}, LABEL [], RETURN ?()} ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2*{t_2}], RETURN ?()} ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [], RETURN ?(t_2*{t_2})}, expr, t_2*{t_2})
+
+;; 3-typing.watsup:398.1-398.75
+relation Global_ok: `%|-%:%`(context, global, globaltype)
+  ;; 3-typing.watsup:414.1-418.40
+  rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
+    `%|-%:%`(C, GLOBAL(gt, expr), gt)
+    -- Globaltype_ok: `|-%:OK`(gt)
+    -- if (gt = `%?%`(MUT?{}, t))
+    -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
+
+;; 3-typing.watsup:399.1-399.74
+relation Table_ok: `%|-%:%`(context, table, tabletype)
+  ;; 3-typing.watsup:420.1-422.30
+  rule _ {C : context, tt : tabletype}:
+    `%|-%:%`(C, TABLE(tt), tt)
+    -- Tabletype_ok: `|-%:OK`(tt)
+
+;; 3-typing.watsup:400.1-400.72
+relation Mem_ok: `%|-%:%`(context, mem, memtype)
+  ;; 3-typing.watsup:424.1-426.28
+  rule _ {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY(mt), mt)
+    -- Memtype_ok: `|-%:OK`(mt)
+
+;; 3-typing.watsup:403.1-403.77
+relation Elemmode_ok: `%|-%:%`(context, elemmode, reftype)
+  ;; 3-typing.watsup:437.1-440.45
+  rule active {C : context, expr : expr, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE_elemmode(x, expr), rt)
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+    -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*{}
+
+  ;; 3-typing.watsup:442.1-443.20
+  rule declare {C : context, rt : reftype}:
+    `%|-%:%`(C, DECLARE_elemmode, rt)
+
+;; 3-typing.watsup:401.1-401.73
+relation Elem_ok: `%|-%:%`(context, elem, reftype)
+  ;; 3-typing.watsup:428.1-431.40
+  rule _ {C : context, elemmode? : elemmode?, expr* : expr*, rt : reftype}:
+    `%|-%:%`(C, `ELEM%%*%?`(rt, expr*{expr}, elemmode?{elemmode}), rt)
+    -- (Expr_ok: `%|-%:%`(C, expr, [(rt <: valtype)]))*{expr}
+    -- (Elemmode_ok: `%|-%:%`(C, elemmode, rt))?{elemmode}
+
+;; 3-typing.watsup:404.1-404.77
+relation Datamode_ok: `%|-%:OK`(context, datamode)
+  ;; 3-typing.watsup:445.1-448.45
+  rule _ {C : context, expr : expr, mt : memtype}:
+    `%|-%:OK`(C, MEMORY_datamode(0, expr))
+    -- if (0 < |C.MEM_context|)
+    -- if (C.MEM_context[0] = mt)
+    -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*{}
+
+;; 3-typing.watsup:402.1-402.73
+relation Data_ok: `%|-%:OK`(context, data)
+  ;; 3-typing.watsup:433.1-435.40
+  rule _ {C : context, b** : byte**, datamode? : datamode?}:
+    `%|-%:OK`(C, `DATA(*)%*%?`(b*{b}*{b}, datamode?{datamode}))
+    -- (Datamode_ok: `%|-%:OK`(C, datamode))?{datamode}
+
+;; 3-typing.watsup:405.1-405.74
+relation Start_ok: `%|-%:OK`(context, start)
+  ;; 3-typing.watsup:450.1-452.39
+  rule _ {C : context, x : idx}:
+    `%|-%:OK`(C, START(x))
+    -- if (x < |C.FUNC_context|)
+    -- if (C.FUNC_context[x] = `%->%`([], []))
+
+;; 3-typing.watsup:455.1-455.80
+relation Import_ok: `%|-%:%`(context, import, externtype)
+  ;; 3-typing.watsup:459.1-461.31
+  rule _ {C : context, name_1 : name, name_2 : name, xt : externtype}:
+    `%|-%:%`(C, IMPORT(name_1, name_2, xt), xt)
+    -- Externtype_ok: `|-%:OK`(xt)
+
+;; 3-typing.watsup:457.1-457.83
+relation Externuse_ok: `%|-%:%`(context, externuse, externtype)
+  ;; 3-typing.watsup:467.1-469.23
+  rule func {C : context, ft : functype, x : idx}:
+    `%|-%:%`(C, FUNC_externuse(x), FUNC_externtype(ft))
+    -- if (x < |C.FUNC_context|)
+    -- if (C.FUNC_context[x] = ft)
+
+  ;; 3-typing.watsup:471.1-473.25
+  rule global {C : context, gt : globaltype, x : idx}:
+    `%|-%:%`(C, GLOBAL_externuse(x), GLOBAL_externtype(gt))
+    -- if (x < |C.GLOBAL_context|)
+    -- if (C.GLOBAL_context[x] = gt)
+
+  ;; 3-typing.watsup:475.1-477.24
+  rule table {C : context, tt : tabletype, x : idx}:
+    `%|-%:%`(C, TABLE_externuse(x), TABLE_externtype(tt))
+    -- if (x < |C.TABLE_context|)
+    -- if (C.TABLE_context[x] = tt)
+
+  ;; 3-typing.watsup:479.1-481.22
+  rule mem {C : context, mt : memtype, x : idx}:
+    `%|-%:%`(C, MEMORY_externuse(x), MEMORY_externtype(mt))
+    -- if (x < |C.MEM_context|)
+    -- if (C.MEM_context[x] = mt)
+
+;; 3-typing.watsup:456.1-456.80
+relation Export_ok: `%|-%:%`(context, export, externtype)
+  ;; 3-typing.watsup:463.1-465.39
+  rule _ {C : context, externuse : externuse, name : name, xt : externtype}:
+    `%|-%:%`(C, EXPORT(name, externuse), xt)
+    -- Externuse_ok: `%|-%:%`(C, externuse, xt)
+
+;; 3-typing.watsup:484.1-484.62
+relation Module_ok: `|-%:OK`(module)
+  ;; 3-typing.watsup:486.1-501.22
+  rule _ {C : context, data^n : data^n, elem* : elem*, export* : export*, ft* : functype*, func* : func*, global* : global*, gt* : globaltype*, import* : import*, mem* : mem*, mt* : memtype*, n : n, rt* : reftype*, start* : start*, table* : table*, tt* : tabletype*}:
+    `|-%:OK`(`MODULE%*%*%*%*%*%*%*%*%*`(import*{import}, func*{func}, global*{global}, table*{table}, mem*{mem}, elem*{elem}, data^n{data}, start*{start}, export*{export}))
+    -- if (|ft*{ft}| = |func*{func}|)
+    -- if (|global*{global}| = |gt*{gt}|)
+    -- if (|table*{table}| = |tt*{tt}|)
+    -- if (|mem*{mem}| = |mt*{mt}|)
+    -- if (|elem*{elem}| = |rt*{rt}|)
+    -- if (|data^n{data}| = n)
+    -- if (C = {FUNC ft*{ft}, GLOBAL gt*{gt}, TABLE tt*{tt}, MEM mt*{mt}, ELEM rt*{rt}, DATA OK^n{}, LOCAL [], LABEL [], RETURN ?()})
+    -- (Func_ok: `%|-%:%`(C, func, ft))*{ft func}
+    -- (Global_ok: `%|-%:%`(C, global, gt))*{global gt}
+    -- (Table_ok: `%|-%:%`(C, table, tt))*{table tt}
+    -- (Mem_ok: `%|-%:%`(C, mem, mt))*{mem mt}
+    -- (Elem_ok: `%|-%:%`(C, elem, rt))*{elem rt}
+    -- (Data_ok: `%|-%:OK`(C, data))^n{data}
+    -- (Start_ok: `%|-%:OK`(C, start))*{start}
+    -- if (|mem*{mem}| <= 1)
+    -- if (|start*{start}| <= 1)
+
+;; 4-runtime.watsup:3.1-3.39
+syntax addr = nat
+
+;; 4-runtime.watsup:4.1-4.53
+syntax funcaddr = addr
+
+;; 4-runtime.watsup:5.1-5.53
+syntax globaladdr = addr
+
+;; 4-runtime.watsup:6.1-6.51
+syntax tableaddr = addr
+
+;; 4-runtime.watsup:7.1-7.50
+syntax memaddr = addr
+
+;; 4-runtime.watsup:8.1-8.49
+syntax elemaddr = addr
+
+;; 4-runtime.watsup:9.1-9.49
+syntax dataaddr = addr
+
+;; 4-runtime.watsup:10.1-10.51
+syntax labeladdr = addr
+
+;; 4-runtime.watsup:11.1-11.49
+syntax hostaddr = addr
+
+;; 4-runtime.watsup:24.1-25.24
+syntax num =
+  | CONST(numtype, c_numtype)
+
+;; 4-runtime.watsup:26.1-27.67
+syntax ref =
+  | REF.NULL(reftype)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+
+;; 4-runtime.watsup:28.1-29.10
+syntax val =
+  | CONST(numtype, c_numtype)
+  | REF.NULL(reftype)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+
+;;
+def val_num : num -> val
+  ;;
+  def {x : (numtype, c_numtype)} val_num(CONST_num(x)) = CONST_val(x)
+
+;;
+def val_ref : ref -> val
+  ;;
+  def {x : reftype} val_ref(REF.NULL_ref(x)) = REF.NULL_val(x)
+  ;;
+  def {x : funcaddr} val_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_val(x)
+  ;;
+  def {x : hostaddr} val_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_val(x)
+
+;; 4-runtime.watsup:31.1-32.18
+syntax result =
+  | _VALS(val*)
+  | TRAP
+
+;; 4-runtime.watsup:38.1-39.66
+syntax externval =
+  | FUNC(funcaddr)
+  | GLOBAL(globaladdr)
+  | TABLE(tableaddr)
+  | MEM(memaddr)
+
+;; 4-runtime.watsup:44.1-44.44
+def default_ : valtype -> val?
+  ;; 4-runtime.watsup:45.1-45.35
+  def default_(I32_valtype) = ?(CONST_val(I32_numtype, 0))
+  ;; 4-runtime.watsup:46.1-46.35
+  def default_(I64_valtype) = ?(CONST_val(I64_numtype, 0))
+  ;; 4-runtime.watsup:47.1-47.35
+  def default_(F32_valtype) = ?(CONST_val(F32_numtype, 0))
+  ;; 4-runtime.watsup:48.1-48.35
+  def default_(F64_valtype) = ?(CONST_val(F64_numtype, 0))
+  ;; 4-runtime.watsup:49.1-49.44
+  def default_(FUNCREF_valtype) = ?(REF.NULL_val(FUNCREF_reftype))
+  ;; 4-runtime.watsup:50.1-50.48
+  def default_(EXTERNREF_valtype) = ?(REF.NULL_val(EXTERNREF_reftype))
+  ;;
+  def {x : valtype} default_(x) = ?()
+
+;; 4-runtime.watsup:61.1-61.71
+syntax exportinst = EXPORT(name, externval)
+
+;; 4-runtime.watsup:71.1-78.25
+syntax moduleinst = {FUNC funcaddr*, GLOBAL globaladdr*, TABLE tableaddr*, MEM memaddr*, ELEM elemaddr*, DATA dataaddr*, EXPORT exportinst*}
+
+;; 4-runtime.watsup:55.1-55.66
+syntax funcinst = `%;%`(moduleinst, func)
+
+;; 4-runtime.watsup:56.1-56.53
+syntax globalinst = val
+
+;; 4-runtime.watsup:57.1-57.52
+syntax tableinst = ref*
+
+;; 4-runtime.watsup:58.1-58.52
+syntax meminst = byte*
+
+;; 4-runtime.watsup:59.1-59.53
+syntax eleminst = ref*
+
+;; 4-runtime.watsup:60.1-60.51
+syntax datainst = byte*
+
+;; 4-runtime.watsup:63.1-69.21
+syntax store = {FUNC funcinst*, GLOBAL globalinst*, TABLE tableinst*, MEM meminst*, ELEM eleminst*, DATA datainst*}
+
+;; 4-runtime.watsup:80.1-82.24
+syntax frame = {LOCAL val*, MODULE moduleinst}
+
+;; 4-runtime.watsup:83.1-83.47
+syntax state = `%;%`(store, frame)
+
+;; 4-runtime.watsup:140.1-147.5
+rec {
+
+;; 4-runtime.watsup:140.1-147.5
+syntax admininstr =
+  | UNREACHABLE
+  | NOP
+  | DROP
+  | SELECT(valtype?)
+  | BLOCK(blocktype, instr*)
+  | LOOP(blocktype, instr*)
+  | IF(blocktype, instr*, instr*)
+  | BR(labelidx)
+  | BR_IF(labelidx)
+  | BR_TABLE(labelidx*, labelidx)
+  | CALL(funcidx)
+  | CALL_INDIRECT(tableidx, functype)
+  | RETURN
+  | CONST(numtype, c_numtype)
+  | UNOP(numtype, unop_numtype)
+  | BINOP(numtype, binop_numtype)
+  | TESTOP(numtype, testop_numtype)
+  | RELOP(numtype, relop_numtype)
+  | EXTEND(numtype, n)
+  | CVTOP(numtype, cvtop, numtype, sx?)
+  | REF.NULL(reftype)
+  | REF.FUNC(funcidx)
+  | REF.IS_NULL
+  | LOCAL.GET(localidx)
+  | LOCAL.SET(localidx)
+  | LOCAL.TEE(localidx)
+  | GLOBAL.GET(globalidx)
+  | GLOBAL.SET(globalidx)
+  | TABLE.GET(tableidx)
+  | TABLE.SET(tableidx)
+  | TABLE.SIZE(tableidx)
+  | TABLE.GROW(tableidx)
+  | TABLE.FILL(tableidx)
+  | TABLE.COPY(tableidx, tableidx)
+  | TABLE.INIT(tableidx, elemidx)
+  | ELEM.DROP(elemidx)
+  | MEMORY.SIZE
+  | MEMORY.GROW
+  | MEMORY.FILL
+  | MEMORY.COPY
+  | MEMORY.INIT(dataidx)
+  | DATA.DROP(dataidx)
+  | LOAD(numtype, (n, sx)?, nat, nat)
+  | STORE(numtype, n?, nat, nat)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+  | CALL_ADDR(funcaddr)
+  | LABEL_(n, instr*, admininstr*)
+  | FRAME_(n, frame, admininstr*)
+  | TRAP
+}
+
+;;
+def admininstr_instr : instr -> admininstr
+  ;;
+  def admininstr_instr(UNREACHABLE_instr) = UNREACHABLE_admininstr
+  ;;
+  def admininstr_instr(NOP_instr) = NOP_admininstr
+  ;;
+  def admininstr_instr(DROP_instr) = DROP_admininstr
+  ;;
+  def {x : valtype?} admininstr_instr(SELECT_instr(x)) = SELECT_admininstr(x)
+  ;;
+  def {x : (blocktype, instr*)} admininstr_instr(BLOCK_instr(x)) = BLOCK_admininstr(x)
+  ;;
+  def {x : (blocktype, instr*)} admininstr_instr(LOOP_instr(x)) = LOOP_admininstr(x)
+  ;;
+  def {x : (blocktype, instr*, instr*)} admininstr_instr(IF_instr(x)) = IF_admininstr(x)
+  ;;
+  def {x : labelidx} admininstr_instr(BR_instr(x)) = BR_admininstr(x)
+  ;;
+  def {x : labelidx} admininstr_instr(BR_IF_instr(x)) = BR_IF_admininstr(x)
+  ;;
+  def {x : (labelidx*, labelidx)} admininstr_instr(BR_TABLE_instr(x)) = BR_TABLE_admininstr(x)
+  ;;
+  def {x : funcidx} admininstr_instr(CALL_instr(x)) = CALL_admininstr(x)
+  ;;
+  def {x : (tableidx, functype)} admininstr_instr(CALL_INDIRECT_instr(x)) = CALL_INDIRECT_admininstr(x)
+  ;;
+  def admininstr_instr(RETURN_instr) = RETURN_admininstr
+  ;;
+  def {x : (numtype, c_numtype)} admininstr_instr(CONST_instr(x)) = CONST_admininstr(x)
+  ;;
+  def {x : (numtype, unop_numtype)} admininstr_instr(UNOP_instr(x)) = UNOP_admininstr(x)
+  ;;
+  def {x : (numtype, binop_numtype)} admininstr_instr(BINOP_instr(x)) = BINOP_admininstr(x)
+  ;;
+  def {x : (numtype, testop_numtype)} admininstr_instr(TESTOP_instr(x)) = TESTOP_admininstr(x)
+  ;;
+  def {x : (numtype, relop_numtype)} admininstr_instr(RELOP_instr(x)) = RELOP_admininstr(x)
+  ;;
+  def {x : (numtype, n)} admininstr_instr(EXTEND_instr(x)) = EXTEND_admininstr(x)
+  ;;
+  def {x : (numtype, cvtop, numtype, sx?)} admininstr_instr(CVTOP_instr(x)) = CVTOP_admininstr(x)
+  ;;
+  def {x : reftype} admininstr_instr(REF.NULL_instr(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcidx} admininstr_instr(REF.FUNC_instr(x)) = REF.FUNC_admininstr(x)
+  ;;
+  def admininstr_instr(REF.IS_NULL_instr) = REF.IS_NULL_admininstr
+  ;;
+  def {x : localidx} admininstr_instr(LOCAL.GET_instr(x)) = LOCAL.GET_admininstr(x)
+  ;;
+  def {x : localidx} admininstr_instr(LOCAL.SET_instr(x)) = LOCAL.SET_admininstr(x)
+  ;;
+  def {x : localidx} admininstr_instr(LOCAL.TEE_instr(x)) = LOCAL.TEE_admininstr(x)
+  ;;
+  def {x : globalidx} admininstr_instr(GLOBAL.GET_instr(x)) = GLOBAL.GET_admininstr(x)
+  ;;
+  def {x : globalidx} admininstr_instr(GLOBAL.SET_instr(x)) = GLOBAL.SET_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.GET_instr(x)) = TABLE.GET_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.SET_instr(x)) = TABLE.SET_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.SIZE_instr(x)) = TABLE.SIZE_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.GROW_instr(x)) = TABLE.GROW_admininstr(x)
+  ;;
+  def {x : tableidx} admininstr_instr(TABLE.FILL_instr(x)) = TABLE.FILL_admininstr(x)
+  ;;
+  def {x : (tableidx, tableidx)} admininstr_instr(TABLE.COPY_instr(x)) = TABLE.COPY_admininstr(x)
+  ;;
+  def {x : (tableidx, elemidx)} admininstr_instr(TABLE.INIT_instr(x)) = TABLE.INIT_admininstr(x)
+  ;;
+  def {x : elemidx} admininstr_instr(ELEM.DROP_instr(x)) = ELEM.DROP_admininstr(x)
+  ;;
+  def admininstr_instr(MEMORY.SIZE_instr) = MEMORY.SIZE_admininstr
+  ;;
+  def admininstr_instr(MEMORY.GROW_instr) = MEMORY.GROW_admininstr
+  ;;
+  def admininstr_instr(MEMORY.FILL_instr) = MEMORY.FILL_admininstr
+  ;;
+  def admininstr_instr(MEMORY.COPY_instr) = MEMORY.COPY_admininstr
+  ;;
+  def {x : dataidx} admininstr_instr(MEMORY.INIT_instr(x)) = MEMORY.INIT_admininstr(x)
+  ;;
+  def {x : dataidx} admininstr_instr(DATA.DROP_instr(x)) = DATA.DROP_admininstr(x)
+  ;;
+  def {x : (numtype, (n, sx)?, nat, nat)} admininstr_instr(LOAD_instr(x)) = LOAD_admininstr(x)
+  ;;
+  def {x : (numtype, n?, nat, nat)} admininstr_instr(STORE_instr(x)) = STORE_admininstr(x)
+
+;;
+def admininstr_val : val -> admininstr
+  ;;
+  def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
+  ;;
+  def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
+  ;;
+  def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
+
+;;
+def admininstr_ref : ref -> admininstr
+  ;;
+  def {x : reftype} admininstr_ref(REF.NULL_ref(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcaddr} admininstr_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_admininstr(x)
+  ;;
+  def {x : hostaddr} admininstr_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_admininstr(x)
+
+;;
+def admininstr_globalinst : globalinst -> admininstr
+  ;;
+  def {x : globalinst} admininstr_globalinst(x) = $admininstr_val(x)
+
+;; 4-runtime.watsup:84.1-84.62
+syntax config = `%;%*`(state, admininstr*)
+
+;; 4-runtime.watsup:102.1-102.59
+def funcaddr : state -> funcaddr*
+  ;; 4-runtime.watsup:103.1-103.38
+  def {f : frame, s : store} funcaddr(`%;%`(s, f)) = f.MODULE_frame.FUNC_moduleinst
+
+;; 4-runtime.watsup:105.1-105.52
+def funcinst : state -> funcinst*
+  ;; 4-runtime.watsup:106.1-106.31
+  def {f : frame, s : store} funcinst(`%;%`(s, f)) = s.FUNC_store
+
+;; 4-runtime.watsup:108.1-108.67
+def func : (state, funcidx) -> funcinst
+  ;; 4-runtime.watsup:116.1-116.48
+  def {f : frame, s : store, x : idx} func(`%;%`(s, f), x) = s.FUNC_store[f.MODULE_frame.FUNC_moduleinst[x]]
+
+;; 4-runtime.watsup:109.1-109.69
+def global : (state, globalidx) -> globalinst
+  ;; 4-runtime.watsup:117.1-117.54
+  def {f : frame, s : store, x : idx} global(`%;%`(s, f), x) = s.GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]]
+
+;; 4-runtime.watsup:110.1-110.68
+def table : (state, tableidx) -> tableinst
+  ;; 4-runtime.watsup:118.1-118.51
+  def {f : frame, s : store, x : idx} table(`%;%`(s, f), x) = s.TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]]
+
+;; 4-runtime.watsup:111.1-111.66
+def mem : (state, memidx) -> meminst
+  ;; 4-runtime.watsup:119.1-119.45
+  def {f : frame, s : store, x : idx} mem(`%;%`(s, f), x) = s.MEM_store[f.MODULE_frame.MEM_moduleinst[x]]
+
+;; 4-runtime.watsup:112.1-112.67
+def elem : (state, tableidx) -> eleminst
+  ;; 4-runtime.watsup:120.1-120.48
+  def {f : frame, s : store, x : idx} elem(`%;%`(s, f), x) = s.ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]]
+
+;; 4-runtime.watsup:113.1-113.67
+def data : (state, dataidx) -> datainst
+  ;; 4-runtime.watsup:121.1-121.48
+  def {f : frame, s : store, x : idx} data(`%;%`(s, f), x) = s.DATA_store[f.MODULE_frame.DATA_moduleinst[x]]
+
+;; 4-runtime.watsup:114.1-114.68
+def local : (state, localidx) -> val
+  ;; 4-runtime.watsup:122.1-122.35
+  def {f : frame, s : store, x : idx} local(`%;%`(s, f), x) = f.LOCAL_frame[x]
+
+;; 4-runtime.watsup:125.1-125.78
+def with_local : (state, localidx, val) -> state
+  ;; 4-runtime.watsup:131.1-131.52
+  def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL[x] = v])
+
+;; 4-runtime.watsup:126.1-126.79
+def with_global : (state, globalidx, val) -> state
+  ;; 4-runtime.watsup:132.1-132.71
+  def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
+
+;; 4-runtime.watsup:127.1-127.81
+def with_table : (state, tableidx, n, ref) -> state
+  ;; 4-runtime.watsup:133.1-133.74
+  def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
+
+;; 4-runtime.watsup:128.1-128.80
+def with_tableext : (state, tableidx, ref*) -> state
+  ;; 4-runtime.watsup:134.1-134.75
+  def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
+
+;; 4-runtime.watsup:129.1-129.77
+def with_elem : (state, elemidx, ref*) -> state
+  ;; 4-runtime.watsup:135.1-135.69
+  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
+
+;; 4-runtime.watsup:149.1-152.21
+rec {
+
+;; 4-runtime.watsup:149.1-152.21
+syntax E =
+  | _HOLE
+  | _SEQ(val*, E, instr*)
+  | LABEL_(n, instr*, E)
+}
+
+;; 5-numerics.watsup:3.1-3.76
+def unop : (unop_numtype, numtype, c_numtype) -> c_numtype*
+
+;; 5-numerics.watsup:4.1-4.79
+def binop : (binop_numtype, numtype, c_numtype, c_numtype) -> c_numtype*
+
+;; 5-numerics.watsup:5.1-5.76
+def testop : (testop_numtype, numtype, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:6.1-6.79
+def relop : (relop_numtype, numtype, c_numtype, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:8.1-8.84
+def ext : (nat, nat, sx, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:9.1-9.84
+def cvtop : (numtype, cvtop, numtype, sx?, c_numtype) -> c_numtype*
+
+;; 6-reduction.watsup:4.1-4.63
+relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
+  ;; 6-reduction.watsup:16.1-17.24
+  rule unreachable:
+    `%*~>%*`([UNREACHABLE_admininstr], [TRAP_admininstr])
+
+  ;; 6-reduction.watsup:19.1-20.19
+  rule nop:
+    `%*~>%*`([NOP_admininstr], [])
+
+  ;; 6-reduction.watsup:22.1-23.24
+  rule drop {val : val}:
+    `%*~>%*`([(val <: admininstr) DROP_admininstr], [])
+
+  ;; 6-reduction.watsup:26.1-28.16
+  rule select-true {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
+    `%*~>%*`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [(val_1 <: admininstr)])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:30.1-32.14
+  rule select-false {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
+    `%*~>%*`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [(val_2 <: admininstr)])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:35.1-37.28
+  rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
+    `%*~>%*`((val <: admininstr)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    -- if (|t_1^k{t_1}| = k)
+    -- if (|t_2^n{t_2}| = n)
+    -- if (|val^k{val}| = k)
+    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
+
+  ;; 6-reduction.watsup:39.1-41.28
+  rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
+    `%*~>%*`((val <: admininstr)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [LOOP_instr(bt, instr*{instr})], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    -- if (|t_1^k{t_1}| = k)
+    -- if (|t_2^n{t_2}| = n)
+    -- if (|val^k{val}| = k)
+    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
+
+  ;; 6-reduction.watsup:43.1-45.16
+  rule if-true {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*{instr_1}, instr_2*{instr_2})], [BLOCK_admininstr(bt, instr_1*{instr_1})])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:47.1-49.14
+  rule if-false {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*{instr_1}, instr_2*{instr_2})], [BLOCK_admininstr(bt, instr_2*{instr_2})])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:52.1-53.38
+  rule label-vals {instr* : instr*, n : n, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr*{instr}, (val <: admininstr)*{val})], (val <: admininstr)*{val})
+
+  ;; 6-reduction.watsup:57.1-58.69
+  rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [BR_admininstr(0)] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val} :: (instr' <: admininstr)*{instr'})
+    -- if (|val^n{val}| = n)
+
+  ;; 6-reduction.watsup:60.1-61.65
+  rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val <: admininstr)*{val} :: [BR_admininstr(l + 1)] :: (instr <: admininstr)*{instr})], (val <: admininstr)*{val} :: [BR_admininstr(l)])
+
+  ;; 6-reduction.watsup:64.1-66.16
+  rule br_if-true {c : c_numtype, l : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)], [BR_admininstr(l)])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:68.1-70.14
+  rule br_if-false {c : c_numtype, l : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)], [])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:73.1-75.17
+  rule br_table-lt {i : nat, l* : labelidx*, l' : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')], [BR_admininstr(l*{l}[i])])
+    -- if (i < |l*{l}|)
+
+  ;; 6-reduction.watsup:77.1-79.18
+  rule br_table-ge {i : nat, l* : labelidx*, l' : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')], [BR_admininstr(l')])
+    -- if (i >= |l*{l}|)
+
+  ;; 6-reduction.watsup:100.1-101.35
+  rule frame-vals {f : frame, n : n, val^n : val^n}:
+    `%*~>%*`([FRAME__admininstr(n, f, (val <: admininstr)^n{val})], (val <: admininstr)^n{val})
+    -- if (|val^n{val}| = n)
+
+  ;; 6-reduction.watsup:103.1-104.55
+  rule return-frame {f : frame, instr* : instr*, n : n, val^n : val^n, val'* : val*}:
+    `%*~>%*`([FRAME__admininstr(n, f, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val})
+    -- if (|val^n{val}| = n)
+
+  ;; 6-reduction.watsup:106.1-107.60
+  rule return-label {instr* : instr*, instr'* : instr*, k : nat, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(k, instr'*{instr'}, (val <: admininstr)*{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)*{val} :: [RETURN_admininstr])
+
+  ;; 6-reduction.watsup:110.1-112.33
+  rule unop-val {c : c_numtype, c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)], [CONST_admininstr(nt, c)])
+    -- if ($unop(unop, nt, c_1) = [c])
+
+  ;; 6-reduction.watsup:114.1-116.39
+  rule unop-trap {c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)], [TRAP_admininstr])
+    -- if ($unop(unop, nt, c_1) = [])
+
+  ;; 6-reduction.watsup:119.1-121.40
+  rule binop-val {binop : binop_numtype, c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)], [CONST_admininstr(nt, c)])
+    -- if ($binop(binop, nt, c_1, c_2) = [c])
+
+  ;; 6-reduction.watsup:123.1-125.46
+  rule binop-trap {binop : binop_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)], [TRAP_admininstr])
+    -- if ($binop(binop, nt, c_1, c_2) = [])
+
+  ;; 6-reduction.watsup:128.1-130.37
+  rule testop {c : c_numtype, c_1 : c_numtype, nt : numtype, testop : testop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) TESTOP_admininstr(nt, testop)], [CONST_admininstr(I32_numtype, c)])
+    -- if (c = $testop(testop, nt, c_1))
+
+  ;; 6-reduction.watsup:132.1-134.40
+  rule relop {c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype, relop : relop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) RELOP_admininstr(nt, relop)], [CONST_admininstr(I32_numtype, c)])
+    -- if (c = $relop(relop, nt, c_1, c_2))
+
+  ;; 6-reduction.watsup:137.1-138.70
+  rule extend {c : c_numtype, n : n, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, !($size(nt <: valtype)), S_sx, c))])
+    -- if ($size(nt <: valtype) =/= ?())
+
+  ;; 6-reduction.watsup:141.1-143.48
+  rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CVTOP_admininstr(nt_1, cvtop, nt_2, sx?{sx})], [CONST_admininstr(nt, c)])
+    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [c])
+
+  ;; 6-reduction.watsup:145.1-147.54
+  rule cvtop-trap {c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CVTOP_admininstr(nt_1, cvtop, nt_2, sx?{sx})], [TRAP_admininstr])
+    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [])
+
+  ;; 6-reduction.watsup:154.1-156.28
+  rule ref.is_null-true {rt : reftype, val : val}:
+    `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
+    -- if (val = REF.NULL_val(rt))
+
+  ;; 6-reduction.watsup:158.1-160.15
+  rule ref.is_null-false {val : val}:
+    `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:169.1-170.47
+  rule local.tee {val : val, x : idx}:
+    `%*~>%*`([(val <: admininstr) LOCAL.TEE_admininstr(x)], [(val <: admininstr) (val <: admininstr) LOCAL.SET_admininstr(x)])
+
+;; 6-reduction.watsup:5.1-5.63
+relation Step_read: `%~>%*`(config, admininstr*)
+  ;; 6-reduction.watsup:82.1-83.47
+  rule call {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CALL_admininstr(x)]), [CALL_ADDR_admininstr($funcaddr(z)[x])])
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:85.1-88.34
+  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [CALL_ADDR_admininstr(a)])
+    -- if (i < |$table(z, x)|)
+    -- if (a < |$funcinst(z)|)
+    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
+    -- if ($funcinst(z)[a] = `%;%`(m, func))
+
+  ;; 6-reduction.watsup:90.1-92.15
+  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [TRAP_admininstr])
+    -- otherwise
+
+  ;; 6-reduction.watsup:94.1-97.52
+  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
+    `%~>%*`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], (instr <: admininstr)*{instr})])])
+    -- if (a < |$funcinst(z)|)
+    -- if (|t_1^k{t_1}| = k)
+    -- if (|t_2^n{t_2}| = n)
+    -- if (|val^k{val}| = k)
+    -- (if ($default_(t) =/= ?()))*{t}
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
+    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
+
+  ;; 6-reduction.watsup:150.1-151.53
+  rule ref.func {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [REF.FUNC_admininstr(x)]), [REF.FUNC_ADDR_admininstr($funcaddr(z)[x])])
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:163.1-164.37
+  rule local.get {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [LOCAL.GET_admininstr(x)]), [($local(z, x) <: admininstr)])
+
+  ;; 6-reduction.watsup:173.1-174.39
+  rule global.get {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]), [($global(z, x) <: admininstr)])
+
+  ;; 6-reduction.watsup:180.1-182.28
+  rule table.get-trap {i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:184.1-186.27
+  rule table.get-val {i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [($table(z, x)[i] <: admininstr)])
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:188.1-190.28
+  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:197.1-199.27
+  rule table.size {n : n, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]), [CONST_admininstr(I32_numtype, n)])
+    -- if (|$table(z, x)| = n)
+
+  ;; 6-reduction.watsup:205.1-206.57
+  rule table.grow-fail {n : n, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), [CONST_admininstr(I32_numtype, - 1)])
+
+  ;; 6-reduction.watsup:209.1-211.34
+  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
+    -- if ((i + n) > |$table(z, x)|)
+
+  ;; 6-reduction.watsup:213.1-216.14
+  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:218.1-222.15
+  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) (val <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) (val <: admininstr) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:225.1-227.63
+  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [TRAP_admininstr])
+    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:229.1-232.14
+  rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:234.1-239.15
+  rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
+    -- otherwise
+    -- if (j <= i)
+
+  ;; 6-reduction.watsup:241.1-245.15
+  rule table.copy-gt {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, ((j + n) - 1)) CONST_admininstr(I32_numtype, ((i + n) - 1)) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:248.1-250.62
+  rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [TRAP_admininstr])
+    -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:252.1-255.14
+  rule table.init-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:257.1-261.15
+  rule table.init-succ {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) ($elem(z, y)[i] <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
+    -- if (i < |$elem(z, y)|)
+    -- otherwise
+
+;; 6-reduction.watsup:3.1-3.63
+relation Step: `%~>%`(config, config)
+  ;; 6-reduction.watsup:7.1-9.34
+  rule pure {instr* : instr*, instr'* : instr*, z : state}:
+    `%~>%`(`%;%*`(z, (instr <: admininstr)*{instr}), `%;%*`(z, (instr' <: admininstr)*{instr'}))
+    -- Step_pure: `%*~>%*`((instr <: admininstr)*{instr}, (instr' <: admininstr)*{instr'})
+
+  ;; 6-reduction.watsup:11.1-13.37
+  rule read {instr* : instr*, instr'* : instr*, z : state}:
+    `%~>%`(`%;%*`(z, (instr <: admininstr)*{instr}), `%;%*`(z, (instr' <: admininstr)*{instr'}))
+    -- Step_read: `%~>%*`(`%;%*`(z, (instr <: admininstr)*{instr}), (instr' <: admininstr)*{instr'})
+
+  ;; 6-reduction.watsup:166.1-167.60
+  rule local.set {val : val, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [(val <: admininstr) LOCAL.SET_admininstr(x)]), `%;%*`($with_local(z, x, val), []))
+
+  ;; 6-reduction.watsup:176.1-177.62
+  rule global.set {val : val, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [(val <: admininstr) GLOBAL.SET_admininstr(x)]), `%;%*`($with_global(z, x, val), []))
+
+  ;; 6-reduction.watsup:192.1-194.27
+  rule table.set-val {i : nat, ref : ref, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), `%;%*`($with_table(z, x, i, ref), []))
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:202.1-203.102
+  rule table.grow-succeed {n : n, ref : ref, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [(ref <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), `%;%*`($with_tableext(z, x, ref^n{}), [CONST_admininstr(I32_numtype, |$table(z, x)|)]))
+
+  ;; 6-reduction.watsup:264.1-265.59
+  rule elem.drop {x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [ELEM.DROP_admininstr(x)]), `%;%*`($with_elem(z, x, []), []))
+
 == IL Validation...
 == Latex Generation...
 $$

From e6095b7703b944a50aeff2b03b671b6c0601ccbe Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sun, 9 Apr 2023 18:37:31 +0200
Subject: [PATCH 64/98] Else elimination pass

---
 spectec/src/backend-lean4/gen.ml       |   7 +-
 spectec/src/exe-watsup/main.ml         |  13 +-
 spectec/src/frontend/multiplicity.ml   |   1 +
 spectec/src/il/ast.ml                  |   1 +
 spectec/src/il/free.ml                 |   1 +
 spectec/src/il/print.ml                |   3 +-
 spectec/src/il/validation.ml           |   2 +
 spectec/src/middlend/dune              |   2 +-
 spectec/src/middlend/else.ml           |  74 ++
 spectec/src/middlend/else.mli          |   1 +
 spectec/src/middlend/sideconditions.ml |   7 +-
 spectec/src/middlend/totalize.ml       |   1 +
 spectec/test-lean4/TEST.md             | 585 +++++++++++++++-
 spectec/test-middlend/TEST.md          | 925 +++++++++++++++++++++++--
 14 files changed, 1539 insertions(+), 84 deletions(-)
 create mode 100644 spectec/src/middlend/else.ml
 create mode 100644 spectec/src/middlend/else.mli

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 9ae0ab0d2b..5fd935714a 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -9,7 +9,6 @@ let ($$) s1 s2 = parens (s1 ^ " " ^ s2)
 let render_tuple how tys = parens (String.concat ", " (List.map how tys))
 let render_list how tys = brackets (String.concat ", " (List.map how tys))
 
-let render_type_name (id : id) = String.capitalize_ascii id.it
 
 (* let render_rec_con (id : id) = "Mk" ^ render_type_name id *)
 
@@ -31,10 +30,13 @@ let make_id s = match s with
     | c -> c
     ) s
 
+
 let render_id (id : id) = make_id id.it
 
 let render_fun_id (id : id) = "«$" ^ id.it ^ "»"
 
+let render_type_name (id : id) = String.capitalize_ascii (make_id id.it)
+
 let render_rule_name _qual _ty_id (rule_id : id) (i : int) :  string =
   if rule_id.it = ""
   then "rule_" ^ string_of_int i
@@ -184,7 +186,8 @@ let rec render_prem (prem : premise) =
         "(Forall₂ (λ " ^ render_id v1 ^ " " ^ render_id v2 ^ " ↦ " ^ render_prem prem ^ ") " ^ render_id v1 ^ ".toList " ^ render_id v2 ^ ".toList)"
       | _,_ -> render_prem prem ^ " /- " ^ Il.Print.string_of_iterexp iterexp ^ " -/"
     end
-    | ElsePr -> "True /- Else? -/"
+    | ElsePr -> "False /- Else? -/"
+    | NegPr prem -> "Not" $$ render_prem prem
 
 let rec render_def (d : def) =
   match d.it with
diff --git a/spectec/src/exe-watsup/main.ml b/spectec/src/exe-watsup/main.ml
index 0f283bcadb..3ba26047ea 100644
--- a/spectec/src/exe-watsup/main.ml
+++ b/spectec/src/exe-watsup/main.ml
@@ -33,6 +33,7 @@ let print_all_il = ref false
 let pass_flat = ref false
 let pass_totalize = ref false
 let pass_sideconditions = ref false
+let pass_else_elim = ref false
 
 (* Argument parsing *)
 
@@ -60,6 +61,7 @@ let argspec = Arg.align
   "--flat", Arg.Set pass_flat, "Run variant flattening";
   "--totalize", Arg.Set pass_totalize, "Run function totalization";
   "--sideconditions", Arg.Set pass_sideconditions, "Infer side conditoins";
+  "--else-elimination", Arg.Set pass_else_elim, "Eliminate otherwise/else";
 
   "--check-only", Arg.Unit (fun () -> target := None), " No output (just checking)";
   "--latex", Arg.Unit (fun () -> target := Latex Backend_latex.Config.latex), " Use Latex settings (default)";
@@ -106,7 +108,7 @@ let () =
       il
     end else il in
 
-    let il = if !pass_sideconditions || !target = Haskell || !target = Lean4 then begin
+    let il = if !pass_sideconditions || !target = Lean4 then begin
       log "Side condition inference";
       let il = Middlend.Sideconditions.transform il in
       if !print_all_il then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
@@ -115,6 +117,15 @@ let () =
       il
     end else il in
 
+    let il = if !pass_else_elim || !target = Lean4 then begin
+      log "Else elimination";
+      let il = Middlend.Else.transform il in
+      if !print_all_il then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
+      log "IL Validation...";
+      Il.Validation.valid il;
+      il
+    end else il in
+
     if !print_final_il && not !print_all_il then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
 
     begin match !target with
diff --git a/spectec/src/frontend/multiplicity.ml b/spectec/src/frontend/multiplicity.ml
index e9e716b0ef..a8b209856e 100644
--- a/spectec/src/frontend/multiplicity.ml
+++ b/spectec/src/frontend/multiplicity.ml
@@ -288,6 +288,7 @@ and annot_prem env prem : Il.Ast.premise * occur =
     let prem1', occur1 = annot_prem env prem1 in
     let iter', occur' = annot_iterexp env occur1 iter prem.at in
     IterPr (prem1', iter') $ prem.at, occur'
+  | NegPr prem' -> annot_prem env prem'
 
 
 let annot_exp env e =
diff --git a/spectec/src/il/ast.ml b/spectec/src/il/ast.ml
index 2730a0cd9f..4978cd6869 100644
--- a/spectec/src/il/ast.ml
+++ b/spectec/src/il/ast.ml
@@ -153,6 +153,7 @@ and premise' =
   | IfPr of exp                                       (* side condition *)
   | ElsePr                                            (* otherwise *)
   | IterPr of premise * iterexp                       (* iteration *)
+  | NegPr of premise                                  (* negation of a premise *)
 
 and hint = {hintid : id; hintexp : string list}       (* hint *)
 
diff --git a/spectec/src/il/free.ml b/spectec/src/il/free.ml
index 7d2128735e..bb3e6436a8 100644
--- a/spectec/src/il/free.ml
+++ b/spectec/src/il/free.ml
@@ -118,6 +118,7 @@ let rec free_prem prem =
   | IfPr e -> free_exp e
   | ElsePr -> empty
   | IterPr (prem', iter) -> union (free_prem prem') (free_iterexp iter)
+  | NegPr prem' -> free_prem prem'
 
 let free_rule rule =
   match rule.it with
diff --git a/spectec/src/il/print.ml b/spectec/src/il/print.ml
index a76d8ca95e..6f8947797e 100644
--- a/spectec/src/il/print.ml
+++ b/spectec/src/il/print.ml
@@ -199,6 +199,7 @@ let rec string_of_prem prem =
     string_of_prem prem' ^ string_of_iterexp iter
   | IterPr (prem', iter) ->
     "(" ^ string_of_prem prem' ^ ")" ^ string_of_iterexp iter
+  | NegPr prem' -> "unless " ^ string_of_prem prem'
 
 
 let string_of_rule rule =
@@ -241,4 +242,4 @@ let rec string_of_def d =
 (* Scripts *)
 
 let string_of_script ds =
-  concat "" (List.map (suffix string_of_def "\n") ds)
+  (concat "" (List.map (suffix string_of_def "\n") ds))
diff --git a/spectec/src/il/validation.ml b/spectec/src/il/validation.ml
index fcdd4c52c6..2e9b1398ad 100644
--- a/spectec/src/il/validation.ml
+++ b/spectec/src/il/validation.ml
@@ -494,6 +494,8 @@ let rec valid_prem env prem =
   | IterPr (prem', iter) ->
     let env' = valid_iterexp env iter in
     valid_prem env' prem'
+  | NegPr prem' ->
+    valid_prem env prem'
 
 
 let valid_rule env mixop t rule =
diff --git a/spectec/src/middlend/dune b/spectec/src/middlend/dune
index 550f1fe5c7..6c0273d17c 100644
--- a/spectec/src/middlend/dune
+++ b/spectec/src/middlend/dune
@@ -1,5 +1,5 @@
 (library
   (name middlend)
   (libraries util il)
-  (modules flat totalize sideconditions)
+  (modules flat totalize sideconditions else)
 )
diff --git a/spectec/src/middlend/else.ml b/spectec/src/middlend/else.ml
new file mode 100644
index 0000000000..0d0020c879
--- /dev/null
+++ b/spectec/src/middlend/else.ml
@@ -0,0 +1,74 @@
+(*
+This transformation removes uses of the `otherwise` (`ElsePr`) premise from
+inductive relations.
+
+It only supports binary relations.
+
+1. It figures out which rules are meant by “otherwise”:
+
+   * All previous rules
+   * Excluding those that definitely can’t apply when the present rule applies
+     (decided by a simple and conservative comparision of the LHS).
+
+2. It creates an auxillary inductive unary predicate with these rules (LHS only).
+
+3. It replaces the `ElsePr` with the negation of that rule.
+
+*)
+
+open Util
+open Source
+open Il.Ast
+
+(* Errors *)
+
+let error at msg = Source.error at "else removal" msg
+
+let unary_mixfix : mixop = [[Atom ""]; [Atom ""]]
+
+let is_else prem = prem.it = ElsePr
+
+let replace_else aux_name lhs prem = match prem.it with
+  | ElsePr -> NegPr (RulePr (aux_name, unary_mixfix, lhs) $ prem.at) $ prem.at
+  | _ -> prem
+
+let unarize rule = match rule.it with 
+    | RuleD (rid, binds, _mixop, exp, prems) ->
+      let lhs = match exp.it with
+        | TupE [lhs; _] -> lhs
+        | _ -> error exp.at "expected manifest pair"
+      in
+      { rule with it = RuleD (rid, binds, unary_mixfix, lhs, prems) }
+  
+
+let rec go at id mixop typ typ1 hints prev_rules : rule list -> def list = function
+  | [] -> [ RelD (id, mixop, typ, List.rev prev_rules, hints) $ at ]
+  | r :: rules -> match r.it with
+    | RuleD (rid, binds, rmixop, exp, prems) ->
+      if List.exists is_else prems
+      then
+        let lhs = match exp.it with
+          | TupE [lhs; _] -> lhs
+          | _ -> error exp.at "expected manifest pair"
+        in
+        let aux_name = id.it ^ "_before_" ^ rid.it $ rid.at in
+        let applicable_prev_rules = List.map unarize prev_rules in
+        [ RelD (aux_name, unary_mixfix, typ1, List.rev applicable_prev_rules, hints) $ r.at ] @
+        let prems' = List.map (replace_else aux_name lhs) prems in
+        let rule' = { r with it = RuleD (rid, binds, rmixop, exp, prems') } in
+        go at id mixop typ typ1 hints (rule' :: prev_rules) rules
+      else
+        go at id mixop typ typ1 hints (r :: prev_rules) rules
+
+let rec t_def (def : def) : def list = match def.it with
+  | RecD defs -> [ { def with it = RecD (List.concat_map t_def defs) } ]
+  | RelD (id, mixop, typ, rules, hints) -> begin match typ.it with
+    | TupT [typ1; _typ2] ->
+      go def.at id mixop typ typ1 hints [] rules
+    | _ -> [def]
+    end
+  | _ -> [ def ]
+
+let transform (defs : script) =
+  List.concat_map t_def defs
+
diff --git a/spectec/src/middlend/else.mli b/spectec/src/middlend/else.mli
new file mode 100644
index 0000000000..542bbf8052
--- /dev/null
+++ b/spectec/src/middlend/else.mli
@@ -0,0 +1 @@
+val transform : Il.Ast.script -> Il.Ast.script
diff --git a/spectec/src/middlend/sideconditions.ml b/spectec/src/middlend/sideconditions.ml
index 8a168cc6f0..0344f67830 100644
--- a/spectec/src/middlend/sideconditions.ml
+++ b/spectec/src/middlend/sideconditions.ml
@@ -16,7 +16,7 @@ open Il.Ast
 
 (* Errors *)
 
-let _error at msg = Source.error at "sideconditions" msg
+let error at msg = Source.error at "sideconditions" msg
 
 let is_null e = CmpE (EqOp, e, OptE None $ no_region) $ no_region
 let iffE e1 e2 = IfPr (BinE (EquivOp, e1, e2) $ no_region) $ no_region
@@ -93,6 +93,11 @@ let rec t_prem prem = match prem.it with
   | IterPr (prem, iterexp)
   -> iter_side_conditions iterexp @
      List.map (fun pr -> IterPr (pr, iterexp) $ no_region) (t_prem prem) @ t_iterexp iterexp
+  | NegPr prem'
+  -> match t_prem prem' with
+    | [] -> []
+    | _ -> error prem.at "side condition in negated premise"
+
 
 let t_prems = List.concat_map t_prem
 
diff --git a/spectec/src/middlend/totalize.ml b/spectec/src/middlend/totalize.ml
index f291c0173f..31b1940815 100644
--- a/spectec/src/middlend/totalize.ml
+++ b/spectec/src/middlend/totalize.ml
@@ -95,6 +95,7 @@ let rec t_prem' env = function
   | IfPr e -> IfPr (t_exp env e)
   | ElsePr -> ElsePr
   | IterPr (prem, iterexp) -> IterPr (t_prem env prem, t_iterexp env iterexp)
+  | NegPr prem -> NegPr (t_prem env prem)
 
 and t_prem env x = { x with it = t_prem' env x.it }
 
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 8854d4ce01..ecf13ae3d2 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -91,18 +91,18 @@ def «$valtype_reftype» : Reftype -> Valtype
   | Reftype.FUNCREF => Valtype.FUNCREF
   | Reftype.EXTERNREF => Valtype.EXTERNREF
 
-inductive In where
- | I32 : In
- | I64 : In
+inductive «in» where
+ | I32 : «in»
+ | I64 : «in»
   deriving Inhabited, BEq
 
-def «$numtype_in» : In -> Numtype
-  | In.I32 => Numtype.I32
-  | In.I64 => Numtype.I64
+def «$numtype_in» : «in» -> Numtype
+  | «in».I32 => Numtype.I32
+  | «in».I64 => Numtype.I64
 
-def «$valtype_in» : In -> Valtype
-  | In.I32 => Valtype.I32
-  | In.I64 => Valtype.I64
+def «$valtype_in» : «in» -> Valtype
+  | «in».I32 => Valtype.I32
+  | «in».I64 => Valtype.I64
 
 inductive Fn where
  | F32 : Fn
@@ -304,7 +304,7 @@ inductive Datamode where
 
 @[reducible] def Func := /- mixop: `FUNC%%*%` -/ (Functype × (List Valtype) × Expr)
 
-@[reducible] def Global := /- mixop: GLOBAL -/ (Globaltype × Expr)
+@[reducible] def «global» := /- mixop: GLOBAL -/ (Globaltype × Expr)
 
 @[reducible] def Table := /- mixop: TABLE -/ Tabletype
 
@@ -323,11 +323,11 @@ inductive Externuse where
  | MEMORY : Memidx -> Externuse
   deriving Inhabited, BEq
 
-@[reducible] def Export := /- mixop: EXPORT -/ (Name × Externuse)
+@[reducible] def «export» := /- mixop: EXPORT -/ (Name × Externuse)
 
-@[reducible] def Import := /- mixop: IMPORT -/ (Name × Name × Externtype)
+@[reducible] def «import» := /- mixop: IMPORT -/ (Name × Name × Externtype)
 
-@[reducible] def Module := /- mixop: `MODULE%*%*%*%*%*%*%*%*%*` -/ ((List Import) × (List Func) × (List Global) × (List Table) × (List Mem) × (List Elem) × (List Data) × (List Start) × (List Export))
+@[reducible] def Module := /- mixop: `MODULE%*%*%*%*%*%*%*%*%*` -/ ((List «import») × (List Func) × (List «global») × (List Table) × (List Mem) × (List Elem) × (List Data) × (List Start) × (List «export»))
 
 def «$size» : Valtype -> (Option Nat)
   | Valtype.I32 => (some 32)
@@ -544,7 +544,7 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (nt_1 != nt_2) ->
     ((«$size» («$valtype_numtype» nt_1)).get! == («$size» («$valtype_numtype» nt_2)).get!) ->
     (Instr_ok (C, (Instr.CVTOP (nt_1, Cvtop.REINTERPRET, nt_2, none)), ([(«$valtype_numtype» nt_2)], [(«$valtype_numtype» nt_1)])))
-  | convert_i (C : Context) (in_1 : In) (in_2 : In) (sx : (Option Sx)) :
+  | convert_i (C : Context) (in_1 : «in») (in_2 : «in») (sx : (Option Sx)) :
     ((«$size» («$valtype_in» in_1)) != none) ->
     ((«$size» («$valtype_in» in_2)) != none) ->
     (in_1 != in_2) ->
@@ -643,7 +643,7 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (x < C.DATA.length) ->
     ((C.DATA.get! x) == ()) ->
     (Instr_ok (C, (Instr.DATA_DROP x), ([], [])))
-  | load (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (sx : (Option Sx)) :
+  | load (C : Context) («in» : «in») (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (sx : (Option Sx)) :
     (0 < C.MEM.length) ->
     ((«$size» («$valtype_numtype» nt)) != none) ->
     (Forall (λ n ↦ ((«$size» («$valtype_numtype» nt)) != none)) n.toList) ->
@@ -653,7 +653,7 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))))) n.toList) ->
     ((n == none) || (nt == («$numtype_in» «in»))) ->
     (Instr_ok (C, (Instr.LOAD (nt, (Option.zipWith (λ n sx ↦ (n, sx)) n sx), n_A, n_O)), ([Valtype.I32], [(«$valtype_numtype» nt)])))
-  | store (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) :
+  | store (C : Context) («in» : «in») (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) :
     (0 < C.MEM.length) ->
     ((«$size» («$valtype_numtype» nt)) != none) ->
     (Forall (λ n ↦ ((«$size» («$valtype_numtype» nt)) != none)) n.toList) ->
@@ -714,7 +714,7 @@ inductive Func_ok : (Context × Func × Functype) -> Prop where
     (Expr_ok ((((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := (t_1 ++ t), LABEL := [], RETURN := none}) ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2], RETURN := none}) ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [], RETURN := (some t_2)}), expr, t_2)) ->
     (Func_ok (C, (ft, t, expr), ft))
 
-inductive Global_ok : (Context × Global × Globaltype) -> Prop where
+inductive Global_ok : (Context × «global» × Globaltype) -> Prop where
   | rule_0 (C : Context) (expr : Expr) (gt : Globaltype) (t : Valtype) :
     (Globaltype_ok gt) ->
     (gt == ((some ()), t)) ->
@@ -764,7 +764,7 @@ inductive Start_ok : (Context × Start) -> Prop where
     ((C.FUNC.get! x) == ([], [])) ->
     (Start_ok (C, x))
 
-inductive Import_ok : (Context × Import × Externtype) -> Prop where
+inductive Import_ok : (Context × «import» × Externtype) -> Prop where
   | rule_0 (C : Context) (name_1 : Name) (name_2 : Name) (xt : Externtype) :
     (Externtype_ok xt) ->
     (Import_ok (C, (name_1, name_2, xt), xt))
@@ -787,13 +787,13 @@ inductive Externuse_ok : (Context × Externuse × Externtype) -> Prop where
     ((C.MEM.get! x) == mt) ->
     (Externuse_ok (C, (Externuse.MEMORY x), (Externtype.MEMORY mt)))
 
-inductive Export_ok : (Context × Export × Externtype) -> Prop where
+inductive Export_ok : (Context × «export» × Externtype) -> Prop where
   | rule_0 (C : Context) (externuse : Externuse) (name : Name) (xt : Externtype) :
     (Externuse_ok (C, externuse, xt)) ->
     (Export_ok (C, (name, externuse), xt))
 
 inductive Module_ok : Module -> Prop where
-  | rule_0 (C : Context) (data : (List Data)) (elem : (List Elem)) («export» : (List Export)) (ft : (List Functype)) (func : (List Func)) («global» : (List Global)) (gt : (List Globaltype)) («import» : (List Import)) (mem : (List Mem)) (mt : (List Memtype)) (n : N) (rt : (List Reftype)) (start : (List Start)) (table : (List Table)) (tt : (List Tabletype)) :
+  | rule_0 (C : Context) (data : (List Data)) (elem : (List Elem)) («export» : (List «export»)) (ft : (List Functype)) (func : (List Func)) («global» : (List «global»)) (gt : (List Globaltype)) («import» : (List «import»)) (mem : (List Mem)) (mt : (List Memtype)) (n : N) (rt : (List Reftype)) (start : (List Start)) (table : (List Table)) (tt : (List Tabletype)) :
     (ft.length == func.length) ->
     («global».length == gt.length) ->
     (table.length == tt.length) ->
@@ -1115,6 +1115,95 @@ def «$ext» : (Nat × Nat × Sx × C_numtype) -> C_numtype := default
 
 def «$cvtop» : (Numtype × Cvtop × Numtype × (Option Sx) × C_numtype) -> (List C_numtype) := default
 
+inductive Step_pure_before_ref_is_null_false : (List Admininstr) -> Prop where
+  | unreachable  :
+    (Step_pure_before_ref_is_null_false [Admininstr.UNREACHABLE])
+  | nop  :
+    (Step_pure_before_ref_is_null_false [Admininstr.NOP])
+  | drop (val : Val) :
+    (Step_pure_before_ref_is_null_false [(«$admininstr_val» val), Admininstr.DROP])
+  | select_true (c : C_numtype) (t : (Option Valtype)) (val_1 : Val) (val_2 : Val) :
+    (c != 0) ->
+    (Step_pure_before_ref_is_null_false [(«$admininstr_val» val_1), («$admininstr_val» val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)])
+  | select_false (c : C_numtype) (t : (Option Valtype)) (val_1 : Val) (val_2 : Val) :
+    (c == 0) ->
+    (Step_pure_before_ref_is_null_false [(«$admininstr_val» val_1), («$admininstr_val» val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)])
+  | block (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
+    (t_1.length == k) ->
+    (t_2.length == n) ->
+    (val.length == k) ->
+    (bt == (t_1, t_2)) ->
+    (Step_pure_before_ref_is_null_false ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.BLOCK (bt, instr))]))
+  | loop (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
+    (t_1.length == k) ->
+    (t_2.length == n) ->
+    (val.length == k) ->
+    (bt == (t_1, t_2)) ->
+    (Step_pure_before_ref_is_null_false ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.LOOP (bt, instr))]))
+  | if_true (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) :
+    (c != 0) ->
+    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (Numtype.I32, c)), (Admininstr.IF (bt, instr_1, instr_2))])
+  | if_false (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) :
+    (c == 0) ->
+    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (Numtype.I32, c)), (Admininstr.IF (bt, instr_1, instr_2))])
+  | label_vals (instr : (List Instr)) (n : N) (val : (List Val)) :
+    (Step_pure_before_ref_is_null_false [(Admininstr.LABEL_ (n, instr, (List.map (λ val ↦ («$admininstr_val» val)) val)))])
+  | br_zero (instr : (List Instr)) (instr' : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) :
+    (val.length == n) ->
+    (Step_pure_before_ref_is_null_false [(Admininstr.LABEL_ (n, instr', ((List.map (λ val' ↦ («$admininstr_val» val')) val') ++ ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([(Admininstr.BR 0)] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr))))))])
+  | br_succ (instr : (List Instr)) (instr' : (List Instr)) (l : Labelidx) (n : N) (val : (List Val)) :
+    (Step_pure_before_ref_is_null_false [(Admininstr.LABEL_ (n, instr', ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([(Admininstr.BR (l + 1))] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)))))])
+  | br_if_true (c : C_numtype) (l : Labelidx) :
+    (c != 0) ->
+    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (Numtype.I32, c)), (Admininstr.BR_IF l)])
+  | br_if_false (c : C_numtype) (l : Labelidx) :
+    (c == 0) ->
+    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (Numtype.I32, c)), (Admininstr.BR_IF l)])
+  | br_table_lt (i : Nat) (l : (List Labelidx)) (l' : Labelidx) :
+    (i < l.length) ->
+    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.BR_TABLE (l, l'))])
+  | br_table_ge (i : Nat) (l : (List Labelidx)) (l' : Labelidx) :
+    (i >= l.length) ->
+    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.BR_TABLE (l, l'))])
+  | frame_vals (f : Frame) (n : N) (val : (List Val)) :
+    (val.length == n) ->
+    (Step_pure_before_ref_is_null_false [(Admininstr.FRAME_ (n, f, (List.map (λ val ↦ («$admininstr_val» val)) val)))])
+  | return_frame (f : Frame) (instr : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) :
+    (val.length == n) ->
+    (Step_pure_before_ref_is_null_false [(Admininstr.FRAME_ (n, f, ((List.map (λ val' ↦ («$admininstr_val» val')) val') ++ ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([Admininstr.RETURN] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr))))))])
+  | return_label (instr : (List Instr)) (instr' : (List Instr)) (k : Nat) (val : (List Val)) :
+    (Step_pure_before_ref_is_null_false [(Admininstr.LABEL_ (k, instr', ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([Admininstr.RETURN] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)))))])
+  | unop_val (c : C_numtype) (c_1 : C_numtype) (nt : Numtype) (unop : Unop_numtype) :
+    ((«$unop» (unop, nt, c_1)) == [c]) ->
+    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (nt, c_1)), (Admininstr.UNOP (nt, unop))])
+  | unop_trap (c_1 : C_numtype) (nt : Numtype) (unop : Unop_numtype) :
+    ((«$unop» (unop, nt, c_1)) == []) ->
+    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (nt, c_1)), (Admininstr.UNOP (nt, unop))])
+  | binop_val (binop : Binop_numtype) (c : C_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) :
+    ((«$binop» (binop, nt, c_1, c_2)) == [c]) ->
+    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.BINOP (nt, binop))])
+  | binop_trap (binop : Binop_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) :
+    ((«$binop» (binop, nt, c_1, c_2)) == []) ->
+    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.BINOP (nt, binop))])
+  | testop (c : C_numtype) (c_1 : C_numtype) (nt : Numtype) (testop : Testop_numtype) :
+    (c == («$testop» (testop, nt, c_1))) ->
+    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (nt, c_1)), (Admininstr.TESTOP (nt, testop))])
+  | relop (c : C_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) (relop : Relop_numtype) :
+    (c == («$relop» (relop, nt, c_1, c_2))) ->
+    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.RELOP (nt, relop))])
+  | extend (c : C_numtype) (n : N) (nt : Numtype) :
+    ((«$size» («$valtype_numtype» nt)) != none) ->
+    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (nt, c)), (Admininstr.EXTEND (nt, n))])
+  | cvtop_val (c : C_numtype) (c_1 : C_numtype) (cvtop : Cvtop) (nt : Numtype) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) :
+    ((«$cvtop» (nt_1, cvtop, nt_2, sx, c_1)) == [c]) ->
+    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (nt, c_1)), (Admininstr.CVTOP (nt_1, cvtop, nt_2, sx))])
+  | cvtop_trap (c_1 : C_numtype) (cvtop : Cvtop) (nt : Numtype) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) :
+    ((«$cvtop» (nt_1, cvtop, nt_2, sx, c_1)) == []) ->
+    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (nt, c_1)), (Admininstr.CVTOP (nt_1, cvtop, nt_2, sx))])
+  | ref_is_null_true (rt : Reftype) (val : Val) :
+    (val == (Val.REF_NULL rt)) ->
+    (Step_pure_before_ref_is_null_false [(«$admininstr_val» val), Admininstr.REF_IS_NULL])
+
 inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
   | unreachable  :
     (Step_pure ([Admininstr.UNREACHABLE], [Admininstr.TRAP]))
@@ -1204,11 +1293,449 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (val == (Val.REF_NULL rt)) ->
     (Step_pure ([(«$admininstr_val» val), Admininstr.REF_IS_NULL], [(Admininstr.CONST (Numtype.I32, 1))]))
   | ref_is_null_false (val : Val) :
-    True /- Else? -/ ->
+    (Not (Step_pure_before_ref_is_null_false [(«$admininstr_val» val), Admininstr.REF_IS_NULL])) ->
     (Step_pure ([(«$admininstr_val» val), Admininstr.REF_IS_NULL], [(Admininstr.CONST (Numtype.I32, 0))]))
   | local_tee (val : Val) (x : Idx) :
     (Step_pure ([(«$admininstr_val» val), (Admininstr.LOCAL_TEE x)], [(«$admininstr_val» val), («$admininstr_val» val), (Admininstr.LOCAL_SET x)]))
 
+inductive Step_read_before_call_indirect_trap : Config -> Prop where
+  | call (x : Idx) (z : State) :
+    (x < («$funcaddr» z).length) ->
+    (Step_read_before_call_indirect_trap (z, [(Admininstr.CALL x)]))
+  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
+    (i < («$table» (z, x)).length) ->
+    (a < («$funcinst» z).length) ->
+    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
+    (((«$funcinst» z).get! a) == (m, func)) ->
+    (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
+
+inductive Step_read_before_table_fill_zero : Config -> Prop where
+  | call (x : Idx) (z : State) :
+    (x < («$funcaddr» z).length) ->
+    (Step_read_before_table_fill_zero (z, [(Admininstr.CALL x)]))
+  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
+    (i < («$table» (z, x)).length) ->
+    (a < («$funcinst» z).length) ->
+    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
+    (((«$funcinst» z).get! a) == (m, func)) ->
+    (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
+  | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
+    (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) ->
+    (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
+  | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
+    (a < («$funcinst» z).length) ->
+    (t_1.length == k) ->
+    (t_2.length == n) ->
+    (val.length == k) ->
+    (Forall (λ t ↦ ((«$default_» t) != none)) t) ->
+    (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
+    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->
+    (Step_read_before_table_fill_zero (z, ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.CALL_ADDR a)])))
+  | ref_func (x : Idx) (z : State) :
+    (x < («$funcaddr» z).length) ->
+    (Step_read_before_table_fill_zero (z, [(Admininstr.REF_FUNC x)]))
+  | local_get (x : Idx) (z : State) :
+    (Step_read_before_table_fill_zero (z, [(Admininstr.LOCAL_GET x)]))
+  | global_get (x : Idx) (z : State) :
+    (Step_read_before_table_fill_zero (z, [(Admininstr.GLOBAL_GET x)]))
+  | table_get_trap (i : Nat) (x : Idx) (z : State) :
+    (i >= («$table» (z, x)).length) ->
+    (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
+  | table_get_val (i : Nat) (x : Idx) (z : State) :
+    (i < («$table» (z, x)).length) ->
+    (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
+  | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) :
+    (i >= («$table» (z, x)).length) ->
+    (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]))
+  | table_size (n : N) (x : Idx) (z : State) :
+    ((«$table» (z, x)).length == n) ->
+    (Step_read_before_table_fill_zero (z, [(Admininstr.TABLE_SIZE x)]))
+  | table_grow_fail (n : N) (x : Idx) (z : State) :
+    (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]))
+  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    ((i + n) > («$table» (z, x)).length) ->
+    (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+
+inductive Step_read_before_table_fill_succ : Config -> Prop where
+  | call (x : Idx) (z : State) :
+    (x < («$funcaddr» z).length) ->
+    (Step_read_before_table_fill_succ (z, [(Admininstr.CALL x)]))
+  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
+    (i < («$table» (z, x)).length) ->
+    (a < («$funcinst» z).length) ->
+    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
+    (((«$funcinst» z).get! a) == (m, func)) ->
+    (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
+  | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
+    (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) ->
+    (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
+  | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
+    (a < («$funcinst» z).length) ->
+    (t_1.length == k) ->
+    (t_2.length == n) ->
+    (val.length == k) ->
+    (Forall (λ t ↦ ((«$default_» t) != none)) t) ->
+    (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
+    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->
+    (Step_read_before_table_fill_succ (z, ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.CALL_ADDR a)])))
+  | ref_func (x : Idx) (z : State) :
+    (x < («$funcaddr» z).length) ->
+    (Step_read_before_table_fill_succ (z, [(Admininstr.REF_FUNC x)]))
+  | local_get (x : Idx) (z : State) :
+    (Step_read_before_table_fill_succ (z, [(Admininstr.LOCAL_GET x)]))
+  | global_get (x : Idx) (z : State) :
+    (Step_read_before_table_fill_succ (z, [(Admininstr.GLOBAL_GET x)]))
+  | table_get_trap (i : Nat) (x : Idx) (z : State) :
+    (i >= («$table» (z, x)).length) ->
+    (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
+  | table_get_val (i : Nat) (x : Idx) (z : State) :
+    (i < («$table» (z, x)).length) ->
+    (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
+  | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) :
+    (i >= («$table» (z, x)).length) ->
+    (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]))
+  | table_size (n : N) (x : Idx) (z : State) :
+    ((«$table» (z, x)).length == n) ->
+    (Step_read_before_table_fill_succ (z, [(Admininstr.TABLE_SIZE x)]))
+  | table_grow_fail (n : N) (x : Idx) (z : State) :
+    (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]))
+  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    ((i + n) > («$table» (z, x)).length) ->
+    (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+  | table_fill_zero (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    (Not (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
+    (n == 0) ->
+    (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+
+inductive Step_read_before_table_copy_zero : Config -> Prop where
+  | call (x : Idx) (z : State) :
+    (x < («$funcaddr» z).length) ->
+    (Step_read_before_table_copy_zero (z, [(Admininstr.CALL x)]))
+  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
+    (i < («$table» (z, x)).length) ->
+    (a < («$funcinst» z).length) ->
+    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
+    (((«$funcinst» z).get! a) == (m, func)) ->
+    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
+  | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
+    (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) ->
+    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
+  | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
+    (a < («$funcinst» z).length) ->
+    (t_1.length == k) ->
+    (t_2.length == n) ->
+    (val.length == k) ->
+    (Forall (λ t ↦ ((«$default_» t) != none)) t) ->
+    (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
+    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->
+    (Step_read_before_table_copy_zero (z, ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.CALL_ADDR a)])))
+  | ref_func (x : Idx) (z : State) :
+    (x < («$funcaddr» z).length) ->
+    (Step_read_before_table_copy_zero (z, [(Admininstr.REF_FUNC x)]))
+  | local_get (x : Idx) (z : State) :
+    (Step_read_before_table_copy_zero (z, [(Admininstr.LOCAL_GET x)]))
+  | global_get (x : Idx) (z : State) :
+    (Step_read_before_table_copy_zero (z, [(Admininstr.GLOBAL_GET x)]))
+  | table_get_trap (i : Nat) (x : Idx) (z : State) :
+    (i >= («$table» (z, x)).length) ->
+    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
+  | table_get_val (i : Nat) (x : Idx) (z : State) :
+    (i < («$table» (z, x)).length) ->
+    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
+  | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) :
+    (i >= («$table» (z, x)).length) ->
+    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]))
+  | table_size (n : N) (x : Idx) (z : State) :
+    ((«$table» (z, x)).length == n) ->
+    (Step_read_before_table_copy_zero (z, [(Admininstr.TABLE_SIZE x)]))
+  | table_grow_fail (n : N) (x : Idx) (z : State) :
+    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]))
+  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    ((i + n) > («$table» (z, x)).length) ->
+    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+  | table_fill_zero (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    (Not (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
+    (n == 0) ->
+    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+  | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    (Not (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
+    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+  | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
+    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
+
+inductive Step_read_before_table_copy_le : Config -> Prop where
+  | call (x : Idx) (z : State) :
+    (x < («$funcaddr» z).length) ->
+    (Step_read_before_table_copy_le (z, [(Admininstr.CALL x)]))
+  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
+    (i < («$table» (z, x)).length) ->
+    (a < («$funcinst» z).length) ->
+    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
+    (((«$funcinst» z).get! a) == (m, func)) ->
+    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
+  | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
+    (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) ->
+    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
+  | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
+    (a < («$funcinst» z).length) ->
+    (t_1.length == k) ->
+    (t_2.length == n) ->
+    (val.length == k) ->
+    (Forall (λ t ↦ ((«$default_» t) != none)) t) ->
+    (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
+    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->
+    (Step_read_before_table_copy_le (z, ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.CALL_ADDR a)])))
+  | ref_func (x : Idx) (z : State) :
+    (x < («$funcaddr» z).length) ->
+    (Step_read_before_table_copy_le (z, [(Admininstr.REF_FUNC x)]))
+  | local_get (x : Idx) (z : State) :
+    (Step_read_before_table_copy_le (z, [(Admininstr.LOCAL_GET x)]))
+  | global_get (x : Idx) (z : State) :
+    (Step_read_before_table_copy_le (z, [(Admininstr.GLOBAL_GET x)]))
+  | table_get_trap (i : Nat) (x : Idx) (z : State) :
+    (i >= («$table» (z, x)).length) ->
+    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
+  | table_get_val (i : Nat) (x : Idx) (z : State) :
+    (i < («$table» (z, x)).length) ->
+    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
+  | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) :
+    (i >= («$table» (z, x)).length) ->
+    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]))
+  | table_size (n : N) (x : Idx) (z : State) :
+    ((«$table» (z, x)).length == n) ->
+    (Step_read_before_table_copy_le (z, [(Admininstr.TABLE_SIZE x)]))
+  | table_grow_fail (n : N) (x : Idx) (z : State) :
+    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]))
+  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    ((i + n) > («$table» (z, x)).length) ->
+    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+  | table_fill_zero (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    (Not (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
+    (n == 0) ->
+    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+  | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    (Not (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
+    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+  | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
+    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
+  | table_copy_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (Not (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
+    (n == 0) ->
+    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
+
+inductive Step_read_before_table_copy_gt : Config -> Prop where
+  | call (x : Idx) (z : State) :
+    (x < («$funcaddr» z).length) ->
+    (Step_read_before_table_copy_gt (z, [(Admininstr.CALL x)]))
+  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
+    (i < («$table» (z, x)).length) ->
+    (a < («$funcinst» z).length) ->
+    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
+    (((«$funcinst» z).get! a) == (m, func)) ->
+    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
+  | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
+    (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) ->
+    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
+  | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
+    (a < («$funcinst» z).length) ->
+    (t_1.length == k) ->
+    (t_2.length == n) ->
+    (val.length == k) ->
+    (Forall (λ t ↦ ((«$default_» t) != none)) t) ->
+    (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
+    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->
+    (Step_read_before_table_copy_gt (z, ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.CALL_ADDR a)])))
+  | ref_func (x : Idx) (z : State) :
+    (x < («$funcaddr» z).length) ->
+    (Step_read_before_table_copy_gt (z, [(Admininstr.REF_FUNC x)]))
+  | local_get (x : Idx) (z : State) :
+    (Step_read_before_table_copy_gt (z, [(Admininstr.LOCAL_GET x)]))
+  | global_get (x : Idx) (z : State) :
+    (Step_read_before_table_copy_gt (z, [(Admininstr.GLOBAL_GET x)]))
+  | table_get_trap (i : Nat) (x : Idx) (z : State) :
+    (i >= («$table» (z, x)).length) ->
+    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
+  | table_get_val (i : Nat) (x : Idx) (z : State) :
+    (i < («$table» (z, x)).length) ->
+    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
+  | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) :
+    (i >= («$table» (z, x)).length) ->
+    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]))
+  | table_size (n : N) (x : Idx) (z : State) :
+    ((«$table» (z, x)).length == n) ->
+    (Step_read_before_table_copy_gt (z, [(Admininstr.TABLE_SIZE x)]))
+  | table_grow_fail (n : N) (x : Idx) (z : State) :
+    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]))
+  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    ((i + n) > («$table» (z, x)).length) ->
+    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+  | table_fill_zero (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    (Not (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
+    (n == 0) ->
+    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+  | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    (Not (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
+    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+  | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
+    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
+  | table_copy_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (Not (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
+    (n == 0) ->
+    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
+  | table_copy_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (Not (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
+    (j <= i) ->
+    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
+
+inductive Step_read_before_table_init_zero : Config -> Prop where
+  | call (x : Idx) (z : State) :
+    (x < («$funcaddr» z).length) ->
+    (Step_read_before_table_init_zero (z, [(Admininstr.CALL x)]))
+  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
+    (i < («$table» (z, x)).length) ->
+    (a < («$funcinst» z).length) ->
+    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
+    (((«$funcinst» z).get! a) == (m, func)) ->
+    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
+  | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
+    (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) ->
+    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
+  | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
+    (a < («$funcinst» z).length) ->
+    (t_1.length == k) ->
+    (t_2.length == n) ->
+    (val.length == k) ->
+    (Forall (λ t ↦ ((«$default_» t) != none)) t) ->
+    (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
+    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->
+    (Step_read_before_table_init_zero (z, ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.CALL_ADDR a)])))
+  | ref_func (x : Idx) (z : State) :
+    (x < («$funcaddr» z).length) ->
+    (Step_read_before_table_init_zero (z, [(Admininstr.REF_FUNC x)]))
+  | local_get (x : Idx) (z : State) :
+    (Step_read_before_table_init_zero (z, [(Admininstr.LOCAL_GET x)]))
+  | global_get (x : Idx) (z : State) :
+    (Step_read_before_table_init_zero (z, [(Admininstr.GLOBAL_GET x)]))
+  | table_get_trap (i : Nat) (x : Idx) (z : State) :
+    (i >= («$table» (z, x)).length) ->
+    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
+  | table_get_val (i : Nat) (x : Idx) (z : State) :
+    (i < («$table» (z, x)).length) ->
+    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
+  | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) :
+    (i >= («$table» (z, x)).length) ->
+    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]))
+  | table_size (n : N) (x : Idx) (z : State) :
+    ((«$table» (z, x)).length == n) ->
+    (Step_read_before_table_init_zero (z, [(Admininstr.TABLE_SIZE x)]))
+  | table_grow_fail (n : N) (x : Idx) (z : State) :
+    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]))
+  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    ((i + n) > («$table» (z, x)).length) ->
+    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+  | table_fill_zero (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    (Not (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
+    (n == 0) ->
+    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+  | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    (Not (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
+    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+  | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
+    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
+  | table_copy_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (Not (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
+    (n == 0) ->
+    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
+  | table_copy_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (Not (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
+    (j <= i) ->
+    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
+  | table_copy_gt (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (Not (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
+    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
+  | table_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (((i + n) > («$elem» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
+    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))
+
+inductive Step_read_before_table_init_succ : Config -> Prop where
+  | call (x : Idx) (z : State) :
+    (x < («$funcaddr» z).length) ->
+    (Step_read_before_table_init_succ (z, [(Admininstr.CALL x)]))
+  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
+    (i < («$table» (z, x)).length) ->
+    (a < («$funcinst» z).length) ->
+    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
+    (((«$funcinst» z).get! a) == (m, func)) ->
+    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
+  | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
+    (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) ->
+    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
+  | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
+    (a < («$funcinst» z).length) ->
+    (t_1.length == k) ->
+    (t_2.length == n) ->
+    (val.length == k) ->
+    (Forall (λ t ↦ ((«$default_» t) != none)) t) ->
+    (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
+    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->
+    (Step_read_before_table_init_succ (z, ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.CALL_ADDR a)])))
+  | ref_func (x : Idx) (z : State) :
+    (x < («$funcaddr» z).length) ->
+    (Step_read_before_table_init_succ (z, [(Admininstr.REF_FUNC x)]))
+  | local_get (x : Idx) (z : State) :
+    (Step_read_before_table_init_succ (z, [(Admininstr.LOCAL_GET x)]))
+  | global_get (x : Idx) (z : State) :
+    (Step_read_before_table_init_succ (z, [(Admininstr.GLOBAL_GET x)]))
+  | table_get_trap (i : Nat) (x : Idx) (z : State) :
+    (i >= («$table» (z, x)).length) ->
+    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
+  | table_get_val (i : Nat) (x : Idx) (z : State) :
+    (i < («$table» (z, x)).length) ->
+    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
+  | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) :
+    (i >= («$table» (z, x)).length) ->
+    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]))
+  | table_size (n : N) (x : Idx) (z : State) :
+    ((«$table» (z, x)).length == n) ->
+    (Step_read_before_table_init_succ (z, [(Admininstr.TABLE_SIZE x)]))
+  | table_grow_fail (n : N) (x : Idx) (z : State) :
+    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]))
+  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    ((i + n) > («$table» (z, x)).length) ->
+    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+  | table_fill_zero (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    (Not (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
+    (n == 0) ->
+    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+  | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
+    (Not (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
+    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+  | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
+    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
+  | table_copy_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (Not (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
+    (n == 0) ->
+    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
+  | table_copy_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (Not (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
+    (j <= i) ->
+    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
+  | table_copy_gt (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (Not (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
+    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
+  | table_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (((i + n) > («$elem» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
+    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))
+  | table_init_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (Not (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))) ->
+    (n == 0) ->
+    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))
+
 inductive Step_read : (Config × (List Admininstr)) -> Prop where
   | call (x : Idx) (z : State) :
     (x < («$funcaddr» z).length) ->
@@ -1220,7 +1747,7 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (((«$funcinst» z).get! a) == (m, func)) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [(Admininstr.CALL_ADDR a)]))
   | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
-    True /- Else? -/ ->
+    (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [Admininstr.TRAP]))
   | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
     (a < («$funcinst» z).length) ->
@@ -1256,36 +1783,36 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     ((i + n) > («$table» (z, x)).length) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), [Admininstr.TRAP]))
   | table_fill_zero (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    True /- Else? -/ ->
+    (Not (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
     (n == 0) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), []))
   | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    True /- Else? -/ ->
+    (Not (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (i + 1))), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_FILL x)]))
   | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]), [Admininstr.TRAP]))
   | table_copy_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    True /- Else? -/ ->
+    (Not (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
     (n == 0) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]), []))
   | table_copy_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    True /- Else? -/ ->
+    (Not (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
     (j <= i) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]), [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET y), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_COPY (x, y))]))
   | table_copy_gt (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    True /- Else? -/ ->
+    (Not (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]), [(Admininstr.CONST (Numtype.I32, ((j + n) - 1))), (Admininstr.CONST (Numtype.I32, ((i + n) - 1))), (Admininstr.TABLE_GET y), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_COPY (x, y))]))
   | table_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     (((i + n) > («$elem» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), [Admininstr.TRAP]))
   | table_init_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    True /- Else? -/ ->
+    (Not (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))) ->
     (n == 0) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), []))
   | table_init_succ (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     (i < («$elem» (z, y)).length) ->
-    True /- Else? -/ ->
+    (Not (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))) ->
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), [(Admininstr.CONST (Numtype.I32, j)), («$admininstr_ref» ((«$elem» (z, y)).get! i)), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_INIT (x, y))]))
 
 inductive Step : (Config × Config) -> Prop where
diff --git a/spectec/test-middlend/TEST.md b/spectec/test-middlend/TEST.md
index ca98990263..567145811c 100644
--- a/spectec/test-middlend/TEST.md
+++ b/spectec/test-middlend/TEST.md
@@ -8003,6 +8003,153 @@ def ext : (nat, nat, sx, c_numtype) -> c_numtype
 ;; 5-numerics.watsup:9.1-9.84
 def cvtop : (numtype, cvtop, numtype, sx?, c_numtype) -> c_numtype*
 
+;; 6-reduction.watsup:158.1-160.15
+relation Step_pure_before_ref.is_null-false: `%`(admininstr*)
+  ;; 6-reduction.watsup:16.1-17.24
+  rule unreachable:
+    `%`([UNREACHABLE_admininstr])
+
+  ;; 6-reduction.watsup:19.1-20.19
+  rule nop:
+    `%`([NOP_admininstr])
+
+  ;; 6-reduction.watsup:22.1-23.24
+  rule drop {val : val}:
+    `%`([(val <: admininstr) DROP_admininstr])
+
+  ;; 6-reduction.watsup:26.1-28.16
+  rule select-true {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
+    `%`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:30.1-32.14
+  rule select-false {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
+    `%`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:35.1-37.28
+  rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
+    `%`((val <: admininstr)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})])
+    -- if (|t_1^k{t_1}| = k)
+    -- if (|t_2^n{t_2}| = n)
+    -- if (|val^k{val}| = k)
+    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
+
+  ;; 6-reduction.watsup:39.1-41.28
+  rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
+    `%`((val <: admininstr)^k{val} :: [LOOP_admininstr(bt, instr*{instr})])
+    -- if (|t_1^k{t_1}| = k)
+    -- if (|t_2^n{t_2}| = n)
+    -- if (|val^k{val}| = k)
+    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
+
+  ;; 6-reduction.watsup:43.1-45.16
+  rule if-true {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
+    `%`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*{instr_1}, instr_2*{instr_2})])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:47.1-49.14
+  rule if-false {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
+    `%`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*{instr_1}, instr_2*{instr_2})])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:52.1-53.38
+  rule label-vals {instr* : instr*, n : n, val* : val*}:
+    `%`([LABEL__admininstr(n, instr*{instr}, (val <: admininstr)*{val})])
+
+  ;; 6-reduction.watsup:57.1-58.69
+  rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
+    `%`([LABEL__admininstr(n, instr'*{instr'}, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [BR_admininstr(0)] :: (instr <: admininstr)*{instr})])
+    -- if (|val^n{val}| = n)
+
+  ;; 6-reduction.watsup:60.1-61.65
+  rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
+    `%`([LABEL__admininstr(n, instr'*{instr'}, (val <: admininstr)*{val} :: [BR_admininstr(l + 1)] :: (instr <: admininstr)*{instr})])
+
+  ;; 6-reduction.watsup:64.1-66.16
+  rule br_if-true {c : c_numtype, l : labelidx}:
+    `%`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:68.1-70.14
+  rule br_if-false {c : c_numtype, l : labelidx}:
+    `%`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:73.1-75.17
+  rule br_table-lt {i : nat, l* : labelidx*, l' : labelidx}:
+    `%`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')])
+    -- if (i < |l*{l}|)
+
+  ;; 6-reduction.watsup:77.1-79.18
+  rule br_table-ge {i : nat, l* : labelidx*, l' : labelidx}:
+    `%`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')])
+    -- if (i >= |l*{l}|)
+
+  ;; 6-reduction.watsup:100.1-101.35
+  rule frame-vals {f : frame, n : n, val^n : val^n}:
+    `%`([FRAME__admininstr(n, f, (val <: admininstr)^n{val})])
+    -- if (|val^n{val}| = n)
+
+  ;; 6-reduction.watsup:103.1-104.55
+  rule return-frame {f : frame, instr* : instr*, n : n, val^n : val^n, val'* : val*}:
+    `%`([FRAME__admininstr(n, f, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})])
+    -- if (|val^n{val}| = n)
+
+  ;; 6-reduction.watsup:106.1-107.60
+  rule return-label {instr* : instr*, instr'* : instr*, k : nat, val* : val*}:
+    `%`([LABEL__admininstr(k, instr'*{instr'}, (val <: admininstr)*{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})])
+
+  ;; 6-reduction.watsup:110.1-112.33
+  rule unop-val {c : c_numtype, c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
+    `%`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)])
+    -- if ($unop(unop, nt, c_1) = [c])
+
+  ;; 6-reduction.watsup:114.1-116.39
+  rule unop-trap {c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
+    `%`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)])
+    -- if ($unop(unop, nt, c_1) = [])
+
+  ;; 6-reduction.watsup:119.1-121.40
+  rule binop-val {binop : binop_numtype, c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
+    `%`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)])
+    -- if ($binop(binop, nt, c_1, c_2) = [c])
+
+  ;; 6-reduction.watsup:123.1-125.46
+  rule binop-trap {binop : binop_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
+    `%`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)])
+    -- if ($binop(binop, nt, c_1, c_2) = [])
+
+  ;; 6-reduction.watsup:128.1-130.37
+  rule testop {c : c_numtype, c_1 : c_numtype, nt : numtype, testop : testop_numtype}:
+    `%`([CONST_admininstr(nt, c_1) TESTOP_admininstr(nt, testop)])
+    -- if (c = $testop(testop, nt, c_1))
+
+  ;; 6-reduction.watsup:132.1-134.40
+  rule relop {c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype, relop : relop_numtype}:
+    `%`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) RELOP_admininstr(nt, relop)])
+    -- if (c = $relop(relop, nt, c_1, c_2))
+
+  ;; 6-reduction.watsup:137.1-138.70
+  rule extend {c : c_numtype, n : n, nt : numtype}:
+    `%`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)])
+    -- if ($size(nt <: valtype) =/= ?())
+
+  ;; 6-reduction.watsup:141.1-143.48
+  rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
+    `%`([CONST_admininstr(nt, c_1) CVTOP_admininstr(nt_1, cvtop, nt_2, sx?{sx})])
+    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [c])
+
+  ;; 6-reduction.watsup:145.1-147.54
+  rule cvtop-trap {c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
+    `%`([CONST_admininstr(nt, c_1) CVTOP_admininstr(nt_1, cvtop, nt_2, sx?{sx})])
+    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [])
+
+  ;; 6-reduction.watsup:154.1-156.28
+  rule ref.is_null-true {rt : reftype, val : val}:
+    `%`([(val <: admininstr) REF.IS_NULL_admininstr])
+    -- if (val = REF.NULL_val(rt))
+
 ;; 6-reduction.watsup:4.1-4.63
 relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:16.1-17.24
@@ -8153,22 +8300,37 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:158.1-160.15
   rule ref.is_null-false {val : val}:
     `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
-    -- otherwise
+    -- unless Step_pure_before_ref.is_null-false: `%`([(val <: admininstr) REF.IS_NULL_admininstr])
 
   ;; 6-reduction.watsup:169.1-170.47
   rule local.tee {val : val, x : idx}:
     `%*~>%*`([(val <: admininstr) LOCAL.TEE_admininstr(x)], [(val <: admininstr) (val <: admininstr) LOCAL.SET_admininstr(x)])
 
-;; 6-reduction.watsup:5.1-5.63
-relation Step_read: `%~>%*`(config, admininstr*)
+;; 6-reduction.watsup:90.1-92.15
+relation Step_read_before_call_indirect-trap: `%`(config)
   ;; 6-reduction.watsup:82.1-83.47
   rule call {x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CALL_admininstr(x)]), [CALL_ADDR_admininstr($funcaddr(z)[x])])
+    `%`(`%;%*`(z, [CALL_admininstr(x)]))
     -- if (x < |$funcaddr(z)|)
 
   ;; 6-reduction.watsup:85.1-88.34
   rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [CALL_ADDR_admininstr(a)])
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+    -- if (i < |$table(z, x)|)
+    -- if (a < |$funcinst(z)|)
+    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
+    -- if ($funcinst(z)[a] = `%;%`(m, func))
+
+;; 6-reduction.watsup:213.1-216.14
+relation Step_read_before_table.fill-zero: `%`(config)
+  ;; 6-reduction.watsup:82.1-83.47
+  rule call {x : idx, z : state}:
+    `%`(`%;%*`(z, [CALL_admininstr(x)]))
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:85.1-88.34
+  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
     -- if (i < |$table(z, x)|)
     -- if (a < |$funcinst(z)|)
     -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
@@ -8176,12 +8338,12 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:90.1-92.15
   rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [TRAP_admininstr])
-    -- otherwise
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+    -- unless Step_read_before_call_indirect-trap: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
 
   ;; 6-reduction.watsup:94.1-97.52
   rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
-    `%~>%*`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], (instr <: admininstr)*{instr})])])
+    `%`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]))
     -- if (a < |$funcinst(z)|)
     -- if (|t_1^k{t_1}| = k)
     -- if (|t_2^n{t_2}| = n)
@@ -8192,95 +8354,760 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:150.1-151.53
   rule ref.func {x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [REF.FUNC_admininstr(x)]), [REF.FUNC_ADDR_admininstr($funcaddr(z)[x])])
+    `%`(`%;%*`(z, [REF.FUNC_admininstr(x)]))
     -- if (x < |$funcaddr(z)|)
 
   ;; 6-reduction.watsup:163.1-164.37
   rule local.get {x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [LOCAL.GET_admininstr(x)]), [($local(z, x) <: admininstr)])
+    `%`(`%;%*`(z, [LOCAL.GET_admininstr(x)]))
 
   ;; 6-reduction.watsup:173.1-174.39
   rule global.get {x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]), [($global(z, x) <: admininstr)])
+    `%`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]))
 
   ;; 6-reduction.watsup:180.1-182.28
   rule table.get-trap {i : nat, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
     -- if (i >= |$table(z, x)|)
 
   ;; 6-reduction.watsup:184.1-186.27
   rule table.get-val {i : nat, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [($table(z, x)[i] <: admininstr)])
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
     -- if (i < |$table(z, x)|)
 
   ;; 6-reduction.watsup:188.1-190.28
   rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]))
     -- if (i >= |$table(z, x)|)
 
   ;; 6-reduction.watsup:197.1-199.27
   rule table.size {n : n, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]), [CONST_admininstr(I32_numtype, n)])
+    `%`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]))
     -- if (|$table(z, x)| = n)
 
   ;; 6-reduction.watsup:205.1-206.57
   rule table.grow-fail {n : n, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), [CONST_admininstr(I32_numtype, - 1)])
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]))
 
   ;; 6-reduction.watsup:209.1-211.34
   rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- if ((i + n) > |$table(z, x)|)
+
+;; 6-reduction.watsup:218.1-222.15
+relation Step_read_before_table.fill-succ: `%`(config)
+  ;; 6-reduction.watsup:82.1-83.47
+  rule call {x : idx, z : state}:
+    `%`(`%;%*`(z, [CALL_admininstr(x)]))
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:85.1-88.34
+  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+    -- if (i < |$table(z, x)|)
+    -- if (a < |$funcinst(z)|)
+    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
+    -- if ($funcinst(z)[a] = `%;%`(m, func))
+
+  ;; 6-reduction.watsup:90.1-92.15
+  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+    -- unless Step_read_before_call_indirect-trap: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+
+  ;; 6-reduction.watsup:94.1-97.52
+  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
+    `%`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]))
+    -- if (a < |$funcinst(z)|)
+    -- if (|t_1^k{t_1}| = k)
+    -- if (|t_2^n{t_2}| = n)
+    -- if (|val^k{val}| = k)
+    -- (if ($default_(t) =/= ?()))*{t}
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
+    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
+
+  ;; 6-reduction.watsup:150.1-151.53
+  rule ref.func {x : idx, z : state}:
+    `%`(`%;%*`(z, [REF.FUNC_admininstr(x)]))
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:163.1-164.37
+  rule local.get {x : idx, z : state}:
+    `%`(`%;%*`(z, [LOCAL.GET_admininstr(x)]))
+
+  ;; 6-reduction.watsup:173.1-174.39
+  rule global.get {x : idx, z : state}:
+    `%`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]))
+
+  ;; 6-reduction.watsup:180.1-182.28
+  rule table.get-trap {i : nat, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:184.1-186.27
+  rule table.get-val {i : nat, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:188.1-190.28
+  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]))
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:197.1-199.27
+  rule table.size {n : n, x : idx, z : state}:
+    `%`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]))
+    -- if (|$table(z, x)| = n)
+
+  ;; 6-reduction.watsup:205.1-206.57
+  rule table.grow-fail {n : n, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]))
+
+  ;; 6-reduction.watsup:209.1-211.34
+  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
     -- if ((i + n) > |$table(z, x)|)
 
   ;; 6-reduction.watsup:213.1-216.14
   rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
-    -- otherwise
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
     -- if (n = 0)
 
-  ;; 6-reduction.watsup:218.1-222.15
-  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) (val <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) (val <: admininstr) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
-    -- otherwise
+;; 6-reduction.watsup:229.1-232.14
+relation Step_read_before_table.copy-zero: `%`(config)
+  ;; 6-reduction.watsup:82.1-83.47
+  rule call {x : idx, z : state}:
+    `%`(`%;%*`(z, [CALL_admininstr(x)]))
+    -- if (x < |$funcaddr(z)|)
 
-  ;; 6-reduction.watsup:225.1-227.63
-  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [TRAP_admininstr])
-    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+  ;; 6-reduction.watsup:85.1-88.34
+  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+    -- if (i < |$table(z, x)|)
+    -- if (a < |$funcinst(z)|)
+    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
+    -- if ($funcinst(z)[a] = `%;%`(m, func))
 
-  ;; 6-reduction.watsup:229.1-232.14
-  rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [])
-    -- otherwise
-    -- if (n = 0)
+  ;; 6-reduction.watsup:90.1-92.15
+  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+    -- unless Step_read_before_call_indirect-trap: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
 
-  ;; 6-reduction.watsup:234.1-239.15
-  rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
-    -- otherwise
-    -- if (j <= i)
+  ;; 6-reduction.watsup:94.1-97.52
+  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
+    `%`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]))
+    -- if (a < |$funcinst(z)|)
+    -- if (|t_1^k{t_1}| = k)
+    -- if (|t_2^n{t_2}| = n)
+    -- if (|val^k{val}| = k)
+    -- (if ($default_(t) =/= ?()))*{t}
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
+    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
 
-  ;; 6-reduction.watsup:241.1-245.15
-  rule table.copy-gt {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, ((j + n) - 1)) CONST_admininstr(I32_numtype, ((i + n) - 1)) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
-    -- otherwise
+  ;; 6-reduction.watsup:150.1-151.53
+  rule ref.func {x : idx, z : state}:
+    `%`(`%;%*`(z, [REF.FUNC_admininstr(x)]))
+    -- if (x < |$funcaddr(z)|)
 
-  ;; 6-reduction.watsup:248.1-250.62
-  rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [TRAP_admininstr])
-    -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
+  ;; 6-reduction.watsup:163.1-164.37
+  rule local.get {x : idx, z : state}:
+    `%`(`%;%*`(z, [LOCAL.GET_admininstr(x)]))
 
-  ;; 6-reduction.watsup:252.1-255.14
-  rule table.init-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+  ;; 6-reduction.watsup:173.1-174.39
+  rule global.get {x : idx, z : state}:
+    `%`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]))
+
+  ;; 6-reduction.watsup:180.1-182.28
+  rule table.get-trap {i : nat, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:184.1-186.27
+  rule table.get-val {i : nat, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:188.1-190.28
+  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]))
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:197.1-199.27
+  rule table.size {n : n, x : idx, z : state}:
+    `%`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]))
+    -- if (|$table(z, x)| = n)
+
+  ;; 6-reduction.watsup:205.1-206.57
+  rule table.grow-fail {n : n, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]))
+
+  ;; 6-reduction.watsup:209.1-211.34
+  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- if ((i + n) > |$table(z, x)|)
+
+  ;; 6-reduction.watsup:213.1-216.14
+  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:218.1-222.15
+  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- unless Step_read_before_table.fill-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+
+  ;; 6-reduction.watsup:225.1-227.63
+  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+;; 6-reduction.watsup:234.1-239.15
+relation Step_read_before_table.copy-le: `%`(config)
+  ;; 6-reduction.watsup:82.1-83.47
+  rule call {x : idx, z : state}:
+    `%`(`%;%*`(z, [CALL_admininstr(x)]))
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:85.1-88.34
+  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+    -- if (i < |$table(z, x)|)
+    -- if (a < |$funcinst(z)|)
+    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
+    -- if ($funcinst(z)[a] = `%;%`(m, func))
+
+  ;; 6-reduction.watsup:90.1-92.15
+  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+    -- unless Step_read_before_call_indirect-trap: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+
+  ;; 6-reduction.watsup:94.1-97.52
+  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
+    `%`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]))
+    -- if (a < |$funcinst(z)|)
+    -- if (|t_1^k{t_1}| = k)
+    -- if (|t_2^n{t_2}| = n)
+    -- if (|val^k{val}| = k)
+    -- (if ($default_(t) =/= ?()))*{t}
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
+    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
+
+  ;; 6-reduction.watsup:150.1-151.53
+  rule ref.func {x : idx, z : state}:
+    `%`(`%;%*`(z, [REF.FUNC_admininstr(x)]))
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:163.1-164.37
+  rule local.get {x : idx, z : state}:
+    `%`(`%;%*`(z, [LOCAL.GET_admininstr(x)]))
+
+  ;; 6-reduction.watsup:173.1-174.39
+  rule global.get {x : idx, z : state}:
+    `%`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]))
+
+  ;; 6-reduction.watsup:180.1-182.28
+  rule table.get-trap {i : nat, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:184.1-186.27
+  rule table.get-val {i : nat, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:188.1-190.28
+  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]))
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:197.1-199.27
+  rule table.size {n : n, x : idx, z : state}:
+    `%`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]))
+    -- if (|$table(z, x)| = n)
+
+  ;; 6-reduction.watsup:205.1-206.57
+  rule table.grow-fail {n : n, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]))
+
+  ;; 6-reduction.watsup:209.1-211.34
+  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- if ((i + n) > |$table(z, x)|)
+
+  ;; 6-reduction.watsup:213.1-216.14
+  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:218.1-222.15
+  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- unless Step_read_before_table.fill-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+
+  ;; 6-reduction.watsup:225.1-227.63
+  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:229.1-232.14
+  rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- unless Step_read_before_table.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (n = 0)
+
+;; 6-reduction.watsup:241.1-245.15
+relation Step_read_before_table.copy-gt: `%`(config)
+  ;; 6-reduction.watsup:82.1-83.47
+  rule call {x : idx, z : state}:
+    `%`(`%;%*`(z, [CALL_admininstr(x)]))
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:85.1-88.34
+  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+    -- if (i < |$table(z, x)|)
+    -- if (a < |$funcinst(z)|)
+    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
+    -- if ($funcinst(z)[a] = `%;%`(m, func))
+
+  ;; 6-reduction.watsup:90.1-92.15
+  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+    -- unless Step_read_before_call_indirect-trap: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+
+  ;; 6-reduction.watsup:94.1-97.52
+  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
+    `%`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]))
+    -- if (a < |$funcinst(z)|)
+    -- if (|t_1^k{t_1}| = k)
+    -- if (|t_2^n{t_2}| = n)
+    -- if (|val^k{val}| = k)
+    -- (if ($default_(t) =/= ?()))*{t}
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
+    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
+
+  ;; 6-reduction.watsup:150.1-151.53
+  rule ref.func {x : idx, z : state}:
+    `%`(`%;%*`(z, [REF.FUNC_admininstr(x)]))
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:163.1-164.37
+  rule local.get {x : idx, z : state}:
+    `%`(`%;%*`(z, [LOCAL.GET_admininstr(x)]))
+
+  ;; 6-reduction.watsup:173.1-174.39
+  rule global.get {x : idx, z : state}:
+    `%`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]))
+
+  ;; 6-reduction.watsup:180.1-182.28
+  rule table.get-trap {i : nat, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:184.1-186.27
+  rule table.get-val {i : nat, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:188.1-190.28
+  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]))
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:197.1-199.27
+  rule table.size {n : n, x : idx, z : state}:
+    `%`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]))
+    -- if (|$table(z, x)| = n)
+
+  ;; 6-reduction.watsup:205.1-206.57
+  rule table.grow-fail {n : n, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]))
+
+  ;; 6-reduction.watsup:209.1-211.34
+  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- if ((i + n) > |$table(z, x)|)
+
+  ;; 6-reduction.watsup:213.1-216.14
+  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:218.1-222.15
+  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- unless Step_read_before_table.fill-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+
+  ;; 6-reduction.watsup:225.1-227.63
+  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:229.1-232.14
+  rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- unless Step_read_before_table.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:234.1-239.15
+  rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- unless Step_read_before_table.copy-le: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (j <= i)
+
+;; 6-reduction.watsup:252.1-255.14
+relation Step_read_before_table.init-zero: `%`(config)
+  ;; 6-reduction.watsup:82.1-83.47
+  rule call {x : idx, z : state}:
+    `%`(`%;%*`(z, [CALL_admininstr(x)]))
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:85.1-88.34
+  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+    -- if (i < |$table(z, x)|)
+    -- if (a < |$funcinst(z)|)
+    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
+    -- if ($funcinst(z)[a] = `%;%`(m, func))
+
+  ;; 6-reduction.watsup:90.1-92.15
+  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+    -- unless Step_read_before_call_indirect-trap: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+
+  ;; 6-reduction.watsup:94.1-97.52
+  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
+    `%`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]))
+    -- if (a < |$funcinst(z)|)
+    -- if (|t_1^k{t_1}| = k)
+    -- if (|t_2^n{t_2}| = n)
+    -- if (|val^k{val}| = k)
+    -- (if ($default_(t) =/= ?()))*{t}
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
+    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
+
+  ;; 6-reduction.watsup:150.1-151.53
+  rule ref.func {x : idx, z : state}:
+    `%`(`%;%*`(z, [REF.FUNC_admininstr(x)]))
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:163.1-164.37
+  rule local.get {x : idx, z : state}:
+    `%`(`%;%*`(z, [LOCAL.GET_admininstr(x)]))
+
+  ;; 6-reduction.watsup:173.1-174.39
+  rule global.get {x : idx, z : state}:
+    `%`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]))
+
+  ;; 6-reduction.watsup:180.1-182.28
+  rule table.get-trap {i : nat, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:184.1-186.27
+  rule table.get-val {i : nat, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:188.1-190.28
+  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]))
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:197.1-199.27
+  rule table.size {n : n, x : idx, z : state}:
+    `%`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]))
+    -- if (|$table(z, x)| = n)
+
+  ;; 6-reduction.watsup:205.1-206.57
+  rule table.grow-fail {n : n, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]))
+
+  ;; 6-reduction.watsup:209.1-211.34
+  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- if ((i + n) > |$table(z, x)|)
+
+  ;; 6-reduction.watsup:213.1-216.14
+  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:218.1-222.15
+  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- unless Step_read_before_table.fill-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+
+  ;; 6-reduction.watsup:225.1-227.63
+  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:229.1-232.14
+  rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- unless Step_read_before_table.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:234.1-239.15
+  rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- unless Step_read_before_table.copy-le: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (j <= i)
+
+  ;; 6-reduction.watsup:241.1-245.15
+  rule table.copy-gt {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- unless Step_read_before_table.copy-gt: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+
+  ;; 6-reduction.watsup:248.1-250.62
+  rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
+    -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+;; 6-reduction.watsup:257.1-261.15
+relation Step_read_before_table.init-succ: `%`(config)
+  ;; 6-reduction.watsup:82.1-83.47
+  rule call {x : idx, z : state}:
+    `%`(`%;%*`(z, [CALL_admininstr(x)]))
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:85.1-88.34
+  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+    -- if (i < |$table(z, x)|)
+    -- if (a < |$funcinst(z)|)
+    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
+    -- if ($funcinst(z)[a] = `%;%`(m, func))
+
+  ;; 6-reduction.watsup:90.1-92.15
+  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+    -- unless Step_read_before_call_indirect-trap: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+
+  ;; 6-reduction.watsup:94.1-97.52
+  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
+    `%`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]))
+    -- if (a < |$funcinst(z)|)
+    -- if (|t_1^k{t_1}| = k)
+    -- if (|t_2^n{t_2}| = n)
+    -- if (|val^k{val}| = k)
+    -- (if ($default_(t) =/= ?()))*{t}
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
+    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
+
+  ;; 6-reduction.watsup:150.1-151.53
+  rule ref.func {x : idx, z : state}:
+    `%`(`%;%*`(z, [REF.FUNC_admininstr(x)]))
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:163.1-164.37
+  rule local.get {x : idx, z : state}:
+    `%`(`%;%*`(z, [LOCAL.GET_admininstr(x)]))
+
+  ;; 6-reduction.watsup:173.1-174.39
+  rule global.get {x : idx, z : state}:
+    `%`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]))
+
+  ;; 6-reduction.watsup:180.1-182.28
+  rule table.get-trap {i : nat, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:184.1-186.27
+  rule table.get-val {i : nat, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:188.1-190.28
+  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]))
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:197.1-199.27
+  rule table.size {n : n, x : idx, z : state}:
+    `%`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]))
+    -- if (|$table(z, x)| = n)
+
+  ;; 6-reduction.watsup:205.1-206.57
+  rule table.grow-fail {n : n, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]))
+
+  ;; 6-reduction.watsup:209.1-211.34
+  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- if ((i + n) > |$table(z, x)|)
+
+  ;; 6-reduction.watsup:213.1-216.14
+  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:218.1-222.15
+  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- unless Step_read_before_table.fill-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+
+  ;; 6-reduction.watsup:225.1-227.63
+  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:229.1-232.14
+  rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- unless Step_read_before_table.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:234.1-239.15
+  rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- unless Step_read_before_table.copy-le: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (j <= i)
+
+  ;; 6-reduction.watsup:241.1-245.15
+  rule table.copy-gt {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- unless Step_read_before_table.copy-gt: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+
+  ;; 6-reduction.watsup:248.1-250.62
+  rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
+    -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:252.1-255.14
+  rule table.init-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
+    -- unless Step_read_before_table.init-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
+    -- if (n = 0)
+
+;; 6-reduction.watsup:5.1-5.63
+relation Step_read: `%~>%*`(config, admininstr*)
+  ;; 6-reduction.watsup:82.1-83.47
+  rule call {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CALL_admininstr(x)]), [CALL_ADDR_admininstr($funcaddr(z)[x])])
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:85.1-88.34
+  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [CALL_ADDR_admininstr(a)])
+    -- if (i < |$table(z, x)|)
+    -- if (a < |$funcinst(z)|)
+    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
+    -- if ($funcinst(z)[a] = `%;%`(m, func))
+
+  ;; 6-reduction.watsup:90.1-92.15
+  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [TRAP_admininstr])
+    -- unless Step_read_before_call_indirect-trap: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+
+  ;; 6-reduction.watsup:94.1-97.52
+  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
+    `%~>%*`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], (instr <: admininstr)*{instr})])])
+    -- if (a < |$funcinst(z)|)
+    -- if (|t_1^k{t_1}| = k)
+    -- if (|t_2^n{t_2}| = n)
+    -- if (|val^k{val}| = k)
+    -- (if ($default_(t) =/= ?()))*{t}
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
+    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
+
+  ;; 6-reduction.watsup:150.1-151.53
+  rule ref.func {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [REF.FUNC_admininstr(x)]), [REF.FUNC_ADDR_admininstr($funcaddr(z)[x])])
+    -- if (x < |$funcaddr(z)|)
+
+  ;; 6-reduction.watsup:163.1-164.37
+  rule local.get {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [LOCAL.GET_admininstr(x)]), [($local(z, x) <: admininstr)])
+
+  ;; 6-reduction.watsup:173.1-174.39
+  rule global.get {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]), [($global(z, x) <: admininstr)])
+
+  ;; 6-reduction.watsup:180.1-182.28
+  rule table.get-trap {i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:184.1-186.27
+  rule table.get-val {i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [($table(z, x)[i] <: admininstr)])
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:188.1-190.28
+  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:197.1-199.27
+  rule table.size {n : n, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]), [CONST_admininstr(I32_numtype, n)])
+    -- if (|$table(z, x)| = n)
+
+  ;; 6-reduction.watsup:205.1-206.57
+  rule table.grow-fail {n : n, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), [CONST_admininstr(I32_numtype, - 1)])
+
+  ;; 6-reduction.watsup:209.1-211.34
+  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
+    -- if ((i + n) > |$table(z, x)|)
+
+  ;; 6-reduction.watsup:213.1-216.14
+  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
+    -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:218.1-222.15
+  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) (val <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) (val <: admininstr) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
+    -- unless Step_read_before_table.fill-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+
+  ;; 6-reduction.watsup:225.1-227.63
+  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [TRAP_admininstr])
+    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:229.1-232.14
+  rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [])
+    -- unless Step_read_before_table.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:234.1-239.15
+  rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
+    -- unless Step_read_before_table.copy-le: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (j <= i)
+
+  ;; 6-reduction.watsup:241.1-245.15
+  rule table.copy-gt {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, ((j + n) - 1)) CONST_admininstr(I32_numtype, ((i + n) - 1)) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
+    -- unless Step_read_before_table.copy-gt: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+
+  ;; 6-reduction.watsup:248.1-250.62
+  rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [TRAP_admininstr])
+    -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:252.1-255.14
+  rule table.init-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [])
-    -- otherwise
+    -- unless Step_read_before_table.init-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
     -- if (n = 0)
 
   ;; 6-reduction.watsup:257.1-261.15
   rule table.init-succ {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) ($elem(z, y)[i] <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
     -- if (i < |$elem(z, y)|)
-    -- otherwise
+    -- unless Step_read_before_table.init-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
 
 ;; 6-reduction.watsup:3.1-3.63
 relation Step: `%~>%`(config, config)

From 72459afdd75d0b258ccce5290679cdab9d99e5de Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sun, 9 Apr 2023 18:53:47 +0200
Subject: [PATCH 65/98] Try to recognize apart expression (does not work yet)

---
 spectec/src/backend-lean4/gen.ml |  2 +-
 spectec/src/il/apart.ml          | 23 +++++++++++++++++++++++
 spectec/src/il/apart.mli         |  2 ++
 spectec/src/il/dune              |  2 +-
 spectec/src/middlend/else.ml     |  6 ++++--
 5 files changed, 31 insertions(+), 4 deletions(-)
 create mode 100644 spectec/src/il/apart.ml
 create mode 100644 spectec/src/il/apart.mli

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 5fd935714a..c0d8e22cb1 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -35,7 +35,7 @@ let render_id (id : id) = make_id id.it
 
 let render_fun_id (id : id) = "«$" ^ id.it ^ "»"
 
-let render_type_name (id : id) = String.capitalize_ascii (make_id id.it)
+let render_type_name (id : id) = make_id (String.capitalize_ascii id.it)
 
 let render_rule_name _qual _ty_id (rule_id : id) (i : int) :  string =
   if rule_id.it = ""
diff --git a/spectec/src/il/apart.ml b/spectec/src/il/apart.ml
new file mode 100644
index 0000000000..30b1f30c34
--- /dev/null
+++ b/spectec/src/il/apart.ml
@@ -0,0 +1,23 @@
+open Ast
+
+
+(* Are these two open terms definitely apart? *)
+(* We only care about expression of the same type, and do not bother
+   returning true for different types. *)
+let rec apart (e1 : exp) (e2: exp) : bool =
+  match e1.it, e2.it with
+  (* A literal is never a literal of other type *)
+  | NatE n1, NatE n2 -> not (n1 = n2)
+  | BoolE b1, BoolE b2 -> not (b1 = b2)
+  | TextE t1, TextE t2 -> not (t1 = t2)
+  | CaseE (a1, exp1, _), CaseE (a2, exp2, _) ->
+    not (a1 = a2) || apart exp1 exp2
+  | TupE es1, TupE es2 when List.length es1 = List.length es2 ->
+    List.exists2 apart es1 es2
+  | ListE es1, ListE es2 ->
+    not (List.length es1 = List.length es2) || List.exists2 apart es1 es2
+  | CatE (e1, es1), CatE (e2, es2) ->
+    apart e1 e2 || apart es1 es2
+  (* We do not know anything about variables and functions *)
+  | _ , _ -> false (* conservative *)
+
diff --git a/spectec/src/il/apart.mli b/spectec/src/il/apart.mli
new file mode 100644
index 0000000000..174ce96d7e
--- /dev/null
+++ b/spectec/src/il/apart.mli
@@ -0,0 +1,2 @@
+open Ast
+val apart : exp -> exp -> bool
diff --git a/spectec/src/il/dune b/spectec/src/il/dune
index 38b4366dee..cf0169cfed 100644
--- a/spectec/src/il/dune
+++ b/spectec/src/il/dune
@@ -1,5 +1,5 @@
 (library
   (name il)
   (libraries util)
-  (modules ast eq free print validation)
+  (modules ast eq free print validation apart)
 )
diff --git a/spectec/src/middlend/else.ml b/spectec/src/middlend/else.ml
index 0d0020c879..1fe6cdb946 100644
--- a/spectec/src/middlend/else.ml
+++ b/spectec/src/middlend/else.ml
@@ -39,7 +39,9 @@ let unarize rule = match rule.it with
         | _ -> error exp.at "expected manifest pair"
       in
       { rule with it = RuleD (rid, binds, unary_mixfix, lhs, prems) }
-  
+
+let not_apart lhs rule = match rule.it with
+    | RuleD (_, _, _, lhs2, _) -> not (Il.Apart.apart lhs lhs2)
 
 let rec go at id mixop typ typ1 hints prev_rules : rule list -> def list = function
   | [] -> [ RelD (id, mixop, typ, List.rev prev_rules, hints) $ at ]
@@ -52,7 +54,7 @@ let rec go at id mixop typ typ1 hints prev_rules : rule list -> def list = funct
           | _ -> error exp.at "expected manifest pair"
         in
         let aux_name = id.it ^ "_before_" ^ rid.it $ rid.at in
-        let applicable_prev_rules = List.map unarize prev_rules in
+        let applicable_prev_rules = List.map unarize (List.filter (not_apart lhs) prev_rules) in
         [ RelD (aux_name, unary_mixfix, typ1, List.rev applicable_prev_rules, hints) $ r.at ] @
         let prems' = List.map (replace_else aux_name lhs) prems in
         let rule' = { r with it = RuleD (rid, binds, rmixop, exp, prems') } in

From 0de4e50e5df1eb7f207ab8981a36d4897d45c452 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sun, 9 Apr 2023 21:56:25 +0200
Subject: [PATCH 66/98] Correctly detect apartness

---
 spectec/src/il/apart.ml       |  36 +-
 spectec/src/middlend/else.ml  |   5 +-
 spectec/test-lean4/TEST.md    | 487 +--------------------
 spectec/test-middlend/TEST.md | 771 +---------------------------------
 4 files changed, 69 insertions(+), 1230 deletions(-)

diff --git a/spectec/src/il/apart.ml b/spectec/src/il/apart.ml
index 30b1f30c34..ed1924d97c 100644
--- a/spectec/src/il/apart.ml
+++ b/spectec/src/il/apart.ml
@@ -1,11 +1,28 @@
+open Util.Source
 open Ast
 
+(* Turns an expression of list with a know tail into the tail elements (reverse
+   order), and the initial part
+ *)
+let rec to_snoc_list (e : exp) : exp list * exp = match e.it with
+  | ListE es -> List.rev es, (ListE [] $ e.at)
+  | CatE (e1, e2) ->
+    let revtail2, init2 = to_snoc_list e2 in
+    if init2.it = ListE []
+    then let revtail1, init = to_snoc_list e1 in
+         revtail2 @ revtail1, init
+    else revtail2, CatE (e1, init2) $ e.at
+  | _ -> [], e
 
 (* Are these two open terms definitely apart? *)
 (* We only care about expression of the same type, and do not bother
    returning true for different types. *)
 let rec apart (e1 : exp) (e2: exp) : bool =
-  match e1.it, e2.it with
+  if Eq.eq_exp e1 e2 then false else
+  (*
+  (fun b -> if not b then Printf.eprintf "apart\n  %s\n  %s\n  %b\n" (Print.string_of_exp e1) (Print.string_of_exp e2) b; b)
+  *)
+  (match e1.it, e2.it with
   (* A literal is never a literal of other type *)
   | NatE n1, NatE n2 -> not (n1 = n2)
   | BoolE b1, BoolE b2 -> not (b1 = b2)
@@ -14,10 +31,19 @@ let rec apart (e1 : exp) (e2: exp) : bool =
     not (a1 = a2) || apart exp1 exp2
   | TupE es1, TupE es2 when List.length es1 = List.length es2 ->
     List.exists2 apart es1 es2
-  | ListE es1, ListE es2 ->
-    not (List.length es1 = List.length es2) || List.exists2 apart es1 es2
-  | CatE (e1, es1), CatE (e2, es2) ->
-    apart e1 e2 || apart es1 es2
+  | (CatE _ | ListE _), (CatE _ | ListE _) ->
+    list_exp_apart e1 e2
+  | SubE (e1, _, _), SubE (e2, _, _) -> apart e1 e2
+  | MixE (mixop1, e1), MixE (mixop2, e2) ->
+    not (mixop1 = mixop2) || apart e1 e2
   (* We do not know anything about variables and functions *)
   | _ , _ -> false (* conservative *)
+  )
 
+and list_exp_apart e1 e2 =
+  let revtail1, init1 = to_snoc_list e1 in
+  let revtail2, init2 = to_snoc_list e2 in
+  List.exists2 apart revtail1 revtail2 ||
+  (if List.length revtail1 = List.length revtail2 && revtail1 != []
+  then apart init1 init2
+  else false)
diff --git a/spectec/src/middlend/else.ml b/spectec/src/middlend/else.ml
index 1fe6cdb946..e1172d9d34 100644
--- a/spectec/src/middlend/else.ml
+++ b/spectec/src/middlend/else.ml
@@ -54,7 +54,10 @@ let rec go at id mixop typ typ1 hints prev_rules : rule list -> def list = funct
           | _ -> error exp.at "expected manifest pair"
         in
         let aux_name = id.it ^ "_before_" ^ rid.it $ rid.at in
-        let applicable_prev_rules = List.map unarize (List.filter (not_apart lhs) prev_rules) in
+        let applicable_prev_rules = prev_rules
+              |> List.map unarize
+              |> List.filter (not_apart lhs)
+              |> List.rev in
         [ RelD (aux_name, unary_mixfix, typ1, List.rev applicable_prev_rules, hints) $ r.at ] @
         let prems' = List.map (replace_else aux_name lhs) prems in
         let rule' = { r with it = RuleD (rid, binds, rmixop, exp, prems') } in
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 6d6b6b830e..3d0b49ff3a 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -1116,90 +1116,6 @@ def «$ext» : (Nat × Nat × Sx × C_numtype) -> C_numtype := default
 def «$cvtop» : (Numtype × Cvtop × Numtype × (Option Sx) × C_numtype) -> (List C_numtype) := default
 
 inductive Step_pure_before_ref_is_null_false : (List Admininstr) -> Prop where
-  | unreachable  :
-    (Step_pure_before_ref_is_null_false [Admininstr.UNREACHABLE])
-  | nop  :
-    (Step_pure_before_ref_is_null_false [Admininstr.NOP])
-  | drop (val : Val) :
-    (Step_pure_before_ref_is_null_false [(«$admininstr_val» val), Admininstr.DROP])
-  | select_true (c : C_numtype) (t : (Option Valtype)) (val_1 : Val) (val_2 : Val) :
-    (c != 0) ->
-    (Step_pure_before_ref_is_null_false [(«$admininstr_val» val_1), («$admininstr_val» val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)])
-  | select_false (c : C_numtype) (t : (Option Valtype)) (val_1 : Val) (val_2 : Val) :
-    (c == 0) ->
-    (Step_pure_before_ref_is_null_false [(«$admininstr_val» val_1), («$admininstr_val» val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)])
-  | block (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
-    (t_1.length == k) ->
-    (t_2.length == n) ->
-    (val.length == k) ->
-    (bt == (t_1, t_2)) ->
-    (Step_pure_before_ref_is_null_false ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.BLOCK (bt, instr))]))
-  | loop (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
-    (t_1.length == k) ->
-    (t_2.length == n) ->
-    (val.length == k) ->
-    (bt == (t_1, t_2)) ->
-    (Step_pure_before_ref_is_null_false ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.LOOP (bt, instr))]))
-  | if_true (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) :
-    (c != 0) ->
-    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (Numtype.I32, c)), (Admininstr.IF (bt, instr_1, instr_2))])
-  | if_false (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) :
-    (c == 0) ->
-    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (Numtype.I32, c)), (Admininstr.IF (bt, instr_1, instr_2))])
-  | label_vals (instr : (List Instr)) (n : N) (val : (List Val)) :
-    (Step_pure_before_ref_is_null_false [(Admininstr.LABEL_ (n, instr, (List.map (λ val ↦ («$admininstr_val» val)) val)))])
-  | br_zero (instr : (List Instr)) (instr' : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) :
-    (val.length == n) ->
-    (Step_pure_before_ref_is_null_false [(Admininstr.LABEL_ (n, instr', ((List.map (λ val' ↦ («$admininstr_val» val')) val') ++ ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([(Admininstr.BR 0)] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr))))))])
-  | br_succ (instr : (List Instr)) (instr' : (List Instr)) (l : Labelidx) (n : N) (val : (List Val)) :
-    (Step_pure_before_ref_is_null_false [(Admininstr.LABEL_ (n, instr', ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([(Admininstr.BR (l + 1))] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)))))])
-  | br_if_true (c : C_numtype) (l : Labelidx) :
-    (c != 0) ->
-    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (Numtype.I32, c)), (Admininstr.BR_IF l)])
-  | br_if_false (c : C_numtype) (l : Labelidx) :
-    (c == 0) ->
-    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (Numtype.I32, c)), (Admininstr.BR_IF l)])
-  | br_table_lt (i : Nat) (l : (List Labelidx)) (l' : Labelidx) :
-    (i < l.length) ->
-    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.BR_TABLE (l, l'))])
-  | br_table_ge (i : Nat) (l : (List Labelidx)) (l' : Labelidx) :
-    (i >= l.length) ->
-    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.BR_TABLE (l, l'))])
-  | frame_vals (f : Frame) (n : N) (val : (List Val)) :
-    (val.length == n) ->
-    (Step_pure_before_ref_is_null_false [(Admininstr.FRAME_ (n, f, (List.map (λ val ↦ («$admininstr_val» val)) val)))])
-  | return_frame (f : Frame) (instr : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) :
-    (val.length == n) ->
-    (Step_pure_before_ref_is_null_false [(Admininstr.FRAME_ (n, f, ((List.map (λ val' ↦ («$admininstr_val» val')) val') ++ ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([Admininstr.RETURN] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr))))))])
-  | return_label (instr : (List Instr)) (instr' : (List Instr)) (k : Nat) (val : (List Val)) :
-    (Step_pure_before_ref_is_null_false [(Admininstr.LABEL_ (k, instr', ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([Admininstr.RETURN] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)))))])
-  | unop_val (c : C_numtype) (c_1 : C_numtype) (nt : Numtype) (unop : Unop_numtype) :
-    ((«$unop» (unop, nt, c_1)) == [c]) ->
-    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (nt, c_1)), (Admininstr.UNOP (nt, unop))])
-  | unop_trap (c_1 : C_numtype) (nt : Numtype) (unop : Unop_numtype) :
-    ((«$unop» (unop, nt, c_1)) == []) ->
-    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (nt, c_1)), (Admininstr.UNOP (nt, unop))])
-  | binop_val (binop : Binop_numtype) (c : C_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) :
-    ((«$binop» (binop, nt, c_1, c_2)) == [c]) ->
-    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.BINOP (nt, binop))])
-  | binop_trap (binop : Binop_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) :
-    ((«$binop» (binop, nt, c_1, c_2)) == []) ->
-    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.BINOP (nt, binop))])
-  | testop (c : C_numtype) (c_1 : C_numtype) (nt : Numtype) (testop : Testop_numtype) :
-    (c == («$testop» (testop, nt, c_1))) ->
-    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (nt, c_1)), (Admininstr.TESTOP (nt, testop))])
-  | relop (c : C_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) (relop : Relop_numtype) :
-    (c == («$relop» (relop, nt, c_1, c_2))) ->
-    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.RELOP (nt, relop))])
-  | extend (c : C_numtype) (n : N) (nt : Numtype) :
-    ((«$size» («$valtype_numtype» nt)) != none) ->
-    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (nt, c)), (Admininstr.EXTEND (nt, n))])
-  | cvtop_val (c : C_numtype) (c_1 : C_numtype) (cvtop : Cvtop) (nt : Numtype) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) :
-    ((«$cvtop» (nt_1, cvtop, nt_2, sx, c_1)) == [c]) ->
-    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (nt, c_1)), (Admininstr.CVTOP (nt_1, cvtop, nt_2, sx))])
-  | cvtop_trap (c_1 : C_numtype) (cvtop : Cvtop) (nt : Numtype) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) :
-    ((«$cvtop» (nt_1, cvtop, nt_2, sx, c_1)) == []) ->
-    (Step_pure_before_ref_is_null_false [(Admininstr.CONST (nt, c_1)), (Admininstr.CVTOP (nt_1, cvtop, nt_2, sx))])
   | ref_is_null_true (rt : Reftype) (val : Val) :
     (val == (Val.REF_NULL rt)) ->
     (Step_pure_before_ref_is_null_false [(«$admininstr_val» val), Admininstr.REF_IS_NULL])
@@ -1299,9 +1215,6 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (Step_pure ([(«$admininstr_val» val), (Admininstr.LOCAL_TEE x)], [(«$admininstr_val» val), («$admininstr_val» val), (Admininstr.LOCAL_SET x)]))
 
 inductive Step_read_before_call_indirect_trap : Config -> Prop where
-  | call (x : Idx) (z : State) :
-    (x < («$funcaddr» z).length) ->
-    (Step_read_before_call_indirect_trap (z, [(Admininstr.CALL x)]))
   | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
     (i < («$table» (z, x)).length) ->
     (a < («$funcinst» z).length) ->
@@ -1310,431 +1223,59 @@ inductive Step_read_before_call_indirect_trap : Config -> Prop where
     (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
 
 inductive Step_read_before_table_fill_zero : Config -> Prop where
-  | call (x : Idx) (z : State) :
-    (x < («$funcaddr» z).length) ->
-    (Step_read_before_table_fill_zero (z, [(Admininstr.CALL x)]))
-  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
-    (i < («$table» (z, x)).length) ->
-    (a < («$funcinst» z).length) ->
-    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
-    (((«$funcinst» z).get! a) == (m, func)) ->
-    (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
-  | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
-    (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) ->
-    (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
-  | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
-    (a < («$funcinst» z).length) ->
-    (t_1.length == k) ->
-    (t_2.length == n) ->
-    (val.length == k) ->
-    (Forall (λ t ↦ ((«$default_» t) != none)) t) ->
-    (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
-    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->
-    (Step_read_before_table_fill_zero (z, ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.CALL_ADDR a)])))
-  | ref_func (x : Idx) (z : State) :
-    (x < («$funcaddr» z).length) ->
-    (Step_read_before_table_fill_zero (z, [(Admininstr.REF_FUNC x)]))
-  | local_get (x : Idx) (z : State) :
-    (Step_read_before_table_fill_zero (z, [(Admininstr.LOCAL_GET x)]))
-  | global_get (x : Idx) (z : State) :
-    (Step_read_before_table_fill_zero (z, [(Admininstr.GLOBAL_GET x)]))
-  | table_get_trap (i : Nat) (x : Idx) (z : State) :
-    (i >= («$table» (z, x)).length) ->
-    (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
-  | table_get_val (i : Nat) (x : Idx) (z : State) :
-    (i < («$table» (z, x)).length) ->
-    (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
-  | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) :
-    (i >= («$table» (z, x)).length) ->
-    (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]))
-  | table_size (n : N) (x : Idx) (z : State) :
-    ((«$table» (z, x)).length == n) ->
-    (Step_read_before_table_fill_zero (z, [(Admininstr.TABLE_SIZE x)]))
-  | table_grow_fail (n : N) (x : Idx) (z : State) :
-    (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]))
   | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
     ((i + n) > («$table» (z, x)).length) ->
     (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
 
 inductive Step_read_before_table_fill_succ : Config -> Prop where
-  | call (x : Idx) (z : State) :
-    (x < («$funcaddr» z).length) ->
-    (Step_read_before_table_fill_succ (z, [(Admininstr.CALL x)]))
-  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
-    (i < («$table» (z, x)).length) ->
-    (a < («$funcinst» z).length) ->
-    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
-    (((«$funcinst» z).get! a) == (m, func)) ->
-    (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
-  | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
-    (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) ->
-    (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
-  | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
-    (a < («$funcinst» z).length) ->
-    (t_1.length == k) ->
-    (t_2.length == n) ->
-    (val.length == k) ->
-    (Forall (λ t ↦ ((«$default_» t) != none)) t) ->
-    (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
-    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->
-    (Step_read_before_table_fill_succ (z, ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.CALL_ADDR a)])))
-  | ref_func (x : Idx) (z : State) :
-    (x < («$funcaddr» z).length) ->
-    (Step_read_before_table_fill_succ (z, [(Admininstr.REF_FUNC x)]))
-  | local_get (x : Idx) (z : State) :
-    (Step_read_before_table_fill_succ (z, [(Admininstr.LOCAL_GET x)]))
-  | global_get (x : Idx) (z : State) :
-    (Step_read_before_table_fill_succ (z, [(Admininstr.GLOBAL_GET x)]))
-  | table_get_trap (i : Nat) (x : Idx) (z : State) :
-    (i >= («$table» (z, x)).length) ->
-    (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
-  | table_get_val (i : Nat) (x : Idx) (z : State) :
-    (i < («$table» (z, x)).length) ->
-    (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
-  | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) :
-    (i >= («$table» (z, x)).length) ->
-    (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]))
-  | table_size (n : N) (x : Idx) (z : State) :
-    ((«$table» (z, x)).length == n) ->
-    (Step_read_before_table_fill_succ (z, [(Admininstr.TABLE_SIZE x)]))
-  | table_grow_fail (n : N) (x : Idx) (z : State) :
-    (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]))
-  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    ((i + n) > («$table» (z, x)).length) ->
-    (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
   | table_fill_zero (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
     (Not (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
     (n == 0) ->
     (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
-
-inductive Step_read_before_table_copy_zero : Config -> Prop where
-  | call (x : Idx) (z : State) :
-    (x < («$funcaddr» z).length) ->
-    (Step_read_before_table_copy_zero (z, [(Admininstr.CALL x)]))
-  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
-    (i < («$table» (z, x)).length) ->
-    (a < («$funcinst» z).length) ->
-    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
-    (((«$funcinst» z).get! a) == (m, func)) ->
-    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
-  | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
-    (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) ->
-    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
-  | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
-    (a < («$funcinst» z).length) ->
-    (t_1.length == k) ->
-    (t_2.length == n) ->
-    (val.length == k) ->
-    (Forall (λ t ↦ ((«$default_» t) != none)) t) ->
-    (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
-    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->
-    (Step_read_before_table_copy_zero (z, ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.CALL_ADDR a)])))
-  | ref_func (x : Idx) (z : State) :
-    (x < («$funcaddr» z).length) ->
-    (Step_read_before_table_copy_zero (z, [(Admininstr.REF_FUNC x)]))
-  | local_get (x : Idx) (z : State) :
-    (Step_read_before_table_copy_zero (z, [(Admininstr.LOCAL_GET x)]))
-  | global_get (x : Idx) (z : State) :
-    (Step_read_before_table_copy_zero (z, [(Admininstr.GLOBAL_GET x)]))
-  | table_get_trap (i : Nat) (x : Idx) (z : State) :
-    (i >= («$table» (z, x)).length) ->
-    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
-  | table_get_val (i : Nat) (x : Idx) (z : State) :
-    (i < («$table» (z, x)).length) ->
-    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
-  | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) :
-    (i >= («$table» (z, x)).length) ->
-    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]))
-  | table_size (n : N) (x : Idx) (z : State) :
-    ((«$table» (z, x)).length == n) ->
-    (Step_read_before_table_copy_zero (z, [(Admininstr.TABLE_SIZE x)]))
-  | table_grow_fail (n : N) (x : Idx) (z : State) :
-    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]))
   | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
     ((i + n) > («$table» (z, x)).length) ->
-    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
-  | table_fill_zero (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    (Not (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
-    (n == 0) ->
-    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
-  | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    (Not (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
-    (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+    (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
+
+inductive Step_read_before_table_copy_zero : Config -> Prop where
   | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
     (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
 
 inductive Step_read_before_table_copy_le : Config -> Prop where
-  | call (x : Idx) (z : State) :
-    (x < («$funcaddr» z).length) ->
-    (Step_read_before_table_copy_le (z, [(Admininstr.CALL x)]))
-  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
-    (i < («$table» (z, x)).length) ->
-    (a < («$funcinst» z).length) ->
-    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
-    (((«$funcinst» z).get! a) == (m, func)) ->
-    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
-  | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
-    (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) ->
-    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
-  | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
-    (a < («$funcinst» z).length) ->
-    (t_1.length == k) ->
-    (t_2.length == n) ->
-    (val.length == k) ->
-    (Forall (λ t ↦ ((«$default_» t) != none)) t) ->
-    (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
-    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->
-    (Step_read_before_table_copy_le (z, ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.CALL_ADDR a)])))
-  | ref_func (x : Idx) (z : State) :
-    (x < («$funcaddr» z).length) ->
-    (Step_read_before_table_copy_le (z, [(Admininstr.REF_FUNC x)]))
-  | local_get (x : Idx) (z : State) :
-    (Step_read_before_table_copy_le (z, [(Admininstr.LOCAL_GET x)]))
-  | global_get (x : Idx) (z : State) :
-    (Step_read_before_table_copy_le (z, [(Admininstr.GLOBAL_GET x)]))
-  | table_get_trap (i : Nat) (x : Idx) (z : State) :
-    (i >= («$table» (z, x)).length) ->
-    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
-  | table_get_val (i : Nat) (x : Idx) (z : State) :
-    (i < («$table» (z, x)).length) ->
-    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
-  | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) :
-    (i >= («$table» (z, x)).length) ->
-    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]))
-  | table_size (n : N) (x : Idx) (z : State) :
-    ((«$table» (z, x)).length == n) ->
-    (Step_read_before_table_copy_le (z, [(Admininstr.TABLE_SIZE x)]))
-  | table_grow_fail (n : N) (x : Idx) (z : State) :
-    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]))
-  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    ((i + n) > («$table» (z, x)).length) ->
-    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
-  | table_fill_zero (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    (Not (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
-    (n == 0) ->
-    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
-  | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    (Not (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
-    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
-  | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
-    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
   | table_copy_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     (Not (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
     (n == 0) ->
     (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
-
-inductive Step_read_before_table_copy_gt : Config -> Prop where
-  | call (x : Idx) (z : State) :
-    (x < («$funcaddr» z).length) ->
-    (Step_read_before_table_copy_gt (z, [(Admininstr.CALL x)]))
-  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
-    (i < («$table» (z, x)).length) ->
-    (a < («$funcinst» z).length) ->
-    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
-    (((«$funcinst» z).get! a) == (m, func)) ->
-    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
-  | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
-    (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) ->
-    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
-  | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
-    (a < («$funcinst» z).length) ->
-    (t_1.length == k) ->
-    (t_2.length == n) ->
-    (val.length == k) ->
-    (Forall (λ t ↦ ((«$default_» t) != none)) t) ->
-    (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
-    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->
-    (Step_read_before_table_copy_gt (z, ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.CALL_ADDR a)])))
-  | ref_func (x : Idx) (z : State) :
-    (x < («$funcaddr» z).length) ->
-    (Step_read_before_table_copy_gt (z, [(Admininstr.REF_FUNC x)]))
-  | local_get (x : Idx) (z : State) :
-    (Step_read_before_table_copy_gt (z, [(Admininstr.LOCAL_GET x)]))
-  | global_get (x : Idx) (z : State) :
-    (Step_read_before_table_copy_gt (z, [(Admininstr.GLOBAL_GET x)]))
-  | table_get_trap (i : Nat) (x : Idx) (z : State) :
-    (i >= («$table» (z, x)).length) ->
-    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
-  | table_get_val (i : Nat) (x : Idx) (z : State) :
-    (i < («$table» (z, x)).length) ->
-    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
-  | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) :
-    (i >= («$table» (z, x)).length) ->
-    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]))
-  | table_size (n : N) (x : Idx) (z : State) :
-    ((«$table» (z, x)).length == n) ->
-    (Step_read_before_table_copy_gt (z, [(Admininstr.TABLE_SIZE x)]))
-  | table_grow_fail (n : N) (x : Idx) (z : State) :
-    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]))
-  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    ((i + n) > («$table» (z, x)).length) ->
-    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
-  | table_fill_zero (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    (Not (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
-    (n == 0) ->
-    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
-  | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    (Not (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
-    (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
   | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
+    (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
+
+inductive Step_read_before_table_copy_gt : Config -> Prop where
+  | table_copy_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (Not (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
+    (j <= i) ->
     (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
   | table_copy_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     (Not (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
     (n == 0) ->
     (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
-  | table_copy_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (Not (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
-    (j <= i) ->
+  | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
     (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
 
 inductive Step_read_before_table_init_zero : Config -> Prop where
-  | call (x : Idx) (z : State) :
-    (x < («$funcaddr» z).length) ->
-    (Step_read_before_table_init_zero (z, [(Admininstr.CALL x)]))
-  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
-    (i < («$table» (z, x)).length) ->
-    (a < («$funcinst» z).length) ->
-    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
-    (((«$funcinst» z).get! a) == (m, func)) ->
-    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
-  | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
-    (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) ->
-    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
-  | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
-    (a < («$funcinst» z).length) ->
-    (t_1.length == k) ->
-    (t_2.length == n) ->
-    (val.length == k) ->
-    (Forall (λ t ↦ ((«$default_» t) != none)) t) ->
-    (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
-    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->
-    (Step_read_before_table_init_zero (z, ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.CALL_ADDR a)])))
-  | ref_func (x : Idx) (z : State) :
-    (x < («$funcaddr» z).length) ->
-    (Step_read_before_table_init_zero (z, [(Admininstr.REF_FUNC x)]))
-  | local_get (x : Idx) (z : State) :
-    (Step_read_before_table_init_zero (z, [(Admininstr.LOCAL_GET x)]))
-  | global_get (x : Idx) (z : State) :
-    (Step_read_before_table_init_zero (z, [(Admininstr.GLOBAL_GET x)]))
-  | table_get_trap (i : Nat) (x : Idx) (z : State) :
-    (i >= («$table» (z, x)).length) ->
-    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
-  | table_get_val (i : Nat) (x : Idx) (z : State) :
-    (i < («$table» (z, x)).length) ->
-    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
-  | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) :
-    (i >= («$table» (z, x)).length) ->
-    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]))
-  | table_size (n : N) (x : Idx) (z : State) :
-    ((«$table» (z, x)).length == n) ->
-    (Step_read_before_table_init_zero (z, [(Admininstr.TABLE_SIZE x)]))
-  | table_grow_fail (n : N) (x : Idx) (z : State) :
-    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]))
-  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    ((i + n) > («$table» (z, x)).length) ->
-    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
-  | table_fill_zero (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    (Not (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
-    (n == 0) ->
-    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
-  | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    (Not (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
-    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
-  | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
-    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
-  | table_copy_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (Not (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
-    (n == 0) ->
-    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
-  | table_copy_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (Not (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
-    (j <= i) ->
-    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
-  | table_copy_gt (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (Not (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
-    (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
   | table_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     (((i + n) > («$elem» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
     (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))
 
 inductive Step_read_before_table_init_succ : Config -> Prop where
-  | call (x : Idx) (z : State) :
-    (x < («$funcaddr» z).length) ->
-    (Step_read_before_table_init_succ (z, [(Admininstr.CALL x)]))
-  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
-    (i < («$table» (z, x)).length) ->
-    (a < («$funcinst» z).length) ->
-    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
-    (((«$funcinst» z).get! a) == (m, func)) ->
-    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
-  | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
-    (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) ->
-    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
-  | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
-    (a < («$funcinst» z).length) ->
-    (t_1.length == k) ->
-    (t_2.length == n) ->
-    (val.length == k) ->
-    (Forall (λ t ↦ ((«$default_» t) != none)) t) ->
-    (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
-    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->
-    (Step_read_before_table_init_succ (z, ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.CALL_ADDR a)])))
-  | ref_func (x : Idx) (z : State) :
-    (x < («$funcaddr» z).length) ->
-    (Step_read_before_table_init_succ (z, [(Admininstr.REF_FUNC x)]))
-  | local_get (x : Idx) (z : State) :
-    (Step_read_before_table_init_succ (z, [(Admininstr.LOCAL_GET x)]))
-  | global_get (x : Idx) (z : State) :
-    (Step_read_before_table_init_succ (z, [(Admininstr.GLOBAL_GET x)]))
-  | table_get_trap (i : Nat) (x : Idx) (z : State) :
-    (i >= («$table» (z, x)).length) ->
-    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
-  | table_get_val (i : Nat) (x : Idx) (z : State) :
-    (i < («$table» (z, x)).length) ->
-    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]))
-  | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) :
-    (i >= («$table» (z, x)).length) ->
-    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]))
-  | table_size (n : N) (x : Idx) (z : State) :
-    ((«$table» (z, x)).length == n) ->
-    (Step_read_before_table_init_succ (z, [(Admininstr.TABLE_SIZE x)]))
-  | table_grow_fail (n : N) (x : Idx) (z : State) :
-    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]))
-  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    ((i + n) > («$table» (z, x)).length) ->
-    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
-  | table_fill_zero (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    (Not (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
-    (n == 0) ->
-    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
-  | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    (Not (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
-    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
-  | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
-    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
-  | table_copy_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (Not (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
-    (n == 0) ->
-    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
-  | table_copy_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (Not (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
-    (j <= i) ->
-    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
-  | table_copy_gt (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (Not (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
-    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
-  | table_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (((i + n) > («$elem» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
-    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))
   | table_init_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
     (Not (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))) ->
     (n == 0) ->
     (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))
+  | table_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
+    (((i + n) > («$elem» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
+    (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))
 
 inductive Step_read : (Config × (List Admininstr)) -> Prop where
   | call (x : Idx) (z : State) :
diff --git a/spectec/test-middlend/TEST.md b/spectec/test-middlend/TEST.md
index 02393af8ce..39363224c8 100644
--- a/spectec/test-middlend/TEST.md
+++ b/spectec/test-middlend/TEST.md
@@ -8005,146 +8005,6 @@ def cvtop : (numtype, cvtop, numtype, sx?, c_numtype) -> c_numtype*
 
 ;; 6-reduction.watsup:158.1-160.15
 relation Step_pure_before_ref.is_null-false: `%`(admininstr*)
-  ;; 6-reduction.watsup:16.1-17.24
-  rule unreachable:
-    `%`([UNREACHABLE_admininstr])
-
-  ;; 6-reduction.watsup:19.1-20.19
-  rule nop:
-    `%`([NOP_admininstr])
-
-  ;; 6-reduction.watsup:22.1-23.24
-  rule drop {val : val}:
-    `%`([(val <: admininstr) DROP_admininstr])
-
-  ;; 6-reduction.watsup:26.1-28.16
-  rule select-true {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
-    `%`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})])
-    -- if (c =/= 0)
-
-  ;; 6-reduction.watsup:30.1-32.14
-  rule select-false {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
-    `%`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})])
-    -- if (c = 0)
-
-  ;; 6-reduction.watsup:35.1-37.28
-  rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
-    `%`((val <: admininstr)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})])
-    -- if (|t_1^k{t_1}| = k)
-    -- if (|t_2^n{t_2}| = n)
-    -- if (|val^k{val}| = k)
-    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
-
-  ;; 6-reduction.watsup:39.1-41.28
-  rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
-    `%`((val <: admininstr)^k{val} :: [LOOP_admininstr(bt, instr*{instr})])
-    -- if (|t_1^k{t_1}| = k)
-    -- if (|t_2^n{t_2}| = n)
-    -- if (|val^k{val}| = k)
-    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
-
-  ;; 6-reduction.watsup:43.1-45.16
-  rule if-true {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
-    `%`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*{instr_1}, instr_2*{instr_2})])
-    -- if (c =/= 0)
-
-  ;; 6-reduction.watsup:47.1-49.14
-  rule if-false {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
-    `%`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*{instr_1}, instr_2*{instr_2})])
-    -- if (c = 0)
-
-  ;; 6-reduction.watsup:52.1-53.38
-  rule label-vals {instr* : instr*, n : n, val* : val*}:
-    `%`([LABEL__admininstr(n, instr*{instr}, (val <: admininstr)*{val})])
-
-  ;; 6-reduction.watsup:57.1-58.69
-  rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
-    `%`([LABEL__admininstr(n, instr'*{instr'}, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [BR_admininstr(0)] :: (instr <: admininstr)*{instr})])
-    -- if (|val^n{val}| = n)
-
-  ;; 6-reduction.watsup:60.1-61.65
-  rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
-    `%`([LABEL__admininstr(n, instr'*{instr'}, (val <: admininstr)*{val} :: [BR_admininstr(l + 1)] :: (instr <: admininstr)*{instr})])
-
-  ;; 6-reduction.watsup:64.1-66.16
-  rule br_if-true {c : c_numtype, l : labelidx}:
-    `%`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)])
-    -- if (c =/= 0)
-
-  ;; 6-reduction.watsup:68.1-70.14
-  rule br_if-false {c : c_numtype, l : labelidx}:
-    `%`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)])
-    -- if (c = 0)
-
-  ;; 6-reduction.watsup:73.1-75.17
-  rule br_table-lt {i : nat, l* : labelidx*, l' : labelidx}:
-    `%`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')])
-    -- if (i < |l*{l}|)
-
-  ;; 6-reduction.watsup:77.1-79.18
-  rule br_table-ge {i : nat, l* : labelidx*, l' : labelidx}:
-    `%`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')])
-    -- if (i >= |l*{l}|)
-
-  ;; 6-reduction.watsup:100.1-101.35
-  rule frame-vals {f : frame, n : n, val^n : val^n}:
-    `%`([FRAME__admininstr(n, f, (val <: admininstr)^n{val})])
-    -- if (|val^n{val}| = n)
-
-  ;; 6-reduction.watsup:103.1-104.55
-  rule return-frame {f : frame, instr* : instr*, n : n, val^n : val^n, val'* : val*}:
-    `%`([FRAME__admininstr(n, f, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})])
-    -- if (|val^n{val}| = n)
-
-  ;; 6-reduction.watsup:106.1-107.60
-  rule return-label {instr* : instr*, instr'* : instr*, k : nat, val* : val*}:
-    `%`([LABEL__admininstr(k, instr'*{instr'}, (val <: admininstr)*{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})])
-
-  ;; 6-reduction.watsup:110.1-112.33
-  rule unop-val {c : c_numtype, c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
-    `%`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)])
-    -- if ($unop(unop, nt, c_1) = [c])
-
-  ;; 6-reduction.watsup:114.1-116.39
-  rule unop-trap {c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
-    `%`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)])
-    -- if ($unop(unop, nt, c_1) = [])
-
-  ;; 6-reduction.watsup:119.1-121.40
-  rule binop-val {binop : binop_numtype, c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
-    `%`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)])
-    -- if ($binop(binop, nt, c_1, c_2) = [c])
-
-  ;; 6-reduction.watsup:123.1-125.46
-  rule binop-trap {binop : binop_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
-    `%`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)])
-    -- if ($binop(binop, nt, c_1, c_2) = [])
-
-  ;; 6-reduction.watsup:128.1-130.37
-  rule testop {c : c_numtype, c_1 : c_numtype, nt : numtype, testop : testop_numtype}:
-    `%`([CONST_admininstr(nt, c_1) TESTOP_admininstr(nt, testop)])
-    -- if (c = $testop(testop, nt, c_1))
-
-  ;; 6-reduction.watsup:132.1-134.40
-  rule relop {c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype, relop : relop_numtype}:
-    `%`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) RELOP_admininstr(nt, relop)])
-    -- if (c = $relop(relop, nt, c_1, c_2))
-
-  ;; 6-reduction.watsup:137.1-138.70
-  rule extend {c : c_numtype, n : n, nt : numtype}:
-    `%`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)])
-    -- if ($size(nt <: valtype) =/= ?())
-
-  ;; 6-reduction.watsup:141.1-143.48
-  rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
-    `%`([CONST_admininstr(nt, c_1) CVTOP_admininstr(nt_1, cvtop, nt_2, sx?{sx})])
-    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [c])
-
-  ;; 6-reduction.watsup:145.1-147.54
-  rule cvtop-trap {c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
-    `%`([CONST_admininstr(nt, c_1) CVTOP_admininstr(nt_1, cvtop, nt_2, sx?{sx})])
-    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [])
-
   ;; 6-reduction.watsup:154.1-156.28
   rule ref.is_null-true {rt : reftype, val : val}:
     `%`([(val <: admininstr) REF.IS_NULL_admininstr])
@@ -8308,11 +8168,6 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
 ;; 6-reduction.watsup:90.1-92.15
 relation Step_read_before_call_indirect-trap: `%`(config)
-  ;; 6-reduction.watsup:82.1-83.47
-  rule call {x : idx, z : state}:
-    `%`(`%;%*`(z, [CALL_admininstr(x)]))
-    -- if (x < |$funcaddr(z)|)
-
   ;; 6-reduction.watsup:85.1-88.34
   rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
@@ -8323,72 +8178,6 @@ relation Step_read_before_call_indirect-trap: `%`(config)
 
 ;; 6-reduction.watsup:213.1-216.14
 relation Step_read_before_table.fill-zero: `%`(config)
-  ;; 6-reduction.watsup:82.1-83.47
-  rule call {x : idx, z : state}:
-    `%`(`%;%*`(z, [CALL_admininstr(x)]))
-    -- if (x < |$funcaddr(z)|)
-
-  ;; 6-reduction.watsup:85.1-88.34
-  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-    -- if (i < |$table(z, x)|)
-    -- if (a < |$funcinst(z)|)
-    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
-    -- if ($funcinst(z)[a] = `%;%`(m, func))
-
-  ;; 6-reduction.watsup:90.1-92.15
-  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-    -- unless Step_read_before_call_indirect-trap: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-
-  ;; 6-reduction.watsup:94.1-97.52
-  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
-    `%`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]))
-    -- if (a < |$funcinst(z)|)
-    -- if (|t_1^k{t_1}| = k)
-    -- if (|t_2^n{t_2}| = n)
-    -- if (|val^k{val}| = k)
-    -- (if ($default_(t) =/= ?()))*{t}
-    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
-    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
-
-  ;; 6-reduction.watsup:150.1-151.53
-  rule ref.func {x : idx, z : state}:
-    `%`(`%;%*`(z, [REF.FUNC_admininstr(x)]))
-    -- if (x < |$funcaddr(z)|)
-
-  ;; 6-reduction.watsup:163.1-164.37
-  rule local.get {x : idx, z : state}:
-    `%`(`%;%*`(z, [LOCAL.GET_admininstr(x)]))
-
-  ;; 6-reduction.watsup:173.1-174.39
-  rule global.get {x : idx, z : state}:
-    `%`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]))
-
-  ;; 6-reduction.watsup:180.1-182.28
-  rule table.get-trap {i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
-    -- if (i >= |$table(z, x)|)
-
-  ;; 6-reduction.watsup:184.1-186.27
-  rule table.get-val {i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
-    -- if (i < |$table(z, x)|)
-
-  ;; 6-reduction.watsup:188.1-190.28
-  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]))
-    -- if (i >= |$table(z, x)|)
-
-  ;; 6-reduction.watsup:197.1-199.27
-  rule table.size {n : n, x : idx, z : state}:
-    `%`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]))
-    -- if (|$table(z, x)| = n)
-
-  ;; 6-reduction.watsup:205.1-206.57
-  rule table.grow-fail {n : n, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]))
-
   ;; 6-reduction.watsup:209.1-211.34
   rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
@@ -8396,596 +8185,76 @@ relation Step_read_before_table.fill-zero: `%`(config)
 
 ;; 6-reduction.watsup:218.1-222.15
 relation Step_read_before_table.fill-succ: `%`(config)
-  ;; 6-reduction.watsup:82.1-83.47
-  rule call {x : idx, z : state}:
-    `%`(`%;%*`(z, [CALL_admininstr(x)]))
-    -- if (x < |$funcaddr(z)|)
-
-  ;; 6-reduction.watsup:85.1-88.34
-  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-    -- if (i < |$table(z, x)|)
-    -- if (a < |$funcinst(z)|)
-    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
-    -- if ($funcinst(z)[a] = `%;%`(m, func))
-
-  ;; 6-reduction.watsup:90.1-92.15
-  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-    -- unless Step_read_before_call_indirect-trap: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-
-  ;; 6-reduction.watsup:94.1-97.52
-  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
-    `%`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]))
-    -- if (a < |$funcinst(z)|)
-    -- if (|t_1^k{t_1}| = k)
-    -- if (|t_2^n{t_2}| = n)
-    -- if (|val^k{val}| = k)
-    -- (if ($default_(t) =/= ?()))*{t}
-    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
-    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
-
-  ;; 6-reduction.watsup:150.1-151.53
-  rule ref.func {x : idx, z : state}:
-    `%`(`%;%*`(z, [REF.FUNC_admininstr(x)]))
-    -- if (x < |$funcaddr(z)|)
-
-  ;; 6-reduction.watsup:163.1-164.37
-  rule local.get {x : idx, z : state}:
-    `%`(`%;%*`(z, [LOCAL.GET_admininstr(x)]))
-
-  ;; 6-reduction.watsup:173.1-174.39
-  rule global.get {x : idx, z : state}:
-    `%`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]))
-
-  ;; 6-reduction.watsup:180.1-182.28
-  rule table.get-trap {i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
-    -- if (i >= |$table(z, x)|)
-
-  ;; 6-reduction.watsup:184.1-186.27
-  rule table.get-val {i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
-    -- if (i < |$table(z, x)|)
-
-  ;; 6-reduction.watsup:188.1-190.28
-  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]))
-    -- if (i >= |$table(z, x)|)
-
-  ;; 6-reduction.watsup:197.1-199.27
-  rule table.size {n : n, x : idx, z : state}:
-    `%`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]))
-    -- if (|$table(z, x)| = n)
-
-  ;; 6-reduction.watsup:205.1-206.57
-  rule table.grow-fail {n : n, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]))
-
-  ;; 6-reduction.watsup:209.1-211.34
-  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- if ((i + n) > |$table(z, x)|)
-
   ;; 6-reduction.watsup:213.1-216.14
   rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
     -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
     -- if (n = 0)
 
+  ;; 6-reduction.watsup:209.1-211.34
+  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- if ((i + n) > |$table(z, x)|)
+
 ;; 6-reduction.watsup:229.1-232.14
 relation Step_read_before_table.copy-zero: `%`(config)
-  ;; 6-reduction.watsup:82.1-83.47
-  rule call {x : idx, z : state}:
-    `%`(`%;%*`(z, [CALL_admininstr(x)]))
-    -- if (x < |$funcaddr(z)|)
-
-  ;; 6-reduction.watsup:85.1-88.34
-  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-    -- if (i < |$table(z, x)|)
-    -- if (a < |$funcinst(z)|)
-    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
-    -- if ($funcinst(z)[a] = `%;%`(m, func))
-
-  ;; 6-reduction.watsup:90.1-92.15
-  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-    -- unless Step_read_before_call_indirect-trap: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-
-  ;; 6-reduction.watsup:94.1-97.52
-  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
-    `%`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]))
-    -- if (a < |$funcinst(z)|)
-    -- if (|t_1^k{t_1}| = k)
-    -- if (|t_2^n{t_2}| = n)
-    -- if (|val^k{val}| = k)
-    -- (if ($default_(t) =/= ?()))*{t}
-    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
-    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
-
-  ;; 6-reduction.watsup:150.1-151.53
-  rule ref.func {x : idx, z : state}:
-    `%`(`%;%*`(z, [REF.FUNC_admininstr(x)]))
-    -- if (x < |$funcaddr(z)|)
-
-  ;; 6-reduction.watsup:163.1-164.37
-  rule local.get {x : idx, z : state}:
-    `%`(`%;%*`(z, [LOCAL.GET_admininstr(x)]))
-
-  ;; 6-reduction.watsup:173.1-174.39
-  rule global.get {x : idx, z : state}:
-    `%`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]))
-
-  ;; 6-reduction.watsup:180.1-182.28
-  rule table.get-trap {i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
-    -- if (i >= |$table(z, x)|)
-
-  ;; 6-reduction.watsup:184.1-186.27
-  rule table.get-val {i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
-    -- if (i < |$table(z, x)|)
-
-  ;; 6-reduction.watsup:188.1-190.28
-  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]))
-    -- if (i >= |$table(z, x)|)
-
-  ;; 6-reduction.watsup:197.1-199.27
-  rule table.size {n : n, x : idx, z : state}:
-    `%`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]))
-    -- if (|$table(z, x)| = n)
-
-  ;; 6-reduction.watsup:205.1-206.57
-  rule table.grow-fail {n : n, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]))
-
-  ;; 6-reduction.watsup:209.1-211.34
-  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- if ((i + n) > |$table(z, x)|)
-
-  ;; 6-reduction.watsup:213.1-216.14
-  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- if (n = 0)
-
-  ;; 6-reduction.watsup:218.1-222.15
-  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- unless Step_read_before_table.fill-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-
-  ;; 6-reduction.watsup:225.1-227.63
-  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
-    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+  ;; 6-reduction.watsup:225.1-227.63
+  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
 
 ;; 6-reduction.watsup:234.1-239.15
 relation Step_read_before_table.copy-le: `%`(config)
-  ;; 6-reduction.watsup:82.1-83.47
-  rule call {x : idx, z : state}:
-    `%`(`%;%*`(z, [CALL_admininstr(x)]))
-    -- if (x < |$funcaddr(z)|)
-
-  ;; 6-reduction.watsup:85.1-88.34
-  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-    -- if (i < |$table(z, x)|)
-    -- if (a < |$funcinst(z)|)
-    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
-    -- if ($funcinst(z)[a] = `%;%`(m, func))
-
-  ;; 6-reduction.watsup:90.1-92.15
-  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-    -- unless Step_read_before_call_indirect-trap: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-
-  ;; 6-reduction.watsup:94.1-97.52
-  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
-    `%`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]))
-    -- if (a < |$funcinst(z)|)
-    -- if (|t_1^k{t_1}| = k)
-    -- if (|t_2^n{t_2}| = n)
-    -- if (|val^k{val}| = k)
-    -- (if ($default_(t) =/= ?()))*{t}
-    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
-    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
-
-  ;; 6-reduction.watsup:150.1-151.53
-  rule ref.func {x : idx, z : state}:
-    `%`(`%;%*`(z, [REF.FUNC_admininstr(x)]))
-    -- if (x < |$funcaddr(z)|)
-
-  ;; 6-reduction.watsup:163.1-164.37
-  rule local.get {x : idx, z : state}:
-    `%`(`%;%*`(z, [LOCAL.GET_admininstr(x)]))
-
-  ;; 6-reduction.watsup:173.1-174.39
-  rule global.get {x : idx, z : state}:
-    `%`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]))
-
-  ;; 6-reduction.watsup:180.1-182.28
-  rule table.get-trap {i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
-    -- if (i >= |$table(z, x)|)
-
-  ;; 6-reduction.watsup:184.1-186.27
-  rule table.get-val {i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
-    -- if (i < |$table(z, x)|)
-
-  ;; 6-reduction.watsup:188.1-190.28
-  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]))
-    -- if (i >= |$table(z, x)|)
-
-  ;; 6-reduction.watsup:197.1-199.27
-  rule table.size {n : n, x : idx, z : state}:
-    `%`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]))
-    -- if (|$table(z, x)| = n)
-
-  ;; 6-reduction.watsup:205.1-206.57
-  rule table.grow-fail {n : n, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]))
-
-  ;; 6-reduction.watsup:209.1-211.34
-  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- if ((i + n) > |$table(z, x)|)
-
-  ;; 6-reduction.watsup:213.1-216.14
-  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- if (n = 0)
-
-  ;; 6-reduction.watsup:218.1-222.15
-  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- unless Step_read_before_table.fill-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-
-  ;; 6-reduction.watsup:225.1-227.63
-  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
-    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
-
   ;; 6-reduction.watsup:229.1-232.14
   rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- unless Step_read_before_table.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- if (n = 0)
 
-;; 6-reduction.watsup:241.1-245.15
-relation Step_read_before_table.copy-gt: `%`(config)
-  ;; 6-reduction.watsup:82.1-83.47
-  rule call {x : idx, z : state}:
-    `%`(`%;%*`(z, [CALL_admininstr(x)]))
-    -- if (x < |$funcaddr(z)|)
-
-  ;; 6-reduction.watsup:85.1-88.34
-  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-    -- if (i < |$table(z, x)|)
-    -- if (a < |$funcinst(z)|)
-    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
-    -- if ($funcinst(z)[a] = `%;%`(m, func))
-
-  ;; 6-reduction.watsup:90.1-92.15
-  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-    -- unless Step_read_before_call_indirect-trap: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-
-  ;; 6-reduction.watsup:94.1-97.52
-  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
-    `%`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]))
-    -- if (a < |$funcinst(z)|)
-    -- if (|t_1^k{t_1}| = k)
-    -- if (|t_2^n{t_2}| = n)
-    -- if (|val^k{val}| = k)
-    -- (if ($default_(t) =/= ?()))*{t}
-    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
-    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
-
-  ;; 6-reduction.watsup:150.1-151.53
-  rule ref.func {x : idx, z : state}:
-    `%`(`%;%*`(z, [REF.FUNC_admininstr(x)]))
-    -- if (x < |$funcaddr(z)|)
-
-  ;; 6-reduction.watsup:163.1-164.37
-  rule local.get {x : idx, z : state}:
-    `%`(`%;%*`(z, [LOCAL.GET_admininstr(x)]))
-
-  ;; 6-reduction.watsup:173.1-174.39
-  rule global.get {x : idx, z : state}:
-    `%`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]))
-
-  ;; 6-reduction.watsup:180.1-182.28
-  rule table.get-trap {i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
-    -- if (i >= |$table(z, x)|)
-
-  ;; 6-reduction.watsup:184.1-186.27
-  rule table.get-val {i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
-    -- if (i < |$table(z, x)|)
-
-  ;; 6-reduction.watsup:188.1-190.28
-  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]))
-    -- if (i >= |$table(z, x)|)
-
-  ;; 6-reduction.watsup:197.1-199.27
-  rule table.size {n : n, x : idx, z : state}:
-    `%`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]))
-    -- if (|$table(z, x)| = n)
-
-  ;; 6-reduction.watsup:205.1-206.57
-  rule table.grow-fail {n : n, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]))
-
-  ;; 6-reduction.watsup:209.1-211.34
-  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- if ((i + n) > |$table(z, x)|)
-
-  ;; 6-reduction.watsup:213.1-216.14
-  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- if (n = 0)
-
-  ;; 6-reduction.watsup:218.1-222.15
-  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- unless Step_read_before_table.fill-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-
   ;; 6-reduction.watsup:225.1-227.63
   rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
 
-  ;; 6-reduction.watsup:229.1-232.14
-  rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
-    -- unless Step_read_before_table.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
-    -- if (n = 0)
-
+;; 6-reduction.watsup:241.1-245.15
+relation Step_read_before_table.copy-gt: `%`(config)
   ;; 6-reduction.watsup:234.1-239.15
   rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- unless Step_read_before_table.copy-le: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- if (j <= i)
 
-;; 6-reduction.watsup:252.1-255.14
-relation Step_read_before_table.init-zero: `%`(config)
-  ;; 6-reduction.watsup:82.1-83.47
-  rule call {x : idx, z : state}:
-    `%`(`%;%*`(z, [CALL_admininstr(x)]))
-    -- if (x < |$funcaddr(z)|)
-
-  ;; 6-reduction.watsup:85.1-88.34
-  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-    -- if (i < |$table(z, x)|)
-    -- if (a < |$funcinst(z)|)
-    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
-    -- if ($funcinst(z)[a] = `%;%`(m, func))
-
-  ;; 6-reduction.watsup:90.1-92.15
-  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-    -- unless Step_read_before_call_indirect-trap: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-
-  ;; 6-reduction.watsup:94.1-97.52
-  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
-    `%`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]))
-    -- if (a < |$funcinst(z)|)
-    -- if (|t_1^k{t_1}| = k)
-    -- if (|t_2^n{t_2}| = n)
-    -- if (|val^k{val}| = k)
-    -- (if ($default_(t) =/= ?()))*{t}
-    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
-    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
-
-  ;; 6-reduction.watsup:150.1-151.53
-  rule ref.func {x : idx, z : state}:
-    `%`(`%;%*`(z, [REF.FUNC_admininstr(x)]))
-    -- if (x < |$funcaddr(z)|)
-
-  ;; 6-reduction.watsup:163.1-164.37
-  rule local.get {x : idx, z : state}:
-    `%`(`%;%*`(z, [LOCAL.GET_admininstr(x)]))
-
-  ;; 6-reduction.watsup:173.1-174.39
-  rule global.get {x : idx, z : state}:
-    `%`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]))
-
-  ;; 6-reduction.watsup:180.1-182.28
-  rule table.get-trap {i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
-    -- if (i >= |$table(z, x)|)
-
-  ;; 6-reduction.watsup:184.1-186.27
-  rule table.get-val {i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
-    -- if (i < |$table(z, x)|)
-
-  ;; 6-reduction.watsup:188.1-190.28
-  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]))
-    -- if (i >= |$table(z, x)|)
-
-  ;; 6-reduction.watsup:197.1-199.27
-  rule table.size {n : n, x : idx, z : state}:
-    `%`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]))
-    -- if (|$table(z, x)| = n)
-
-  ;; 6-reduction.watsup:205.1-206.57
-  rule table.grow-fail {n : n, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]))
-
-  ;; 6-reduction.watsup:209.1-211.34
-  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- if ((i + n) > |$table(z, x)|)
-
-  ;; 6-reduction.watsup:213.1-216.14
-  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- if (n = 0)
-
-  ;; 6-reduction.watsup:218.1-222.15
-  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- unless Step_read_before_table.fill-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-
-  ;; 6-reduction.watsup:225.1-227.63
-  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
-    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
-
   ;; 6-reduction.watsup:229.1-232.14
   rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- unless Step_read_before_table.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- if (n = 0)
 
-  ;; 6-reduction.watsup:234.1-239.15
-  rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
-    -- unless Step_read_before_table.copy-le: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
-    -- if (j <= i)
-
-  ;; 6-reduction.watsup:241.1-245.15
-  rule table.copy-gt {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
-    -- unless Step_read_before_table.copy-gt: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
-
-  ;; 6-reduction.watsup:248.1-250.62
-  rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
-    -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
-
-;; 6-reduction.watsup:257.1-261.15
-relation Step_read_before_table.init-succ: `%`(config)
-  ;; 6-reduction.watsup:82.1-83.47
-  rule call {x : idx, z : state}:
-    `%`(`%;%*`(z, [CALL_admininstr(x)]))
-    -- if (x < |$funcaddr(z)|)
-
-  ;; 6-reduction.watsup:85.1-88.34
-  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-    -- if (i < |$table(z, x)|)
-    -- if (a < |$funcinst(z)|)
-    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
-    -- if ($funcinst(z)[a] = `%;%`(m, func))
-
-  ;; 6-reduction.watsup:90.1-92.15
-  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-    -- unless Step_read_before_call_indirect-trap: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
-
-  ;; 6-reduction.watsup:94.1-97.52
-  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
-    `%`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]))
-    -- if (a < |$funcinst(z)|)
-    -- if (|t_1^k{t_1}| = k)
-    -- if (|t_2^n{t_2}| = n)
-    -- if (|val^k{val}| = k)
-    -- (if ($default_(t) =/= ?()))*{t}
-    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
-    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
-
-  ;; 6-reduction.watsup:150.1-151.53
-  rule ref.func {x : idx, z : state}:
-    `%`(`%;%*`(z, [REF.FUNC_admininstr(x)]))
-    -- if (x < |$funcaddr(z)|)
-
-  ;; 6-reduction.watsup:163.1-164.37
-  rule local.get {x : idx, z : state}:
-    `%`(`%;%*`(z, [LOCAL.GET_admininstr(x)]))
-
-  ;; 6-reduction.watsup:173.1-174.39
-  rule global.get {x : idx, z : state}:
-    `%`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]))
-
-  ;; 6-reduction.watsup:180.1-182.28
-  rule table.get-trap {i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
-    -- if (i >= |$table(z, x)|)
-
-  ;; 6-reduction.watsup:184.1-186.27
-  rule table.get-val {i : nat, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]))
-    -- if (i < |$table(z, x)|)
-
-  ;; 6-reduction.watsup:188.1-190.28
-  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]))
-    -- if (i >= |$table(z, x)|)
-
-  ;; 6-reduction.watsup:197.1-199.27
-  rule table.size {n : n, x : idx, z : state}:
-    `%`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]))
-    -- if (|$table(z, x)| = n)
-
-  ;; 6-reduction.watsup:205.1-206.57
-  rule table.grow-fail {n : n, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]))
-
-  ;; 6-reduction.watsup:209.1-211.34
-  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- if ((i + n) > |$table(z, x)|)
-
-  ;; 6-reduction.watsup:213.1-216.14
-  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- if (n = 0)
-
-  ;; 6-reduction.watsup:218.1-222.15
-  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- unless Step_read_before_table.fill-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-
   ;; 6-reduction.watsup:225.1-227.63
   rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
 
-  ;; 6-reduction.watsup:229.1-232.14
-  rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
-    -- unless Step_read_before_table.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
-    -- if (n = 0)
-
-  ;; 6-reduction.watsup:234.1-239.15
-  rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
-    -- unless Step_read_before_table.copy-le: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
-    -- if (j <= i)
-
-  ;; 6-reduction.watsup:241.1-245.15
-  rule table.copy-gt {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
-    -- unless Step_read_before_table.copy-gt: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
-
+;; 6-reduction.watsup:252.1-255.14
+relation Step_read_before_table.init-zero: `%`(config)
   ;; 6-reduction.watsup:248.1-250.62
   rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
     -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
 
+;; 6-reduction.watsup:257.1-261.15
+relation Step_read_before_table.init-succ: `%`(config)
   ;; 6-reduction.watsup:252.1-255.14
   rule table.init-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
     -- unless Step_read_before_table.init-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
     -- if (n = 0)
 
+  ;; 6-reduction.watsup:248.1-250.62
+  rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
+    -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
 ;; 6-reduction.watsup:5.1-5.63
 relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:82.1-83.47

From e9b2979f22b2dfb543bf6a49424ba2cf9271c925 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sun, 9 Apr 2023 22:07:13 +0200
Subject: [PATCH 67/98] Eta-contract some lamdas

---
 spectec/src/backend-lean4/gen.ml | 17 +++++++++++------
 spectec/test-lean4/TEST.md       | 26 +++++++++++++-------------
 2 files changed, 24 insertions(+), 19 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index c0d8e22cb1..a0f663b639 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -5,11 +5,11 @@ let include_input = false
 let parens s = "(" ^ s ^ ")"
 let brackets s = "[" ^ s ^ "]"
 let braces s = "{" ^ s ^ "}"
-let ($$) s1 s2 = parens (s1 ^ " " ^ s2)
+let ($$$) s1 ss = parens (String.concat " " (s1 :: ss))
+let ($$) s1 s2 = s1 $$$ [s2]
 let render_tuple how tys = parens (String.concat ", " (List.map how tys))
 let render_list how tys = brackets (String.concat ", " (List.map how tys))
 
-
 (* let render_rec_con (id : id) = "Mk" ^ render_type_name id *)
 
 let is_reserved = function
@@ -116,14 +116,14 @@ let rec render_exp (exp : exp) = match exp.it with
       | (List|List1|ListN _), [] ->
         "[" ^ render_exp e ^ "]"
       | (List|List1|ListN _), [v] ->
-        "(List.map (λ " ^ render_id v ^ " ↦ " ^ render_exp e ^ ") " ^ render_id v ^ ")"
+        "List.map" $$$ [render_lam v e; render_id v]
       | (List|List1|ListN _), [v1; v2] ->
-        "(List.zipWith (λ " ^ render_id v1 ^ " " ^ render_id v2 ^ " ↦ " ^ render_exp e ^ ") " ^ render_id v1 ^ " " ^ render_id v2 ^ ")"
+        "List.zipWith" $$$ [ "(λ " ^ render_id v1 ^ " " ^ render_id v2 ^ " ↦ " ^ render_exp e ^ ")"; render_id v1; render_id v2 ]
       | Opt, [] -> "some" $$ render_exp e
       | Opt, [v] ->
-        "(Option.map (λ " ^ render_id v ^ " ↦ " ^ render_exp e ^ ") " ^ render_id v ^ ")"
+        "Option.map" $$$ [render_lam v e; render_id v]
       | Opt, [v1; v2] ->
-        "(Option.zipWith (λ " ^ render_id v1 ^ " " ^ render_id v2 ^ " ↦ " ^ render_exp e ^ ") " ^ render_id v1 ^ " " ^ render_id v2 ^ ")"
+        "Option.zipWith" $$$ [ "(λ " ^ render_id v1 ^ " " ^ render_id v2 ^ " ↦ " ^ render_exp e ^ ")"; render_id v1; render_id v2 ]
       | _, _ ->
       render_exp e ^ " /- " ^ Il.Print.string_of_iterexp (iter, vs) ^ " -/"
   end
@@ -158,6 +158,11 @@ and render_case a e typ =
     then render_con_name' true typ a
     else render_con_name' true typ a $$ render_exp e
 
+and render_lam v e = match e.it with
+  | CallE (f, {it = VarE v2;_}) when v.it = v2.it -> render_fun_id f
+  | SubE ({it = VarE v2;_}, typ1, typ2) when v.it = v2.it -> render_variant_inj' typ2 typ1
+  | _ -> "(λ " ^ render_id v ^ " ↦ " ^ render_exp e ^ ")"
+
 let render_clause (_id : id) (clause : clause) = match clause.it with
   | DefD (_binds, lhs, rhs, premise) ->
    (if premise <> [] then "-- Premises ignored! \n" else "") ^
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/TEST.md
index 3d0b49ff3a..602ed75a73 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/TEST.md
@@ -1138,13 +1138,13 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (t_2.length == n) ->
     (val.length == k) ->
     (bt == (t_1, t_2)) ->
-    (Step_pure (((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.BLOCK (bt, instr))]), [(Admininstr.LABEL_ (n, [], ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr))))]))
+    (Step_pure (((List.map «$admininstr_val» val) ++ [(Admininstr.BLOCK (bt, instr))]), [(Admininstr.LABEL_ (n, [], ((List.map «$admininstr_val» val) ++ (List.map «$admininstr_instr» instr))))]))
   | loop (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
     (t_1.length == k) ->
     (t_2.length == n) ->
     (val.length == k) ->
     (bt == (t_1, t_2)) ->
-    (Step_pure (((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.LOOP (bt, instr))]), [(Admininstr.LABEL_ (n, [(Instr.LOOP (bt, instr))], ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr))))]))
+    (Step_pure (((List.map «$admininstr_val» val) ++ [(Admininstr.LOOP (bt, instr))]), [(Admininstr.LABEL_ (n, [(Instr.LOOP (bt, instr))], ((List.map «$admininstr_val» val) ++ (List.map «$admininstr_instr» instr))))]))
   | if_true (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) :
     (c != 0) ->
     (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.IF (bt, instr_1, instr_2))], [(Admininstr.BLOCK (bt, instr_1))]))
@@ -1152,12 +1152,12 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (c == 0) ->
     (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.IF (bt, instr_1, instr_2))], [(Admininstr.BLOCK (bt, instr_2))]))
   | label_vals (instr : (List Instr)) (n : N) (val : (List Val)) :
-    (Step_pure ([(Admininstr.LABEL_ (n, instr, (List.map (λ val ↦ («$admininstr_val» val)) val)))], (List.map (λ val ↦ («$admininstr_val» val)) val)))
+    (Step_pure ([(Admininstr.LABEL_ (n, instr, (List.map «$admininstr_val» val)))], (List.map «$admininstr_val» val)))
   | br_zero (instr : (List Instr)) (instr' : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) :
     (val.length == n) ->
-    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((List.map (λ val' ↦ («$admininstr_val» val')) val') ++ ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([(Admininstr.BR 0)] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr))))))], ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ (List.map (λ instr' ↦ («$admininstr_instr» instr')) instr'))))
+    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((List.map «$admininstr_val» val') ++ ((List.map «$admininstr_val» val) ++ ([(Admininstr.BR 0)] ++ (List.map «$admininstr_instr» instr))))))], ((List.map «$admininstr_val» val) ++ (List.map «$admininstr_instr» instr'))))
   | br_succ (instr : (List Instr)) (instr' : (List Instr)) (l : Labelidx) (n : N) (val : (List Val)) :
-    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([(Admininstr.BR (l + 1))] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)))))], ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.BR l)])))
+    (Step_pure ([(Admininstr.LABEL_ (n, instr', ((List.map «$admininstr_val» val) ++ ([(Admininstr.BR (l + 1))] ++ (List.map «$admininstr_instr» instr)))))], ((List.map «$admininstr_val» val) ++ [(Admininstr.BR l)])))
   | br_if_true (c : C_numtype) (l : Labelidx) :
     (c != 0) ->
     (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.BR_IF l)], [(Admininstr.BR l)]))
@@ -1172,12 +1172,12 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (Step_pure ([(Admininstr.CONST (Numtype.I32, i)), (Admininstr.BR_TABLE (l, l'))], [(Admininstr.BR l')]))
   | frame_vals (f : Frame) (n : N) (val : (List Val)) :
     (val.length == n) ->
-    (Step_pure ([(Admininstr.FRAME_ (n, f, (List.map (λ val ↦ («$admininstr_val» val)) val)))], (List.map (λ val ↦ («$admininstr_val» val)) val)))
+    (Step_pure ([(Admininstr.FRAME_ (n, f, (List.map «$admininstr_val» val)))], (List.map «$admininstr_val» val)))
   | return_frame (f : Frame) (instr : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) :
     (val.length == n) ->
-    (Step_pure ([(Admininstr.FRAME_ (n, f, ((List.map (λ val' ↦ («$admininstr_val» val')) val') ++ ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([Admininstr.RETURN] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr))))))], (List.map (λ val ↦ («$admininstr_val» val)) val)))
+    (Step_pure ([(Admininstr.FRAME_ (n, f, ((List.map «$admininstr_val» val') ++ ((List.map «$admininstr_val» val) ++ ([Admininstr.RETURN] ++ (List.map «$admininstr_instr» instr))))))], (List.map «$admininstr_val» val)))
   | return_label (instr : (List Instr)) (instr' : (List Instr)) (k : Nat) (val : (List Val)) :
-    (Step_pure ([(Admininstr.LABEL_ (k, instr', ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ ([Admininstr.RETURN] ++ (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)))))], ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [Admininstr.RETURN])))
+    (Step_pure ([(Admininstr.LABEL_ (k, instr', ((List.map «$admininstr_val» val) ++ ([Admininstr.RETURN] ++ (List.map «$admininstr_instr» instr)))))], ((List.map «$admininstr_val» val) ++ [Admininstr.RETURN])))
   | unop_val (c : C_numtype) (c_1 : C_numtype) (nt : Numtype) (unop : Unop_numtype) :
     ((«$unop» (unop, nt, c_1)) == [c]) ->
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.UNOP (nt, unop))], [(Admininstr.CONST (nt, c))]))
@@ -1298,7 +1298,7 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (Forall (λ t ↦ ((«$default_» t) != none)) t) ->
     (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
     (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->
-    (Step_read ((z, ((List.map (λ val ↦ («$admininstr_val» val)) val) ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, f, [(Admininstr.LABEL_ (n, [], (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)))]))]))
+    (Step_read ((z, ((List.map «$admininstr_val» val) ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, f, [(Admininstr.LABEL_ (n, [], (List.map «$admininstr_instr» instr)))]))]))
   | ref_func (x : Idx) (z : State) :
     (x < («$funcaddr» z).length) ->
     (Step_read ((z, [(Admininstr.REF_FUNC x)]), [(Admininstr.REF_FUNC_ADDR ((«$funcaddr» z).get! x))]))
@@ -1358,11 +1358,11 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
 
 inductive Step : (Config × Config) -> Prop where
   | pure (instr : (List Instr)) (instr' : (List Instr)) (z : State) :
-    (Step_pure ((List.map (λ instr ↦ («$admininstr_instr» instr)) instr), (List.map (λ instr' ↦ («$admininstr_instr» instr')) instr'))) ->
-    (Step ((z, (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)), (z, (List.map (λ instr' ↦ («$admininstr_instr» instr')) instr'))))
+    (Step_pure ((List.map «$admininstr_instr» instr), (List.map «$admininstr_instr» instr'))) ->
+    (Step ((z, (List.map «$admininstr_instr» instr)), (z, (List.map «$admininstr_instr» instr'))))
   | read (instr : (List Instr)) (instr' : (List Instr)) (z : State) :
-    (Step_read ((z, (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)), (List.map (λ instr' ↦ («$admininstr_instr» instr')) instr'))) ->
-    (Step ((z, (List.map (λ instr ↦ («$admininstr_instr» instr)) instr)), (z, (List.map (λ instr' ↦ («$admininstr_instr» instr')) instr'))))
+    (Step_read ((z, (List.map «$admininstr_instr» instr)), (List.map «$admininstr_instr» instr'))) ->
+    (Step ((z, (List.map «$admininstr_instr» instr)), (z, (List.map «$admininstr_instr» instr'))))
   | local_set (val : Val) (x : Idx) (z : State) :
     (Step ((z, [(«$admininstr_val» val), (Admininstr.LOCAL_SET x)]), ((«$with_local» (z, x, val)), [])))
   | global_set (val : Val) (x : Idx) (z : State) :

From cef6357815957c7308c19790384958b0faf239e9 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sun, 9 Apr 2023 22:26:52 +0200
Subject: [PATCH 68/98] Improve backend tests, so that golden value is a file
 of its own

---
 spectec/test-haskell/SpecTec.hs              | 668 ++++++++++++++
 spectec/test-haskell/dune                    |  20 +-
 spectec/test-lean4/{TEST.md => SpecTec.lean} | 875 +++++++++----------
 spectec/test-lean4/dune                      |  20 +-
 4 files changed, 1136 insertions(+), 447 deletions(-)
 create mode 100644 spectec/test-haskell/SpecTec.hs
 rename spectec/test-lean4/{TEST.md => SpecTec.lean} (78%)

diff --git a/spectec/test-haskell/SpecTec.hs b/spectec/test-haskell/SpecTec.hs
new file mode 100644
index 0000000000..603b81a667
--- /dev/null
+++ b/spectec/test-haskell/SpecTec.hs
@@ -0,0 +1,668 @@
+{-# LANGUAGE OverloadedRecordDot #-}
+{-# LANGUAGE DuplicateRecordFields #-}
+module Test where
+import Prelude (Bool, String, undefined, error, Maybe, fromIntegral, (+), (!!))
+import Numeric.Natural (Natural)
+type N = Natural
+
+type Name = String
+
+type Byte = Natural
+
+type U32 = Natural
+
+type Idx = Natural
+
+type Funcidx = Idx
+
+type Globalidx = Idx
+
+type Tableidx = Idx
+
+type Memidx = Idx
+
+type Elemidx = Idx
+
+type Dataidx = Idx
+
+type Labelidx = Idx
+
+type Localidx = Idx
+
+data Numtype
+ = Numtype_I32
+ | Numtype_I64
+ | Numtype_F32
+ | Numtype_F64
+
+data Vectype
+ = Vectype_V128
+
+data Reftype
+ = Reftype_FUNCREF
+ | Reftype_EXTERNREF
+
+data Valtype
+ = Valtype_I32
+ | Valtype_I64
+ | Valtype_F32
+ | Valtype_F64
+ | Valtype_V128
+ | Valtype_FUNCREF
+ | Valtype_EXTERNREF
+ | Valtype_BOT
+
+valtype_numtype :: Numtype -> Valtype
+valtype_numtype Numtype_I32 = Valtype_I32
+valtype_numtype Numtype_I64 = Valtype_I64
+valtype_numtype Numtype_F32 = Valtype_F32
+valtype_numtype Numtype_F64 = Valtype_F64
+
+valtype_vectype :: Vectype -> Valtype
+valtype_vectype Vectype_V128 = Valtype_V128
+
+valtype_reftype :: Reftype -> Valtype
+valtype_reftype Reftype_FUNCREF = Valtype_FUNCREF
+valtype_reftype Reftype_EXTERNREF = Valtype_EXTERNREF
+
+data In
+ = In_I32
+ | In_I64
+
+numtype_in :: In -> Numtype
+numtype_in In_I32 = Numtype_I32
+numtype_in In_I64 = Numtype_I64
+
+valtype_in :: In -> Valtype
+valtype_in In_I32 = Valtype_I32
+valtype_in In_I64 = Valtype_I64
+
+data Fn
+ = Fn_F32
+ | Fn_F64
+
+numtype_fn :: Fn -> Numtype
+numtype_fn Fn_F32 = Numtype_F32
+numtype_fn Fn_F64 = Numtype_F64
+
+valtype_fn :: Fn -> Valtype
+valtype_fn Fn_F32 = Valtype_F32
+valtype_fn Fn_F64 = Valtype_F64
+
+type Resulttype = [Valtype]
+
+type Limits = {- mixop: `[%..%]` -} (U32, U32)
+
+type Mutflag = {- mixop: MUT -} ()
+
+type Globaltype = {- mixop: `%?%` -} ((Maybe Mutflag), Valtype)
+
+type Functype = {- mixop: `%->%` -} (Resulttype, Resulttype)
+
+type Tabletype = {- mixop: `%%` -} (Limits, Reftype)
+
+type Memtype = {- mixop: `%I8` -} Limits
+
+type Elemtype = Reftype
+
+type Datatype = {- mixop: OK -} ()
+
+data Externtype
+ = Externtype_GLOBAL Globaltype
+ | Externtype_FUNC Functype
+ | Externtype_TABLE Tabletype
+ | Externtype_MEMORY Memtype
+
+data Sx
+ = Sx_U
+ | Sx_S
+
+data Unop_IXX
+ = Unop_IXX_CLZ
+ | Unop_IXX_CTZ
+ | Unop_IXX_POPCNT
+
+data Unop_FXX
+ = Unop_FXX_ABS
+ | Unop_FXX_NEG
+ | Unop_FXX_SQRT
+ | Unop_FXX_CEIL
+ | Unop_FXX_FLOOR
+ | Unop_FXX_TRUNC
+ | Unop_FXX_NEAREST
+
+data Binop_IXX
+ = Binop_IXX_ADD
+ | Binop_IXX_SUB
+ | Binop_IXX_MUL
+ | Binop_IXX_DIV Sx
+ | Binop_IXX_REM Sx
+ | Binop_IXX_AND
+ | Binop_IXX_OR
+ | Binop_IXX_XOR
+ | Binop_IXX_SHL
+ | Binop_IXX_SHR Sx
+ | Binop_IXX_ROTL
+ | Binop_IXX_ROTR
+
+data Binop_FXX
+ = Binop_FXX_ADD
+ | Binop_FXX_SUB
+ | Binop_FXX_MUL
+ | Binop_FXX_DIV
+ | Binop_FXX_MIN
+ | Binop_FXX_MAX
+ | Binop_FXX_COPYSIGN
+
+data Testop_IXX
+ = Testop_IXX_EQZ
+
+data Testop_FXX
+
+data Relop_IXX
+ = Relop_IXX_EQ
+ | Relop_IXX_NE
+ | Relop_IXX_LT Sx
+ | Relop_IXX_GT Sx
+ | Relop_IXX_LE Sx
+ | Relop_IXX_GE Sx
+
+data Relop_FXX
+ = Relop_FXX_EQ
+ | Relop_FXX_NE
+ | Relop_FXX_LT
+ | Relop_FXX_GT
+ | Relop_FXX_LE
+ | Relop_FXX_GE
+
+data Unop_numtype
+ = Unop_numtype_I Unop_IXX
+ | Unop_numtype_F Unop_FXX
+
+data Binop_numtype
+ = Binop_numtype_I Binop_IXX
+ | Binop_numtype_F Binop_FXX
+
+data Testop_numtype
+ = Testop_numtype_I Testop_IXX
+ | Testop_numtype_F Testop_FXX
+
+data Relop_numtype
+ = Relop_numtype_I Relop_IXX
+ | Relop_numtype_F Relop_FXX
+
+data Cvtop
+ = Cvtop_CONVERT
+ | Cvtop_REINTERPRET
+
+type C_numtype = Natural
+
+type C_vectype = Natural
+
+type Blocktype = Functype
+
+data Instr
+ = Instr_UNREACHABLE
+ | Instr_NOP
+ | Instr_DROP
+ | Instr_SELECT (Maybe Valtype)
+ | Instr_BLOCK (Blocktype, [Instr])
+ | Instr_LOOP (Blocktype, [Instr])
+ | Instr_IF (Blocktype, [Instr], [Instr])
+ | Instr_BR Labelidx
+ | Instr_BR_IF Labelidx
+ | Instr_BR_TABLE ([Labelidx], Labelidx)
+ | Instr_CALL Funcidx
+ | Instr_CALL_INDIRECT (Tableidx, Functype)
+ | Instr_RETURN
+ | Instr_CONST (Numtype, C_numtype)
+ | Instr_UNOP (Numtype, Unop_numtype)
+ | Instr_BINOP (Numtype, Binop_numtype)
+ | Instr_TESTOP (Numtype, Testop_numtype)
+ | Instr_RELOP (Numtype, Relop_numtype)
+ | Instr_EXTEND (Numtype, N)
+ | Instr_CVTOP (Numtype, Cvtop, Numtype, (Maybe Sx))
+ | Instr_REF_NULL Reftype
+ | Instr_REF_FUNC Funcidx
+ | Instr_REF_IS_NULL
+ | Instr_LOCAL_GET Localidx
+ | Instr_LOCAL_SET Localidx
+ | Instr_LOCAL_TEE Localidx
+ | Instr_GLOBAL_GET Globalidx
+ | Instr_GLOBAL_SET Globalidx
+ | Instr_TABLE_GET Tableidx
+ | Instr_TABLE_SET Tableidx
+ | Instr_TABLE_SIZE Tableidx
+ | Instr_TABLE_GROW Tableidx
+ | Instr_TABLE_FILL Tableidx
+ | Instr_TABLE_COPY (Tableidx, Tableidx)
+ | Instr_TABLE_INIT (Tableidx, Elemidx)
+ | Instr_ELEM_DROP Elemidx
+ | Instr_MEMORY_SIZE
+ | Instr_MEMORY_GROW
+ | Instr_MEMORY_FILL
+ | Instr_MEMORY_COPY
+ | Instr_MEMORY_INIT Dataidx
+ | Instr_DATA_DROP Dataidx
+ | Instr_LOAD (Numtype, (Maybe (N, Sx)), Natural, Natural)
+ | Instr_STORE (Numtype, (Maybe N), Natural, Natural)
+
+type Expr = [Instr]
+
+data Elemmode
+ = Elemmode_TABLE (Tableidx, Expr)
+ | Elemmode_DECLARE
+
+data Datamode
+ = Datamode_MEMORY (Memidx, Expr)
+
+type Func = {- mixop: `FUNC%%*%` -} (Functype, [Valtype], Expr)
+
+type Global = {- mixop: GLOBAL -} (Globaltype, Expr)
+
+type Table = {- mixop: TABLE -} Tabletype
+
+type Mem = {- mixop: MEMORY -} Memtype
+
+type Elem = {- mixop: `ELEM%%*%?` -} (Reftype, [Expr], (Maybe Elemmode))
+
+type Data = {- mixop: `DATA(*)%*%?` -} ([[Byte]], (Maybe Datamode))
+
+type Start = {- mixop: START -} Funcidx
+
+data Externuse
+ = Externuse_FUNC Funcidx
+ | Externuse_GLOBAL Globalidx
+ | Externuse_TABLE Tableidx
+ | Externuse_MEMORY Memidx
+
+type Export = {- mixop: EXPORT -} (Name, Externuse)
+
+type Import = {- mixop: IMPORT -} (Name, Name, Externtype)
+
+type Module = {- mixop: `MODULE%*%*%*%*%*%*%*%*%*` -} ([Import], [Func], [Global], [Table], [Mem], [Elem], [Data], [Start], [Export])
+
+size :: Valtype -> Natural
+size Valtype_I32 = 32
+size Valtype_I64 = 64
+size Valtype_F32 = 32
+size Valtype_F64 = 64
+size Valtype_V128 = 128
+
+test_sub_ATOM_22 :: N -> Natural
+test_sub_ATOM_22 n_3_ATOM_y = 0
+
+curried_ :: (N, N) -> Natural
+curried_ (n_1, n_2) = (n_1 + n_2)
+
+data Testfuse
+ = Testfuse_AB_ (Natural, Natural, Natural)
+ | Testfuse_CD (Natural, Natural, Natural)
+ | Testfuse_EF (Natural, Natural, Natural)
+ | Testfuse_GH (Natural, Natural, Natural)
+ | Testfuse_IJ (Natural, Natural, Natural)
+ | Testfuse_KL (Natural, Natural, Natural)
+ | Testfuse_MN (Natural, Natural, Natural)
+ | Testfuse_OP (Natural, Natural, Natural)
+ | Testfuse_QR (Natural, Natural, Natural)
+
+data Context = MkContext
+ { fUNC :: [Functype]
+ , gLOBAL :: [Globaltype]
+ , tABLE :: [Tabletype]
+ , mEM :: [Memtype]
+ , eLEM :: [Elemtype]
+ , dATA :: [Datatype]
+ , lOCAL :: [Valtype]
+ , lABEL :: [Resulttype]
+ , rETURN :: (Maybe Resulttype)
+ }
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+type Addr = Natural
+
+type Funcaddr = Addr
+
+type Globaladdr = Addr
+
+type Tableaddr = Addr
+
+type Memaddr = Addr
+
+type Elemaddr = Addr
+
+type Dataaddr = Addr
+
+type Labeladdr = Addr
+
+type Hostaddr = Addr
+
+data Num
+ = Num_CONST (Numtype, C_numtype)
+
+data Ref
+ = Ref_REF_NULL Reftype
+ | Ref_REF_FUNC_ADDR Funcaddr
+ | Ref_REF_HOST_ADDR Hostaddr
+
+data Val
+ = Val_CONST (Numtype, C_numtype)
+ | Val_REF_NULL Reftype
+ | Val_REF_FUNC_ADDR Funcaddr
+ | Val_REF_HOST_ADDR Hostaddr
+
+val_num :: Num -> Val
+val_num (Num_CONST x) = (Val_CONST x)
+
+val_ref :: Ref -> Val
+val_ref (Ref_REF_NULL x) = (Val_REF_NULL x)
+val_ref (Ref_REF_FUNC_ADDR x) = (Val_REF_FUNC_ADDR x)
+val_ref (Ref_REF_HOST_ADDR x) = (Val_REF_HOST_ADDR x)
+
+data Result
+ = Result_VALS [Val]
+ | Result_TRAP
+
+data Externval
+ = Externval_FUNC Funcaddr
+ | Externval_GLOBAL Globaladdr
+ | Externval_TABLE Tableaddr
+ | Externval_MEM Memaddr
+
+default_ :: Valtype -> Val
+default_ Valtype_I32 = (Val_CONST (Numtype_I32, 0))
+default_ Valtype_I64 = (Val_CONST (Numtype_I64, 0))
+default_ Valtype_F32 = (Val_CONST (Numtype_F32, 0))
+default_ Valtype_F64 = (Val_CONST (Numtype_F64, 0))
+default_ Valtype_FUNCREF = (Val_REF_NULL Reftype_FUNCREF)
+default_ Valtype_EXTERNREF = (Val_REF_NULL Reftype_EXTERNREF)
+
+type Exportinst = {- mixop: EXPORT -} (Name, Externval)
+
+data Moduleinst = MkModuleinst
+ { fUNC :: [Funcaddr]
+ , gLOBAL :: [Globaladdr]
+ , tABLE :: [Tableaddr]
+ , mEM :: [Memaddr]
+ , eLEM :: [Elemaddr]
+ , dATA :: [Dataaddr]
+ , eXPORT :: [Exportinst]
+ }
+
+type Funcinst = {- mixop: `%;%` -} (Moduleinst, Func)
+
+type Globalinst = Val
+
+type Tableinst = [Ref]
+
+type Meminst = [Byte]
+
+type Eleminst = [Ref]
+
+type Datainst = [Byte]
+
+data Store = MkStore
+ { fUNC :: [Funcinst]
+ , gLOBAL :: [Globalinst]
+ , tABLE :: [Tableinst]
+ , mEM :: [Meminst]
+ , eLEM :: [Eleminst]
+ , dATA :: [Datainst]
+ }
+
+data Frame = MkFrame
+ { lOCAL :: [Val]
+ , mODULE :: Moduleinst
+ }
+
+type State = {- mixop: `%;%` -} (Store, Frame)
+
+data Admininstr
+ = Admininstr_UNREACHABLE
+ | Admininstr_NOP
+ | Admininstr_DROP
+ | Admininstr_SELECT (Maybe Valtype)
+ | Admininstr_BLOCK (Blocktype, [Instr])
+ | Admininstr_LOOP (Blocktype, [Instr])
+ | Admininstr_IF (Blocktype, [Instr], [Instr])
+ | Admininstr_BR Labelidx
+ | Admininstr_BR_IF Labelidx
+ | Admininstr_BR_TABLE ([Labelidx], Labelidx)
+ | Admininstr_CALL Funcidx
+ | Admininstr_CALL_INDIRECT (Tableidx, Functype)
+ | Admininstr_RETURN
+ | Admininstr_CONST (Numtype, C_numtype)
+ | Admininstr_UNOP (Numtype, Unop_numtype)
+ | Admininstr_BINOP (Numtype, Binop_numtype)
+ | Admininstr_TESTOP (Numtype, Testop_numtype)
+ | Admininstr_RELOP (Numtype, Relop_numtype)
+ | Admininstr_EXTEND (Numtype, N)
+ | Admininstr_CVTOP (Numtype, Cvtop, Numtype, (Maybe Sx))
+ | Admininstr_REF_NULL Reftype
+ | Admininstr_REF_FUNC Funcidx
+ | Admininstr_REF_IS_NULL
+ | Admininstr_LOCAL_GET Localidx
+ | Admininstr_LOCAL_SET Localidx
+ | Admininstr_LOCAL_TEE Localidx
+ | Admininstr_GLOBAL_GET Globalidx
+ | Admininstr_GLOBAL_SET Globalidx
+ | Admininstr_TABLE_GET Tableidx
+ | Admininstr_TABLE_SET Tableidx
+ | Admininstr_TABLE_SIZE Tableidx
+ | Admininstr_TABLE_GROW Tableidx
+ | Admininstr_TABLE_FILL Tableidx
+ | Admininstr_TABLE_COPY (Tableidx, Tableidx)
+ | Admininstr_TABLE_INIT (Tableidx, Elemidx)
+ | Admininstr_ELEM_DROP Elemidx
+ | Admininstr_MEMORY_SIZE
+ | Admininstr_MEMORY_GROW
+ | Admininstr_MEMORY_FILL
+ | Admininstr_MEMORY_COPY
+ | Admininstr_MEMORY_INIT Dataidx
+ | Admininstr_DATA_DROP Dataidx
+ | Admininstr_LOAD (Numtype, (Maybe (N, Sx)), Natural, Natural)
+ | Admininstr_STORE (Numtype, (Maybe N), Natural, Natural)
+ | Admininstr_REF_FUNC_ADDR Funcaddr
+ | Admininstr_REF_HOST_ADDR Hostaddr
+ | Admininstr_CALL_ADDR Funcaddr
+ | Admininstr_LABEL_ (N, [Instr], [Admininstr])
+ | Admininstr_FRAME_ (N, Frame, [Admininstr])
+ | Admininstr_TRAP
+
+admininstr_instr :: Instr -> Admininstr
+admininstr_instr Instr_UNREACHABLE = Admininstr_UNREACHABLE
+admininstr_instr Instr_NOP = Admininstr_NOP
+admininstr_instr Instr_DROP = Admininstr_DROP
+admininstr_instr (Instr_SELECT x) = (Admininstr_SELECT x)
+admininstr_instr (Instr_BLOCK x) = (Admininstr_BLOCK x)
+admininstr_instr (Instr_LOOP x) = (Admininstr_LOOP x)
+admininstr_instr (Instr_IF x) = (Admininstr_IF x)
+admininstr_instr (Instr_BR x) = (Admininstr_BR x)
+admininstr_instr (Instr_BR_IF x) = (Admininstr_BR_IF x)
+admininstr_instr (Instr_BR_TABLE x) = (Admininstr_BR_TABLE x)
+admininstr_instr (Instr_CALL x) = (Admininstr_CALL x)
+admininstr_instr (Instr_CALL_INDIRECT x) = (Admininstr_CALL_INDIRECT x)
+admininstr_instr Instr_RETURN = Admininstr_RETURN
+admininstr_instr (Instr_CONST x) = (Admininstr_CONST x)
+admininstr_instr (Instr_UNOP x) = (Admininstr_UNOP x)
+admininstr_instr (Instr_BINOP x) = (Admininstr_BINOP x)
+admininstr_instr (Instr_TESTOP x) = (Admininstr_TESTOP x)
+admininstr_instr (Instr_RELOP x) = (Admininstr_RELOP x)
+admininstr_instr (Instr_EXTEND x) = (Admininstr_EXTEND x)
+admininstr_instr (Instr_CVTOP x) = (Admininstr_CVTOP x)
+admininstr_instr (Instr_REF_NULL x) = (Admininstr_REF_NULL x)
+admininstr_instr (Instr_REF_FUNC x) = (Admininstr_REF_FUNC x)
+admininstr_instr Instr_REF_IS_NULL = Admininstr_REF_IS_NULL
+admininstr_instr (Instr_LOCAL_GET x) = (Admininstr_LOCAL_GET x)
+admininstr_instr (Instr_LOCAL_SET x) = (Admininstr_LOCAL_SET x)
+admininstr_instr (Instr_LOCAL_TEE x) = (Admininstr_LOCAL_TEE x)
+admininstr_instr (Instr_GLOBAL_GET x) = (Admininstr_GLOBAL_GET x)
+admininstr_instr (Instr_GLOBAL_SET x) = (Admininstr_GLOBAL_SET x)
+admininstr_instr (Instr_TABLE_GET x) = (Admininstr_TABLE_GET x)
+admininstr_instr (Instr_TABLE_SET x) = (Admininstr_TABLE_SET x)
+admininstr_instr (Instr_TABLE_SIZE x) = (Admininstr_TABLE_SIZE x)
+admininstr_instr (Instr_TABLE_GROW x) = (Admininstr_TABLE_GROW x)
+admininstr_instr (Instr_TABLE_FILL x) = (Admininstr_TABLE_FILL x)
+admininstr_instr (Instr_TABLE_COPY x) = (Admininstr_TABLE_COPY x)
+admininstr_instr (Instr_TABLE_INIT x) = (Admininstr_TABLE_INIT x)
+admininstr_instr (Instr_ELEM_DROP x) = (Admininstr_ELEM_DROP x)
+admininstr_instr Instr_MEMORY_SIZE = Admininstr_MEMORY_SIZE
+admininstr_instr Instr_MEMORY_GROW = Admininstr_MEMORY_GROW
+admininstr_instr Instr_MEMORY_FILL = Admininstr_MEMORY_FILL
+admininstr_instr Instr_MEMORY_COPY = Admininstr_MEMORY_COPY
+admininstr_instr (Instr_MEMORY_INIT x) = (Admininstr_MEMORY_INIT x)
+admininstr_instr (Instr_DATA_DROP x) = (Admininstr_DATA_DROP x)
+admininstr_instr (Instr_LOAD x) = (Admininstr_LOAD x)
+admininstr_instr (Instr_STORE x) = (Admininstr_STORE x)
+
+admininstr_val :: Val -> Admininstr
+admininstr_val (Val_CONST x) = (Admininstr_CONST x)
+admininstr_val (Val_REF_NULL x) = (Admininstr_REF_NULL x)
+admininstr_val (Val_REF_FUNC_ADDR x) = (Admininstr_REF_FUNC_ADDR x)
+admininstr_val (Val_REF_HOST_ADDR x) = (Admininstr_REF_HOST_ADDR x)
+
+admininstr_ref :: Ref -> Admininstr
+admininstr_ref (Ref_REF_NULL x) = (Admininstr_REF_NULL x)
+admininstr_ref (Ref_REF_FUNC_ADDR x) = (Admininstr_REF_FUNC_ADDR x)
+admininstr_ref (Ref_REF_HOST_ADDR x) = (Admininstr_REF_HOST_ADDR x)
+
+admininstr_globalinst :: Globalinst -> Admininstr
+admininstr_globalinst x = undefined {- $admininstr_val(x) -}
+
+type Config = {- mixop: `%;%*` -} (State, [Admininstr])
+
+funcaddr :: State -> [Funcaddr]
+funcaddr (s, f) = f.mODULE.fUNC
+
+funcinst :: State -> [Funcinst]
+funcinst (s, f) = s.fUNC
+
+func :: (State, Funcidx) -> Funcinst
+func ((s, f), x) = (s.fUNC !! (fromIntegral (f.mODULE.fUNC !! (fromIntegral x))))
+
+global :: (State, Globalidx) -> Globalinst
+global ((s, f), x) = (s.gLOBAL !! (fromIntegral (f.mODULE.gLOBAL !! (fromIntegral x))))
+
+table :: (State, Tableidx) -> Tableinst
+table ((s, f), x) = (s.tABLE !! (fromIntegral (f.mODULE.tABLE !! (fromIntegral x))))
+
+mem :: (State, Memidx) -> Meminst
+mem ((s, f), x) = (s.mEM !! (fromIntegral (f.mODULE.mEM !! (fromIntegral x))))
+
+elem :: (State, Tableidx) -> Eleminst
+elem ((s, f), x) = (s.eLEM !! (fromIntegral (f.mODULE.eLEM !! (fromIntegral x))))
+
+data_ :: (State, Dataidx) -> Datainst
+data_ ((s, f), x) = (s.dATA !! (fromIntegral (f.mODULE.dATA !! (fromIntegral x))))
+
+local :: (State, Localidx) -> Val
+local ((s, f), x) = (f.lOCAL !! (fromIntegral x))
+
+with_local :: (State, Localidx, Val) -> State
+with_local ((s, f), x, v) = (s, undefined {- f[LOCAL[x] = v] -})
+
+with_global :: (State, Globalidx, Val) -> State
+with_global ((s, f), x, v) = (undefined {- s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v] -}, f)
+
+with_table :: (State, Tableidx, N, Ref) -> State
+with_table ((s, f), x, i, r) = (undefined {- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r] -}, f)
+
+with_tableext :: (State, Tableidx, [Ref]) -> State
+with_tableext ((s, f), x, r) = (undefined {- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}] -}, f)
+
+with_elem :: (State, Elemidx, [Ref]) -> State
+with_elem ((s, f), x, r) = (undefined {- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}] -}, f)
+
+data E
+ = E_HOLE
+ | E_SEQ ([Val], E, [Instr])
+ | E_LABEL_ (N, [Instr], E)
+
+unop :: (Unop_numtype, Numtype, C_numtype) -> [C_numtype]
+unop = error "function without clauses"
+
+binop :: (Binop_numtype, Numtype, C_numtype, C_numtype) -> [C_numtype]
+binop = error "function without clauses"
+
+testop :: (Testop_numtype, Numtype, C_numtype) -> C_numtype
+testop = error "function without clauses"
+
+relop :: (Relop_numtype, Numtype, C_numtype, C_numtype) -> C_numtype
+relop = error "function without clauses"
+
+ext :: (Natural, Natural, Sx, C_numtype) -> C_numtype
+ext = error "function without clauses"
+
+cvtop :: (Numtype, Cvtop, Numtype, (Maybe Sx), C_numtype) -> [C_numtype]
+cvtop = error "function without clauses"
+
+
+
+
+
diff --git a/spectec/test-haskell/dune b/spectec/test-haskell/dune
index 47035d055b..3430d9e584 100644
--- a/spectec/test-haskell/dune
+++ b/spectec/test-haskell/dune
@@ -1,8 +1,22 @@
-(mdx
-  (libraries spectec)
+(rule
+  (targets stderr.current SpecTec.hs.current)
   (deps
     (file ../src/exe-watsup/main.exe)
     (glob_files ../spec/*.watsup)
   )
-  (files TEST.md)
+  (action
+    (progn
+      (write-file SpecTec.hs.current "not generated")
+      (with-stderr-to stderr.current (run %{deps} --haskell -o SpecTec.hs.current))
+    )
+  )
+)
+
+(rule
+ (alias   runtest)
+ (action (diff stderr.expected stderr.current))
+)
+(rule
+ (alias   runtest)
+ (action (diff SpecTec.hs SpecTec.hs.current))
 )
diff --git a/spectec/test-lean4/TEST.md b/spectec/test-lean4/SpecTec.lean
similarity index 78%
rename from spectec/test-lean4/TEST.md
rename to spectec/test-lean4/SpecTec.lean
index 602ed75a73..42586b4940 100644
--- a/spectec/test-lean4/TEST.md
+++ b/spectec/test-lean4/SpecTec.lean
@@ -1,8 +1,3 @@
-# Preview
-
-```sh
-$ dune exec ../src/exe-watsup/main.exe -- --lean4 ../spec/*.watsup -o SpecTec.lean
-$ cat SpecTec.lean
 /- Lean 4 export -/
 
 instance : Append (Option a) where
@@ -355,7 +350,7 @@ inductive Testfuse where
  | QR : (Nat × Nat × Nat) -> Testfuse
   deriving Inhabited, BEq
 
-structure Context where
+structure Context where 
   FUNC : (List Functype)
   GLOBAL : (List Globaltype)
   TABLE : (List Tabletype)
@@ -380,436 +375,436 @@ instance : Append Context where
   }
 
 inductive Limits_ok : (Limits × Nat) -> Prop where
-  | rule_0 (k : Nat) (n_1 : N) (n_2 : N) :
-    ((n_1 <= n_2) && (n_2 <= k)) ->
+  | rule_0 (k : Nat) (n_1 : N) (n_2 : N) : 
+    ((n_1 <= n_2) && (n_2 <= k)) -> 
     (Limits_ok ((n_1, n_2), k))
 
 inductive Functype_ok : Functype -> Prop where
-  | rule_0 (ft : Functype) :
+  | rule_0 (ft : Functype) : 
     (Functype_ok ft)
 
 inductive Globaltype_ok : Globaltype -> Prop where
-  | rule_0 (gt : Globaltype) :
+  | rule_0 (gt : Globaltype) : 
     (Globaltype_ok gt)
 
 inductive Tabletype_ok : Tabletype -> Prop where
-  | rule_0 (lim : Limits) (rt : Reftype) :
-    (Limits_ok (lim, ((((Nat.pow 2) 32)) - 1))) ->
+  | rule_0 (lim : Limits) (rt : Reftype) : 
+    (Limits_ok (lim, ((((Nat.pow 2) 32)) - 1))) -> 
     (Tabletype_ok (lim, rt))
 
 inductive Memtype_ok : Memtype -> Prop where
-  | rule_0 (lim : Limits) :
-    (Limits_ok (lim, (((Nat.pow 2) 16)))) ->
+  | rule_0 (lim : Limits) : 
+    (Limits_ok (lim, (((Nat.pow 2) 16)))) -> 
     (Memtype_ok lim)
 
 inductive Externtype_ok : Externtype -> Prop where
-  | func (functype : Functype) :
-    (Functype_ok functype) ->
+  | func (functype : Functype) : 
+    (Functype_ok functype) -> 
     (Externtype_ok (Externtype.FUNC functype))
-  | «global» (globaltype : Globaltype) :
-    (Globaltype_ok globaltype) ->
+  | «global» (globaltype : Globaltype) : 
+    (Globaltype_ok globaltype) -> 
     (Externtype_ok (Externtype.GLOBAL globaltype))
-  | table (tabletype : Tabletype) :
-    (Tabletype_ok tabletype) ->
+  | table (tabletype : Tabletype) : 
+    (Tabletype_ok tabletype) -> 
     (Externtype_ok (Externtype.TABLE tabletype))
-  | mem (memtype : Memtype) :
-    (Memtype_ok memtype) ->
+  | mem (memtype : Memtype) : 
+    (Memtype_ok memtype) -> 
     (Externtype_ok (Externtype.MEMORY memtype))
 
 inductive Valtype_sub : (Valtype × Valtype) -> Prop where
-  | refl (t : Valtype) :
+  | refl (t : Valtype) : 
     (Valtype_sub (t, t))
-  | bot (t : Valtype) :
+  | bot (t : Valtype) : 
     (Valtype_sub (Valtype.BOT, t))
 
 inductive Resulttype_sub : ((List Valtype) × (List Valtype)) -> Prop where
-  | rule_0 (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
-    (t_1.length == t_2.length) ->
-    (Forall₂ (λ t_1 t_2 ↦ (Valtype_sub (t_1, t_2))) t_1 t_2) ->
+  | rule_0 (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
+    (t_1.length == t_2.length) -> 
+    (Forall₂ (λ t_1 t_2 ↦ (Valtype_sub (t_1, t_2))) t_1 t_2) -> 
     (Resulttype_sub (t_1, t_2))
 
 inductive Limits_sub : (Limits × Limits) -> Prop where
-  | rule_0 (n_11 : N) (n_12 : N) (n_21 : N) (n_22 : N) :
-    (n_11 >= n_21) ->
-    (n_12 <= n_22) ->
+  | rule_0 (n_11 : N) (n_12 : N) (n_21 : N) (n_22 : N) : 
+    (n_11 >= n_21) -> 
+    (n_12 <= n_22) -> 
     (Limits_sub ((n_11, n_12), (n_21, n_22)))
 
 inductive Functype_sub : (Functype × Functype) -> Prop where
-  | rule_0 (ft : Functype) :
+  | rule_0 (ft : Functype) : 
     (Functype_sub (ft, ft))
 
 inductive Globaltype_sub : (Globaltype × Globaltype) -> Prop where
-  | rule_0 (gt : Globaltype) :
+  | rule_0 (gt : Globaltype) : 
     (Globaltype_sub (gt, gt))
 
 inductive Tabletype_sub : (Tabletype × Tabletype) -> Prop where
-  | rule_0 (lim_1 : Limits) (lim_2 : Limits) (rt : Reftype) :
-    (Limits_sub (lim_1, lim_2)) ->
+  | rule_0 (lim_1 : Limits) (lim_2 : Limits) (rt : Reftype) : 
+    (Limits_sub (lim_1, lim_2)) -> 
     (Tabletype_sub ((lim_1, rt), (lim_2, rt)))
 
 inductive Memtype_sub : (Memtype × Memtype) -> Prop where
-  | rule_0 (lim_1 : Limits) (lim_2 : Limits) :
-    (Limits_sub (lim_1, lim_2)) ->
+  | rule_0 (lim_1 : Limits) (lim_2 : Limits) : 
+    (Limits_sub (lim_1, lim_2)) -> 
     (Memtype_sub (lim_1, lim_2))
 
 inductive Externtype_sub : (Externtype × Externtype) -> Prop where
-  | func (ft_1 : Functype) (ft_2 : Functype) :
-    (Functype_sub (ft_1, ft_2)) ->
+  | func (ft_1 : Functype) (ft_2 : Functype) : 
+    (Functype_sub (ft_1, ft_2)) -> 
     (Externtype_sub ((Externtype.FUNC ft_1), (Externtype.FUNC ft_2)))
-  | «global» (gt_1 : Globaltype) (gt_2 : Globaltype) :
-    (Globaltype_sub (gt_1, gt_2)) ->
+  | «global» (gt_1 : Globaltype) (gt_2 : Globaltype) : 
+    (Globaltype_sub (gt_1, gt_2)) -> 
     (Externtype_sub ((Externtype.GLOBAL gt_1), (Externtype.GLOBAL gt_2)))
-  | table (tt_1 : Tabletype) (tt_2 : Tabletype) :
-    (Tabletype_sub (tt_1, tt_2)) ->
+  | table (tt_1 : Tabletype) (tt_2 : Tabletype) : 
+    (Tabletype_sub (tt_1, tt_2)) -> 
     (Externtype_sub ((Externtype.TABLE tt_1), (Externtype.TABLE tt_2)))
-  | mem (mt_1 : Memtype) (mt_2 : Memtype) :
-    (Memtype_sub (mt_1, mt_2)) ->
+  | mem (mt_1 : Memtype) (mt_2 : Memtype) : 
+    (Memtype_sub (mt_1, mt_2)) -> 
     (Externtype_sub ((Externtype.MEMORY mt_1), (Externtype.MEMORY mt_2)))
 
 inductive Blocktype_ok : (Context × Blocktype × Functype) -> Prop where
-  | rule_0 (C : Context) (ft : Functype) :
-    (Functype_ok ft) ->
+  | rule_0 (C : Context) (ft : Functype) : 
+    (Functype_ok ft) -> 
     (Blocktype_ok (C, ft, ft))
 
 mutual
 inductive Instr_ok : (Context × Instr × Functype) -> Prop where
-  | unreachable (C : Context) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
+  | unreachable (C : Context) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
     (Instr_ok (C, Instr.UNREACHABLE, (t_1, t_2)))
-  | nop (C : Context) :
+  | nop (C : Context) : 
     (Instr_ok (C, Instr.NOP, ([], [])))
-  | drop (C : Context) (t : Valtype) :
+  | drop (C : Context) (t : Valtype) : 
     (Instr_ok (C, Instr.DROP, ([t], [])))
-  | select_expl (C : Context) (t : Valtype) :
+  | select_expl (C : Context) (t : Valtype) : 
     (Instr_ok (C, (Instr.SELECT (some t)), ([t, t, Valtype.I32], [t])))
-  | select_impl (C : Context) (numtype : Numtype) (t : Valtype) (t' : Valtype) (vectype : Vectype) :
-    (Valtype_sub (t, t')) ->
-    ((t' == («$valtype_numtype» numtype)) || (t' == («$valtype_vectype» vectype))) ->
+  | select_impl (C : Context) (numtype : Numtype) (t : Valtype) (t' : Valtype) (vectype : Vectype) : 
+    (Valtype_sub (t, t')) -> 
+    ((t' == («$valtype_numtype» numtype)) || (t' == («$valtype_vectype» vectype))) -> 
     (Instr_ok (C, (Instr.SELECT none), ([t, t, Valtype.I32], [t])))
-  | block (C : Context) (bt : Blocktype) (instr : (List Instr)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
-    (Blocktype_ok (C, bt, (t_1, t_2))) ->
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_2 ↦ [t_2]) t_2), RETURN := none}), instr, (t_1, t_2))) ->
+  | block (C : Context) (bt : Blocktype) (instr : (List Instr)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
+    (Blocktype_ok (C, bt, (t_1, t_2))) -> 
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_2 ↦ [t_2]) t_2), RETURN := none}), instr, (t_1, t_2))) -> 
     (Instr_ok (C, (Instr.BLOCK (bt, instr)), (t_1, t_2)))
-  | loop (C : Context) (bt : Blocktype) (instr : (List Instr)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
-    (Blocktype_ok (C, bt, (t_1, t_2))) ->
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_1 ↦ [t_1]) t_1), RETURN := none}), instr, (t_1, t_2))) ->
+  | loop (C : Context) (bt : Blocktype) (instr : (List Instr)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
+    (Blocktype_ok (C, bt, (t_1, t_2))) -> 
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_1 ↦ [t_1]) t_1), RETURN := none}), instr, (t_1, t_2))) -> 
     (Instr_ok (C, (Instr.LOOP (bt, instr)), (t_1, t_2)))
-  | if (C : Context) (bt : Blocktype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
-    (Blocktype_ok (C, bt, (t_1, t_2))) ->
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_2 ↦ [t_2]) t_2), RETURN := none}), instr_1, (t_1, t_2))) ->
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_2 ↦ [t_2]) t_2), RETURN := none}), instr_2, (t_1, t_2))) ->
+  | if (C : Context) (bt : Blocktype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
+    (Blocktype_ok (C, bt, (t_1, t_2))) -> 
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_2 ↦ [t_2]) t_2), RETURN := none}), instr_1, (t_1, t_2))) -> 
+    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_2 ↦ [t_2]) t_2), RETURN := none}), instr_2, (t_1, t_2))) -> 
     (Instr_ok (C, (Instr.IF (bt, instr_1, instr_2)), (t_1, t_2)))
-  | br (C : Context) (l : Labelidx) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
-    (l < C.LABEL.length) ->
-    ((C.LABEL.get! l) == t) ->
+  | br (C : Context) (l : Labelidx) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
+    (l < C.LABEL.length) -> 
+    ((C.LABEL.get! l) == t) -> 
     (Instr_ok (C, (Instr.BR l), ((t_1 ++ t), t_2)))
-  | br_if (C : Context) (l : Labelidx) (t : (List Valtype)) :
-    (l < C.LABEL.length) ->
-    ((C.LABEL.get! l) == t) ->
+  | br_if (C : Context) (l : Labelidx) (t : (List Valtype)) : 
+    (l < C.LABEL.length) -> 
+    ((C.LABEL.get! l) == t) -> 
     (Instr_ok (C, (Instr.BR_IF l), ((t ++ [Valtype.I32]), t)))
-  | br_table (C : Context) (l : (List Labelidx)) (l' : Labelidx) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
-    (Forall (λ l ↦ (l < C.LABEL.length)) l) ->
-    (l' < C.LABEL.length) ->
-    (Forall (λ l ↦ (Resulttype_sub (t, (C.LABEL.get! l)))) l) ->
-    (Resulttype_sub (t, (C.LABEL.get! l'))) ->
+  | br_table (C : Context) (l : (List Labelidx)) (l' : Labelidx) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
+    (Forall (λ l ↦ (l < C.LABEL.length)) l) -> 
+    (l' < C.LABEL.length) -> 
+    (Forall (λ l ↦ (Resulttype_sub (t, (C.LABEL.get! l)))) l) -> 
+    (Resulttype_sub (t, (C.LABEL.get! l'))) -> 
     (Instr_ok (C, (Instr.BR_TABLE (l, l')), ((t_1 ++ t), t_2)))
-  | return (C : Context) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
-    (C.RETURN == (some t)) ->
+  | return (C : Context) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
+    (C.RETURN == (some t)) -> 
     (Instr_ok (C, Instr.RETURN, ((t_1 ++ t), t_2)))
-  | call (C : Context) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (x : Idx) :
-    (x < C.FUNC.length) ->
-    ((C.FUNC.get! x) == (t_1, t_2)) ->
+  | call (C : Context) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (x : Idx) : 
+    (x < C.FUNC.length) -> 
+    ((C.FUNC.get! x) == (t_1, t_2)) -> 
     (Instr_ok (C, (Instr.CALL x), (t_1, t_2)))
-  | call_indirect (C : Context) (ft : Functype) (lim : Limits) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (x : Idx) :
-    (x < C.TABLE.length) ->
-    ((C.TABLE.get! x) == (lim, Reftype.FUNCREF)) ->
-    (ft == (t_1, t_2)) ->
+  | call_indirect (C : Context) (ft : Functype) (lim : Limits) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (x : Idx) : 
+    (x < C.TABLE.length) -> 
+    ((C.TABLE.get! x) == (lim, Reftype.FUNCREF)) -> 
+    (ft == (t_1, t_2)) -> 
     (Instr_ok (C, (Instr.CALL_INDIRECT (x, ft)), ((t_1 ++ [Valtype.I32]), t_2)))
-  | const (C : Context) (c_nt : C_numtype) (nt : Numtype) :
+  | const (C : Context) (c_nt : C_numtype) (nt : Numtype) : 
     (Instr_ok (C, (Instr.CONST (nt, c_nt)), ([], [(«$valtype_numtype» nt)])))
-  | unop (C : Context) (nt : Numtype) (unop : Unop_numtype) :
+  | unop (C : Context) (nt : Numtype) (unop : Unop_numtype) : 
     (Instr_ok (C, (Instr.UNOP (nt, unop)), ([(«$valtype_numtype» nt)], [(«$valtype_numtype» nt)])))
-  | binop (C : Context) (binop : Binop_numtype) (nt : Numtype) :
+  | binop (C : Context) (binop : Binop_numtype) (nt : Numtype) : 
     (Instr_ok (C, (Instr.BINOP (nt, binop)), ([(«$valtype_numtype» nt), («$valtype_numtype» nt)], [(«$valtype_numtype» nt)])))
-  | testop (C : Context) (nt : Numtype) (testop : Testop_numtype) :
+  | testop (C : Context) (nt : Numtype) (testop : Testop_numtype) : 
     (Instr_ok (C, (Instr.TESTOP (nt, testop)), ([(«$valtype_numtype» nt)], [Valtype.I32])))
-  | relop (C : Context) (nt : Numtype) (relop : Relop_numtype) :
+  | relop (C : Context) (nt : Numtype) (relop : Relop_numtype) : 
     (Instr_ok (C, (Instr.RELOP (nt, relop)), ([(«$valtype_numtype» nt), («$valtype_numtype» nt)], [Valtype.I32])))
-  | extend (C : Context) (n : N) (nt : Numtype) :
-    ((«$size» («$valtype_numtype» nt)) != none) ->
-    (n <= («$size» («$valtype_numtype» nt)).get!) ->
+  | extend (C : Context) (n : N) (nt : Numtype) : 
+    ((«$size» («$valtype_numtype» nt)) != none) -> 
+    (n <= («$size» («$valtype_numtype» nt)).get!) -> 
     (Instr_ok (C, (Instr.EXTEND (nt, n)), ([(«$valtype_numtype» nt)], [(«$valtype_numtype» nt)])))
-  | reinterpret (C : Context) (nt_1 : Numtype) (nt_2 : Numtype) :
-    ((«$size» («$valtype_numtype» nt_1)) != none) ->
-    ((«$size» («$valtype_numtype» nt_2)) != none) ->
-    (nt_1 != nt_2) ->
-    ((«$size» («$valtype_numtype» nt_1)).get! == («$size» («$valtype_numtype» nt_2)).get!) ->
+  | reinterpret (C : Context) (nt_1 : Numtype) (nt_2 : Numtype) : 
+    ((«$size» («$valtype_numtype» nt_1)) != none) -> 
+    ((«$size» («$valtype_numtype» nt_2)) != none) -> 
+    (nt_1 != nt_2) -> 
+    ((«$size» («$valtype_numtype» nt_1)).get! == («$size» («$valtype_numtype» nt_2)).get!) -> 
     (Instr_ok (C, (Instr.CVTOP (nt_1, Cvtop.REINTERPRET, nt_2, none)), ([(«$valtype_numtype» nt_2)], [(«$valtype_numtype» nt_1)])))
-  | convert_i (C : Context) (in_1 : In) (in_2 : In) (sx : (Option Sx)) :
-    ((«$size» («$valtype_in» in_1)) != none) ->
-    ((«$size» («$valtype_in» in_2)) != none) ->
-    (in_1 != in_2) ->
-    ((sx == none) = ((«$size» («$valtype_in» in_1)).get! > («$size» («$valtype_in» in_2)).get!)) ->
+  | convert_i (C : Context) (in_1 : In) (in_2 : In) (sx : (Option Sx)) : 
+    ((«$size» («$valtype_in» in_1)) != none) -> 
+    ((«$size» («$valtype_in» in_2)) != none) -> 
+    (in_1 != in_2) -> 
+    ((sx == none) = ((«$size» («$valtype_in» in_1)).get! > («$size» («$valtype_in» in_2)).get!)) -> 
     (Instr_ok (C, (Instr.CVTOP ((«$numtype_in» in_1), Cvtop.CONVERT, («$numtype_in» in_2), sx)), ([(«$valtype_in» in_2)], [(«$valtype_in» in_1)])))
-  | convert_f (C : Context) (fn_1 : Fn) (fn_2 : Fn) :
-    (fn_1 != fn_2) ->
+  | convert_f (C : Context) (fn_1 : Fn) (fn_2 : Fn) : 
+    (fn_1 != fn_2) -> 
     (Instr_ok (C, (Instr.CVTOP ((«$numtype_fn» fn_1), Cvtop.CONVERT, («$numtype_fn» fn_2), none)), ([(«$valtype_fn» fn_2)], [(«$valtype_fn» fn_1)])))
-  | ref_null (C : Context) (rt : Reftype) :
+  | ref_null (C : Context) (rt : Reftype) : 
     (Instr_ok (C, (Instr.REF_NULL rt), ([], [(«$valtype_reftype» rt)])))
-  | ref_func (C : Context) (ft : Functype) (x : Idx) :
-    (x < C.FUNC.length) ->
-    ((C.FUNC.get! x) == ft) ->
+  | ref_func (C : Context) (ft : Functype) (x : Idx) : 
+    (x < C.FUNC.length) -> 
+    ((C.FUNC.get! x) == ft) -> 
     (Instr_ok (C, (Instr.REF_FUNC x), ([], [Valtype.FUNCREF])))
-  | ref_is_null (C : Context) (rt : Reftype) :
+  | ref_is_null (C : Context) (rt : Reftype) : 
     (Instr_ok (C, Instr.REF_IS_NULL, ([(«$valtype_reftype» rt)], [Valtype.I32])))
-  | local_get (C : Context) (t : Valtype) (x : Idx) :
-    (x < C.LOCAL.length) ->
-    ((C.LOCAL.get! x) == t) ->
+  | local_get (C : Context) (t : Valtype) (x : Idx) : 
+    (x < C.LOCAL.length) -> 
+    ((C.LOCAL.get! x) == t) -> 
     (Instr_ok (C, (Instr.LOCAL_GET x), ([], [t])))
-  | local_set (C : Context) (t : Valtype) (x : Idx) :
-    (x < C.LOCAL.length) ->
-    ((C.LOCAL.get! x) == t) ->
+  | local_set (C : Context) (t : Valtype) (x : Idx) : 
+    (x < C.LOCAL.length) -> 
+    ((C.LOCAL.get! x) == t) -> 
     (Instr_ok (C, (Instr.LOCAL_SET x), ([t], [])))
-  | local_tee (C : Context) (t : Valtype) (x : Idx) :
-    (x < C.LOCAL.length) ->
-    ((C.LOCAL.get! x) == t) ->
+  | local_tee (C : Context) (t : Valtype) (x : Idx) : 
+    (x < C.LOCAL.length) -> 
+    ((C.LOCAL.get! x) == t) -> 
     (Instr_ok (C, (Instr.LOCAL_TEE x), ([t], [t])))
-  | global_get (C : Context) («mut» : (Option Mutflag)) (t : Valtype) (x : Idx) :
-    (x < C.GLOBAL.length) ->
-    ((C.GLOBAL.get! x) == («mut», t)) ->
+  | global_get (C : Context) («mut» : (Option Mutflag)) (t : Valtype) (x : Idx) : 
+    (x < C.GLOBAL.length) -> 
+    ((C.GLOBAL.get! x) == («mut», t)) -> 
     (Instr_ok (C, (Instr.GLOBAL_GET x), ([], [t])))
-  | global_set (C : Context) (t : Valtype) (x : Idx) :
-    (x < C.GLOBAL.length) ->
-    ((C.GLOBAL.get! x) == ((some ()), t)) ->
+  | global_set (C : Context) (t : Valtype) (x : Idx) : 
+    (x < C.GLOBAL.length) -> 
+    ((C.GLOBAL.get! x) == ((some ()), t)) -> 
     (Instr_ok (C, (Instr.GLOBAL_SET x), ([t], [])))
-  | table_get (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
-    (x < C.TABLE.length) ->
-    ((C.TABLE.get! x) == (lim, rt)) ->
+  | table_get (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) : 
+    (x < C.TABLE.length) -> 
+    ((C.TABLE.get! x) == (lim, rt)) -> 
     (Instr_ok (C, (Instr.TABLE_GET x), ([Valtype.I32], [(«$valtype_reftype» rt)])))
-  | table_set (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
-    (x < C.TABLE.length) ->
-    ((C.TABLE.get! x) == (lim, rt)) ->
+  | table_set (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) : 
+    (x < C.TABLE.length) -> 
+    ((C.TABLE.get! x) == (lim, rt)) -> 
     (Instr_ok (C, (Instr.TABLE_SET x), ([Valtype.I32, («$valtype_reftype» rt)], [])))
-  | table_size (C : Context) (tt : Tabletype) (x : Idx) :
-    (x < C.TABLE.length) ->
-    ((C.TABLE.get! x) == tt) ->
+  | table_size (C : Context) (tt : Tabletype) (x : Idx) : 
+    (x < C.TABLE.length) -> 
+    ((C.TABLE.get! x) == tt) -> 
     (Instr_ok (C, (Instr.TABLE_SIZE x), ([], [Valtype.I32])))
-  | table_grow (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
-    (x < C.TABLE.length) ->
-    ((C.TABLE.get! x) == (lim, rt)) ->
+  | table_grow (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) : 
+    (x < C.TABLE.length) -> 
+    ((C.TABLE.get! x) == (lim, rt)) -> 
     (Instr_ok (C, (Instr.TABLE_GROW x), ([(«$valtype_reftype» rt), Valtype.I32], [Valtype.I32])))
-  | table_fill (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) :
-    (x < C.TABLE.length) ->
-    ((C.TABLE.get! x) == (lim, rt)) ->
+  | table_fill (C : Context) (lim : Limits) (rt : Reftype) (x : Idx) : 
+    (x < C.TABLE.length) -> 
+    ((C.TABLE.get! x) == (lim, rt)) -> 
     (Instr_ok (C, (Instr.TABLE_FILL x), ([Valtype.I32, («$valtype_reftype» rt), Valtype.I32], [])))
-  | table_copy (C : Context) (lim_1 : Limits) (lim_2 : Limits) (rt : Reftype) (x_1 : Idx) (x_2 : Idx) :
-    (x_1 < C.TABLE.length) ->
-    (x_2 < C.TABLE.length) ->
-    ((C.TABLE.get! x_1) == (lim_1, rt)) ->
-    ((C.TABLE.get! x_2) == (lim_2, rt)) ->
+  | table_copy (C : Context) (lim_1 : Limits) (lim_2 : Limits) (rt : Reftype) (x_1 : Idx) (x_2 : Idx) : 
+    (x_1 < C.TABLE.length) -> 
+    (x_2 < C.TABLE.length) -> 
+    ((C.TABLE.get! x_1) == (lim_1, rt)) -> 
+    ((C.TABLE.get! x_2) == (lim_2, rt)) -> 
     (Instr_ok (C, (Instr.TABLE_COPY (x_1, x_2)), ([Valtype.I32, Valtype.I32, Valtype.I32], [])))
-  | table_init (C : Context) (lim : Limits) (rt : Reftype) (x_1 : Idx) (x_2 : Idx) :
-    (x_1 < C.TABLE.length) ->
-    (x_2 < C.ELEM.length) ->
-    ((C.TABLE.get! x_1) == (lim, rt)) ->
-    ((C.ELEM.get! x_2) == rt) ->
+  | table_init (C : Context) (lim : Limits) (rt : Reftype) (x_1 : Idx) (x_2 : Idx) : 
+    (x_1 < C.TABLE.length) -> 
+    (x_2 < C.ELEM.length) -> 
+    ((C.TABLE.get! x_1) == (lim, rt)) -> 
+    ((C.ELEM.get! x_2) == rt) -> 
     (Instr_ok (C, (Instr.TABLE_INIT (x_1, x_2)), ([Valtype.I32, Valtype.I32, Valtype.I32], [])))
-  | elem_drop (C : Context) (rt : Reftype) (x : Idx) :
-    (x < C.ELEM.length) ->
-    ((C.ELEM.get! x) == rt) ->
+  | elem_drop (C : Context) (rt : Reftype) (x : Idx) : 
+    (x < C.ELEM.length) -> 
+    ((C.ELEM.get! x) == rt) -> 
     (Instr_ok (C, (Instr.ELEM_DROP x), ([], [])))
-  | memory_size (C : Context) (mt : Memtype) :
-    (0 < C.MEM.length) ->
-    ((C.MEM.get! 0) == mt) ->
+  | memory_size (C : Context) (mt : Memtype) : 
+    (0 < C.MEM.length) -> 
+    ((C.MEM.get! 0) == mt) -> 
     (Instr_ok (C, Instr.MEMORY_SIZE, ([], [Valtype.I32])))
-  | memory_grow (C : Context) (mt : Memtype) :
-    (0 < C.MEM.length) ->
-    ((C.MEM.get! 0) == mt) ->
+  | memory_grow (C : Context) (mt : Memtype) : 
+    (0 < C.MEM.length) -> 
+    ((C.MEM.get! 0) == mt) -> 
     (Instr_ok (C, Instr.MEMORY_GROW, ([Valtype.I32], [Valtype.I32])))
-  | memory_fill (C : Context) (mt : Memtype) :
-    (0 < C.MEM.length) ->
-    ((C.MEM.get! 0) == mt) ->
+  | memory_fill (C : Context) (mt : Memtype) : 
+    (0 < C.MEM.length) -> 
+    ((C.MEM.get! 0) == mt) -> 
     (Instr_ok (C, Instr.MEMORY_FILL, ([Valtype.I32, Valtype.I32, Valtype.I32], [Valtype.I32])))
-  | memory_copy (C : Context) (mt : Memtype) :
-    (0 < C.MEM.length) ->
-    ((C.MEM.get! 0) == mt) ->
+  | memory_copy (C : Context) (mt : Memtype) : 
+    (0 < C.MEM.length) -> 
+    ((C.MEM.get! 0) == mt) -> 
     (Instr_ok (C, Instr.MEMORY_COPY, ([Valtype.I32, Valtype.I32, Valtype.I32], [Valtype.I32])))
-  | memory_init (C : Context) (mt : Memtype) (x : Idx) :
-    (0 < C.MEM.length) ->
-    (x < C.DATA.length) ->
-    ((C.MEM.get! 0) == mt) ->
-    ((C.DATA.get! x) == ()) ->
+  | memory_init (C : Context) (mt : Memtype) (x : Idx) : 
+    (0 < C.MEM.length) -> 
+    (x < C.DATA.length) -> 
+    ((C.MEM.get! 0) == mt) -> 
+    ((C.DATA.get! x) == ()) -> 
     (Instr_ok (C, (Instr.MEMORY_INIT x), ([Valtype.I32, Valtype.I32, Valtype.I32], [Valtype.I32])))
-  | data_drop (C : Context) (x : Idx) :
-    (x < C.DATA.length) ->
-    ((C.DATA.get! x) == ()) ->
+  | data_drop (C : Context) (x : Idx) : 
+    (x < C.DATA.length) -> 
+    ((C.DATA.get! x) == ()) -> 
     (Instr_ok (C, (Instr.DATA_DROP x), ([], [])))
-  | load (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (sx : (Option Sx)) :
-    (0 < C.MEM.length) ->
-    ((«$size» («$valtype_numtype» nt)) != none) ->
-    (Forall (λ n ↦ ((«$size» («$valtype_numtype» nt)) != none)) n.toList) ->
-    ((n == none) = (sx == none)) ->
-    ((C.MEM.get! 0) == mt) ->
-    ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))) ->
-    (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))))) n.toList) ->
-    ((n == none) || (nt == («$numtype_in» «in»))) ->
+  | load (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (sx : (Option Sx)) : 
+    (0 < C.MEM.length) -> 
+    ((«$size» («$valtype_numtype» nt)) != none) -> 
+    (Forall (λ n ↦ ((«$size» («$valtype_numtype» nt)) != none)) n.toList) -> 
+    ((n == none) = (sx == none)) -> 
+    ((C.MEM.get! 0) == mt) -> 
+    ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))) -> 
+    (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))))) n.toList) -> 
+    ((n == none) || (nt == («$numtype_in» «in»))) -> 
     (Instr_ok (C, (Instr.LOAD (nt, (Option.zipWith (λ n sx ↦ (n, sx)) n sx), n_A, n_O)), ([Valtype.I32], [(«$valtype_numtype» nt)])))
-  | store (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) :
-    (0 < C.MEM.length) ->
-    ((«$size» («$valtype_numtype» nt)) != none) ->
-    (Forall (λ n ↦ ((«$size» («$valtype_numtype» nt)) != none)) n.toList) ->
-    ((C.MEM.get! 0) == mt) ->
-    ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))) ->
-    (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))))) n.toList) ->
-    ((n == none) || (nt == («$numtype_in» «in»))) ->
+  | store (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) : 
+    (0 < C.MEM.length) -> 
+    ((«$size» («$valtype_numtype» nt)) != none) -> 
+    (Forall (λ n ↦ ((«$size» («$valtype_numtype» nt)) != none)) n.toList) -> 
+    ((C.MEM.get! 0) == mt) -> 
+    ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))) -> 
+    (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))))) n.toList) -> 
+    ((n == none) || (nt == («$numtype_in» «in»))) -> 
     (Instr_ok (C, (Instr.STORE (nt, n, n_A, n_O)), ([Valtype.I32, («$valtype_numtype» nt)], [])))
 inductive InstrSeq_ok : (Context × (List Instr) × Functype) -> Prop where
-  | empty (C : Context) :
+  | empty (C : Context) : 
     (InstrSeq_ok (C, [], ([], [])))
-  | seq (C : Context) (instr_1 : Instr) (instr_2 : Instr) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (t_3 : (List Valtype)) :
-    (Instr_ok (C, instr_1, (t_1, t_2))) ->
-    (InstrSeq_ok (C, [instr_2], (t_2, t_3))) ->
+  | seq (C : Context) (instr_1 : Instr) (instr_2 : Instr) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (t_3 : (List Valtype)) : 
+    (Instr_ok (C, instr_1, (t_1, t_2))) -> 
+    (InstrSeq_ok (C, [instr_2], (t_2, t_3))) -> 
     (InstrSeq_ok (C, ([instr_1] ++ [instr_2]), (t_1, t_3)))
-  | weak (C : Context) (instr : (List Instr)) (t'_1 : Valtype) (t'_2 : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
-    (InstrSeq_ok (C, instr, (t_1, t_2))) ->
-    (Resulttype_sub ([t'_1], t_1)) ->
-    (Resulttype_sub (t_2, t'_2)) ->
+  | weak (C : Context) (instr : (List Instr)) (t'_1 : Valtype) (t'_2 : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
+    (InstrSeq_ok (C, instr, (t_1, t_2))) -> 
+    (Resulttype_sub ([t'_1], t_1)) -> 
+    (Resulttype_sub (t_2, t'_2)) -> 
     (InstrSeq_ok (C, instr, ([t'_1], t'_2)))
-  | frame (C : Context) (instr : (List Instr)) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
-    (InstrSeq_ok (C, instr, (t_1, t_2))) ->
+  | frame (C : Context) (instr : (List Instr)) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
+    (InstrSeq_ok (C, instr, (t_1, t_2))) -> 
     (InstrSeq_ok (C, instr, ((t ++ t_1), (t ++ t_2))))end
 
 
 inductive Expr_ok : (Context × Expr × Resulttype) -> Prop where
-  | rule_0 (C : Context) (instr : (List Instr)) (t : (List Valtype)) :
-    (InstrSeq_ok (C, instr, ([], t))) ->
+  | rule_0 (C : Context) (instr : (List Instr)) (t : (List Valtype)) : 
+    (InstrSeq_ok (C, instr, ([], t))) -> 
     (Expr_ok (C, instr, t))
 
 inductive Instr_const : (Context × Instr) -> Prop where
-  | const (C : Context) (c : C_numtype) (nt : Numtype) :
+  | const (C : Context) (c : C_numtype) (nt : Numtype) : 
     (Instr_const (C, (Instr.CONST (nt, c))))
-  | ref_null (C : Context) (rt : Reftype) :
+  | ref_null (C : Context) (rt : Reftype) : 
     (Instr_const (C, (Instr.REF_NULL rt)))
-  | ref_func (C : Context) (x : Idx) :
+  | ref_func (C : Context) (x : Idx) : 
     (Instr_const (C, (Instr.REF_FUNC x)))
-  | global_get (C : Context) (t : Valtype) (x : Idx) :
-    (x < C.GLOBAL.length) ->
-    ((C.GLOBAL.get! x) == (none, t)) ->
+  | global_get (C : Context) (t : Valtype) (x : Idx) : 
+    (x < C.GLOBAL.length) -> 
+    ((C.GLOBAL.get! x) == (none, t)) -> 
     (Instr_const (C, (Instr.GLOBAL_GET x)))
 
 inductive Expr_const : (Context × Expr) -> Prop where
-  | rule_0 (C : Context) (instr : (List Instr)) :
-    (Forall (λ instr ↦ (Instr_const (C, instr))) instr) ->
+  | rule_0 (C : Context) (instr : (List Instr)) : 
+    (Forall (λ instr ↦ (Instr_const (C, instr))) instr) -> 
     (Expr_const (C, instr))
 
 inductive Expr_ok_const : (Context × Expr × Valtype) -> Prop where
-  | rule_0 (C : Context) (expr : Expr) (t : Valtype) :
-    (Expr_ok (C, expr, [t])) ->
-    (Expr_const (C, expr)) ->
+  | rule_0 (C : Context) (expr : Expr) (t : Valtype) : 
+    (Expr_ok (C, expr, [t])) -> 
+    (Expr_const (C, expr)) -> 
     (Expr_ok_const (C, expr, t))
 
 inductive Func_ok : (Context × Func × Functype) -> Prop where
-  | rule_0 (C : Context) (expr : Expr) (ft : Functype) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) :
-    (ft == (t_1, t_2)) ->
-    (Functype_ok ft) ->
-    (Expr_ok ((((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := (t_1 ++ t), LABEL := [], RETURN := none}) ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2], RETURN := none}) ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [], RETURN := (some t_2)}), expr, t_2)) ->
+  | rule_0 (C : Context) (expr : Expr) (ft : Functype) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
+    (ft == (t_1, t_2)) -> 
+    (Functype_ok ft) -> 
+    (Expr_ok ((((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := (t_1 ++ t), LABEL := [], RETURN := none}) ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2], RETURN := none}) ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [], RETURN := (some t_2)}), expr, t_2)) -> 
     (Func_ok (C, (ft, t, expr), ft))
 
 inductive Global_ok : (Context × Global × Globaltype) -> Prop where
-  | rule_0 (C : Context) (expr : Expr) (gt : Globaltype) (t : Valtype) :
-    (Globaltype_ok gt) ->
-    (gt == ((some ()), t)) ->
-    (Expr_ok_const (C, expr, t)) ->
+  | rule_0 (C : Context) (expr : Expr) (gt : Globaltype) (t : Valtype) : 
+    (Globaltype_ok gt) -> 
+    (gt == ((some ()), t)) -> 
+    (Expr_ok_const (C, expr, t)) -> 
     (Global_ok (C, (gt, expr), gt))
 
 inductive Table_ok : (Context × Table × Tabletype) -> Prop where
-  | rule_0 (C : Context) (tt : Tabletype) :
-    (Tabletype_ok tt) ->
+  | rule_0 (C : Context) (tt : Tabletype) : 
+    (Tabletype_ok tt) -> 
     (Table_ok (C, tt, tt))
 
 inductive Mem_ok : (Context × Mem × Memtype) -> Prop where
-  | rule_0 (C : Context) (mt : Memtype) :
-    (Memtype_ok mt) ->
+  | rule_0 (C : Context) (mt : Memtype) : 
+    (Memtype_ok mt) -> 
     (Mem_ok (C, mt, mt))
 
 inductive Elemmode_ok : (Context × Elemmode × Reftype) -> Prop where
-  | active (C : Context) (expr : Expr) (lim : Limits) (rt : Reftype) (x : Idx) :
-    (x < C.TABLE.length) ->
-    ((C.TABLE.get! x) == (lim, rt)) ->
-    (Expr_ok_const (C, expr, Valtype.I32)) /- *{} -/ ->
+  | active (C : Context) (expr : Expr) (lim : Limits) (rt : Reftype) (x : Idx) : 
+    (x < C.TABLE.length) -> 
+    ((C.TABLE.get! x) == (lim, rt)) -> 
+    (Expr_ok_const (C, expr, Valtype.I32)) /- *{} -/ -> 
     (Elemmode_ok (C, (Elemmode.TABLE (x, expr)), rt))
-  | declare (C : Context) (rt : Reftype) :
+  | declare (C : Context) (rt : Reftype) : 
     (Elemmode_ok (C, Elemmode.DECLARE, rt))
 
 inductive Elem_ok : (Context × Elem × Reftype) -> Prop where
-  | rule_0 (C : Context) (elemmode : (Option Elemmode)) (expr : (List Expr)) (rt : Reftype) :
-    (Forall (λ expr ↦ (Expr_ok (C, expr, [(«$valtype_reftype» rt)]))) expr) ->
-    (Forall (λ elemmode ↦ (Elemmode_ok (C, elemmode, rt))) elemmode.toList) ->
+  | rule_0 (C : Context) (elemmode : (Option Elemmode)) (expr : (List Expr)) (rt : Reftype) : 
+    (Forall (λ expr ↦ (Expr_ok (C, expr, [(«$valtype_reftype» rt)]))) expr) -> 
+    (Forall (λ elemmode ↦ (Elemmode_ok (C, elemmode, rt))) elemmode.toList) -> 
     (Elem_ok (C, (rt, expr, elemmode), rt))
 
 inductive Datamode_ok : (Context × Datamode) -> Prop where
-  | rule_0 (C : Context) (expr : Expr) (mt : Memtype) :
-    (0 < C.MEM.length) ->
-    ((C.MEM.get! 0) == mt) ->
-    (Expr_ok_const (C, expr, Valtype.I32)) /- *{} -/ ->
+  | rule_0 (C : Context) (expr : Expr) (mt : Memtype) : 
+    (0 < C.MEM.length) -> 
+    ((C.MEM.get! 0) == mt) -> 
+    (Expr_ok_const (C, expr, Valtype.I32)) /- *{} -/ -> 
     (Datamode_ok (C, (Datamode.MEMORY (0, expr))))
 
 inductive Data_ok : (Context × Data) -> Prop where
-  | rule_0 (C : Context) (b : (List (List Byte))) (datamode : (Option Datamode)) :
-    (Forall (λ datamode ↦ (Datamode_ok (C, datamode))) datamode.toList) ->
+  | rule_0 (C : Context) (b : (List (List Byte))) (datamode : (Option Datamode)) : 
+    (Forall (λ datamode ↦ (Datamode_ok (C, datamode))) datamode.toList) -> 
     (Data_ok (C, ((List.map (λ b ↦ b) b), datamode)))
 
 inductive Start_ok : (Context × Start) -> Prop where
-  | rule_0 (C : Context) (x : Idx) :
-    (x < C.FUNC.length) ->
-    ((C.FUNC.get! x) == ([], [])) ->
+  | rule_0 (C : Context) (x : Idx) : 
+    (x < C.FUNC.length) -> 
+    ((C.FUNC.get! x) == ([], [])) -> 
     (Start_ok (C, x))
 
 inductive Import_ok : (Context × Import × Externtype) -> Prop where
-  | rule_0 (C : Context) (name_1 : Name) (name_2 : Name) (xt : Externtype) :
-    (Externtype_ok xt) ->
+  | rule_0 (C : Context) (name_1 : Name) (name_2 : Name) (xt : Externtype) : 
+    (Externtype_ok xt) -> 
     (Import_ok (C, (name_1, name_2, xt), xt))
 
 inductive Externuse_ok : (Context × Externuse × Externtype) -> Prop where
-  | func (C : Context) (ft : Functype) (x : Idx) :
-    (x < C.FUNC.length) ->
-    ((C.FUNC.get! x) == ft) ->
+  | func (C : Context) (ft : Functype) (x : Idx) : 
+    (x < C.FUNC.length) -> 
+    ((C.FUNC.get! x) == ft) -> 
     (Externuse_ok (C, (Externuse.FUNC x), (Externtype.FUNC ft)))
-  | «global» (C : Context) (gt : Globaltype) (x : Idx) :
-    (x < C.GLOBAL.length) ->
-    ((C.GLOBAL.get! x) == gt) ->
+  | «global» (C : Context) (gt : Globaltype) (x : Idx) : 
+    (x < C.GLOBAL.length) -> 
+    ((C.GLOBAL.get! x) == gt) -> 
     (Externuse_ok (C, (Externuse.GLOBAL x), (Externtype.GLOBAL gt)))
-  | table (C : Context) (tt : Tabletype) (x : Idx) :
-    (x < C.TABLE.length) ->
-    ((C.TABLE.get! x) == tt) ->
+  | table (C : Context) (tt : Tabletype) (x : Idx) : 
+    (x < C.TABLE.length) -> 
+    ((C.TABLE.get! x) == tt) -> 
     (Externuse_ok (C, (Externuse.TABLE x), (Externtype.TABLE tt)))
-  | mem (C : Context) (mt : Memtype) (x : Idx) :
-    (x < C.MEM.length) ->
-    ((C.MEM.get! x) == mt) ->
+  | mem (C : Context) (mt : Memtype) (x : Idx) : 
+    (x < C.MEM.length) -> 
+    ((C.MEM.get! x) == mt) -> 
     (Externuse_ok (C, (Externuse.MEMORY x), (Externtype.MEMORY mt)))
 
 inductive Export_ok : (Context × Export × Externtype) -> Prop where
-  | rule_0 (C : Context) (externuse : Externuse) (name : Name) (xt : Externtype) :
-    (Externuse_ok (C, externuse, xt)) ->
+  | rule_0 (C : Context) (externuse : Externuse) (name : Name) (xt : Externtype) : 
+    (Externuse_ok (C, externuse, xt)) -> 
     (Export_ok (C, (name, externuse), xt))
 
 inductive Module_ok : Module -> Prop where
-  | rule_0 (C : Context) (data : (List Data)) (elem : (List Elem)) («export» : (List Export)) (ft : (List Functype)) (func : (List Func)) («global» : (List Global)) (gt : (List Globaltype)) («import» : (List Import)) (mem : (List Mem)) (mt : (List Memtype)) (n : N) (rt : (List Reftype)) (start : (List Start)) (table : (List Table)) (tt : (List Tabletype)) :
-    (ft.length == func.length) ->
-    («global».length == gt.length) ->
-    (table.length == tt.length) ->
-    (mem.length == mt.length) ->
-    (elem.length == rt.length) ->
-    (data.length == n) ->
-    (C == {FUNC := ft, GLOBAL := gt, TABLE := tt, MEM := mt, ELEM := rt, DATA := [()], LOCAL := [], LABEL := [], RETURN := none}) ->
-    (Forall₂ (λ ft func ↦ (Func_ok (C, func, ft))) ft func) ->
-    (Forall₂ (λ «global» gt ↦ (Global_ok (C, «global», gt))) «global» gt) ->
-    (Forall₂ (λ table tt ↦ (Table_ok (C, table, tt))) table tt) ->
-    (Forall₂ (λ mem mt ↦ (Mem_ok (C, mem, mt))) mem mt) ->
-    (Forall₂ (λ elem rt ↦ (Elem_ok (C, elem, rt))) elem rt) ->
-    (Forall (λ data ↦ (Data_ok (C, data))) data) ->
-    (Forall (λ start ↦ (Start_ok (C, start))) start) ->
-    (mem.length <= 1) ->
-    (start.length <= 1) ->
+  | rule_0 (C : Context) (data : (List Data)) (elem : (List Elem)) («export» : (List Export)) (ft : (List Functype)) (func : (List Func)) («global» : (List Global)) (gt : (List Globaltype)) («import» : (List Import)) (mem : (List Mem)) (mt : (List Memtype)) (n : N) (rt : (List Reftype)) (start : (List Start)) (table : (List Table)) (tt : (List Tabletype)) : 
+    (ft.length == func.length) -> 
+    («global».length == gt.length) -> 
+    (table.length == tt.length) -> 
+    (mem.length == mt.length) -> 
+    (elem.length == rt.length) -> 
+    (data.length == n) -> 
+    (C == {FUNC := ft, GLOBAL := gt, TABLE := tt, MEM := mt, ELEM := rt, DATA := [()], LOCAL := [], LABEL := [], RETURN := none}) -> 
+    (Forall₂ (λ ft func ↦ (Func_ok (C, func, ft))) ft func) -> 
+    (Forall₂ (λ «global» gt ↦ (Global_ok (C, «global», gt))) «global» gt) -> 
+    (Forall₂ (λ table tt ↦ (Table_ok (C, table, tt))) table tt) -> 
+    (Forall₂ (λ mem mt ↦ (Mem_ok (C, mem, mt))) mem mt) -> 
+    (Forall₂ (λ elem rt ↦ (Elem_ok (C, elem, rt))) elem rt) -> 
+    (Forall (λ data ↦ (Data_ok (C, data))) data) -> 
+    (Forall (λ start ↦ (Start_ok (C, start))) start) -> 
+    (mem.length <= 1) -> 
+    (start.length <= 1) -> 
     (Module_ok («import», func, «global», table, mem, elem, data, start, «export»))
 
 @[reducible] def Addr := Nat
@@ -878,7 +873,7 @@ def «$default_» : Valtype -> (Option Val)
 
 @[reducible] def Exportinst := /- mixop: EXPORT -/ (Name × Externval)
 
-structure Moduleinst where
+structure Moduleinst where 
   FUNC : (List Funcaddr)
   GLOBAL : (List Globaladdr)
   TABLE : (List Tableaddr)
@@ -910,7 +905,7 @@ instance : Append Moduleinst where
 
 @[reducible] def Datainst := (List Byte)
 
-structure Store where
+structure Store where 
   FUNC : (List Funcinst)
   GLOBAL : (List Globalinst)
   TABLE : (List Tableinst)
@@ -928,7 +923,7 @@ instance : Append Store where
     DATA := r1.DATA ++ r2.DATA,
   }
 
-structure Frame where
+structure Frame where 
   LOCAL : (List Val)
   MODULE : Moduleinst
   deriving Inhabited, BEq
@@ -1116,263 +1111,261 @@ def «$ext» : (Nat × Nat × Sx × C_numtype) -> C_numtype := default
 def «$cvtop» : (Numtype × Cvtop × Numtype × (Option Sx) × C_numtype) -> (List C_numtype) := default
 
 inductive Step_pure_before_ref_is_null_false : (List Admininstr) -> Prop where
-  | ref_is_null_true (rt : Reftype) (val : Val) :
-    (val == (Val.REF_NULL rt)) ->
+  | ref_is_null_true (rt : Reftype) (val : Val) : 
+    (val == (Val.REF_NULL rt)) -> 
     (Step_pure_before_ref_is_null_false [(«$admininstr_val» val), Admininstr.REF_IS_NULL])
 
 inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
-  | unreachable  :
+  | unreachable  : 
     (Step_pure ([Admininstr.UNREACHABLE], [Admininstr.TRAP]))
-  | nop  :
+  | nop  : 
     (Step_pure ([Admininstr.NOP], []))
-  | drop (val : Val) :
+  | drop (val : Val) : 
     (Step_pure ([(«$admininstr_val» val), Admininstr.DROP], []))
-  | select_true (c : C_numtype) (t : (Option Valtype)) (val_1 : Val) (val_2 : Val) :
-    (c != 0) ->
+  | select_true (c : C_numtype) (t : (Option Valtype)) (val_1 : Val) (val_2 : Val) : 
+    (c != 0) -> 
     (Step_pure ([(«$admininstr_val» val_1), («$admininstr_val» val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)], [(«$admininstr_val» val_1)]))
-  | select_false (c : C_numtype) (t : (Option Valtype)) (val_1 : Val) (val_2 : Val) :
-    (c == 0) ->
+  | select_false (c : C_numtype) (t : (Option Valtype)) (val_1 : Val) (val_2 : Val) : 
+    (c == 0) -> 
     (Step_pure ([(«$admininstr_val» val_1), («$admininstr_val» val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)], [(«$admininstr_val» val_2)]))
-  | block (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
-    (t_1.length == k) ->
-    (t_2.length == n) ->
-    (val.length == k) ->
-    (bt == (t_1, t_2)) ->
+  | block (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) : 
+    (t_1.length == k) -> 
+    (t_2.length == n) -> 
+    (val.length == k) -> 
+    (bt == (t_1, t_2)) -> 
     (Step_pure (((List.map «$admininstr_val» val) ++ [(Admininstr.BLOCK (bt, instr))]), [(Admininstr.LABEL_ (n, [], ((List.map «$admininstr_val» val) ++ (List.map «$admininstr_instr» instr))))]))
-  | loop (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) :
-    (t_1.length == k) ->
-    (t_2.length == n) ->
-    (val.length == k) ->
-    (bt == (t_1, t_2)) ->
+  | loop (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) : 
+    (t_1.length == k) -> 
+    (t_2.length == n) -> 
+    (val.length == k) -> 
+    (bt == (t_1, t_2)) -> 
     (Step_pure (((List.map «$admininstr_val» val) ++ [(Admininstr.LOOP (bt, instr))]), [(Admininstr.LABEL_ (n, [(Instr.LOOP (bt, instr))], ((List.map «$admininstr_val» val) ++ (List.map «$admininstr_instr» instr))))]))
-  | if_true (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) :
-    (c != 0) ->
+  | if_true (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) : 
+    (c != 0) -> 
     (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.IF (bt, instr_1, instr_2))], [(Admininstr.BLOCK (bt, instr_1))]))
-  | if_false (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) :
-    (c == 0) ->
+  | if_false (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) : 
+    (c == 0) -> 
     (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.IF (bt, instr_1, instr_2))], [(Admininstr.BLOCK (bt, instr_2))]))
-  | label_vals (instr : (List Instr)) (n : N) (val : (List Val)) :
+  | label_vals (instr : (List Instr)) (n : N) (val : (List Val)) : 
     (Step_pure ([(Admininstr.LABEL_ (n, instr, (List.map «$admininstr_val» val)))], (List.map «$admininstr_val» val)))
-  | br_zero (instr : (List Instr)) (instr' : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) :
-    (val.length == n) ->
+  | br_zero (instr : (List Instr)) (instr' : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) : 
+    (val.length == n) -> 
     (Step_pure ([(Admininstr.LABEL_ (n, instr', ((List.map «$admininstr_val» val') ++ ((List.map «$admininstr_val» val) ++ ([(Admininstr.BR 0)] ++ (List.map «$admininstr_instr» instr))))))], ((List.map «$admininstr_val» val) ++ (List.map «$admininstr_instr» instr'))))
-  | br_succ (instr : (List Instr)) (instr' : (List Instr)) (l : Labelidx) (n : N) (val : (List Val)) :
+  | br_succ (instr : (List Instr)) (instr' : (List Instr)) (l : Labelidx) (n : N) (val : (List Val)) : 
     (Step_pure ([(Admininstr.LABEL_ (n, instr', ((List.map «$admininstr_val» val) ++ ([(Admininstr.BR (l + 1))] ++ (List.map «$admininstr_instr» instr)))))], ((List.map «$admininstr_val» val) ++ [(Admininstr.BR l)])))
-  | br_if_true (c : C_numtype) (l : Labelidx) :
-    (c != 0) ->
+  | br_if_true (c : C_numtype) (l : Labelidx) : 
+    (c != 0) -> 
     (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.BR_IF l)], [(Admininstr.BR l)]))
-  | br_if_false (c : C_numtype) (l : Labelidx) :
-    (c == 0) ->
+  | br_if_false (c : C_numtype) (l : Labelidx) : 
+    (c == 0) -> 
     (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.BR_IF l)], []))
-  | br_table_lt (i : Nat) (l : (List Labelidx)) (l' : Labelidx) :
-    (i < l.length) ->
+  | br_table_lt (i : Nat) (l : (List Labelidx)) (l' : Labelidx) : 
+    (i < l.length) -> 
     (Step_pure ([(Admininstr.CONST (Numtype.I32, i)), (Admininstr.BR_TABLE (l, l'))], [(Admininstr.BR (l.get! i))]))
-  | br_table_ge (i : Nat) (l : (List Labelidx)) (l' : Labelidx) :
-    (i >= l.length) ->
+  | br_table_ge (i : Nat) (l : (List Labelidx)) (l' : Labelidx) : 
+    (i >= l.length) -> 
     (Step_pure ([(Admininstr.CONST (Numtype.I32, i)), (Admininstr.BR_TABLE (l, l'))], [(Admininstr.BR l')]))
-  | frame_vals (f : Frame) (n : N) (val : (List Val)) :
-    (val.length == n) ->
+  | frame_vals (f : Frame) (n : N) (val : (List Val)) : 
+    (val.length == n) -> 
     (Step_pure ([(Admininstr.FRAME_ (n, f, (List.map «$admininstr_val» val)))], (List.map «$admininstr_val» val)))
-  | return_frame (f : Frame) (instr : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) :
-    (val.length == n) ->
+  | return_frame (f : Frame) (instr : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) : 
+    (val.length == n) -> 
     (Step_pure ([(Admininstr.FRAME_ (n, f, ((List.map «$admininstr_val» val') ++ ((List.map «$admininstr_val» val) ++ ([Admininstr.RETURN] ++ (List.map «$admininstr_instr» instr))))))], (List.map «$admininstr_val» val)))
-  | return_label (instr : (List Instr)) (instr' : (List Instr)) (k : Nat) (val : (List Val)) :
+  | return_label (instr : (List Instr)) (instr' : (List Instr)) (k : Nat) (val : (List Val)) : 
     (Step_pure ([(Admininstr.LABEL_ (k, instr', ((List.map «$admininstr_val» val) ++ ([Admininstr.RETURN] ++ (List.map «$admininstr_instr» instr)))))], ((List.map «$admininstr_val» val) ++ [Admininstr.RETURN])))
-  | unop_val (c : C_numtype) (c_1 : C_numtype) (nt : Numtype) (unop : Unop_numtype) :
-    ((«$unop» (unop, nt, c_1)) == [c]) ->
+  | unop_val (c : C_numtype) (c_1 : C_numtype) (nt : Numtype) (unop : Unop_numtype) : 
+    ((«$unop» (unop, nt, c_1)) == [c]) -> 
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.UNOP (nt, unop))], [(Admininstr.CONST (nt, c))]))
-  | unop_trap (c_1 : C_numtype) (nt : Numtype) (unop : Unop_numtype) :
-    ((«$unop» (unop, nt, c_1)) == []) ->
+  | unop_trap (c_1 : C_numtype) (nt : Numtype) (unop : Unop_numtype) : 
+    ((«$unop» (unop, nt, c_1)) == []) -> 
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.UNOP (nt, unop))], [Admininstr.TRAP]))
-  | binop_val (binop : Binop_numtype) (c : C_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) :
-    ((«$binop» (binop, nt, c_1, c_2)) == [c]) ->
+  | binop_val (binop : Binop_numtype) (c : C_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) : 
+    ((«$binop» (binop, nt, c_1, c_2)) == [c]) -> 
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.BINOP (nt, binop))], [(Admininstr.CONST (nt, c))]))
-  | binop_trap (binop : Binop_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) :
-    ((«$binop» (binop, nt, c_1, c_2)) == []) ->
+  | binop_trap (binop : Binop_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) : 
+    ((«$binop» (binop, nt, c_1, c_2)) == []) -> 
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.BINOP (nt, binop))], [Admininstr.TRAP]))
-  | testop (c : C_numtype) (c_1 : C_numtype) (nt : Numtype) (testop : Testop_numtype) :
-    (c == («$testop» (testop, nt, c_1))) ->
+  | testop (c : C_numtype) (c_1 : C_numtype) (nt : Numtype) (testop : Testop_numtype) : 
+    (c == («$testop» (testop, nt, c_1))) -> 
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.TESTOP (nt, testop))], [(Admininstr.CONST (Numtype.I32, c))]))
-  | relop (c : C_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) (relop : Relop_numtype) :
-    (c == («$relop» (relop, nt, c_1, c_2))) ->
+  | relop (c : C_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) (relop : Relop_numtype) : 
+    (c == («$relop» (relop, nt, c_1, c_2))) -> 
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.RELOP (nt, relop))], [(Admininstr.CONST (Numtype.I32, c))]))
-  | extend (c : C_numtype) (n : N) (nt : Numtype) :
-    ((«$size» («$valtype_numtype» nt)) != none) ->
+  | extend (c : C_numtype) (n : N) (nt : Numtype) : 
+    ((«$size» («$valtype_numtype» nt)) != none) -> 
     (Step_pure ([(Admininstr.CONST (nt, c)), (Admininstr.EXTEND (nt, n))], [(Admininstr.CONST (nt, («$ext» (n, («$size» («$valtype_numtype» nt)).get!, Sx.S, c))))]))
-  | cvtop_val (c : C_numtype) (c_1 : C_numtype) (cvtop : Cvtop) (nt : Numtype) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) :
-    ((«$cvtop» (nt_1, cvtop, nt_2, sx, c_1)) == [c]) ->
+  | cvtop_val (c : C_numtype) (c_1 : C_numtype) (cvtop : Cvtop) (nt : Numtype) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) : 
+    ((«$cvtop» (nt_1, cvtop, nt_2, sx, c_1)) == [c]) -> 
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CVTOP (nt_1, cvtop, nt_2, sx))], [(Admininstr.CONST (nt, c))]))
-  | cvtop_trap (c_1 : C_numtype) (cvtop : Cvtop) (nt : Numtype) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) :
-    ((«$cvtop» (nt_1, cvtop, nt_2, sx, c_1)) == []) ->
+  | cvtop_trap (c_1 : C_numtype) (cvtop : Cvtop) (nt : Numtype) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) : 
+    ((«$cvtop» (nt_1, cvtop, nt_2, sx, c_1)) == []) -> 
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CVTOP (nt_1, cvtop, nt_2, sx))], [Admininstr.TRAP]))
-  | ref_is_null_true (rt : Reftype) (val : Val) :
-    (val == (Val.REF_NULL rt)) ->
+  | ref_is_null_true (rt : Reftype) (val : Val) : 
+    (val == (Val.REF_NULL rt)) -> 
     (Step_pure ([(«$admininstr_val» val), Admininstr.REF_IS_NULL], [(Admininstr.CONST (Numtype.I32, 1))]))
-  | ref_is_null_false (val : Val) :
-    (Not (Step_pure_before_ref_is_null_false [(«$admininstr_val» val), Admininstr.REF_IS_NULL])) ->
+  | ref_is_null_false (val : Val) : 
+    (Not (Step_pure_before_ref_is_null_false [(«$admininstr_val» val), Admininstr.REF_IS_NULL])) -> 
     (Step_pure ([(«$admininstr_val» val), Admininstr.REF_IS_NULL], [(Admininstr.CONST (Numtype.I32, 0))]))
-  | local_tee (val : Val) (x : Idx) :
+  | local_tee (val : Val) (x : Idx) : 
     (Step_pure ([(«$admininstr_val» val), (Admininstr.LOCAL_TEE x)], [(«$admininstr_val» val), («$admininstr_val» val), (Admininstr.LOCAL_SET x)]))
 
 inductive Step_read_before_call_indirect_trap : Config -> Prop where
-  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
-    (i < («$table» (z, x)).length) ->
-    (a < («$funcinst» z).length) ->
-    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
-    (((«$funcinst» z).get! a) == (m, func)) ->
+  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) : 
+    (i < («$table» (z, x)).length) -> 
+    (a < («$funcinst» z).length) -> 
+    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) -> 
+    (((«$funcinst» z).get! a) == (m, func)) -> 
     (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
 
 inductive Step_read_before_table_fill_zero : Config -> Prop where
-  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    ((i + n) > («$table» (z, x)).length) ->
+  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) : 
+    ((i + n) > («$table» (z, x)).length) -> 
     (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
 
 inductive Step_read_before_table_fill_succ : Config -> Prop where
-  | table_fill_zero (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    (Not (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
-    (n == 0) ->
+  | table_fill_zero (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) : 
+    (Not (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) -> 
+    (n == 0) -> 
     (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
-  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    ((i + n) > («$table» (z, x)).length) ->
+  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) : 
+    ((i + n) > («$table» (z, x)).length) -> 
     (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))
 
 inductive Step_read_before_table_copy_zero : Config -> Prop where
-  | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
+  | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) -> 
     (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
 
 inductive Step_read_before_table_copy_le : Config -> Prop where
-  | table_copy_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (Not (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
-    (n == 0) ->
+  | table_copy_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (Not (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) -> 
+    (n == 0) -> 
     (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
-  | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
+  | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) -> 
     (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
 
 inductive Step_read_before_table_copy_gt : Config -> Prop where
-  | table_copy_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (Not (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
-    (j <= i) ->
+  | table_copy_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (Not (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) -> 
+    (j <= i) -> 
     (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
-  | table_copy_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (Not (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
-    (n == 0) ->
+  | table_copy_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (Not (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) -> 
+    (n == 0) -> 
     (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
-  | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
+  | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) -> 
     (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))
 
 inductive Step_read_before_table_init_zero : Config -> Prop where
-  | table_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (((i + n) > («$elem» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
+  | table_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (((i + n) > («$elem» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) -> 
     (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))
 
 inductive Step_read_before_table_init_succ : Config -> Prop where
-  | table_init_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (Not (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))) ->
-    (n == 0) ->
+  | table_init_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (Not (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))) -> 
+    (n == 0) -> 
     (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))
-  | table_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (((i + n) > («$elem» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
+  | table_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (((i + n) > («$elem» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) -> 
     (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))
 
 inductive Step_read : (Config × (List Admininstr)) -> Prop where
-  | call (x : Idx) (z : State) :
-    (x < («$funcaddr» z).length) ->
+  | call (x : Idx) (z : State) : 
+    (x < («$funcaddr» z).length) -> 
     (Step_read ((z, [(Admininstr.CALL x)]), [(Admininstr.CALL_ADDR ((«$funcaddr» z).get! x))]))
-  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) :
-    (i < («$table» (z, x)).length) ->
-    (a < («$funcinst» z).length) ->
-    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) ->
-    (((«$funcinst» z).get! a) == (m, func)) ->
+  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) : 
+    (i < («$table» (z, x)).length) -> 
+    (a < («$funcinst» z).length) -> 
+    (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) -> 
+    (((«$funcinst» z).get! a) == (m, func)) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [(Admininstr.CALL_ADDR a)]))
-  | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) :
-    (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) ->
+  | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) : 
+    (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [Admininstr.TRAP]))
-  | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) :
-    (a < («$funcinst» z).length) ->
-    (t_1.length == k) ->
-    (t_2.length == n) ->
-    (val.length == k) ->
-    (Forall (λ t ↦ ((«$default_» t) != none)) t) ->
-    (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) ->
-    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) ->
+  | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) : 
+    (a < («$funcinst» z).length) -> 
+    (t_1.length == k) -> 
+    (t_2.length == n) -> 
+    (val.length == k) -> 
+    (Forall (λ t ↦ ((«$default_» t) != none)) t) -> 
+    (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) -> 
+    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) -> 
     (Step_read ((z, ((List.map «$admininstr_val» val) ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, f, [(Admininstr.LABEL_ (n, [], (List.map «$admininstr_instr» instr)))]))]))
-  | ref_func (x : Idx) (z : State) :
-    (x < («$funcaddr» z).length) ->
+  | ref_func (x : Idx) (z : State) : 
+    (x < («$funcaddr» z).length) -> 
     (Step_read ((z, [(Admininstr.REF_FUNC x)]), [(Admininstr.REF_FUNC_ADDR ((«$funcaddr» z).get! x))]))
-  | local_get (x : Idx) (z : State) :
+  | local_get (x : Idx) (z : State) : 
     (Step_read ((z, [(Admininstr.LOCAL_GET x)]), [(«$admininstr_val» («$local» (z, x)))]))
-  | global_get (x : Idx) (z : State) :
+  | global_get (x : Idx) (z : State) : 
     (Step_read ((z, [(Admininstr.GLOBAL_GET x)]), [(«$admininstr_globalinst» («$global» (z, x)))]))
-  | table_get_trap (i : Nat) (x : Idx) (z : State) :
-    (i >= («$table» (z, x)).length) ->
+  | table_get_trap (i : Nat) (x : Idx) (z : State) : 
+    (i >= («$table» (z, x)).length) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]), [Admininstr.TRAP]))
-  | table_get_val (i : Nat) (x : Idx) (z : State) :
-    (i < («$table» (z, x)).length) ->
+  | table_get_val (i : Nat) (x : Idx) (z : State) : 
+    (i < («$table» (z, x)).length) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]), [(«$admininstr_ref» ((«$table» (z, x)).get! i))]))
-  | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) :
-    (i >= («$table» (z, x)).length) ->
+  | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) : 
+    (i >= («$table» (z, x)).length) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]), [Admininstr.TRAP]))
-  | table_size (n : N) (x : Idx) (z : State) :
-    ((«$table» (z, x)).length == n) ->
+  | table_size (n : N) (x : Idx) (z : State) : 
+    ((«$table» (z, x)).length == n) -> 
     (Step_read ((z, [(Admininstr.TABLE_SIZE x)]), [(Admininstr.CONST (Numtype.I32, n))]))
-  | table_grow_fail (n : N) (x : Idx) (z : State) :
+  | table_grow_fail (n : N) (x : Idx) (z : State) : 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), [(Admininstr.CONST (Numtype.I32, default /- - 1 -/))]))
-  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    ((i + n) > («$table» (z, x)).length) ->
+  | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) : 
+    ((i + n) > («$table» (z, x)).length) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), [Admininstr.TRAP]))
-  | table_fill_zero (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    (Not (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
-    (n == 0) ->
+  | table_fill_zero (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) : 
+    (Not (Step_read_before_table_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) -> 
+    (n == 0) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), []))
-  | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) :
-    (Not (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) ->
+  | table_fill_succ (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) : 
+    (Not (Step_read_before_table_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]))) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (i + 1))), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_FILL x)]))
-  | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
+  | table_copy_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (((i + n) > («$table» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]), [Admininstr.TRAP]))
-  | table_copy_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (Not (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
-    (n == 0) ->
+  | table_copy_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (Not (Step_read_before_table_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) -> 
+    (n == 0) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]), []))
-  | table_copy_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (Not (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
-    (j <= i) ->
+  | table_copy_le (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (Not (Step_read_before_table_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) -> 
+    (j <= i) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]), [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET y), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_COPY (x, y))]))
-  | table_copy_gt (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (Not (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) ->
+  | table_copy_gt (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (Not (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]), [(Admininstr.CONST (Numtype.I32, ((j + n) - 1))), (Admininstr.CONST (Numtype.I32, ((i + n) - 1))), (Admininstr.TABLE_GET y), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_COPY (x, y))]))
-  | table_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (((i + n) > («$elem» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) ->
+  | table_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (((i + n) > («$elem» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), [Admininstr.TRAP]))
-  | table_init_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (Not (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))) ->
-    (n == 0) ->
+  | table_init_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (Not (Step_read_before_table_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))) -> 
+    (n == 0) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), []))
-  | table_init_succ (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) :
-    (i < («$elem» (z, y)).length) ->
-    (Not (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))) ->
+  | table_init_succ (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (i < («$elem» (z, y)).length) -> 
+    (Not (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), [(Admininstr.CONST (Numtype.I32, j)), («$admininstr_ref» ((«$elem» (z, y)).get! i)), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_INIT (x, y))]))
 
 inductive Step : (Config × Config) -> Prop where
-  | pure (instr : (List Instr)) (instr' : (List Instr)) (z : State) :
-    (Step_pure ((List.map «$admininstr_instr» instr), (List.map «$admininstr_instr» instr'))) ->
+  | pure (instr : (List Instr)) (instr' : (List Instr)) (z : State) : 
+    (Step_pure ((List.map «$admininstr_instr» instr), (List.map «$admininstr_instr» instr'))) -> 
     (Step ((z, (List.map «$admininstr_instr» instr)), (z, (List.map «$admininstr_instr» instr'))))
-  | read (instr : (List Instr)) (instr' : (List Instr)) (z : State) :
-    (Step_read ((z, (List.map «$admininstr_instr» instr)), (List.map «$admininstr_instr» instr'))) ->
+  | read (instr : (List Instr)) (instr' : (List Instr)) (z : State) : 
+    (Step_read ((z, (List.map «$admininstr_instr» instr)), (List.map «$admininstr_instr» instr'))) -> 
     (Step ((z, (List.map «$admininstr_instr» instr)), (z, (List.map «$admininstr_instr» instr'))))
-  | local_set (val : Val) (x : Idx) (z : State) :
+  | local_set (val : Val) (x : Idx) (z : State) : 
     (Step ((z, [(«$admininstr_val» val), (Admininstr.LOCAL_SET x)]), ((«$with_local» (z, x, val)), [])))
-  | global_set (val : Val) (x : Idx) (z : State) :
+  | global_set (val : Val) (x : Idx) (z : State) : 
     (Step ((z, [(«$admininstr_val» val), (Admininstr.GLOBAL_SET x)]), ((«$with_global» (z, x, val)), [])))
-  | table_set_val (i : Nat) (ref : Ref) (x : Idx) (z : State) :
-    (i < («$table» (z, x)).length) ->
+  | table_set_val (i : Nat) (ref : Ref) (x : Idx) (z : State) : 
+    (i < («$table» (z, x)).length) -> 
     (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]), ((«$with_table» (z, x, i, ref)), [])))
-  | table_grow_succeed (n : N) (ref : Ref) (x : Idx) (z : State) :
+  | table_grow_succeed (n : N) (ref : Ref) (x : Idx) (z : State) : 
     (Step ((z, [(«$admininstr_ref» ref), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), ((«$with_tableext» (z, x, [ref])), [(Admininstr.CONST (Numtype.I32, («$table» (z, x)).length))])))
-  | elem_drop (x : Idx) (z : State) :
-    (Step ((z, [(Admininstr.ELEM_DROP x)]), ((«$with_elem» (z, x, [])), [])))
-$ lean SpecTec.lean 2>&1 | sed -e 's,/[^ ]*/toolchains,.../toolchains`,g' | sed -e 's,SpecTec.lean:[0-9]\+:[0-9]\+,SpecTec.lean,' | sed -e 's,\?m\.[0-9]\+,?m,g'
-```
+  | elem_drop (x : Idx) (z : State) : 
+    (Step ((z, [(Admininstr.ELEM_DROP x)]), ((«$with_elem» (z, x, [])), [])))
\ No newline at end of file
diff --git a/spectec/test-lean4/dune b/spectec/test-lean4/dune
index 47035d055b..bbf7877e85 100644
--- a/spectec/test-lean4/dune
+++ b/spectec/test-lean4/dune
@@ -1,8 +1,22 @@
-(mdx
-  (libraries spectec)
+(rule
+  (targets stderr.current SpecTec.lean.current)
   (deps
     (file ../src/exe-watsup/main.exe)
     (glob_files ../spec/*.watsup)
   )
-  (files TEST.md)
+  (action
+    (progn
+      (write-file SpecTec.lean.current "not generated")
+      (with-stderr-to stderr.current (run %{deps} --lean4 -o SpecTec.lean.current))
+    )
+  )
+)
+
+(rule
+ (alias   runtest)
+ (action (diff stderr.expected stderr.current))
+)
+(rule
+ (alias   runtest)
+ (action (diff SpecTec.lean SpecTec.lean.current))
 )

From 84abc0c1125903ccc0a48de2cf414398c36c9733 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sun, 9 Apr 2023 22:29:41 +0200
Subject: [PATCH 69/98] Add negated premises

---
 spectec/src/frontend/multiplicity.ml | 1 +
 spectec/src/il/ast.ml                | 1 +
 spectec/src/il/free.ml               | 1 +
 spectec/src/il/print.ml              | 1 +
 spectec/src/il/validation.ml         | 2 ++
 spectec/src/middlend/totalize.ml     | 1 +
 6 files changed, 7 insertions(+)

diff --git a/spectec/src/frontend/multiplicity.ml b/spectec/src/frontend/multiplicity.ml
index e9e716b0ef..a8b209856e 100644
--- a/spectec/src/frontend/multiplicity.ml
+++ b/spectec/src/frontend/multiplicity.ml
@@ -288,6 +288,7 @@ and annot_prem env prem : Il.Ast.premise * occur =
     let prem1', occur1 = annot_prem env prem1 in
     let iter', occur' = annot_iterexp env occur1 iter prem.at in
     IterPr (prem1', iter') $ prem.at, occur'
+  | NegPr prem' -> annot_prem env prem'
 
 
 let annot_exp env e =
diff --git a/spectec/src/il/ast.ml b/spectec/src/il/ast.ml
index 2730a0cd9f..4978cd6869 100644
--- a/spectec/src/il/ast.ml
+++ b/spectec/src/il/ast.ml
@@ -153,6 +153,7 @@ and premise' =
   | IfPr of exp                                       (* side condition *)
   | ElsePr                                            (* otherwise *)
   | IterPr of premise * iterexp                       (* iteration *)
+  | NegPr of premise                                  (* negation of a premise *)
 
 and hint = {hintid : id; hintexp : string list}       (* hint *)
 
diff --git a/spectec/src/il/free.ml b/spectec/src/il/free.ml
index 7d2128735e..bb3e6436a8 100644
--- a/spectec/src/il/free.ml
+++ b/spectec/src/il/free.ml
@@ -118,6 +118,7 @@ let rec free_prem prem =
   | IfPr e -> free_exp e
   | ElsePr -> empty
   | IterPr (prem', iter) -> union (free_prem prem') (free_iterexp iter)
+  | NegPr prem' -> free_prem prem'
 
 let free_rule rule =
   match rule.it with
diff --git a/spectec/src/il/print.ml b/spectec/src/il/print.ml
index a76d8ca95e..83d6717b03 100644
--- a/spectec/src/il/print.ml
+++ b/spectec/src/il/print.ml
@@ -199,6 +199,7 @@ let rec string_of_prem prem =
     string_of_prem prem' ^ string_of_iterexp iter
   | IterPr (prem', iter) ->
     "(" ^ string_of_prem prem' ^ ")" ^ string_of_iterexp iter
+  | NegPr prem' -> "unless " ^ string_of_prem prem'
 
 
 let string_of_rule rule =
diff --git a/spectec/src/il/validation.ml b/spectec/src/il/validation.ml
index fcdd4c52c6..2e9b1398ad 100644
--- a/spectec/src/il/validation.ml
+++ b/spectec/src/il/validation.ml
@@ -494,6 +494,8 @@ let rec valid_prem env prem =
   | IterPr (prem', iter) ->
     let env' = valid_iterexp env iter in
     valid_prem env' prem'
+  | NegPr prem' ->
+    valid_prem env prem'
 
 
 let valid_rule env mixop t rule =
diff --git a/spectec/src/middlend/totalize.ml b/spectec/src/middlend/totalize.ml
index f291c0173f..31b1940815 100644
--- a/spectec/src/middlend/totalize.ml
+++ b/spectec/src/middlend/totalize.ml
@@ -95,6 +95,7 @@ let rec t_prem' env = function
   | IfPr e -> IfPr (t_exp env e)
   | ElsePr -> ElsePr
   | IterPr (prem, iterexp) -> IterPr (t_prem env prem, t_iterexp env iterexp)
+  | NegPr prem -> NegPr (t_prem env prem)
 
 and t_prem env x = { x with it = t_prem' env x.it }
 

From 44a44466b5cb1994c83909cf85ba0c5038346f9c Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sun, 9 Apr 2023 22:30:57 +0200
Subject: [PATCH 70/98] eq_prem: Add NegPr case

---
 spectec/src/il/eq.ml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/spectec/src/il/eq.ml b/spectec/src/il/eq.ml
index 5853720947..54c7ec396a 100644
--- a/spectec/src/il/eq.ml
+++ b/spectec/src/il/eq.ml
@@ -105,4 +105,5 @@ let rec eq_prem prem1 prem2 =
   | ElsePr, ElsePr -> true
   | IterPr (prem1, iterexp1), IterPr (prem2, iterexp2) ->
   eq_prem prem1 prem2 && eq_iterexp iterexp1 iterexp2
+  | NegPr prem1, NegPr prem2 -> eq_prem prem1 prem2
   | _, _ -> false

From 4b6dc628ca0760284fe9fa5f3e98d9be63797b27 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Sun, 9 Apr 2023 22:35:08 +0200
Subject: [PATCH 71/98] Remove implied premises by prior premises, cleans up
 some noise

---
 spectec/src/middlend/sideconditions.ml | 9 ++++++++-
 spectec/test-lean4/SpecTec.lean        | 2 --
 spectec/test-middlend/TEST.md          | 4 ----
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/spectec/src/middlend/sideconditions.ml b/spectec/src/middlend/sideconditions.ml
index 0344f67830..d81729173b 100644
--- a/spectec/src/middlend/sideconditions.ml
+++ b/spectec/src/middlend/sideconditions.ml
@@ -101,10 +101,17 @@ let rec t_prem prem = match prem.it with
 
 let t_prems = List.concat_map t_prem
 
+(* Does prem1 obviously imply prem2? *)
+let rec implies prem1 prem2 = Il.Eq.eq_prem prem1 prem2 ||
+  match prem2.it with
+  | IterPr (prem2', _) -> implies prem1 prem2'
+  | _ -> false
+
+
 let t_rule' = function
   | RuleD (id, binds, mixop, exp, prems) ->
     let extra_prems = t_prems prems @ t_exp exp in
-    let prems' = Util.Lib.List.nub Il.Eq.eq_prem (extra_prems @ prems) in
+    let prems' = Util.Lib.List.nub implies (extra_prems @ prems) in
     RuleD (id, binds, mixop, exp, prems')
 
 let t_rule x = { x with it = t_rule' x.it }
diff --git a/spectec/test-lean4/SpecTec.lean b/spectec/test-lean4/SpecTec.lean
index 42586b4940..994fb7c726 100644
--- a/spectec/test-lean4/SpecTec.lean
+++ b/spectec/test-lean4/SpecTec.lean
@@ -641,7 +641,6 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
   | load (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (sx : (Option Sx)) : 
     (0 < C.MEM.length) -> 
     ((«$size» («$valtype_numtype» nt)) != none) -> 
-    (Forall (λ n ↦ ((«$size» («$valtype_numtype» nt)) != none)) n.toList) -> 
     ((n == none) = (sx == none)) -> 
     ((C.MEM.get! 0) == mt) -> 
     ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))) -> 
@@ -651,7 +650,6 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
   | store (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) : 
     (0 < C.MEM.length) -> 
     ((«$size» («$valtype_numtype» nt)) != none) -> 
-    (Forall (λ n ↦ ((«$size» («$valtype_numtype» nt)) != none)) n.toList) -> 
     ((C.MEM.get! 0) == mt) -> 
     ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))) -> 
     (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))))) n.toList) -> 
diff --git a/spectec/test-middlend/TEST.md b/spectec/test-middlend/TEST.md
index 39363224c8..8275387ee1 100644
--- a/spectec/test-middlend/TEST.md
+++ b/spectec/test-middlend/TEST.md
@@ -5639,7 +5639,6 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
     -- if (0 < |C.MEM_context|)
     -- if ($size(nt <: valtype) =/= ?())
-    -- (if ($size(nt <: valtype) =/= ?()))?{n}
     -- if ((n?{n} = ?()) <=> (sx?{sx} = ?()))
     -- if (C.MEM_context[0] = mt)
     -- if ((2 ^ n_A) <= (!($size(nt <: valtype)) / 8))
@@ -5651,7 +5650,6 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype (nt <: valtype)], []))
     -- if (0 < |C.MEM_context|)
     -- if ($size(nt <: valtype) =/= ?())
-    -- (if ($size(nt <: valtype) =/= ?()))?{n}
     -- if (C.MEM_context[0] = mt)
     -- if ((2 ^ n_A) <= (!($size(nt <: valtype)) / 8))
     -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size(nt <: valtype)) / 8))))?{n}
@@ -7385,7 +7383,6 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
     -- if (0 < |C.MEM_context|)
     -- if ($size(nt <: valtype) =/= ?())
-    -- (if ($size(nt <: valtype) =/= ?()))?{n}
     -- if ((n?{n} = ?()) <=> (sx?{sx} = ?()))
     -- if (C.MEM_context[0] = mt)
     -- if ((2 ^ n_A) <= (!($size(nt <: valtype)) / 8))
@@ -7397,7 +7394,6 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype (nt <: valtype)], []))
     -- if (0 < |C.MEM_context|)
     -- if ($size(nt <: valtype) =/= ?())
-    -- (if ($size(nt <: valtype) =/= ?()))?{n}
     -- if (C.MEM_context[0] = mt)
     -- if ((2 ^ n_A) <= (!($size(nt <: valtype)) / 8))
     -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size(nt <: valtype)) / 8))))?{n}

From ab04eb6940395e3fddd26fee16bcefe248fa4352 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Mon, 10 Apr 2023 21:43:48 +0200
Subject: [PATCH 72/98] CompE is actually flipped concatenation

---
 spectec/src/backend-lean4/gen.ml |  2 +-
 spectec/test-lean4/SpecTec.lean  | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index a0f663b639..d36c448ca4 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -150,7 +150,7 @@ let rec render_exp (exp : exp) = match exp.it with
   | CmpE (GeOp, e1, e2)    -> parens (render_exp e1 ^ " >= "  ^ render_exp e2)
   | CmpE (GtOp, e1, e2)    -> parens (render_exp e1 ^ " > "   ^ render_exp e2)
   | CatE (e1, e2)          -> parens (render_exp e1 ^ " ++ "  ^ render_exp e2)
-  | CompE (e1, e2)         -> parens (render_exp e1 ^ " ++ "  ^ render_exp e2)
+  | CompE (e1, e2)         -> parens (render_exp e2 ^ " ++ "  ^ render_exp e1) (* NB! flip order *)
   | _ -> "default /- " ^ Il.Print.string_of_exp exp ^ " -/"
 
 and render_case a e typ =
diff --git a/spectec/test-lean4/SpecTec.lean b/spectec/test-lean4/SpecTec.lean
index 994fb7c726..70457618fc 100644
--- a/spectec/test-lean4/SpecTec.lean
+++ b/spectec/test-lean4/SpecTec.lean
@@ -482,16 +482,16 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (Instr_ok (C, (Instr.SELECT none), ([t, t, Valtype.I32], [t])))
   | block (C : Context) (bt : Blocktype) (instr : (List Instr)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
     (Blocktype_ok (C, bt, (t_1, t_2))) -> 
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_2 ↦ [t_2]) t_2), RETURN := none}), instr, (t_1, t_2))) -> 
+    (InstrSeq_ok (({FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_2 ↦ [t_2]) t_2), RETURN := none} ++ C), instr, (t_1, t_2))) -> 
     (Instr_ok (C, (Instr.BLOCK (bt, instr)), (t_1, t_2)))
   | loop (C : Context) (bt : Blocktype) (instr : (List Instr)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
     (Blocktype_ok (C, bt, (t_1, t_2))) -> 
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_1 ↦ [t_1]) t_1), RETURN := none}), instr, (t_1, t_2))) -> 
+    (InstrSeq_ok (({FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_1 ↦ [t_1]) t_1), RETURN := none} ++ C), instr, (t_1, t_2))) -> 
     (Instr_ok (C, (Instr.LOOP (bt, instr)), (t_1, t_2)))
   | if (C : Context) (bt : Blocktype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
     (Blocktype_ok (C, bt, (t_1, t_2))) -> 
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_2 ↦ [t_2]) t_2), RETURN := none}), instr_1, (t_1, t_2))) -> 
-    (InstrSeq_ok ((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_2 ↦ [t_2]) t_2), RETURN := none}), instr_2, (t_1, t_2))) -> 
+    (InstrSeq_ok (({FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_2 ↦ [t_2]) t_2), RETURN := none} ++ C), instr_1, (t_1, t_2))) -> 
+    (InstrSeq_ok (({FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := (List.map (λ t_2 ↦ [t_2]) t_2), RETURN := none} ++ C), instr_2, (t_1, t_2))) -> 
     (Instr_ok (C, (Instr.IF (bt, instr_1, instr_2)), (t_1, t_2)))
   | br (C : Context) (l : Labelidx) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
     (l < C.LABEL.length) -> 
@@ -704,7 +704,7 @@ inductive Func_ok : (Context × Func × Functype) -> Prop where
   | rule_0 (C : Context) (expr : Expr) (ft : Functype) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
     (ft == (t_1, t_2)) -> 
     (Functype_ok ft) -> 
-    (Expr_ok ((((C ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := (t_1 ++ t), LABEL := [], RETURN := none}) ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2], RETURN := none}) ++ {FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [], RETURN := (some t_2)}), expr, t_2)) -> 
+    (Expr_ok (({FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [], RETURN := (some t_2)} ++ ({FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2], RETURN := none} ++ ({FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := (t_1 ++ t), LABEL := [], RETURN := none} ++ C))), expr, t_2)) -> 
     (Func_ok (C, (ft, t, expr), ft))
 
 inductive Global_ok : (Context × Global × Globaltype) -> Prop where

From c6f30d9746c5eb672b565295beef7a8f58e560fd Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Mon, 10 Apr 2023 21:46:46 +0200
Subject: [PATCH 73/98] Lean backend: Unop MinusOp

---
 spectec/src/backend-lean4/gen.ml | 1 +
 spectec/test-lean4/SpecTec.lean  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index d36c448ca4..ddf4d91319 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -136,6 +136,7 @@ let rec render_exp (exp : exp) = match exp.it with
   | IdxE (e1, e2) -> parens (render_exp e1 ^ ".get! " ^ render_exp e2)
   | LenE e -> render_exp e ^ ".length"
   | CallE (id, e) -> render_fun_id id $$ render_exp e
+  | UnE (MinusOp, e1)      -> parens ("- " ^ render_exp e1)
   | BinE (AddOp, e1, e2)   -> parens (render_exp e1 ^ " + " ^ render_exp e2)
   | BinE (SubOp, e1, e2)   -> parens (render_exp e1 ^ " - " ^ render_exp e2)
   | BinE (ExpOp, e1, e2)   -> parens ("Nat.pow" $$ render_exp e1 $$ render_exp e2)
diff --git a/spectec/test-lean4/SpecTec.lean b/spectec/test-lean4/SpecTec.lean
index 70457618fc..c61086dc95 100644
--- a/spectec/test-lean4/SpecTec.lean
+++ b/spectec/test-lean4/SpecTec.lean
@@ -1312,7 +1312,7 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     ((«$table» (z, x)).length == n) -> 
     (Step_read ((z, [(Admininstr.TABLE_SIZE x)]), [(Admininstr.CONST (Numtype.I32, n))]))
   | table_grow_fail (n : N) (x : Idx) (z : State) : 
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), [(Admininstr.CONST (Numtype.I32, default /- - 1 -/))]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), [(Admininstr.CONST (Numtype.I32, (- 1)))]))
   | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) : 
     ((i + n) > («$table» (z, x)).length) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), [Admininstr.TRAP]))

From cff72231e55cfca9b9e4d40c453f7c1c7d4bf633 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Mon, 10 Apr 2023 22:40:57 +0200
Subject: [PATCH 74/98] Implement UpdE, and fix lean4 test runner

---
 spectec/src/backend-lean4/gen.ml | 31 +++++++++++++++++++++++++++----
 spectec/test-lean4/SpecTec.lean  | 16 +++++++++++-----
 spectec/test-lean4/dune          | 15 ++++++++++-----
 spectec/test-lean4/lean.stdout   |  0
 spectec/test-lean4/run-lean.sh   |  3 +++
 spectec/test-lean4/watsup.stderr |  0
 6 files changed, 51 insertions(+), 14 deletions(-)
 create mode 100644 spectec/test-lean4/lean.stdout
 create mode 100755 spectec/test-lean4/run-lean.sh
 create mode 100644 spectec/test-lean4/watsup.stderr

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index ddf4d91319..af11a8587c 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -132,11 +132,13 @@ let rec render_exp (exp : exp) = match exp.it with
     render_field_name a ^ " := " ^ render_exp e
     ) fields))
   | SubE (e, typ1, typ2) -> render_variant_inj' typ2 typ1 $$ render_exp e
-  | DotE (_ty, e, a) -> render_exp e ^ "." ^ render_field_name a
-  | IdxE (e1, e2) -> parens (render_exp e1 ^ ".get! " ^ render_exp e2)
+  | DotE (_ty, e, a) -> render_dot (render_exp e) a
+  | UpdE (exp1, path, exp2) ->
+    render_path path (render_exp exp1) (fun _ -> render_exp exp2)
+  | IdxE (e1, e2) -> render_idx (render_exp e1) e2
   | LenE e -> render_exp e ^ ".length"
   | CallE (id, e) -> render_fun_id id $$ render_exp e
-  | UnE (MinusOp, e1)      -> parens ("- " ^ render_exp e1)
+  | UnE (MinusOp, e1)      -> parens ("0 - " ^ render_exp e1)
   | BinE (AddOp, e1, e2)   -> parens (render_exp e1 ^ " + " ^ render_exp e2)
   | BinE (SubOp, e1, e2)   -> parens (render_exp e1 ^ " - " ^ render_exp e2)
   | BinE (ExpOp, e1, e2)   -> parens ("Nat.pow" $$ render_exp e1 $$ render_exp e2)
@@ -154,6 +156,23 @@ let rec render_exp (exp : exp) = match exp.it with
   | CompE (e1, e2)         -> parens (render_exp e2 ^ " ++ "  ^ render_exp e1) (* NB! flip order *)
   | _ -> "default /- " ^ Il.Print.string_of_exp exp ^ " -/"
 
+and render_dot e_string a = e_string ^ "." ^ render_field_name a
+
+and render_idx e_string exp = parens (e_string ^ ".get! " ^ render_exp exp)
+
+(* The path is inside out, in a way, hence the continuation passing style here *)
+and render_path (path : path) old_val (k : string -> string) : string = match path.it with
+  | RootP -> k old_val
+  | DotP (path', a) ->
+    render_path path' old_val (fun old_val ->
+     "{" ^ old_val ^ " with " ^  render_field_name a ^ " := " ^ k (render_dot old_val a) ^ " }"
+    )
+  | IdxP (path', idx_exp) ->
+    render_path path' old_val (fun old_val ->
+      "(" ^ old_val ^ ".upd " ^ render_exp idx_exp ^ " " ^ k (render_idx old_val idx_exp) ^ ")"
+    )
+
+
 and render_case a e typ =
     if e.it = TupE []
     then render_con_name' true typ a
@@ -285,7 +304,11 @@ let gen_string (el : script) =
   "  | none => List.nil\n" ^
   "  | some x => [x]\n" ^
   "set_option linter.unusedVariables false\n" ^
-
+  "def List.upd : List α → Nat → α → List α\n" ^
+  "| [], _, _ => []\n" ^
+  "| x::xs, 0, y => y :: xs\n" ^
+  "| x::xs, n+1, y => x :: xs.upd n y\n" ^
+  "\n\n" ^
   render_script el
 
 
diff --git a/spectec/test-lean4/SpecTec.lean b/spectec/test-lean4/SpecTec.lean
index c61086dc95..eff5c75e80 100644
--- a/spectec/test-lean4/SpecTec.lean
+++ b/spectec/test-lean4/SpecTec.lean
@@ -20,6 +20,12 @@ def Option.toList : Option α → List α
   | none => List.nil
   | some x => [x]
 set_option linter.unusedVariables false
+def List.upd : List α → Nat → α → List α
+| [], _, _ => []
+| x::xs, 0, y => y :: xs
+| x::xs, n+1, y => x :: xs.upd n y
+
+
 @[reducible] def N := Nat
 
 @[reducible] def Name := String
@@ -1076,19 +1082,19 @@ def «$local» : (State × Localidx) -> Val
   | ((s, f), x) => (f.LOCAL.get! x)
 
 def «$with_local» : (State × Localidx × Val) -> State
-  | ((s, f), x, v) => (s, default /- f[LOCAL[x] = v] -/)
+  | ((s, f), x, v) => (s, {f with LOCAL := (f.LOCAL.upd x v) })
 
 def «$with_global» : (State × Globalidx × Val) -> State
-  | ((s, f), x, v) => (default /- s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v] -/, f)
+  | ((s, f), x, v) => ({s with GLOBAL := (s.GLOBAL.upd (f.MODULE.GLOBAL.get! x) v) }, f)
 
 def «$with_table» : (State × Tableidx × N × Ref) -> State
-  | ((s, f), x, i, r) => (default /- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r] -/, f)
+  | ((s, f), x, i, r) => ({s with TABLE := (s.TABLE.upd (f.MODULE.TABLE.get! x) ((s.TABLE.get! (f.MODULE.TABLE.get! x)).upd i r)) }, f)
 
 def «$with_tableext» : (State × Tableidx × (List Ref)) -> State
   | ((s, f), x, r) => (default /- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}] -/, f)
 
 def «$with_elem» : (State × Elemidx × (List Ref)) -> State
-  | ((s, f), x, r) => (default /- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}] -/, f)
+  | ((s, f), x, r) => ({s with TABLE := (s.TABLE.upd (f.MODULE.TABLE.get! x) r) }, f)
 
 inductive E where
  | _HOLE : E
@@ -1312,7 +1318,7 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     ((«$table» (z, x)).length == n) -> 
     (Step_read ((z, [(Admininstr.TABLE_SIZE x)]), [(Admininstr.CONST (Numtype.I32, n))]))
   | table_grow_fail (n : N) (x : Idx) (z : State) : 
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), [(Admininstr.CONST (Numtype.I32, (- 1)))]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), [(Admininstr.CONST (Numtype.I32, (0 - 1)))]))
   | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) : 
     ((i + n) > («$table» (z, x)).length) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), [Admininstr.TRAP]))
diff --git a/spectec/test-lean4/dune b/spectec/test-lean4/dune
index bbf7877e85..b6698d4379 100644
--- a/spectec/test-lean4/dune
+++ b/spectec/test-lean4/dune
@@ -1,5 +1,5 @@
 (rule
-  (targets stderr.current SpecTec.lean.current)
+  (targets watsup.stderr.current SpecTec.lean.current lean.stdout.current)
   (deps
     (file ../src/exe-watsup/main.exe)
     (glob_files ../spec/*.watsup)
@@ -7,16 +7,21 @@
   (action
     (progn
       (write-file SpecTec.lean.current "not generated")
-      (with-stderr-to stderr.current (run %{deps} --lean4 -o SpecTec.lean.current))
+      (with-stderr-to watsup.stderr.current (run %{deps} --lean4 -o SpecTec.lean.current))
+      (with-stdout-to lean.stdout.current (run ./run-lean.sh SpecTec.lean.current))
     )
   )
 )
 
 (rule
- (alias   runtest)
- (action (diff stderr.expected stderr.current))
+ (alias runtest)
+ (action (diff watsup.stderr watsup.stderr.current))
 )
 (rule
- (alias   runtest)
+ (alias runtest)
  (action (diff SpecTec.lean SpecTec.lean.current))
 )
+(rule
+ (alias runtest)
+ (action (progn (diff lean.stdout lean.stdout.current)))
+)
diff --git a/spectec/test-lean4/lean.stdout b/spectec/test-lean4/lean.stdout
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/spectec/test-lean4/run-lean.sh b/spectec/test-lean4/run-lean.sh
new file mode 100755
index 0000000000..f77eec5376
--- /dev/null
+++ b/spectec/test-lean4/run-lean.sh
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+lean "$1" 2>&1 | sed -e 's,/[^ ]*/toolchains,.../toolchains`,g' | sed -e 's,SpecTec.lean:[0-9]\+:[0-9]\+,SpecTec.lean,' | sed -e 's,\?m\.[0-9]\+,?m,g'
diff --git a/spectec/test-lean4/watsup.stderr b/spectec/test-lean4/watsup.stderr
new file mode 100644
index 0000000000..e69de29bb2

From d917eb274f6f72df49e3eaadad243d345fbbf5b1 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Mon, 10 Apr 2023 22:44:52 +0200
Subject: [PATCH 75/98] Implement ExtE. All occuring expressions are
 translated!

---
 spectec/src/backend-lean4/gen.ml | 2 ++
 spectec/test-lean4/SpecTec.lean  | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index af11a8587c..be3a01abb5 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -135,6 +135,8 @@ let rec render_exp (exp : exp) = match exp.it with
   | DotE (_ty, e, a) -> render_dot (render_exp e) a
   | UpdE (exp1, path, exp2) ->
     render_path path (render_exp exp1) (fun _ -> render_exp exp2)
+  | ExtE (exp1, path, exp2) ->
+    render_path path (render_exp exp1) (fun old_val -> "List.append" $$$ [old_val;  render_exp exp2])
   | IdxE (e1, e2) -> render_idx (render_exp e1) e2
   | LenE e -> render_exp e ^ ".length"
   | CallE (id, e) -> render_fun_id id $$ render_exp e
diff --git a/spectec/test-lean4/SpecTec.lean b/spectec/test-lean4/SpecTec.lean
index eff5c75e80..d22de0e3df 100644
--- a/spectec/test-lean4/SpecTec.lean
+++ b/spectec/test-lean4/SpecTec.lean
@@ -1091,7 +1091,7 @@ def «$with_table» : (State × Tableidx × N × Ref) -> State
   | ((s, f), x, i, r) => ({s with TABLE := (s.TABLE.upd (f.MODULE.TABLE.get! x) ((s.TABLE.get! (f.MODULE.TABLE.get! x)).upd i r)) }, f)
 
 def «$with_tableext» : (State × Tableidx × (List Ref)) -> State
-  | ((s, f), x, r) => (default /- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}] -/, f)
+  | ((s, f), x, r) => ({s with TABLE := (s.TABLE.upd (f.MODULE.TABLE.get! x) (List.append (s.TABLE.get! (f.MODULE.TABLE.get! x)) r)) }, f)
 
 def «$with_elem» : (State × Elemidx × (List Ref)) -> State
   | ((s, f), x, r) => ({s with TABLE := (s.TABLE.upd (f.MODULE.TABLE.get! x) r) }, f)

From f3df355ca46abae622db4a7ce622be038bf097f4 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Tue, 11 Apr 2023 12:28:34 +0200
Subject: [PATCH 76/98] =?UTF-8?q?Rename=20flat.ml=20=E2=86=92=20sub.ml?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 spectec/src/exe-watsup/main.ml             | 10 +++++-----
 spectec/src/middlend/dune                  |  2 +-
 spectec/src/middlend/{flat.ml => sub.ml}   |  0
 spectec/src/middlend/{flat.mli => sub.mli} |  0
 spectec/test-middlend/TEST.md              |  4 ++--
 5 files changed, 8 insertions(+), 8 deletions(-)
 rename spectec/src/middlend/{flat.ml => sub.ml} (100%)
 rename spectec/src/middlend/{flat.mli => sub.mli} (100%)

diff --git a/spectec/src/exe-watsup/main.ml b/spectec/src/exe-watsup/main.ml
index 3ba26047ea..75a658666b 100644
--- a/spectec/src/exe-watsup/main.ml
+++ b/spectec/src/exe-watsup/main.ml
@@ -30,7 +30,7 @@ let print_elab_il = ref false
 let print_final_il = ref false
 let print_all_il = ref false
 
-let pass_flat = ref false
+let pass_sub = ref false
 let pass_totalize = ref false
 let pass_sideconditions = ref false
 let pass_else_elim = ref false
@@ -58,7 +58,7 @@ let argspec = Arg.align
   "--print-final-il", Arg.Set print_final_il, "Print final il";
   "--print-all-il", Arg.Set print_all_il, "Print il after each step";
 
-  "--flat", Arg.Set pass_flat, "Run variant flattening";
+  "--sub", Arg.Set pass_sub, "Synthesize explicit subtype coercions";
   "--totalize", Arg.Set pass_totalize, "Run function totalization";
   "--sideconditions", Arg.Set pass_sideconditions, "Infer side conditoins";
   "--else-elimination", Arg.Set pass_else_elim, "Eliminate otherwise/else";
@@ -90,9 +90,9 @@ let () =
     log "IL Validation...";
     Il.Validation.valid il;
 
-    let il = if !pass_flat || !target = Haskell || !target = Lean4 then begin
-      log "Variant flattening...";
-      let il = Middlend.Flat.transform il in
+    let il = if !pass_sub || !target = Haskell || !target = Lean4 then begin
+      log "Subtype injection...";
+      let il = Middlend.Sub.transform il in
       if !print_all_il then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
       log "IL Validation...";
       Il.Validation.valid il;
diff --git a/spectec/src/middlend/dune b/spectec/src/middlend/dune
index 6c0273d17c..0fa902f0ec 100644
--- a/spectec/src/middlend/dune
+++ b/spectec/src/middlend/dune
@@ -1,5 +1,5 @@
 (library
   (name middlend)
   (libraries util il)
-  (modules flat totalize sideconditions else)
+  (modules sub totalize sideconditions else)
 )
diff --git a/spectec/src/middlend/flat.ml b/spectec/src/middlend/sub.ml
similarity index 100%
rename from spectec/src/middlend/flat.ml
rename to spectec/src/middlend/sub.ml
diff --git a/spectec/src/middlend/flat.mli b/spectec/src/middlend/sub.mli
similarity index 100%
rename from spectec/src/middlend/flat.mli
rename to spectec/src/middlend/sub.mli
diff --git a/spectec/test-middlend/TEST.md b/spectec/test-middlend/TEST.md
index 8275387ee1..f75f416cee 100644
--- a/spectec/test-middlend/TEST.md
+++ b/spectec/test-middlend/TEST.md
@@ -1,7 +1,7 @@
 # Preview
 
 ```sh
-$ (cd ../spec && ../src/exe-watsup/main.exe *.watsup -l --print-all-il --flat --totalize --sideconditions --else-elimination --check-only)
+$ (cd ../spec && ../src/exe-watsup/main.exe *.watsup -l --print-all-il --sub --totalize --sideconditions --else-elimination --check-only)
 == Parsing...
 == Elaboration...
 
@@ -1488,7 +1488,7 @@ relation Step: `%~>%`(config, config)
     `%~>%`(`%;%*`(z, [ELEM.DROP_admininstr(x)]), `%;%*`($with_elem(z, x, []), []))
 
 == IL Validation...
-== Variant flattening...
+== Subtype injection...
 
 ;; 1-syntax.watsup:3.1-3.15
 syntax n = nat

From d0b839bdbf7095132a57357044028e62b24586f9 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Tue, 11 Apr 2023 13:26:50 +0200
Subject: [PATCH 77/98] Correctly infer which injections need to be produced

---
 spectec/src/middlend/sub.ml     | 268 ++++++++----
 spectec/test-haskell/SpecTec.hs |  33 +-
 spectec/test-lean4/SpecTec.lean |  33 +-
 spectec/test-middlend/TEST.md   | 752 +++++++++++++++-----------------
 4 files changed, 580 insertions(+), 506 deletions(-)

diff --git a/spectec/src/middlend/sub.ml b/spectec/src/middlend/sub.ml
index ad2f4c0a5f..7379ebd31f 100644
--- a/spectec/src/middlend/sub.ml
+++ b/spectec/src/middlend/sub.ml
@@ -1,11 +1,25 @@
 (*
-This transformation
- * generates functions for all occurring subtype coercions
-   (not yet: relies on hints so far)
- * uses these functions
-   (not yet: done in the backend so far)
- * duplicates cases in functions as needed
-   (not yet: $default_ rewritten in spec)
+This transformation replaces SubE expressions with explicit subtype injection
+functions.
+
+ 1. It traverses all expressions and finds out which type pairs
+    occur in SubE expressions
+    - all type pairs mentioned in SubE expressions
+    - for all variant types: list of constructors
+    - for all alias types: right hand side of the alias
+
+ 2. It traverses all definitions to collect information about variant types and
+    type aliases (assuming only such types occur in type aliases).
+
+ 3. It generates explicit injection functions for pairs, and put them in the
+ right spot (after both types are defined, but outside `RecD` groups)
+
+ 4. It replaces occurrences of SubE with a suitable CallE
+
+Step 1 and 4 are done together, and step 2 and 3
+
+This pass assumes that there is no name shadowing in the type definitions.
+
 *)
 
 open Util
@@ -14,93 +28,195 @@ open Il.Ast
 
 (* Errors *)
 
-let error at msg = Source.error at "type" msg
+let error at msg = Source.error at "subtype elimination" msg
 
 (* Environment *)
 
-module Env = Map.Make(String)
+module M = Map.Make(String)
+module S = Set.Make(struct
+  type t = id * id
+  let compare (t1, t2) (t3, t4) = compare (t1.it, t2.it) (t3.it, t4.it)
+end)
 
+(*
+The environment consist of:
+  * Which constructors the type has (and their non-aliased concrete type)
+  * Which SubE type pairs have been observed, but not yet generated
+*)
 type env =
-  { mutable variants : typcase list Env.t;
-    mutable needed_pairs : (id * id) list;
-    mutable available_pairs : (id * id) list;
+  { mutable typ : (id * typcase list) M.t;
+    mutable pairs : S.t
   }
 
 let new_env () : env =
-  { variants = Env.empty;
-    needed_pairs = [];
-    available_pairs = [];
+  { typ = M.empty;
+    pairs = S.empty;
   }
 
-let lookup_cons (env : env) (id : id) =
-  match Env.find_opt id.it env.variants with
-  | None -> error id.at ("undeclared variant `" ^ id.it ^ "`")
+let lookup (env : env) (id : id) : id * typcase list =
+  match M.find_opt id.it env.typ with
+  | None -> error id.at ("unknown type `" ^ id.it ^ "`")
   | Some t -> t
 
-let register_cons (env : env) (id :id) (cases : typcase list) =
-  if Env.mem id.it env.variants then
-    error id.at ("duplicate declaration for variant `" ^ id.it ^ "`")
+let register_variant (env : env) (id : id) (cases : typcase list) =
+  if M.mem id.it env.typ then
+    error id.at ("duplicate declaration for type `" ^ id.it ^ "`")
   else
-    env.variants <- Env.add id.it cases env.variants
+    env.typ <- M.add id.it (id, cases) env.typ
+
+let register_alias (env : env) (id : id) (id2 : id) =
+  match M.find_opt id2.it env.typ with
+  | Some type_info ->
+    env.typ <- M.add id.it type_info env.typ
+  | None -> () (* Not an alias of a variant type *)
+
+let injection_name (sub : id) (sup : id) = sup.it ^ "_" ^ sub.it $ no_region
+
+let var_of_typ typ = match typ.it with
+  | VarT id -> id
+  | _ -> error typ.at ("Non-variable type expression not supported:\n" ^ Il.Print.string_of_typ typ)
+
+(* Step 1 and 4: Collect SubE occurrences, and replace with function *)
+
+(* The main transformation case *)
+let rec t_exp env exp =
+  let exp' = t_exp2 env exp in
+  match exp'.it with
+  | SubE (e, sub_ty, sup_ty) ->
+    let sub = var_of_typ sub_ty in
+    let sup = var_of_typ sup_ty in
+    env.pairs <- S.add (sub, sup) env.pairs;
+    { exp' with it = CallE (injection_name sub sup, e)}
+  | _ -> exp'
+
+(* Traversal boilerplate *)
+
+and t_exp2 env x = { x with it = t_exp' env x.it }
+
+and t_exp' env = function
+  | (VarE _ | BoolE _ | NatE _ | TextE _) as e -> e
+  | UnE (unop, exp) -> UnE (unop, t_exp env exp)
+  | BinE (binop, exp1, exp2) -> BinE (binop, t_exp env exp1, t_exp env exp2)
+  | CmpE (cmpop, exp1, exp2) -> CmpE (cmpop, t_exp env exp1, t_exp env exp2)
+  | IdxE (exp1, exp2) -> IdxE (t_exp env exp1, t_exp env exp2)
+  | SliceE (exp1, exp2, exp3) -> SliceE (t_exp env exp1, t_exp env exp2, t_exp env exp3)
+  | UpdE (exp1, path, exp2) -> UpdE (t_exp env exp1, t_path env path, t_exp env exp2)
+  | ExtE (exp1, path, exp2) -> ExtE (t_exp env exp1, t_path env path, t_exp env exp2)
+  | StrE fields -> StrE (List.map (fun (a, e) -> a, t_exp env e) fields)
+  | DotE (t, e, a) -> DotE (t, t_exp env e, a)
+  | CompE (exp1, exp2) -> CompE (t_exp env exp1, t_exp env exp2)
+  | LenE exp -> LenE exp
+  | TupE es -> TupE (List.map (t_exp env) es)
+  | MixE (mixop, exp) -> MixE (mixop, t_exp env exp)
+  | CallE (a, exp) -> CallE (a, t_exp env exp)
+  | IterE (e, iterexp) -> IterE (t_exp env e, t_iterexp env iterexp)
+  | OptE None -> OptE None
+  | OptE (Some exp) -> OptE (Some exp)
+  | TheE exp -> TheE exp
+  | ListE es -> ListE (List.map (t_exp env) es)
+  | CatE (exp1, exp2) -> CatE (t_exp env exp1, t_exp env exp2)
+  | CaseE (a, e, t) -> CaseE (a, t_exp env e, t)
+  | SubE (e, t1, t2) -> SubE (e, t1, t2)
+
+and t_iter env = function
+  | ListN e -> ListN (t_exp env e)
+  | i -> i
+
+and t_iterexp env (iter, vs) = (t_iter env iter, vs)
 
-let rec transform_def_rec env (def : def) : def * (def list) = match def.it with
-  | RecD defs ->
-    let defs', new_defs = List.split (List.map (transform_def_rec env) defs) in
-    { def with it = RecD defs' },  List.concat new_defs
-  | SynD (id, deftyp, hints) ->
+and t_path' env = function
+  | RootP -> RootP
+  | IdxP (path, e) -> IdxP (t_path env path, t_exp env e)
+  | DotP (path, a) -> DotP (t_path env path, a)
+
+and t_path env x = { x with it = t_path' env x.it }
+
+let rec t_prem' env = function
+  | RulePr (id, mixop, exp) -> RulePr (id, mixop, t_exp env exp)
+  | IfPr e -> IfPr (t_exp env e)
+  | ElsePr -> ElsePr
+  | IterPr (prem, iterexp) -> IterPr (t_prem env prem, t_iterexp env iterexp)
+  | NegPr prem -> NegPr (t_prem env prem)
+
+and t_prem env x = { x with it = t_prem' env x.it }
+
+let t_prems env = List.map (t_prem env)
+
+let t_clause' env = function
+ | DefD (binds, lhs, rhs, prems) ->
+   DefD (binds, t_exp env lhs, t_exp env rhs, t_prems env prems)
+
+let t_clause env (clause : clause) = { clause with it = t_clause' env clause.it }
+
+let t_clauses env = List.map (t_clause env)
+
+let t_rule' env = function
+  | RuleD (id, binds, mixop, exp, prems) ->
+    RuleD (id, binds, mixop, t_exp env exp, t_prems env prems)
+
+let t_rule env x = { x with it = t_rule' env x.it }
+
+let rec t_def' env = function
+  | RecD defs -> RecD (List.map (t_def env) defs)
+  | DecD (id, typ1, typ2, clauses, hints) ->
+    DecD (id, typ1, typ2, t_clauses env clauses, hints)
+  | RelD (id, mixop, typ, rules, hints) ->
+    RelD (id, mixop, typ, List.map (t_rule env) rules, hints)
+  | def -> def
+
+and t_def env (def : def) = { def with it = t_def' env def.it }
+
+(* Step 2 and 3: Traverse definitions, collect type information, insert as soon as possible *)
+
+let rec add_type_info env (def : def) = match def.it with
+  | RecD defs -> List.iter (add_type_info env) defs
+  | SynD (id, deftyp, _hints) ->
     begin match deftyp.it with
-    | VariantT cases ->
-      register_cons env id cases;
-      def,
-      (* Also generate conversion functions *)
-      let pairs =
-        List.concat_map (fun {hintid; hintexp} ->
-          (if hintid.it = "subtype" then List.map (fun s -> (id, s $ no_region)) hintexp else []) @
-          (if hintid.it = "supertype" then List.map (fun s -> (s $ no_region, id)) hintexp else [])
-        ) hints in
-      List.map (fun (id, sid) ->
-        let name = (id.it ^ "_" ^ sid.it) $ no_region in
-        let ty = VarT id $ no_region in
-        let sty = VarT sid $ no_region in
-        let clauses = List.map (fun (a, arg_typ, _hints) ->
-          if arg_typ.it = TupT []
-          then DefD ([],
-                CaseE (a, TupE [] $ no_region, sty) $ no_region,
-                CaseE (a, TupE [] $ no_region, ty) $ no_region, []) $ no_region
-          else
-            let x = "x" $ no_region in
-            DefD ([(x, arg_typ, [])],
-                CaseE (a, VarE x $ no_region, sty) $ no_region,
-                CaseE (a, VarE x $ no_region, ty) $ no_region, []) $ no_region
-        ) (lookup_cons env sid) in
-        DecD (name, VarT sid $ no_region, VarT id $ no_region, clauses, []) $ no_region
-      ) pairs @
-      List.concat_map (fun {hintid; hintexp} ->
-        match hintid.it, hintexp with
-        | "subtype_alias", [s1; s2] ->
-          let id1 = s1 $ no_region in
-          let id2 = s2 $ no_region in
-          let name = (id.it ^ "_" ^ id1.it) $ no_region in
-          let name2 = (id.it ^ "_" ^ id2.it) $ no_region in
-          let x = "x" $ no_region in
-          let clauses = [
-            DefD ([(x, VarT id1 $ no_region, [])],
-                  VarE x $ no_region,
-                  CallE (name2, VarE x $ no_region) $ no_region, []) $ no_region
-          ] in
-          [ DecD (name, VarT id1 $ no_region, VarT id $ no_region, clauses, []) $ no_region ]
-        | _, _ -> []
-      ) hints
-    | _ -> def, []
+    | VariantT cases -> register_variant env id cases
+    | AliasT {it = VarT id2; _} -> register_alias env id id2
+    | _ -> ()
     end
-  | _ ->
-  def, [] (* TODO: look inside *)
+  | _ ->()
+
+let is_ready env (t1, t2) = M.mem t1.it env.typ && M.mem t2.it env.typ
+
+(* Returns type pairs that are defined now, and removes them from the env *)
+let ready_pairs (env : env) =
+  let (ready, todo) = S.partition (is_ready env) env.pairs in
+  env.pairs <- todo;
+  S.elements ready
+
+
+let insert_injections env (def : def) : def list =
+  add_type_info env def;
+  let pairs = ready_pairs env in
+  [ def ] @
+  List.map (fun (sub, sup) ->
+    let name = injection_name sub sup in
+    let sub_ty = VarT sub $ no_region in
+    let sup_ty = VarT sup $ no_region in
+    let (real_id, cases) = lookup env sub in
+    let clauses = List.map (fun (a, arg_typ, _hints) ->
+        if arg_typ.it = TupT []
+        then
+          DefD ([],
+            CaseE (a, TupE [] $ no_region, VarT real_id $ no_region) $ no_region,
+            CaseE (a, TupE [] $ no_region, sup_ty) $ no_region, []) $ no_region
+        else
+          let x = "x" $ no_region in
+          let xe = VarE x $ no_region in
+          DefD ([(x, arg_typ, [])],
+            CaseE (a, xe, VarT real_id $ no_region) $ no_region,
+            CaseE (a, xe, sup_ty) $ no_region, []) $ no_region
+      ) cases in
+    DecD (name, sub_ty, sup_ty, clauses, []) $ no_region
+  ) pairs
 
-and transform_def env (def : def) : def list =
-  let def', new_defs = transform_def_rec env def in
-  def' :: new_defs
 
 let transform (defs : script) =
   let env = new_env () in
-  List.concat_map (transform_def env) defs
+  let defs' = List.map (t_def env) defs in
+  let defs'' = List.concat_map (insert_injections env) defs' in
+  S.iter (fun (sub, sup) -> error sub.at ("left-over subtype coercion " ^ sub.it ^ " <: " ^ sup.it)) env.pairs;
+  defs''
 
diff --git a/spectec/test-haskell/SpecTec.hs b/spectec/test-haskell/SpecTec.hs
index 603b81a667..3b6a3812a2 100644
--- a/spectec/test-haskell/SpecTec.hs
+++ b/spectec/test-haskell/SpecTec.hs
@@ -58,13 +58,13 @@ valtype_numtype Numtype_I64 = Valtype_I64
 valtype_numtype Numtype_F32 = Valtype_F32
 valtype_numtype Numtype_F64 = Valtype_F64
 
-valtype_vectype :: Vectype -> Valtype
-valtype_vectype Vectype_V128 = Valtype_V128
-
 valtype_reftype :: Reftype -> Valtype
 valtype_reftype Reftype_FUNCREF = Valtype_FUNCREF
 valtype_reftype Reftype_EXTERNREF = Valtype_EXTERNREF
 
+valtype_vectype :: Vectype -> Valtype
+valtype_vectype Vectype_V128 = Valtype_V128
+
 data In
  = In_I32
  | In_I64
@@ -417,14 +417,6 @@ data Val
  | Val_REF_FUNC_ADDR Funcaddr
  | Val_REF_HOST_ADDR Hostaddr
 
-val_num :: Num -> Val
-val_num (Num_CONST x) = (Val_CONST x)
-
-val_ref :: Ref -> Val
-val_ref (Ref_REF_NULL x) = (Val_REF_NULL x)
-val_ref (Ref_REF_FUNC_ADDR x) = (Val_REF_FUNC_ADDR x)
-val_ref (Ref_REF_HOST_ADDR x) = (Val_REF_HOST_ADDR x)
-
 data Result
  = Result_VALS [Val]
  | Result_TRAP
@@ -535,6 +527,12 @@ data Admininstr
  | Admininstr_FRAME_ (N, Frame, [Admininstr])
  | Admininstr_TRAP
 
+admininstr_globalinst :: Globalinst -> Admininstr
+admininstr_globalinst (Val_CONST x) = (Admininstr_CONST x)
+admininstr_globalinst (Val_REF_NULL x) = (Admininstr_REF_NULL x)
+admininstr_globalinst (Val_REF_FUNC_ADDR x) = (Admininstr_REF_FUNC_ADDR x)
+admininstr_globalinst (Val_REF_HOST_ADDR x) = (Admininstr_REF_HOST_ADDR x)
+
 admininstr_instr :: Instr -> Admininstr
 admininstr_instr Instr_UNREACHABLE = Admininstr_UNREACHABLE
 admininstr_instr Instr_NOP = Admininstr_NOP
@@ -581,19 +579,16 @@ admininstr_instr (Instr_DATA_DROP x) = (Admininstr_DATA_DROP x)
 admininstr_instr (Instr_LOAD x) = (Admininstr_LOAD x)
 admininstr_instr (Instr_STORE x) = (Admininstr_STORE x)
 
-admininstr_val :: Val -> Admininstr
-admininstr_val (Val_CONST x) = (Admininstr_CONST x)
-admininstr_val (Val_REF_NULL x) = (Admininstr_REF_NULL x)
-admininstr_val (Val_REF_FUNC_ADDR x) = (Admininstr_REF_FUNC_ADDR x)
-admininstr_val (Val_REF_HOST_ADDR x) = (Admininstr_REF_HOST_ADDR x)
-
 admininstr_ref :: Ref -> Admininstr
 admininstr_ref (Ref_REF_NULL x) = (Admininstr_REF_NULL x)
 admininstr_ref (Ref_REF_FUNC_ADDR x) = (Admininstr_REF_FUNC_ADDR x)
 admininstr_ref (Ref_REF_HOST_ADDR x) = (Admininstr_REF_HOST_ADDR x)
 
-admininstr_globalinst :: Globalinst -> Admininstr
-admininstr_globalinst x = undefined {- $admininstr_val(x) -}
+admininstr_val :: Val -> Admininstr
+admininstr_val (Val_CONST x) = (Admininstr_CONST x)
+admininstr_val (Val_REF_NULL x) = (Admininstr_REF_NULL x)
+admininstr_val (Val_REF_FUNC_ADDR x) = (Admininstr_REF_FUNC_ADDR x)
+admininstr_val (Val_REF_HOST_ADDR x) = (Admininstr_REF_HOST_ADDR x)
 
 type Config = {- mixop: `%;%*` -} (State, [Admininstr])
 
diff --git a/spectec/test-lean4/SpecTec.lean b/spectec/test-lean4/SpecTec.lean
index d22de0e3df..565319543e 100644
--- a/spectec/test-lean4/SpecTec.lean
+++ b/spectec/test-lean4/SpecTec.lean
@@ -85,13 +85,13 @@ def «$valtype_numtype» : Numtype -> Valtype
   | Numtype.F32 => Valtype.F32
   | Numtype.F64 => Valtype.F64
 
-def «$valtype_vectype» : Vectype -> Valtype
-  | Vectype.V128 => Valtype.V128
-
 def «$valtype_reftype» : Reftype -> Valtype
   | Reftype.FUNCREF => Valtype.FUNCREF
   | Reftype.EXTERNREF => Valtype.EXTERNREF
 
+def «$valtype_vectype» : Vectype -> Valtype
+  | Vectype.V128 => Valtype.V128
+
 inductive In where
  | I32 : In
  | I64 : In
@@ -846,14 +846,6 @@ inductive Val where
  | REF_HOST_ADDR : Hostaddr -> Val
   deriving Inhabited, BEq
 
-def «$val_num» : Num -> Val
-  | (Num.CONST x) => (Val.CONST x)
-
-def «$val_ref» : Ref -> Val
-  | (Ref.REF_NULL x) => (Val.REF_NULL x)
-  | (Ref.REF_FUNC_ADDR x) => (Val.REF_FUNC_ADDR x)
-  | (Ref.REF_HOST_ADDR x) => (Val.REF_HOST_ADDR x)
-
 inductive Result where
  | _VALS : (List Val) -> Result
  | TRAP : Result
@@ -992,6 +984,12 @@ inductive Admininstr where
  | TRAP : Admininstr
   deriving Inhabited, BEq
 
+def «$admininstr_globalinst» : Globalinst -> Admininstr
+  | (Val.CONST x) => (Admininstr.CONST x)
+  | (Val.REF_NULL x) => (Admininstr.REF_NULL x)
+  | (Val.REF_FUNC_ADDR x) => (Admininstr.REF_FUNC_ADDR x)
+  | (Val.REF_HOST_ADDR x) => (Admininstr.REF_HOST_ADDR x)
+
 def «$admininstr_instr» : Instr -> Admininstr
   | Instr.UNREACHABLE => Admininstr.UNREACHABLE
   | Instr.NOP => Admininstr.NOP
@@ -1038,19 +1036,16 @@ def «$admininstr_instr» : Instr -> Admininstr
   | (Instr.LOAD x) => (Admininstr.LOAD x)
   | (Instr.STORE x) => (Admininstr.STORE x)
 
-def «$admininstr_val» : Val -> Admininstr
-  | (Val.CONST x) => (Admininstr.CONST x)
-  | (Val.REF_NULL x) => (Admininstr.REF_NULL x)
-  | (Val.REF_FUNC_ADDR x) => (Admininstr.REF_FUNC_ADDR x)
-  | (Val.REF_HOST_ADDR x) => (Admininstr.REF_HOST_ADDR x)
-
 def «$admininstr_ref» : Ref -> Admininstr
   | (Ref.REF_NULL x) => (Admininstr.REF_NULL x)
   | (Ref.REF_FUNC_ADDR x) => (Admininstr.REF_FUNC_ADDR x)
   | (Ref.REF_HOST_ADDR x) => (Admininstr.REF_HOST_ADDR x)
 
-def «$admininstr_globalinst» : Globalinst -> Admininstr
-  | x => («$admininstr_val» x)
+def «$admininstr_val» : Val -> Admininstr
+  | (Val.CONST x) => (Admininstr.CONST x)
+  | (Val.REF_NULL x) => (Admininstr.REF_NULL x)
+  | (Val.REF_FUNC_ADDR x) => (Admininstr.REF_FUNC_ADDR x)
+  | (Val.REF_HOST_ADDR x) => (Admininstr.REF_HOST_ADDR x)
 
 @[reducible] def Config := /- mixop: `%;%*` -/ (State × (List Admininstr))
 
diff --git a/spectec/test-middlend/TEST.md b/spectec/test-middlend/TEST.md
index f75f416cee..54aa8a7e63 100644
--- a/spectec/test-middlend/TEST.md
+++ b/spectec/test-middlend/TEST.md
@@ -1567,11 +1567,6 @@ def valtype_numtype : numtype -> valtype
   ;;
   def valtype_numtype(F64_numtype) = F64_valtype
 
-;;
-def valtype_vectype : vectype -> valtype
-  ;;
-  def valtype_vectype(V128_vectype) = V128_valtype
-
 ;;
 def valtype_reftype : reftype -> valtype
   ;;
@@ -1579,6 +1574,11 @@ def valtype_reftype : reftype -> valtype
   ;;
   def valtype_reftype(EXTERNREF_reftype) = EXTERNREF_valtype
 
+;;
+def valtype_vectype : vectype -> valtype
+  ;;
+  def valtype_vectype(V128_vectype) = V128_valtype
+
 ;; 1-syntax.watsup:48.1-48.71
 syntax in =
   | I32
@@ -2055,7 +2055,7 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
   rule select-impl {C : context, numtype : numtype, t : valtype, t' : valtype, vectype : vectype}:
     `%|-%:%`(C, SELECT_instr(?()), `%->%`([t t I32_valtype], [t]))
     -- Valtype_sub: `|-%<:%`(t, t')
-    -- if ((t' = (numtype <: valtype)) \/ (t' = (vectype <: valtype)))
+    -- if ((t' = $valtype_numtype(numtype)) \/ (t' = $valtype_vectype(vectype)))
 
   ;; 3-typing.watsup:178.1-181.57
   rule block {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
@@ -2110,49 +2110,49 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:222.1-223.37
   rule const {C : context, c_nt : c_numtype, nt : numtype}:
-    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [(nt <: valtype)]))
+    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [$valtype_numtype(nt)]))
 
   ;; 3-typing.watsup:225.1-226.31
   rule unop {C : context, nt : numtype, unop : unop_numtype}:
-    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
+    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([$valtype_numtype(nt)], [$valtype_numtype(nt)]))
 
   ;; 3-typing.watsup:228.1-229.36
   rule binop {C : context, binop : binop_numtype, nt : numtype}:
-    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([(nt <: valtype) (nt <: valtype)], [(nt <: valtype)]))
+    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([$valtype_numtype(nt) $valtype_numtype(nt)], [$valtype_numtype(nt)]))
 
   ;; 3-typing.watsup:231.1-232.36
   rule testop {C : context, nt : numtype, testop : testop_numtype}:
-    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([(nt <: valtype)], [I32_valtype]))
+    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([$valtype_numtype(nt)], [I32_valtype]))
 
   ;; 3-typing.watsup:234.1-235.37
   rule relop {C : context, nt : numtype, relop : relop_numtype}:
-    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([(nt <: valtype) (nt <: valtype)], [I32_valtype]))
+    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([$valtype_numtype(nt) $valtype_numtype(nt)], [I32_valtype]))
 
   ;; 3-typing.watsup:238.1-240.23
   rule extend {C : context, n : n, nt : numtype}:
-    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
-    -- if (n <= $size(nt <: valtype))
+    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([$valtype_numtype(nt)], [$valtype_numtype(nt)]))
+    -- if (n <= $size($valtype_numtype(nt)))
 
   ;; 3-typing.watsup:242.1-245.34
   rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype}:
-    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([(nt_2 <: valtype)], [(nt_1 <: valtype)]))
+    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([$valtype_numtype(nt_2)], [$valtype_numtype(nt_1)]))
     -- if (nt_1 =/= nt_2)
-    -- if ($size(nt_1 <: valtype) = $size(nt_2 <: valtype))
+    -- if ($size($valtype_numtype(nt_1)) = $size($valtype_numtype(nt_2)))
 
   ;; 3-typing.watsup:247.1-250.52
   rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?}:
-    `%|-%:%`(C, CVTOP_instr((in_1 <: numtype), CONVERT_cvtop, (in_2 <: numtype), sx?{sx}), `%->%`([(in_2 <: valtype)], [(in_1 <: valtype)]))
+    `%|-%:%`(C, CVTOP_instr($numtype_in(in_1), CONVERT_cvtop, $numtype_in(in_2), sx?{sx}), `%->%`([$valtype_in(in_2)], [$valtype_in(in_1)]))
     -- if (in_1 =/= in_2)
-    -- if ((sx?{sx} = ?()) <=> ($size(in_1 <: valtype) > $size(in_2 <: valtype)))
+    -- if ((sx?{sx} = ?()) <=> ($size($valtype_in(in_1)) > $size($valtype_in(in_2))))
 
   ;; 3-typing.watsup:252.1-254.22
   rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
-    `%|-%:%`(C, CVTOP_instr((fn_1 <: numtype), CONVERT_cvtop, (fn_2 <: numtype), ?()), `%->%`([(fn_2 <: valtype)], [(fn_1 <: valtype)]))
+    `%|-%:%`(C, CVTOP_instr($numtype_fn(fn_1), CONVERT_cvtop, $numtype_fn(fn_2), ?()), `%->%`([$valtype_fn(fn_2)], [$valtype_fn(fn_1)]))
     -- if (fn_1 =/= fn_2)
 
   ;; 3-typing.watsup:257.1-258.35
   rule ref.null {C : context, rt : reftype}:
-    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [(rt <: valtype)]))
+    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [$valtype_reftype(rt)]))
 
   ;; 3-typing.watsup:260.1-262.23
   rule ref.func {C : context, ft : functype, x : idx}:
@@ -2161,7 +2161,7 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:264.1-265.31
   rule ref.is_null {C : context, rt : reftype}:
-    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([(rt <: valtype)], [I32_valtype]))
+    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([$valtype_reftype(rt)], [I32_valtype]))
 
   ;; 3-typing.watsup:268.1-270.23
   rule local.get {C : context, t : valtype, x : idx}:
@@ -2190,12 +2190,12 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:290.1-292.28
   rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [(rt <: valtype)]))
+    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [$valtype_reftype(rt)]))
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:294.1-296.28
   rule table.set {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype (rt <: valtype)], []))
+    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype $valtype_reftype(rt)], []))
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:298.1-300.24
@@ -2205,12 +2205,12 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:302.1-304.28
   rule table.grow {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([(rt <: valtype) I32_valtype], [I32_valtype]))
+    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([$valtype_reftype(rt) I32_valtype], [I32_valtype]))
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:306.1-308.28
   rule table.fill {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype (rt <: valtype) I32_valtype], []))
+    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype $valtype_reftype(rt) I32_valtype], []))
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:310.1-313.32
@@ -2263,19 +2263,19 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:350.1-355.32
   rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?}:
-    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
+    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [$valtype_numtype(nt)]))
     -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= ($size(nt <: valtype) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(nt <: valtype) / 8))))?{n}
-    -- if ((n?{n} = ?()) \/ (nt = (in <: numtype)))
+    -- if ((2 ^ n_A) <= ($size($valtype_numtype(nt)) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size($valtype_numtype(nt)) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
 
   ;; 3-typing.watsup:357.1-362.32
   rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype}:
-    `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype (nt <: valtype)], []))
+    `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype $valtype_numtype(nt)], []))
     -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= ($size(nt <: valtype) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size(nt <: valtype) / 8))))?{n}
-    -- if ((n?{n} = ?()) \/ (nt = (in <: numtype)))
+    -- if ((2 ^ n_A) <= ($size($valtype_numtype(nt)) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < ($size($valtype_numtype(nt)) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
 
 ;; 3-typing.watsup:124.1-124.67
 relation InstrSeq_ok: `%|-%*:%`(context, instr*, functype)
@@ -2392,7 +2392,7 @@ relation Elem_ok: `%|-%:%`(context, elem, reftype)
   ;; 3-typing.watsup:428.1-431.40
   rule _ {C : context, elemmode? : elemmode?, expr* : expr*, rt : reftype}:
     `%|-%:%`(C, `ELEM%%*%?`(rt, expr*{expr}, elemmode?{elemmode}), rt)
-    -- (Expr_ok: `%|-%:%`(C, expr, [(rt <: valtype)]))*{expr}
+    -- (Expr_ok: `%|-%:%`(C, expr, [$valtype_reftype(rt)]))*{expr}
     -- (Elemmode_ok: `%|-%:%`(C, elemmode, rt))?{elemmode}
 
 ;; 3-typing.watsup:404.1-404.77
@@ -2513,20 +2513,6 @@ syntax val =
   | REF.FUNC_ADDR(funcaddr)
   | REF.HOST_ADDR(hostaddr)
 
-;;
-def val_num : num -> val
-  ;;
-  def {x : (numtype, c_numtype)} val_num(CONST_num(x)) = CONST_val(x)
-
-;;
-def val_ref : ref -> val
-  ;;
-  def {x : reftype} val_ref(REF.NULL_ref(x)) = REF.NULL_val(x)
-  ;;
-  def {x : funcaddr} val_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_val(x)
-  ;;
-  def {x : hostaddr} val_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_val(x)
-
 ;; 4-runtime.watsup:31.1-32.18
 syntax result =
   | _VALS(val*)
@@ -2644,6 +2630,17 @@ syntax admininstr =
   | TRAP
 }
 
+;;
+def admininstr_globalinst : globalinst -> admininstr
+  ;;
+  def {x : (numtype, c_numtype)} admininstr_globalinst(CONST_val(x)) = CONST_admininstr(x)
+  ;;
+  def {x : reftype} admininstr_globalinst(REF.NULL_val(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcaddr} admininstr_globalinst(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
+  ;;
+  def {x : hostaddr} admininstr_globalinst(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
+
 ;;
 def admininstr_instr : instr -> admininstr
   ;;
@@ -2735,17 +2732,6 @@ def admininstr_instr : instr -> admininstr
   ;;
   def {x : (numtype, n?, nat, nat)} admininstr_instr(STORE_instr(x)) = STORE_admininstr(x)
 
-;;
-def admininstr_val : val -> admininstr
-  ;;
-  def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
-  ;;
-  def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
-  ;;
-  def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
-  def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
-
 ;;
 def admininstr_ref : ref -> admininstr
   ;;
@@ -2756,9 +2742,15 @@ def admininstr_ref : ref -> admininstr
   def {x : hostaddr} admininstr_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_admininstr(x)
 
 ;;
-def admininstr_globalinst : globalinst -> admininstr
+def admininstr_val : val -> admininstr
+  ;;
+  def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
+  ;;
+  def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
   ;;
-  def {x : globalinst} admininstr_globalinst(x) = $admininstr_val(x)
+  def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
 
 ;; 4-runtime.watsup:84.1-84.62
 syntax config = `%;%*`(state, admininstr*)
@@ -2873,26 +2865,26 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:22.1-23.24
   rule drop {val : val}:
-    `%*~>%*`([(val <: admininstr) DROP_admininstr], [])
+    `%*~>%*`([$admininstr_val(val) DROP_admininstr], [])
 
   ;; 6-reduction.watsup:26.1-28.16
   rule select-true {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
-    `%*~>%*`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [(val_1 <: admininstr)])
+    `%*~>%*`([$admininstr_val(val_1) $admininstr_val(val_2) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [$admininstr_val(val_1)])
     -- if (c =/= 0)
 
   ;; 6-reduction.watsup:30.1-32.14
   rule select-false {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
-    `%*~>%*`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [(val_2 <: admininstr)])
+    `%*~>%*`([$admininstr_val(val_1) $admininstr_val(val_2) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [$admininstr_val(val_2)])
     -- if (c = 0)
 
   ;; 6-reduction.watsup:35.1-37.28
   rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
-    `%*~>%*`((val <: admininstr)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    `%*~>%*`($admininstr_val(val)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], $admininstr_val(val)^k{val} :: $admininstr_instr(instr)*{instr})])
     -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
 
   ;; 6-reduction.watsup:39.1-41.28
   rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
-    `%*~>%*`((val <: admininstr)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [LOOP_instr(bt, instr*{instr})], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    `%*~>%*`($admininstr_val(val)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [LOOP_instr(bt, instr*{instr})], $admininstr_val(val)^k{val} :: $admininstr_instr(instr)*{instr})])
     -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
 
   ;; 6-reduction.watsup:43.1-45.16
@@ -2907,15 +2899,15 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:52.1-53.38
   rule label-vals {instr* : instr*, n : n, val* : val*}:
-    `%*~>%*`([LABEL__admininstr(n, instr*{instr}, (val <: admininstr)*{val})], (val <: admininstr)*{val})
+    `%*~>%*`([LABEL__admininstr(n, instr*{instr}, $admininstr_val(val)*{val})], $admininstr_val(val)*{val})
 
   ;; 6-reduction.watsup:57.1-58.69
   rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
-    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [BR_admininstr(0)] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val} :: (instr' <: admininstr)*{instr'})
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, $admininstr_val(val')*{val'} :: $admininstr_val(val)^n{val} :: [BR_admininstr(0)] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)^n{val} :: $admininstr_instr(instr')*{instr'})
 
   ;; 6-reduction.watsup:60.1-61.65
   rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
-    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val <: admininstr)*{val} :: [BR_admininstr(l + 1)] :: (instr <: admininstr)*{instr})], (val <: admininstr)*{val} :: [BR_admininstr(l)])
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, $admininstr_val(val)*{val} :: [BR_admininstr(l + 1)] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)*{val} :: [BR_admininstr(l)])
 
   ;; 6-reduction.watsup:64.1-66.16
   rule br_if-true {c : c_numtype, l : labelidx}:
@@ -2939,15 +2931,15 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:100.1-101.35
   rule frame-vals {f : frame, n : n, val^n : val^n}:
-    `%*~>%*`([FRAME__admininstr(n, f, (val <: admininstr)^n{val})], (val <: admininstr)^n{val})
+    `%*~>%*`([FRAME__admininstr(n, f, $admininstr_val(val)^n{val})], $admininstr_val(val)^n{val})
 
   ;; 6-reduction.watsup:103.1-104.55
   rule return-frame {f : frame, instr* : instr*, n : n, val^n : val^n, val'* : val*}:
-    `%*~>%*`([FRAME__admininstr(n, f, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val})
+    `%*~>%*`([FRAME__admininstr(n, f, $admininstr_val(val')*{val'} :: $admininstr_val(val)^n{val} :: [RETURN_admininstr] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)^n{val})
 
   ;; 6-reduction.watsup:106.1-107.60
   rule return-label {instr* : instr*, instr'* : instr*, k : nat, val* : val*}:
-    `%*~>%*`([LABEL__admininstr(k, instr'*{instr'}, (val <: admininstr)*{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)*{val} :: [RETURN_admininstr])
+    `%*~>%*`([LABEL__admininstr(k, instr'*{instr'}, $admininstr_val(val)*{val} :: [RETURN_admininstr] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)*{val} :: [RETURN_admininstr])
 
   ;; 6-reduction.watsup:110.1-112.33
   rule unop-val {c : c_numtype, c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
@@ -2981,7 +2973,7 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:137.1-138.70
   rule extend {c : c_numtype, n : n, nt : numtype}:
-    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, $size(nt <: valtype), S_sx, c))])
+    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, $size($valtype_numtype(nt)), S_sx, c))])
 
   ;; 6-reduction.watsup:141.1-143.48
   rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
@@ -2995,17 +2987,17 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:154.1-156.28
   rule ref.is_null-true {rt : reftype, val : val}:
-    `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
+    `%*~>%*`([$admininstr_val(val) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
     -- if (val = REF.NULL_val(rt))
 
   ;; 6-reduction.watsup:158.1-160.15
   rule ref.is_null-false {val : val}:
-    `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
+    `%*~>%*`([$admininstr_val(val) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
     -- otherwise
 
   ;; 6-reduction.watsup:169.1-170.47
   rule local.tee {val : val, x : idx}:
-    `%*~>%*`([(val <: admininstr) LOCAL.TEE_admininstr(x)], [(val <: admininstr) (val <: admininstr) LOCAL.SET_admininstr(x)])
+    `%*~>%*`([$admininstr_val(val) LOCAL.TEE_admininstr(x)], [$admininstr_val(val) $admininstr_val(val) LOCAL.SET_admininstr(x)])
 
 ;; 6-reduction.watsup:5.1-5.63
 relation Step_read: `%~>%*`(config, admininstr*)
@@ -3026,7 +3018,7 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:94.1-97.52
   rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
-    `%~>%*`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], (instr <: admininstr)*{instr})])])
+    `%~>%*`(`%;%*`(z, $admininstr_val(val)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], $admininstr_instr(instr)*{instr})])])
     -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
     -- if (f = {LOCAL val^k{val} :: $default_(t)*{t}, MODULE m})
 
@@ -3036,11 +3028,11 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:163.1-164.37
   rule local.get {x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [LOCAL.GET_admininstr(x)]), [($local(z, x) <: admininstr)])
+    `%~>%*`(`%;%*`(z, [LOCAL.GET_admininstr(x)]), [$admininstr_val($local(z, x))])
 
   ;; 6-reduction.watsup:173.1-174.39
   rule global.get {x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]), [($global(z, x) <: admininstr)])
+    `%~>%*`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]), [$admininstr_globalinst($global(z, x))])
 
   ;; 6-reduction.watsup:180.1-182.28
   rule table.get-trap {i : nat, x : idx, z : state}:
@@ -3049,12 +3041,12 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:184.1-186.27
   rule table.get-val {i : nat, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [($table(z, x)[i] <: admininstr)])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [$admininstr_ref($table(z, x)[i])])
     -- if (i < |$table(z, x)|)
 
   ;; 6-reduction.watsup:188.1-190.28
   rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_ref(ref) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
     -- if (i >= |$table(z, x)|)
 
   ;; 6-reduction.watsup:197.1-199.27
@@ -3068,18 +3060,18 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:209.1-211.34
   rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
     -- if ((i + n) > |$table(z, x)|)
 
   ;; 6-reduction.watsup:213.1-216.14
   rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
     -- otherwise
     -- if (n = 0)
 
   ;; 6-reduction.watsup:218.1-222.15
   rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) (val <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) (val <: admininstr) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) $admininstr_val(val) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) $admininstr_val(val) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
     -- otherwise
 
   ;; 6-reduction.watsup:225.1-227.63
@@ -3117,37 +3109,37 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:257.1-261.15
   rule table.init-succ {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) ($elem(z, y)[i] <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) $admininstr_ref($elem(z, y)[i]) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
     -- otherwise
 
 ;; 6-reduction.watsup:3.1-3.63
 relation Step: `%~>%`(config, config)
   ;; 6-reduction.watsup:7.1-9.34
   rule pure {instr* : instr*, instr'* : instr*, z : state}:
-    `%~>%`(`%;%*`(z, (instr <: admininstr)*{instr}), `%;%*`(z, (instr' <: admininstr)*{instr'}))
-    -- Step_pure: `%*~>%*`((instr <: admininstr)*{instr}, (instr' <: admininstr)*{instr'})
+    `%~>%`(`%;%*`(z, $admininstr_instr(instr)*{instr}), `%;%*`(z, $admininstr_instr(instr')*{instr'}))
+    -- Step_pure: `%*~>%*`($admininstr_instr(instr)*{instr}, $admininstr_instr(instr')*{instr'})
 
   ;; 6-reduction.watsup:11.1-13.37
   rule read {instr* : instr*, instr'* : instr*, z : state}:
-    `%~>%`(`%;%*`(z, (instr <: admininstr)*{instr}), `%;%*`(z, (instr' <: admininstr)*{instr'}))
-    -- Step_read: `%~>%*`(`%;%*`(z, (instr <: admininstr)*{instr}), (instr' <: admininstr)*{instr'})
+    `%~>%`(`%;%*`(z, $admininstr_instr(instr)*{instr}), `%;%*`(z, $admininstr_instr(instr')*{instr'}))
+    -- Step_read: `%~>%*`(`%;%*`(z, $admininstr_instr(instr)*{instr}), $admininstr_instr(instr')*{instr'})
 
   ;; 6-reduction.watsup:166.1-167.60
   rule local.set {val : val, x : idx, z : state}:
-    `%~>%`(`%;%*`(z, [(val <: admininstr) LOCAL.SET_admininstr(x)]), `%;%*`($with_local(z, x, val), []))
+    `%~>%`(`%;%*`(z, [$admininstr_val(val) LOCAL.SET_admininstr(x)]), `%;%*`($with_local(z, x, val), []))
 
   ;; 6-reduction.watsup:176.1-177.62
   rule global.set {val : val, x : idx, z : state}:
-    `%~>%`(`%;%*`(z, [(val <: admininstr) GLOBAL.SET_admininstr(x)]), `%;%*`($with_global(z, x, val), []))
+    `%~>%`(`%;%*`(z, [$admininstr_val(val) GLOBAL.SET_admininstr(x)]), `%;%*`($with_global(z, x, val), []))
 
   ;; 6-reduction.watsup:192.1-194.27
   rule table.set-val {i : nat, ref : ref, x : idx, z : state}:
-    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), `%;%*`($with_table(z, x, i, ref), []))
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_ref(ref) TABLE.GET_admininstr(x)]), `%;%*`($with_table(z, x, i, ref), []))
     -- if (i < |$table(z, x)|)
 
   ;; 6-reduction.watsup:202.1-203.102
   rule table.grow-succeed {n : n, ref : ref, x : idx, z : state}:
-    `%~>%`(`%;%*`(z, [(ref <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), `%;%*`($with_tableext(z, x, ref^n{}), [CONST_admininstr(I32_numtype, |$table(z, x)|)]))
+    `%~>%`(`%;%*`(z, [$admininstr_ref(ref) CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), `%;%*`($with_tableext(z, x, ref^n{}), [CONST_admininstr(I32_numtype, |$table(z, x)|)]))
 
   ;; 6-reduction.watsup:264.1-265.59
   rule elem.drop {x : idx, z : state}:
@@ -3233,11 +3225,6 @@ def valtype_numtype : numtype -> valtype
   ;;
   def valtype_numtype(F64_numtype) = F64_valtype
 
-;;
-def valtype_vectype : vectype -> valtype
-  ;;
-  def valtype_vectype(V128_vectype) = V128_valtype
-
 ;;
 def valtype_reftype : reftype -> valtype
   ;;
@@ -3245,6 +3232,11 @@ def valtype_reftype : reftype -> valtype
   ;;
   def valtype_reftype(EXTERNREF_reftype) = EXTERNREF_valtype
 
+;;
+def valtype_vectype : vectype -> valtype
+  ;;
+  def valtype_vectype(V128_vectype) = V128_valtype
+
 ;; 1-syntax.watsup:48.1-48.71
 syntax in =
   | I32
@@ -3723,7 +3715,7 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
   rule select-impl {C : context, numtype : numtype, t : valtype, t' : valtype, vectype : vectype}:
     `%|-%:%`(C, SELECT_instr(?()), `%->%`([t t I32_valtype], [t]))
     -- Valtype_sub: `|-%<:%`(t, t')
-    -- if ((t' = (numtype <: valtype)) \/ (t' = (vectype <: valtype)))
+    -- if ((t' = $valtype_numtype(numtype)) \/ (t' = $valtype_vectype(vectype)))
 
   ;; 3-typing.watsup:178.1-181.57
   rule block {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
@@ -3778,49 +3770,49 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:222.1-223.37
   rule const {C : context, c_nt : c_numtype, nt : numtype}:
-    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [(nt <: valtype)]))
+    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [$valtype_numtype(nt)]))
 
   ;; 3-typing.watsup:225.1-226.31
   rule unop {C : context, nt : numtype, unop : unop_numtype}:
-    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
+    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([$valtype_numtype(nt)], [$valtype_numtype(nt)]))
 
   ;; 3-typing.watsup:228.1-229.36
   rule binop {C : context, binop : binop_numtype, nt : numtype}:
-    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([(nt <: valtype) (nt <: valtype)], [(nt <: valtype)]))
+    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([$valtype_numtype(nt) $valtype_numtype(nt)], [$valtype_numtype(nt)]))
 
   ;; 3-typing.watsup:231.1-232.36
   rule testop {C : context, nt : numtype, testop : testop_numtype}:
-    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([(nt <: valtype)], [I32_valtype]))
+    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([$valtype_numtype(nt)], [I32_valtype]))
 
   ;; 3-typing.watsup:234.1-235.37
   rule relop {C : context, nt : numtype, relop : relop_numtype}:
-    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([(nt <: valtype) (nt <: valtype)], [I32_valtype]))
+    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([$valtype_numtype(nt) $valtype_numtype(nt)], [I32_valtype]))
 
   ;; 3-typing.watsup:238.1-240.23
   rule extend {C : context, n : n, nt : numtype}:
-    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
-    -- if (n <= !($size(nt <: valtype)))
+    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([$valtype_numtype(nt)], [$valtype_numtype(nt)]))
+    -- if (n <= !($size($valtype_numtype(nt))))
 
   ;; 3-typing.watsup:242.1-245.34
   rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype}:
-    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([(nt_2 <: valtype)], [(nt_1 <: valtype)]))
+    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([$valtype_numtype(nt_2)], [$valtype_numtype(nt_1)]))
     -- if (nt_1 =/= nt_2)
-    -- if (!($size(nt_1 <: valtype)) = !($size(nt_2 <: valtype)))
+    -- if (!($size($valtype_numtype(nt_1))) = !($size($valtype_numtype(nt_2))))
 
   ;; 3-typing.watsup:247.1-250.52
   rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?}:
-    `%|-%:%`(C, CVTOP_instr((in_1 <: numtype), CONVERT_cvtop, (in_2 <: numtype), sx?{sx}), `%->%`([(in_2 <: valtype)], [(in_1 <: valtype)]))
+    `%|-%:%`(C, CVTOP_instr($numtype_in(in_1), CONVERT_cvtop, $numtype_in(in_2), sx?{sx}), `%->%`([$valtype_in(in_2)], [$valtype_in(in_1)]))
     -- if (in_1 =/= in_2)
-    -- if ((sx?{sx} = ?()) <=> (!($size(in_1 <: valtype)) > !($size(in_2 <: valtype))))
+    -- if ((sx?{sx} = ?()) <=> (!($size($valtype_in(in_1))) > !($size($valtype_in(in_2)))))
 
   ;; 3-typing.watsup:252.1-254.22
   rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
-    `%|-%:%`(C, CVTOP_instr((fn_1 <: numtype), CONVERT_cvtop, (fn_2 <: numtype), ?()), `%->%`([(fn_2 <: valtype)], [(fn_1 <: valtype)]))
+    `%|-%:%`(C, CVTOP_instr($numtype_fn(fn_1), CONVERT_cvtop, $numtype_fn(fn_2), ?()), `%->%`([$valtype_fn(fn_2)], [$valtype_fn(fn_1)]))
     -- if (fn_1 =/= fn_2)
 
   ;; 3-typing.watsup:257.1-258.35
   rule ref.null {C : context, rt : reftype}:
-    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [(rt <: valtype)]))
+    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [$valtype_reftype(rt)]))
 
   ;; 3-typing.watsup:260.1-262.23
   rule ref.func {C : context, ft : functype, x : idx}:
@@ -3829,7 +3821,7 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:264.1-265.31
   rule ref.is_null {C : context, rt : reftype}:
-    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([(rt <: valtype)], [I32_valtype]))
+    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([$valtype_reftype(rt)], [I32_valtype]))
 
   ;; 3-typing.watsup:268.1-270.23
   rule local.get {C : context, t : valtype, x : idx}:
@@ -3858,12 +3850,12 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:290.1-292.28
   rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [(rt <: valtype)]))
+    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [$valtype_reftype(rt)]))
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:294.1-296.28
   rule table.set {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype (rt <: valtype)], []))
+    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype $valtype_reftype(rt)], []))
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:298.1-300.24
@@ -3873,12 +3865,12 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:302.1-304.28
   rule table.grow {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([(rt <: valtype) I32_valtype], [I32_valtype]))
+    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([$valtype_reftype(rt) I32_valtype], [I32_valtype]))
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:306.1-308.28
   rule table.fill {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype (rt <: valtype) I32_valtype], []))
+    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype $valtype_reftype(rt) I32_valtype], []))
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:310.1-313.32
@@ -3931,19 +3923,19 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:350.1-355.32
   rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?}:
-    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
+    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [$valtype_numtype(nt)]))
     -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= (!($size(nt <: valtype)) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size(nt <: valtype)) / 8))))?{n}
-    -- if ((n?{n} = ?()) \/ (nt = (in <: numtype)))
+    -- if ((2 ^ n_A) <= (!($size($valtype_numtype(nt))) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size($valtype_numtype(nt))) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
 
   ;; 3-typing.watsup:357.1-362.32
   rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype}:
-    `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype (nt <: valtype)], []))
+    `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype $valtype_numtype(nt)], []))
     -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= (!($size(nt <: valtype)) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size(nt <: valtype)) / 8))))?{n}
-    -- if ((n?{n} = ?()) \/ (nt = (in <: numtype)))
+    -- if ((2 ^ n_A) <= (!($size($valtype_numtype(nt))) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size($valtype_numtype(nt))) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
 
 ;; 3-typing.watsup:124.1-124.67
 relation InstrSeq_ok: `%|-%*:%`(context, instr*, functype)
@@ -4060,7 +4052,7 @@ relation Elem_ok: `%|-%:%`(context, elem, reftype)
   ;; 3-typing.watsup:428.1-431.40
   rule _ {C : context, elemmode? : elemmode?, expr* : expr*, rt : reftype}:
     `%|-%:%`(C, `ELEM%%*%?`(rt, expr*{expr}, elemmode?{elemmode}), rt)
-    -- (Expr_ok: `%|-%:%`(C, expr, [(rt <: valtype)]))*{expr}
+    -- (Expr_ok: `%|-%:%`(C, expr, [$valtype_reftype(rt)]))*{expr}
     -- (Elemmode_ok: `%|-%:%`(C, elemmode, rt))?{elemmode}
 
 ;; 3-typing.watsup:404.1-404.77
@@ -4181,20 +4173,6 @@ syntax val =
   | REF.FUNC_ADDR(funcaddr)
   | REF.HOST_ADDR(hostaddr)
 
-;;
-def val_num : num -> val
-  ;;
-  def {x : (numtype, c_numtype)} val_num(CONST_num(x)) = CONST_val(x)
-
-;;
-def val_ref : ref -> val
-  ;;
-  def {x : reftype} val_ref(REF.NULL_ref(x)) = REF.NULL_val(x)
-  ;;
-  def {x : funcaddr} val_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_val(x)
-  ;;
-  def {x : hostaddr} val_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_val(x)
-
 ;; 4-runtime.watsup:31.1-32.18
 syntax result =
   | _VALS(val*)
@@ -4314,6 +4292,17 @@ syntax admininstr =
   | TRAP
 }
 
+;;
+def admininstr_globalinst : globalinst -> admininstr
+  ;;
+  def {x : (numtype, c_numtype)} admininstr_globalinst(CONST_val(x)) = CONST_admininstr(x)
+  ;;
+  def {x : reftype} admininstr_globalinst(REF.NULL_val(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcaddr} admininstr_globalinst(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
+  ;;
+  def {x : hostaddr} admininstr_globalinst(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
+
 ;;
 def admininstr_instr : instr -> admininstr
   ;;
@@ -4405,17 +4394,6 @@ def admininstr_instr : instr -> admininstr
   ;;
   def {x : (numtype, n?, nat, nat)} admininstr_instr(STORE_instr(x)) = STORE_admininstr(x)
 
-;;
-def admininstr_val : val -> admininstr
-  ;;
-  def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
-  ;;
-  def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
-  ;;
-  def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
-  def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
-
 ;;
 def admininstr_ref : ref -> admininstr
   ;;
@@ -4426,9 +4404,15 @@ def admininstr_ref : ref -> admininstr
   def {x : hostaddr} admininstr_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_admininstr(x)
 
 ;;
-def admininstr_globalinst : globalinst -> admininstr
+def admininstr_val : val -> admininstr
+  ;;
+  def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
+  ;;
+  def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
   ;;
-  def {x : globalinst} admininstr_globalinst(x) = $admininstr_val(x)
+  def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
+  ;;
+  def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
 
 ;; 4-runtime.watsup:84.1-84.62
 syntax config = `%;%*`(state, admininstr*)
@@ -4543,26 +4527,26 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:22.1-23.24
   rule drop {val : val}:
-    `%*~>%*`([(val <: admininstr) DROP_admininstr], [])
+    `%*~>%*`([$admininstr_val(val) DROP_admininstr], [])
 
   ;; 6-reduction.watsup:26.1-28.16
   rule select-true {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
-    `%*~>%*`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [(val_1 <: admininstr)])
+    `%*~>%*`([$admininstr_val(val_1) $admininstr_val(val_2) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [$admininstr_val(val_1)])
     -- if (c =/= 0)
 
   ;; 6-reduction.watsup:30.1-32.14
   rule select-false {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
-    `%*~>%*`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [(val_2 <: admininstr)])
+    `%*~>%*`([$admininstr_val(val_1) $admininstr_val(val_2) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [$admininstr_val(val_2)])
     -- if (c = 0)
 
   ;; 6-reduction.watsup:35.1-37.28
   rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
-    `%*~>%*`((val <: admininstr)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    `%*~>%*`($admininstr_val(val)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], $admininstr_val(val)^k{val} :: $admininstr_instr(instr)*{instr})])
     -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
 
   ;; 6-reduction.watsup:39.1-41.28
   rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
-    `%*~>%*`((val <: admininstr)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [LOOP_instr(bt, instr*{instr})], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    `%*~>%*`($admininstr_val(val)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [LOOP_instr(bt, instr*{instr})], $admininstr_val(val)^k{val} :: $admininstr_instr(instr)*{instr})])
     -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
 
   ;; 6-reduction.watsup:43.1-45.16
@@ -4577,15 +4561,15 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:52.1-53.38
   rule label-vals {instr* : instr*, n : n, val* : val*}:
-    `%*~>%*`([LABEL__admininstr(n, instr*{instr}, (val <: admininstr)*{val})], (val <: admininstr)*{val})
+    `%*~>%*`([LABEL__admininstr(n, instr*{instr}, $admininstr_val(val)*{val})], $admininstr_val(val)*{val})
 
   ;; 6-reduction.watsup:57.1-58.69
   rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
-    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [BR_admininstr(0)] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val} :: (instr' <: admininstr)*{instr'})
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, $admininstr_val(val')*{val'} :: $admininstr_val(val)^n{val} :: [BR_admininstr(0)] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)^n{val} :: $admininstr_instr(instr')*{instr'})
 
   ;; 6-reduction.watsup:60.1-61.65
   rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
-    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val <: admininstr)*{val} :: [BR_admininstr(l + 1)] :: (instr <: admininstr)*{instr})], (val <: admininstr)*{val} :: [BR_admininstr(l)])
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, $admininstr_val(val)*{val} :: [BR_admininstr(l + 1)] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)*{val} :: [BR_admininstr(l)])
 
   ;; 6-reduction.watsup:64.1-66.16
   rule br_if-true {c : c_numtype, l : labelidx}:
@@ -4609,15 +4593,15 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:100.1-101.35
   rule frame-vals {f : frame, n : n, val^n : val^n}:
-    `%*~>%*`([FRAME__admininstr(n, f, (val <: admininstr)^n{val})], (val <: admininstr)^n{val})
+    `%*~>%*`([FRAME__admininstr(n, f, $admininstr_val(val)^n{val})], $admininstr_val(val)^n{val})
 
   ;; 6-reduction.watsup:103.1-104.55
   rule return-frame {f : frame, instr* : instr*, n : n, val^n : val^n, val'* : val*}:
-    `%*~>%*`([FRAME__admininstr(n, f, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val})
+    `%*~>%*`([FRAME__admininstr(n, f, $admininstr_val(val')*{val'} :: $admininstr_val(val)^n{val} :: [RETURN_admininstr] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)^n{val})
 
   ;; 6-reduction.watsup:106.1-107.60
   rule return-label {instr* : instr*, instr'* : instr*, k : nat, val* : val*}:
-    `%*~>%*`([LABEL__admininstr(k, instr'*{instr'}, (val <: admininstr)*{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)*{val} :: [RETURN_admininstr])
+    `%*~>%*`([LABEL__admininstr(k, instr'*{instr'}, $admininstr_val(val)*{val} :: [RETURN_admininstr] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)*{val} :: [RETURN_admininstr])
 
   ;; 6-reduction.watsup:110.1-112.33
   rule unop-val {c : c_numtype, c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
@@ -4651,7 +4635,7 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:137.1-138.70
   rule extend {c : c_numtype, n : n, nt : numtype}:
-    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, !($size(nt <: valtype)), S_sx, c))])
+    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, !($size($valtype_numtype(nt))), S_sx, c))])
 
   ;; 6-reduction.watsup:141.1-143.48
   rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
@@ -4665,17 +4649,17 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:154.1-156.28
   rule ref.is_null-true {rt : reftype, val : val}:
-    `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
+    `%*~>%*`([$admininstr_val(val) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
     -- if (val = REF.NULL_val(rt))
 
   ;; 6-reduction.watsup:158.1-160.15
   rule ref.is_null-false {val : val}:
-    `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
+    `%*~>%*`([$admininstr_val(val) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
     -- otherwise
 
   ;; 6-reduction.watsup:169.1-170.47
   rule local.tee {val : val, x : idx}:
-    `%*~>%*`([(val <: admininstr) LOCAL.TEE_admininstr(x)], [(val <: admininstr) (val <: admininstr) LOCAL.SET_admininstr(x)])
+    `%*~>%*`([$admininstr_val(val) LOCAL.TEE_admininstr(x)], [$admininstr_val(val) $admininstr_val(val) LOCAL.SET_admininstr(x)])
 
 ;; 6-reduction.watsup:5.1-5.63
 relation Step_read: `%~>%*`(config, admininstr*)
@@ -4696,7 +4680,7 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:94.1-97.52
   rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
-    `%~>%*`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], (instr <: admininstr)*{instr})])])
+    `%~>%*`(`%;%*`(z, $admininstr_val(val)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], $admininstr_instr(instr)*{instr})])])
     -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
     -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
 
@@ -4706,11 +4690,11 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:163.1-164.37
   rule local.get {x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [LOCAL.GET_admininstr(x)]), [($local(z, x) <: admininstr)])
+    `%~>%*`(`%;%*`(z, [LOCAL.GET_admininstr(x)]), [$admininstr_val($local(z, x))])
 
   ;; 6-reduction.watsup:173.1-174.39
   rule global.get {x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]), [($global(z, x) <: admininstr)])
+    `%~>%*`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]), [$admininstr_globalinst($global(z, x))])
 
   ;; 6-reduction.watsup:180.1-182.28
   rule table.get-trap {i : nat, x : idx, z : state}:
@@ -4719,12 +4703,12 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:184.1-186.27
   rule table.get-val {i : nat, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [($table(z, x)[i] <: admininstr)])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [$admininstr_ref($table(z, x)[i])])
     -- if (i < |$table(z, x)|)
 
   ;; 6-reduction.watsup:188.1-190.28
   rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_ref(ref) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
     -- if (i >= |$table(z, x)|)
 
   ;; 6-reduction.watsup:197.1-199.27
@@ -4738,18 +4722,18 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:209.1-211.34
   rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
     -- if ((i + n) > |$table(z, x)|)
 
   ;; 6-reduction.watsup:213.1-216.14
   rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
     -- otherwise
     -- if (n = 0)
 
   ;; 6-reduction.watsup:218.1-222.15
   rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) (val <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) (val <: admininstr) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) $admininstr_val(val) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) $admininstr_val(val) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
     -- otherwise
 
   ;; 6-reduction.watsup:225.1-227.63
@@ -4787,37 +4771,37 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:257.1-261.15
   rule table.init-succ {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) ($elem(z, y)[i] <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) $admininstr_ref($elem(z, y)[i]) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
     -- otherwise
 
 ;; 6-reduction.watsup:3.1-3.63
 relation Step: `%~>%`(config, config)
   ;; 6-reduction.watsup:7.1-9.34
   rule pure {instr* : instr*, instr'* : instr*, z : state}:
-    `%~>%`(`%;%*`(z, (instr <: admininstr)*{instr}), `%;%*`(z, (instr' <: admininstr)*{instr'}))
-    -- Step_pure: `%*~>%*`((instr <: admininstr)*{instr}, (instr' <: admininstr)*{instr'})
+    `%~>%`(`%;%*`(z, $admininstr_instr(instr)*{instr}), `%;%*`(z, $admininstr_instr(instr')*{instr'}))
+    -- Step_pure: `%*~>%*`($admininstr_instr(instr)*{instr}, $admininstr_instr(instr')*{instr'})
 
   ;; 6-reduction.watsup:11.1-13.37
   rule read {instr* : instr*, instr'* : instr*, z : state}:
-    `%~>%`(`%;%*`(z, (instr <: admininstr)*{instr}), `%;%*`(z, (instr' <: admininstr)*{instr'}))
-    -- Step_read: `%~>%*`(`%;%*`(z, (instr <: admininstr)*{instr}), (instr' <: admininstr)*{instr'})
+    `%~>%`(`%;%*`(z, $admininstr_instr(instr)*{instr}), `%;%*`(z, $admininstr_instr(instr')*{instr'}))
+    -- Step_read: `%~>%*`(`%;%*`(z, $admininstr_instr(instr)*{instr}), $admininstr_instr(instr')*{instr'})
 
   ;; 6-reduction.watsup:166.1-167.60
   rule local.set {val : val, x : idx, z : state}:
-    `%~>%`(`%;%*`(z, [(val <: admininstr) LOCAL.SET_admininstr(x)]), `%;%*`($with_local(z, x, val), []))
+    `%~>%`(`%;%*`(z, [$admininstr_val(val) LOCAL.SET_admininstr(x)]), `%;%*`($with_local(z, x, val), []))
 
   ;; 6-reduction.watsup:176.1-177.62
   rule global.set {val : val, x : idx, z : state}:
-    `%~>%`(`%;%*`(z, [(val <: admininstr) GLOBAL.SET_admininstr(x)]), `%;%*`($with_global(z, x, val), []))
+    `%~>%`(`%;%*`(z, [$admininstr_val(val) GLOBAL.SET_admininstr(x)]), `%;%*`($with_global(z, x, val), []))
 
   ;; 6-reduction.watsup:192.1-194.27
   rule table.set-val {i : nat, ref : ref, x : idx, z : state}:
-    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), `%;%*`($with_table(z, x, i, ref), []))
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_ref(ref) TABLE.GET_admininstr(x)]), `%;%*`($with_table(z, x, i, ref), []))
     -- if (i < |$table(z, x)|)
 
   ;; 6-reduction.watsup:202.1-203.102
   rule table.grow-succeed {n : n, ref : ref, x : idx, z : state}:
-    `%~>%`(`%;%*`(z, [(ref <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), `%;%*`($with_tableext(z, x, ref^n{}), [CONST_admininstr(I32_numtype, |$table(z, x)|)]))
+    `%~>%`(`%;%*`(z, [$admininstr_ref(ref) CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), `%;%*`($with_tableext(z, x, ref^n{}), [CONST_admininstr(I32_numtype, |$table(z, x)|)]))
 
   ;; 6-reduction.watsup:264.1-265.59
   rule elem.drop {x : idx, z : state}:
@@ -4903,11 +4887,6 @@ def valtype_numtype : numtype -> valtype
   ;;
   def valtype_numtype(F64_numtype) = F64_valtype
 
-;;
-def valtype_vectype : vectype -> valtype
-  ;;
-  def valtype_vectype(V128_vectype) = V128_valtype
-
 ;;
 def valtype_reftype : reftype -> valtype
   ;;
@@ -4915,6 +4894,11 @@ def valtype_reftype : reftype -> valtype
   ;;
   def valtype_reftype(EXTERNREF_reftype) = EXTERNREF_valtype
 
+;;
+def valtype_vectype : vectype -> valtype
+  ;;
+  def valtype_vectype(V128_vectype) = V128_valtype
+
 ;; 1-syntax.watsup:48.1-48.71
 syntax in =
   | I32
@@ -5394,7 +5378,7 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
   rule select-impl {C : context, numtype : numtype, t : valtype, t' : valtype, vectype : vectype}:
     `%|-%:%`(C, SELECT_instr(?()), `%->%`([t t I32_valtype], [t]))
     -- Valtype_sub: `|-%<:%`(t, t')
-    -- if ((t' = (numtype <: valtype)) \/ (t' = (vectype <: valtype)))
+    -- if ((t' = $valtype_numtype(numtype)) \/ (t' = $valtype_vectype(vectype)))
 
   ;; 3-typing.watsup:178.1-181.57
   rule block {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
@@ -5455,54 +5439,54 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:222.1-223.37
   rule const {C : context, c_nt : c_numtype, nt : numtype}:
-    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [(nt <: valtype)]))
+    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [$valtype_numtype(nt)]))
 
   ;; 3-typing.watsup:225.1-226.31
   rule unop {C : context, nt : numtype, unop : unop_numtype}:
-    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
+    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([$valtype_numtype(nt)], [$valtype_numtype(nt)]))
 
   ;; 3-typing.watsup:228.1-229.36
   rule binop {C : context, binop : binop_numtype, nt : numtype}:
-    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([(nt <: valtype) (nt <: valtype)], [(nt <: valtype)]))
+    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([$valtype_numtype(nt) $valtype_numtype(nt)], [$valtype_numtype(nt)]))
 
   ;; 3-typing.watsup:231.1-232.36
   rule testop {C : context, nt : numtype, testop : testop_numtype}:
-    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([(nt <: valtype)], [I32_valtype]))
+    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([$valtype_numtype(nt)], [I32_valtype]))
 
   ;; 3-typing.watsup:234.1-235.37
   rule relop {C : context, nt : numtype, relop : relop_numtype}:
-    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([(nt <: valtype) (nt <: valtype)], [I32_valtype]))
+    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([$valtype_numtype(nt) $valtype_numtype(nt)], [I32_valtype]))
 
   ;; 3-typing.watsup:238.1-240.23
   rule extend {C : context, n : n, nt : numtype}:
-    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
-    -- if ($size(nt <: valtype) =/= ?())
-    -- if (n <= !($size(nt <: valtype)))
+    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([$valtype_numtype(nt)], [$valtype_numtype(nt)]))
+    -- if ($size($valtype_numtype(nt)) =/= ?())
+    -- if (n <= !($size($valtype_numtype(nt))))
 
   ;; 3-typing.watsup:242.1-245.34
   rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype}:
-    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([(nt_2 <: valtype)], [(nt_1 <: valtype)]))
-    -- if ($size(nt_1 <: valtype) =/= ?())
-    -- if ($size(nt_2 <: valtype) =/= ?())
+    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([$valtype_numtype(nt_2)], [$valtype_numtype(nt_1)]))
+    -- if ($size($valtype_numtype(nt_1)) =/= ?())
+    -- if ($size($valtype_numtype(nt_2)) =/= ?())
     -- if (nt_1 =/= nt_2)
-    -- if (!($size(nt_1 <: valtype)) = !($size(nt_2 <: valtype)))
+    -- if (!($size($valtype_numtype(nt_1))) = !($size($valtype_numtype(nt_2))))
 
   ;; 3-typing.watsup:247.1-250.52
   rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?}:
-    `%|-%:%`(C, CVTOP_instr((in_1 <: numtype), CONVERT_cvtop, (in_2 <: numtype), sx?{sx}), `%->%`([(in_2 <: valtype)], [(in_1 <: valtype)]))
-    -- if ($size(in_1 <: valtype) =/= ?())
-    -- if ($size(in_2 <: valtype) =/= ?())
+    `%|-%:%`(C, CVTOP_instr($numtype_in(in_1), CONVERT_cvtop, $numtype_in(in_2), sx?{sx}), `%->%`([$valtype_in(in_2)], [$valtype_in(in_1)]))
+    -- if ($size($valtype_in(in_1)) =/= ?())
+    -- if ($size($valtype_in(in_2)) =/= ?())
     -- if (in_1 =/= in_2)
-    -- if ((sx?{sx} = ?()) <=> (!($size(in_1 <: valtype)) > !($size(in_2 <: valtype))))
+    -- if ((sx?{sx} = ?()) <=> (!($size($valtype_in(in_1))) > !($size($valtype_in(in_2)))))
 
   ;; 3-typing.watsup:252.1-254.22
   rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
-    `%|-%:%`(C, CVTOP_instr((fn_1 <: numtype), CONVERT_cvtop, (fn_2 <: numtype), ?()), `%->%`([(fn_2 <: valtype)], [(fn_1 <: valtype)]))
+    `%|-%:%`(C, CVTOP_instr($numtype_fn(fn_1), CONVERT_cvtop, $numtype_fn(fn_2), ?()), `%->%`([$valtype_fn(fn_2)], [$valtype_fn(fn_1)]))
     -- if (fn_1 =/= fn_2)
 
   ;; 3-typing.watsup:257.1-258.35
   rule ref.null {C : context, rt : reftype}:
-    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [(rt <: valtype)]))
+    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [$valtype_reftype(rt)]))
 
   ;; 3-typing.watsup:260.1-262.23
   rule ref.func {C : context, ft : functype, x : idx}:
@@ -5512,7 +5496,7 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:264.1-265.31
   rule ref.is_null {C : context, rt : reftype}:
-    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([(rt <: valtype)], [I32_valtype]))
+    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([$valtype_reftype(rt)], [I32_valtype]))
 
   ;; 3-typing.watsup:268.1-270.23
   rule local.get {C : context, t : valtype, x : idx}:
@@ -5546,13 +5530,13 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:290.1-292.28
   rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [(rt <: valtype)]))
+    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [$valtype_reftype(rt)]))
     -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:294.1-296.28
   rule table.set {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype (rt <: valtype)], []))
+    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype $valtype_reftype(rt)], []))
     -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
@@ -5564,13 +5548,13 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:302.1-304.28
   rule table.grow {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([(rt <: valtype) I32_valtype], [I32_valtype]))
+    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([$valtype_reftype(rt) I32_valtype], [I32_valtype]))
     -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:306.1-308.28
   rule table.fill {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype (rt <: valtype) I32_valtype], []))
+    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype $valtype_reftype(rt) I32_valtype], []))
     -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
@@ -5636,24 +5620,24 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:350.1-355.32
   rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?}:
-    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
+    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [$valtype_numtype(nt)]))
     -- if (0 < |C.MEM_context|)
-    -- if ($size(nt <: valtype) =/= ?())
+    -- if ($size($valtype_numtype(nt)) =/= ?())
     -- if ((n?{n} = ?()) <=> (sx?{sx} = ?()))
     -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= (!($size(nt <: valtype)) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size(nt <: valtype)) / 8))))?{n}
-    -- if ((n?{n} = ?()) \/ (nt = (in <: numtype)))
+    -- if ((2 ^ n_A) <= (!($size($valtype_numtype(nt))) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size($valtype_numtype(nt))) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
 
   ;; 3-typing.watsup:357.1-362.32
   rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype}:
-    `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype (nt <: valtype)], []))
+    `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype $valtype_numtype(nt)], []))
     -- if (0 < |C.MEM_context|)
-    -- if ($size(nt <: valtype) =/= ?())
+    -- if ($size($valtype_numtype(nt)) =/= ?())
     -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= (!($size(nt <: valtype)) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size(nt <: valtype)) / 8))))?{n}
-    -- if ((n?{n} = ?()) \/ (nt = (in <: numtype)))
+    -- if ((2 ^ n_A) <= (!($size($valtype_numtype(nt))) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size($valtype_numtype(nt))) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
 
 ;; 3-typing.watsup:124.1-124.67
 relation InstrSeq_ok: `%|-%*:%`(context, instr*, functype)
@@ -5772,7 +5756,7 @@ relation Elem_ok: `%|-%:%`(context, elem, reftype)
   ;; 3-typing.watsup:428.1-431.40
   rule _ {C : context, elemmode? : elemmode?, expr* : expr*, rt : reftype}:
     `%|-%:%`(C, `ELEM%%*%?`(rt, expr*{expr}, elemmode?{elemmode}), rt)
-    -- (Expr_ok: `%|-%:%`(C, expr, [(rt <: valtype)]))*{expr}
+    -- (Expr_ok: `%|-%:%`(C, expr, [$valtype_reftype(rt)]))*{expr}
     -- (Elemmode_ok: `%|-%:%`(C, elemmode, rt))?{elemmode}
 
 ;; 3-typing.watsup:404.1-404.77
@@ -5905,20 +5889,6 @@ syntax val =
   | REF.FUNC_ADDR(funcaddr)
   | REF.HOST_ADDR(hostaddr)
 
-;;
-def val_num : num -> val
-  ;;
-  def {x : (numtype, c_numtype)} val_num(CONST_num(x)) = CONST_val(x)
-
-;;
-def val_ref : ref -> val
-  ;;
-  def {x : reftype} val_ref(REF.NULL_ref(x)) = REF.NULL_val(x)
-  ;;
-  def {x : funcaddr} val_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_val(x)
-  ;;
-  def {x : hostaddr} val_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_val(x)
-
 ;; 4-runtime.watsup:31.1-32.18
 syntax result =
   | _VALS(val*)
@@ -6038,6 +6008,17 @@ syntax admininstr =
   | TRAP
 }
 
+;;
+def admininstr_globalinst : globalinst -> admininstr
+  ;;
+  def {x : (numtype, c_numtype)} admininstr_globalinst(CONST_val(x)) = CONST_admininstr(x)
+  ;;
+  def {x : reftype} admininstr_globalinst(REF.NULL_val(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcaddr} admininstr_globalinst(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
+  ;;
+  def {x : hostaddr} admininstr_globalinst(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
+
 ;;
 def admininstr_instr : instr -> admininstr
   ;;
@@ -6129,17 +6110,6 @@ def admininstr_instr : instr -> admininstr
   ;;
   def {x : (numtype, n?, nat, nat)} admininstr_instr(STORE_instr(x)) = STORE_admininstr(x)
 
-;;
-def admininstr_val : val -> admininstr
-  ;;
-  def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
-  ;;
-  def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
-  ;;
-  def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
-  def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
-
 ;;
 def admininstr_ref : ref -> admininstr
   ;;
@@ -6150,9 +6120,15 @@ def admininstr_ref : ref -> admininstr
   def {x : hostaddr} admininstr_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_admininstr(x)
 
 ;;
-def admininstr_globalinst : globalinst -> admininstr
+def admininstr_val : val -> admininstr
   ;;
-  def {x : globalinst} admininstr_globalinst(x) = $admininstr_val(x)
+  def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
+  ;;
+  def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
+  ;;
+  def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
 
 ;; 4-runtime.watsup:84.1-84.62
 syntax config = `%;%*`(state, admininstr*)
@@ -6267,21 +6243,21 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:22.1-23.24
   rule drop {val : val}:
-    `%*~>%*`([(val <: admininstr) DROP_admininstr], [])
+    `%*~>%*`([$admininstr_val(val) DROP_admininstr], [])
 
   ;; 6-reduction.watsup:26.1-28.16
   rule select-true {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
-    `%*~>%*`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [(val_1 <: admininstr)])
+    `%*~>%*`([$admininstr_val(val_1) $admininstr_val(val_2) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [$admininstr_val(val_1)])
     -- if (c =/= 0)
 
   ;; 6-reduction.watsup:30.1-32.14
   rule select-false {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
-    `%*~>%*`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [(val_2 <: admininstr)])
+    `%*~>%*`([$admininstr_val(val_1) $admininstr_val(val_2) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [$admininstr_val(val_2)])
     -- if (c = 0)
 
   ;; 6-reduction.watsup:35.1-37.28
   rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
-    `%*~>%*`((val <: admininstr)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    `%*~>%*`($admininstr_val(val)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], $admininstr_val(val)^k{val} :: $admininstr_instr(instr)*{instr})])
     -- if (|t_1^k{t_1}| = k)
     -- if (|t_2^n{t_2}| = n)
     -- if (|val^k{val}| = k)
@@ -6289,7 +6265,7 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:39.1-41.28
   rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
-    `%*~>%*`((val <: admininstr)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [LOOP_instr(bt, instr*{instr})], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    `%*~>%*`($admininstr_val(val)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [LOOP_instr(bt, instr*{instr})], $admininstr_val(val)^k{val} :: $admininstr_instr(instr)*{instr})])
     -- if (|t_1^k{t_1}| = k)
     -- if (|t_2^n{t_2}| = n)
     -- if (|val^k{val}| = k)
@@ -6307,16 +6283,16 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:52.1-53.38
   rule label-vals {instr* : instr*, n : n, val* : val*}:
-    `%*~>%*`([LABEL__admininstr(n, instr*{instr}, (val <: admininstr)*{val})], (val <: admininstr)*{val})
+    `%*~>%*`([LABEL__admininstr(n, instr*{instr}, $admininstr_val(val)*{val})], $admininstr_val(val)*{val})
 
   ;; 6-reduction.watsup:57.1-58.69
   rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
-    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [BR_admininstr(0)] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val} :: (instr' <: admininstr)*{instr'})
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, $admininstr_val(val')*{val'} :: $admininstr_val(val)^n{val} :: [BR_admininstr(0)] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)^n{val} :: $admininstr_instr(instr')*{instr'})
     -- if (|val^n{val}| = n)
 
   ;; 6-reduction.watsup:60.1-61.65
   rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
-    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val <: admininstr)*{val} :: [BR_admininstr(l + 1)] :: (instr <: admininstr)*{instr})], (val <: admininstr)*{val} :: [BR_admininstr(l)])
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, $admininstr_val(val)*{val} :: [BR_admininstr(l + 1)] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)*{val} :: [BR_admininstr(l)])
 
   ;; 6-reduction.watsup:64.1-66.16
   rule br_if-true {c : c_numtype, l : labelidx}:
@@ -6340,17 +6316,17 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:100.1-101.35
   rule frame-vals {f : frame, n : n, val^n : val^n}:
-    `%*~>%*`([FRAME__admininstr(n, f, (val <: admininstr)^n{val})], (val <: admininstr)^n{val})
+    `%*~>%*`([FRAME__admininstr(n, f, $admininstr_val(val)^n{val})], $admininstr_val(val)^n{val})
     -- if (|val^n{val}| = n)
 
   ;; 6-reduction.watsup:103.1-104.55
   rule return-frame {f : frame, instr* : instr*, n : n, val^n : val^n, val'* : val*}:
-    `%*~>%*`([FRAME__admininstr(n, f, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val})
+    `%*~>%*`([FRAME__admininstr(n, f, $admininstr_val(val')*{val'} :: $admininstr_val(val)^n{val} :: [RETURN_admininstr] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)^n{val})
     -- if (|val^n{val}| = n)
 
   ;; 6-reduction.watsup:106.1-107.60
   rule return-label {instr* : instr*, instr'* : instr*, k : nat, val* : val*}:
-    `%*~>%*`([LABEL__admininstr(k, instr'*{instr'}, (val <: admininstr)*{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)*{val} :: [RETURN_admininstr])
+    `%*~>%*`([LABEL__admininstr(k, instr'*{instr'}, $admininstr_val(val)*{val} :: [RETURN_admininstr] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)*{val} :: [RETURN_admininstr])
 
   ;; 6-reduction.watsup:110.1-112.33
   rule unop-val {c : c_numtype, c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
@@ -6384,8 +6360,8 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:137.1-138.70
   rule extend {c : c_numtype, n : n, nt : numtype}:
-    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, !($size(nt <: valtype)), S_sx, c))])
-    -- if ($size(nt <: valtype) =/= ?())
+    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, !($size($valtype_numtype(nt))), S_sx, c))])
+    -- if ($size($valtype_numtype(nt)) =/= ?())
 
   ;; 6-reduction.watsup:141.1-143.48
   rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
@@ -6399,17 +6375,17 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:154.1-156.28
   rule ref.is_null-true {rt : reftype, val : val}:
-    `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
+    `%*~>%*`([$admininstr_val(val) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
     -- if (val = REF.NULL_val(rt))
 
   ;; 6-reduction.watsup:158.1-160.15
   rule ref.is_null-false {val : val}:
-    `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
+    `%*~>%*`([$admininstr_val(val) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
     -- otherwise
 
   ;; 6-reduction.watsup:169.1-170.47
   rule local.tee {val : val, x : idx}:
-    `%*~>%*`([(val <: admininstr) LOCAL.TEE_admininstr(x)], [(val <: admininstr) (val <: admininstr) LOCAL.SET_admininstr(x)])
+    `%*~>%*`([$admininstr_val(val) LOCAL.TEE_admininstr(x)], [$admininstr_val(val) $admininstr_val(val) LOCAL.SET_admininstr(x)])
 
 ;; 6-reduction.watsup:5.1-5.63
 relation Step_read: `%~>%*`(config, admininstr*)
@@ -6433,7 +6409,7 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:94.1-97.52
   rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
-    `%~>%*`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], (instr <: admininstr)*{instr})])])
+    `%~>%*`(`%;%*`(z, $admininstr_val(val)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], $admininstr_instr(instr)*{instr})])])
     -- if (a < |$funcinst(z)|)
     -- if (|t_1^k{t_1}| = k)
     -- if (|t_2^n{t_2}| = n)
@@ -6449,11 +6425,11 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:163.1-164.37
   rule local.get {x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [LOCAL.GET_admininstr(x)]), [($local(z, x) <: admininstr)])
+    `%~>%*`(`%;%*`(z, [LOCAL.GET_admininstr(x)]), [$admininstr_val($local(z, x))])
 
   ;; 6-reduction.watsup:173.1-174.39
   rule global.get {x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]), [($global(z, x) <: admininstr)])
+    `%~>%*`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]), [$admininstr_globalinst($global(z, x))])
 
   ;; 6-reduction.watsup:180.1-182.28
   rule table.get-trap {i : nat, x : idx, z : state}:
@@ -6462,12 +6438,12 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:184.1-186.27
   rule table.get-val {i : nat, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [($table(z, x)[i] <: admininstr)])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [$admininstr_ref($table(z, x)[i])])
     -- if (i < |$table(z, x)|)
 
   ;; 6-reduction.watsup:188.1-190.28
   rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_ref(ref) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
     -- if (i >= |$table(z, x)|)
 
   ;; 6-reduction.watsup:197.1-199.27
@@ -6481,18 +6457,18 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:209.1-211.34
   rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
     -- if ((i + n) > |$table(z, x)|)
 
   ;; 6-reduction.watsup:213.1-216.14
   rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
     -- otherwise
     -- if (n = 0)
 
   ;; 6-reduction.watsup:218.1-222.15
   rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) (val <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) (val <: admininstr) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) $admininstr_val(val) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) $admininstr_val(val) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
     -- otherwise
 
   ;; 6-reduction.watsup:225.1-227.63
@@ -6530,7 +6506,7 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:257.1-261.15
   rule table.init-succ {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) ($elem(z, y)[i] <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) $admininstr_ref($elem(z, y)[i]) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
     -- if (i < |$elem(z, y)|)
     -- otherwise
 
@@ -6538,30 +6514,30 @@ relation Step_read: `%~>%*`(config, admininstr*)
 relation Step: `%~>%`(config, config)
   ;; 6-reduction.watsup:7.1-9.34
   rule pure {instr* : instr*, instr'* : instr*, z : state}:
-    `%~>%`(`%;%*`(z, (instr <: admininstr)*{instr}), `%;%*`(z, (instr' <: admininstr)*{instr'}))
-    -- Step_pure: `%*~>%*`((instr <: admininstr)*{instr}, (instr' <: admininstr)*{instr'})
+    `%~>%`(`%;%*`(z, $admininstr_instr(instr)*{instr}), `%;%*`(z, $admininstr_instr(instr')*{instr'}))
+    -- Step_pure: `%*~>%*`($admininstr_instr(instr)*{instr}, $admininstr_instr(instr')*{instr'})
 
   ;; 6-reduction.watsup:11.1-13.37
   rule read {instr* : instr*, instr'* : instr*, z : state}:
-    `%~>%`(`%;%*`(z, (instr <: admininstr)*{instr}), `%;%*`(z, (instr' <: admininstr)*{instr'}))
-    -- Step_read: `%~>%*`(`%;%*`(z, (instr <: admininstr)*{instr}), (instr' <: admininstr)*{instr'})
+    `%~>%`(`%;%*`(z, $admininstr_instr(instr)*{instr}), `%;%*`(z, $admininstr_instr(instr')*{instr'}))
+    -- Step_read: `%~>%*`(`%;%*`(z, $admininstr_instr(instr)*{instr}), $admininstr_instr(instr')*{instr'})
 
   ;; 6-reduction.watsup:166.1-167.60
   rule local.set {val : val, x : idx, z : state}:
-    `%~>%`(`%;%*`(z, [(val <: admininstr) LOCAL.SET_admininstr(x)]), `%;%*`($with_local(z, x, val), []))
+    `%~>%`(`%;%*`(z, [$admininstr_val(val) LOCAL.SET_admininstr(x)]), `%;%*`($with_local(z, x, val), []))
 
   ;; 6-reduction.watsup:176.1-177.62
   rule global.set {val : val, x : idx, z : state}:
-    `%~>%`(`%;%*`(z, [(val <: admininstr) GLOBAL.SET_admininstr(x)]), `%;%*`($with_global(z, x, val), []))
+    `%~>%`(`%;%*`(z, [$admininstr_val(val) GLOBAL.SET_admininstr(x)]), `%;%*`($with_global(z, x, val), []))
 
   ;; 6-reduction.watsup:192.1-194.27
   rule table.set-val {i : nat, ref : ref, x : idx, z : state}:
-    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), `%;%*`($with_table(z, x, i, ref), []))
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_ref(ref) TABLE.GET_admininstr(x)]), `%;%*`($with_table(z, x, i, ref), []))
     -- if (i < |$table(z, x)|)
 
   ;; 6-reduction.watsup:202.1-203.102
   rule table.grow-succeed {n : n, ref : ref, x : idx, z : state}:
-    `%~>%`(`%;%*`(z, [(ref <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), `%;%*`($with_tableext(z, x, ref^n{}), [CONST_admininstr(I32_numtype, |$table(z, x)|)]))
+    `%~>%`(`%;%*`(z, [$admininstr_ref(ref) CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), `%;%*`($with_tableext(z, x, ref^n{}), [CONST_admininstr(I32_numtype, |$table(z, x)|)]))
 
   ;; 6-reduction.watsup:264.1-265.59
   rule elem.drop {x : idx, z : state}:
@@ -6647,11 +6623,6 @@ def valtype_numtype : numtype -> valtype
   ;;
   def valtype_numtype(F64_numtype) = F64_valtype
 
-;;
-def valtype_vectype : vectype -> valtype
-  ;;
-  def valtype_vectype(V128_vectype) = V128_valtype
-
 ;;
 def valtype_reftype : reftype -> valtype
   ;;
@@ -6659,6 +6630,11 @@ def valtype_reftype : reftype -> valtype
   ;;
   def valtype_reftype(EXTERNREF_reftype) = EXTERNREF_valtype
 
+;;
+def valtype_vectype : vectype -> valtype
+  ;;
+  def valtype_vectype(V128_vectype) = V128_valtype
+
 ;; 1-syntax.watsup:48.1-48.71
 syntax in =
   | I32
@@ -7138,7 +7114,7 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
   rule select-impl {C : context, numtype : numtype, t : valtype, t' : valtype, vectype : vectype}:
     `%|-%:%`(C, SELECT_instr(?()), `%->%`([t t I32_valtype], [t]))
     -- Valtype_sub: `|-%<:%`(t, t')
-    -- if ((t' = (numtype <: valtype)) \/ (t' = (vectype <: valtype)))
+    -- if ((t' = $valtype_numtype(numtype)) \/ (t' = $valtype_vectype(vectype)))
 
   ;; 3-typing.watsup:178.1-181.57
   rule block {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
@@ -7199,54 +7175,54 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:222.1-223.37
   rule const {C : context, c_nt : c_numtype, nt : numtype}:
-    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [(nt <: valtype)]))
+    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [$valtype_numtype(nt)]))
 
   ;; 3-typing.watsup:225.1-226.31
   rule unop {C : context, nt : numtype, unop : unop_numtype}:
-    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
+    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([$valtype_numtype(nt)], [$valtype_numtype(nt)]))
 
   ;; 3-typing.watsup:228.1-229.36
   rule binop {C : context, binop : binop_numtype, nt : numtype}:
-    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([(nt <: valtype) (nt <: valtype)], [(nt <: valtype)]))
+    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([$valtype_numtype(nt) $valtype_numtype(nt)], [$valtype_numtype(nt)]))
 
   ;; 3-typing.watsup:231.1-232.36
   rule testop {C : context, nt : numtype, testop : testop_numtype}:
-    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([(nt <: valtype)], [I32_valtype]))
+    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([$valtype_numtype(nt)], [I32_valtype]))
 
   ;; 3-typing.watsup:234.1-235.37
   rule relop {C : context, nt : numtype, relop : relop_numtype}:
-    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([(nt <: valtype) (nt <: valtype)], [I32_valtype]))
+    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([$valtype_numtype(nt) $valtype_numtype(nt)], [I32_valtype]))
 
   ;; 3-typing.watsup:238.1-240.23
   rule extend {C : context, n : n, nt : numtype}:
-    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([(nt <: valtype)], [(nt <: valtype)]))
-    -- if ($size(nt <: valtype) =/= ?())
-    -- if (n <= !($size(nt <: valtype)))
+    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([$valtype_numtype(nt)], [$valtype_numtype(nt)]))
+    -- if ($size($valtype_numtype(nt)) =/= ?())
+    -- if (n <= !($size($valtype_numtype(nt))))
 
   ;; 3-typing.watsup:242.1-245.34
   rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype}:
-    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([(nt_2 <: valtype)], [(nt_1 <: valtype)]))
-    -- if ($size(nt_1 <: valtype) =/= ?())
-    -- if ($size(nt_2 <: valtype) =/= ?())
+    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([$valtype_numtype(nt_2)], [$valtype_numtype(nt_1)]))
+    -- if ($size($valtype_numtype(nt_1)) =/= ?())
+    -- if ($size($valtype_numtype(nt_2)) =/= ?())
     -- if (nt_1 =/= nt_2)
-    -- if (!($size(nt_1 <: valtype)) = !($size(nt_2 <: valtype)))
+    -- if (!($size($valtype_numtype(nt_1))) = !($size($valtype_numtype(nt_2))))
 
   ;; 3-typing.watsup:247.1-250.52
   rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?}:
-    `%|-%:%`(C, CVTOP_instr((in_1 <: numtype), CONVERT_cvtop, (in_2 <: numtype), sx?{sx}), `%->%`([(in_2 <: valtype)], [(in_1 <: valtype)]))
-    -- if ($size(in_1 <: valtype) =/= ?())
-    -- if ($size(in_2 <: valtype) =/= ?())
+    `%|-%:%`(C, CVTOP_instr($numtype_in(in_1), CONVERT_cvtop, $numtype_in(in_2), sx?{sx}), `%->%`([$valtype_in(in_2)], [$valtype_in(in_1)]))
+    -- if ($size($valtype_in(in_1)) =/= ?())
+    -- if ($size($valtype_in(in_2)) =/= ?())
     -- if (in_1 =/= in_2)
-    -- if ((sx?{sx} = ?()) <=> (!($size(in_1 <: valtype)) > !($size(in_2 <: valtype))))
+    -- if ((sx?{sx} = ?()) <=> (!($size($valtype_in(in_1))) > !($size($valtype_in(in_2)))))
 
   ;; 3-typing.watsup:252.1-254.22
   rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
-    `%|-%:%`(C, CVTOP_instr((fn_1 <: numtype), CONVERT_cvtop, (fn_2 <: numtype), ?()), `%->%`([(fn_2 <: valtype)], [(fn_1 <: valtype)]))
+    `%|-%:%`(C, CVTOP_instr($numtype_fn(fn_1), CONVERT_cvtop, $numtype_fn(fn_2), ?()), `%->%`([$valtype_fn(fn_2)], [$valtype_fn(fn_1)]))
     -- if (fn_1 =/= fn_2)
 
   ;; 3-typing.watsup:257.1-258.35
   rule ref.null {C : context, rt : reftype}:
-    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [(rt <: valtype)]))
+    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [$valtype_reftype(rt)]))
 
   ;; 3-typing.watsup:260.1-262.23
   rule ref.func {C : context, ft : functype, x : idx}:
@@ -7256,7 +7232,7 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:264.1-265.31
   rule ref.is_null {C : context, rt : reftype}:
-    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([(rt <: valtype)], [I32_valtype]))
+    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([$valtype_reftype(rt)], [I32_valtype]))
 
   ;; 3-typing.watsup:268.1-270.23
   rule local.get {C : context, t : valtype, x : idx}:
@@ -7290,13 +7266,13 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:290.1-292.28
   rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [(rt <: valtype)]))
+    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [$valtype_reftype(rt)]))
     -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:294.1-296.28
   rule table.set {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype (rt <: valtype)], []))
+    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype $valtype_reftype(rt)], []))
     -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
@@ -7308,13 +7284,13 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:302.1-304.28
   rule table.grow {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([(rt <: valtype) I32_valtype], [I32_valtype]))
+    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([$valtype_reftype(rt) I32_valtype], [I32_valtype]))
     -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:306.1-308.28
   rule table.fill {C : context, lim : limits, rt : reftype, x : idx}:
-    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype (rt <: valtype) I32_valtype], []))
+    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype $valtype_reftype(rt) I32_valtype], []))
     -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
@@ -7380,24 +7356,24 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
 
   ;; 3-typing.watsup:350.1-355.32
   rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?}:
-    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [(nt <: valtype)]))
+    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [$valtype_numtype(nt)]))
     -- if (0 < |C.MEM_context|)
-    -- if ($size(nt <: valtype) =/= ?())
+    -- if ($size($valtype_numtype(nt)) =/= ?())
     -- if ((n?{n} = ?()) <=> (sx?{sx} = ?()))
     -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= (!($size(nt <: valtype)) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size(nt <: valtype)) / 8))))?{n}
-    -- if ((n?{n} = ?()) \/ (nt = (in <: numtype)))
+    -- if ((2 ^ n_A) <= (!($size($valtype_numtype(nt))) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size($valtype_numtype(nt))) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
 
   ;; 3-typing.watsup:357.1-362.32
   rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype}:
-    `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype (nt <: valtype)], []))
+    `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype $valtype_numtype(nt)], []))
     -- if (0 < |C.MEM_context|)
-    -- if ($size(nt <: valtype) =/= ?())
+    -- if ($size($valtype_numtype(nt)) =/= ?())
     -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= (!($size(nt <: valtype)) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size(nt <: valtype)) / 8))))?{n}
-    -- if ((n?{n} = ?()) \/ (nt = (in <: numtype)))
+    -- if ((2 ^ n_A) <= (!($size($valtype_numtype(nt))) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size($valtype_numtype(nt))) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
 
 ;; 3-typing.watsup:124.1-124.67
 relation InstrSeq_ok: `%|-%*:%`(context, instr*, functype)
@@ -7516,7 +7492,7 @@ relation Elem_ok: `%|-%:%`(context, elem, reftype)
   ;; 3-typing.watsup:428.1-431.40
   rule _ {C : context, elemmode? : elemmode?, expr* : expr*, rt : reftype}:
     `%|-%:%`(C, `ELEM%%*%?`(rt, expr*{expr}, elemmode?{elemmode}), rt)
-    -- (Expr_ok: `%|-%:%`(C, expr, [(rt <: valtype)]))*{expr}
+    -- (Expr_ok: `%|-%:%`(C, expr, [$valtype_reftype(rt)]))*{expr}
     -- (Elemmode_ok: `%|-%:%`(C, elemmode, rt))?{elemmode}
 
 ;; 3-typing.watsup:404.1-404.77
@@ -7649,20 +7625,6 @@ syntax val =
   | REF.FUNC_ADDR(funcaddr)
   | REF.HOST_ADDR(hostaddr)
 
-;;
-def val_num : num -> val
-  ;;
-  def {x : (numtype, c_numtype)} val_num(CONST_num(x)) = CONST_val(x)
-
-;;
-def val_ref : ref -> val
-  ;;
-  def {x : reftype} val_ref(REF.NULL_ref(x)) = REF.NULL_val(x)
-  ;;
-  def {x : funcaddr} val_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_val(x)
-  ;;
-  def {x : hostaddr} val_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_val(x)
-
 ;; 4-runtime.watsup:31.1-32.18
 syntax result =
   | _VALS(val*)
@@ -7782,6 +7744,17 @@ syntax admininstr =
   | TRAP
 }
 
+;;
+def admininstr_globalinst : globalinst -> admininstr
+  ;;
+  def {x : (numtype, c_numtype)} admininstr_globalinst(CONST_val(x)) = CONST_admininstr(x)
+  ;;
+  def {x : reftype} admininstr_globalinst(REF.NULL_val(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcaddr} admininstr_globalinst(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
+  ;;
+  def {x : hostaddr} admininstr_globalinst(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
+
 ;;
 def admininstr_instr : instr -> admininstr
   ;;
@@ -7873,17 +7846,6 @@ def admininstr_instr : instr -> admininstr
   ;;
   def {x : (numtype, n?, nat, nat)} admininstr_instr(STORE_instr(x)) = STORE_admininstr(x)
 
-;;
-def admininstr_val : val -> admininstr
-  ;;
-  def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
-  ;;
-  def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
-  ;;
-  def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
-  def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
-
 ;;
 def admininstr_ref : ref -> admininstr
   ;;
@@ -7894,9 +7856,15 @@ def admininstr_ref : ref -> admininstr
   def {x : hostaddr} admininstr_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_admininstr(x)
 
 ;;
-def admininstr_globalinst : globalinst -> admininstr
+def admininstr_val : val -> admininstr
+  ;;
+  def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
   ;;
-  def {x : globalinst} admininstr_globalinst(x) = $admininstr_val(x)
+  def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
+  ;;
+  def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
+  ;;
+  def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
 
 ;; 4-runtime.watsup:84.1-84.62
 syntax config = `%;%*`(state, admininstr*)
@@ -8003,7 +7971,7 @@ def cvtop : (numtype, cvtop, numtype, sx?, c_numtype) -> c_numtype*
 relation Step_pure_before_ref.is_null-false: `%`(admininstr*)
   ;; 6-reduction.watsup:154.1-156.28
   rule ref.is_null-true {rt : reftype, val : val}:
-    `%`([(val <: admininstr) REF.IS_NULL_admininstr])
+    `%`([$admininstr_val(val) REF.IS_NULL_admininstr])
     -- if (val = REF.NULL_val(rt))
 
 ;; 6-reduction.watsup:4.1-4.63
@@ -8018,21 +7986,21 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:22.1-23.24
   rule drop {val : val}:
-    `%*~>%*`([(val <: admininstr) DROP_admininstr], [])
+    `%*~>%*`([$admininstr_val(val) DROP_admininstr], [])
 
   ;; 6-reduction.watsup:26.1-28.16
   rule select-true {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
-    `%*~>%*`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [(val_1 <: admininstr)])
+    `%*~>%*`([$admininstr_val(val_1) $admininstr_val(val_2) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [$admininstr_val(val_1)])
     -- if (c =/= 0)
 
   ;; 6-reduction.watsup:30.1-32.14
   rule select-false {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
-    `%*~>%*`([(val_1 <: admininstr) (val_2 <: admininstr) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [(val_2 <: admininstr)])
+    `%*~>%*`([$admininstr_val(val_1) $admininstr_val(val_2) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [$admininstr_val(val_2)])
     -- if (c = 0)
 
   ;; 6-reduction.watsup:35.1-37.28
   rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
-    `%*~>%*`((val <: admininstr)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    `%*~>%*`($admininstr_val(val)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], $admininstr_val(val)^k{val} :: $admininstr_instr(instr)*{instr})])
     -- if (|t_1^k{t_1}| = k)
     -- if (|t_2^n{t_2}| = n)
     -- if (|val^k{val}| = k)
@@ -8040,7 +8008,7 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:39.1-41.28
   rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
-    `%*~>%*`((val <: admininstr)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [LOOP_instr(bt, instr*{instr})], (val <: admininstr)^k{val} :: (instr <: admininstr)*{instr})])
+    `%*~>%*`($admininstr_val(val)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [LOOP_instr(bt, instr*{instr})], $admininstr_val(val)^k{val} :: $admininstr_instr(instr)*{instr})])
     -- if (|t_1^k{t_1}| = k)
     -- if (|t_2^n{t_2}| = n)
     -- if (|val^k{val}| = k)
@@ -8058,16 +8026,16 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:52.1-53.38
   rule label-vals {instr* : instr*, n : n, val* : val*}:
-    `%*~>%*`([LABEL__admininstr(n, instr*{instr}, (val <: admininstr)*{val})], (val <: admininstr)*{val})
+    `%*~>%*`([LABEL__admininstr(n, instr*{instr}, $admininstr_val(val)*{val})], $admininstr_val(val)*{val})
 
   ;; 6-reduction.watsup:57.1-58.69
   rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
-    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [BR_admininstr(0)] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val} :: (instr' <: admininstr)*{instr'})
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, $admininstr_val(val')*{val'} :: $admininstr_val(val)^n{val} :: [BR_admininstr(0)] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)^n{val} :: $admininstr_instr(instr')*{instr'})
     -- if (|val^n{val}| = n)
 
   ;; 6-reduction.watsup:60.1-61.65
   rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
-    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, (val <: admininstr)*{val} :: [BR_admininstr(l + 1)] :: (instr <: admininstr)*{instr})], (val <: admininstr)*{val} :: [BR_admininstr(l)])
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, $admininstr_val(val)*{val} :: [BR_admininstr(l + 1)] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)*{val} :: [BR_admininstr(l)])
 
   ;; 6-reduction.watsup:64.1-66.16
   rule br_if-true {c : c_numtype, l : labelidx}:
@@ -8091,17 +8059,17 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:100.1-101.35
   rule frame-vals {f : frame, n : n, val^n : val^n}:
-    `%*~>%*`([FRAME__admininstr(n, f, (val <: admininstr)^n{val})], (val <: admininstr)^n{val})
+    `%*~>%*`([FRAME__admininstr(n, f, $admininstr_val(val)^n{val})], $admininstr_val(val)^n{val})
     -- if (|val^n{val}| = n)
 
   ;; 6-reduction.watsup:103.1-104.55
   rule return-frame {f : frame, instr* : instr*, n : n, val^n : val^n, val'* : val*}:
-    `%*~>%*`([FRAME__admininstr(n, f, (val' <: admininstr)*{val'} :: (val <: admininstr)^n{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)^n{val})
+    `%*~>%*`([FRAME__admininstr(n, f, $admininstr_val(val')*{val'} :: $admininstr_val(val)^n{val} :: [RETURN_admininstr] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)^n{val})
     -- if (|val^n{val}| = n)
 
   ;; 6-reduction.watsup:106.1-107.60
   rule return-label {instr* : instr*, instr'* : instr*, k : nat, val* : val*}:
-    `%*~>%*`([LABEL__admininstr(k, instr'*{instr'}, (val <: admininstr)*{val} :: [RETURN_admininstr] :: (instr <: admininstr)*{instr})], (val <: admininstr)*{val} :: [RETURN_admininstr])
+    `%*~>%*`([LABEL__admininstr(k, instr'*{instr'}, $admininstr_val(val)*{val} :: [RETURN_admininstr] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)*{val} :: [RETURN_admininstr])
 
   ;; 6-reduction.watsup:110.1-112.33
   rule unop-val {c : c_numtype, c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
@@ -8135,8 +8103,8 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:137.1-138.70
   rule extend {c : c_numtype, n : n, nt : numtype}:
-    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, !($size(nt <: valtype)), S_sx, c))])
-    -- if ($size(nt <: valtype) =/= ?())
+    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, !($size($valtype_numtype(nt))), S_sx, c))])
+    -- if ($size($valtype_numtype(nt)) =/= ?())
 
   ;; 6-reduction.watsup:141.1-143.48
   rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
@@ -8150,17 +8118,17 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
 
   ;; 6-reduction.watsup:154.1-156.28
   rule ref.is_null-true {rt : reftype, val : val}:
-    `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
+    `%*~>%*`([$admininstr_val(val) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
     -- if (val = REF.NULL_val(rt))
 
   ;; 6-reduction.watsup:158.1-160.15
   rule ref.is_null-false {val : val}:
-    `%*~>%*`([(val <: admininstr) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
-    -- unless Step_pure_before_ref.is_null-false: `%`([(val <: admininstr) REF.IS_NULL_admininstr])
+    `%*~>%*`([$admininstr_val(val) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
+    -- unless Step_pure_before_ref.is_null-false: `%`([$admininstr_val(val) REF.IS_NULL_admininstr])
 
   ;; 6-reduction.watsup:169.1-170.47
   rule local.tee {val : val, x : idx}:
-    `%*~>%*`([(val <: admininstr) LOCAL.TEE_admininstr(x)], [(val <: admininstr) (val <: admininstr) LOCAL.SET_admininstr(x)])
+    `%*~>%*`([$admininstr_val(val) LOCAL.TEE_admininstr(x)], [$admininstr_val(val) $admininstr_val(val) LOCAL.SET_admininstr(x)])
 
 ;; 6-reduction.watsup:90.1-92.15
 relation Step_read_before_call_indirect-trap: `%`(config)
@@ -8176,20 +8144,20 @@ relation Step_read_before_call_indirect-trap: `%`(config)
 relation Step_read_before_table.fill-zero: `%`(config)
   ;; 6-reduction.watsup:209.1-211.34
   rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
     -- if ((i + n) > |$table(z, x)|)
 
 ;; 6-reduction.watsup:218.1-222.15
 relation Step_read_before_table.fill-succ: `%`(config)
   ;; 6-reduction.watsup:213.1-216.14
   rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
-    -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
     -- if (n = 0)
 
   ;; 6-reduction.watsup:209.1-211.34
   rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
-    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
     -- if ((i + n) > |$table(z, x)|)
 
 ;; 6-reduction.watsup:229.1-232.14
@@ -8273,7 +8241,7 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:94.1-97.52
   rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
-    `%~>%*`(`%;%*`(z, (val <: admininstr)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], (instr <: admininstr)*{instr})])])
+    `%~>%*`(`%;%*`(z, $admininstr_val(val)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], $admininstr_instr(instr)*{instr})])])
     -- if (a < |$funcinst(z)|)
     -- if (|t_1^k{t_1}| = k)
     -- if (|t_2^n{t_2}| = n)
@@ -8289,11 +8257,11 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:163.1-164.37
   rule local.get {x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [LOCAL.GET_admininstr(x)]), [($local(z, x) <: admininstr)])
+    `%~>%*`(`%;%*`(z, [LOCAL.GET_admininstr(x)]), [$admininstr_val($local(z, x))])
 
   ;; 6-reduction.watsup:173.1-174.39
   rule global.get {x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]), [($global(z, x) <: admininstr)])
+    `%~>%*`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]), [$admininstr_globalinst($global(z, x))])
 
   ;; 6-reduction.watsup:180.1-182.28
   rule table.get-trap {i : nat, x : idx, z : state}:
@@ -8302,12 +8270,12 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:184.1-186.27
   rule table.get-val {i : nat, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [($table(z, x)[i] <: admininstr)])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [$admininstr_ref($table(z, x)[i])])
     -- if (i < |$table(z, x)|)
 
   ;; 6-reduction.watsup:188.1-190.28
   rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_ref(ref) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
     -- if (i >= |$table(z, x)|)
 
   ;; 6-reduction.watsup:197.1-199.27
@@ -8321,19 +8289,19 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:209.1-211.34
   rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
     -- if ((i + n) > |$table(z, x)|)
 
   ;; 6-reduction.watsup:213.1-216.14
   rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
-    -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
+    -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
     -- if (n = 0)
 
   ;; 6-reduction.watsup:218.1-222.15
   rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) (val <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) (val <: admininstr) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
-    -- unless Step_read_before_table.fill-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (val <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) $admininstr_val(val) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) $admininstr_val(val) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
+    -- unless Step_read_before_table.fill-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
 
   ;; 6-reduction.watsup:225.1-227.63
   rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
@@ -8370,7 +8338,7 @@ relation Step_read: `%~>%*`(config, admininstr*)
 
   ;; 6-reduction.watsup:257.1-261.15
   rule table.init-succ {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) ($elem(z, y)[i] <: admininstr) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) $admininstr_ref($elem(z, y)[i]) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
     -- if (i < |$elem(z, y)|)
     -- unless Step_read_before_table.init-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
 
@@ -8378,30 +8346,30 @@ relation Step_read: `%~>%*`(config, admininstr*)
 relation Step: `%~>%`(config, config)
   ;; 6-reduction.watsup:7.1-9.34
   rule pure {instr* : instr*, instr'* : instr*, z : state}:
-    `%~>%`(`%;%*`(z, (instr <: admininstr)*{instr}), `%;%*`(z, (instr' <: admininstr)*{instr'}))
-    -- Step_pure: `%*~>%*`((instr <: admininstr)*{instr}, (instr' <: admininstr)*{instr'})
+    `%~>%`(`%;%*`(z, $admininstr_instr(instr)*{instr}), `%;%*`(z, $admininstr_instr(instr')*{instr'}))
+    -- Step_pure: `%*~>%*`($admininstr_instr(instr)*{instr}, $admininstr_instr(instr')*{instr'})
 
   ;; 6-reduction.watsup:11.1-13.37
   rule read {instr* : instr*, instr'* : instr*, z : state}:
-    `%~>%`(`%;%*`(z, (instr <: admininstr)*{instr}), `%;%*`(z, (instr' <: admininstr)*{instr'}))
-    -- Step_read: `%~>%*`(`%;%*`(z, (instr <: admininstr)*{instr}), (instr' <: admininstr)*{instr'})
+    `%~>%`(`%;%*`(z, $admininstr_instr(instr)*{instr}), `%;%*`(z, $admininstr_instr(instr')*{instr'}))
+    -- Step_read: `%~>%*`(`%;%*`(z, $admininstr_instr(instr)*{instr}), $admininstr_instr(instr')*{instr'})
 
   ;; 6-reduction.watsup:166.1-167.60
   rule local.set {val : val, x : idx, z : state}:
-    `%~>%`(`%;%*`(z, [(val <: admininstr) LOCAL.SET_admininstr(x)]), `%;%*`($with_local(z, x, val), []))
+    `%~>%`(`%;%*`(z, [$admininstr_val(val) LOCAL.SET_admininstr(x)]), `%;%*`($with_local(z, x, val), []))
 
   ;; 6-reduction.watsup:176.1-177.62
   rule global.set {val : val, x : idx, z : state}:
-    `%~>%`(`%;%*`(z, [(val <: admininstr) GLOBAL.SET_admininstr(x)]), `%;%*`($with_global(z, x, val), []))
+    `%~>%`(`%;%*`(z, [$admininstr_val(val) GLOBAL.SET_admininstr(x)]), `%;%*`($with_global(z, x, val), []))
 
   ;; 6-reduction.watsup:192.1-194.27
   rule table.set-val {i : nat, ref : ref, x : idx, z : state}:
-    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) (ref <: admininstr) TABLE.GET_admininstr(x)]), `%;%*`($with_table(z, x, i, ref), []))
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_ref(ref) TABLE.GET_admininstr(x)]), `%;%*`($with_table(z, x, i, ref), []))
     -- if (i < |$table(z, x)|)
 
   ;; 6-reduction.watsup:202.1-203.102
   rule table.grow-succeed {n : n, ref : ref, x : idx, z : state}:
-    `%~>%`(`%;%*`(z, [(ref <: admininstr) CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), `%;%*`($with_tableext(z, x, ref^n{}), [CONST_admininstr(I32_numtype, |$table(z, x)|)]))
+    `%~>%`(`%;%*`(z, [$admininstr_ref(ref) CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), `%;%*`($with_tableext(z, x, ref^n{}), [CONST_admininstr(I32_numtype, |$table(z, x)|)]))
 
   ;; 6-reduction.watsup:264.1-265.59
   rule elem.drop {x : idx, z : state}:

From dad82c33fabbbbb9682f7c427773fab79a0b2f8d Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Tue, 11 Apr 2023 13:28:01 +0200
Subject: [PATCH 78/98] Remove hints

---
 spectec/spec/1-syntax.watsup  |  6 +++---
 spectec/spec/4-runtime.watsup |  4 ++--
 spectec/test-frontend/TEST.md |  4 ++--
 spectec/test-middlend/TEST.md | 20 ++++++++++----------
 4 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/spectec/spec/1-syntax.watsup b/spectec/spec/1-syntax.watsup
index b97113d201..81d39ddcfa 100644
--- a/spectec/spec/1-syntax.watsup
+++ b/spectec/spec/1-syntax.watsup
@@ -42,11 +42,11 @@ syntax vectype hint(desc "vector type") =
   | V128
 syntax reftype hint(desc "reference type") =
   | FUNCREF | EXTERNREF
-syntax valtype hint(desc "value type") hint(subtype numtype vectype reftype) =
+syntax valtype hint(desc "value type") =
   | numtype | vectype | reftype | BOT
 
-syntax in hint(show I#n) hint(supertype numtype valtype) = | I32 | I64
-syntax fn hint(show F#n) hint(supertype numtype valtype) = | F32 | F64
+syntax in hint(show I#n) = | I32 | I64
+syntax fn hint(show F#n) = | F32 | F64
 
 var t : valtype
 var nt : numtype
diff --git a/spectec/spec/4-runtime.watsup b/spectec/spec/4-runtime.watsup
index 4038bf1862..dcf84b3332 100644
--- a/spectec/spec/4-runtime.watsup
+++ b/spectec/spec/4-runtime.watsup
@@ -25,7 +25,7 @@ syntax num hint(desc "number") =
   | CONST numtype c_numtype
 syntax ref hint(desc "reference") =
   | REF.NULL reftype | REF.FUNC_ADDR funcaddr | REF.HOST_ADDR hostaddr
-syntax val hint(desc "value") hint(subtype num ref) =
+syntax val hint(desc "value") =
   | num | ref
 
 syntax result hint(desc "result") =
@@ -137,7 +137,7 @@ def $with_elem((s; f), x, r*) = s[.TABLE[f.MODULE.TABLE[x]] = r*]; f
 
 ;; Administrative Instructions
 
-syntax admininstr hint(show instr) hint(desc "administrative instruction") hint(subtype instr val ref) hint(subtype_alias globalinst val)=
+syntax admininstr hint(show instr) hint(desc "administrative instruction") =
   | instr
   | REF.FUNC_ADDR funcaddr         hint(show REF.FUNC %)
   | REF.HOST_ADDR hostaddr         hint(show REF.EXTERN %)
diff --git a/spectec/test-frontend/TEST.md b/spectec/test-frontend/TEST.md
index 5740c860e1..22a62b1ec8 100644
--- a/spectec/test-frontend/TEST.md
+++ b/spectec/test-frontend/TEST.md
@@ -72,12 +72,12 @@ syntax valtype =
   | EXTERNREF
   | BOT
 
-;; 1-syntax.watsup:48.1-48.71
+;; 1-syntax.watsup:48.1-48.39
 syntax in =
   | I32
   | I64
 
-;; 1-syntax.watsup:49.1-49.71
+;; 1-syntax.watsup:49.1-49.39
 syntax fn =
   | F32
   | F64
diff --git a/spectec/test-middlend/TEST.md b/spectec/test-middlend/TEST.md
index 54aa8a7e63..05570168cc 100644
--- a/spectec/test-middlend/TEST.md
+++ b/spectec/test-middlend/TEST.md
@@ -71,12 +71,12 @@ syntax valtype =
   | EXTERNREF
   | BOT
 
-;; 1-syntax.watsup:48.1-48.71
+;; 1-syntax.watsup:48.1-48.39
 syntax in =
   | I32
   | I64
 
-;; 1-syntax.watsup:49.1-49.71
+;; 1-syntax.watsup:49.1-49.39
 syntax fn =
   | F32
   | F64
@@ -1579,7 +1579,7 @@ def valtype_vectype : vectype -> valtype
   ;;
   def valtype_vectype(V128_vectype) = V128_valtype
 
-;; 1-syntax.watsup:48.1-48.71
+;; 1-syntax.watsup:48.1-48.39
 syntax in =
   | I32
   | I64
@@ -1598,7 +1598,7 @@ def valtype_in : in -> valtype
   ;;
   def valtype_in(I64_in) = I64_valtype
 
-;; 1-syntax.watsup:49.1-49.71
+;; 1-syntax.watsup:49.1-49.39
 syntax fn =
   | F32
   | F64
@@ -3237,7 +3237,7 @@ def valtype_vectype : vectype -> valtype
   ;;
   def valtype_vectype(V128_vectype) = V128_valtype
 
-;; 1-syntax.watsup:48.1-48.71
+;; 1-syntax.watsup:48.1-48.39
 syntax in =
   | I32
   | I64
@@ -3256,7 +3256,7 @@ def valtype_in : in -> valtype
   ;;
   def valtype_in(I64_in) = I64_valtype
 
-;; 1-syntax.watsup:49.1-49.71
+;; 1-syntax.watsup:49.1-49.39
 syntax fn =
   | F32
   | F64
@@ -4899,7 +4899,7 @@ def valtype_vectype : vectype -> valtype
   ;;
   def valtype_vectype(V128_vectype) = V128_valtype
 
-;; 1-syntax.watsup:48.1-48.71
+;; 1-syntax.watsup:48.1-48.39
 syntax in =
   | I32
   | I64
@@ -4918,7 +4918,7 @@ def valtype_in : in -> valtype
   ;;
   def valtype_in(I64_in) = I64_valtype
 
-;; 1-syntax.watsup:49.1-49.71
+;; 1-syntax.watsup:49.1-49.39
 syntax fn =
   | F32
   | F64
@@ -6635,7 +6635,7 @@ def valtype_vectype : vectype -> valtype
   ;;
   def valtype_vectype(V128_vectype) = V128_valtype
 
-;; 1-syntax.watsup:48.1-48.71
+;; 1-syntax.watsup:48.1-48.39
 syntax in =
   | I32
   | I64
@@ -6654,7 +6654,7 @@ def valtype_in : in -> valtype
   ;;
   def valtype_in(I64_in) = I64_valtype
 
-;; 1-syntax.watsup:49.1-49.71
+;; 1-syntax.watsup:49.1-49.39
 syntax fn =
   | F32
   | F64

From 125f5ee5c1d10546030c50a38b08f10f6db0815d Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Tue, 11 Apr 2023 21:35:26 +0200
Subject: [PATCH 79/98] Some lean4 code cleanup

---
 spectec/src/backend-lean4/gen.ml | 43 +++++++++-----------------------
 spectec/test-lean4/SpecTec.lean  |  1 -
 2 files changed, 12 insertions(+), 32 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index be3a01abb5..b187598983 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -1,5 +1,7 @@
 open Il.Ast
 
+let error at msg = Util.Source.error at "Lean4 generation" msg
+
 let include_input = false
 
 let parens s = "(" ^ s ^ ")"
@@ -20,7 +22,8 @@ let is_reserved = function
  | "local"
  | "mut"
  -> true
- | _ -> false
+ | _
+ -> false
 
 let make_id s = match s with
  | s when is_reserved s -> "«" ^ s ^ "»"
@@ -75,23 +78,6 @@ let rec render_typ (ty : typ) = match ty.it with
 
 and render_tuple_typ tys = parens (String.concat " × " (List.map render_typ tys))
 
-let _unsupported_def d =
-  "/- " ^
-  Il.Print.string_of_def d ^
-  "\n-/"
-
-let rec prepend first rest = function
-  | [] -> ""
-  | (x::xs) -> first ^ x ^ prepend rest rest xs
-
-
-let render_variant_inj (id1 : id) (id2 : id) =
-  "«$" ^ id1.it ^ "_" ^ id2.it ^ "»"
-
-let render_variant_inj' (typ1 : typ) (typ2 : typ) = match typ1.it, typ2.it with
-  | VarT id1, VarT id2 -> render_variant_inj id1 id2
-  | _, _ -> "_ {- render_variant_inj': Typs not ids -}"
-
 let render_variant_case id ((a, ty, _hints) : typcase) =
   render_con_name false id a ^ " : " ^
   if ty.it = TupT []
@@ -111,7 +97,8 @@ let rec render_exp (exp : exp) = match exp.it with
   | OptE (Some e) -> "some" $$ render_exp e
   | TheE e  -> render_exp e ^ ".get!"
   | IterE (e, (iter, vs)) -> begin match e.it with
-    | VarE v when List.length vs = 1 && List.for_all (Il.Eq.eq_id v) vs  -> render_id v (* Short-ciruit this common form *)
+    (* Short-ciruit v*; use variable directly instead of calling map *)
+    | VarE v when [v.it] = List.map (fun (v : id) -> v.it) vs -> render_id v
     | _ -> match iter, vs with
       | (List|List1|ListN _), [] ->
         "[" ^ render_exp e ^ "]"
@@ -131,7 +118,7 @@ let rec render_exp (exp : exp) = match exp.it with
   | StrE fields -> braces ( String.concat ", " (List.map (fun (a, e) ->
     render_field_name a ^ " := " ^ render_exp e
     ) fields))
-  | SubE (e, typ1, typ2) -> render_variant_inj' typ2 typ1 $$ render_exp e
+  | SubE _ -> error exp.at "SubE encountered. Did the SubE elimination pass run?"
   | DotE (_ty, e, a) -> render_dot (render_exp e) a
   | UpdE (exp1, path, exp2) ->
     render_path path (render_exp exp1) (fun _ -> render_exp exp2)
@@ -182,7 +169,6 @@ and render_case a e typ =
 
 and render_lam v e = match e.it with
   | CallE (f, {it = VarE v2;_}) when v.it = v2.it -> render_fun_id f
-  | SubE ({it = VarE v2;_}, typ1, typ2) when v.it = v2.it -> render_variant_inj' typ2 typ1
   | _ -> "(λ " ^ render_id v ^ " ↦ " ^ render_exp e ^ ")"
 
 let render_clause (_id : id) (clause : clause) = match clause.it with
@@ -213,7 +199,7 @@ let rec render_prem (prem : premise) =
         "(Forall₂ (λ " ^ render_id v1 ^ " " ^ render_id v2 ^ " ↦ " ^ render_prem prem ^ ") " ^ render_id v1 ^ ".toList " ^ render_id v2 ^ ".toList)"
       | _,_ -> render_prem prem ^ " /- " ^ Il.Print.string_of_iterexp iterexp ^ " -/"
     end
-    | ElsePr -> "False /- Else? -/"
+    | ElsePr -> error prem.at "ElsePr encountered. Did the SubE elimination pass run?"
     | NegPr prem -> "Not" $$ render_prem prem
 
 let rec render_def (d : def) =
@@ -226,21 +212,17 @@ let rec render_def (d : def) =
     | NotationT (mop, ty) ->
       "@[reducible] def " ^ render_type_name id ^ " := /- mixop: " ^ Il.Print.string_of_mixop mop ^ " -/ " ^ render_typ ty
     | VariantT cases ->
-      "inductive " ^ render_type_name id ^ " where" ^ prepend "\n | " "\n | " (
-        List.map (render_variant_case id) cases
+      "inductive " ^ render_type_name id ^ " where" ^ String.concat "" (
+        List.map (fun case -> "\n | " ^ render_variant_case id case) cases
       ) ^
       (if cases = [] then "\n  deriving BEq" else "\n  deriving Inhabited, BEq")
     | StructT fields ->
-      (*
-      "type " ^ render_type_name id ^ " = " ^ render_tuple render_typ (
-        List.map (fun (_a, ty, _hints) -> ty) fields
-      )
-      *)
       "structure " ^ render_type_name id ^ " where " ^
       String.concat "" ( List.map (fun (a, ty, _hints) ->
         "\n  " ^ render_field_name a ^ " : " ^ render_typ ty
       ) fields) ^
       "\n  deriving Inhabited, BEq\n" ^
+      (* Generate an instance so that ++ works, for CompE *)
       "instance : Append " ^ render_type_name id ^ " where\n" ^
       "  append := fun r1 r2 => {\n" ^
       String.concat "" (List.map (fun (a, _ty, _hints) ->
@@ -279,7 +261,7 @@ let rec render_def (d : def) =
   | RecD defs ->
     "mutual\n" ^
     String.concat "\n" (List.map render_def defs) ^
-    "end\n"
+    "end"
 
 let render_script (el : script) =
   String.concat "\n\n" (List.map render_def el)
@@ -289,7 +271,6 @@ let gen_string (el : script) =
   "instance : Append (Option a) where\n" ^
   "  append := fun o1 o2 => match o1 with | none => o2 | _ => o1\n\n" ^
   "\n" ^
-  (* Really not in the default distribution? *)
   "inductive Forall (R : α → Prop) : List α → Prop\n" ^
   "  | nil : Forall R []\n" ^
   "  | cons {a l₁} : R a → Forall R l₁ → Forall R (a :: l₁)\n" ^
diff --git a/spectec/test-lean4/SpecTec.lean b/spectec/test-lean4/SpecTec.lean
index 565319543e..b33aa7eaba 100644
--- a/spectec/test-lean4/SpecTec.lean
+++ b/spectec/test-lean4/SpecTec.lean
@@ -677,7 +677,6 @@ inductive InstrSeq_ok : (Context × (List Instr) × Functype) -> Prop where
     (InstrSeq_ok (C, instr, (t_1, t_2))) -> 
     (InstrSeq_ok (C, instr, ((t ++ t_1), (t ++ t_2))))end
 
-
 inductive Expr_ok : (Context × Expr × Resulttype) -> Prop where
   | rule_0 (C : Context) (instr : (List Instr)) (t : (List Valtype)) : 
     (InstrSeq_ok (C, instr, ([], t))) -> 

From 9453e216bc79542e7511e436083ee7b171861301 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Tue, 11 Apr 2023 21:38:31 +0200
Subject: [PATCH 80/98] Il.Print: Do not add comments when `at = no_region`

---
 spectec/src/il/print.ml       |  10 +-
 spectec/test-middlend/TEST.md | 330 ----------------------------------
 2 files changed, 7 insertions(+), 333 deletions(-)

diff --git a/spectec/src/il/print.ml b/spectec/src/il/print.ml
index 6f8947797e..c40ca2b435 100644
--- a/spectec/src/il/print.ml
+++ b/spectec/src/il/print.ml
@@ -201,12 +201,16 @@ let rec string_of_prem prem =
     "(" ^ string_of_prem prem' ^ ")" ^ string_of_iterexp iter
   | NegPr prem' -> "unless " ^ string_of_prem prem'
 
+let region_comment indent at =
+  if at = no_region
+  then ""
+  else indent ^ ";; " ^ string_of_region at ^ "\n"
 
 let string_of_rule rule =
   match rule.it with
   | RuleD (id, binds, mixop, e, prems) ->
     let id' = if id.it = "" then "_" else id.it in
-    "\n  ;; " ^ string_of_region rule.at ^ "\n" ^
+    "\n" ^ region_comment "  " rule.at ^
     "  rule " ^ id' ^ string_of_binds binds ^ ":\n    " ^
       string_of_exp (MixE (mixop, e) $ e.at) ^
       concat "" (List.map (prefix "\n    -- " string_of_prem) prems)
@@ -214,13 +218,13 @@ let string_of_rule rule =
 let string_of_clause id clause =
   match clause.it with
   | DefD (binds, e1, e2, prems) ->
-    "\n  ;; " ^ string_of_region clause.at ^ "\n" ^
+    "\n" ^ region_comment "  " clause.at ^
     "  def" ^ string_of_binds binds ^ " " ^ id.it ^ string_of_exp_args e1 ^ " = " ^
       string_of_exp e2 ^
       concat "" (List.map (prefix "\n    -- " string_of_prem) prems)
 
 let rec string_of_def d =
-  "\n;; " ^ string_of_region d.at ^ "\n" ^
+  "\n" ^ region_comment "" d.at ^
   match d.it with
   | SynD (id, dt, _hints) ->
     "syntax " ^ id.it ^ " = " ^ string_of_deftyp dt
diff --git a/spectec/test-middlend/TEST.md b/spectec/test-middlend/TEST.md
index 05570168cc..3c0b0c375d 100644
--- a/spectec/test-middlend/TEST.md
+++ b/spectec/test-middlend/TEST.md
@@ -1556,27 +1556,17 @@ syntax valtype =
   | EXTERNREF
   | BOT
 
-;;
 def valtype_numtype : numtype -> valtype
-  ;;
   def valtype_numtype(I32_numtype) = I32_valtype
-  ;;
   def valtype_numtype(I64_numtype) = I64_valtype
-  ;;
   def valtype_numtype(F32_numtype) = F32_valtype
-  ;;
   def valtype_numtype(F64_numtype) = F64_valtype
 
-;;
 def valtype_reftype : reftype -> valtype
-  ;;
   def valtype_reftype(FUNCREF_reftype) = FUNCREF_valtype
-  ;;
   def valtype_reftype(EXTERNREF_reftype) = EXTERNREF_valtype
 
-;;
 def valtype_vectype : vectype -> valtype
-  ;;
   def valtype_vectype(V128_vectype) = V128_valtype
 
 ;; 1-syntax.watsup:48.1-48.39
@@ -1584,18 +1574,12 @@ syntax in =
   | I32
   | I64
 
-;;
 def numtype_in : in -> numtype
-  ;;
   def numtype_in(I32_in) = I32_numtype
-  ;;
   def numtype_in(I64_in) = I64_numtype
 
-;;
 def valtype_in : in -> valtype
-  ;;
   def valtype_in(I32_in) = I32_valtype
-  ;;
   def valtype_in(I64_in) = I64_valtype
 
 ;; 1-syntax.watsup:49.1-49.39
@@ -1603,18 +1587,12 @@ syntax fn =
   | F32
   | F64
 
-;;
 def numtype_fn : fn -> numtype
-  ;;
   def numtype_fn(F32_fn) = F32_numtype
-  ;;
   def numtype_fn(F64_fn) = F64_numtype
 
-;;
 def valtype_fn : fn -> valtype
-  ;;
   def valtype_fn(F32_fn) = F32_valtype
-  ;;
   def valtype_fn(F64_fn) = F64_valtype
 
 ;; 1-syntax.watsup:56.1-57.11
@@ -2630,126 +2608,67 @@ syntax admininstr =
   | TRAP
 }
 
-;;
 def admininstr_globalinst : globalinst -> admininstr
-  ;;
   def {x : (numtype, c_numtype)} admininstr_globalinst(CONST_val(x)) = CONST_admininstr(x)
-  ;;
   def {x : reftype} admininstr_globalinst(REF.NULL_val(x)) = REF.NULL_admininstr(x)
-  ;;
   def {x : funcaddr} admininstr_globalinst(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
   def {x : hostaddr} admininstr_globalinst(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
 
-;;
 def admininstr_instr : instr -> admininstr
-  ;;
   def admininstr_instr(UNREACHABLE_instr) = UNREACHABLE_admininstr
-  ;;
   def admininstr_instr(NOP_instr) = NOP_admininstr
-  ;;
   def admininstr_instr(DROP_instr) = DROP_admininstr
-  ;;
   def {x : valtype?} admininstr_instr(SELECT_instr(x)) = SELECT_admininstr(x)
-  ;;
   def {x : (blocktype, instr*)} admininstr_instr(BLOCK_instr(x)) = BLOCK_admininstr(x)
-  ;;
   def {x : (blocktype, instr*)} admininstr_instr(LOOP_instr(x)) = LOOP_admininstr(x)
-  ;;
   def {x : (blocktype, instr*, instr*)} admininstr_instr(IF_instr(x)) = IF_admininstr(x)
-  ;;
   def {x : labelidx} admininstr_instr(BR_instr(x)) = BR_admininstr(x)
-  ;;
   def {x : labelidx} admininstr_instr(BR_IF_instr(x)) = BR_IF_admininstr(x)
-  ;;
   def {x : (labelidx*, labelidx)} admininstr_instr(BR_TABLE_instr(x)) = BR_TABLE_admininstr(x)
-  ;;
   def {x : funcidx} admininstr_instr(CALL_instr(x)) = CALL_admininstr(x)
-  ;;
   def {x : (tableidx, functype)} admininstr_instr(CALL_INDIRECT_instr(x)) = CALL_INDIRECT_admininstr(x)
-  ;;
   def admininstr_instr(RETURN_instr) = RETURN_admininstr
-  ;;
   def {x : (numtype, c_numtype)} admininstr_instr(CONST_instr(x)) = CONST_admininstr(x)
-  ;;
   def {x : (numtype, unop_numtype)} admininstr_instr(UNOP_instr(x)) = UNOP_admininstr(x)
-  ;;
   def {x : (numtype, binop_numtype)} admininstr_instr(BINOP_instr(x)) = BINOP_admininstr(x)
-  ;;
   def {x : (numtype, testop_numtype)} admininstr_instr(TESTOP_instr(x)) = TESTOP_admininstr(x)
-  ;;
   def {x : (numtype, relop_numtype)} admininstr_instr(RELOP_instr(x)) = RELOP_admininstr(x)
-  ;;
   def {x : (numtype, n)} admininstr_instr(EXTEND_instr(x)) = EXTEND_admininstr(x)
-  ;;
   def {x : (numtype, cvtop, numtype, sx?)} admininstr_instr(CVTOP_instr(x)) = CVTOP_admininstr(x)
-  ;;
   def {x : reftype} admininstr_instr(REF.NULL_instr(x)) = REF.NULL_admininstr(x)
-  ;;
   def {x : funcidx} admininstr_instr(REF.FUNC_instr(x)) = REF.FUNC_admininstr(x)
-  ;;
   def admininstr_instr(REF.IS_NULL_instr) = REF.IS_NULL_admininstr
-  ;;
   def {x : localidx} admininstr_instr(LOCAL.GET_instr(x)) = LOCAL.GET_admininstr(x)
-  ;;
   def {x : localidx} admininstr_instr(LOCAL.SET_instr(x)) = LOCAL.SET_admininstr(x)
-  ;;
   def {x : localidx} admininstr_instr(LOCAL.TEE_instr(x)) = LOCAL.TEE_admininstr(x)
-  ;;
   def {x : globalidx} admininstr_instr(GLOBAL.GET_instr(x)) = GLOBAL.GET_admininstr(x)
-  ;;
   def {x : globalidx} admininstr_instr(GLOBAL.SET_instr(x)) = GLOBAL.SET_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.GET_instr(x)) = TABLE.GET_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.SET_instr(x)) = TABLE.SET_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.SIZE_instr(x)) = TABLE.SIZE_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.GROW_instr(x)) = TABLE.GROW_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.FILL_instr(x)) = TABLE.FILL_admininstr(x)
-  ;;
   def {x : (tableidx, tableidx)} admininstr_instr(TABLE.COPY_instr(x)) = TABLE.COPY_admininstr(x)
-  ;;
   def {x : (tableidx, elemidx)} admininstr_instr(TABLE.INIT_instr(x)) = TABLE.INIT_admininstr(x)
-  ;;
   def {x : elemidx} admininstr_instr(ELEM.DROP_instr(x)) = ELEM.DROP_admininstr(x)
-  ;;
   def admininstr_instr(MEMORY.SIZE_instr) = MEMORY.SIZE_admininstr
-  ;;
   def admininstr_instr(MEMORY.GROW_instr) = MEMORY.GROW_admininstr
-  ;;
   def admininstr_instr(MEMORY.FILL_instr) = MEMORY.FILL_admininstr
-  ;;
   def admininstr_instr(MEMORY.COPY_instr) = MEMORY.COPY_admininstr
-  ;;
   def {x : dataidx} admininstr_instr(MEMORY.INIT_instr(x)) = MEMORY.INIT_admininstr(x)
-  ;;
   def {x : dataidx} admininstr_instr(DATA.DROP_instr(x)) = DATA.DROP_admininstr(x)
-  ;;
   def {x : (numtype, (n, sx)?, nat, nat)} admininstr_instr(LOAD_instr(x)) = LOAD_admininstr(x)
-  ;;
   def {x : (numtype, n?, nat, nat)} admininstr_instr(STORE_instr(x)) = STORE_admininstr(x)
 
-;;
 def admininstr_ref : ref -> admininstr
-  ;;
   def {x : reftype} admininstr_ref(REF.NULL_ref(x)) = REF.NULL_admininstr(x)
-  ;;
   def {x : funcaddr} admininstr_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
   def {x : hostaddr} admininstr_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_admininstr(x)
 
-;;
 def admininstr_val : val -> admininstr
-  ;;
   def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
-  ;;
   def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
-  ;;
   def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
   def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
 
 ;; 4-runtime.watsup:84.1-84.62
@@ -3214,27 +3133,17 @@ syntax valtype =
   | EXTERNREF
   | BOT
 
-;;
 def valtype_numtype : numtype -> valtype
-  ;;
   def valtype_numtype(I32_numtype) = I32_valtype
-  ;;
   def valtype_numtype(I64_numtype) = I64_valtype
-  ;;
   def valtype_numtype(F32_numtype) = F32_valtype
-  ;;
   def valtype_numtype(F64_numtype) = F64_valtype
 
-;;
 def valtype_reftype : reftype -> valtype
-  ;;
   def valtype_reftype(FUNCREF_reftype) = FUNCREF_valtype
-  ;;
   def valtype_reftype(EXTERNREF_reftype) = EXTERNREF_valtype
 
-;;
 def valtype_vectype : vectype -> valtype
-  ;;
   def valtype_vectype(V128_vectype) = V128_valtype
 
 ;; 1-syntax.watsup:48.1-48.39
@@ -3242,18 +3151,12 @@ syntax in =
   | I32
   | I64
 
-;;
 def numtype_in : in -> numtype
-  ;;
   def numtype_in(I32_in) = I32_numtype
-  ;;
   def numtype_in(I64_in) = I64_numtype
 
-;;
 def valtype_in : in -> valtype
-  ;;
   def valtype_in(I32_in) = I32_valtype
-  ;;
   def valtype_in(I64_in) = I64_valtype
 
 ;; 1-syntax.watsup:49.1-49.39
@@ -3261,18 +3164,12 @@ syntax fn =
   | F32
   | F64
 
-;;
 def numtype_fn : fn -> numtype
-  ;;
   def numtype_fn(F32_fn) = F32_numtype
-  ;;
   def numtype_fn(F64_fn) = F64_numtype
 
-;;
 def valtype_fn : fn -> valtype
-  ;;
   def valtype_fn(F32_fn) = F32_valtype
-  ;;
   def valtype_fn(F64_fn) = F64_valtype
 
 ;; 1-syntax.watsup:56.1-57.11
@@ -3527,7 +3424,6 @@ def size : valtype -> nat?
   def size(F64_valtype) = ?(64)
   ;; 2-aux.watsup:10.1-10.22
   def size(V128_valtype) = ?(128)
-  ;;
   def {x : valtype} size(x) = ?()
 
 ;; 2-aux.watsup:15.1-15.40
@@ -4199,7 +4095,6 @@ def default_ : valtype -> val?
   def default_(FUNCREF_valtype) = ?(REF.NULL_val(FUNCREF_reftype))
   ;; 4-runtime.watsup:50.1-50.48
   def default_(EXTERNREF_valtype) = ?(REF.NULL_val(EXTERNREF_reftype))
-  ;;
   def {x : valtype} default_(x) = ?()
 
 ;; 4-runtime.watsup:61.1-61.71
@@ -4292,126 +4187,67 @@ syntax admininstr =
   | TRAP
 }
 
-;;
 def admininstr_globalinst : globalinst -> admininstr
-  ;;
   def {x : (numtype, c_numtype)} admininstr_globalinst(CONST_val(x)) = CONST_admininstr(x)
-  ;;
   def {x : reftype} admininstr_globalinst(REF.NULL_val(x)) = REF.NULL_admininstr(x)
-  ;;
   def {x : funcaddr} admininstr_globalinst(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
   def {x : hostaddr} admininstr_globalinst(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
 
-;;
 def admininstr_instr : instr -> admininstr
-  ;;
   def admininstr_instr(UNREACHABLE_instr) = UNREACHABLE_admininstr
-  ;;
   def admininstr_instr(NOP_instr) = NOP_admininstr
-  ;;
   def admininstr_instr(DROP_instr) = DROP_admininstr
-  ;;
   def {x : valtype?} admininstr_instr(SELECT_instr(x)) = SELECT_admininstr(x)
-  ;;
   def {x : (blocktype, instr*)} admininstr_instr(BLOCK_instr(x)) = BLOCK_admininstr(x)
-  ;;
   def {x : (blocktype, instr*)} admininstr_instr(LOOP_instr(x)) = LOOP_admininstr(x)
-  ;;
   def {x : (blocktype, instr*, instr*)} admininstr_instr(IF_instr(x)) = IF_admininstr(x)
-  ;;
   def {x : labelidx} admininstr_instr(BR_instr(x)) = BR_admininstr(x)
-  ;;
   def {x : labelidx} admininstr_instr(BR_IF_instr(x)) = BR_IF_admininstr(x)
-  ;;
   def {x : (labelidx*, labelidx)} admininstr_instr(BR_TABLE_instr(x)) = BR_TABLE_admininstr(x)
-  ;;
   def {x : funcidx} admininstr_instr(CALL_instr(x)) = CALL_admininstr(x)
-  ;;
   def {x : (tableidx, functype)} admininstr_instr(CALL_INDIRECT_instr(x)) = CALL_INDIRECT_admininstr(x)
-  ;;
   def admininstr_instr(RETURN_instr) = RETURN_admininstr
-  ;;
   def {x : (numtype, c_numtype)} admininstr_instr(CONST_instr(x)) = CONST_admininstr(x)
-  ;;
   def {x : (numtype, unop_numtype)} admininstr_instr(UNOP_instr(x)) = UNOP_admininstr(x)
-  ;;
   def {x : (numtype, binop_numtype)} admininstr_instr(BINOP_instr(x)) = BINOP_admininstr(x)
-  ;;
   def {x : (numtype, testop_numtype)} admininstr_instr(TESTOP_instr(x)) = TESTOP_admininstr(x)
-  ;;
   def {x : (numtype, relop_numtype)} admininstr_instr(RELOP_instr(x)) = RELOP_admininstr(x)
-  ;;
   def {x : (numtype, n)} admininstr_instr(EXTEND_instr(x)) = EXTEND_admininstr(x)
-  ;;
   def {x : (numtype, cvtop, numtype, sx?)} admininstr_instr(CVTOP_instr(x)) = CVTOP_admininstr(x)
-  ;;
   def {x : reftype} admininstr_instr(REF.NULL_instr(x)) = REF.NULL_admininstr(x)
-  ;;
   def {x : funcidx} admininstr_instr(REF.FUNC_instr(x)) = REF.FUNC_admininstr(x)
-  ;;
   def admininstr_instr(REF.IS_NULL_instr) = REF.IS_NULL_admininstr
-  ;;
   def {x : localidx} admininstr_instr(LOCAL.GET_instr(x)) = LOCAL.GET_admininstr(x)
-  ;;
   def {x : localidx} admininstr_instr(LOCAL.SET_instr(x)) = LOCAL.SET_admininstr(x)
-  ;;
   def {x : localidx} admininstr_instr(LOCAL.TEE_instr(x)) = LOCAL.TEE_admininstr(x)
-  ;;
   def {x : globalidx} admininstr_instr(GLOBAL.GET_instr(x)) = GLOBAL.GET_admininstr(x)
-  ;;
   def {x : globalidx} admininstr_instr(GLOBAL.SET_instr(x)) = GLOBAL.SET_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.GET_instr(x)) = TABLE.GET_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.SET_instr(x)) = TABLE.SET_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.SIZE_instr(x)) = TABLE.SIZE_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.GROW_instr(x)) = TABLE.GROW_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.FILL_instr(x)) = TABLE.FILL_admininstr(x)
-  ;;
   def {x : (tableidx, tableidx)} admininstr_instr(TABLE.COPY_instr(x)) = TABLE.COPY_admininstr(x)
-  ;;
   def {x : (tableidx, elemidx)} admininstr_instr(TABLE.INIT_instr(x)) = TABLE.INIT_admininstr(x)
-  ;;
   def {x : elemidx} admininstr_instr(ELEM.DROP_instr(x)) = ELEM.DROP_admininstr(x)
-  ;;
   def admininstr_instr(MEMORY.SIZE_instr) = MEMORY.SIZE_admininstr
-  ;;
   def admininstr_instr(MEMORY.GROW_instr) = MEMORY.GROW_admininstr
-  ;;
   def admininstr_instr(MEMORY.FILL_instr) = MEMORY.FILL_admininstr
-  ;;
   def admininstr_instr(MEMORY.COPY_instr) = MEMORY.COPY_admininstr
-  ;;
   def {x : dataidx} admininstr_instr(MEMORY.INIT_instr(x)) = MEMORY.INIT_admininstr(x)
-  ;;
   def {x : dataidx} admininstr_instr(DATA.DROP_instr(x)) = DATA.DROP_admininstr(x)
-  ;;
   def {x : (numtype, (n, sx)?, nat, nat)} admininstr_instr(LOAD_instr(x)) = LOAD_admininstr(x)
-  ;;
   def {x : (numtype, n?, nat, nat)} admininstr_instr(STORE_instr(x)) = STORE_admininstr(x)
 
-;;
 def admininstr_ref : ref -> admininstr
-  ;;
   def {x : reftype} admininstr_ref(REF.NULL_ref(x)) = REF.NULL_admininstr(x)
-  ;;
   def {x : funcaddr} admininstr_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
   def {x : hostaddr} admininstr_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_admininstr(x)
 
-;;
 def admininstr_val : val -> admininstr
-  ;;
   def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
-  ;;
   def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
-  ;;
   def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
   def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
 
 ;; 4-runtime.watsup:84.1-84.62
@@ -4876,27 +4712,17 @@ syntax valtype =
   | EXTERNREF
   | BOT
 
-;;
 def valtype_numtype : numtype -> valtype
-  ;;
   def valtype_numtype(I32_numtype) = I32_valtype
-  ;;
   def valtype_numtype(I64_numtype) = I64_valtype
-  ;;
   def valtype_numtype(F32_numtype) = F32_valtype
-  ;;
   def valtype_numtype(F64_numtype) = F64_valtype
 
-;;
 def valtype_reftype : reftype -> valtype
-  ;;
   def valtype_reftype(FUNCREF_reftype) = FUNCREF_valtype
-  ;;
   def valtype_reftype(EXTERNREF_reftype) = EXTERNREF_valtype
 
-;;
 def valtype_vectype : vectype -> valtype
-  ;;
   def valtype_vectype(V128_vectype) = V128_valtype
 
 ;; 1-syntax.watsup:48.1-48.39
@@ -4904,18 +4730,12 @@ syntax in =
   | I32
   | I64
 
-;;
 def numtype_in : in -> numtype
-  ;;
   def numtype_in(I32_in) = I32_numtype
-  ;;
   def numtype_in(I64_in) = I64_numtype
 
-;;
 def valtype_in : in -> valtype
-  ;;
   def valtype_in(I32_in) = I32_valtype
-  ;;
   def valtype_in(I64_in) = I64_valtype
 
 ;; 1-syntax.watsup:49.1-49.39
@@ -4923,18 +4743,12 @@ syntax fn =
   | F32
   | F64
 
-;;
 def numtype_fn : fn -> numtype
-  ;;
   def numtype_fn(F32_fn) = F32_numtype
-  ;;
   def numtype_fn(F64_fn) = F64_numtype
 
-;;
 def valtype_fn : fn -> valtype
-  ;;
   def valtype_fn(F32_fn) = F32_valtype
-  ;;
   def valtype_fn(F64_fn) = F64_valtype
 
 ;; 1-syntax.watsup:56.1-57.11
@@ -5189,7 +5003,6 @@ def size : valtype -> nat?
   def size(F64_valtype) = ?(64)
   ;; 2-aux.watsup:10.1-10.22
   def size(V128_valtype) = ?(128)
-  ;;
   def {x : valtype} size(x) = ?()
 
 ;; 2-aux.watsup:15.1-15.40
@@ -5915,7 +5728,6 @@ def default_ : valtype -> val?
   def default_(FUNCREF_valtype) = ?(REF.NULL_val(FUNCREF_reftype))
   ;; 4-runtime.watsup:50.1-50.48
   def default_(EXTERNREF_valtype) = ?(REF.NULL_val(EXTERNREF_reftype))
-  ;;
   def {x : valtype} default_(x) = ?()
 
 ;; 4-runtime.watsup:61.1-61.71
@@ -6008,126 +5820,67 @@ syntax admininstr =
   | TRAP
 }
 
-;;
 def admininstr_globalinst : globalinst -> admininstr
-  ;;
   def {x : (numtype, c_numtype)} admininstr_globalinst(CONST_val(x)) = CONST_admininstr(x)
-  ;;
   def {x : reftype} admininstr_globalinst(REF.NULL_val(x)) = REF.NULL_admininstr(x)
-  ;;
   def {x : funcaddr} admininstr_globalinst(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
   def {x : hostaddr} admininstr_globalinst(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
 
-;;
 def admininstr_instr : instr -> admininstr
-  ;;
   def admininstr_instr(UNREACHABLE_instr) = UNREACHABLE_admininstr
-  ;;
   def admininstr_instr(NOP_instr) = NOP_admininstr
-  ;;
   def admininstr_instr(DROP_instr) = DROP_admininstr
-  ;;
   def {x : valtype?} admininstr_instr(SELECT_instr(x)) = SELECT_admininstr(x)
-  ;;
   def {x : (blocktype, instr*)} admininstr_instr(BLOCK_instr(x)) = BLOCK_admininstr(x)
-  ;;
   def {x : (blocktype, instr*)} admininstr_instr(LOOP_instr(x)) = LOOP_admininstr(x)
-  ;;
   def {x : (blocktype, instr*, instr*)} admininstr_instr(IF_instr(x)) = IF_admininstr(x)
-  ;;
   def {x : labelidx} admininstr_instr(BR_instr(x)) = BR_admininstr(x)
-  ;;
   def {x : labelidx} admininstr_instr(BR_IF_instr(x)) = BR_IF_admininstr(x)
-  ;;
   def {x : (labelidx*, labelidx)} admininstr_instr(BR_TABLE_instr(x)) = BR_TABLE_admininstr(x)
-  ;;
   def {x : funcidx} admininstr_instr(CALL_instr(x)) = CALL_admininstr(x)
-  ;;
   def {x : (tableidx, functype)} admininstr_instr(CALL_INDIRECT_instr(x)) = CALL_INDIRECT_admininstr(x)
-  ;;
   def admininstr_instr(RETURN_instr) = RETURN_admininstr
-  ;;
   def {x : (numtype, c_numtype)} admininstr_instr(CONST_instr(x)) = CONST_admininstr(x)
-  ;;
   def {x : (numtype, unop_numtype)} admininstr_instr(UNOP_instr(x)) = UNOP_admininstr(x)
-  ;;
   def {x : (numtype, binop_numtype)} admininstr_instr(BINOP_instr(x)) = BINOP_admininstr(x)
-  ;;
   def {x : (numtype, testop_numtype)} admininstr_instr(TESTOP_instr(x)) = TESTOP_admininstr(x)
-  ;;
   def {x : (numtype, relop_numtype)} admininstr_instr(RELOP_instr(x)) = RELOP_admininstr(x)
-  ;;
   def {x : (numtype, n)} admininstr_instr(EXTEND_instr(x)) = EXTEND_admininstr(x)
-  ;;
   def {x : (numtype, cvtop, numtype, sx?)} admininstr_instr(CVTOP_instr(x)) = CVTOP_admininstr(x)
-  ;;
   def {x : reftype} admininstr_instr(REF.NULL_instr(x)) = REF.NULL_admininstr(x)
-  ;;
   def {x : funcidx} admininstr_instr(REF.FUNC_instr(x)) = REF.FUNC_admininstr(x)
-  ;;
   def admininstr_instr(REF.IS_NULL_instr) = REF.IS_NULL_admininstr
-  ;;
   def {x : localidx} admininstr_instr(LOCAL.GET_instr(x)) = LOCAL.GET_admininstr(x)
-  ;;
   def {x : localidx} admininstr_instr(LOCAL.SET_instr(x)) = LOCAL.SET_admininstr(x)
-  ;;
   def {x : localidx} admininstr_instr(LOCAL.TEE_instr(x)) = LOCAL.TEE_admininstr(x)
-  ;;
   def {x : globalidx} admininstr_instr(GLOBAL.GET_instr(x)) = GLOBAL.GET_admininstr(x)
-  ;;
   def {x : globalidx} admininstr_instr(GLOBAL.SET_instr(x)) = GLOBAL.SET_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.GET_instr(x)) = TABLE.GET_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.SET_instr(x)) = TABLE.SET_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.SIZE_instr(x)) = TABLE.SIZE_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.GROW_instr(x)) = TABLE.GROW_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.FILL_instr(x)) = TABLE.FILL_admininstr(x)
-  ;;
   def {x : (tableidx, tableidx)} admininstr_instr(TABLE.COPY_instr(x)) = TABLE.COPY_admininstr(x)
-  ;;
   def {x : (tableidx, elemidx)} admininstr_instr(TABLE.INIT_instr(x)) = TABLE.INIT_admininstr(x)
-  ;;
   def {x : elemidx} admininstr_instr(ELEM.DROP_instr(x)) = ELEM.DROP_admininstr(x)
-  ;;
   def admininstr_instr(MEMORY.SIZE_instr) = MEMORY.SIZE_admininstr
-  ;;
   def admininstr_instr(MEMORY.GROW_instr) = MEMORY.GROW_admininstr
-  ;;
   def admininstr_instr(MEMORY.FILL_instr) = MEMORY.FILL_admininstr
-  ;;
   def admininstr_instr(MEMORY.COPY_instr) = MEMORY.COPY_admininstr
-  ;;
   def {x : dataidx} admininstr_instr(MEMORY.INIT_instr(x)) = MEMORY.INIT_admininstr(x)
-  ;;
   def {x : dataidx} admininstr_instr(DATA.DROP_instr(x)) = DATA.DROP_admininstr(x)
-  ;;
   def {x : (numtype, (n, sx)?, nat, nat)} admininstr_instr(LOAD_instr(x)) = LOAD_admininstr(x)
-  ;;
   def {x : (numtype, n?, nat, nat)} admininstr_instr(STORE_instr(x)) = STORE_admininstr(x)
 
-;;
 def admininstr_ref : ref -> admininstr
-  ;;
   def {x : reftype} admininstr_ref(REF.NULL_ref(x)) = REF.NULL_admininstr(x)
-  ;;
   def {x : funcaddr} admininstr_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
   def {x : hostaddr} admininstr_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_admininstr(x)
 
-;;
 def admininstr_val : val -> admininstr
-  ;;
   def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
-  ;;
   def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
-  ;;
   def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
   def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
 
 ;; 4-runtime.watsup:84.1-84.62
@@ -6612,27 +6365,17 @@ syntax valtype =
   | EXTERNREF
   | BOT
 
-;;
 def valtype_numtype : numtype -> valtype
-  ;;
   def valtype_numtype(I32_numtype) = I32_valtype
-  ;;
   def valtype_numtype(I64_numtype) = I64_valtype
-  ;;
   def valtype_numtype(F32_numtype) = F32_valtype
-  ;;
   def valtype_numtype(F64_numtype) = F64_valtype
 
-;;
 def valtype_reftype : reftype -> valtype
-  ;;
   def valtype_reftype(FUNCREF_reftype) = FUNCREF_valtype
-  ;;
   def valtype_reftype(EXTERNREF_reftype) = EXTERNREF_valtype
 
-;;
 def valtype_vectype : vectype -> valtype
-  ;;
   def valtype_vectype(V128_vectype) = V128_valtype
 
 ;; 1-syntax.watsup:48.1-48.39
@@ -6640,18 +6383,12 @@ syntax in =
   | I32
   | I64
 
-;;
 def numtype_in : in -> numtype
-  ;;
   def numtype_in(I32_in) = I32_numtype
-  ;;
   def numtype_in(I64_in) = I64_numtype
 
-;;
 def valtype_in : in -> valtype
-  ;;
   def valtype_in(I32_in) = I32_valtype
-  ;;
   def valtype_in(I64_in) = I64_valtype
 
 ;; 1-syntax.watsup:49.1-49.39
@@ -6659,18 +6396,12 @@ syntax fn =
   | F32
   | F64
 
-;;
 def numtype_fn : fn -> numtype
-  ;;
   def numtype_fn(F32_fn) = F32_numtype
-  ;;
   def numtype_fn(F64_fn) = F64_numtype
 
-;;
 def valtype_fn : fn -> valtype
-  ;;
   def valtype_fn(F32_fn) = F32_valtype
-  ;;
   def valtype_fn(F64_fn) = F64_valtype
 
 ;; 1-syntax.watsup:56.1-57.11
@@ -6925,7 +6656,6 @@ def size : valtype -> nat?
   def size(F64_valtype) = ?(64)
   ;; 2-aux.watsup:10.1-10.22
   def size(V128_valtype) = ?(128)
-  ;;
   def {x : valtype} size(x) = ?()
 
 ;; 2-aux.watsup:15.1-15.40
@@ -7651,7 +7381,6 @@ def default_ : valtype -> val?
   def default_(FUNCREF_valtype) = ?(REF.NULL_val(FUNCREF_reftype))
   ;; 4-runtime.watsup:50.1-50.48
   def default_(EXTERNREF_valtype) = ?(REF.NULL_val(EXTERNREF_reftype))
-  ;;
   def {x : valtype} default_(x) = ?()
 
 ;; 4-runtime.watsup:61.1-61.71
@@ -7744,126 +7473,67 @@ syntax admininstr =
   | TRAP
 }
 
-;;
 def admininstr_globalinst : globalinst -> admininstr
-  ;;
   def {x : (numtype, c_numtype)} admininstr_globalinst(CONST_val(x)) = CONST_admininstr(x)
-  ;;
   def {x : reftype} admininstr_globalinst(REF.NULL_val(x)) = REF.NULL_admininstr(x)
-  ;;
   def {x : funcaddr} admininstr_globalinst(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
   def {x : hostaddr} admininstr_globalinst(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
 
-;;
 def admininstr_instr : instr -> admininstr
-  ;;
   def admininstr_instr(UNREACHABLE_instr) = UNREACHABLE_admininstr
-  ;;
   def admininstr_instr(NOP_instr) = NOP_admininstr
-  ;;
   def admininstr_instr(DROP_instr) = DROP_admininstr
-  ;;
   def {x : valtype?} admininstr_instr(SELECT_instr(x)) = SELECT_admininstr(x)
-  ;;
   def {x : (blocktype, instr*)} admininstr_instr(BLOCK_instr(x)) = BLOCK_admininstr(x)
-  ;;
   def {x : (blocktype, instr*)} admininstr_instr(LOOP_instr(x)) = LOOP_admininstr(x)
-  ;;
   def {x : (blocktype, instr*, instr*)} admininstr_instr(IF_instr(x)) = IF_admininstr(x)
-  ;;
   def {x : labelidx} admininstr_instr(BR_instr(x)) = BR_admininstr(x)
-  ;;
   def {x : labelidx} admininstr_instr(BR_IF_instr(x)) = BR_IF_admininstr(x)
-  ;;
   def {x : (labelidx*, labelidx)} admininstr_instr(BR_TABLE_instr(x)) = BR_TABLE_admininstr(x)
-  ;;
   def {x : funcidx} admininstr_instr(CALL_instr(x)) = CALL_admininstr(x)
-  ;;
   def {x : (tableidx, functype)} admininstr_instr(CALL_INDIRECT_instr(x)) = CALL_INDIRECT_admininstr(x)
-  ;;
   def admininstr_instr(RETURN_instr) = RETURN_admininstr
-  ;;
   def {x : (numtype, c_numtype)} admininstr_instr(CONST_instr(x)) = CONST_admininstr(x)
-  ;;
   def {x : (numtype, unop_numtype)} admininstr_instr(UNOP_instr(x)) = UNOP_admininstr(x)
-  ;;
   def {x : (numtype, binop_numtype)} admininstr_instr(BINOP_instr(x)) = BINOP_admininstr(x)
-  ;;
   def {x : (numtype, testop_numtype)} admininstr_instr(TESTOP_instr(x)) = TESTOP_admininstr(x)
-  ;;
   def {x : (numtype, relop_numtype)} admininstr_instr(RELOP_instr(x)) = RELOP_admininstr(x)
-  ;;
   def {x : (numtype, n)} admininstr_instr(EXTEND_instr(x)) = EXTEND_admininstr(x)
-  ;;
   def {x : (numtype, cvtop, numtype, sx?)} admininstr_instr(CVTOP_instr(x)) = CVTOP_admininstr(x)
-  ;;
   def {x : reftype} admininstr_instr(REF.NULL_instr(x)) = REF.NULL_admininstr(x)
-  ;;
   def {x : funcidx} admininstr_instr(REF.FUNC_instr(x)) = REF.FUNC_admininstr(x)
-  ;;
   def admininstr_instr(REF.IS_NULL_instr) = REF.IS_NULL_admininstr
-  ;;
   def {x : localidx} admininstr_instr(LOCAL.GET_instr(x)) = LOCAL.GET_admininstr(x)
-  ;;
   def {x : localidx} admininstr_instr(LOCAL.SET_instr(x)) = LOCAL.SET_admininstr(x)
-  ;;
   def {x : localidx} admininstr_instr(LOCAL.TEE_instr(x)) = LOCAL.TEE_admininstr(x)
-  ;;
   def {x : globalidx} admininstr_instr(GLOBAL.GET_instr(x)) = GLOBAL.GET_admininstr(x)
-  ;;
   def {x : globalidx} admininstr_instr(GLOBAL.SET_instr(x)) = GLOBAL.SET_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.GET_instr(x)) = TABLE.GET_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.SET_instr(x)) = TABLE.SET_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.SIZE_instr(x)) = TABLE.SIZE_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.GROW_instr(x)) = TABLE.GROW_admininstr(x)
-  ;;
   def {x : tableidx} admininstr_instr(TABLE.FILL_instr(x)) = TABLE.FILL_admininstr(x)
-  ;;
   def {x : (tableidx, tableidx)} admininstr_instr(TABLE.COPY_instr(x)) = TABLE.COPY_admininstr(x)
-  ;;
   def {x : (tableidx, elemidx)} admininstr_instr(TABLE.INIT_instr(x)) = TABLE.INIT_admininstr(x)
-  ;;
   def {x : elemidx} admininstr_instr(ELEM.DROP_instr(x)) = ELEM.DROP_admininstr(x)
-  ;;
   def admininstr_instr(MEMORY.SIZE_instr) = MEMORY.SIZE_admininstr
-  ;;
   def admininstr_instr(MEMORY.GROW_instr) = MEMORY.GROW_admininstr
-  ;;
   def admininstr_instr(MEMORY.FILL_instr) = MEMORY.FILL_admininstr
-  ;;
   def admininstr_instr(MEMORY.COPY_instr) = MEMORY.COPY_admininstr
-  ;;
   def {x : dataidx} admininstr_instr(MEMORY.INIT_instr(x)) = MEMORY.INIT_admininstr(x)
-  ;;
   def {x : dataidx} admininstr_instr(DATA.DROP_instr(x)) = DATA.DROP_admininstr(x)
-  ;;
   def {x : (numtype, (n, sx)?, nat, nat)} admininstr_instr(LOAD_instr(x)) = LOAD_admininstr(x)
-  ;;
   def {x : (numtype, n?, nat, nat)} admininstr_instr(STORE_instr(x)) = STORE_admininstr(x)
 
-;;
 def admininstr_ref : ref -> admininstr
-  ;;
   def {x : reftype} admininstr_ref(REF.NULL_ref(x)) = REF.NULL_admininstr(x)
-  ;;
   def {x : funcaddr} admininstr_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
   def {x : hostaddr} admininstr_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_admininstr(x)
 
-;;
 def admininstr_val : val -> admininstr
-  ;;
   def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
-  ;;
   def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
-  ;;
   def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
   def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
 
 ;; 4-runtime.watsup:84.1-84.62

From 2ce35622241972f6b752d424814ec2f432d9d579 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Tue, 11 Apr 2023 21:38:31 +0200
Subject: [PATCH 81/98] Il.Print: Do not add comments when `at = no_region`

---
 spectec/src/il/print.ml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/spectec/src/il/print.ml b/spectec/src/il/print.ml
index a76d8ca95e..cecc122792 100644
--- a/spectec/src/il/print.ml
+++ b/spectec/src/il/print.ml
@@ -200,12 +200,16 @@ let rec string_of_prem prem =
   | IterPr (prem', iter) ->
     "(" ^ string_of_prem prem' ^ ")" ^ string_of_iterexp iter
 
+let region_comment indent at =
+  if at = no_region
+  then ""
+  else indent ^ ";; " ^ string_of_region at ^ "\n"
 
 let string_of_rule rule =
   match rule.it with
   | RuleD (id, binds, mixop, e, prems) ->
     let id' = if id.it = "" then "_" else id.it in
-    "\n  ;; " ^ string_of_region rule.at ^ "\n" ^
+    "\n" ^ region_comment "  " rule.at ^
     "  rule " ^ id' ^ string_of_binds binds ^ ":\n    " ^
       string_of_exp (MixE (mixop, e) $ e.at) ^
       concat "" (List.map (prefix "\n    -- " string_of_prem) prems)
@@ -213,13 +217,13 @@ let string_of_rule rule =
 let string_of_clause id clause =
   match clause.it with
   | DefD (binds, e1, e2, prems) ->
-    "\n  ;; " ^ string_of_region clause.at ^ "\n" ^
+    "\n" ^ region_comment "  " clause.at ^
     "  def" ^ string_of_binds binds ^ " " ^ id.it ^ string_of_exp_args e1 ^ " = " ^
       string_of_exp e2 ^
       concat "" (List.map (prefix "\n    -- " string_of_prem) prems)
 
 let rec string_of_def d =
-  "\n;; " ^ string_of_region d.at ^ "\n" ^
+  "\n" ^ region_comment "" d.at ^
   match d.it with
   | SynD (id, dt, _hints) ->
     "syntax " ^ id.it ^ " = " ^ string_of_deftyp dt

From ae45be3b31dcf350f1aed168e6daa7d5fabc3af3 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 12 Apr 2023 18:31:07 +0200
Subject: [PATCH 82/98] Clean up prelude

---
 spectec/src/backend-lean4/gen.ml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index b187598983..edb3844513 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -267,7 +267,12 @@ let render_script (el : script) =
   String.concat "\n\n" (List.map render_def el)
 
 let gen_string (el : script) =
-  "/- Lean 4 export -/\n\n" ^
+  "/- Lean 4 export -/\n" ^
+  "\n" ^
+  "/- A little prelude -/\n" ^
+  "\n" ^
+  "set_option linter.unusedVariables false\n" ^
+  "\n" ^
   "instance : Append (Option a) where\n" ^
   "  append := fun o1 o2 => match o1 with | none => o2 | _ => o1\n\n" ^
   "\n" ^
@@ -275,7 +280,6 @@ let gen_string (el : script) =
   "  | nil : Forall R []\n" ^
   "  | cons {a l₁} : R a → Forall R l₁ → Forall R (a :: l₁)\n" ^
   "attribute [simp] Forall.nil\n" ^
-  "variable {r : α → β → Prop} {p : γ → δ → Prop}\n" ^
   "inductive Forall₂ (R : α → β → Prop) : List α → List β → Prop\n" ^
   "  | nil : Forall₂ R [] []\n" ^
   "  | cons {a b l₁ l₂} : R a b → Forall₂ R l₁ l₂ → Forall₂ R (a :: l₁) (b :: l₂)\n" ^
@@ -286,12 +290,13 @@ let gen_string (el : script) =
   "def Option.toList : Option α → List α\n" ^
   "  | none => List.nil\n" ^
   "  | some x => [x]\n" ^
-  "set_option linter.unusedVariables false\n" ^
   "def List.upd : List α → Nat → α → List α\n" ^
   "| [], _, _ => []\n" ^
   "| x::xs, 0, y => y :: xs\n" ^
   "| x::xs, n+1, y => x :: xs.upd n y\n" ^
   "\n\n" ^
+  "/- Now, the generated code -/\n" ^
+  "\n" ^
   render_script el
 
 

From 0c11a8f6d0692cb22946fc74651228b111478207 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 12 Apr 2023 22:32:58 +0200
Subject: [PATCH 83/98] Forgot to promote

---
 spectec/test-lean4/SpecTec.lean | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/spectec/test-lean4/SpecTec.lean b/spectec/test-lean4/SpecTec.lean
index b33aa7eaba..4689df4176 100644
--- a/spectec/test-lean4/SpecTec.lean
+++ b/spectec/test-lean4/SpecTec.lean
@@ -1,5 +1,9 @@
 /- Lean 4 export -/
 
+/- A little prelude -/
+
+set_option linter.unusedVariables false
+
 instance : Append (Option a) where
   append := fun o1 o2 => match o1 with | none => o2 | _ => o1
 
@@ -8,7 +12,6 @@ inductive Forall (R : α → Prop) : List α → Prop
   | nil : Forall R []
   | cons {a l₁} : R a → Forall R l₁ → Forall R (a :: l₁)
 attribute [simp] Forall.nil
-variable {r : α → β → Prop} {p : γ → δ → Prop}
 inductive Forall₂ (R : α → β → Prop) : List α → List β → Prop
   | nil : Forall₂ R [] []
   | cons {a b l₁ l₂} : R a b → Forall₂ R l₁ l₂ → Forall₂ R (a :: l₁) (b :: l₂)
@@ -19,13 +22,14 @@ def Option.zipWith : (α → β → γ) → Option α → Option β → Option 
 def Option.toList : Option α → List α
   | none => List.nil
   | some x => [x]
-set_option linter.unusedVariables false
 def List.upd : List α → Nat → α → List α
 | [], _, _ => []
 | x::xs, 0, y => y :: xs
 | x::xs, n+1, y => x :: xs.upd n y
 
 
+/- Now, the generated code -/
+
 @[reducible] def N := Nat
 
 @[reducible] def Name := String

From 5b6bd22aa6e9850cc505ff38826c1e9ec2d325fb Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Fri, 21 Apr 2023 18:22:23 +0200
Subject: [PATCH 84/98] Prepare --the-elimination pass

---
 spectec/src/exe-watsup/main.ml |   11 +
 spectec/src/middlend/dune      |    2 +-
 spectec/src/middlend/unthe.ml  |   16 +
 spectec/src/middlend/unthe.mli |    1 +
 spectec/test-middlend/TEST.md  | 1581 +++++++++++++++++++++++++++++++-
 5 files changed, 1609 insertions(+), 2 deletions(-)
 create mode 100644 spectec/src/middlend/unthe.ml
 create mode 100644 spectec/src/middlend/unthe.mli

diff --git a/spectec/src/exe-watsup/main.ml b/spectec/src/exe-watsup/main.ml
index 9fec66673a..1f1b5b0b47 100644
--- a/spectec/src/exe-watsup/main.ml
+++ b/spectec/src/exe-watsup/main.ml
@@ -33,6 +33,7 @@ let print_all_il = ref false
 
 let pass_sub = ref false
 let pass_totalize = ref false
+let pass_unthe = ref false
 let pass_sideconditions = ref false
 let pass_else_elim = ref false
 
@@ -61,6 +62,7 @@ let argspec = Arg.align
 
   "--sub", Arg.Set pass_sub, "Synthesize explicit subtype coercions";
   "--totalize", Arg.Set pass_totalize, "Run function totalization";
+  "--the-elimination", Arg.Set pass_unthe, "Eliminate the ! operator in relations";
   "--sideconditions", Arg.Set pass_sideconditions, "Infer side conditoins";
   "--else-elimination", Arg.Set pass_else_elim, "Eliminate otherwise/else";
 
@@ -110,6 +112,15 @@ let () =
       il
     end else il in
 
+    let il = if !pass_unthe || !target = Lean4 then begin
+      log "Option projection eliminiation";
+      let il = Middlend.Unthe.transform il in
+      if !print_all_il then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
+      log "IL Validation...";
+      Il.Validation.valid il;
+      il
+    end else il in
+
     let il = if !pass_sideconditions || !target = Lean4 then begin
       log "Side condition inference";
       let il = Middlend.Sideconditions.transform il in
diff --git a/spectec/src/middlend/dune b/spectec/src/middlend/dune
index 0fa902f0ec..06914d2abc 100644
--- a/spectec/src/middlend/dune
+++ b/spectec/src/middlend/dune
@@ -1,5 +1,5 @@
 (library
   (name middlend)
   (libraries util il)
-  (modules sub totalize sideconditions else)
+  (modules sub totalize unthe sideconditions else)
 )
diff --git a/spectec/src/middlend/unthe.ml b/spectec/src/middlend/unthe.ml
new file mode 100644
index 0000000000..3fbb1a072c
--- /dev/null
+++ b/spectec/src/middlend/unthe.ml
@@ -0,0 +1,16 @@
+(*
+This transformation removes use of the ! operator from relations, by
+introducing fresh variables.
+
+An occurrence of !(e) will be replaced with a fresh variable x of the suitable
+type (and dimension), and a new condition e = ?(x) is added.
+
+This is an alternative to to how the Sideconditions pass handles the ! operator.
+If you need both, passes, run this one first.
+*)
+
+open Il.Ast
+
+(* Errors *)
+let transform (defs : script) = defs
+
diff --git a/spectec/src/middlend/unthe.mli b/spectec/src/middlend/unthe.mli
new file mode 100644
index 0000000000..542bbf8052
--- /dev/null
+++ b/spectec/src/middlend/unthe.mli
@@ -0,0 +1 @@
+val transform : Il.Ast.script -> Il.Ast.script
diff --git a/spectec/test-middlend/TEST.md b/spectec/test-middlend/TEST.md
index 3c0b0c375d..8aaaa85f2e 100644
--- a/spectec/test-middlend/TEST.md
+++ b/spectec/test-middlend/TEST.md
@@ -1,7 +1,7 @@
 # Preview
 
 ```sh
-$ (cd ../spec && ../src/exe-watsup/main.exe *.watsup -l --print-all-il --sub --totalize --sideconditions --else-elimination --check-only)
+$ (cd ../spec && ../src/exe-watsup/main.exe *.watsup -l --print-all-il --sub --totalize --the-elimination --sideconditions --else-elimination --check-only)
 == Parsing...
 == Elaboration...
 
@@ -4643,6 +4643,1585 @@ relation Step: `%~>%`(config, config)
   rule elem.drop {x : idx, z : state}:
     `%~>%`(`%;%*`(z, [ELEM.DROP_admininstr(x)]), `%;%*`($with_elem(z, x, []), []))
 
+== IL Validation...
+== Option projection eliminiation
+
+;; 1-syntax.watsup:3.1-3.15
+syntax n = nat
+
+;; 1-syntax.watsup:9.1-9.37
+syntax name = text
+
+;; 1-syntax.watsup:14.1-14.36
+syntax byte = nat
+
+;; 1-syntax.watsup:15.1-15.45
+syntax u32 = nat
+
+;; 1-syntax.watsup:22.1-22.36
+syntax idx = nat
+
+;; 1-syntax.watsup:23.1-23.49
+syntax funcidx = idx
+
+;; 1-syntax.watsup:24.1-24.49
+syntax globalidx = idx
+
+;; 1-syntax.watsup:25.1-25.47
+syntax tableidx = idx
+
+;; 1-syntax.watsup:26.1-26.46
+syntax memidx = idx
+
+;; 1-syntax.watsup:27.1-27.45
+syntax elemidx = idx
+
+;; 1-syntax.watsup:28.1-28.45
+syntax dataidx = idx
+
+;; 1-syntax.watsup:29.1-29.47
+syntax labelidx = idx
+
+;; 1-syntax.watsup:30.1-30.47
+syntax localidx = idx
+
+;; 1-syntax.watsup:39.1-40.22
+syntax numtype =
+  | I32
+  | I64
+  | F32
+  | F64
+
+;; 1-syntax.watsup:41.1-42.5
+syntax vectype =
+  | V128
+
+;; 1-syntax.watsup:43.1-44.20
+syntax reftype =
+  | FUNCREF
+  | EXTERNREF
+
+;; 1-syntax.watsup:45.1-46.34
+syntax valtype =
+  | I32
+  | I64
+  | F32
+  | F64
+  | V128
+  | FUNCREF
+  | EXTERNREF
+  | BOT
+
+def valtype_numtype : numtype -> valtype
+  def valtype_numtype(I32_numtype) = I32_valtype
+  def valtype_numtype(I64_numtype) = I64_valtype
+  def valtype_numtype(F32_numtype) = F32_valtype
+  def valtype_numtype(F64_numtype) = F64_valtype
+
+def valtype_reftype : reftype -> valtype
+  def valtype_reftype(FUNCREF_reftype) = FUNCREF_valtype
+  def valtype_reftype(EXTERNREF_reftype) = EXTERNREF_valtype
+
+def valtype_vectype : vectype -> valtype
+  def valtype_vectype(V128_vectype) = V128_valtype
+
+;; 1-syntax.watsup:48.1-48.39
+syntax in =
+  | I32
+  | I64
+
+def numtype_in : in -> numtype
+  def numtype_in(I32_in) = I32_numtype
+  def numtype_in(I64_in) = I64_numtype
+
+def valtype_in : in -> valtype
+  def valtype_in(I32_in) = I32_valtype
+  def valtype_in(I64_in) = I64_valtype
+
+;; 1-syntax.watsup:49.1-49.39
+syntax fn =
+  | F32
+  | F64
+
+def numtype_fn : fn -> numtype
+  def numtype_fn(F32_fn) = F32_numtype
+  def numtype_fn(F64_fn) = F64_numtype
+
+def valtype_fn : fn -> valtype
+  def valtype_fn(F32_fn) = F32_valtype
+  def valtype_fn(F64_fn) = F64_valtype
+
+;; 1-syntax.watsup:56.1-57.11
+syntax resulttype = valtype*
+
+;; 1-syntax.watsup:59.1-60.16
+syntax limits = `[%..%]`(u32, u32)
+
+;; 1-syntax.watsup:61.1-62.6
+syntax mutflag = MUT
+
+;; 1-syntax.watsup:63.1-64.19
+syntax globaltype = `%?%`(mutflag?, valtype)
+
+;; 1-syntax.watsup:65.1-66.27
+syntax functype = `%->%`(resulttype, resulttype)
+
+;; 1-syntax.watsup:67.1-68.17
+syntax tabletype = `%%`(limits, reftype)
+
+;; 1-syntax.watsup:69.1-70.12
+syntax memtype = `%I8`(limits)
+
+;; 1-syntax.watsup:71.1-72.10
+syntax elemtype = reftype
+
+;; 1-syntax.watsup:73.1-74.5
+syntax datatype = OK
+
+;; 1-syntax.watsup:75.1-76.69
+syntax externtype =
+  | GLOBAL(globaltype)
+  | FUNC(functype)
+  | TABLE(tabletype)
+  | MEMORY(memtype)
+
+;; 1-syntax.watsup:89.1-89.44
+syntax sx =
+  | U
+  | S
+
+;; 1-syntax.watsup:91.1-91.39
+syntax unop_IXX =
+  | CLZ
+  | CTZ
+  | POPCNT
+
+;; 1-syntax.watsup:92.1-92.70
+syntax unop_FXX =
+  | ABS
+  | NEG
+  | SQRT
+  | CEIL
+  | FLOOR
+  | TRUNC
+  | NEAREST
+
+;; 1-syntax.watsup:94.1-96.62
+syntax binop_IXX =
+  | ADD
+  | SUB
+  | MUL
+  | DIV(sx)
+  | REM(sx)
+  | AND
+  | OR
+  | XOR
+  | SHL
+  | SHR(sx)
+  | ROTL
+  | ROTR
+
+;; 1-syntax.watsup:97.1-97.66
+syntax binop_FXX =
+  | ADD
+  | SUB
+  | MUL
+  | DIV
+  | MIN
+  | MAX
+  | COPYSIGN
+
+;; 1-syntax.watsup:99.1-99.26
+syntax testop_IXX =
+  | EQZ
+
+;; 1-syntax.watsup:100.1-100.22
+syntax testop_FXX =
+  |
+
+;; 1-syntax.watsup:102.1-103.108
+syntax relop_IXX =
+  | EQ
+  | NE
+  | LT(sx)
+  | GT(sx)
+  | LE(sx)
+  | GE(sx)
+
+;; 1-syntax.watsup:104.1-104.49
+syntax relop_FXX =
+  | EQ
+  | NE
+  | LT
+  | GT
+  | LE
+  | GE
+
+;; 1-syntax.watsup:106.1-106.50
+syntax unop_numtype =
+  | _I(unop_IXX)
+  | _F(unop_FXX)
+
+;; 1-syntax.watsup:107.1-107.53
+syntax binop_numtype =
+  | _I(binop_IXX)
+  | _F(binop_FXX)
+
+;; 1-syntax.watsup:108.1-108.56
+syntax testop_numtype =
+  | _I(testop_IXX)
+  | _F(testop_FXX)
+
+;; 1-syntax.watsup:109.1-109.53
+syntax relop_numtype =
+  | _I(relop_IXX)
+  | _F(relop_FXX)
+
+;; 1-syntax.watsup:110.1-110.39
+syntax cvtop =
+  | CONVERT
+  | REINTERPRET
+
+;; 1-syntax.watsup:120.1-120.23
+syntax c_numtype = nat
+
+;; 1-syntax.watsup:121.1-121.23
+syntax c_vectype = nat
+
+;; 1-syntax.watsup:124.1-124.52
+syntax blocktype = functype
+
+;; 1-syntax.watsup:159.1-180.55
+rec {
+
+;; 1-syntax.watsup:159.1-180.55
+syntax instr =
+  | UNREACHABLE
+  | NOP
+  | DROP
+  | SELECT(valtype?)
+  | BLOCK(blocktype, instr*)
+  | LOOP(blocktype, instr*)
+  | IF(blocktype, instr*, instr*)
+  | BR(labelidx)
+  | BR_IF(labelidx)
+  | BR_TABLE(labelidx*, labelidx)
+  | CALL(funcidx)
+  | CALL_INDIRECT(tableidx, functype)
+  | RETURN
+  | CONST(numtype, c_numtype)
+  | UNOP(numtype, unop_numtype)
+  | BINOP(numtype, binop_numtype)
+  | TESTOP(numtype, testop_numtype)
+  | RELOP(numtype, relop_numtype)
+  | EXTEND(numtype, n)
+  | CVTOP(numtype, cvtop, numtype, sx?)
+  | REF.NULL(reftype)
+  | REF.FUNC(funcidx)
+  | REF.IS_NULL
+  | LOCAL.GET(localidx)
+  | LOCAL.SET(localidx)
+  | LOCAL.TEE(localidx)
+  | GLOBAL.GET(globalidx)
+  | GLOBAL.SET(globalidx)
+  | TABLE.GET(tableidx)
+  | TABLE.SET(tableidx)
+  | TABLE.SIZE(tableidx)
+  | TABLE.GROW(tableidx)
+  | TABLE.FILL(tableidx)
+  | TABLE.COPY(tableidx, tableidx)
+  | TABLE.INIT(tableidx, elemidx)
+  | ELEM.DROP(elemidx)
+  | MEMORY.SIZE
+  | MEMORY.GROW
+  | MEMORY.FILL
+  | MEMORY.COPY
+  | MEMORY.INIT(dataidx)
+  | DATA.DROP(dataidx)
+  | LOAD(numtype, (n, sx)?, nat, nat)
+  | STORE(numtype, n?, nat, nat)
+}
+
+;; 1-syntax.watsup:182.1-183.9
+syntax expr = instr*
+
+;; 1-syntax.watsup:188.1-188.50
+syntax elemmode =
+  | TABLE(tableidx, expr)
+  | DECLARE
+
+;; 1-syntax.watsup:189.1-189.39
+syntax datamode =
+  | MEMORY(memidx, expr)
+
+;; 1-syntax.watsup:191.1-192.30
+syntax func = `FUNC%%*%`(functype, valtype*, expr)
+
+;; 1-syntax.watsup:193.1-194.25
+syntax global = GLOBAL(globaltype, expr)
+
+;; 1-syntax.watsup:195.1-196.18
+syntax table = TABLE(tabletype)
+
+;; 1-syntax.watsup:197.1-198.17
+syntax mem = MEMORY(memtype)
+
+;; 1-syntax.watsup:199.1-200.31
+syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
+
+;; 1-syntax.watsup:201.1-202.26
+syntax data = `DATA(*)%*%?`(byte**, datamode?)
+
+;; 1-syntax.watsup:203.1-204.16
+syntax start = START(funcidx)
+
+;; 1-syntax.watsup:206.1-207.65
+syntax externuse =
+  | FUNC(funcidx)
+  | GLOBAL(globalidx)
+  | TABLE(tableidx)
+  | MEMORY(memidx)
+
+;; 1-syntax.watsup:208.1-209.24
+syntax export = EXPORT(name, externuse)
+
+;; 1-syntax.watsup:210.1-211.30
+syntax import = IMPORT(name, name, externtype)
+
+;; 1-syntax.watsup:213.1-214.70
+syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
+
+;; 2-aux.watsup:5.1-5.55
+def size : valtype -> nat?
+  ;; 2-aux.watsup:6.1-6.20
+  def size(I32_valtype) = ?(32)
+  ;; 2-aux.watsup:7.1-7.20
+  def size(I64_valtype) = ?(64)
+  ;; 2-aux.watsup:8.1-8.20
+  def size(F32_valtype) = ?(32)
+  ;; 2-aux.watsup:9.1-9.20
+  def size(F64_valtype) = ?(64)
+  ;; 2-aux.watsup:10.1-10.22
+  def size(V128_valtype) = ?(128)
+  def {x : valtype} size(x) = ?()
+
+;; 2-aux.watsup:15.1-15.40
+def test_sub_ATOM_22 : n -> nat
+  ;; 2-aux.watsup:16.1-16.38
+  def {n_3_ATOM_y : n} test_sub_ATOM_22(n_3_ATOM_y) = 0
+
+;; 2-aux.watsup:18.1-18.26
+def curried_ : (n, n) -> nat
+  ;; 2-aux.watsup:19.1-19.39
+  def {n_1 : n, n_2 : n} curried_(n_1, n_2) = (n_1 + n_2)
+
+;; 2-aux.watsup:21.1-30.39
+syntax testfuse =
+  | AB_(nat, nat, nat)
+  | CD(nat, nat, nat)
+  | EF(nat, nat, nat)
+  | GH(nat, nat, nat)
+  | IJ(nat, nat, nat)
+  | KL(nat, nat, nat)
+  | MN(nat, nat, nat)
+  | OP(nat, nat, nat)
+  | QR(nat, nat, nat)
+
+;; 3-typing.watsup:3.1-6.60
+syntax context = {FUNC functype*, GLOBAL globaltype*, TABLE tabletype*, MEM memtype*, ELEM elemtype*, DATA datatype*, LOCAL valtype*, LABEL resulttype*, RETURN resulttype?}
+
+;; 3-typing.watsup:14.1-14.66
+relation Limits_ok: `|-%:%`(limits, nat)
+  ;; 3-typing.watsup:22.1-24.24
+  rule _ {k : nat, n_1 : n, n_2 : n}:
+    `|-%:%`(`[%..%]`(n_1, n_2), k)
+    -- if ((n_1 <= n_2) /\ (n_2 <= k))
+
+;; 3-typing.watsup:15.1-15.64
+relation Functype_ok: `|-%:OK`(functype)
+  ;; 3-typing.watsup:26.1-27.13
+  rule _ {ft : functype}:
+    `|-%:OK`(ft)
+
+;; 3-typing.watsup:16.1-16.66
+relation Globaltype_ok: `|-%:OK`(globaltype)
+  ;; 3-typing.watsup:29.1-30.13
+  rule _ {gt : globaltype}:
+    `|-%:OK`(gt)
+
+;; 3-typing.watsup:17.1-17.65
+relation Tabletype_ok: `|-%:OK`(tabletype)
+  ;; 3-typing.watsup:32.1-34.35
+  rule _ {lim : limits, rt : reftype}:
+    `|-%:OK`(`%%`(lim, rt))
+    -- Limits_ok: `|-%:%`(lim, ((2 ^ 32) - 1))
+
+;; 3-typing.watsup:18.1-18.63
+relation Memtype_ok: `|-%:OK`(memtype)
+  ;; 3-typing.watsup:36.1-38.33
+  rule _ {lim : limits}:
+    `|-%:OK`(`%I8`(lim))
+    -- Limits_ok: `|-%:%`(lim, (2 ^ 16))
+
+;; 3-typing.watsup:19.1-19.66
+relation Externtype_ok: `|-%:OK`(externtype)
+  ;; 3-typing.watsup:41.1-43.35
+  rule func {functype : functype}:
+    `|-%:OK`(FUNC_externtype(functype))
+    -- Functype_ok: `|-%:OK`(functype)
+
+  ;; 3-typing.watsup:45.1-47.39
+  rule global {globaltype : globaltype}:
+    `|-%:OK`(GLOBAL_externtype(globaltype))
+    -- Globaltype_ok: `|-%:OK`(globaltype)
+
+  ;; 3-typing.watsup:49.1-51.37
+  rule table {tabletype : tabletype}:
+    `|-%:OK`(TABLE_externtype(tabletype))
+    -- Tabletype_ok: `|-%:OK`(tabletype)
+
+  ;; 3-typing.watsup:53.1-55.33
+  rule mem {memtype : memtype}:
+    `|-%:OK`(MEMORY_externtype(memtype))
+    -- Memtype_ok: `|-%:OK`(memtype)
+
+;; 3-typing.watsup:61.1-61.65
+relation Valtype_sub: `|-%<:%`(valtype, valtype)
+  ;; 3-typing.watsup:64.1-65.12
+  rule refl {t : valtype}:
+    `|-%<:%`(t, t)
+
+  ;; 3-typing.watsup:67.1-68.14
+  rule bot {t : valtype}:
+    `|-%<:%`(BOT_valtype, t)
+
+;; 3-typing.watsup:62.1-62.72
+relation Resulttype_sub: `|-%*<:%*`(valtype*, valtype*)
+  ;; 3-typing.watsup:70.1-72.35
+  rule _ {t_1* : valtype*, t_2* : valtype*}:
+    `|-%*<:%*`(t_1*{t_1}, t_2*{t_2})
+    -- (Valtype_sub: `|-%<:%`(t_1, t_2))*{t_1 t_2}
+
+;; 3-typing.watsup:75.1-75.75
+relation Limits_sub: `|-%<:%`(limits, limits)
+  ;; 3-typing.watsup:83.1-86.21
+  rule _ {n_11 : n, n_12 : n, n_21 : n, n_22 : n}:
+    `|-%<:%`(`[%..%]`(n_11, n_12), `[%..%]`(n_21, n_22))
+    -- if (n_11 >= n_21)
+    -- if (n_12 <= n_22)
+
+;; 3-typing.watsup:76.1-76.73
+relation Functype_sub: `|-%<:%`(functype, functype)
+  ;; 3-typing.watsup:88.1-89.14
+  rule _ {ft : functype}:
+    `|-%<:%`(ft, ft)
+
+;; 3-typing.watsup:77.1-77.75
+relation Globaltype_sub: `|-%<:%`(globaltype, globaltype)
+  ;; 3-typing.watsup:91.1-92.14
+  rule _ {gt : globaltype}:
+    `|-%<:%`(gt, gt)
+
+;; 3-typing.watsup:78.1-78.74
+relation Tabletype_sub: `|-%<:%`(tabletype, tabletype)
+  ;; 3-typing.watsup:94.1-96.35
+  rule _ {lim_1 : limits, lim_2 : limits, rt : reftype}:
+    `|-%<:%`(`%%`(lim_1, rt), `%%`(lim_2, rt))
+    -- Limits_sub: `|-%<:%`(lim_1, lim_2)
+
+;; 3-typing.watsup:79.1-79.72
+relation Memtype_sub: `|-%<:%`(memtype, memtype)
+  ;; 3-typing.watsup:98.1-100.35
+  rule _ {lim_1 : limits, lim_2 : limits}:
+    `|-%<:%`(`%I8`(lim_1), `%I8`(lim_2))
+    -- Limits_sub: `|-%<:%`(lim_1, lim_2)
+
+;; 3-typing.watsup:80.1-80.75
+relation Externtype_sub: `|-%<:%`(externtype, externtype)
+  ;; 3-typing.watsup:103.1-105.35
+  rule func {ft_1 : functype, ft_2 : functype}:
+    `|-%<:%`(FUNC_externtype(ft_1), FUNC_externtype(ft_2))
+    -- Functype_sub: `|-%<:%`(ft_1, ft_2)
+
+  ;; 3-typing.watsup:107.1-109.37
+  rule global {gt_1 : globaltype, gt_2 : globaltype}:
+    `|-%<:%`(GLOBAL_externtype(gt_1), GLOBAL_externtype(gt_2))
+    -- Globaltype_sub: `|-%<:%`(gt_1, gt_2)
+
+  ;; 3-typing.watsup:111.1-113.36
+  rule table {tt_1 : tabletype, tt_2 : tabletype}:
+    `|-%<:%`(TABLE_externtype(tt_1), TABLE_externtype(tt_2))
+    -- Tabletype_sub: `|-%<:%`(tt_1, tt_2)
+
+  ;; 3-typing.watsup:115.1-117.34
+  rule mem {mt_1 : memtype, mt_2 : memtype}:
+    `|-%<:%`(MEMORY_externtype(mt_1), MEMORY_externtype(mt_2))
+    -- Memtype_sub: `|-%<:%`(mt_1, mt_2)
+
+;; 3-typing.watsup:172.1-172.76
+relation Blocktype_ok: `%|-%:%`(context, blocktype, functype)
+  ;; 3-typing.watsup:174.1-176.29
+  rule _ {C : context, ft : functype}:
+    `%|-%:%`(C, ft, ft)
+    -- Functype_ok: `|-%:OK`(ft)
+
+;; 3-typing.watsup:123.1-124.67
+rec {
+
+;; 3-typing.watsup:123.1-123.66
+relation Instr_ok: `%|-%:%`(context, instr, functype)
+  ;; 3-typing.watsup:153.1-154.34
+  rule unreachable {C : context, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, UNREACHABLE_instr, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:156.1-157.32
+  rule nop {C : context}:
+    `%|-%:%`(C, NOP_instr, `%->%`([], []))
+
+  ;; 3-typing.watsup:159.1-160.27
+  rule drop {C : context, t : valtype}:
+    `%|-%:%`(C, DROP_instr, `%->%`([t], []))
+
+  ;; 3-typing.watsup:163.1-164.31
+  rule select-expl {C : context, t : valtype}:
+    `%|-%:%`(C, SELECT_instr(?(t)), `%->%`([t t I32_valtype], [t]))
+
+  ;; 3-typing.watsup:166.1-169.37
+  rule select-impl {C : context, numtype : numtype, t : valtype, t' : valtype, vectype : vectype}:
+    `%|-%:%`(C, SELECT_instr(?()), `%->%`([t t I32_valtype], [t]))
+    -- Valtype_sub: `|-%<:%`(t, t')
+    -- if ((t' = $valtype_numtype(numtype)) \/ (t' = $valtype_vectype(vectype)))
+
+  ;; 3-typing.watsup:178.1-181.57
+  rule block {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BLOCK_instr(bt, instr*{instr}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:183.1-186.57
+  rule loop {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, LOOP_instr(bt, instr*{instr}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_1]*{t_1}, RETURN ?()}, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:188.1-192.59
+  rule if {C : context, bt : blocktype, instr_1* : instr*, instr_2* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, IF_instr(bt, instr_1*{instr_1}, instr_2*{instr_2}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr_1*{instr_1}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr_2*{instr_2}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:195.1-197.24
+  rule br {C : context, l : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BR_instr(l), `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- if (C.LABEL_context[l] = t*{t})
+
+  ;; 3-typing.watsup:199.1-201.24
+  rule br_if {C : context, l : labelidx, t* : valtype*}:
+    `%|-%:%`(C, BR_IF_instr(l), `%->%`(t*{t} :: [I32_valtype], t*{t}))
+    -- if (C.LABEL_context[l] = t*{t})
+
+  ;; 3-typing.watsup:203.1-206.42
+  rule br_table {C : context, l* : labelidx*, l' : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BR_TABLE_instr(l*{l}, l'), `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- (Resulttype_sub: `|-%*<:%*`(t*{t}, C.LABEL_context[l]))*{l}
+    -- Resulttype_sub: `|-%*<:%*`(t*{t}, C.LABEL_context[l'])
+
+  ;; 3-typing.watsup:208.1-210.24
+  rule return {C : context, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, RETURN_instr, `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- if (C.RETURN_context = ?(t*{t}))
+
+  ;; 3-typing.watsup:212.1-214.33
+  rule call {C : context, t_1* : valtype*, t_2* : valtype*, x : idx}:
+    `%|-%:%`(C, CALL_instr(x), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- if (C.FUNC_context[x] = `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:216.1-219.26
+  rule call_indirect {C : context, ft : functype, lim : limits, t_1* : valtype*, t_2* : valtype*, x : idx}:
+    `%|-%:%`(C, CALL_INDIRECT_instr(x, ft), `%->%`(t_1*{t_1} :: [I32_valtype], t_2*{t_2}))
+    -- if (C.TABLE_context[x] = `%%`(lim, FUNCREF_reftype))
+    -- if (ft = `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:222.1-223.37
+  rule const {C : context, c_nt : c_numtype, nt : numtype}:
+    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [$valtype_numtype(nt)]))
+
+  ;; 3-typing.watsup:225.1-226.31
+  rule unop {C : context, nt : numtype, unop : unop_numtype}:
+    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([$valtype_numtype(nt)], [$valtype_numtype(nt)]))
+
+  ;; 3-typing.watsup:228.1-229.36
+  rule binop {C : context, binop : binop_numtype, nt : numtype}:
+    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([$valtype_numtype(nt) $valtype_numtype(nt)], [$valtype_numtype(nt)]))
+
+  ;; 3-typing.watsup:231.1-232.36
+  rule testop {C : context, nt : numtype, testop : testop_numtype}:
+    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([$valtype_numtype(nt)], [I32_valtype]))
+
+  ;; 3-typing.watsup:234.1-235.37
+  rule relop {C : context, nt : numtype, relop : relop_numtype}:
+    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([$valtype_numtype(nt) $valtype_numtype(nt)], [I32_valtype]))
+
+  ;; 3-typing.watsup:238.1-240.23
+  rule extend {C : context, n : n, nt : numtype}:
+    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([$valtype_numtype(nt)], [$valtype_numtype(nt)]))
+    -- if (n <= !($size($valtype_numtype(nt))))
+
+  ;; 3-typing.watsup:242.1-245.34
+  rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype}:
+    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([$valtype_numtype(nt_2)], [$valtype_numtype(nt_1)]))
+    -- if (nt_1 =/= nt_2)
+    -- if (!($size($valtype_numtype(nt_1))) = !($size($valtype_numtype(nt_2))))
+
+  ;; 3-typing.watsup:247.1-250.52
+  rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?}:
+    `%|-%:%`(C, CVTOP_instr($numtype_in(in_1), CONVERT_cvtop, $numtype_in(in_2), sx?{sx}), `%->%`([$valtype_in(in_2)], [$valtype_in(in_1)]))
+    -- if (in_1 =/= in_2)
+    -- if ((sx?{sx} = ?()) <=> (!($size($valtype_in(in_1))) > !($size($valtype_in(in_2)))))
+
+  ;; 3-typing.watsup:252.1-254.22
+  rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
+    `%|-%:%`(C, CVTOP_instr($numtype_fn(fn_1), CONVERT_cvtop, $numtype_fn(fn_2), ?()), `%->%`([$valtype_fn(fn_2)], [$valtype_fn(fn_1)]))
+    -- if (fn_1 =/= fn_2)
+
+  ;; 3-typing.watsup:257.1-258.35
+  rule ref.null {C : context, rt : reftype}:
+    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [$valtype_reftype(rt)]))
+
+  ;; 3-typing.watsup:260.1-262.23
+  rule ref.func {C : context, ft : functype, x : idx}:
+    `%|-%:%`(C, REF.FUNC_instr(x), `%->%`([], [FUNCREF_valtype]))
+    -- if (C.FUNC_context[x] = ft)
+
+  ;; 3-typing.watsup:264.1-265.31
+  rule ref.is_null {C : context, rt : reftype}:
+    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([$valtype_reftype(rt)], [I32_valtype]))
+
+  ;; 3-typing.watsup:268.1-270.23
+  rule local.get {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.GET_instr(x), `%->%`([], [t]))
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:272.1-274.23
+  rule local.set {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.SET_instr(x), `%->%`([t], []))
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:276.1-278.23
+  rule local.tee {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.TEE_instr(x), `%->%`([t], [t]))
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:281.1-283.29
+  rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
+    `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
+    -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
+
+  ;; 3-typing.watsup:285.1-287.28
+  rule global.set {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
+    -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
+
+  ;; 3-typing.watsup:290.1-292.28
+  rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [$valtype_reftype(rt)]))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:294.1-296.28
+  rule table.set {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype $valtype_reftype(rt)], []))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:298.1-300.24
+  rule table.size {C : context, tt : tabletype, x : idx}:
+    `%|-%:%`(C, TABLE.SIZE_instr(x), `%->%`([], [I32_valtype]))
+    -- if (C.TABLE_context[x] = tt)
+
+  ;; 3-typing.watsup:302.1-304.28
+  rule table.grow {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([$valtype_reftype(rt) I32_valtype], [I32_valtype]))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:306.1-308.28
+  rule table.fill {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype $valtype_reftype(rt) I32_valtype], []))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:310.1-313.32
+  rule table.copy {C : context, lim_1 : limits, lim_2 : limits, rt : reftype, x_1 : idx, x_2 : idx}:
+    `%|-%:%`(C, TABLE.COPY_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (C.TABLE_context[x_1] = `%%`(lim_1, rt))
+    -- if (C.TABLE_context[x_2] = `%%`(lim_2, rt))
+
+  ;; 3-typing.watsup:315.1-318.25
+  rule table.init {C : context, lim : limits, rt : reftype, x_1 : idx, x_2 : idx}:
+    `%|-%:%`(C, TABLE.INIT_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (C.TABLE_context[x_1] = `%%`(lim, rt))
+    -- if (C.ELEM_context[x_2] = rt)
+
+  ;; 3-typing.watsup:320.1-322.23
+  rule elem.drop {C : context, rt : reftype, x : idx}:
+    `%|-%:%`(C, ELEM.DROP_instr(x), `%->%`([], []))
+    -- if (C.ELEM_context[x] = rt)
+
+  ;; 3-typing.watsup:325.1-327.22
+  rule memory.size {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.SIZE_instr, `%->%`([], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:329.1-331.22
+  rule memory.grow {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.GROW_instr, `%->%`([I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:333.1-335.22
+  rule memory.fill {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.FILL_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:337.1-339.22
+  rule memory.copy {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.COPY_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:341.1-344.23
+  rule memory.init {C : context, mt : memtype, x : idx}:
+    `%|-%:%`(C, MEMORY.INIT_instr(x), `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+    -- if (C.DATA_context[x] = OK)
+
+  ;; 3-typing.watsup:346.1-348.23
+  rule data.drop {C : context, x : idx}:
+    `%|-%:%`(C, DATA.DROP_instr(x), `%->%`([], []))
+    -- if (C.DATA_context[x] = OK)
+
+  ;; 3-typing.watsup:350.1-355.32
+  rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?}:
+    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [$valtype_numtype(nt)]))
+    -- if (C.MEM_context[0] = mt)
+    -- if ((2 ^ n_A) <= (!($size($valtype_numtype(nt))) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size($valtype_numtype(nt))) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
+
+  ;; 3-typing.watsup:357.1-362.32
+  rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype}:
+    `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype $valtype_numtype(nt)], []))
+    -- if (C.MEM_context[0] = mt)
+    -- if ((2 ^ n_A) <= (!($size($valtype_numtype(nt))) / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size($valtype_numtype(nt))) / 8))))?{n}
+    -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
+
+;; 3-typing.watsup:124.1-124.67
+relation InstrSeq_ok: `%|-%*:%`(context, instr*, functype)
+  ;; 3-typing.watsup:133.1-134.36
+  rule empty {C : context}:
+    `%|-%*:%`(C, [], `%->%`([], []))
+
+  ;; 3-typing.watsup:136.1-139.46
+  rule seq {C : context, instr_1 : instr, instr_2 : instr, t_1* : valtype*, t_2* : valtype*, t_3* : valtype*}:
+    `%|-%*:%`(C, [instr_1] :: instr_2*{}, `%->%`(t_1*{t_1}, t_3*{t_3}))
+    -- Instr_ok: `%|-%:%`(C, instr_1, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, [instr_2], `%->%`(t_2*{t_2}, t_3*{t_3}))
+
+  ;; 3-typing.watsup:141.1-146.38
+  rule weak {C : context, instr* : instr*, t'_1 : valtype, t'_2* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%*:%`(C, instr*{instr}, `%->%`([t'_1], t'_2*{t'_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Resulttype_sub: `|-%*<:%*`(t'_1*{}, t_1*{t_1})
+    -- Resulttype_sub: `|-%*<:%*`(t_2*{t_2}, t'_2*{t'_2})
+
+  ;; 3-typing.watsup:148.1-150.45
+  rule frame {C : context, instr* : instr*, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%*:%`(C, instr*{instr}, `%->%`(t*{t} :: t_1*{t_1}, t*{t} :: t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+}
+
+;; 3-typing.watsup:125.1-125.71
+relation Expr_ok: `%|-%:%`(context, expr, resulttype)
+  ;; 3-typing.watsup:128.1-130.46
+  rule _ {C : context, instr* : instr*, t* : valtype*}:
+    `%|-%:%`(C, instr*{instr}, t*{t})
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`([], t*{t}))
+
+;; 3-typing.watsup:367.1-367.78
+relation Instr_const: `%|-%CONST`(context, instr)
+  ;; 3-typing.watsup:371.1-372.26
+  rule const {C : context, c : c_numtype, nt : numtype}:
+    `%|-%CONST`(C, CONST_instr(nt, c))
+
+  ;; 3-typing.watsup:374.1-375.27
+  rule ref.null {C : context, rt : reftype}:
+    `%|-%CONST`(C, REF.NULL_instr(rt))
+
+  ;; 3-typing.watsup:377.1-378.26
+  rule ref.func {C : context, x : idx}:
+    `%|-%CONST`(C, REF.FUNC_instr(x))
+
+  ;; 3-typing.watsup:380.1-382.32
+  rule global.get {C : context, t : valtype, x : idx}:
+    `%|-%CONST`(C, GLOBAL.GET_instr(x))
+    -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
+
+;; 3-typing.watsup:368.1-368.77
+relation Expr_const: `%|-%CONST`(context, expr)
+  ;; 3-typing.watsup:385.1-386.38
+  rule _ {C : context, instr* : instr*}:
+    `%|-%CONST`(C, instr*{instr})
+    -- (Instr_const: `%|-%CONST`(C, instr))*{instr}
+
+;; 3-typing.watsup:369.1-369.78
+relation Expr_ok_const: `%|-%:%CONST`(context, expr, valtype)
+  ;; 3-typing.watsup:389.1-392.33
+  rule _ {C : context, expr : expr, t : valtype}:
+    `%|-%:%CONST`(C, expr, t)
+    -- Expr_ok: `%|-%:%`(C, expr, [t])
+    -- Expr_const: `%|-%CONST`(C, expr)
+
+;; 3-typing.watsup:397.1-397.73
+relation Func_ok: `%|-%:%`(context, func, functype)
+  ;; 3-typing.watsup:408.1-412.75
+  rule _ {C : context, expr : expr, ft : functype, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, `FUNC%%*%`(ft, t*{t}, expr), ft)
+    -- if (ft = `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Functype_ok: `|-%:OK`(ft)
+    -- Expr_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL t_1*{t_1} :: t*{t}, LABEL [], RETURN ?()} ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2*{t_2}], RETURN ?()} ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [], RETURN ?(t_2*{t_2})}, expr, t_2*{t_2})
+
+;; 3-typing.watsup:398.1-398.75
+relation Global_ok: `%|-%:%`(context, global, globaltype)
+  ;; 3-typing.watsup:414.1-418.40
+  rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
+    `%|-%:%`(C, GLOBAL(gt, expr), gt)
+    -- Globaltype_ok: `|-%:OK`(gt)
+    -- if (gt = `%?%`(MUT?{}, t))
+    -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
+
+;; 3-typing.watsup:399.1-399.74
+relation Table_ok: `%|-%:%`(context, table, tabletype)
+  ;; 3-typing.watsup:420.1-422.30
+  rule _ {C : context, tt : tabletype}:
+    `%|-%:%`(C, TABLE(tt), tt)
+    -- Tabletype_ok: `|-%:OK`(tt)
+
+;; 3-typing.watsup:400.1-400.72
+relation Mem_ok: `%|-%:%`(context, mem, memtype)
+  ;; 3-typing.watsup:424.1-426.28
+  rule _ {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY(mt), mt)
+    -- Memtype_ok: `|-%:OK`(mt)
+
+;; 3-typing.watsup:403.1-403.77
+relation Elemmode_ok: `%|-%:%`(context, elemmode, reftype)
+  ;; 3-typing.watsup:437.1-440.45
+  rule active {C : context, expr : expr, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE_elemmode(x, expr), rt)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+    -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*{}
+
+  ;; 3-typing.watsup:442.1-443.20
+  rule declare {C : context, rt : reftype}:
+    `%|-%:%`(C, DECLARE_elemmode, rt)
+
+;; 3-typing.watsup:401.1-401.73
+relation Elem_ok: `%|-%:%`(context, elem, reftype)
+  ;; 3-typing.watsup:428.1-431.40
+  rule _ {C : context, elemmode? : elemmode?, expr* : expr*, rt : reftype}:
+    `%|-%:%`(C, `ELEM%%*%?`(rt, expr*{expr}, elemmode?{elemmode}), rt)
+    -- (Expr_ok: `%|-%:%`(C, expr, [$valtype_reftype(rt)]))*{expr}
+    -- (Elemmode_ok: `%|-%:%`(C, elemmode, rt))?{elemmode}
+
+;; 3-typing.watsup:404.1-404.77
+relation Datamode_ok: `%|-%:OK`(context, datamode)
+  ;; 3-typing.watsup:445.1-448.45
+  rule _ {C : context, expr : expr, mt : memtype}:
+    `%|-%:OK`(C, MEMORY_datamode(0, expr))
+    -- if (C.MEM_context[0] = mt)
+    -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*{}
+
+;; 3-typing.watsup:402.1-402.73
+relation Data_ok: `%|-%:OK`(context, data)
+  ;; 3-typing.watsup:433.1-435.40
+  rule _ {C : context, b** : byte**, datamode? : datamode?}:
+    `%|-%:OK`(C, `DATA(*)%*%?`(b*{b}*{b}, datamode?{datamode}))
+    -- (Datamode_ok: `%|-%:OK`(C, datamode))?{datamode}
+
+;; 3-typing.watsup:405.1-405.74
+relation Start_ok: `%|-%:OK`(context, start)
+  ;; 3-typing.watsup:450.1-452.39
+  rule _ {C : context, x : idx}:
+    `%|-%:OK`(C, START(x))
+    -- if (C.FUNC_context[x] = `%->%`([], []))
+
+;; 3-typing.watsup:455.1-455.80
+relation Import_ok: `%|-%:%`(context, import, externtype)
+  ;; 3-typing.watsup:459.1-461.31
+  rule _ {C : context, name_1 : name, name_2 : name, xt : externtype}:
+    `%|-%:%`(C, IMPORT(name_1, name_2, xt), xt)
+    -- Externtype_ok: `|-%:OK`(xt)
+
+;; 3-typing.watsup:457.1-457.83
+relation Externuse_ok: `%|-%:%`(context, externuse, externtype)
+  ;; 3-typing.watsup:467.1-469.23
+  rule func {C : context, ft : functype, x : idx}:
+    `%|-%:%`(C, FUNC_externuse(x), FUNC_externtype(ft))
+    -- if (C.FUNC_context[x] = ft)
+
+  ;; 3-typing.watsup:471.1-473.25
+  rule global {C : context, gt : globaltype, x : idx}:
+    `%|-%:%`(C, GLOBAL_externuse(x), GLOBAL_externtype(gt))
+    -- if (C.GLOBAL_context[x] = gt)
+
+  ;; 3-typing.watsup:475.1-477.24
+  rule table {C : context, tt : tabletype, x : idx}:
+    `%|-%:%`(C, TABLE_externuse(x), TABLE_externtype(tt))
+    -- if (C.TABLE_context[x] = tt)
+
+  ;; 3-typing.watsup:479.1-481.22
+  rule mem {C : context, mt : memtype, x : idx}:
+    `%|-%:%`(C, MEMORY_externuse(x), MEMORY_externtype(mt))
+    -- if (C.MEM_context[x] = mt)
+
+;; 3-typing.watsup:456.1-456.80
+relation Export_ok: `%|-%:%`(context, export, externtype)
+  ;; 3-typing.watsup:463.1-465.39
+  rule _ {C : context, externuse : externuse, name : name, xt : externtype}:
+    `%|-%:%`(C, EXPORT(name, externuse), xt)
+    -- Externuse_ok: `%|-%:%`(C, externuse, xt)
+
+;; 3-typing.watsup:484.1-484.62
+relation Module_ok: `|-%:OK`(module)
+  ;; 3-typing.watsup:486.1-501.22
+  rule _ {C : context, data^n : data^n, elem* : elem*, export* : export*, ft* : functype*, func* : func*, global* : global*, gt* : globaltype*, import* : import*, mem* : mem*, mt* : memtype*, n : n, rt* : reftype*, start* : start*, table* : table*, tt* : tabletype*}:
+    `|-%:OK`(`MODULE%*%*%*%*%*%*%*%*%*`(import*{import}, func*{func}, global*{global}, table*{table}, mem*{mem}, elem*{elem}, data^n{data}, start*{start}, export*{export}))
+    -- if (C = {FUNC ft*{ft}, GLOBAL gt*{gt}, TABLE tt*{tt}, MEM mt*{mt}, ELEM rt*{rt}, DATA OK^n{}, LOCAL [], LABEL [], RETURN ?()})
+    -- (Func_ok: `%|-%:%`(C, func, ft))*{ft func}
+    -- (Global_ok: `%|-%:%`(C, global, gt))*{global gt}
+    -- (Table_ok: `%|-%:%`(C, table, tt))*{table tt}
+    -- (Mem_ok: `%|-%:%`(C, mem, mt))*{mem mt}
+    -- (Elem_ok: `%|-%:%`(C, elem, rt))*{elem rt}
+    -- (Data_ok: `%|-%:OK`(C, data))^n{data}
+    -- (Start_ok: `%|-%:OK`(C, start))*{start}
+    -- if (|mem*{mem}| <= 1)
+    -- if (|start*{start}| <= 1)
+
+;; 4-runtime.watsup:3.1-3.39
+syntax addr = nat
+
+;; 4-runtime.watsup:4.1-4.53
+syntax funcaddr = addr
+
+;; 4-runtime.watsup:5.1-5.53
+syntax globaladdr = addr
+
+;; 4-runtime.watsup:6.1-6.51
+syntax tableaddr = addr
+
+;; 4-runtime.watsup:7.1-7.50
+syntax memaddr = addr
+
+;; 4-runtime.watsup:8.1-8.49
+syntax elemaddr = addr
+
+;; 4-runtime.watsup:9.1-9.49
+syntax dataaddr = addr
+
+;; 4-runtime.watsup:10.1-10.51
+syntax labeladdr = addr
+
+;; 4-runtime.watsup:11.1-11.49
+syntax hostaddr = addr
+
+;; 4-runtime.watsup:24.1-25.24
+syntax num =
+  | CONST(numtype, c_numtype)
+
+;; 4-runtime.watsup:26.1-27.67
+syntax ref =
+  | REF.NULL(reftype)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+
+;; 4-runtime.watsup:28.1-29.10
+syntax val =
+  | CONST(numtype, c_numtype)
+  | REF.NULL(reftype)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+
+;; 4-runtime.watsup:31.1-32.18
+syntax result =
+  | _VALS(val*)
+  | TRAP
+
+;; 4-runtime.watsup:38.1-39.66
+syntax externval =
+  | FUNC(funcaddr)
+  | GLOBAL(globaladdr)
+  | TABLE(tableaddr)
+  | MEM(memaddr)
+
+;; 4-runtime.watsup:44.1-44.44
+def default_ : valtype -> val?
+  ;; 4-runtime.watsup:45.1-45.35
+  def default_(I32_valtype) = ?(CONST_val(I32_numtype, 0))
+  ;; 4-runtime.watsup:46.1-46.35
+  def default_(I64_valtype) = ?(CONST_val(I64_numtype, 0))
+  ;; 4-runtime.watsup:47.1-47.35
+  def default_(F32_valtype) = ?(CONST_val(F32_numtype, 0))
+  ;; 4-runtime.watsup:48.1-48.35
+  def default_(F64_valtype) = ?(CONST_val(F64_numtype, 0))
+  ;; 4-runtime.watsup:49.1-49.44
+  def default_(FUNCREF_valtype) = ?(REF.NULL_val(FUNCREF_reftype))
+  ;; 4-runtime.watsup:50.1-50.48
+  def default_(EXTERNREF_valtype) = ?(REF.NULL_val(EXTERNREF_reftype))
+  def {x : valtype} default_(x) = ?()
+
+;; 4-runtime.watsup:61.1-61.71
+syntax exportinst = EXPORT(name, externval)
+
+;; 4-runtime.watsup:71.1-78.25
+syntax moduleinst = {FUNC funcaddr*, GLOBAL globaladdr*, TABLE tableaddr*, MEM memaddr*, ELEM elemaddr*, DATA dataaddr*, EXPORT exportinst*}
+
+;; 4-runtime.watsup:55.1-55.66
+syntax funcinst = `%;%`(moduleinst, func)
+
+;; 4-runtime.watsup:56.1-56.53
+syntax globalinst = val
+
+;; 4-runtime.watsup:57.1-57.52
+syntax tableinst = ref*
+
+;; 4-runtime.watsup:58.1-58.52
+syntax meminst = byte*
+
+;; 4-runtime.watsup:59.1-59.53
+syntax eleminst = ref*
+
+;; 4-runtime.watsup:60.1-60.51
+syntax datainst = byte*
+
+;; 4-runtime.watsup:63.1-69.21
+syntax store = {FUNC funcinst*, GLOBAL globalinst*, TABLE tableinst*, MEM meminst*, ELEM eleminst*, DATA datainst*}
+
+;; 4-runtime.watsup:80.1-82.24
+syntax frame = {LOCAL val*, MODULE moduleinst}
+
+;; 4-runtime.watsup:83.1-83.47
+syntax state = `%;%`(store, frame)
+
+;; 4-runtime.watsup:140.1-147.5
+rec {
+
+;; 4-runtime.watsup:140.1-147.5
+syntax admininstr =
+  | UNREACHABLE
+  | NOP
+  | DROP
+  | SELECT(valtype?)
+  | BLOCK(blocktype, instr*)
+  | LOOP(blocktype, instr*)
+  | IF(blocktype, instr*, instr*)
+  | BR(labelidx)
+  | BR_IF(labelidx)
+  | BR_TABLE(labelidx*, labelidx)
+  | CALL(funcidx)
+  | CALL_INDIRECT(tableidx, functype)
+  | RETURN
+  | CONST(numtype, c_numtype)
+  | UNOP(numtype, unop_numtype)
+  | BINOP(numtype, binop_numtype)
+  | TESTOP(numtype, testop_numtype)
+  | RELOP(numtype, relop_numtype)
+  | EXTEND(numtype, n)
+  | CVTOP(numtype, cvtop, numtype, sx?)
+  | REF.NULL(reftype)
+  | REF.FUNC(funcidx)
+  | REF.IS_NULL
+  | LOCAL.GET(localidx)
+  | LOCAL.SET(localidx)
+  | LOCAL.TEE(localidx)
+  | GLOBAL.GET(globalidx)
+  | GLOBAL.SET(globalidx)
+  | TABLE.GET(tableidx)
+  | TABLE.SET(tableidx)
+  | TABLE.SIZE(tableidx)
+  | TABLE.GROW(tableidx)
+  | TABLE.FILL(tableidx)
+  | TABLE.COPY(tableidx, tableidx)
+  | TABLE.INIT(tableidx, elemidx)
+  | ELEM.DROP(elemidx)
+  | MEMORY.SIZE
+  | MEMORY.GROW
+  | MEMORY.FILL
+  | MEMORY.COPY
+  | MEMORY.INIT(dataidx)
+  | DATA.DROP(dataidx)
+  | LOAD(numtype, (n, sx)?, nat, nat)
+  | STORE(numtype, n?, nat, nat)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+  | CALL_ADDR(funcaddr)
+  | LABEL_(n, instr*, admininstr*)
+  | FRAME_(n, frame, admininstr*)
+  | TRAP
+}
+
+def admininstr_globalinst : globalinst -> admininstr
+  def {x : (numtype, c_numtype)} admininstr_globalinst(CONST_val(x)) = CONST_admininstr(x)
+  def {x : reftype} admininstr_globalinst(REF.NULL_val(x)) = REF.NULL_admininstr(x)
+  def {x : funcaddr} admininstr_globalinst(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
+  def {x : hostaddr} admininstr_globalinst(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
+
+def admininstr_instr : instr -> admininstr
+  def admininstr_instr(UNREACHABLE_instr) = UNREACHABLE_admininstr
+  def admininstr_instr(NOP_instr) = NOP_admininstr
+  def admininstr_instr(DROP_instr) = DROP_admininstr
+  def {x : valtype?} admininstr_instr(SELECT_instr(x)) = SELECT_admininstr(x)
+  def {x : (blocktype, instr*)} admininstr_instr(BLOCK_instr(x)) = BLOCK_admininstr(x)
+  def {x : (blocktype, instr*)} admininstr_instr(LOOP_instr(x)) = LOOP_admininstr(x)
+  def {x : (blocktype, instr*, instr*)} admininstr_instr(IF_instr(x)) = IF_admininstr(x)
+  def {x : labelidx} admininstr_instr(BR_instr(x)) = BR_admininstr(x)
+  def {x : labelidx} admininstr_instr(BR_IF_instr(x)) = BR_IF_admininstr(x)
+  def {x : (labelidx*, labelidx)} admininstr_instr(BR_TABLE_instr(x)) = BR_TABLE_admininstr(x)
+  def {x : funcidx} admininstr_instr(CALL_instr(x)) = CALL_admininstr(x)
+  def {x : (tableidx, functype)} admininstr_instr(CALL_INDIRECT_instr(x)) = CALL_INDIRECT_admininstr(x)
+  def admininstr_instr(RETURN_instr) = RETURN_admininstr
+  def {x : (numtype, c_numtype)} admininstr_instr(CONST_instr(x)) = CONST_admininstr(x)
+  def {x : (numtype, unop_numtype)} admininstr_instr(UNOP_instr(x)) = UNOP_admininstr(x)
+  def {x : (numtype, binop_numtype)} admininstr_instr(BINOP_instr(x)) = BINOP_admininstr(x)
+  def {x : (numtype, testop_numtype)} admininstr_instr(TESTOP_instr(x)) = TESTOP_admininstr(x)
+  def {x : (numtype, relop_numtype)} admininstr_instr(RELOP_instr(x)) = RELOP_admininstr(x)
+  def {x : (numtype, n)} admininstr_instr(EXTEND_instr(x)) = EXTEND_admininstr(x)
+  def {x : (numtype, cvtop, numtype, sx?)} admininstr_instr(CVTOP_instr(x)) = CVTOP_admininstr(x)
+  def {x : reftype} admininstr_instr(REF.NULL_instr(x)) = REF.NULL_admininstr(x)
+  def {x : funcidx} admininstr_instr(REF.FUNC_instr(x)) = REF.FUNC_admininstr(x)
+  def admininstr_instr(REF.IS_NULL_instr) = REF.IS_NULL_admininstr
+  def {x : localidx} admininstr_instr(LOCAL.GET_instr(x)) = LOCAL.GET_admininstr(x)
+  def {x : localidx} admininstr_instr(LOCAL.SET_instr(x)) = LOCAL.SET_admininstr(x)
+  def {x : localidx} admininstr_instr(LOCAL.TEE_instr(x)) = LOCAL.TEE_admininstr(x)
+  def {x : globalidx} admininstr_instr(GLOBAL.GET_instr(x)) = GLOBAL.GET_admininstr(x)
+  def {x : globalidx} admininstr_instr(GLOBAL.SET_instr(x)) = GLOBAL.SET_admininstr(x)
+  def {x : tableidx} admininstr_instr(TABLE.GET_instr(x)) = TABLE.GET_admininstr(x)
+  def {x : tableidx} admininstr_instr(TABLE.SET_instr(x)) = TABLE.SET_admininstr(x)
+  def {x : tableidx} admininstr_instr(TABLE.SIZE_instr(x)) = TABLE.SIZE_admininstr(x)
+  def {x : tableidx} admininstr_instr(TABLE.GROW_instr(x)) = TABLE.GROW_admininstr(x)
+  def {x : tableidx} admininstr_instr(TABLE.FILL_instr(x)) = TABLE.FILL_admininstr(x)
+  def {x : (tableidx, tableidx)} admininstr_instr(TABLE.COPY_instr(x)) = TABLE.COPY_admininstr(x)
+  def {x : (tableidx, elemidx)} admininstr_instr(TABLE.INIT_instr(x)) = TABLE.INIT_admininstr(x)
+  def {x : elemidx} admininstr_instr(ELEM.DROP_instr(x)) = ELEM.DROP_admininstr(x)
+  def admininstr_instr(MEMORY.SIZE_instr) = MEMORY.SIZE_admininstr
+  def admininstr_instr(MEMORY.GROW_instr) = MEMORY.GROW_admininstr
+  def admininstr_instr(MEMORY.FILL_instr) = MEMORY.FILL_admininstr
+  def admininstr_instr(MEMORY.COPY_instr) = MEMORY.COPY_admininstr
+  def {x : dataidx} admininstr_instr(MEMORY.INIT_instr(x)) = MEMORY.INIT_admininstr(x)
+  def {x : dataidx} admininstr_instr(DATA.DROP_instr(x)) = DATA.DROP_admininstr(x)
+  def {x : (numtype, (n, sx)?, nat, nat)} admininstr_instr(LOAD_instr(x)) = LOAD_admininstr(x)
+  def {x : (numtype, n?, nat, nat)} admininstr_instr(STORE_instr(x)) = STORE_admininstr(x)
+
+def admininstr_ref : ref -> admininstr
+  def {x : reftype} admininstr_ref(REF.NULL_ref(x)) = REF.NULL_admininstr(x)
+  def {x : funcaddr} admininstr_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_admininstr(x)
+  def {x : hostaddr} admininstr_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_admininstr(x)
+
+def admininstr_val : val -> admininstr
+  def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
+  def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
+  def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
+  def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
+
+;; 4-runtime.watsup:84.1-84.62
+syntax config = `%;%*`(state, admininstr*)
+
+;; 4-runtime.watsup:102.1-102.59
+def funcaddr : state -> funcaddr*
+  ;; 4-runtime.watsup:103.1-103.38
+  def {f : frame, s : store} funcaddr(`%;%`(s, f)) = f.MODULE_frame.FUNC_moduleinst
+
+;; 4-runtime.watsup:105.1-105.52
+def funcinst : state -> funcinst*
+  ;; 4-runtime.watsup:106.1-106.31
+  def {f : frame, s : store} funcinst(`%;%`(s, f)) = s.FUNC_store
+
+;; 4-runtime.watsup:108.1-108.67
+def func : (state, funcidx) -> funcinst
+  ;; 4-runtime.watsup:116.1-116.48
+  def {f : frame, s : store, x : idx} func(`%;%`(s, f), x) = s.FUNC_store[f.MODULE_frame.FUNC_moduleinst[x]]
+
+;; 4-runtime.watsup:109.1-109.69
+def global : (state, globalidx) -> globalinst
+  ;; 4-runtime.watsup:117.1-117.54
+  def {f : frame, s : store, x : idx} global(`%;%`(s, f), x) = s.GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]]
+
+;; 4-runtime.watsup:110.1-110.68
+def table : (state, tableidx) -> tableinst
+  ;; 4-runtime.watsup:118.1-118.51
+  def {f : frame, s : store, x : idx} table(`%;%`(s, f), x) = s.TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]]
+
+;; 4-runtime.watsup:111.1-111.66
+def mem : (state, memidx) -> meminst
+  ;; 4-runtime.watsup:119.1-119.45
+  def {f : frame, s : store, x : idx} mem(`%;%`(s, f), x) = s.MEM_store[f.MODULE_frame.MEM_moduleinst[x]]
+
+;; 4-runtime.watsup:112.1-112.67
+def elem : (state, tableidx) -> eleminst
+  ;; 4-runtime.watsup:120.1-120.48
+  def {f : frame, s : store, x : idx} elem(`%;%`(s, f), x) = s.ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]]
+
+;; 4-runtime.watsup:113.1-113.67
+def data : (state, dataidx) -> datainst
+  ;; 4-runtime.watsup:121.1-121.48
+  def {f : frame, s : store, x : idx} data(`%;%`(s, f), x) = s.DATA_store[f.MODULE_frame.DATA_moduleinst[x]]
+
+;; 4-runtime.watsup:114.1-114.68
+def local : (state, localidx) -> val
+  ;; 4-runtime.watsup:122.1-122.35
+  def {f : frame, s : store, x : idx} local(`%;%`(s, f), x) = f.LOCAL_frame[x]
+
+;; 4-runtime.watsup:125.1-125.78
+def with_local : (state, localidx, val) -> state
+  ;; 4-runtime.watsup:131.1-131.52
+  def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL[x] = v])
+
+;; 4-runtime.watsup:126.1-126.79
+def with_global : (state, globalidx, val) -> state
+  ;; 4-runtime.watsup:132.1-132.71
+  def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
+
+;; 4-runtime.watsup:127.1-127.81
+def with_table : (state, tableidx, n, ref) -> state
+  ;; 4-runtime.watsup:133.1-133.74
+  def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
+
+;; 4-runtime.watsup:128.1-128.80
+def with_tableext : (state, tableidx, ref*) -> state
+  ;; 4-runtime.watsup:134.1-134.75
+  def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
+
+;; 4-runtime.watsup:129.1-129.77
+def with_elem : (state, elemidx, ref*) -> state
+  ;; 4-runtime.watsup:135.1-135.69
+  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
+
+;; 4-runtime.watsup:149.1-152.21
+rec {
+
+;; 4-runtime.watsup:149.1-152.21
+syntax E =
+  | _HOLE
+  | _SEQ(val*, E, instr*)
+  | LABEL_(n, instr*, E)
+}
+
+;; 5-numerics.watsup:3.1-3.76
+def unop : (unop_numtype, numtype, c_numtype) -> c_numtype*
+
+;; 5-numerics.watsup:4.1-4.79
+def binop : (binop_numtype, numtype, c_numtype, c_numtype) -> c_numtype*
+
+;; 5-numerics.watsup:5.1-5.76
+def testop : (testop_numtype, numtype, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:6.1-6.79
+def relop : (relop_numtype, numtype, c_numtype, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:8.1-8.84
+def ext : (nat, nat, sx, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:9.1-9.84
+def cvtop : (numtype, cvtop, numtype, sx?, c_numtype) -> c_numtype*
+
+;; 6-reduction.watsup:4.1-4.63
+relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
+  ;; 6-reduction.watsup:16.1-17.24
+  rule unreachable:
+    `%*~>%*`([UNREACHABLE_admininstr], [TRAP_admininstr])
+
+  ;; 6-reduction.watsup:19.1-20.19
+  rule nop:
+    `%*~>%*`([NOP_admininstr], [])
+
+  ;; 6-reduction.watsup:22.1-23.24
+  rule drop {val : val}:
+    `%*~>%*`([$admininstr_val(val) DROP_admininstr], [])
+
+  ;; 6-reduction.watsup:26.1-28.16
+  rule select-true {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
+    `%*~>%*`([$admininstr_val(val_1) $admininstr_val(val_2) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [$admininstr_val(val_1)])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:30.1-32.14
+  rule select-false {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
+    `%*~>%*`([$admininstr_val(val_1) $admininstr_val(val_2) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [$admininstr_val(val_2)])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:35.1-37.28
+  rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
+    `%*~>%*`($admininstr_val(val)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], $admininstr_val(val)^k{val} :: $admininstr_instr(instr)*{instr})])
+    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
+
+  ;; 6-reduction.watsup:39.1-41.28
+  rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
+    `%*~>%*`($admininstr_val(val)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [LOOP_instr(bt, instr*{instr})], $admininstr_val(val)^k{val} :: $admininstr_instr(instr)*{instr})])
+    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
+
+  ;; 6-reduction.watsup:43.1-45.16
+  rule if-true {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*{instr_1}, instr_2*{instr_2})], [BLOCK_admininstr(bt, instr_1*{instr_1})])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:47.1-49.14
+  rule if-false {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*{instr_1}, instr_2*{instr_2})], [BLOCK_admininstr(bt, instr_2*{instr_2})])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:52.1-53.38
+  rule label-vals {instr* : instr*, n : n, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr*{instr}, $admininstr_val(val)*{val})], $admininstr_val(val)*{val})
+
+  ;; 6-reduction.watsup:57.1-58.69
+  rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, $admininstr_val(val')*{val'} :: $admininstr_val(val)^n{val} :: [BR_admininstr(0)] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)^n{val} :: $admininstr_instr(instr')*{instr'})
+
+  ;; 6-reduction.watsup:60.1-61.65
+  rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, $admininstr_val(val)*{val} :: [BR_admininstr(l + 1)] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)*{val} :: [BR_admininstr(l)])
+
+  ;; 6-reduction.watsup:64.1-66.16
+  rule br_if-true {c : c_numtype, l : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)], [BR_admininstr(l)])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:68.1-70.14
+  rule br_if-false {c : c_numtype, l : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)], [])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:73.1-75.17
+  rule br_table-lt {i : nat, l* : labelidx*, l' : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')], [BR_admininstr(l*{l}[i])])
+    -- if (i < |l*{l}|)
+
+  ;; 6-reduction.watsup:77.1-79.18
+  rule br_table-ge {i : nat, l* : labelidx*, l' : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')], [BR_admininstr(l')])
+    -- if (i >= |l*{l}|)
+
+  ;; 6-reduction.watsup:100.1-101.35
+  rule frame-vals {f : frame, n : n, val^n : val^n}:
+    `%*~>%*`([FRAME__admininstr(n, f, $admininstr_val(val)^n{val})], $admininstr_val(val)^n{val})
+
+  ;; 6-reduction.watsup:103.1-104.55
+  rule return-frame {f : frame, instr* : instr*, n : n, val^n : val^n, val'* : val*}:
+    `%*~>%*`([FRAME__admininstr(n, f, $admininstr_val(val')*{val'} :: $admininstr_val(val)^n{val} :: [RETURN_admininstr] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)^n{val})
+
+  ;; 6-reduction.watsup:106.1-107.60
+  rule return-label {instr* : instr*, instr'* : instr*, k : nat, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(k, instr'*{instr'}, $admininstr_val(val)*{val} :: [RETURN_admininstr] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)*{val} :: [RETURN_admininstr])
+
+  ;; 6-reduction.watsup:110.1-112.33
+  rule unop-val {c : c_numtype, c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)], [CONST_admininstr(nt, c)])
+    -- if ($unop(unop, nt, c_1) = [c])
+
+  ;; 6-reduction.watsup:114.1-116.39
+  rule unop-trap {c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)], [TRAP_admininstr])
+    -- if ($unop(unop, nt, c_1) = [])
+
+  ;; 6-reduction.watsup:119.1-121.40
+  rule binop-val {binop : binop_numtype, c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)], [CONST_admininstr(nt, c)])
+    -- if ($binop(binop, nt, c_1, c_2) = [c])
+
+  ;; 6-reduction.watsup:123.1-125.46
+  rule binop-trap {binop : binop_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)], [TRAP_admininstr])
+    -- if ($binop(binop, nt, c_1, c_2) = [])
+
+  ;; 6-reduction.watsup:128.1-130.37
+  rule testop {c : c_numtype, c_1 : c_numtype, nt : numtype, testop : testop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) TESTOP_admininstr(nt, testop)], [CONST_admininstr(I32_numtype, c)])
+    -- if (c = $testop(testop, nt, c_1))
+
+  ;; 6-reduction.watsup:132.1-134.40
+  rule relop {c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype, relop : relop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) RELOP_admininstr(nt, relop)], [CONST_admininstr(I32_numtype, c)])
+    -- if (c = $relop(relop, nt, c_1, c_2))
+
+  ;; 6-reduction.watsup:137.1-138.70
+  rule extend {c : c_numtype, n : n, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, !($size($valtype_numtype(nt))), S_sx, c))])
+
+  ;; 6-reduction.watsup:141.1-143.48
+  rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CVTOP_admininstr(nt_1, cvtop, nt_2, sx?{sx})], [CONST_admininstr(nt, c)])
+    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [c])
+
+  ;; 6-reduction.watsup:145.1-147.54
+  rule cvtop-trap {c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CVTOP_admininstr(nt_1, cvtop, nt_2, sx?{sx})], [TRAP_admininstr])
+    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [])
+
+  ;; 6-reduction.watsup:154.1-156.28
+  rule ref.is_null-true {rt : reftype, val : val}:
+    `%*~>%*`([$admininstr_val(val) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
+    -- if (val = REF.NULL_val(rt))
+
+  ;; 6-reduction.watsup:158.1-160.15
+  rule ref.is_null-false {val : val}:
+    `%*~>%*`([$admininstr_val(val) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:169.1-170.47
+  rule local.tee {val : val, x : idx}:
+    `%*~>%*`([$admininstr_val(val) LOCAL.TEE_admininstr(x)], [$admininstr_val(val) $admininstr_val(val) LOCAL.SET_admininstr(x)])
+
+;; 6-reduction.watsup:5.1-5.63
+relation Step_read: `%~>%*`(config, admininstr*)
+  ;; 6-reduction.watsup:82.1-83.47
+  rule call {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CALL_admininstr(x)]), [CALL_ADDR_admininstr($funcaddr(z)[x])])
+
+  ;; 6-reduction.watsup:85.1-88.34
+  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [CALL_ADDR_admininstr(a)])
+    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
+    -- if ($funcinst(z)[a] = `%;%`(m, func))
+
+  ;; 6-reduction.watsup:90.1-92.15
+  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [TRAP_admininstr])
+    -- otherwise
+
+  ;; 6-reduction.watsup:94.1-97.52
+  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
+    `%~>%*`(`%;%*`(z, $admininstr_val(val)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], $admininstr_instr(instr)*{instr})])])
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
+    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
+
+  ;; 6-reduction.watsup:150.1-151.53
+  rule ref.func {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [REF.FUNC_admininstr(x)]), [REF.FUNC_ADDR_admininstr($funcaddr(z)[x])])
+
+  ;; 6-reduction.watsup:163.1-164.37
+  rule local.get {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [LOCAL.GET_admininstr(x)]), [$admininstr_val($local(z, x))])
+
+  ;; 6-reduction.watsup:173.1-174.39
+  rule global.get {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]), [$admininstr_globalinst($global(z, x))])
+
+  ;; 6-reduction.watsup:180.1-182.28
+  rule table.get-trap {i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:184.1-186.27
+  rule table.get-val {i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [$admininstr_ref($table(z, x)[i])])
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:188.1-190.28
+  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_ref(ref) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:197.1-199.27
+  rule table.size {n : n, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]), [CONST_admininstr(I32_numtype, n)])
+    -- if (|$table(z, x)| = n)
+
+  ;; 6-reduction.watsup:205.1-206.57
+  rule table.grow-fail {n : n, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), [CONST_admininstr(I32_numtype, - 1)])
+
+  ;; 6-reduction.watsup:209.1-211.34
+  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
+    -- if ((i + n) > |$table(z, x)|)
+
+  ;; 6-reduction.watsup:213.1-216.14
+  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:218.1-222.15
+  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) $admininstr_val(val) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) $admininstr_val(val) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:225.1-227.63
+  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [TRAP_admininstr])
+    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:229.1-232.14
+  rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:234.1-239.15
+  rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
+    -- otherwise
+    -- if (j <= i)
+
+  ;; 6-reduction.watsup:241.1-245.15
+  rule table.copy-gt {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, ((j + n) - 1)) CONST_admininstr(I32_numtype, ((i + n) - 1)) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:248.1-250.62
+  rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [TRAP_admininstr])
+    -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:252.1-255.14
+  rule table.init-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:257.1-261.15
+  rule table.init-succ {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) $admininstr_ref($elem(z, y)[i]) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
+    -- otherwise
+
+;; 6-reduction.watsup:3.1-3.63
+relation Step: `%~>%`(config, config)
+  ;; 6-reduction.watsup:7.1-9.34
+  rule pure {instr* : instr*, instr'* : instr*, z : state}:
+    `%~>%`(`%;%*`(z, $admininstr_instr(instr)*{instr}), `%;%*`(z, $admininstr_instr(instr')*{instr'}))
+    -- Step_pure: `%*~>%*`($admininstr_instr(instr)*{instr}, $admininstr_instr(instr')*{instr'})
+
+  ;; 6-reduction.watsup:11.1-13.37
+  rule read {instr* : instr*, instr'* : instr*, z : state}:
+    `%~>%`(`%;%*`(z, $admininstr_instr(instr)*{instr}), `%;%*`(z, $admininstr_instr(instr')*{instr'}))
+    -- Step_read: `%~>%*`(`%;%*`(z, $admininstr_instr(instr)*{instr}), $admininstr_instr(instr')*{instr'})
+
+  ;; 6-reduction.watsup:166.1-167.60
+  rule local.set {val : val, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [$admininstr_val(val) LOCAL.SET_admininstr(x)]), `%;%*`($with_local(z, x, val), []))
+
+  ;; 6-reduction.watsup:176.1-177.62
+  rule global.set {val : val, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [$admininstr_val(val) GLOBAL.SET_admininstr(x)]), `%;%*`($with_global(z, x, val), []))
+
+  ;; 6-reduction.watsup:192.1-194.27
+  rule table.set-val {i : nat, ref : ref, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_ref(ref) TABLE.GET_admininstr(x)]), `%;%*`($with_table(z, x, i, ref), []))
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:202.1-203.102
+  rule table.grow-succeed {n : n, ref : ref, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [$admininstr_ref(ref) CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), `%;%*`($with_tableext(z, x, ref^n{}), [CONST_admininstr(I32_numtype, |$table(z, x)|)]))
+
+  ;; 6-reduction.watsup:264.1-265.59
+  rule elem.drop {x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [ELEM.DROP_admininstr(x)]), `%;%*`($with_elem(z, x, []), []))
+
 == IL Validation...
 == Side condition inference
 

From fcefbe6f7711efa53ee1b61690d29141348eebbc Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Fri, 21 Apr 2023 20:02:39 +0200
Subject: [PATCH 85/98] Implement --the-elimination

---
 spectec/src/il/validation.ml    |   9 +-
 spectec/src/il/validation.mli   |  15 +++
 spectec/src/middlend/unthe.ml   | 187 +++++++++++++++++++++++++++++++-
 spectec/test-lean4/SpecTec.lean |  55 +++++-----
 spectec/test-middlend/TEST.md   | 153 +++++++++++++++-----------
 5 files changed, 324 insertions(+), 95 deletions(-)

diff --git a/spectec/src/il/validation.ml b/spectec/src/il/validation.ml
index 2e9b1398ad..0d93cf3df3 100644
--- a/spectec/src/il/validation.ml
+++ b/spectec/src/il/validation.ml
@@ -483,6 +483,8 @@ let valid_binds env binds =
     env.vars <- bind "variable" env.vars id (t, dim)
   ) binds
 
+let clear_binds env = env.vars <- Env.empty
+
 let rec valid_prem env prem =
   match prem.it with
   | RulePr (id, mixop, e) ->
@@ -504,7 +506,7 @@ let valid_rule env mixop t rule =
     valid_binds env binds;
     valid_expmix env mixop' e (mixop, t) e.at;
     List.iter (valid_prem env) prems;
-    env.vars <- Env.empty
+    clear_binds env
 
 let valid_clause env t1 t2 clause =
   match clause.it with
@@ -513,7 +515,7 @@ let valid_clause env t1 t2 clause =
     valid_exp env e1 t1;
     valid_exp env e2 t2;
     List.iter (valid_prem env) prems;
-    env.vars <- Env.empty;
+    clear_binds env;
     let free_rh = Free.(Set.diff (free_exp e2).varid (free_exp e1).varid) in
     if free_rh <> Free.Set.empty then
       error clause.at ("definition contains unbound variable(s) `" ^
@@ -565,9 +567,10 @@ let rec valid_def {bind} env d =
           ": invalid recurion between definitions of different sort")
     ) ds
 
+let valid_defs env = List.iter (valid_def {bind} env)
 
 (* Scripts *)
 
 let valid ds =
   let env = new_env () in
-  List.iter (valid_def {bind} env) ds
+  valid_defs env ds
diff --git a/spectec/src/il/validation.mli b/spectec/src/il/validation.mli
index f5fd703abd..84d7b4d410 100644
--- a/spectec/src/il/validation.mli
+++ b/spectec/src/il/validation.mli
@@ -1 +1,16 @@
+(* Main interface for validation *)
 val valid : Ast.script -> unit (* raises Source.Error *)
+
+(* Interface for passes that need type information.
+   (Re-validates stuff, so maybe to be replaced with AST annotations.) *)
+(* Collect global type information *)
+type env
+val new_env : unit -> env
+val valid_defs : env -> Ast.script -> unit
+(* Enter binders (stateful!) and iterexpr (returns new env) *)
+val valid_binds : env -> Ast.binds -> unit
+val clear_binds : env -> unit
+val valid_iterexp : env -> Ast.iterexp -> env
+(* Infer expression types *)
+val infer_exp : env -> Ast.exp -> Ast.typ
+
diff --git a/spectec/src/middlend/unthe.ml b/spectec/src/middlend/unthe.ml
index 3fbb1a072c..c142fca875 100644
--- a/spectec/src/middlend/unthe.ml
+++ b/spectec/src/middlend/unthe.ml
@@ -9,8 +9,193 @@ This is an alternative to to how the Sideconditions pass handles the ! operator.
 If you need both, passes, run this one first.
 *)
 
+open Util
+open Source
 open Il.Ast
 
 (* Errors *)
-let transform (defs : script) = defs
+
+let error at msg = Source.error at "sideconditions" msg
+
+(* We pull out fresh variables and equating side conditions. *)
+
+type bind = (id * typ * iter list)
+type eqn = (bind * premise)
+type eqns = eqn list
+
+(* Fresh name generation *)
+
+let name i = "o" ^ string_of_int i (* no clash avoidance *)
+
+let fresh_id (n : int ref) : id =
+  let i = !n in
+  n := !n+1;
+  name i $ no_region
+
+(* If a bind and premise is generated under an iteration, wrap them accordingly *)
+let eqn_under_iterexp (i, vs) new_vs ((v, t, is), pr) : eqn =
+ ((v, t, is@[i]), IterPr (pr, (i, vs @ new_vs)) $ no_region)
+
+let under_iterexp (iter, vs) eqns : iterexp * eqns =
+   let new_vs = List.map (fun ((v, _, _), _) -> v) eqns in
+   let iterexp' = (iter, vs @ new_vs) in
+   let eqns' = List.map (eqn_under_iterexp (iter, vs) new_vs) eqns in
+   iterexp', eqns'
+
+(* Generic traversal helpers *)
+
+type 'a traversal = Il.Validation.env -> int ref -> 'a -> eqns * 'a
+type ('a, 'b) traversal_k = Il.Validation.env -> int ref -> 'a -> ('a -> 'b) -> eqns * 'b
+
+let phrase (t : 'a traversal) : 'a phrase traversal
+  = fun env n x -> let eqns, x' = t env n x.it in eqns, x' $ x.at
+
+let t_list (t : 'a traversal) : ('a list, 'b) traversal_k
+  = fun env n xs k ->
+    let eqnss, xs' = List.split (List.map (t env n) xs) in
+    List.concat eqnss, k xs'
+
+let unary (t : 'a traversal) : ('a, 'b) traversal_k =
+  fun env n x k ->
+  let eqns, exp' = t env n x in
+  eqns, k exp'
+
+let binary (t1 : 'a traversal) (t2 : 'b traversal) : ('a * 'b, 'c) traversal_k =
+  fun env n (x1, x2) k ->
+  let eqns1, x1' = t1 env n x1 in
+  let eqns2, x2' = t2 env n x2 in
+  eqns1 @ eqns2, k (x1', x2')
+
+let ternary (t1 : 'a traversal) (t2 : 'b traversal) (t3 : 'c traversal) : ('a * 'b * 'c, 'd) traversal_k =
+  fun env n (x1, x2, x3) k ->
+  let eqns1, x1' = t1 env n x1 in
+  let eqns2, x2' = t2 env n x2 in
+  let eqns3, x3' = t3 env n x3 in
+  eqns1 @ eqns2 @ eqns3, k (x1', x2', x3')
+
+(* Expr traversal *)
+
+let rec t_exp env n e : eqns * exp =
+  (* Descend first using t_exp2, and then see if we have to pull out the current expression *)
+  let eqns, e' = t_exp2 env n e in
+  match e.it with
+  |  TheE exp ->
+    let x = fresh_id n in
+    let xe = VarE x $ no_region in
+    let t = Il.Validation.infer_exp env e' in
+    let bind = (x, t, []) in
+    let prem = IfPr (CmpE (EqOp, exp, OptE (Some xe) $ no_region) $ no_region) $ no_region in
+    eqns @ [(bind, prem)], xe
+  | _ -> eqns, e'
+
+(* Traversal helpers *)
+
+and t_exp2 env n = phrase t_exp' env n
+
+and t_e env n x k = unary t_exp env n x k
+and t_ee env n x k = binary t_exp t_exp env n x k
+and t_eee env n x k = ternary t_exp t_exp t_exp env n x k
+and t_epe env n x k = ternary t_exp t_path t_exp env n x k
+
+and t_exp' env n e : eqns * exp' =
+  match e with
+  | VarE _ | BoolE _ | NatE _ | TextE _ | OptE None -> [], e
+
+  | UnE (uo, exp) -> t_e env n exp (fun exp' -> UnE (uo, exp'))
+  | DotE (a, exp, b) -> t_e env n exp (fun exp' -> DotE (a, exp', b))
+  | LenE exp -> t_e env n exp (fun exp' -> LenE exp')
+  | MixE (mo, exp) -> t_e env n exp (fun exp' -> MixE (mo, exp'))
+  | CallE (f, exp) ->t_e env n exp (fun exp' -> CallE (f, exp'))
+  | OptE (Some exp) ->t_e env n exp (fun exp' -> OptE (Some exp'))
+  | TheE exp ->t_e env n exp (fun exp' -> TheE exp')
+  | CaseE (a, exp, b) ->t_e env n exp (fun exp' -> CaseE (a, exp', b))
+  | SubE (exp, a, b) -> t_e env n exp (fun exp' -> SubE (exp', a, b))
+
+  | BinE (bo, exp1, exp2) -> t_ee env n (exp1, exp2) (fun (e1', e2') -> BinE (bo, e1', e2'))
+  | CmpE (co, exp1, exp2) -> t_ee env n (exp1, exp2) (fun (e1', e2') -> CmpE (co, e1', e2'))
+  | IdxE (exp1, exp2) -> t_ee env n (exp1, exp2) (fun (e1', e2') -> IdxE (e1', e2'))
+  | CompE (exp1, exp2) -> t_ee env n (exp1, exp2) (fun (e1', e2') -> CompE (e1', e2'))
+  | CatE (exp1, exp2) -> t_ee env n (exp1, exp2) (fun (e1', e2') -> CatE (e1', e2'))
+
+  | SliceE (exp1, exp2, exp3) -> t_eee env n (exp1, exp2, exp3) (fun (e1', e2', e3') -> SliceE (e1', e2', e3'))
+
+  | UpdE (exp1, path, exp2) -> t_epe env n (exp1, path, exp2) (fun (e1', p', e2') -> UpdE (e1', p', e2'))
+  | ExtE (exp1, path, exp2) -> t_epe env n (exp1, path, exp2) (fun (e1', p', e2') -> ExtE (e1', p', e2'))
+
+  | StrE fields -> t_list t_field env n fields (fun fields' -> StrE fields')
+
+  | TupE es -> t_list t_exp env n es (fun es' -> TupE es')
+  | ListE es -> t_list t_exp env n es (fun es' -> ListE es')
+
+  | IterE (e, iterexp) ->
+    let eqns1, e' = t_exp env n e in
+    let iterexp', eqns1' = under_iterexp iterexp eqns1 in
+    let eqns2, iterexp'' = t_iterexp env n iterexp' in
+    eqns1' @ eqns2, IterE (e', iterexp'')
+
+and t_field env n ((a, e) : expfield) =
+  unary t_exp env n e (fun e' -> (a, e'))
+
+and t_iterexp env n (iter, vs) =
+  unary t_iter env n iter (fun iter' -> (iter', vs))
+
+and t_iter env n iter = match iter with
+  | ListN e -> unary t_exp env n e (fun e' -> ListN e')
+  | _ -> [], iter
+
+and t_path env n = phrase t_path' env n
+
+and t_path' env n path = match path with
+  | RootP -> [], path
+  | IdxP (path, e) -> binary t_path t_exp env n (path, e) (fun (path', e') -> IdxP (path', e'))
+  | DotP (path, a) -> unary t_path env n path (fun path' -> DotP (path', a))
+
+let rec t_prem env n : premise -> eqns * premise = phrase t_prem' env n
+
+and t_prem' env n prem : eqns * premise' =
+  match prem with
+  | RulePr (a, b, exp) ->
+    unary t_exp env n exp (fun exp' -> RulePr (a, b, exp'))
+  | IfPr e -> unary t_exp env n e (fun e' -> IfPr e')
+  | ElsePr -> [], prem
+  | IterPr (prem, iterexp) ->
+    let eqns1, prem' = t_prem env n prem in
+    let iterexp', eqns1' = under_iterexp iterexp eqns1 in
+    let eqns2, iterexp'' = t_iterexp env n iterexp' in
+    eqns1' @ eqns2, IterPr (prem', iterexp'')
+  | NegPr prem
+  -> match t_prem env n prem with
+    | [], prem' -> [], NegPr prem'
+    | _ -> error prem.at "partial expression (!(e)) in negated premise"
+
+let t_prems env n k  = t_list t_prem env n k (fun x -> x)
+
+let t_rule' env = function
+  | RuleD (id, binds, mixop, exp, prems) ->
+    (* Entering the scope of the binds; need to pass them to Il.Validation for type infernece *)
+    Il.Validation.valid_binds env binds;
+    (* Counter for fresh variables *)
+    let n = ref 0 in
+    let eqns, (exp', prems') = binary t_exp t_prems env n (exp, prems) (fun x -> x) in
+    let extra_binds, extra_prems = List.split eqns in
+    Il.Validation.clear_binds env;
+    RuleD (id, binds @ extra_binds, mixop, exp', extra_prems @ prems')
+
+let t_rule env x = { x with it = t_rule' env x.it }
+
+let t_rules env = List.map (t_rule env)
+
+let rec t_def' env = function
+  | RecD defs -> RecD (List.map (t_def env) defs)
+  | RelD (id, mixop, typ, rules, hints) ->
+    RelD (id, mixop, typ, t_rules env rules, hints)
+  | def -> def
+
+and t_def env x = { x with it = t_def' env x.it }
+
+let transform (defs : script) =
+  (* Run type inference *)
+  let env = Il.Validation.new_env () in
+  Il.Validation.valid_defs env defs;
+  List.map (t_def env) defs
 
diff --git a/spectec/test-lean4/SpecTec.lean b/spectec/test-lean4/SpecTec.lean
index 4689df4176..dd2b5c4806 100644
--- a/spectec/test-lean4/SpecTec.lean
+++ b/spectec/test-lean4/SpecTec.lean
@@ -539,21 +539,21 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (Instr_ok (C, (Instr.TESTOP (nt, testop)), ([(«$valtype_numtype» nt)], [Valtype.I32])))
   | relop (C : Context) (nt : Numtype) (relop : Relop_numtype) : 
     (Instr_ok (C, (Instr.RELOP (nt, relop)), ([(«$valtype_numtype» nt), («$valtype_numtype» nt)], [Valtype.I32])))
-  | extend (C : Context) (n : N) (nt : Numtype) : 
-    ((«$size» («$valtype_numtype» nt)) != none) -> 
-    (n <= («$size» («$valtype_numtype» nt)).get!) -> 
+  | extend (C : Context) (n : N) (nt : Numtype) (o0 : Nat) : 
+    ((«$size» («$valtype_numtype» nt)) == (some o0)) -> 
+    (n <= o0) -> 
     (Instr_ok (C, (Instr.EXTEND (nt, n)), ([(«$valtype_numtype» nt)], [(«$valtype_numtype» nt)])))
-  | reinterpret (C : Context) (nt_1 : Numtype) (nt_2 : Numtype) : 
-    ((«$size» («$valtype_numtype» nt_1)) != none) -> 
-    ((«$size» («$valtype_numtype» nt_2)) != none) -> 
+  | reinterpret (C : Context) (nt_1 : Numtype) (nt_2 : Numtype) (o0 : Nat) (o1 : Nat) : 
+    ((«$size» («$valtype_numtype» nt_1)) == (some o0)) -> 
+    ((«$size» («$valtype_numtype» nt_2)) == (some o1)) -> 
     (nt_1 != nt_2) -> 
-    ((«$size» («$valtype_numtype» nt_1)).get! == («$size» («$valtype_numtype» nt_2)).get!) -> 
+    (o0 == o1) -> 
     (Instr_ok (C, (Instr.CVTOP (nt_1, Cvtop.REINTERPRET, nt_2, none)), ([(«$valtype_numtype» nt_2)], [(«$valtype_numtype» nt_1)])))
-  | convert_i (C : Context) (in_1 : In) (in_2 : In) (sx : (Option Sx)) : 
-    ((«$size» («$valtype_in» in_1)) != none) -> 
-    ((«$size» («$valtype_in» in_2)) != none) -> 
+  | convert_i (C : Context) (in_1 : In) (in_2 : In) (sx : (Option Sx)) (o0 : Nat) (o1 : Nat) : 
+    ((«$size» («$valtype_in» in_1)) == (some o0)) -> 
+    ((«$size» («$valtype_in» in_2)) == (some o1)) -> 
     (in_1 != in_2) -> 
-    ((sx == none) = ((«$size» («$valtype_in» in_1)).get! > («$size» («$valtype_in» in_2)).get!)) -> 
+    ((sx == none) = (o0 > o1)) -> 
     (Instr_ok (C, (Instr.CVTOP ((«$numtype_in» in_1), Cvtop.CONVERT, («$numtype_in» in_2), sx)), ([(«$valtype_in» in_2)], [(«$valtype_in» in_1)])))
   | convert_f (C : Context) (fn_1 : Fn) (fn_2 : Fn) : 
     (fn_1 != fn_2) -> 
@@ -648,21 +648,25 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (x < C.DATA.length) -> 
     ((C.DATA.get! x) == ()) -> 
     (Instr_ok (C, (Instr.DATA_DROP x), ([], [])))
-  | load (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (sx : (Option Sx)) : 
+  | load (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (sx : (Option Sx)) (o0 : Nat) (o1 : (Option Nat)) : 
+    ((n == none) = (o1 == none)) -> 
     (0 < C.MEM.length) -> 
-    ((«$size» («$valtype_numtype» nt)) != none) -> 
     ((n == none) = (sx == none)) -> 
+    ((«$size» («$valtype_numtype» nt)) == (some o0)) -> 
+    (Forall₂ (λ n o1 ↦ ((«$size» («$valtype_numtype» nt)) == (some o1))) n.toList o1.toList) -> 
     ((C.MEM.get! 0) == mt) -> 
-    ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))) -> 
-    (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))))) n.toList) -> 
+    ((((Nat.pow 2) n_A)) <= (((Nat.div o0) 8))) -> 
+    (Forall₂ (λ n o1 ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div o1) 8))))) n.toList o1.toList) -> 
     ((n == none) || (nt == («$numtype_in» «in»))) -> 
     (Instr_ok (C, (Instr.LOAD (nt, (Option.zipWith (λ n sx ↦ (n, sx)) n sx), n_A, n_O)), ([Valtype.I32], [(«$valtype_numtype» nt)])))
-  | store (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) : 
+  | store (C : Context) («in» : In) (mt : Memtype) (n : (Option N)) (n_A : N) (n_O : N) (nt : Numtype) (o0 : Nat) (o1 : (Option Nat)) : 
+    ((n == none) = (o1 == none)) -> 
     (0 < C.MEM.length) -> 
-    ((«$size» («$valtype_numtype» nt)) != none) -> 
+    ((«$size» («$valtype_numtype» nt)) == (some o0)) -> 
+    (Forall₂ (λ n o1 ↦ ((«$size» («$valtype_numtype» nt)) == (some o1))) n.toList o1.toList) -> 
     ((C.MEM.get! 0) == mt) -> 
-    ((((Nat.pow 2) n_A)) <= (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))) -> 
-    (Forall (λ n ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div («$size» («$valtype_numtype» nt)).get!) 8))))) n.toList) -> 
+    ((((Nat.pow 2) n_A)) <= (((Nat.div o0) 8))) -> 
+    (Forall₂ (λ n o1 ↦ (((((Nat.pow 2) n_A)) <= (((Nat.div n) 8))) && ((((Nat.div n) 8)) < (((Nat.div o1) 8))))) n.toList o1.toList) -> 
     ((n == none) || (nt == («$numtype_in» «in»))) -> 
     (Instr_ok (C, (Instr.STORE (nt, n, n_A, n_O)), ([Valtype.I32, («$valtype_numtype» nt)], [])))
 inductive InstrSeq_ok : (Context × (List Instr) × Functype) -> Prop where
@@ -1193,9 +1197,9 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
   | relop (c : C_numtype) (c_1 : C_numtype) (c_2 : C_numtype) (nt : Numtype) (relop : Relop_numtype) : 
     (c == («$relop» (relop, nt, c_1, c_2))) -> 
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CONST (nt, c_2)), (Admininstr.RELOP (nt, relop))], [(Admininstr.CONST (Numtype.I32, c))]))
-  | extend (c : C_numtype) (n : N) (nt : Numtype) : 
-    ((«$size» («$valtype_numtype» nt)) != none) -> 
-    (Step_pure ([(Admininstr.CONST (nt, c)), (Admininstr.EXTEND (nt, n))], [(Admininstr.CONST (nt, («$ext» (n, («$size» («$valtype_numtype» nt)).get!, Sx.S, c))))]))
+  | extend (c : C_numtype) (n : N) (nt : Numtype) (o0 : Nat) : 
+    ((«$size» («$valtype_numtype» nt)) == (some o0)) -> 
+    (Step_pure ([(Admininstr.CONST (nt, c)), (Admininstr.EXTEND (nt, n))], [(Admininstr.CONST (nt, («$ext» (n, o0, Sx.S, c))))]))
   | cvtop_val (c : C_numtype) (c_1 : C_numtype) (cvtop : Cvtop) (nt : Numtype) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) : 
     ((«$cvtop» (nt_1, cvtop, nt_2, sx, c_1)) == [c]) -> 
     (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CVTOP (nt_1, cvtop, nt_2, sx))], [(Admininstr.CONST (nt, c))]))
@@ -1287,14 +1291,15 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
   | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) : 
     (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [Admininstr.TRAP]))
-  | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) : 
+  | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) (o0 : (List Val)) : 
+    (t.length == o0.length) -> 
     (a < («$funcinst» z).length) -> 
     (t_1.length == k) -> 
     (t_2.length == n) -> 
     (val.length == k) -> 
-    (Forall (λ t ↦ ((«$default_» t) != none)) t) -> 
+    (Forall₂ (λ t o0 ↦ ((«$default_» t) == (some o0))) t o0) -> 
     (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) -> 
-    (f == {LOCAL := (val ++ (List.map (λ t ↦ («$default_» t).get!) t)), MODULE := m}) -> 
+    (f == {LOCAL := (val ++ (List.zipWith (λ t o0 ↦ o0) t o0)), MODULE := m}) -> 
     (Step_read ((z, ((List.map «$admininstr_val» val) ++ [(Admininstr.CALL_ADDR a)])), [(Admininstr.FRAME_ (n, f, [(Admininstr.LABEL_ (n, [], (List.map «$admininstr_instr» instr)))]))]))
   | ref_func (x : Idx) (z : State) : 
     (x < («$funcaddr» z).length) -> 
diff --git a/spectec/test-middlend/TEST.md b/spectec/test-middlend/TEST.md
index 8aaaa85f2e..53ae9530b5 100644
--- a/spectec/test-middlend/TEST.md
+++ b/spectec/test-middlend/TEST.md
@@ -5264,21 +5264,26 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([$valtype_numtype(nt) $valtype_numtype(nt)], [I32_valtype]))
 
   ;; 3-typing.watsup:238.1-240.23
-  rule extend {C : context, n : n, nt : numtype}:
+  rule extend {C : context, n : n, nt : numtype, o0 : nat}:
     `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([$valtype_numtype(nt)], [$valtype_numtype(nt)]))
-    -- if (n <= !($size($valtype_numtype(nt))))
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- if (n <= o0)
 
   ;; 3-typing.watsup:242.1-245.34
-  rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype}:
+  rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype, o0 : nat, o1 : nat}:
     `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([$valtype_numtype(nt_2)], [$valtype_numtype(nt_1)]))
+    -- if ($size($valtype_numtype(nt_1)) = ?(o0))
+    -- if ($size($valtype_numtype(nt_2)) = ?(o1))
     -- if (nt_1 =/= nt_2)
-    -- if (!($size($valtype_numtype(nt_1))) = !($size($valtype_numtype(nt_2))))
+    -- if (o0 = o1)
 
   ;; 3-typing.watsup:247.1-250.52
-  rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?}:
+  rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?, o0 : nat, o1 : nat}:
     `%|-%:%`(C, CVTOP_instr($numtype_in(in_1), CONVERT_cvtop, $numtype_in(in_2), sx?{sx}), `%->%`([$valtype_in(in_2)], [$valtype_in(in_1)]))
+    -- if ($size($valtype_in(in_1)) = ?(o0))
+    -- if ($size($valtype_in(in_2)) = ?(o1))
     -- if (in_1 =/= in_2)
-    -- if ((sx?{sx} = ?()) <=> (!($size($valtype_in(in_1))) > !($size($valtype_in(in_2)))))
+    -- if ((sx?{sx} = ?()) <=> (o0 > o1))
 
   ;; 3-typing.watsup:252.1-254.22
   rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
@@ -5397,19 +5402,23 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (C.DATA_context[x] = OK)
 
   ;; 3-typing.watsup:350.1-355.32
-  rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?}:
+  rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?, o0 : nat, o1? : nat?}:
     `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [$valtype_numtype(nt)]))
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- (if ($size($valtype_numtype(nt)) = ?(o1)))?{n o1}
     -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= (!($size($valtype_numtype(nt))) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size($valtype_numtype(nt))) / 8))))?{n}
+    -- if ((2 ^ n_A) <= (o0 / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (o1 / 8))))?{n o1}
     -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
 
   ;; 3-typing.watsup:357.1-362.32
-  rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype}:
+  rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, o0 : nat, o1? : nat?}:
     `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype $valtype_numtype(nt)], []))
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- (if ($size($valtype_numtype(nt)) = ?(o1)))?{n o1}
     -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= (!($size($valtype_numtype(nt))) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size($valtype_numtype(nt))) / 8))))?{n}
+    -- if ((2 ^ n_A) <= (o0 / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (o1 / 8))))?{n o1}
     -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
 
 ;; 3-typing.watsup:124.1-124.67
@@ -6049,8 +6058,9 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
     -- if (c = $relop(relop, nt, c_1, c_2))
 
   ;; 6-reduction.watsup:137.1-138.70
-  rule extend {c : c_numtype, n : n, nt : numtype}:
-    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, !($size($valtype_numtype(nt))), S_sx, c))])
+  rule extend {c : c_numtype, n : n, nt : numtype, o0 : nat}:
+    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, o0, S_sx, c))])
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
 
   ;; 6-reduction.watsup:141.1-143.48
   rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
@@ -6094,10 +6104,11 @@ relation Step_read: `%~>%*`(config, admininstr*)
     -- otherwise
 
   ;; 6-reduction.watsup:94.1-97.52
-  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
+  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state, o0* : val*}:
     `%~>%*`(`%;%*`(z, $admininstr_val(val)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], $admininstr_instr(instr)*{instr})])])
+    -- (if ($default_(t) = ?(o0)))*{t o0}
     -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
-    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
+    -- if (f = {LOCAL val^k{val} :: o0*{t o0}, MODULE m})
 
   ;; 6-reduction.watsup:150.1-151.53
   rule ref.func {x : idx, z : state}:
@@ -6850,26 +6861,26 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([$valtype_numtype(nt) $valtype_numtype(nt)], [I32_valtype]))
 
   ;; 3-typing.watsup:238.1-240.23
-  rule extend {C : context, n : n, nt : numtype}:
+  rule extend {C : context, n : n, nt : numtype, o0 : nat}:
     `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([$valtype_numtype(nt)], [$valtype_numtype(nt)]))
-    -- if ($size($valtype_numtype(nt)) =/= ?())
-    -- if (n <= !($size($valtype_numtype(nt))))
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- if (n <= o0)
 
   ;; 3-typing.watsup:242.1-245.34
-  rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype}:
+  rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype, o0 : nat, o1 : nat}:
     `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([$valtype_numtype(nt_2)], [$valtype_numtype(nt_1)]))
-    -- if ($size($valtype_numtype(nt_1)) =/= ?())
-    -- if ($size($valtype_numtype(nt_2)) =/= ?())
+    -- if ($size($valtype_numtype(nt_1)) = ?(o0))
+    -- if ($size($valtype_numtype(nt_2)) = ?(o1))
     -- if (nt_1 =/= nt_2)
-    -- if (!($size($valtype_numtype(nt_1))) = !($size($valtype_numtype(nt_2))))
+    -- if (o0 = o1)
 
   ;; 3-typing.watsup:247.1-250.52
-  rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?}:
+  rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?, o0 : nat, o1 : nat}:
     `%|-%:%`(C, CVTOP_instr($numtype_in(in_1), CONVERT_cvtop, $numtype_in(in_2), sx?{sx}), `%->%`([$valtype_in(in_2)], [$valtype_in(in_1)]))
-    -- if ($size($valtype_in(in_1)) =/= ?())
-    -- if ($size($valtype_in(in_2)) =/= ?())
+    -- if ($size($valtype_in(in_1)) = ?(o0))
+    -- if ($size($valtype_in(in_2)) = ?(o1))
     -- if (in_1 =/= in_2)
-    -- if ((sx?{sx} = ?()) <=> (!($size($valtype_in(in_1))) > !($size($valtype_in(in_2)))))
+    -- if ((sx?{sx} = ?()) <=> (o0 > o1))
 
   ;; 3-typing.watsup:252.1-254.22
   rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
@@ -7011,24 +7022,28 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (C.DATA_context[x] = OK)
 
   ;; 3-typing.watsup:350.1-355.32
-  rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?}:
+  rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?, o0 : nat, o1? : nat?}:
     `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [$valtype_numtype(nt)]))
+    -- if ((n?{n} = ?()) <=> (o1?{o1} = ?()))
     -- if (0 < |C.MEM_context|)
-    -- if ($size($valtype_numtype(nt)) =/= ?())
     -- if ((n?{n} = ?()) <=> (sx?{sx} = ?()))
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- (if ($size($valtype_numtype(nt)) = ?(o1)))?{n o1}
     -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= (!($size($valtype_numtype(nt))) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size($valtype_numtype(nt))) / 8))))?{n}
+    -- if ((2 ^ n_A) <= (o0 / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (o1 / 8))))?{n o1}
     -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
 
   ;; 3-typing.watsup:357.1-362.32
-  rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype}:
+  rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, o0 : nat, o1? : nat?}:
     `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype $valtype_numtype(nt)], []))
+    -- if ((n?{n} = ?()) <=> (o1?{o1} = ?()))
     -- if (0 < |C.MEM_context|)
-    -- if ($size($valtype_numtype(nt)) =/= ?())
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- (if ($size($valtype_numtype(nt)) = ?(o1)))?{n o1}
     -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= (!($size($valtype_numtype(nt))) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size($valtype_numtype(nt))) / 8))))?{n}
+    -- if ((2 ^ n_A) <= (o0 / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (o1 / 8))))?{n o1}
     -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
 
 ;; 3-typing.watsup:124.1-124.67
@@ -7691,9 +7706,9 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
     -- if (c = $relop(relop, nt, c_1, c_2))
 
   ;; 6-reduction.watsup:137.1-138.70
-  rule extend {c : c_numtype, n : n, nt : numtype}:
-    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, !($size($valtype_numtype(nt))), S_sx, c))])
-    -- if ($size($valtype_numtype(nt)) =/= ?())
+  rule extend {c : c_numtype, n : n, nt : numtype, o0 : nat}:
+    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, o0, S_sx, c))])
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
 
   ;; 6-reduction.watsup:141.1-143.48
   rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
@@ -7740,15 +7755,16 @@ relation Step_read: `%~>%*`(config, admininstr*)
     -- otherwise
 
   ;; 6-reduction.watsup:94.1-97.52
-  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
+  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state, o0* : val*}:
     `%~>%*`(`%;%*`(z, $admininstr_val(val)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], $admininstr_instr(instr)*{instr})])])
+    -- if (|t*{t}| = |o0*{o0}|)
     -- if (a < |$funcinst(z)|)
     -- if (|t_1^k{t_1}| = k)
     -- if (|t_2^n{t_2}| = n)
     -- if (|val^k{val}| = k)
-    -- (if ($default_(t) =/= ?()))*{t}
+    -- (if ($default_(t) = ?(o0)))*{t o0}
     -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
-    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
+    -- if (f = {LOCAL val^k{val} :: o0*{t o0}, MODULE m})
 
   ;; 6-reduction.watsup:150.1-151.53
   rule ref.func {x : idx, z : state}:
@@ -8503,26 +8519,26 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([$valtype_numtype(nt) $valtype_numtype(nt)], [I32_valtype]))
 
   ;; 3-typing.watsup:238.1-240.23
-  rule extend {C : context, n : n, nt : numtype}:
+  rule extend {C : context, n : n, nt : numtype, o0 : nat}:
     `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([$valtype_numtype(nt)], [$valtype_numtype(nt)]))
-    -- if ($size($valtype_numtype(nt)) =/= ?())
-    -- if (n <= !($size($valtype_numtype(nt))))
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- if (n <= o0)
 
   ;; 3-typing.watsup:242.1-245.34
-  rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype}:
+  rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype, o0 : nat, o1 : nat}:
     `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([$valtype_numtype(nt_2)], [$valtype_numtype(nt_1)]))
-    -- if ($size($valtype_numtype(nt_1)) =/= ?())
-    -- if ($size($valtype_numtype(nt_2)) =/= ?())
+    -- if ($size($valtype_numtype(nt_1)) = ?(o0))
+    -- if ($size($valtype_numtype(nt_2)) = ?(o1))
     -- if (nt_1 =/= nt_2)
-    -- if (!($size($valtype_numtype(nt_1))) = !($size($valtype_numtype(nt_2))))
+    -- if (o0 = o1)
 
   ;; 3-typing.watsup:247.1-250.52
-  rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?}:
+  rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?, o0 : nat, o1 : nat}:
     `%|-%:%`(C, CVTOP_instr($numtype_in(in_1), CONVERT_cvtop, $numtype_in(in_2), sx?{sx}), `%->%`([$valtype_in(in_2)], [$valtype_in(in_1)]))
-    -- if ($size($valtype_in(in_1)) =/= ?())
-    -- if ($size($valtype_in(in_2)) =/= ?())
+    -- if ($size($valtype_in(in_1)) = ?(o0))
+    -- if ($size($valtype_in(in_2)) = ?(o1))
     -- if (in_1 =/= in_2)
-    -- if ((sx?{sx} = ?()) <=> (!($size($valtype_in(in_1))) > !($size($valtype_in(in_2)))))
+    -- if ((sx?{sx} = ?()) <=> (o0 > o1))
 
   ;; 3-typing.watsup:252.1-254.22
   rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
@@ -8664,24 +8680,28 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (C.DATA_context[x] = OK)
 
   ;; 3-typing.watsup:350.1-355.32
-  rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?}:
+  rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?, o0 : nat, o1? : nat?}:
     `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [$valtype_numtype(nt)]))
+    -- if ((n?{n} = ?()) <=> (o1?{o1} = ?()))
     -- if (0 < |C.MEM_context|)
-    -- if ($size($valtype_numtype(nt)) =/= ?())
     -- if ((n?{n} = ?()) <=> (sx?{sx} = ?()))
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- (if ($size($valtype_numtype(nt)) = ?(o1)))?{n o1}
     -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= (!($size($valtype_numtype(nt))) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size($valtype_numtype(nt))) / 8))))?{n}
+    -- if ((2 ^ n_A) <= (o0 / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (o1 / 8))))?{n o1}
     -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
 
   ;; 3-typing.watsup:357.1-362.32
-  rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype}:
+  rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, o0 : nat, o1? : nat?}:
     `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype $valtype_numtype(nt)], []))
+    -- if ((n?{n} = ?()) <=> (o1?{o1} = ?()))
     -- if (0 < |C.MEM_context|)
-    -- if ($size($valtype_numtype(nt)) =/= ?())
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- (if ($size($valtype_numtype(nt)) = ?(o1)))?{n o1}
     -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= (!($size($valtype_numtype(nt))) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size($valtype_numtype(nt))) / 8))))?{n}
+    -- if ((2 ^ n_A) <= (o0 / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (o1 / 8))))?{n o1}
     -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
 
 ;; 3-typing.watsup:124.1-124.67
@@ -9351,9 +9371,9 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
     -- if (c = $relop(relop, nt, c_1, c_2))
 
   ;; 6-reduction.watsup:137.1-138.70
-  rule extend {c : c_numtype, n : n, nt : numtype}:
-    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, !($size($valtype_numtype(nt))), S_sx, c))])
-    -- if ($size($valtype_numtype(nt)) =/= ?())
+  rule extend {c : c_numtype, n : n, nt : numtype, o0 : nat}:
+    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, o0, S_sx, c))])
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
 
   ;; 6-reduction.watsup:141.1-143.48
   rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
@@ -9489,15 +9509,16 @@ relation Step_read: `%~>%*`(config, admininstr*)
     -- unless Step_read_before_call_indirect-trap: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
 
   ;; 6-reduction.watsup:94.1-97.52
-  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
+  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state, o0* : val*}:
     `%~>%*`(`%;%*`(z, $admininstr_val(val)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], $admininstr_instr(instr)*{instr})])])
+    -- if (|t*{t}| = |o0*{o0}|)
     -- if (a < |$funcinst(z)|)
     -- if (|t_1^k{t_1}| = k)
     -- if (|t_2^n{t_2}| = n)
     -- if (|val^k{val}| = k)
-    -- (if ($default_(t) =/= ?()))*{t}
+    -- (if ($default_(t) = ?(o0)))*{t o0}
     -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
-    -- if (f = {LOCAL val^k{val} :: !($default_(t))*{t}, MODULE m})
+    -- if (f = {LOCAL val^k{val} :: o0*{t o0}, MODULE m})
 
   ;; 6-reduction.watsup:150.1-151.53
   rule ref.func {x : idx, z : state}:

From ca57e9e8592e1e5dfd38fdfa502719359919f5a2 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Mon, 24 Apr 2023 09:49:23 +0200
Subject: [PATCH 86/98] Update sideconditions

---
 spectec/src/middlend/sideconditions.ml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/spectec/src/middlend/sideconditions.ml b/spectec/src/middlend/sideconditions.ml
index 81b7ec1273..541c0ebd4f 100644
--- a/spectec/src/middlend/sideconditions.ml
+++ b/spectec/src/middlend/sideconditions.ml
@@ -16,7 +16,7 @@ open Il.Ast
 
 (* Errors *)
 
-let _error at msg = Source.error at "sideconditions" msg
+let error at msg = Source.error at "sideconditions" msg
 
 let is_null e = CmpE (EqOp, e, OptE None $ no_region) $ no_region
 let iffE e1 e2 = IfPr (BinE (EquivOp, e1, e2) $ no_region) $ no_region
@@ -94,6 +94,11 @@ let rec t_prem prem = match prem.it with
   | IterPr (prem, iterexp)
   -> iter_side_conditions iterexp @
      List.map (fun pr -> IterPr (pr, iterexp) $ no_region) (t_prem prem) @ t_iterexp iterexp
+  | NegPr prem'
+  -> match t_prem prem' with
+    | [] -> []
+    | _ -> error prem.at "side condition in negated premise"
+
 
 let t_prems = List.concat_map t_prem
 

From efe04b656e7aeb7d2b9c040473d4e1dd56019627 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Mon, 24 Apr 2023 10:06:53 +0200
Subject: [PATCH 87/98] Fix merge blunder

---
 spectec/src/exe-watsup/main.ml  |   3 +
 spectec/test-haskell/SpecTec.hs | 307 +++++++++++++++++++++-
 spectec/test-lean4/SpecTec.lean | 443 +++++++++++++++++++++++++++++++-
 3 files changed, 737 insertions(+), 16 deletions(-)

diff --git a/spectec/src/exe-watsup/main.ml b/spectec/src/exe-watsup/main.ml
index 8bfc710fb3..2dab8593e2 100644
--- a/spectec/src/exe-watsup/main.ml
+++ b/spectec/src/exe-watsup/main.ml
@@ -63,6 +63,9 @@ let argspec = Arg.align
   "--sphinx", Arg.Unit (fun () -> target := Latex Backend_latex.Config.sphinx),
     " Generate Latex for Sphinx";
   "--prose", Arg.Unit (fun () -> target := Prose), " Generate prose";
+  "--haskell", Arg.Unit (fun () -> target := Haskell), " Produce Haskell code";
+  "--lean4", Arg.Unit (fun () -> target := Lean4), " Produce Lean4 code";
+
 
   "--print-il", Arg.Set print_elab_il, "Print il (after elaboration)";
   "--print-final-il", Arg.Set print_final_il, "Print final il";
diff --git a/spectec/test-haskell/SpecTec.hs b/spectec/test-haskell/SpecTec.hs
index 2656880684..befe170513 100644
--- a/spectec/test-haskell/SpecTec.hs
+++ b/spectec/test-haskell/SpecTec.hs
@@ -7,41 +7,71 @@ type N = Natural
 
 type Name = String
 
+
+
 type Byte = Natural
 
+
+
 type U32 = Natural
 
+
+
 type Idx = Natural
 
+
+
 type Funcidx = Idx
 
+
+
 type Globalidx = Idx
 
+
+
 type Tableidx = Idx
 
+
+
 type Memidx = Idx
 
+
+
 type Elemidx = Idx
 
+
+
 type Dataidx = Idx
 
+
+
 type Labelidx = Idx
 
+
+
 type Localidx = Idx
 
+
+
 data Numtype
  = Numtype_I32
  | Numtype_I64
  | Numtype_F32
  | Numtype_F64
 
+
+
 data Vectype
  = Vectype_V128
 
+
+
 data Reftype
  = Reftype_FUNCREF
  | Reftype_EXTERNREF
 
+
+
 data Valtype
  = Valtype_I32
  | Valtype_I64
@@ -65,6 +95,8 @@ valtype_reftype Reftype_EXTERNREF = Valtype_EXTERNREF
 valtype_vectype :: Vectype -> Valtype
 valtype_vectype Vectype_V128 = Valtype_V128
 
+
+
 data In
  = In_I32
  | In_I64
@@ -77,6 +109,8 @@ valtype_in :: In -> Valtype
 valtype_in In_I32 = Valtype_I32
 valtype_in In_I64 = Valtype_I64
 
+
+
 data Fn
  = Fn_F32
  | Fn_F64
@@ -89,34 +123,58 @@ valtype_fn :: Fn -> Valtype
 valtype_fn Fn_F32 = Valtype_F32
 valtype_fn Fn_F64 = Valtype_F64
 
+
+
 type Resulttype = [Valtype]
 
+
+
 type Limits = {- mixop: `[%..%]` -} (U32, U32)
 
+
+
 type Mutflag = {- mixop: MUT -} ()
 
+
+
 type Globaltype = {- mixop: `%?%` -} ((Maybe Mutflag), Valtype)
 
+
+
 type Functype = {- mixop: `%->%` -} (Resulttype, Resulttype)
 
+
+
 type Tabletype = {- mixop: `%%` -} (Limits, Reftype)
 
+
+
 type Memtype = {- mixop: `%I8` -} Limits
 
+
+
 type Elemtype = Reftype
 
+
+
 type Datatype = {- mixop: OK -} ()
 
+
+
 data Externtype
  = Externtype_GLOBAL Globaltype
  | Externtype_FUNC Functype
  | Externtype_TABLE Tabletype
  | Externtype_MEMORY Memtype
 
+
+
 data Sx
  = Sx_U
  | Sx_S
 
+
+
 data Unop_IXX
  = Unop_IXX_CLZ
  | Unop_IXX_CTZ
@@ -201,6 +259,8 @@ type C_vectype = Natural
 
 type Blocktype = Functype
 
+
+
 data Instr
  = Instr_UNREACHABLE
  | Instr_NOP
@@ -244,13 +304,23 @@ data Instr
  | Instr_MEMORY_COPY
  | Instr_MEMORY_INIT Dataidx
  | Instr_DATA_DROP Dataidx
- | Instr_LOAD (Numtype, (Maybe (N, Sx)), Natural, Natural)
- | Instr_STORE (Numtype, (Maybe N), Natural, Natural)
+ | Instr_LOAD (Numtype, (Maybe (N, Sx)), U32, U32)
+ | Instr_STORE (Numtype, (Maybe N), U32, U32)
+
+
+
+
+
+
+
+
 
 type Expr = [Instr]
 
 
 
+
+
 data Elemmode
  = Elemmode_TABLE (Tableidx, Expr)
  | Elemmode_DECLARE
@@ -260,30 +330,60 @@ data Datamode
 
 type Func = {- mixop: `FUNC%%*%` -} (Functype, [Valtype], Expr)
 
+
+
 type Global = {- mixop: GLOBAL -} (Globaltype, Expr)
 
+
+
 type Table = {- mixop: TABLE -} Tabletype
 
+
+
 type Mem = {- mixop: MEMORY -} Memtype
 
+
+
 type Elem = {- mixop: `ELEM%%*%?` -} (Reftype, [Expr], (Maybe Elemmode))
 
+
+
 type Data = {- mixop: `DATA(*)%*%?` -} ([[Byte]], (Maybe Datamode))
 
+
+
 type Start = {- mixop: START -} Funcidx
 
+
+
 data Externuse
  = Externuse_FUNC Funcidx
  | Externuse_GLOBAL Globalidx
  | Externuse_TABLE Tableidx
  | Externuse_MEMORY Memidx
 
+
+
 type Export = {- mixop: EXPORT -} (Name, Externuse)
 
+
+
 type Import = {- mixop: IMPORT -} (Name, Name, Externtype)
 
+
+
 type Module = {- mixop: `MODULE%*%*%*%*%*%*%*%*%*` -} ([Import], [Func], [Global], [Table], [Mem], [Elem], [Data], [Start], [Export])
 
+
+
+Ki :: () -> Natural
+Ki () = 1024
+
+min :: (Natural, Natural) -> Natural
+min (0, j) = 0
+min (i, 0) = 0
+min ((i + 1), (j + 1)) = undefined {- $min(i, j) -}
+
 size :: Valtype -> Natural
 size Valtype_I32 = 32
 size Valtype_I64 = 64
@@ -291,6 +391,8 @@ size Valtype_F32 = 32
 size Valtype_F64 = 64
 size Valtype_V128 = 128
 
+
+
 test_sub_ATOM_22 :: N -> Natural
 test_sub_ATOM_22 n_3_ATOM_y = 0
 
@@ -366,6 +468,76 @@ data Context = MkContext
 
 
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 
 
 
@@ -389,46 +561,74 @@ data Context = MkContext
 
 type Addr = Natural
 
+
+
 type Funcaddr = Addr
 
+
+
 type Globaladdr = Addr
 
+
+
 type Tableaddr = Addr
 
+
+
 type Memaddr = Addr
 
+
+
 type Elemaddr = Addr
 
+
+
 type Dataaddr = Addr
 
+
+
 type Labeladdr = Addr
 
+
+
 type Hostaddr = Addr
 
+
+
 data Num
  = Num_CONST (Numtype, C_numtype)
 
+
+
 data Ref
  = Ref_REF_NULL Reftype
  | Ref_REF_FUNC_ADDR Funcaddr
  | Ref_REF_HOST_ADDR Hostaddr
 
+
+
 data Val
  = Val_CONST (Numtype, C_numtype)
  | Val_REF_NULL Reftype
  | Val_REF_FUNC_ADDR Funcaddr
  | Val_REF_HOST_ADDR Hostaddr
 
+
+
 data Result
  = Result_VALS [Val]
  | Result_TRAP
 
+
+
 data Externval
  = Externval_FUNC Funcaddr
  | Externval_GLOBAL Globaladdr
  | Externval_TABLE Tableaddr
  | Externval_MEM Memaddr
 
+
+
 default_ :: Valtype -> Val
 default_ Valtype_I32 = (Val_CONST (Numtype_I32, 0))
 default_ Valtype_I64 = (Val_CONST (Numtype_I64, 0))
@@ -437,6 +637,8 @@ default_ Valtype_F64 = (Val_CONST (Numtype_F64, 0))
 default_ Valtype_FUNCREF = (Val_REF_NULL Reftype_FUNCREF)
 default_ Valtype_EXTERNREF = (Val_REF_NULL Reftype_EXTERNREF)
 
+
+
 type Exportinst = {- mixop: EXPORT -} (Name, Externval)
 
 data Moduleinst = MkModuleinst
@@ -451,16 +653,30 @@ data Moduleinst = MkModuleinst
 
 type Funcinst = {- mixop: `%;%` -} (Moduleinst, Func)
 
+
+
 type Globalinst = Val
 
+
+
 type Tableinst = [Ref]
 
+
+
 type Meminst = [Byte]
 
+
+
 type Eleminst = [Ref]
 
+
+
 type Datainst = [Byte]
 
+
+
+
+
 data Store = MkStore
  { fUNC :: [Funcinst]
  , gLOBAL :: [Globalinst]
@@ -470,13 +686,21 @@ data Store = MkStore
  , dATA :: [Datainst]
  }
 
+
+
+
+
 data Frame = MkFrame
  { lOCAL :: [Val]
  , mODULE :: Moduleinst
  }
 
+
+
 type State = {- mixop: `%;%` -} (Store, Frame)
 
+
+
 data Admininstr
  = Admininstr_UNREACHABLE
  | Admininstr_NOP
@@ -520,8 +744,8 @@ data Admininstr
  | Admininstr_MEMORY_COPY
  | Admininstr_MEMORY_INIT Dataidx
  | Admininstr_DATA_DROP Dataidx
- | Admininstr_LOAD (Numtype, (Maybe (N, Sx)), Natural, Natural)
- | Admininstr_STORE (Numtype, (Maybe N), Natural, Natural)
+ | Admininstr_LOAD (Numtype, (Maybe (N, Sx)), U32, U32)
+ | Admininstr_STORE (Numtype, (Maybe N), U32, U32)
  | Admininstr_REF_FUNC_ADDR Funcaddr
  | Admininstr_REF_HOST_ADDR Hostaddr
  | Admininstr_CALL_ADDR Funcaddr
@@ -594,72 +818,145 @@ admininstr_val (Val_REF_HOST_ADDR x) = (Admininstr_REF_HOST_ADDR x)
 
 type Config = {- mixop: `%;%*` -} (State, [Admininstr])
 
+
+
 funcaddr :: State -> [Funcaddr]
 funcaddr (s, f) = f.mODULE.fUNC
 
+
+
 funcinst :: State -> [Funcinst]
 funcinst (s, f) = s.fUNC
 
+
+
 func :: (State, Funcidx) -> Funcinst
 func ((s, f), x) = (s.fUNC !! (fromIntegral (f.mODULE.fUNC !! (fromIntegral x))))
 
+
+
 global :: (State, Globalidx) -> Globalinst
 global ((s, f), x) = (s.gLOBAL !! (fromIntegral (f.mODULE.gLOBAL !! (fromIntegral x))))
 
+
+
 table :: (State, Tableidx) -> Tableinst
 table ((s, f), x) = (s.tABLE !! (fromIntegral (f.mODULE.tABLE !! (fromIntegral x))))
 
+
+
 mem :: (State, Memidx) -> Meminst
 mem ((s, f), x) = (s.mEM !! (fromIntegral (f.mODULE.mEM !! (fromIntegral x))))
 
+
+
 elem :: (State, Tableidx) -> Eleminst
 elem ((s, f), x) = (s.eLEM !! (fromIntegral (f.mODULE.eLEM !! (fromIntegral x))))
 
+
+
 data_ :: (State, Dataidx) -> Datainst
 data_ ((s, f), x) = (s.dATA !! (fromIntegral (f.mODULE.dATA !! (fromIntegral x))))
 
+
+
 local :: (State, Localidx) -> Val
 local ((s, f), x) = (f.lOCAL !! (fromIntegral x))
 
+
+
 with_local :: (State, Localidx, Val) -> State
 with_local ((s, f), x, v) = (s, undefined {- f[LOCAL[x] = v] -})
 
+
+
 with_global :: (State, Globalidx, Val) -> State
 with_global ((s, f), x, v) = (undefined {- s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v] -}, f)
 
-with_table :: (State, Tableidx, N, Ref) -> State
+
+
+with_table :: (State, Tableidx, Natural, Ref) -> State
 with_table ((s, f), x, i, r) = (undefined {- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r] -}, f)
 
+
+
 with_tableext :: (State, Tableidx, [Ref]) -> State
 with_tableext ((s, f), x, r) = (undefined {- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}] -}, f)
 
+
+
+with_mem :: (State, Tableidx, Natural, Natural, [Byte]) -> State
+with_mem ((s, f), x, i, j, b) = (undefined {- s[MEM[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}] -}, f)
+
+
+
+with_memext :: (State, Tableidx, [Byte]) -> State
+with_memext ((s, f), x, b) = (undefined {- s[MEM[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}] -}, f)
+
+
+
 with_elem :: (State, Elemidx, [Ref]) -> State
 with_elem ((s, f), x, r) = (undefined {- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}] -}, f)
 
+
+
+with_data :: (State, Dataidx, [Byte]) -> State
+with_data ((s, f), x, b) = (undefined {- s[MEM[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}] -}, f)
+
+
+
+
+
 data E
  = E_HOLE
  | E_SEQ ([Val], E, [Instr])
  | E_LABEL_ (N, [Instr], E)
 
+
+
 unop :: (Unop_numtype, Numtype, C_numtype) -> [C_numtype]
 unop = error "function without clauses"
 
+
+
 binop :: (Binop_numtype, Numtype, C_numtype, C_numtype) -> [C_numtype]
 binop = error "function without clauses"
 
+
+
 testop :: (Testop_numtype, Numtype, C_numtype) -> C_numtype
 testop = error "function without clauses"
 
+
+
 relop :: (Relop_numtype, Numtype, C_numtype, C_numtype) -> C_numtype
 relop = error "function without clauses"
 
+
+
 ext :: (Natural, Natural, Sx, C_numtype) -> C_numtype
 ext = error "function without clauses"
 
+
+
 cvtop :: (Numtype, Cvtop, Numtype, (Maybe Sx), C_numtype) -> [C_numtype]
 cvtop = error "function without clauses"
 
 
 
+wrap_ :: ((Natural, Natural), C_numtype) -> Natural
+wrap_ = error "function without clauses"
+
+bytes_ :: (Natural, C_numtype) -> [Byte]
+bytes_ = error "function without clauses"
+
+
+
+
+
+
+
+
+
 
 
diff --git a/spectec/test-lean4/SpecTec.lean b/spectec/test-lean4/SpecTec.lean
index dcb890528a..fe00cb4e65 100644
--- a/spectec/test-lean4/SpecTec.lean
+++ b/spectec/test-lean4/SpecTec.lean
@@ -34,28 +34,52 @@ def List.upd : List α → Nat → α → List α
 
 @[reducible] def Name := String
 
+
+
 @[reducible] def Byte := Nat
 
+
+
 @[reducible] def U32 := Nat
 
+
+
 @[reducible] def Idx := Nat
 
+
+
 @[reducible] def Funcidx := Idx
 
+
+
 @[reducible] def Globalidx := Idx
 
+
+
 @[reducible] def Tableidx := Idx
 
+
+
 @[reducible] def Memidx := Idx
 
+
+
 @[reducible] def Elemidx := Idx
 
+
+
 @[reducible] def Dataidx := Idx
 
+
+
 @[reducible] def Labelidx := Idx
 
+
+
 @[reducible] def Localidx := Idx
 
+
+
 inductive Numtype where
  | I32 : Numtype
  | I64 : Numtype
@@ -63,15 +87,21 @@ inductive Numtype where
  | F64 : Numtype
   deriving Inhabited, BEq
 
+
+
 inductive Vectype where
  | V128 : Vectype
   deriving Inhabited, BEq
 
+
+
 inductive Reftype where
  | FUNCREF : Reftype
  | EXTERNREF : Reftype
   deriving Inhabited, BEq
 
+
+
 inductive Valtype where
  | I32 : Valtype
  | I64 : Valtype
@@ -96,6 +126,8 @@ def «$valtype_reftype» : Reftype -> Valtype
 def «$valtype_vectype» : Vectype -> Valtype
   | Vectype.V128 => Valtype.V128
 
+
+
 inductive In where
  | I32 : In
  | I64 : In
@@ -109,6 +141,8 @@ def «$valtype_in» : In -> Valtype
   | In.I32 => Valtype.I32
   | In.I64 => Valtype.I64
 
+
+
 inductive Fn where
  | F32 : Fn
  | F64 : Fn
@@ -122,24 +156,44 @@ def «$valtype_fn» : Fn -> Valtype
   | Fn.F32 => Valtype.F32
   | Fn.F64 => Valtype.F64
 
+
+
 @[reducible] def Resulttype := (List Valtype)
 
+
+
 @[reducible] def Limits := /- mixop: `[%..%]` -/ (U32 × U32)
 
+
+
 @[reducible] def Mutflag := /- mixop: MUT -/ Unit
 
+
+
 @[reducible] def Globaltype := /- mixop: `%?%` -/ ((Option Mutflag) × Valtype)
 
+
+
 @[reducible] def Functype := /- mixop: `%->%` -/ (Resulttype × Resulttype)
 
+
+
 @[reducible] def Tabletype := /- mixop: `%%` -/ (Limits × Reftype)
 
+
+
 @[reducible] def Memtype := /- mixop: `%I8` -/ Limits
 
+
+
 @[reducible] def Elemtype := Reftype
 
+
+
 @[reducible] def Datatype := /- mixop: OK -/ Unit
 
+
+
 inductive Externtype where
  | GLOBAL : Globaltype -> Externtype
  | FUNC : Functype -> Externtype
@@ -147,11 +201,15 @@ inductive Externtype where
  | MEMORY : Memtype -> Externtype
   deriving Inhabited, BEq
 
+
+
 inductive Sx where
  | U : Sx
  | S : Sx
   deriving Inhabited, BEq
 
+
+
 inductive Unop_IXX where
  | CLZ : Unop_IXX
  | CTZ : Unop_IXX
@@ -249,6 +307,8 @@ inductive Cvtop where
 
 @[reducible] def Blocktype := Functype
 
+
+
 inductive Instr where
  | UNREACHABLE : Instr
  | NOP : Instr
@@ -292,14 +352,24 @@ inductive Instr where
  | MEMORY_COPY : Instr
  | MEMORY_INIT : Dataidx -> Instr
  | DATA_DROP : Dataidx -> Instr
- | LOAD : (Numtype × (Option (N × Sx)) × Nat × Nat) -> Instr
- | STORE : (Numtype × (Option N) × Nat × Nat) -> Instr
+ | LOAD : (Numtype × (Option (N × Sx)) × U32 × U32) -> Instr
+ | STORE : (Numtype × (Option N) × U32 × U32) -> Instr
   deriving Inhabited, BEq
 
+
+
+
+
+
+
+
+
 @[reducible] def Expr := (List Instr)
 
 
 
+
+
 inductive Elemmode where
  | TABLE : (Tableidx × Expr) -> Elemmode
  | DECLARE : Elemmode
@@ -311,18 +381,32 @@ inductive Datamode where
 
 @[reducible] def Func := /- mixop: `FUNC%%*%` -/ (Functype × (List Valtype) × Expr)
 
+
+
 @[reducible] def Global := /- mixop: GLOBAL -/ (Globaltype × Expr)
 
+
+
 @[reducible] def Table := /- mixop: TABLE -/ Tabletype
 
+
+
 @[reducible] def Mem := /- mixop: MEMORY -/ Memtype
 
+
+
 @[reducible] def Elem := /- mixop: `ELEM%%*%?` -/ (Reftype × (List Expr) × (Option Elemmode))
 
+
+
 @[reducible] def Data := /- mixop: `DATA(*)%*%?` -/ ((List (List Byte)) × (Option Datamode))
 
+
+
 @[reducible] def Start := /- mixop: START -/ Funcidx
 
+
+
 inductive Externuse where
  | FUNC : Funcidx -> Externuse
  | GLOBAL : Globalidx -> Externuse
@@ -330,12 +414,28 @@ inductive Externuse where
  | MEMORY : Memidx -> Externuse
   deriving Inhabited, BEq
 
+
+
 @[reducible] def Export := /- mixop: EXPORT -/ (Name × Externuse)
 
+
+
 @[reducible] def Import := /- mixop: IMPORT -/ (Name × Name × Externtype)
 
+
+
 @[reducible] def Module := /- mixop: `MODULE%*%*%*%*%*%*%*%*%*` -/ ((List Import) × (List Func) × (List Global) × (List Table) × (List Mem) × (List Elem) × (List Data) × (List Start) × (List Export))
 
+
+
+def «$Ki» : Unit -> Nat
+  | () => 1024
+
+def «$min» : (Nat × Nat) -> Nat
+  | (0, j) => 0
+  | (i, 0) => 0
+  | ((i + 1), (j + 1)) => («$min» (i, j))
+
 def «$size» : Valtype -> (Option Nat)
   | Valtype.I32 => (some 32)
   | Valtype.I64 => (some 64)
@@ -344,6 +444,8 @@ def «$size» : Valtype -> (Option Nat)
   | Valtype.V128 => (some 128)
   | x => none
 
+
+
 def «$test_sub_ATOM_22» : N -> Nat
   | n_3_ATOM_y => 0
 
@@ -386,29 +488,41 @@ instance : Append Context where
     RETURN := r1.RETURN ++ r2.RETURN,
   }
 
+
+
 inductive Limits_ok : (Limits × Nat) -> Prop where
   | rule_0 (k : Nat) (n_1 : N) (n_2 : N) : 
     ((n_1 <= n_2) && (n_2 <= k)) -> 
     (Limits_ok ((n_1, n_2), k))
 
+
+
 inductive Functype_ok : Functype -> Prop where
   | rule_0 (ft : Functype) : 
     (Functype_ok ft)
 
+
+
 inductive Globaltype_ok : Globaltype -> Prop where
   | rule_0 (gt : Globaltype) : 
     (Globaltype_ok gt)
 
+
+
 inductive Tabletype_ok : Tabletype -> Prop where
   | rule_0 (lim : Limits) (rt : Reftype) : 
     (Limits_ok (lim, ((((Nat.pow 2) 32)) - 1))) -> 
     (Tabletype_ok (lim, rt))
 
+
+
 inductive Memtype_ok : Memtype -> Prop where
   | rule_0 (lim : Limits) : 
     (Limits_ok (lim, (((Nat.pow 2) 16)))) -> 
     (Memtype_ok lim)
 
+
+
 inductive Externtype_ok : Externtype -> Prop where
   | func (functype : Functype) : 
     (Functype_ok functype) -> 
@@ -423,42 +537,58 @@ inductive Externtype_ok : Externtype -> Prop where
     (Memtype_ok memtype) -> 
     (Externtype_ok (Externtype.MEMORY memtype))
 
+
+
 inductive Valtype_sub : (Valtype × Valtype) -> Prop where
   | refl (t : Valtype) : 
     (Valtype_sub (t, t))
   | bot (t : Valtype) : 
     (Valtype_sub (Valtype.BOT, t))
 
+
+
 inductive Resulttype_sub : ((List Valtype) × (List Valtype)) -> Prop where
   | rule_0 (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
     (t_1.length == t_2.length) -> 
     (Forall₂ (λ t_1 t_2 ↦ (Valtype_sub (t_1, t_2))) t_1 t_2) -> 
     (Resulttype_sub (t_1, t_2))
 
+
+
 inductive Limits_sub : (Limits × Limits) -> Prop where
   | rule_0 (n_11 : N) (n_12 : N) (n_21 : N) (n_22 : N) : 
     (n_11 >= n_21) -> 
     (n_12 <= n_22) -> 
     (Limits_sub ((n_11, n_12), (n_21, n_22)))
 
+
+
 inductive Functype_sub : (Functype × Functype) -> Prop where
   | rule_0 (ft : Functype) : 
     (Functype_sub (ft, ft))
 
+
+
 inductive Globaltype_sub : (Globaltype × Globaltype) -> Prop where
   | rule_0 (gt : Globaltype) : 
     (Globaltype_sub (gt, gt))
 
+
+
 inductive Tabletype_sub : (Tabletype × Tabletype) -> Prop where
   | rule_0 (lim_1 : Limits) (lim_2 : Limits) (rt : Reftype) : 
     (Limits_sub (lim_1, lim_2)) -> 
     (Tabletype_sub ((lim_1, rt), (lim_2, rt)))
 
+
+
 inductive Memtype_sub : (Memtype × Memtype) -> Prop where
   | rule_0 (lim_1 : Limits) (lim_2 : Limits) : 
     (Limits_sub (lim_1, lim_2)) -> 
     (Memtype_sub (lim_1, lim_2))
 
+
+
 inductive Externtype_sub : (Externtype × Externtype) -> Prop where
   | func (ft_1 : Functype) (ft_2 : Functype) : 
     (Functype_sub (ft_1, ft_2)) -> 
@@ -473,6 +603,8 @@ inductive Externtype_sub : (Externtype × Externtype) -> Prop where
     (Memtype_sub (mt_1, mt_2)) -> 
     (Externtype_sub ((Externtype.MEMORY mt_1), (Externtype.MEMORY mt_2)))
 
+
+
 inductive Blocktype_ok : (Context × Blocktype × Functype) -> Prop where
   | rule_0 (C : Context) (ft : Functype) : 
     (Functype_ok ft) -> 
@@ -687,11 +819,19 @@ inductive InstrSeq_ok : (Context × (List Instr) × Functype) -> Prop where
     (InstrSeq_ok (C, instr, (t_1, t_2))) -> 
     (InstrSeq_ok (C, instr, ((t ++ t_1), (t ++ t_2))))end
 
+
+
+
+
 inductive Expr_ok : (Context × Expr × Resulttype) -> Prop where
   | rule_0 (C : Context) (instr : (List Instr)) (t : (List Valtype)) : 
     (InstrSeq_ok (C, instr, ([], t))) -> 
     (Expr_ok (C, instr, t))
 
+
+
+
+
 inductive Instr_const : (Context × Instr) -> Prop where
   | const (C : Context) (c : C_numtype) (nt : Numtype) : 
     (Instr_const (C, (Instr.CONST (nt, c))))
@@ -704,17 +844,23 @@ inductive Instr_const : (Context × Instr) -> Prop where
     ((C.GLOBAL.get! x) == (none, t)) -> 
     (Instr_const (C, (Instr.GLOBAL_GET x)))
 
+
+
 inductive Expr_const : (Context × Expr) -> Prop where
   | rule_0 (C : Context) (instr : (List Instr)) : 
     (Forall (λ instr ↦ (Instr_const (C, instr))) instr) -> 
     (Expr_const (C, instr))
 
+
+
 inductive Expr_ok_const : (Context × Expr × Valtype) -> Prop where
   | rule_0 (C : Context) (expr : Expr) (t : Valtype) : 
     (Expr_ok (C, expr, [t])) -> 
     (Expr_const (C, expr)) -> 
     (Expr_ok_const (C, expr, t))
 
+
+
 inductive Func_ok : (Context × Func × Functype) -> Prop where
   | rule_0 (C : Context) (expr : Expr) (ft : Functype) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
     (ft == (t_1, t_2)) -> 
@@ -722,6 +868,8 @@ inductive Func_ok : (Context × Func × Functype) -> Prop where
     (Expr_ok (({FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [], RETURN := (some t_2)} ++ ({FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := [], LABEL := [t_2], RETURN := none} ++ ({FUNC := [], GLOBAL := [], TABLE := [], MEM := [], ELEM := [], DATA := [], LOCAL := (t_1 ++ t), LABEL := [], RETURN := none} ++ C))), expr, t_2)) -> 
     (Func_ok (C, (ft, t, expr), ft))
 
+
+
 inductive Global_ok : (Context × Global × Globaltype) -> Prop where
   | rule_0 (C : Context) (expr : Expr) (gt : Globaltype) (t : Valtype) : 
     (Globaltype_ok gt) -> 
@@ -729,16 +877,22 @@ inductive Global_ok : (Context × Global × Globaltype) -> Prop where
     (Expr_ok_const (C, expr, t)) -> 
     (Global_ok (C, (gt, expr), gt))
 
+
+
 inductive Table_ok : (Context × Table × Tabletype) -> Prop where
   | rule_0 (C : Context) (tt : Tabletype) : 
     (Tabletype_ok tt) -> 
     (Table_ok (C, tt, tt))
 
+
+
 inductive Mem_ok : (Context × Mem × Memtype) -> Prop where
   | rule_0 (C : Context) (mt : Memtype) : 
     (Memtype_ok mt) -> 
     (Mem_ok (C, mt, mt))
 
+
+
 inductive Elemmode_ok : (Context × Elemmode × Reftype) -> Prop where
   | active (C : Context) (expr : Expr) (lim : Limits) (rt : Reftype) (x : Idx) : 
     (x < C.TABLE.length) -> 
@@ -754,6 +908,8 @@ inductive Elem_ok : (Context × Elem × Reftype) -> Prop where
     (Forall (λ elemmode ↦ (Elemmode_ok (C, elemmode, rt))) elemmode.toList) -> 
     (Elem_ok (C, (rt, expr, elemmode), rt))
 
+
+
 inductive Datamode_ok : (Context × Datamode) -> Prop where
   | rule_0 (C : Context) (expr : Expr) (mt : Memtype) : 
     (0 < C.MEM.length) -> 
@@ -766,17 +922,27 @@ inductive Data_ok : (Context × Data) -> Prop where
     (Forall (λ datamode ↦ (Datamode_ok (C, datamode))) datamode.toList) -> 
     (Data_ok (C, ((List.map (λ b ↦ b) b), datamode)))
 
+
+
+
+
+
+
 inductive Start_ok : (Context × Start) -> Prop where
   | rule_0 (C : Context) (x : Idx) : 
     (x < C.FUNC.length) -> 
     ((C.FUNC.get! x) == ([], [])) -> 
     (Start_ok (C, x))
 
+
+
 inductive Import_ok : (Context × Import × Externtype) -> Prop where
   | rule_0 (C : Context) (name_1 : Name) (name_2 : Name) (xt : Externtype) : 
     (Externtype_ok xt) -> 
     (Import_ok (C, (name_1, name_2, xt), xt))
 
+
+
 inductive Externuse_ok : (Context × Externuse × Externtype) -> Prop where
   | func (C : Context) (ft : Functype) (x : Idx) : 
     (x < C.FUNC.length) -> 
@@ -800,6 +966,10 @@ inductive Export_ok : (Context × Export × Externtype) -> Prop where
     (Externuse_ok (C, externuse, xt)) -> 
     (Export_ok (C, (name, externuse), xt))
 
+
+
+
+
 inductive Module_ok : Module -> Prop where
   | rule_0 (C : Context) (data : (List Data)) (elem : (List Elem)) («export» : (List Export)) (ft : (List Functype)) (func : (List Func)) («global» : (List Global)) (gt : (List Globaltype)) («import» : (List Import)) (mem : (List Mem)) (mt : (List Memtype)) (n : N) (rt : (List Reftype)) (start : (List Start)) (table : (List Table)) (tt : (List Tabletype)) : 
     (ft.length == func.length) -> 
@@ -820,34 +990,58 @@ inductive Module_ok : Module -> Prop where
     (start.length <= 1) -> 
     (Module_ok («import», func, «global», table, mem, elem, data, start, «export»))
 
+
+
 @[reducible] def Addr := Nat
 
+
+
 @[reducible] def Funcaddr := Addr
 
+
+
 @[reducible] def Globaladdr := Addr
 
+
+
 @[reducible] def Tableaddr := Addr
 
+
+
 @[reducible] def Memaddr := Addr
 
+
+
 @[reducible] def Elemaddr := Addr
 
+
+
 @[reducible] def Dataaddr := Addr
 
+
+
 @[reducible] def Labeladdr := Addr
 
+
+
 @[reducible] def Hostaddr := Addr
 
+
+
 inductive Num where
  | CONST : (Numtype × C_numtype) -> Num
   deriving Inhabited, BEq
 
+
+
 inductive Ref where
  | REF_NULL : Reftype -> Ref
  | REF_FUNC_ADDR : Funcaddr -> Ref
  | REF_HOST_ADDR : Hostaddr -> Ref
   deriving Inhabited, BEq
 
+
+
 inductive Val where
  | CONST : (Numtype × C_numtype) -> Val
  | REF_NULL : Reftype -> Val
@@ -855,11 +1049,15 @@ inductive Val where
  | REF_HOST_ADDR : Hostaddr -> Val
   deriving Inhabited, BEq
 
+
+
 inductive Result where
  | _VALS : (List Val) -> Result
  | TRAP : Result
   deriving Inhabited, BEq
 
+
+
 inductive Externval where
  | FUNC : Funcaddr -> Externval
  | GLOBAL : Globaladdr -> Externval
@@ -867,6 +1065,8 @@ inductive Externval where
  | MEM : Memaddr -> Externval
   deriving Inhabited, BEq
 
+
+
 def «$default_» : Valtype -> (Option Val)
   | Valtype.I32 => (some (Val.CONST (Numtype.I32, 0)))
   | Valtype.I64 => (some (Val.CONST (Numtype.I64, 0)))
@@ -876,6 +1076,8 @@ def «$default_» : Valtype -> (Option Val)
   | Valtype.EXTERNREF => (some (Val.REF_NULL Reftype.EXTERNREF))
   | x => none
 
+
+
 @[reducible] def Exportinst := /- mixop: EXPORT -/ (Name × Externval)
 
 structure Moduleinst where 
@@ -900,16 +1102,30 @@ instance : Append Moduleinst where
 
 @[reducible] def Funcinst := /- mixop: `%;%` -/ (Moduleinst × Func)
 
+
+
 @[reducible] def Globalinst := Val
 
+
+
 @[reducible] def Tableinst := (List Ref)
 
+
+
 @[reducible] def Meminst := (List Byte)
 
+
+
 @[reducible] def Eleminst := (List Ref)
 
+
+
 @[reducible] def Datainst := (List Byte)
 
+
+
+
+
 structure Store where 
   FUNC : (List Funcinst)
   GLOBAL : (List Globalinst)
@@ -928,6 +1144,10 @@ instance : Append Store where
     DATA := r1.DATA ++ r2.DATA,
   }
 
+
+
+
+
 structure Frame where 
   LOCAL : (List Val)
   MODULE : Moduleinst
@@ -938,8 +1158,12 @@ instance : Append Frame where
     MODULE := r1.MODULE ++ r2.MODULE,
   }
 
+
+
 @[reducible] def State := /- mixop: `%;%` -/ (Store × Frame)
 
+
+
 inductive Admininstr where
  | UNREACHABLE : Admininstr
  | NOP : Admininstr
@@ -983,8 +1207,8 @@ inductive Admininstr where
  | MEMORY_COPY : Admininstr
  | MEMORY_INIT : Dataidx -> Admininstr
  | DATA_DROP : Dataidx -> Admininstr
- | LOAD : (Numtype × (Option (N × Sx)) × Nat × Nat) -> Admininstr
- | STORE : (Numtype × (Option N) × Nat × Nat) -> Admininstr
+ | LOAD : (Numtype × (Option (N × Sx)) × U32 × U32) -> Admininstr
+ | STORE : (Numtype × (Option N) × U32 × U32) -> Admininstr
  | REF_FUNC_ADDR : Funcaddr -> Admininstr
  | REF_HOST_ADDR : Hostaddr -> Admininstr
  | CALL_ADDR : Funcaddr -> Admininstr
@@ -1058,66 +1282,131 @@ def «$admininstr_val» : Val -> Admininstr
 
 @[reducible] def Config := /- mixop: `%;%*` -/ (State × (List Admininstr))
 
+
+
 def «$funcaddr» : State -> (List Funcaddr)
   | (s, f) => f.MODULE.FUNC
 
+
+
 def «$funcinst» : State -> (List Funcinst)
   | (s, f) => s.FUNC
 
+
+
 def «$func» : (State × Funcidx) -> Funcinst
   | ((s, f), x) => (s.FUNC.get! (f.MODULE.FUNC.get! x))
 
+
+
 def «$global» : (State × Globalidx) -> Globalinst
   | ((s, f), x) => (s.GLOBAL.get! (f.MODULE.GLOBAL.get! x))
 
+
+
 def «$table» : (State × Tableidx) -> Tableinst
   | ((s, f), x) => (s.TABLE.get! (f.MODULE.TABLE.get! x))
 
+
+
 def «$mem» : (State × Memidx) -> Meminst
   | ((s, f), x) => (s.MEM.get! (f.MODULE.MEM.get! x))
 
+
+
 def «$elem» : (State × Tableidx) -> Eleminst
   | ((s, f), x) => (s.ELEM.get! (f.MODULE.ELEM.get! x))
 
+
+
 def «$data» : (State × Dataidx) -> Datainst
   | ((s, f), x) => (s.DATA.get! (f.MODULE.DATA.get! x))
 
+
+
 def «$local» : (State × Localidx) -> Val
   | ((s, f), x) => (f.LOCAL.get! x)
 
+
+
 def «$with_local» : (State × Localidx × Val) -> State
   | ((s, f), x, v) => (s, {f with LOCAL := (f.LOCAL.upd x v) })
 
+
+
 def «$with_global» : (State × Globalidx × Val) -> State
   | ((s, f), x, v) => ({s with GLOBAL := (s.GLOBAL.upd (f.MODULE.GLOBAL.get! x) v) }, f)
 
-def «$with_table» : (State × Tableidx × N × Ref) -> State
+
+
+def «$with_table» : (State × Tableidx × Nat × Ref) -> State
   | ((s, f), x, i, r) => ({s with TABLE := (s.TABLE.upd (f.MODULE.TABLE.get! x) ((s.TABLE.get! (f.MODULE.TABLE.get! x)).upd i r)) }, f)
 
+
+
 def «$with_tableext» : (State × Tableidx × (List Ref)) -> State
   | ((s, f), x, r) => ({s with TABLE := (s.TABLE.upd (f.MODULE.TABLE.get! x) (List.append (s.TABLE.get! (f.MODULE.TABLE.get! x)) r)) }, f)
 
+
+
+def «$with_mem» : (State × Tableidx × Nat × Nat × (List Byte)) -> State
+  | ((s, f), x, i, j, b) => (default /- TODO -/, f)
+
+
+
+def «$with_memext» : (State × Tableidx × (List Byte)) -> State
+  | ((s, f), x, b) => ({s with MEM := (s.MEM.upd (f.MODULE.MEM.get! x) (List.append (s.MEM.get! (f.MODULE.MEM.get! x)) b)) }, f)
+
+
+
 def «$with_elem» : (State × Elemidx × (List Ref)) -> State
   | ((s, f), x, r) => ({s with TABLE := (s.TABLE.upd (f.MODULE.TABLE.get! x) r) }, f)
 
+
+
+def «$with_data» : (State × Dataidx × (List Byte)) -> State
+  | ((s, f), x, b) => ({s with MEM := (s.MEM.upd (f.MODULE.MEM.get! x) b) }, f)
+
+
+
+
+
 inductive E where
  | _HOLE : E
  | _SEQ : ((List Val) × E × (List Instr)) -> E
  | LABEL_ : (N × (List Instr) × E) -> E
   deriving Inhabited, BEq
 
+
+
 def «$unop» : (Unop_numtype × Numtype × C_numtype) -> (List C_numtype) := default
 
+
+
 def «$binop» : (Binop_numtype × Numtype × C_numtype × C_numtype) -> (List C_numtype) := default
 
+
+
 def «$testop» : (Testop_numtype × Numtype × C_numtype) -> C_numtype := default
 
+
+
 def «$relop» : (Relop_numtype × Numtype × C_numtype × C_numtype) -> C_numtype := default
 
+
+
 def «$ext» : (Nat × Nat × Sx × C_numtype) -> C_numtype := default
 
+
+
 def «$cvtop» : (Numtype × Cvtop × Numtype × (Option Sx) × C_numtype) -> (List C_numtype) := default
 
+
+
+def «$wrap_» : ((Nat × Nat) × C_numtype) -> Nat := default
+
+def «$bytes_» : (Nat × C_numtype) -> (List Byte) := default
+
 inductive Step_pure_before_ref_is_null_false : (List Admininstr) -> Prop where
   | ref_is_null_true (rt : Reftype) (val : Val) : 
     (val == (Val.REF_NULL rt)) -> 
@@ -1280,6 +1569,61 @@ inductive Step_read_before_table_init_succ : Config -> Prop where
     (((i + n) > («$elem» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) -> 
     (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))
 
+inductive Step_read_before_memory_fill_zero : Config -> Prop where
+  | memory_fill_trap (i : Nat) (n : N) (val : Val) (z : State) : 
+    ((i + n) > («$mem» (z, 0)).length) -> 
+    (Step_read_before_memory_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_FILL]))
+
+inductive Step_read_before_memory_fill_succ : Config -> Prop where
+  | memory_fill_zero (i : Nat) (n : N) (val : Val) (z : State) : 
+    (Not (Step_read_before_memory_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_FILL]))) -> 
+    (n == 0) -> 
+    (Step_read_before_memory_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_FILL]))
+  | memory_fill_trap (i : Nat) (n : N) (val : Val) (z : State) : 
+    ((i + n) > («$mem» (z, 0)).length) -> 
+    (Step_read_before_memory_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_FILL]))
+
+inductive Step_read_before_memory_copy_zero : Config -> Prop where
+  | memory_copy_trap (i : Nat) (j : Nat) (n : N) (z : State) : 
+    (((i + n) > («$table» (z, 0)).length) || ((j + n) > («$table» (z, 0)).length)) -> 
+    (Step_read_before_memory_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))
+
+inductive Step_read_before_memory_copy_le : Config -> Prop where
+  | memory_copy_zero (i : Nat) (j : Nat) (n : N) (z : State) : 
+    (Not (Step_read_before_memory_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))) -> 
+    (n == 0) -> 
+    (Step_read_before_memory_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))
+  | memory_copy_trap (i : Nat) (j : Nat) (n : N) (z : State) : 
+    (((i + n) > («$table» (z, 0)).length) || ((j + n) > («$table» (z, 0)).length)) -> 
+    (Step_read_before_memory_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))
+
+inductive Step_read_before_memory_copy_gt : Config -> Prop where
+  | memory_copy_le (i : Nat) (j : Nat) (n : N) (z : State) : 
+    (Not (Step_read_before_memory_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))) -> 
+    (j <= i) -> 
+    (Step_read_before_memory_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))
+  | memory_copy_zero (i : Nat) (j : Nat) (n : N) (z : State) : 
+    (Not (Step_read_before_memory_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))) -> 
+    (n == 0) -> 
+    (Step_read_before_memory_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))
+  | memory_copy_trap (i : Nat) (j : Nat) (n : N) (z : State) : 
+    (((i + n) > («$table» (z, 0)).length) || ((j + n) > («$table» (z, 0)).length)) -> 
+    (Step_read_before_memory_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))
+
+inductive Step_read_before_memory_init_zero : Config -> Prop where
+  | memory_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (((i + n) > («$data» (z, y)).length) || ((j + n) > («$mem» (z, 0)).length)) -> 
+    (Step_read_before_memory_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.MEMORY_INIT x)]))
+
+inductive Step_read_before_memory_init_succ : Config -> Prop where
+  | memory_init_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (z : State) : 
+    (Not (Step_read_before_memory_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.MEMORY_INIT x)]))) -> 
+    (n == 0) -> 
+    (Step_read_before_memory_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.MEMORY_INIT x)]))
+  | memory_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (((i + n) > («$data» (z, y)).length) || ((j + n) > («$mem» (z, 0)).length)) -> 
+    (Step_read_before_memory_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.MEMORY_INIT x)]))
+
 inductive Step_read : (Config × (List Admininstr)) -> Prop where
   | call (x : Idx) (z : State) : 
     (x < («$funcaddr» z).length) -> 
@@ -1316,14 +1660,9 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
   | table_get_val (i : Nat) (x : Idx) (z : State) : 
     (i < («$table» (z, x)).length) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET x)]), [(«$admininstr_ref» ((«$table» (z, x)).get! i))]))
-  | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) : 
-    (i >= («$table» (z, x)).length) -> 
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]), [Admininstr.TRAP]))
   | table_size (n : N) (x : Idx) (z : State) : 
     ((«$table» (z, x)).length == n) -> 
     (Step_read ((z, [(Admininstr.TABLE_SIZE x)]), [(Admininstr.CONST (Numtype.I32, n))]))
-  | table_grow_fail (n : N) (x : Idx) (z : State) : 
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), [(Admininstr.CONST (Numtype.I32, (0 - 1)))]))
   | table_fill_trap (i : Nat) (n : N) (val : Val) (x : Idx) (z : State) : 
     ((i + n) > («$table» (z, x)).length) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_FILL x)]), [Admininstr.TRAP]))
@@ -1359,6 +1698,56 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (i < («$elem» (z, y)).length) -> 
     (Not (Step_read_before_table_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]))) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), [(Admininstr.CONST (Numtype.I32, j)), («$admininstr_ref» ((«$elem» (z, y)).get! i)), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_INIT (x, y))]))
+  | load_num_trap (i : Nat) (n_A : N) (n_O : N) (nt : Numtype) (z : State) (o0 : Nat) : 
+    ((«$size» («$valtype_numtype» nt)) == (some o0)) -> 
+    (((i + n_O) + (((Nat.div o0) 8))) >= («$mem» (z, 0)).length) -> 
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.LOAD (nt, none, n_A, n_O))]), [Admininstr.TRAP]))
+  | load_num_val (c : C_numtype) (i : Nat) (n_A : N) (n_O : N) (nt : Numtype) (z : State) (o0 : Nat) (o1 : Nat) : 
+    ((«$size» («$valtype_numtype» nt)) == (some o0)) -> 
+    ((«$size» («$valtype_numtype» nt)) == (some o1)) -> 
+    ((«$bytes_» (o0, c)) == default /- $mem(z, 0)[(i + n_O) : (o1 / 8)] -/) -> 
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.LOAD (nt, none, n_A, n_O))]), [(Admininstr.CONST (nt, c))]))
+  | load_pack_trap (i : Nat) (n : N) (n_A : N) (n_O : N) (nt : Numtype) (sx : Sx) (z : State) : 
+    (((i + n_O) + (((Nat.div n) 8))) >= («$mem» (z, 0)).length) -> 
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.LOAD (nt, (some (n, sx)), n_A, n_O))]), [Admininstr.TRAP]))
+  | load_pack_val (c : C_numtype) (i : Nat) (n : N) (n_A : N) (n_O : N) (nt : Numtype) (sx : Sx) (z : State) : 
+    ((«$bytes_» (n, c)) == default /- $mem(z, 0)[(i + n_O) : (n / 8)] -/) -> 
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.LOAD (nt, (some (n, sx)), n_A, n_O))]), [(Admininstr.CONST (nt, c))]))
+  | memory_fill_trap (i : Nat) (n : N) (val : Val) (z : State) : 
+    ((i + n) > («$mem» (z, 0)).length) -> 
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_FILL]), [Admininstr.TRAP]))
+  | memory_fill_zero (i : Nat) (n : N) (val : Val) (z : State) : 
+    (Not (Step_read_before_memory_fill_zero (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_FILL]))) -> 
+    (n == 0) -> 
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_FILL]), []))
+  | memory_fill_succ (i : Nat) (n : N) (val : Val) (z : State) : 
+    (Not (Step_read_before_memory_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_FILL]))) -> 
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_FILL]), [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.STORE (Numtype.I32, (some 8), 0, 0)), (Admininstr.CONST (Numtype.I32, (i + 1))), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, (n - 1))), Admininstr.MEMORY_FILL]))
+  | memory_copy_trap (i : Nat) (j : Nat) (n : N) (z : State) : 
+    (((i + n) > («$table» (z, 0)).length) || ((j + n) > («$table» (z, 0)).length)) -> 
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]), [Admininstr.TRAP]))
+  | memory_copy_zero (i : Nat) (j : Nat) (n : N) (z : State) : 
+    (Not (Step_read_before_memory_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))) -> 
+    (n == 0) -> 
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]), []))
+  | memory_copy_le (i : Nat) (j : Nat) (n : N) (z : State) : 
+    (Not (Step_read_before_memory_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))) -> 
+    (j <= i) -> 
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]), [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.LOAD (Numtype.I32, (some (8, Sx.U)), 0, 0)), (Admininstr.STORE (Numtype.I32, (some 8), 0, 0)), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), Admininstr.MEMORY_COPY]))
+  | memory_copy_gt (i : Nat) (j : Nat) (n : N) (z : State) : 
+    (Not (Step_read_before_memory_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))) -> 
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]), [(Admininstr.CONST (Numtype.I32, ((j + n) - 1))), (Admininstr.CONST (Numtype.I32, ((i + n) - 1))), (Admininstr.LOAD (Numtype.I32, (some (8, Sx.U)), 0, 0)), (Admininstr.STORE (Numtype.I32, (some 8), 0, 0)), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), Admininstr.MEMORY_COPY]))
+  | memory_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
+    (((i + n) > («$data» (z, y)).length) || ((j + n) > («$mem» (z, 0)).length)) -> 
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.MEMORY_INIT x)]), [Admininstr.TRAP]))
+  | memory_init_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (z : State) : 
+    (Not (Step_read_before_memory_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.MEMORY_INIT x)]))) -> 
+    (n == 0) -> 
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.MEMORY_INIT x)]), []))
+  | memory_init_succ (i : Nat) (j : Nat) (n : N) (x : Idx) (z : State) : 
+    (i < («$data» (z, x)).length) -> 
+    (Not (Step_read_before_memory_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.MEMORY_INIT x)]))) -> 
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.MEMORY_INIT x)]), [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, ((«$data» (z, x)).get! i))), (Admininstr.STORE (Numtype.I32, (some 8), 0, 0)), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.MEMORY_INIT x)]))
 
 inductive Step : (Config × Config) -> Prop where
   | pure (instr : (List Instr)) (instr' : (List Instr)) (z : State) : 
@@ -1371,10 +1760,42 @@ inductive Step : (Config × Config) -> Prop where
     (Step ((z, [(«$admininstr_val» val), (Admininstr.LOCAL_SET x)]), ((«$with_local» (z, x, val)), [])))
   | global_set (val : Val) (x : Idx) (z : State) : 
     (Step ((z, [(«$admininstr_val» val), (Admininstr.GLOBAL_SET x)]), ((«$with_global» (z, x, val)), [])))
+  | table_set_trap (i : Nat) (ref : Ref) (x : Idx) (z : State) : 
+    (i >= («$table» (z, x)).length) -> 
+    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]), (z, [Admininstr.TRAP])))
   | table_set_val (i : Nat) (ref : Ref) (x : Idx) (z : State) : 
     (i < («$table» (z, x)).length) -> 
     (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_ref» ref), (Admininstr.TABLE_GET x)]), ((«$with_table» (z, x, i, ref)), [])))
   | table_grow_succeed (n : N) (ref : Ref) (x : Idx) (z : State) : 
     (Step ((z, [(«$admininstr_ref» ref), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), ((«$with_tableext» (z, x, [ref])), [(Admininstr.CONST (Numtype.I32, («$table» (z, x)).length))])))
+  | table_grow_fail (n : N) (ref : Ref) (x : Idx) (z : State) : 
+    (Step ((z, [(«$admininstr_ref» ref), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_GROW x)]), (z, [(Admininstr.CONST (Numtype.I32, (0 - 1)))])))
   | elem_drop (x : Idx) (z : State) : 
-    (Step ((z, [(Admininstr.ELEM_DROP x)]), ((«$with_elem» (z, x, [])), [])))
\ No newline at end of file
+    (Step ((z, [(Admininstr.ELEM_DROP x)]), ((«$with_elem» (z, x, [])), [])))
+  | store_num_trap (c : C_numtype) (i : Nat) (n_A : N) (n_O : N) (nt : Numtype) (z : State) (o0 : Nat) : 
+    ((«$size» («$valtype_numtype» nt)) == (some o0)) -> 
+    (((i + n_O) + (((Nat.div o0) 8))) >= («$mem» (z, 0)).length) -> 
+    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.STORE (nt, none, n_A, n_O))]), (z, [Admininstr.TRAP])))
+  | store_num_val (b : (List Byte)) (c : C_numtype) (i : Nat) (n_A : N) (n_O : N) (nt : Numtype) (z : State) (o0 : Nat) (o1 : Nat) : 
+    ((«$size» («$valtype_numtype» nt)) == (some o0)) -> 
+    ((«$size» («$valtype_numtype» nt)) == (some o1)) -> 
+    (b == («$bytes_» (o1, c))) -> 
+    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.STORE (nt, none, n_A, n_O))]), ((«$with_mem» (z, 0, (i + n_O), (((Nat.div o0) 8)), b)), [])))
+  | store_pack_trap (c : C_numtype) (i : Nat) (n : N) (n_A : N) (n_O : N) (nt : Numtype) (z : State) : 
+    (((i + n_O) + (((Nat.div n) 8))) >= («$mem» (z, 0)).length) -> 
+    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.STORE (nt, (some n), n_A, n_O))]), (z, [Admininstr.TRAP])))
+  | store_pack_val (b : (List Byte)) (c : C_numtype) (i : Nat) (n : N) (n_A : N) (n_O : N) (nt : Numtype) (z : State) (o0 : Nat) : 
+    ((«$size» («$valtype_numtype» nt)) == (some o0)) -> 
+    (b == («$bytes_» (n, («$wrap_» ((o0, n), c))))) -> 
+    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.STORE (nt, (some n), n_A, n_O))]), ((«$with_mem» (z, 0, (i + n_O), (((Nat.div n) 8)), b)), [])))
+  | memory_grow_succeed (n : N) (z : State) : 
+    (Step ((z, [(Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_GROW]), ((«$with_memext» (z, 0, [0])), [(Admininstr.CONST (Numtype.I32, («$mem» (z, 0)).length))])))
+  | memory_grow_fail (n : N) (z : State) : 
+    (Step ((z, [(Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_GROW]), (z, [(Admininstr.CONST (Numtype.I32, (0 - 1)))])))
+  | data_drop (x : Idx) (z : State) : 
+    (Step ((z, [(Admininstr.DATA_DROP x)]), ((«$with_data» (z, x, [])), [])))
+
+
+
+
+

From 4c539fbed4ba0cb5cabb0c3a239f6cf4c82d72ab Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Mon, 24 Apr 2023 10:09:15 +0200
Subject: [PATCH 88/98] Adjust coding style

---
 spectec/src/exe-watsup/main.ml | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/spectec/src/exe-watsup/main.ml b/spectec/src/exe-watsup/main.ml
index 2dab8593e2..869d548286 100644
--- a/spectec/src/exe-watsup/main.ml
+++ b/spectec/src/exe-watsup/main.ml
@@ -102,7 +102,8 @@ let () =
     let il = if not (!pass_sub || !target = Haskell || !target = Lean4) then il else
      ( log "Subtype injection...";
        let il = Middlend.Sub.transform il in
-       if !print_all_il then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
+       if !print_all_il then
+         Printf.printf "%s\n%!" (Il.Print.string_of_script il);
        log "IL Validation...";
        Il.Validation.valid il;
        il
@@ -111,7 +112,8 @@ let () =
     let il = if not (!pass_totalize || !target = Lean4) then il else
       ( log "Function totalization...";
         let il = Middlend.Totalize.transform il in
-        if !print_all_il then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
+        if !print_all_il then
+          Printf.printf "%s\n%!" (Il.Print.string_of_script il);
         log "IL Validation...";
         Il.Validation.valid il;
         il
@@ -121,7 +123,8 @@ let () =
     let il = if not (!pass_unthe || !target = Lean4) then il else
       ( log "Option projection eliminiation";
         let il = Middlend.Unthe.transform il in
-        if !print_all_il then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
+        if !print_all_il then
+          Printf.printf "%s\n%!" (Il.Print.string_of_script il);
         log "IL Validation...";
         Il.Validation.valid il;
         il
@@ -130,7 +133,8 @@ let () =
     let il = if not (!pass_sideconditions || !target = Lean4) then il else
       ( log "Side condition inference";
         let il = Middlend.Sideconditions.transform il in
-        if !print_all_il then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
+        if !print_all_il then
+          Printf.printf "%s\n%!" (Il.Print.string_of_script il);
         log "IL Validation...";
         Il.Validation.valid il;
         il
@@ -140,7 +144,8 @@ let () =
     let il = if not (!pass_else_elim || !target = Lean4) then il else
       ( log "Else elimination";
         let il = Middlend.Else.transform il in
-        if !print_all_il then Printf.printf "%s\n%!" (Il.Print.string_of_script il);
+        if !print_all_il then
+          Printf.printf "%s\n%!" (Il.Print.string_of_script il);
         log "IL Validation...";
         Il.Validation.valid il;
         il

From 4aec85dac838c0f96bea9ba33a85aaf2a9afd2c9 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Mon, 24 Apr 2023 11:09:55 +0200
Subject: [PATCH 89/98] Assume totalize has run

---
 spectec/src/backend-lean4/gen.ml | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 4a8f315316..014d932157 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -236,12 +236,7 @@ let rec render_def (d : def) =
     show_input d ^
     "def " ^ render_fun_id id ^ " : " ^ render_typ typ1 ^ " -> " ^ render_typ typ2 ^
     begin if clauses = [] then " := default" else
-    String.concat "" (List.map (render_clause id) clauses) ^
-    ""
-    (* TODO
-    (if (List.exists (fun h -> h.hintid.it = "partial") hints)
-    then "\n  | _ => default" else "") (* Could use no_error_if_unused% as well *)
-    *)
+    String.concat "" (List.map (render_clause id) clauses)
     end
 
   | RelD (id, _mixop, typ, rules) ->

From cd51aa7391498084cca09d6b0f790348c2551d98 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 26 Apr 2023 09:38:32 +0200
Subject: [PATCH 90/98] Finish merge

---
 spectec/src/backend-lean4/gen.ml |   2 +-
 spectec/test-frontend/TEST.md    |  40 ---
 spectec/test-haskell/SpecTec.hs  |  16 +-
 spectec/test-middlend/TEST.md    | 484 +------------------------------
 4 files changed, 17 insertions(+), 525 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 014d932157..8584020332 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -152,7 +152,7 @@ and render_idx e_string exp = parens (e_string ^ ".get! " ^ render_exp exp)
 (* The path is inside out, in a way, hence the continuation passing style here *)
 and render_path (path : path) old_val (k : string -> string) : string = match path.it with
   | RootP -> k old_val
-  | DotP (path', a) ->
+  | DotP (path', _, a) ->
     render_path path' old_val (fun old_val ->
      "{" ^ old_val ^ " with " ^  render_field_name a ^ " := " ^ k (render_dot old_val a) ^ " }"
     )
diff --git a/spectec/test-frontend/TEST.md b/spectec/test-frontend/TEST.md
index e42a3f1bb5..e153149c91 100644
--- a/spectec/test-frontend/TEST.md
+++ b/spectec/test-frontend/TEST.md
@@ -1163,83 +1163,43 @@ def local : (state, localidx) -> val
 
 ;; 4-runtime.watsup:125.1-125.78
 def with_local : (state, localidx, val) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:134.1-134.52
-  def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL[x] = v])
-=======
-  ;; 4-runtime.watsup:133.1-133.52
   def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL_frame[x] = v])
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:126.1-126.79
 def with_global : (state, globalidx, val) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:135.1-135.71
-  def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
-=======
-  ;; 4-runtime.watsup:134.1-134.71
   def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:127.1-127.83
 def with_table : (state, tableidx, nat, ref) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:136.1-136.74
-  def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
-=======
-  ;; 4-runtime.watsup:135.1-135.74
   def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:128.1-128.80
 def with_tableext : (state, tableidx, ref*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:137.1-137.75
-  def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
-=======
-  ;; 4-runtime.watsup:136.1-136.75
   def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:129.1-129.90
 def with_mem : (state, tableidx, nat, nat, byte*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:138.1-138.77
-  def {b* : byte*, f : frame, i : nat, j : nat, s : store, x : idx} with_mem(`%;%`(s, f), x, i, j, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}], f)
-=======
-  ;; 4-runtime.watsup:137.1-137.77
   def {b* : byte*, f : frame, i : nat, j : nat, s : store, x : idx} with_mem(`%;%`(s, f), x, i, j, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:130.1-130.78
 def with_memext : (state, tableidx, byte*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:139.1-139.69
-  def {b* : byte*, f : frame, s : store, x : idx} with_memext(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}], f)
-=======
-  ;; 4-runtime.watsup:138.1-138.69
   def {b* : byte*, f : frame, s : store, x : idx} with_memext(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:131.1-131.77
 def with_elem : (state, elemidx, ref*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:140.1-140.69
-  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
-=======
-  ;; 4-runtime.watsup:139.1-139.69
   def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:132.1-132.77
 def with_data : (state, dataidx, byte*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:141.1-141.65
-  def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
-=======
-  ;; 4-runtime.watsup:140.1-140.65
   def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:155.1-158.21
 rec {
diff --git a/spectec/test-haskell/SpecTec.hs b/spectec/test-haskell/SpecTec.hs
index befe170513..8d49cf0db5 100644
--- a/spectec/test-haskell/SpecTec.hs
+++ b/spectec/test-haskell/SpecTec.hs
@@ -866,42 +866,42 @@ local ((s, f), x) = (f.lOCAL !! (fromIntegral x))
 
 
 with_local :: (State, Localidx, Val) -> State
-with_local ((s, f), x, v) = (s, undefined {- f[LOCAL[x] = v] -})
+with_local ((s, f), x, v) = (s, undefined {- f[LOCAL_frame[x] = v] -})
 
 
 
 with_global :: (State, Globalidx, Val) -> State
-with_global ((s, f), x, v) = (undefined {- s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v] -}, f)
+with_global ((s, f), x, v) = (undefined {- s[GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]] = v] -}, f)
 
 
 
 with_table :: (State, Tableidx, Natural, Ref) -> State
-with_table ((s, f), x, i, r) = (undefined {- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r] -}, f)
+with_table ((s, f), x, i, r) = (undefined {- s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]][i] = r] -}, f)
 
 
 
 with_tableext :: (State, Tableidx, [Ref]) -> State
-with_tableext ((s, f), x, r) = (undefined {- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}] -}, f)
+with_tableext ((s, f), x, r) = (undefined {- s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}] -}, f)
 
 
 
 with_mem :: (State, Tableidx, Natural, Natural, [Byte]) -> State
-with_mem ((s, f), x, i, j, b) = (undefined {- s[MEM[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}] -}, f)
+with_mem ((s, f), x, i, j, b) = (undefined {- s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}] -}, f)
 
 
 
 with_memext :: (State, Tableidx, [Byte]) -> State
-with_memext ((s, f), x, b) = (undefined {- s[MEM[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}] -}, f)
+with_memext ((s, f), x, b) = (undefined {- s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}] -}, f)
 
 
 
 with_elem :: (State, Elemidx, [Ref]) -> State
-with_elem ((s, f), x, r) = (undefined {- s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}] -}, f)
+with_elem ((s, f), x, r) = (undefined {- s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}] -}, f)
 
 
 
 with_data :: (State, Dataidx, [Byte]) -> State
-with_data ((s, f), x, b) = (undefined {- s[MEM[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}] -}, f)
+with_data ((s, f), x, b) = (undefined {- s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}] -}, f)
 
 
 
diff --git a/spectec/test-middlend/TEST.md b/spectec/test-middlend/TEST.md
index 4d64388d48..97d886dfa2 100644
--- a/spectec/test-middlend/TEST.md
+++ b/spectec/test-middlend/TEST.md
@@ -1162,83 +1162,43 @@ def local : (state, localidx) -> val
 
 ;; 4-runtime.watsup:125.1-125.78
 def with_local : (state, localidx, val) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:134.1-134.52
-  def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL[x] = v])
-=======
-  ;; 4-runtime.watsup:133.1-133.52
   def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL_frame[x] = v])
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:126.1-126.79
 def with_global : (state, globalidx, val) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:135.1-135.71
-  def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
-=======
-  ;; 4-runtime.watsup:134.1-134.71
   def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:127.1-127.83
 def with_table : (state, tableidx, nat, ref) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:136.1-136.74
-  def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
-=======
-  ;; 4-runtime.watsup:135.1-135.74
   def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:128.1-128.80
 def with_tableext : (state, tableidx, ref*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:137.1-137.75
-  def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
-=======
-  ;; 4-runtime.watsup:136.1-136.75
   def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:129.1-129.90
 def with_mem : (state, tableidx, nat, nat, byte*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:138.1-138.77
-  def {b* : byte*, f : frame, i : nat, j : nat, s : store, x : idx} with_mem(`%;%`(s, f), x, i, j, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}], f)
-=======
-  ;; 4-runtime.watsup:137.1-137.77
   def {b* : byte*, f : frame, i : nat, j : nat, s : store, x : idx} with_mem(`%;%`(s, f), x, i, j, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:130.1-130.78
 def with_memext : (state, tableidx, byte*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:139.1-139.69
-  def {b* : byte*, f : frame, s : store, x : idx} with_memext(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}], f)
-=======
-  ;; 4-runtime.watsup:138.1-138.69
   def {b* : byte*, f : frame, s : store, x : idx} with_memext(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:131.1-131.77
 def with_elem : (state, elemidx, ref*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:140.1-140.69
-  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
-=======
-  ;; 4-runtime.watsup:139.1-139.69
   def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:132.1-132.77
 def with_data : (state, dataidx, byte*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:141.1-141.65
-  def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
-=======
-  ;; 4-runtime.watsup:140.1-140.65
   def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:155.1-158.21
 rec {
@@ -2924,83 +2884,43 @@ def local : (state, localidx) -> val
 
 ;; 4-runtime.watsup:125.1-125.78
 def with_local : (state, localidx, val) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:134.1-134.52
-  def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL[x] = v])
-=======
-  ;; 4-runtime.watsup:133.1-133.52
   def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL_frame[x] = v])
->>>>>>> sub-elim
 
 ;; 4-runtime.watsup:126.1-126.79
 def with_global : (state, globalidx, val) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:135.1-135.71
-  def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
-=======
-  ;; 4-runtime.watsup:134.1-134.71
   def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
->>>>>>> sub-elim
 
 ;; 4-runtime.watsup:127.1-127.83
 def with_table : (state, tableidx, nat, ref) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:136.1-136.74
-  def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
-=======
-  ;; 4-runtime.watsup:135.1-135.74
   def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
->>>>>>> sub-elim
 
 ;; 4-runtime.watsup:128.1-128.80
 def with_tableext : (state, tableidx, ref*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:137.1-137.75
-  def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
-=======
-  ;; 4-runtime.watsup:136.1-136.75
   def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
->>>>>>> sub-elim
 
 ;; 4-runtime.watsup:129.1-129.90
 def with_mem : (state, tableidx, nat, nat, byte*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:138.1-138.77
-  def {b* : byte*, f : frame, i : nat, j : nat, s : store, x : idx} with_mem(`%;%`(s, f), x, i, j, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}], f)
-=======
-  ;; 4-runtime.watsup:137.1-137.77
   def {b* : byte*, f : frame, i : nat, j : nat, s : store, x : idx} with_mem(`%;%`(s, f), x, i, j, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}], f)
->>>>>>> sub-elim
 
 ;; 4-runtime.watsup:130.1-130.78
 def with_memext : (state, tableidx, byte*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:139.1-139.69
-  def {b* : byte*, f : frame, s : store, x : idx} with_memext(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}], f)
-=======
-  ;; 4-runtime.watsup:138.1-138.69
   def {b* : byte*, f : frame, s : store, x : idx} with_memext(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}], f)
->>>>>>> sub-elim
 
 ;; 4-runtime.watsup:131.1-131.77
 def with_elem : (state, elemidx, ref*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:140.1-140.69
-  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
-=======
-  ;; 4-runtime.watsup:139.1-139.69
   def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
->>>>>>> sub-elim
 
 ;; 4-runtime.watsup:132.1-132.77
 def with_data : (state, dataidx, byte*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:141.1-141.65
-  def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
-=======
-  ;; 4-runtime.watsup:140.1-140.65
   def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
->>>>>>> sub-elim
 
 ;; 4-runtime.watsup:155.1-158.21
 rec {
@@ -4688,83 +4608,43 @@ def local : (state, localidx) -> val
 
 ;; 4-runtime.watsup:125.1-125.78
 def with_local : (state, localidx, val) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:134.1-134.52
-  def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL[x] = v])
-=======
-  ;; 4-runtime.watsup:133.1-133.52
   def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL_frame[x] = v])
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:126.1-126.79
 def with_global : (state, globalidx, val) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:135.1-135.71
-  def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
-=======
-  ;; 4-runtime.watsup:134.1-134.71
   def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:127.1-127.83
 def with_table : (state, tableidx, nat, ref) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:136.1-136.74
-  def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
-=======
-  ;; 4-runtime.watsup:135.1-135.74
   def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:128.1-128.80
 def with_tableext : (state, tableidx, ref*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:137.1-137.75
-  def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
-=======
-  ;; 4-runtime.watsup:136.1-136.75
   def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:129.1-129.90
 def with_mem : (state, tableidx, nat, nat, byte*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:138.1-138.77
-  def {b* : byte*, f : frame, i : nat, j : nat, s : store, x : idx} with_mem(`%;%`(s, f), x, i, j, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}], f)
-=======
-  ;; 4-runtime.watsup:137.1-137.77
   def {b* : byte*, f : frame, i : nat, j : nat, s : store, x : idx} with_mem(`%;%`(s, f), x, i, j, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:130.1-130.78
 def with_memext : (state, tableidx, byte*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:139.1-139.69
-  def {b* : byte*, f : frame, s : store, x : idx} with_memext(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}], f)
-=======
-  ;; 4-runtime.watsup:138.1-138.69
   def {b* : byte*, f : frame, s : store, x : idx} with_memext(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:131.1-131.77
 def with_elem : (state, elemidx, ref*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:140.1-140.69
-  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
-=======
-  ;; 4-runtime.watsup:139.1-139.69
   def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:132.1-132.77
 def with_data : (state, dataidx, byte*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:141.1-141.65
-  def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
-=======
-  ;; 4-runtime.watsup:140.1-140.65
   def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:155.1-158.21
 rec {
@@ -6461,83 +6341,43 @@ def local : (state, localidx) -> val
 
 ;; 4-runtime.watsup:125.1-125.78
 def with_local : (state, localidx, val) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:134.1-134.52
-  def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL[x] = v])
-=======
-  ;; 4-runtime.watsup:133.1-133.52
   def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL_frame[x] = v])
->>>>>>> the-elimination
 
 ;; 4-runtime.watsup:126.1-126.79
 def with_global : (state, globalidx, val) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:135.1-135.71
-  def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
-=======
-  ;; 4-runtime.watsup:134.1-134.71
   def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
->>>>>>> the-elimination
 
 ;; 4-runtime.watsup:127.1-127.83
 def with_table : (state, tableidx, nat, ref) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:136.1-136.74
-  def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
-=======
-  ;; 4-runtime.watsup:135.1-135.74
   def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
->>>>>>> the-elimination
 
 ;; 4-runtime.watsup:128.1-128.80
 def with_tableext : (state, tableidx, ref*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:137.1-137.75
-  def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
-=======
-  ;; 4-runtime.watsup:136.1-136.75
   def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
->>>>>>> the-elimination
 
 ;; 4-runtime.watsup:129.1-129.90
 def with_mem : (state, tableidx, nat, nat, byte*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:138.1-138.77
-  def {b* : byte*, f : frame, i : nat, j : nat, s : store, x : idx} with_mem(`%;%`(s, f), x, i, j, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}], f)
-=======
-  ;; 4-runtime.watsup:137.1-137.77
   def {b* : byte*, f : frame, i : nat, j : nat, s : store, x : idx} with_mem(`%;%`(s, f), x, i, j, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}], f)
->>>>>>> the-elimination
 
 ;; 4-runtime.watsup:130.1-130.78
 def with_memext : (state, tableidx, byte*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:139.1-139.69
-  def {b* : byte*, f : frame, s : store, x : idx} with_memext(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}], f)
-=======
-  ;; 4-runtime.watsup:138.1-138.69
   def {b* : byte*, f : frame, s : store, x : idx} with_memext(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}], f)
->>>>>>> the-elimination
 
 ;; 4-runtime.watsup:131.1-131.77
 def with_elem : (state, elemidx, ref*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:140.1-140.69
-  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
-=======
-  ;; 4-runtime.watsup:139.1-139.69
   def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
->>>>>>> the-elimination
 
 ;; 4-runtime.watsup:132.1-132.77
 def with_data : (state, dataidx, byte*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:141.1-141.65
-  def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
-=======
-  ;; 4-runtime.watsup:140.1-140.65
   def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
->>>>>>> the-elimination
 
 ;; 4-runtime.watsup:155.1-158.21
 rec {
@@ -7049,41 +6889,17 @@ syntax valtype =
   | EXTERNREF
   | BOT
 
-<<<<<<< HEAD
-def valtype_numtype : numtype -> valtype
-  def valtype_numtype(I32_numtype) = I32_valtype
-  def valtype_numtype(I64_numtype) = I64_valtype
-  def valtype_numtype(F32_numtype) = F32_valtype
-  def valtype_numtype(F64_numtype) = F64_valtype
-
-def valtype_reftype : reftype -> valtype
-  def valtype_reftype(FUNCREF_reftype) = FUNCREF_valtype
-  def valtype_reftype(EXTERNREF_reftype) = EXTERNREF_valtype
-
-def valtype_vectype : vectype -> valtype
-=======
-;;
 def valtype_numtype : numtype -> valtype
-  ;;
   def valtype_numtype(I32_numtype) = I32_valtype
-  ;;
   def valtype_numtype(I64_numtype) = I64_valtype
-  ;;
   def valtype_numtype(F32_numtype) = F32_valtype
-  ;;
   def valtype_numtype(F64_numtype) = F64_valtype
 
-;;
 def valtype_reftype : reftype -> valtype
-  ;;
   def valtype_reftype(FUNCREF_reftype) = FUNCREF_valtype
-  ;;
   def valtype_reftype(EXTERNREF_reftype) = EXTERNREF_valtype
 
-;;
 def valtype_vectype : vectype -> valtype
-  ;;
->>>>>>> sub-elim
   def valtype_vectype(V128_vectype) = V128_valtype
 
 ;; 1-syntax.watsup:48.1-48.39
@@ -7091,27 +6907,12 @@ syntax in =
   | I32
   | I64
 
-<<<<<<< HEAD
-def numtype_in : in -> numtype
-  def numtype_in(I32_in) = I32_numtype
-  def numtype_in(I64_in) = I64_numtype
-
-def valtype_in : in -> valtype
-  def valtype_in(I32_in) = I32_valtype
-=======
-;;
 def numtype_in : in -> numtype
-  ;;
   def numtype_in(I32_in) = I32_numtype
-  ;;
   def numtype_in(I64_in) = I64_numtype
 
-;;
 def valtype_in : in -> valtype
-  ;;
   def valtype_in(I32_in) = I32_valtype
-  ;;
->>>>>>> sub-elim
   def valtype_in(I64_in) = I64_valtype
 
 ;; 1-syntax.watsup:49.1-49.39
@@ -7119,27 +6920,12 @@ syntax fn =
   | F32
   | F64
 
-<<<<<<< HEAD
-def numtype_fn : fn -> numtype
-  def numtype_fn(F32_fn) = F32_numtype
-  def numtype_fn(F64_fn) = F64_numtype
-
-def valtype_fn : fn -> valtype
-  def valtype_fn(F32_fn) = F32_valtype
-=======
-;;
 def numtype_fn : fn -> numtype
-  ;;
   def numtype_fn(F32_fn) = F32_numtype
-  ;;
   def numtype_fn(F64_fn) = F64_numtype
 
-;;
 def valtype_fn : fn -> valtype
-  ;;
   def valtype_fn(F32_fn) = F32_valtype
-  ;;
->>>>>>> sub-elim
   def valtype_fn(F64_fn) = F64_valtype
 
 ;; 1-syntax.watsup:56.1-57.11
@@ -7680,7 +7466,6 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([$valtype_numtype(nt) $valtype_numtype(nt)], [I32_valtype]))
 
   ;; 3-typing.watsup:238.1-240.23
-<<<<<<< HEAD
   rule extend {C : context, n : n, nt : numtype, o0 : nat}:
     `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([$valtype_numtype(nt)], [$valtype_numtype(nt)]))
     -- if ($size($valtype_numtype(nt)) = ?(o0))
@@ -7701,28 +7486,6 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if ($size($valtype_in(in_2)) = ?(o1))
     -- if (in_1 =/= in_2)
     -- if ((sx?{sx} = ?()) <=> (o0 > o1))
-=======
-  rule extend {C : context, n : n, nt : numtype}:
-    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([$valtype_numtype(nt)], [$valtype_numtype(nt)]))
-    -- if ($size($valtype_numtype(nt)) =/= ?())
-    -- if (n <= !($size($valtype_numtype(nt))))
-
-  ;; 3-typing.watsup:242.1-245.34
-  rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype}:
-    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([$valtype_numtype(nt_2)], [$valtype_numtype(nt_1)]))
-    -- if ($size($valtype_numtype(nt_1)) =/= ?())
-    -- if ($size($valtype_numtype(nt_2)) =/= ?())
-    -- if (nt_1 =/= nt_2)
-    -- if (!($size($valtype_numtype(nt_1))) = !($size($valtype_numtype(nt_2))))
-
-  ;; 3-typing.watsup:247.1-250.52
-  rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?}:
-    `%|-%:%`(C, CVTOP_instr($numtype_in(in_1), CONVERT_cvtop, $numtype_in(in_2), sx?{sx}), `%->%`([$valtype_in(in_2)], [$valtype_in(in_1)]))
-    -- if ($size($valtype_in(in_1)) =/= ?())
-    -- if ($size($valtype_in(in_2)) =/= ?())
-    -- if (in_1 =/= in_2)
-    -- if ((sx?{sx} = ?()) <=> (!($size($valtype_in(in_1))) > !($size($valtype_in(in_2)))))
->>>>>>> sub-elim
 
   ;; 3-typing.watsup:252.1-254.22
   rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
@@ -7864,22 +7627,14 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (C.DATA_context[x] = OK)
 
   ;; 3-typing.watsup:350.1-355.32
-<<<<<<< HEAD
   rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?, o0 : nat, o1? : nat?}:
     `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [$valtype_numtype(nt)]))
     -- if (0 < |C.MEM_context|)
     -- if ((n?{n} = ?()) <=> (o1?{o1} = ?()))
-=======
-  rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?}:
-    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [$valtype_numtype(nt)]))
-    -- if (0 < |C.MEM_context|)
-    -- if ($size($valtype_numtype(nt)) =/= ?())
->>>>>>> sub-elim
     -- if ((n?{n} = ?()) <=> (sx?{sx} = ?()))
     -- if ($size($valtype_numtype(nt)) = ?(o0))
     -- (if ($size($valtype_numtype(nt)) = ?(o1)))?{o1}
     -- if (C.MEM_context[0] = mt)
-<<<<<<< HEAD
     -- if ((2 ^ n_A) <= (o0 / 8))
     -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (o1 / 8))))?{n o1}
     -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
@@ -7894,20 +7649,6 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (C.MEM_context[0] = mt)
     -- if ((2 ^ n_A) <= (o0 / 8))
     -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (o1 / 8))))?{n o1}
-=======
-    -- if ((2 ^ n_A) <= (!($size($valtype_numtype(nt))) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size($valtype_numtype(nt))) / 8))))?{n}
-    -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
-
-  ;; 3-typing.watsup:357.1-362.32
-  rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype}:
-    `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype $valtype_numtype(nt)], []))
-    -- if (0 < |C.MEM_context|)
-    -- if ($size($valtype_numtype(nt)) =/= ?())
-    -- if (C.MEM_context[0] = mt)
-    -- if ((2 ^ n_A) <= (!($size($valtype_numtype(nt))) / 8))
-    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (!($size($valtype_numtype(nt))) / 8))))?{n}
->>>>>>> sub-elim
     -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
 
 ;; 3-typing.watsup:124.1-124.67
@@ -8182,16 +7923,10 @@ def default_ : valtype -> val?
   def default_(F32_valtype) = ?(CONST_val(F32_numtype, 0))
   ;; 4-runtime.watsup:48.1-48.35
   def default_(F64_valtype) = ?(CONST_val(F64_numtype, 0))
-<<<<<<< HEAD
   ;; 4-runtime.watsup:49.1-49.44
   def default_(FUNCREF_valtype) = ?(REF.NULL_val(FUNCREF_reftype))
   ;; 4-runtime.watsup:50.1-50.48
   def default_(EXTERNREF_valtype) = ?(REF.NULL_val(EXTERNREF_reftype))
-=======
-  ;; 4-runtime.watsup:49.1-49.34
-  def {rt : reftype} default_($valtype_reftype(rt)) = ?(REF.NULL_val(rt))
-  ;;
->>>>>>> sub-elim
   def {x : valtype} default_(x) = ?()
 
 ;; 4-runtime.watsup:61.1-61.71
@@ -8284,7 +8019,6 @@ syntax admininstr =
   | TRAP
 }
 
-<<<<<<< HEAD
 def admininstr_globalinst : globalinst -> admininstr
   def {x : (numtype, c_numtype)} admininstr_globalinst(CONST_val(x)) = CONST_admininstr(x)
   def {x : reftype} admininstr_globalinst(REF.NULL_val(x)) = REF.NULL_admininstr(x)
@@ -8349,131 +8083,6 @@ def admininstr_val : val -> admininstr
   def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
 
 ;; 4-runtime.watsup:84.1-84.62
-=======
-;;
-def admininstr_globalinst : globalinst -> admininstr
-  ;;
-  def {x : (numtype, c_numtype)} admininstr_globalinst(CONST_val(x)) = CONST_admininstr(x)
-  ;;
-  def {x : reftype} admininstr_globalinst(REF.NULL_val(x)) = REF.NULL_admininstr(x)
-  ;;
-  def {x : funcaddr} admininstr_globalinst(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
-  def {x : hostaddr} admininstr_globalinst(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
-
-;;
-def admininstr_instr : instr -> admininstr
-  ;;
-  def admininstr_instr(UNREACHABLE_instr) = UNREACHABLE_admininstr
-  ;;
-  def admininstr_instr(NOP_instr) = NOP_admininstr
-  ;;
-  def admininstr_instr(DROP_instr) = DROP_admininstr
-  ;;
-  def {x : valtype?} admininstr_instr(SELECT_instr(x)) = SELECT_admininstr(x)
-  ;;
-  def {x : (blocktype, instr*)} admininstr_instr(BLOCK_instr(x)) = BLOCK_admininstr(x)
-  ;;
-  def {x : (blocktype, instr*)} admininstr_instr(LOOP_instr(x)) = LOOP_admininstr(x)
-  ;;
-  def {x : (blocktype, instr*, instr*)} admininstr_instr(IF_instr(x)) = IF_admininstr(x)
-  ;;
-  def {x : labelidx} admininstr_instr(BR_instr(x)) = BR_admininstr(x)
-  ;;
-  def {x : labelidx} admininstr_instr(BR_IF_instr(x)) = BR_IF_admininstr(x)
-  ;;
-  def {x : (labelidx*, labelidx)} admininstr_instr(BR_TABLE_instr(x)) = BR_TABLE_admininstr(x)
-  ;;
-  def {x : funcidx} admininstr_instr(CALL_instr(x)) = CALL_admininstr(x)
-  ;;
-  def {x : (tableidx, functype)} admininstr_instr(CALL_INDIRECT_instr(x)) = CALL_INDIRECT_admininstr(x)
-  ;;
-  def admininstr_instr(RETURN_instr) = RETURN_admininstr
-  ;;
-  def {x : (numtype, c_numtype)} admininstr_instr(CONST_instr(x)) = CONST_admininstr(x)
-  ;;
-  def {x : (numtype, unop_numtype)} admininstr_instr(UNOP_instr(x)) = UNOP_admininstr(x)
-  ;;
-  def {x : (numtype, binop_numtype)} admininstr_instr(BINOP_instr(x)) = BINOP_admininstr(x)
-  ;;
-  def {x : (numtype, testop_numtype)} admininstr_instr(TESTOP_instr(x)) = TESTOP_admininstr(x)
-  ;;
-  def {x : (numtype, relop_numtype)} admininstr_instr(RELOP_instr(x)) = RELOP_admininstr(x)
-  ;;
-  def {x : (numtype, n)} admininstr_instr(EXTEND_instr(x)) = EXTEND_admininstr(x)
-  ;;
-  def {x : (numtype, cvtop, numtype, sx?)} admininstr_instr(CVTOP_instr(x)) = CVTOP_admininstr(x)
-  ;;
-  def {x : reftype} admininstr_instr(REF.NULL_instr(x)) = REF.NULL_admininstr(x)
-  ;;
-  def {x : funcidx} admininstr_instr(REF.FUNC_instr(x)) = REF.FUNC_admininstr(x)
-  ;;
-  def admininstr_instr(REF.IS_NULL_instr) = REF.IS_NULL_admininstr
-  ;;
-  def {x : localidx} admininstr_instr(LOCAL.GET_instr(x)) = LOCAL.GET_admininstr(x)
-  ;;
-  def {x : localidx} admininstr_instr(LOCAL.SET_instr(x)) = LOCAL.SET_admininstr(x)
-  ;;
-  def {x : localidx} admininstr_instr(LOCAL.TEE_instr(x)) = LOCAL.TEE_admininstr(x)
-  ;;
-  def {x : globalidx} admininstr_instr(GLOBAL.GET_instr(x)) = GLOBAL.GET_admininstr(x)
-  ;;
-  def {x : globalidx} admininstr_instr(GLOBAL.SET_instr(x)) = GLOBAL.SET_admininstr(x)
-  ;;
-  def {x : tableidx} admininstr_instr(TABLE.GET_instr(x)) = TABLE.GET_admininstr(x)
-  ;;
-  def {x : tableidx} admininstr_instr(TABLE.SET_instr(x)) = TABLE.SET_admininstr(x)
-  ;;
-  def {x : tableidx} admininstr_instr(TABLE.SIZE_instr(x)) = TABLE.SIZE_admininstr(x)
-  ;;
-  def {x : tableidx} admininstr_instr(TABLE.GROW_instr(x)) = TABLE.GROW_admininstr(x)
-  ;;
-  def {x : tableidx} admininstr_instr(TABLE.FILL_instr(x)) = TABLE.FILL_admininstr(x)
-  ;;
-  def {x : (tableidx, tableidx)} admininstr_instr(TABLE.COPY_instr(x)) = TABLE.COPY_admininstr(x)
-  ;;
-  def {x : (tableidx, elemidx)} admininstr_instr(TABLE.INIT_instr(x)) = TABLE.INIT_admininstr(x)
-  ;;
-  def {x : elemidx} admininstr_instr(ELEM.DROP_instr(x)) = ELEM.DROP_admininstr(x)
-  ;;
-  def admininstr_instr(MEMORY.SIZE_instr) = MEMORY.SIZE_admininstr
-  ;;
-  def admininstr_instr(MEMORY.GROW_instr) = MEMORY.GROW_admininstr
-  ;;
-  def admininstr_instr(MEMORY.FILL_instr) = MEMORY.FILL_admininstr
-  ;;
-  def admininstr_instr(MEMORY.COPY_instr) = MEMORY.COPY_admininstr
-  ;;
-  def {x : dataidx} admininstr_instr(MEMORY.INIT_instr(x)) = MEMORY.INIT_admininstr(x)
-  ;;
-  def {x : dataidx} admininstr_instr(DATA.DROP_instr(x)) = DATA.DROP_admininstr(x)
-  ;;
-  def {x : (numtype, (n, sx)?, u32, u32)} admininstr_instr(LOAD_instr(x)) = LOAD_admininstr(x)
-  ;;
-  def {x : (numtype, n?, u32, u32)} admininstr_instr(STORE_instr(x)) = STORE_admininstr(x)
-
-;;
-def admininstr_ref : ref -> admininstr
-  ;;
-  def {x : reftype} admininstr_ref(REF.NULL_ref(x)) = REF.NULL_admininstr(x)
-  ;;
-  def {x : funcaddr} admininstr_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
-  def {x : hostaddr} admininstr_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_admininstr(x)
-
-;;
-def admininstr_val : val -> admininstr
-  ;;
-  def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
-  ;;
-  def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
-  ;;
-  def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
-  ;;
-  def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
-
-;; 4-runtime.watsup:83.1-83.62
->>>>>>> sub-elim
 syntax config = `%;%*`(state, admininstr*)
 
 ;; 4-runtime.watsup:102.1-102.59
@@ -8523,83 +8132,43 @@ def local : (state, localidx) -> val
 
 ;; 4-runtime.watsup:125.1-125.78
 def with_local : (state, localidx, val) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:134.1-134.52
-  def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL[x] = v])
-=======
-  ;; 4-runtime.watsup:133.1-133.52
   def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL_frame[x] = v])
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:126.1-126.79
 def with_global : (state, globalidx, val) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:135.1-135.71
-  def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
-=======
-  ;; 4-runtime.watsup:134.1-134.71
   def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:127.1-127.83
 def with_table : (state, tableidx, nat, ref) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:136.1-136.74
-  def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
-=======
-  ;; 4-runtime.watsup:135.1-135.74
   def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:128.1-128.80
 def with_tableext : (state, tableidx, ref*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:137.1-137.75
-  def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
-=======
-  ;; 4-runtime.watsup:136.1-136.75
   def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:129.1-129.90
 def with_mem : (state, tableidx, nat, nat, byte*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:138.1-138.77
-  def {b* : byte*, f : frame, i : nat, j : nat, s : store, x : idx} with_mem(`%;%`(s, f), x, i, j, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}], f)
-=======
-  ;; 4-runtime.watsup:137.1-137.77
   def {b* : byte*, f : frame, i : nat, j : nat, s : store, x : idx} with_mem(`%;%`(s, f), x, i, j, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:130.1-130.78
 def with_memext : (state, tableidx, byte*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:139.1-139.69
-  def {b* : byte*, f : frame, s : store, x : idx} with_memext(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}], f)
-=======
-  ;; 4-runtime.watsup:138.1-138.69
   def {b* : byte*, f : frame, s : store, x : idx} with_memext(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:131.1-131.77
 def with_elem : (state, elemidx, ref*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:140.1-140.69
-  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
-=======
-  ;; 4-runtime.watsup:139.1-139.69
   def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:132.1-132.77
 def with_data : (state, dataidx, byte*) -> state
-<<<<<<< HEAD
   ;; 4-runtime.watsup:141.1-141.65
-  def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
-=======
-  ;; 4-runtime.watsup:140.1-140.65
   def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
->>>>>>> NegPr
 
 ;; 4-runtime.watsup:155.1-158.21
 rec {
@@ -8763,15 +8332,9 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
     -- if (c = $relop(relop, nt, c_1, c_2))
 
   ;; 6-reduction.watsup:137.1-138.70
-<<<<<<< HEAD
   rule extend {c : c_numtype, n : n, nt : numtype, o0 : nat}:
     `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, o0, S_sx, c))])
     -- if ($size($valtype_numtype(nt)) = ?(o0))
-=======
-  rule extend {c : c_numtype, n : n, nt : numtype}:
-    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, !($size($valtype_numtype(nt))), S_sx, c))])
-    -- if ($size($valtype_numtype(nt)) =/= ?())
->>>>>>> sub-elim
 
   ;; 6-reduction.watsup:141.1-143.48
   rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
@@ -8818,14 +8381,9 @@ relation Step_read: `%~>%*`(config, admininstr*)
     -- otherwise
 
   ;; 6-reduction.watsup:94.1-97.52
-<<<<<<< HEAD
   rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state, o0* : val*}:
     `%~>%*`(`%;%*`(z, $admininstr_val(val)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], $admininstr_instr(instr)*{instr})])])
     -- if (|t*{t}| = |o0*{o0}|)
-=======
-  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state}:
-    `%~>%*`(`%;%*`(z, $admininstr_val(val)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], $admininstr_instr(instr)*{instr})])])
->>>>>>> sub-elim
     -- if (a < |$funcinst(z)|)
     -- if (|t_1^k{t_1}| = k)
     -- if (|t_2^n{t_2}| = n)
@@ -8920,25 +8478,15 @@ relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:268.1-270.49
   rule load-num-trap {i : nat, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) LOAD_admininstr(nt, ?(), n_A, n_O)]), [TRAP_admininstr])
-<<<<<<< HEAD
     -- if ($size($valtype_numtype(nt)) = ?(o0))
     -- if (((i + n_O) + (o0 / 8)) >= |$mem(z, 0)|)
-=======
-    -- if ($size($valtype_numtype(nt)) =/= ?())
-    -- if (((i + n_O) + (!($size($valtype_numtype(nt))) / 8)) >= |$mem(z, 0)|)
->>>>>>> sub-elim
 
   ;; 6-reduction.watsup:272.1-274.66
   rule load-num-val {c : c_numtype, i : nat, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat, o1 : nat}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) LOAD_admininstr(nt, ?(), n_A, n_O)]), [CONST_admininstr(nt, c)])
-<<<<<<< HEAD
     -- if ($size($valtype_numtype(nt)) = ?(o0))
     -- if ($size($valtype_numtype(nt)) = ?(o1))
     -- if ($bytes_(o0, c) = $mem(z, 0)[(i + n_O) : (o1 / 8)])
-=======
-    -- if ($size($valtype_numtype(nt)) =/= ?())
-    -- if ($bytes_(!($size($valtype_numtype(nt))), c) = $mem(z, 0)[(i + n_O) : (!($size($valtype_numtype(nt))) / 8)])
->>>>>>> sub-elim
 
   ;; 6-reduction.watsup:276.1-278.41
   rule load-pack-trap {i : nat, n : n, n_A : n, n_O : n, nt : numtype, sx : sx, z : state}:
@@ -9050,7 +8598,6 @@ relation Step: `%~>%`(config, config)
   ;; 6-reduction.watsup:285.1-287.49
   rule store-num-trap {c : c_numtype, i : nat, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat}:
     `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, c) STORE_admininstr(nt, ?(), n_A, n_O)]), `%;%*`(z, [TRAP_admininstr]))
-<<<<<<< HEAD
     -- if ($size($valtype_numtype(nt)) = ?(o0))
     -- if (((i + n_O) + (o0 / 8)) >= |$mem(z, 0)|)
 
@@ -9060,16 +8607,6 @@ relation Step: `%~>%`(config, config)
     -- if ($size($valtype_numtype(nt)) = ?(o0))
     -- if ($size($valtype_numtype(nt)) = ?(o1))
     -- if (b*{b} = $bytes_(o1, c))
-=======
-    -- if ($size($valtype_numtype(nt)) =/= ?())
-    -- if (((i + n_O) + (!($size($valtype_numtype(nt))) / 8)) >= |$mem(z, 0)|)
-
-  ;; 6-reduction.watsup:289.1-291.35
-  rule store-num-val {b* : byte*, c : c_numtype, i : nat, n_A : n, n_O : n, nt : numtype, z : state}:
-    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, c) STORE_admininstr(nt, ?(), n_A, n_O)]), `%;%*`($with_mem(z, 0, (i + n_O), (!($size($valtype_numtype(nt))) / 8), b*{b}), []))
-    -- if ($size($valtype_numtype(nt)) =/= ?())
-    -- if (b*{b} = $bytes_(!($size($valtype_numtype(nt))), c))
->>>>>>> sub-elim
 
   ;; 6-reduction.watsup:293.1-295.41
   rule store-pack-trap {c : c_numtype, i : nat, n : n, n_A : n, n_O : n, nt : numtype, z : state}:
@@ -9079,7 +8616,6 @@ relation Step: `%~>%`(config, config)
   ;; 6-reduction.watsup:297.1-299.50
   rule store-pack-val {b* : byte*, c : c_numtype, i : nat, n : n, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat}:
     `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, c) STORE_admininstr(nt, ?(n), n_A, n_O)]), `%;%*`($with_mem(z, 0, (i + n_O), (n / 8), b*{b}), []))
-<<<<<<< HEAD
     -- if ($size($valtype_numtype(nt)) = ?(o0))
     -- if (b*{b} = $bytes_(n, $wrap_((o0, n), c)))
 
@@ -10408,42 +9944,42 @@ def local : (state, localidx) -> val
 ;; 4-runtime.watsup:125.1-125.78
 def with_local : (state, localidx, val) -> state
   ;; 4-runtime.watsup:134.1-134.52
-  def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL[x] = v])
+  def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL_frame[x] = v])
 
 ;; 4-runtime.watsup:126.1-126.79
 def with_global : (state, globalidx, val) -> state
   ;; 4-runtime.watsup:135.1-135.71
-  def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
+  def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
 
 ;; 4-runtime.watsup:127.1-127.83
 def with_table : (state, tableidx, nat, ref) -> state
   ;; 4-runtime.watsup:136.1-136.74
-  def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
+  def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
 
 ;; 4-runtime.watsup:128.1-128.80
 def with_tableext : (state, tableidx, ref*) -> state
   ;; 4-runtime.watsup:137.1-137.75
-  def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
+  def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
 
 ;; 4-runtime.watsup:129.1-129.90
 def with_mem : (state, tableidx, nat, nat, byte*) -> state
   ;; 4-runtime.watsup:138.1-138.77
-  def {b* : byte*, f : frame, i : nat, j : nat, s : store, x : idx} with_mem(`%;%`(s, f), x, i, j, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}], f)
+  def {b* : byte*, f : frame, i : nat, j : nat, s : store, x : idx} with_mem(`%;%`(s, f), x, i, j, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}], f)
 
 ;; 4-runtime.watsup:130.1-130.78
 def with_memext : (state, tableidx, byte*) -> state
   ;; 4-runtime.watsup:139.1-139.69
-  def {b* : byte*, f : frame, s : store, x : idx} with_memext(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}], f)
+  def {b* : byte*, f : frame, s : store, x : idx} with_memext(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}], f)
 
 ;; 4-runtime.watsup:131.1-131.77
 def with_elem : (state, elemidx, ref*) -> state
   ;; 4-runtime.watsup:140.1-140.69
-  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
+  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
 
 ;; 4-runtime.watsup:132.1-132.77
 def with_data : (state, dataidx, byte*) -> state
   ;; 4-runtime.watsup:141.1-141.65
-  def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
+  def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
 
 ;; 4-runtime.watsup:155.1-158.21
 rec {
@@ -11068,10 +10604,6 @@ relation Step: `%~>%`(config, config)
     `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, c) STORE_admininstr(nt, ?(n), n_A, n_O)]), `%;%*`($with_mem(z, 0, (i + n_O), (n / 8), b*{b}), []))
     -- if ($size($valtype_numtype(nt)) = ?(o0))
     -- if (b*{b} = $bytes_(n, $wrap_((o0, n), c)))
-=======
-    -- if ($size($valtype_numtype(nt)) =/= ?())
-    -- if (b*{b} = $bytes_(n, $wrap_((!($size($valtype_numtype(nt))), n), c)))
->>>>>>> sub-elim
 
   ;; 6-reduction.watsup:302.1-303.104
   rule memory.grow-succeed {n : n, z : state}:

From e3dddae5adcae81cf9f643abfcf800c45b7b6b9a Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 3 May 2023 08:05:04 +0200
Subject: [PATCH 91/98] IL: (Conservative) apartness checker

---
 spectec/src/il/apart.ml  | 49 ++++++++++++++++++++++++++++++++++++++++
 spectec/src/il/apart.mli |  2 ++
 2 files changed, 51 insertions(+)
 create mode 100644 spectec/src/il/apart.ml
 create mode 100644 spectec/src/il/apart.mli

diff --git a/spectec/src/il/apart.ml b/spectec/src/il/apart.ml
new file mode 100644
index 0000000000..ed1924d97c
--- /dev/null
+++ b/spectec/src/il/apart.ml
@@ -0,0 +1,49 @@
+open Util.Source
+open Ast
+
+(* Turns an expression of list with a know tail into the tail elements (reverse
+   order), and the initial part
+ *)
+let rec to_snoc_list (e : exp) : exp list * exp = match e.it with
+  | ListE es -> List.rev es, (ListE [] $ e.at)
+  | CatE (e1, e2) ->
+    let revtail2, init2 = to_snoc_list e2 in
+    if init2.it = ListE []
+    then let revtail1, init = to_snoc_list e1 in
+         revtail2 @ revtail1, init
+    else revtail2, CatE (e1, init2) $ e.at
+  | _ -> [], e
+
+(* Are these two open terms definitely apart? *)
+(* We only care about expression of the same type, and do not bother
+   returning true for different types. *)
+let rec apart (e1 : exp) (e2: exp) : bool =
+  if Eq.eq_exp e1 e2 then false else
+  (*
+  (fun b -> if not b then Printf.eprintf "apart\n  %s\n  %s\n  %b\n" (Print.string_of_exp e1) (Print.string_of_exp e2) b; b)
+  *)
+  (match e1.it, e2.it with
+  (* A literal is never a literal of other type *)
+  | NatE n1, NatE n2 -> not (n1 = n2)
+  | BoolE b1, BoolE b2 -> not (b1 = b2)
+  | TextE t1, TextE t2 -> not (t1 = t2)
+  | CaseE (a1, exp1, _), CaseE (a2, exp2, _) ->
+    not (a1 = a2) || apart exp1 exp2
+  | TupE es1, TupE es2 when List.length es1 = List.length es2 ->
+    List.exists2 apart es1 es2
+  | (CatE _ | ListE _), (CatE _ | ListE _) ->
+    list_exp_apart e1 e2
+  | SubE (e1, _, _), SubE (e2, _, _) -> apart e1 e2
+  | MixE (mixop1, e1), MixE (mixop2, e2) ->
+    not (mixop1 = mixop2) || apart e1 e2
+  (* We do not know anything about variables and functions *)
+  | _ , _ -> false (* conservative *)
+  )
+
+and list_exp_apart e1 e2 =
+  let revtail1, init1 = to_snoc_list e1 in
+  let revtail2, init2 = to_snoc_list e2 in
+  List.exists2 apart revtail1 revtail2 ||
+  (if List.length revtail1 = List.length revtail2 && revtail1 != []
+  then apart init1 init2
+  else false)
diff --git a/spectec/src/il/apart.mli b/spectec/src/il/apart.mli
new file mode 100644
index 0000000000..174ce96d7e
--- /dev/null
+++ b/spectec/src/il/apart.mli
@@ -0,0 +1,2 @@
+open Ast
+val apart : exp -> exp -> bool

From fd3484adbff4c4670c88d1dd432237fb6eaad948 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 3 May 2023 08:27:35 +0200
Subject: [PATCH 92/98] Refactor a bit

---
 spectec/src/il/apart.ml | 55 +++++++++++++++++++++++++----------------
 spectec/src/il/dune     |  2 +-
 2 files changed, 35 insertions(+), 22 deletions(-)

diff --git a/spectec/src/il/apart.ml b/spectec/src/il/apart.ml
index ed1924d97c..9d36d44798 100644
--- a/spectec/src/il/apart.ml
+++ b/spectec/src/il/apart.ml
@@ -1,22 +1,29 @@
+(*
+This module implements a (consservative) apartness check: Given two (open)
+expression (typically reduction rules LHSs), are they definitely apart.
+*)
+
 open Util.Source
 open Ast
 
-(* Turns an expression of list with a know tail into the tail elements (reverse
-   order), and the initial part
+(* Looks at an expression of type list from the back and chops off all
+   known _elements_, followed by the list of all list expressions.
+   Returns it all in reverse order.
  *)
-let rec to_snoc_list (e : exp) : exp list * exp = match e.it with
-  | ListE es -> List.rev es, (ListE [] $ e.at)
+let rec to_snoc_list (e : exp) : exp list * exp list = match e.it with
+  | ListE es -> List.rev es, []
   | CatE (e1, e2) ->
-    let revtail2, init2 = to_snoc_list e2 in
-    if init2.it = ListE []
-    then let revtail1, init = to_snoc_list e1 in
-         revtail2 @ revtail1, init
-    else revtail2, CatE (e1, init2) $ e.at
-  | _ -> [], e
+    let tailelems2, listelems2 = to_snoc_list e2 in
+    if listelems2 = []
+    (* Second list is fully known? Can look at first list *)
+    then let tailelems1, listelems1 = to_snoc_list e1 in
+         tailelems2 @ tailelems1, listelems1
+    (* Second list has unknown elements, have to stop there *)
+    else tailelems2, listelems2 @ [e1]
+  | _ -> [], [e]
 
-(* Are these two open terms definitely apart? *)
-(* We only care about expression of the same type, and do not bother
-   returning true for different types. *)
+(* We assume the expressions to be of the same type; for ill-typed inputs
+   no guarantees are made. *)
 let rec apart (e1 : exp) (e2: exp) : bool =
   if Eq.eq_exp e1 e2 then false else
   (*
@@ -27,7 +34,7 @@ let rec apart (e1 : exp) (e2: exp) : bool =
   | NatE n1, NatE n2 -> not (n1 = n2)
   | BoolE b1, BoolE b2 -> not (b1 = b2)
   | TextE t1, TextE t2 -> not (t1 = t2)
-  | CaseE (a1, exp1, _), CaseE (a2, exp2, _) ->
+  | CaseE (a1, exp1), CaseE (a2, exp2) ->
     not (a1 = a2) || apart exp1 exp2
   | TupE es1, TupE es2 when List.length es1 = List.length es2 ->
     List.exists2 apart es1 es2
@@ -40,10 +47,16 @@ let rec apart (e1 : exp) (e2: exp) : bool =
   | _ , _ -> false (* conservative *)
   )
 
-and list_exp_apart e1 e2 =
-  let revtail1, init1 = to_snoc_list e1 in
-  let revtail2, init2 = to_snoc_list e2 in
-  List.exists2 apart revtail1 revtail2 ||
-  (if List.length revtail1 = List.length revtail2 && revtail1 != []
-  then apart init1 init2
-  else false)
+(* Two list expressions are apart if either their manifest tail elements are apart *)
+and list_exp_apart e1 e2 = snoc_list_apart (to_snoc_list e1) (to_snoc_list e2)
+
+and snoc_list_apart (tailelems1, listelems1) (tailelems2, listelems2) =
+  match tailelems1, listelems1, tailelems2, listelems2 with
+  (* If the heads are apart, the lists are apart *)
+  | e1 :: e1s, _, e2 :: e2s, _ -> apart e1 e2 || snoc_list_apart (e1s, listelems1) (e2s, listelems2)
+  (* If one list is definitely empty and the other list definitely isn't *)
+  | [], [], _ :: _, _ -> false
+  | _ :: _, _, [], [] -> false
+  (* Else, can't tell *)
+  | _, _, _, _ -> false
+
diff --git a/spectec/src/il/dune b/spectec/src/il/dune
index 38b4366dee..cf0169cfed 100644
--- a/spectec/src/il/dune
+++ b/spectec/src/il/dune
@@ -1,5 +1,5 @@
 (library
   (name il)
   (libraries util)
-  (modules ast eq free print validation)
+  (modules ast eq free print validation apart)
 )

From b3a369e8cdd6a04be99764ee7e369ac0c97a1c64 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Fri, 9 Jun 2023 10:03:16 +0200
Subject: [PATCH 93/98] Il-to-il-pass: Replace wildcards with variables

this is a pass that takes care of the problem with `MUT?`, which is a
non-functional expression (denotes multiple values), and thus cannot be
compiled like this to functional backends (proof backends).

Here is its effect:
```diff
 relation Global_ok: `%|-%:%`(context, global, globaltype)
   ;; 3-typing.watsup:414.1-418.40
-  rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
+  rule _ {C : context, expr : expr, gt : globaltype, t : valtype, w0 : ()?}:
     `%|-%:%`(C, GLOBAL(gt, expr), gt)
     -- Globaltype_ok: `|-%:OK`(gt)
-    -- if (gt = `MUT%?%`(()?{}, t))
+    -- if (gt = `MUT%?%`(w0, t))
     -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
```
---
 spectec/src/exe-watsup/main.ml |   13 +
 spectec/src/middlend/dune      |    1 +
 spectec/src/middlend/unthe.ml  |    2 +-
 spectec/src/middlend/wild.ml   |  238 +++++
 spectec/src/middlend/wild.mli  |    1 +
 spectec/test-middlend/TEST.md  | 1762 +++++++++++++++++++++++++++++++-
 6 files changed, 2007 insertions(+), 10 deletions(-)
 create mode 100644 spectec/src/middlend/wild.ml
 create mode 100644 spectec/src/middlend/wild.mli

diff --git a/spectec/src/exe-watsup/main.ml b/spectec/src/exe-watsup/main.ml
index 8124e3d96f..e7e2d98642 100644
--- a/spectec/src/exe-watsup/main.ml
+++ b/spectec/src/exe-watsup/main.ml
@@ -32,6 +32,7 @@ let print_all_il = ref false
 let pass_sub = ref false
 let pass_totalize = ref false
 let pass_unthe = ref false
+let pass_wild = ref false
 let pass_sideconditions = ref false
 let pass_animate = ref false
 
@@ -69,6 +70,7 @@ let argspec = Arg.align
   "--sub", Arg.Set pass_sub, " Synthesize explicit subtype coercions";
   "--totalize", Arg.Set pass_totalize, " Run function totalization";
   "--the-elimination", Arg.Set pass_unthe, " Eliminate the ! operator in relations";
+  "--wildcards", Arg.Set pass_wild, " Eliminate wildcards and equivalent expressions";
   "--sideconditions", Arg.Set pass_sideconditions, " Infer side conditions";
   "--animate", Arg.Set pass_animate, " Animate equality conditions";
 
@@ -126,6 +128,17 @@ let () =
       )
     in
 
+    let il = if not !pass_wild then il else
+      ( log "Wildcard elimination";
+        let il = Middlend.Wild.transform il in
+        if !print_all_il then
+          Printf.printf "%s\n%!" (Il.Print.string_of_script il);
+        log "IL Validation...";
+        Il.Validation.valid il;
+        il
+      )
+    in
+
     let il = if not !pass_sideconditions then il else
       ( log "Side condition inference";
         let il = Middlend.Sideconditions.transform il in
diff --git a/spectec/src/middlend/dune b/spectec/src/middlend/dune
index 26c4e76275..b07e76304c 100644
--- a/spectec/src/middlend/dune
+++ b/spectec/src/middlend/dune
@@ -4,6 +4,7 @@
   (modules
     sub
     totalize
+    wild
     unthe
     sideconditions
     animate
diff --git a/spectec/src/middlend/unthe.ml b/spectec/src/middlend/unthe.ml
index 5ab6d589d3..a272bdb753 100644
--- a/spectec/src/middlend/unthe.ml
+++ b/spectec/src/middlend/unthe.ml
@@ -15,7 +15,7 @@ open Il.Ast
 
 (* Errors *)
 
-let error at msg = Source.error at "sideconditions" msg
+let error at msg = Source.error at "unthe" msg
 
 (* We pull out fresh variables and equating side conditions. *)
 
diff --git a/spectec/src/middlend/wild.ml b/spectec/src/middlend/wild.ml
new file mode 100644
index 0000000000..e79b15a8e5
--- /dev/null
+++ b/spectec/src/middlend/wild.ml
@@ -0,0 +1,238 @@
+(*
+This transformation removes various forms of wildcards from the syntax.
+
+In particular we currently detect
+ * `FOO?` where `FOO is a constructor of a single-constructor-variant
+ * `()?`
+
+Like many other transformations, this bridges the gap between the source
+syntax, where expressions are really relations (can fail, can denote multiple
+values) and the target syntax of theorem provers, where expressions must be
+purely functional (given a value for all free variables, must denote exactly
+one value).
+
+The overall structure of this module is similar to that of Middlend.Unthe.
+*)
+
+open Util
+open Source
+open Il.Ast
+
+(* Errors *)
+
+let _error at msg = Source.error at "wild" msg
+
+(* Environment
+
+We need to know which variant types have exactly one constructor.
+(We do not remember the name of the constructor, and assume the input to
+be well-typed.
+*)
+
+module S = Set.Make(String)
+type env = {
+  mutable unit_variants : S.t;
+  mutable counter : int;  (* to generate fresh names *)
+}
+let new_env () : env = { unit_variants = S.empty; counter = 0 }
+
+(*
+The main predicate here: Which expressions are
+
+ - universal (describes all values of the current type) and
+ - multi-valued (describes more than one value)
+
+So far, we only look for `FOO?` and `()?`, but this can be extended of cousre.
+*)
+
+let rec is_universal env exp : bool =
+  match exp.it with
+  | TupE es -> List.for_all (is_universal env) es
+  | CaseE _ -> begin match exp.note.it with
+    | VarT i -> S.mem i.it env.unit_variants
+    | _ -> false
+  end
+  | _ -> false
+
+let is_universal_and_multi_value env exp : bool =
+  match exp.it with
+  | IterE (e, (Opt, [])) -> is_universal env e
+  | _ -> false
+
+
+(* We pull out fresh variables and equating side conditions. *)
+
+type bind = (id * typ * iter list)
+type binds = bind list
+
+(* Fresh name generation *)
+
+let name i = "w" ^ string_of_int i (* NB: no clash avoidance yet *)
+
+let fresh_id env : id =
+  let i = env.counter in
+  env.counter <- env.counter + 1;
+  name i $ no_region
+
+(* If a bind and premise is generated under an iteration, wrap them accordingly *)
+
+let under_iterexp (iter, vs) binds : iterexp * binds =
+   let new_vs = List.map (fun (v, _, _) -> v) binds in
+   let iterexp' = (iter, vs @ new_vs) in
+   let binds' = List.map (fun (v, t, is) -> (v, t, is@[iter])) binds in
+   iterexp', binds'
+
+(* Generic traversal helpers *)
+
+type 'a traversal = env -> 'a -> binds * 'a
+type ('a, 'b) traversal_k = env -> 'a -> ('a -> 'b) -> binds * 'b
+
+let phrase (t : 'a traversal) : ('a, 'b) note_phrase traversal
+  = fun env x -> let binds, x' = t env x.it in binds, x' $$ x.at % x.note
+
+let t_list (t : 'a traversal) : ('a list, 'b) traversal_k
+  = fun n xs k ->
+    let bindss, xs' = List.split (List.map (t n) xs) in
+    List.concat bindss, k xs'
+
+let unary (t : 'a traversal) : ('a, 'b) traversal_k =
+  fun n x k ->
+  let binds, exp' = t n x in
+  binds, k exp'
+
+let binary (t1 : 'a traversal) (t2 : 'b traversal) : ('a * 'b, 'c) traversal_k =
+  fun n (x1, x2) k ->
+  let binds1, x1' = t1 n x1 in
+  let binds2, x2' = t2 n x2 in
+  binds1 @ binds2, k (x1', x2')
+
+let ternary (t1 : 'a traversal) (t2 : 'b traversal) (t3 : 'c traversal) : ('a * 'b * 'c, 'd) traversal_k =
+  fun n (x1, x2, x3) k ->
+  let binds1, x1' = t1 n x1 in
+  let binds2, x2' = t2 n x2 in
+  let binds3, x3' = t3 n x3 in
+  binds1 @ binds2 @ binds3, k (x1', x2', x3')
+
+(* Expr traversal *)
+
+
+let rec t_exp env e : binds * exp =
+  (* Descend first using t_exp2, and then see if we have to pull out the current expression *)
+  let binds, e' = t_exp2 env e in
+  if is_universal_and_multi_value env e'
+  then
+    let t = e.note in
+    let x = fresh_id env in
+    let xe = VarE x $$ no_region % t in
+    let bind = (x, t, []) in
+    binds @ [bind], xe
+  else binds, e'
+
+(* Traversal helpers *)
+
+and t_exp2 env = phrase t_exp' env
+
+and t_e env x k = unary t_exp env x k
+and t_ee env x k = binary t_exp t_exp env x k
+and t_eee env x k = ternary t_exp t_exp t_exp env x k
+and t_epe env x k = ternary t_exp t_path t_exp env x k
+
+and t_exp' env e : binds * exp' =
+  match e with
+  | VarE _ | BoolE _ | NatE _ | TextE _ | OptE None -> [], e
+
+  | UnE (uo, exp) -> t_e env exp (fun exp' -> UnE (uo, exp'))
+  | DotE (exp, a) -> t_e env exp (fun exp' -> DotE (exp', a))
+  | LenE exp -> t_e env exp (fun exp' -> LenE exp')
+  | MixE (mo, exp) -> t_e env exp (fun exp' -> MixE (mo, exp'))
+  | CallE (f, exp) ->t_e env exp (fun exp' -> CallE (f, exp'))
+  | OptE (Some exp) ->t_e env exp (fun exp' -> OptE (Some exp'))
+  | TheE exp ->t_e env exp (fun exp' -> TheE exp')
+  | CaseE (a, exp) ->t_e env exp (fun exp' -> CaseE (a, exp'))
+  | SubE (exp, a, b) -> t_e env exp (fun exp' -> SubE (exp', a, b))
+
+  | BinE (bo, exp1, exp2) -> t_ee env (exp1, exp2) (fun (e1', e2') -> BinE (bo, e1', e2'))
+  | CmpE (co, exp1, exp2) -> t_ee env (exp1, exp2) (fun (e1', e2') -> CmpE (co, e1', e2'))
+  | IdxE (exp1, exp2) -> t_ee env (exp1, exp2) (fun (e1', e2') -> IdxE (e1', e2'))
+  | CompE (exp1, exp2) -> t_ee env (exp1, exp2) (fun (e1', e2') -> CompE (e1', e2'))
+  | CatE (exp1, exp2) -> t_ee env (exp1, exp2) (fun (e1', e2') -> CatE (e1', e2'))
+
+  | SliceE (exp1, exp2, exp3) -> t_eee env (exp1, exp2, exp3) (fun (e1', e2', e3') -> SliceE (e1', e2', e3'))
+
+  | UpdE (exp1, path, exp2) -> t_epe env (exp1, path, exp2) (fun (e1', p', e2') -> UpdE (e1', p', e2'))
+  | ExtE (exp1, path, exp2) -> t_epe env (exp1, path, exp2) (fun (e1', p', e2') -> ExtE (e1', p', e2'))
+
+  | StrE fields -> t_list t_field env fields (fun fields' -> StrE fields')
+
+  | TupE es -> t_list t_exp env es (fun es' -> TupE es')
+  | ListE es -> t_list t_exp env es (fun es' -> ListE es')
+
+  | IterE (e, iterexp) ->
+    let binds1, e' = t_exp env e in
+    let iterexp', binds1' = under_iterexp iterexp binds1 in
+    let binds2, iterexp'' = t_iterexp env iterexp' in
+    binds1' @ binds2, IterE (e', iterexp'')
+
+and t_field env ((a, e) : expfield) =
+  unary t_exp env e (fun e' -> (a, e'))
+
+and t_iterexp env (iter, vs) =
+  unary t_iter env iter (fun iter' -> (iter', vs))
+
+and t_iter env iter = match iter with
+  | ListN e -> unary t_exp env e (fun e' -> ListN e')
+  | _ -> [], iter
+
+and t_path env = phrase t_path' env
+
+and t_path' env path = match path with
+  | RootP -> [], path
+  | IdxP (path, e) -> binary t_path t_exp env (path, e) (fun (path', e') -> IdxP (path', e'))
+  | SliceP (path, e1, e2) -> ternary t_path t_exp t_exp env (path, e1, e2) (fun (path', e1', e2') -> SliceP (path', e1', e2'))
+  | DotP (path, a) -> unary t_path env path (fun path' -> DotP (path', a))
+
+let rec t_prem env : premise -> binds * premise = phrase t_prem' env
+
+and t_prem' env prem : binds * premise' =
+  match prem with
+  | RulePr (a, b, exp) ->
+    unary t_exp env exp (fun exp' -> RulePr (a, b, exp'))
+  | IfPr e -> unary t_exp env e (fun e' -> IfPr e')
+  | LetPr (e1, e2) -> binary t_exp t_exp env (e1, e2) (fun (e1', e2') -> LetPr (e1', e2'))
+  | ElsePr -> [], prem
+  | IterPr (prem, iterexp) ->
+    let binds1, prem' = t_prem env prem in
+    let iterexp', binds1' = under_iterexp iterexp binds1 in
+    let binds2, iterexp'' = t_iterexp env iterexp' in
+    binds1' @ binds2, IterPr (prem', iterexp'')
+
+let t_prems env k  = t_list t_prem env k (fun x -> x)
+
+let t_rule' env = function
+  | RuleD (id, binds, mixop, exp, prems) ->
+    (* Reset counter for fresh variables *)
+    env.counter <- 0;
+    let extra_binds, (exp', prems') = binary t_exp t_prems env (exp, prems) (fun x -> x) in
+    RuleD (id, binds @ extra_binds, mixop, exp', prems')
+
+let t_rule env x = { x with it = t_rule' env x.it }
+
+let t_rules env = List.map (t_rule env)
+
+let rec t_def' env = function
+  | SynD (id, { it = VariantT []; _ }) as def ->
+    env.unit_variants <- S.add id.it env.unit_variants;
+    def
+  | RecD defs -> RecD (t_defs env defs)
+  | RelD (id, mixop, typ, rules) ->
+    RelD (id, mixop, typ, t_rules env rules)
+  | def -> def
+
+and t_def env x = { x with it = t_def' env x.it }
+
+and t_defs env = List.map (t_def env)
+
+let transform (defs : script) =
+  let env = new_env () in
+  t_defs env defs
+
diff --git a/spectec/src/middlend/wild.mli b/spectec/src/middlend/wild.mli
new file mode 100644
index 0000000000..542bbf8052
--- /dev/null
+++ b/spectec/src/middlend/wild.mli
@@ -0,0 +1 @@
+val transform : Il.Ast.script -> Il.Ast.script
diff --git a/spectec/test-middlend/TEST.md b/spectec/test-middlend/TEST.md
index 9d2562d49a..d38765f07b 100644
--- a/spectec/test-middlend/TEST.md
+++ b/spectec/test-middlend/TEST.md
@@ -1,7 +1,7 @@
 # Preview
 
 ```sh
-$ (cd ../spec && ../src/exe-watsup/main.exe *.watsup -l --print-all-il --sub --totalize --the-elimination --sideconditions --animate --check)
+$ (cd ../spec && ../src/exe-watsup/main.exe *.watsup -l --print-all-il --sub --totalize --the-elimination --wildcards --sideconditions --animate --check)
 == Parsing...
 == Elaboration...
 
@@ -6825,6 +6825,1750 @@ relation Step: `%~>%`(config, config)
   rule data.drop {x : idx, z : state}:
     `%~>%`(`%;%*`(z, [DATA.DROP_admininstr(x)]), `%;%*`($with_data(z, x, []), []))
 
+== IL Validation...
+== Wildcard elimination
+
+;; 1-syntax.watsup:3.1-3.15
+syntax n = nat
+
+;; 1-syntax.watsup:9.1-9.37
+syntax name = text
+
+;; 1-syntax.watsup:14.1-14.36
+syntax byte = nat
+
+;; 1-syntax.watsup:15.1-15.45
+syntax u32 = nat
+
+;; 1-syntax.watsup:22.1-22.36
+syntax idx = nat
+
+;; 1-syntax.watsup:23.1-23.49
+syntax funcidx = idx
+
+;; 1-syntax.watsup:24.1-24.49
+syntax globalidx = idx
+
+;; 1-syntax.watsup:25.1-25.47
+syntax tableidx = idx
+
+;; 1-syntax.watsup:26.1-26.46
+syntax memidx = idx
+
+;; 1-syntax.watsup:27.1-27.45
+syntax elemidx = idx
+
+;; 1-syntax.watsup:28.1-28.45
+syntax dataidx = idx
+
+;; 1-syntax.watsup:29.1-29.47
+syntax labelidx = idx
+
+;; 1-syntax.watsup:30.1-30.47
+syntax localidx = idx
+
+;; 1-syntax.watsup:39.1-40.22
+syntax numtype =
+  | I32
+  | I64
+  | F32
+  | F64
+
+;; 1-syntax.watsup:41.1-42.5
+syntax vectype =
+  | V128
+
+;; 1-syntax.watsup:43.1-44.20
+syntax reftype =
+  | FUNCREF
+  | EXTERNREF
+
+;; 1-syntax.watsup:45.1-46.34
+syntax valtype =
+  | I32
+  | I64
+  | F32
+  | F64
+  | V128
+  | FUNCREF
+  | EXTERNREF
+  | BOT
+
+def valtype_numtype : numtype -> valtype
+  def valtype_numtype(I32_numtype) = I32_valtype
+  def valtype_numtype(I64_numtype) = I64_valtype
+  def valtype_numtype(F32_numtype) = F32_valtype
+  def valtype_numtype(F64_numtype) = F64_valtype
+
+def valtype_reftype : reftype -> valtype
+  def valtype_reftype(FUNCREF_reftype) = FUNCREF_valtype
+  def valtype_reftype(EXTERNREF_reftype) = EXTERNREF_valtype
+
+def valtype_vectype : vectype -> valtype
+  def valtype_vectype(V128_vectype) = V128_valtype
+
+;; 1-syntax.watsup:48.1-48.39
+syntax in =
+  | I32
+  | I64
+
+def numtype_in : in -> numtype
+  def numtype_in(I32_in) = I32_numtype
+  def numtype_in(I64_in) = I64_numtype
+
+def valtype_in : in -> valtype
+  def valtype_in(I32_in) = I32_valtype
+  def valtype_in(I64_in) = I64_valtype
+
+;; 1-syntax.watsup:49.1-49.39
+syntax fn =
+  | F32
+  | F64
+
+def numtype_fn : fn -> numtype
+  def numtype_fn(F32_fn) = F32_numtype
+  def numtype_fn(F64_fn) = F64_numtype
+
+def valtype_fn : fn -> valtype
+  def valtype_fn(F32_fn) = F32_valtype
+  def valtype_fn(F64_fn) = F64_valtype
+
+;; 1-syntax.watsup:56.1-57.11
+syntax resulttype = valtype*
+
+;; 1-syntax.watsup:59.1-60.16
+syntax limits = `[%..%]`(u32, u32)
+
+;; 1-syntax.watsup:61.1-62.15
+syntax globaltype = `MUT%?%`(()?, valtype)
+
+;; 1-syntax.watsup:63.1-64.27
+syntax functype = `%->%`(resulttype, resulttype)
+
+;; 1-syntax.watsup:65.1-66.17
+syntax tabletype = `%%`(limits, reftype)
+
+;; 1-syntax.watsup:67.1-68.12
+syntax memtype = `%I8`(limits)
+
+;; 1-syntax.watsup:69.1-70.10
+syntax elemtype = reftype
+
+;; 1-syntax.watsup:71.1-72.5
+syntax datatype = OK
+
+;; 1-syntax.watsup:73.1-74.69
+syntax externtype =
+  | GLOBAL(globaltype)
+  | FUNC(functype)
+  | TABLE(tabletype)
+  | MEMORY(memtype)
+
+;; 1-syntax.watsup:86.1-86.44
+syntax sx =
+  | U
+  | S
+
+;; 1-syntax.watsup:88.1-88.39
+syntax unop_IXX =
+  | CLZ
+  | CTZ
+  | POPCNT
+
+;; 1-syntax.watsup:89.1-89.70
+syntax unop_FXX =
+  | ABS
+  | NEG
+  | SQRT
+  | CEIL
+  | FLOOR
+  | TRUNC
+  | NEAREST
+
+;; 1-syntax.watsup:91.1-93.62
+syntax binop_IXX =
+  | ADD
+  | SUB
+  | MUL
+  | DIV(sx)
+  | REM(sx)
+  | AND
+  | OR
+  | XOR
+  | SHL
+  | SHR(sx)
+  | ROTL
+  | ROTR
+
+;; 1-syntax.watsup:94.1-94.66
+syntax binop_FXX =
+  | ADD
+  | SUB
+  | MUL
+  | DIV
+  | MIN
+  | MAX
+  | COPYSIGN
+
+;; 1-syntax.watsup:96.1-96.26
+syntax testop_IXX =
+  | EQZ
+
+;; 1-syntax.watsup:97.1-97.22
+syntax testop_FXX =
+  |
+
+;; 1-syntax.watsup:99.1-100.108
+syntax relop_IXX =
+  | EQ
+  | NE
+  | LT(sx)
+  | GT(sx)
+  | LE(sx)
+  | GE(sx)
+
+;; 1-syntax.watsup:101.1-101.49
+syntax relop_FXX =
+  | EQ
+  | NE
+  | LT
+  | GT
+  | LE
+  | GE
+
+;; 1-syntax.watsup:103.1-103.50
+syntax unop_numtype =
+  | _I(unop_IXX)
+  | _F(unop_FXX)
+
+;; 1-syntax.watsup:104.1-104.53
+syntax binop_numtype =
+  | _I(binop_IXX)
+  | _F(binop_FXX)
+
+;; 1-syntax.watsup:105.1-105.56
+syntax testop_numtype =
+  | _I(testop_IXX)
+  | _F(testop_FXX)
+
+;; 1-syntax.watsup:106.1-106.53
+syntax relop_numtype =
+  | _I(relop_IXX)
+  | _F(relop_FXX)
+
+;; 1-syntax.watsup:107.1-107.39
+syntax cvtop =
+  | CONVERT
+  | REINTERPRET
+
+;; 1-syntax.watsup:117.1-117.23
+syntax c_numtype = nat
+
+;; 1-syntax.watsup:118.1-118.23
+syntax c_vectype = nat
+
+;; 1-syntax.watsup:121.1-121.52
+syntax blocktype = functype
+
+;; 1-syntax.watsup:156.1-177.80
+rec {
+
+;; 1-syntax.watsup:156.1-177.80
+syntax instr =
+  | UNREACHABLE
+  | NOP
+  | DROP
+  | SELECT(valtype?)
+  | BLOCK(blocktype, instr*)
+  | LOOP(blocktype, instr*)
+  | IF(blocktype, instr*, instr*)
+  | BR(labelidx)
+  | BR_IF(labelidx)
+  | BR_TABLE(labelidx*, labelidx)
+  | CALL(funcidx)
+  | CALL_INDIRECT(tableidx, functype)
+  | RETURN
+  | CONST(numtype, c_numtype)
+  | UNOP(numtype, unop_numtype)
+  | BINOP(numtype, binop_numtype)
+  | TESTOP(numtype, testop_numtype)
+  | RELOP(numtype, relop_numtype)
+  | EXTEND(numtype, n)
+  | CVTOP(numtype, cvtop, numtype, sx?)
+  | REF.NULL(reftype)
+  | REF.FUNC(funcidx)
+  | REF.IS_NULL
+  | LOCAL.GET(localidx)
+  | LOCAL.SET(localidx)
+  | LOCAL.TEE(localidx)
+  | GLOBAL.GET(globalidx)
+  | GLOBAL.SET(globalidx)
+  | TABLE.GET(tableidx)
+  | TABLE.SET(tableidx)
+  | TABLE.SIZE(tableidx)
+  | TABLE.GROW(tableidx)
+  | TABLE.FILL(tableidx)
+  | TABLE.COPY(tableidx, tableidx)
+  | TABLE.INIT(tableidx, elemidx)
+  | ELEM.DROP(elemidx)
+  | MEMORY.SIZE
+  | MEMORY.GROW
+  | MEMORY.FILL
+  | MEMORY.COPY
+  | MEMORY.INIT(dataidx)
+  | DATA.DROP(dataidx)
+  | LOAD(numtype, (n, sx)?, u32, u32)
+  | STORE(numtype, n?, u32, u32)
+}
+
+;; 1-syntax.watsup:179.1-180.9
+syntax expr = instr*
+
+;; 1-syntax.watsup:187.1-187.50
+syntax elemmode =
+  | TABLE(tableidx, expr)
+  | DECLARE
+
+;; 1-syntax.watsup:188.1-188.39
+syntax datamode =
+  | MEMORY(memidx, expr)
+
+;; 1-syntax.watsup:190.1-191.30
+syntax func = `FUNC%%*%`(functype, valtype*, expr)
+
+;; 1-syntax.watsup:192.1-193.25
+syntax global = GLOBAL(globaltype, expr)
+
+;; 1-syntax.watsup:194.1-195.18
+syntax table = TABLE(tabletype)
+
+;; 1-syntax.watsup:196.1-197.17
+syntax mem = MEMORY(memtype)
+
+;; 1-syntax.watsup:198.1-199.31
+syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
+
+;; 1-syntax.watsup:200.1-201.26
+syntax data = `DATA(*)%*%?`(byte**, datamode?)
+
+;; 1-syntax.watsup:202.1-203.16
+syntax start = START(funcidx)
+
+;; 1-syntax.watsup:205.1-206.65
+syntax externuse =
+  | FUNC(funcidx)
+  | GLOBAL(globalidx)
+  | TABLE(tableidx)
+  | MEMORY(memidx)
+
+;; 1-syntax.watsup:207.1-208.24
+syntax export = EXPORT(name, externuse)
+
+;; 1-syntax.watsup:209.1-210.30
+syntax import = IMPORT(name, name, externtype)
+
+;; 1-syntax.watsup:212.1-213.70
+syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
+
+;; 2-aux.watsup:3.1-3.14
+def Ki : nat
+  ;; 2-aux.watsup:4.1-4.15
+  def Ki = 1024
+
+;; 2-aux.watsup:9.1-9.25
+rec {
+
+;; 2-aux.watsup:9.1-9.25
+def min : (nat, nat) -> nat
+  ;; 2-aux.watsup:10.1-10.19
+  def {j : nat} min(0, j) = 0
+  ;; 2-aux.watsup:11.1-11.19
+  def {i : nat} min(i, 0) = 0
+  ;; 2-aux.watsup:12.1-12.38
+  def {i : nat, j : nat} min((i + 1), (j + 1)) = $min(i, j)
+}
+
+;; 2-aux.watsup:19.1-19.55
+def size : valtype -> nat?
+  ;; 2-aux.watsup:20.1-20.20
+  def size(I32_valtype) = ?(32)
+  ;; 2-aux.watsup:21.1-21.20
+  def size(I64_valtype) = ?(64)
+  ;; 2-aux.watsup:22.1-22.20
+  def size(F32_valtype) = ?(32)
+  ;; 2-aux.watsup:23.1-23.20
+  def size(F64_valtype) = ?(64)
+  ;; 2-aux.watsup:24.1-24.22
+  def size(V128_valtype) = ?(128)
+  def {x : valtype} size(x) = ?()
+
+;; 2-aux.watsup:29.1-29.40
+def test_sub_ATOM_22 : n -> nat
+  ;; 2-aux.watsup:30.1-30.38
+  def {n_3_ATOM_y : n} test_sub_ATOM_22(n_3_ATOM_y) = 0
+
+;; 2-aux.watsup:32.1-32.26
+def curried_ : (n, n) -> nat
+  ;; 2-aux.watsup:33.1-33.39
+  def {n_1 : n, n_2 : n} curried_(n_1, n_2) = (n_1 + n_2)
+
+;; 2-aux.watsup:35.1-44.39
+syntax testfuse =
+  | AB_(nat, nat, nat)
+  | CD(nat, nat, nat)
+  | EF(nat, nat, nat)
+  | GH(nat, nat, nat)
+  | IJ(nat, nat, nat)
+  | KL(nat, nat, nat)
+  | MN(nat, nat, nat)
+  | OP(nat, nat, nat)
+  | QR(nat, nat, nat)
+
+;; 3-typing.watsup:3.1-6.60
+syntax context = {FUNC functype*, GLOBAL globaltype*, TABLE tabletype*, MEM memtype*, ELEM elemtype*, DATA datatype*, LOCAL valtype*, LABEL resulttype*, RETURN resulttype?}
+
+;; 3-typing.watsup:14.1-14.66
+relation Limits_ok: `|-%:%`(limits, nat)
+  ;; 3-typing.watsup:22.1-24.24
+  rule _ {k : nat, n_1 : n, n_2 : n}:
+    `|-%:%`(`[%..%]`(n_1, n_2), k)
+    -- if ((n_1 <= n_2) /\ (n_2 <= k))
+
+;; 3-typing.watsup:15.1-15.64
+relation Functype_ok: `|-%:OK`(functype)
+  ;; 3-typing.watsup:26.1-27.13
+  rule _ {ft : functype}:
+    `|-%:OK`(ft)
+
+;; 3-typing.watsup:16.1-16.66
+relation Globaltype_ok: `|-%:OK`(globaltype)
+  ;; 3-typing.watsup:29.1-30.13
+  rule _ {gt : globaltype}:
+    `|-%:OK`(gt)
+
+;; 3-typing.watsup:17.1-17.65
+relation Tabletype_ok: `|-%:OK`(tabletype)
+  ;; 3-typing.watsup:32.1-34.35
+  rule _ {lim : limits, rt : reftype}:
+    `|-%:OK`(`%%`(lim, rt))
+    -- Limits_ok: `|-%:%`(lim, ((2 ^ 32) - 1))
+
+;; 3-typing.watsup:18.1-18.63
+relation Memtype_ok: `|-%:OK`(memtype)
+  ;; 3-typing.watsup:36.1-38.33
+  rule _ {lim : limits}:
+    `|-%:OK`(`%I8`(lim))
+    -- Limits_ok: `|-%:%`(lim, (2 ^ 16))
+
+;; 3-typing.watsup:19.1-19.66
+relation Externtype_ok: `|-%:OK`(externtype)
+  ;; 3-typing.watsup:41.1-43.35
+  rule func {functype : functype}:
+    `|-%:OK`(FUNC_externtype(functype))
+    -- Functype_ok: `|-%:OK`(functype)
+
+  ;; 3-typing.watsup:45.1-47.39
+  rule global {globaltype : globaltype}:
+    `|-%:OK`(GLOBAL_externtype(globaltype))
+    -- Globaltype_ok: `|-%:OK`(globaltype)
+
+  ;; 3-typing.watsup:49.1-51.37
+  rule table {tabletype : tabletype}:
+    `|-%:OK`(TABLE_externtype(tabletype))
+    -- Tabletype_ok: `|-%:OK`(tabletype)
+
+  ;; 3-typing.watsup:53.1-55.33
+  rule mem {memtype : memtype}:
+    `|-%:OK`(MEMORY_externtype(memtype))
+    -- Memtype_ok: `|-%:OK`(memtype)
+
+;; 3-typing.watsup:61.1-61.65
+relation Valtype_sub: `|-%<:%`(valtype, valtype)
+  ;; 3-typing.watsup:64.1-65.12
+  rule refl {t : valtype}:
+    `|-%<:%`(t, t)
+
+  ;; 3-typing.watsup:67.1-68.14
+  rule bot {t : valtype}:
+    `|-%<:%`(BOT_valtype, t)
+
+;; 3-typing.watsup:62.1-62.72
+relation Resulttype_sub: `|-%*<:%*`(valtype*, valtype*)
+  ;; 3-typing.watsup:70.1-72.35
+  rule _ {t_1* : valtype*, t_2* : valtype*}:
+    `|-%*<:%*`(t_1*{t_1}, t_2*{t_2})
+    -- (Valtype_sub: `|-%<:%`(t_1, t_2))*{t_1 t_2}
+
+;; 3-typing.watsup:75.1-75.75
+relation Limits_sub: `|-%<:%`(limits, limits)
+  ;; 3-typing.watsup:83.1-86.21
+  rule _ {n_11 : n, n_12 : n, n_21 : n, n_22 : n}:
+    `|-%<:%`(`[%..%]`(n_11, n_12), `[%..%]`(n_21, n_22))
+    -- if (n_11 >= n_21)
+    -- if (n_12 <= n_22)
+
+;; 3-typing.watsup:76.1-76.73
+relation Functype_sub: `|-%<:%`(functype, functype)
+  ;; 3-typing.watsup:88.1-89.14
+  rule _ {ft : functype}:
+    `|-%<:%`(ft, ft)
+
+;; 3-typing.watsup:77.1-77.75
+relation Globaltype_sub: `|-%<:%`(globaltype, globaltype)
+  ;; 3-typing.watsup:91.1-92.14
+  rule _ {gt : globaltype}:
+    `|-%<:%`(gt, gt)
+
+;; 3-typing.watsup:78.1-78.74
+relation Tabletype_sub: `|-%<:%`(tabletype, tabletype)
+  ;; 3-typing.watsup:94.1-96.35
+  rule _ {lim_1 : limits, lim_2 : limits, rt : reftype}:
+    `|-%<:%`(`%%`(lim_1, rt), `%%`(lim_2, rt))
+    -- Limits_sub: `|-%<:%`(lim_1, lim_2)
+
+;; 3-typing.watsup:79.1-79.72
+relation Memtype_sub: `|-%<:%`(memtype, memtype)
+  ;; 3-typing.watsup:98.1-100.35
+  rule _ {lim_1 : limits, lim_2 : limits}:
+    `|-%<:%`(`%I8`(lim_1), `%I8`(lim_2))
+    -- Limits_sub: `|-%<:%`(lim_1, lim_2)
+
+;; 3-typing.watsup:80.1-80.75
+relation Externtype_sub: `|-%<:%`(externtype, externtype)
+  ;; 3-typing.watsup:103.1-105.35
+  rule func {ft_1 : functype, ft_2 : functype}:
+    `|-%<:%`(FUNC_externtype(ft_1), FUNC_externtype(ft_2))
+    -- Functype_sub: `|-%<:%`(ft_1, ft_2)
+
+  ;; 3-typing.watsup:107.1-109.37
+  rule global {gt_1 : globaltype, gt_2 : globaltype}:
+    `|-%<:%`(GLOBAL_externtype(gt_1), GLOBAL_externtype(gt_2))
+    -- Globaltype_sub: `|-%<:%`(gt_1, gt_2)
+
+  ;; 3-typing.watsup:111.1-113.36
+  rule table {tt_1 : tabletype, tt_2 : tabletype}:
+    `|-%<:%`(TABLE_externtype(tt_1), TABLE_externtype(tt_2))
+    -- Tabletype_sub: `|-%<:%`(tt_1, tt_2)
+
+  ;; 3-typing.watsup:115.1-117.34
+  rule mem {mt_1 : memtype, mt_2 : memtype}:
+    `|-%<:%`(MEMORY_externtype(mt_1), MEMORY_externtype(mt_2))
+    -- Memtype_sub: `|-%<:%`(mt_1, mt_2)
+
+;; 3-typing.watsup:172.1-172.76
+relation Blocktype_ok: `%|-%:%`(context, blocktype, functype)
+  ;; 3-typing.watsup:174.1-176.29
+  rule _ {C : context, ft : functype}:
+    `%|-%:%`(C, ft, ft)
+    -- Functype_ok: `|-%:OK`(ft)
+
+;; 3-typing.watsup:123.1-124.67
+rec {
+
+;; 3-typing.watsup:123.1-123.66
+relation Instr_ok: `%|-%:%`(context, instr, functype)
+  ;; 3-typing.watsup:153.1-154.34
+  rule unreachable {C : context, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, UNREACHABLE_instr, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:156.1-157.32
+  rule nop {C : context}:
+    `%|-%:%`(C, NOP_instr, `%->%`([], []))
+
+  ;; 3-typing.watsup:159.1-160.27
+  rule drop {C : context, t : valtype}:
+    `%|-%:%`(C, DROP_instr, `%->%`([t], []))
+
+  ;; 3-typing.watsup:163.1-164.31
+  rule select-expl {C : context, t : valtype}:
+    `%|-%:%`(C, SELECT_instr(?(t)), `%->%`([t t I32_valtype], [t]))
+
+  ;; 3-typing.watsup:166.1-169.37
+  rule select-impl {C : context, numtype : numtype, t : valtype, t' : valtype, vectype : vectype}:
+    `%|-%:%`(C, SELECT_instr(?()), `%->%`([t t I32_valtype], [t]))
+    -- Valtype_sub: `|-%<:%`(t, t')
+    -- if ((t' = $valtype_numtype(numtype)) \/ (t' = $valtype_vectype(vectype)))
+
+  ;; 3-typing.watsup:178.1-181.57
+  rule block {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BLOCK_instr(bt, instr*{instr}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:183.1-186.57
+  rule loop {C : context, bt : blocktype, instr* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, LOOP_instr(bt, instr*{instr}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_1]*{t_1}, RETURN ?()}, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:188.1-192.59
+  rule if {C : context, bt : blocktype, instr_1* : instr*, instr_2* : instr*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, IF_instr(bt, instr_1*{instr_1}, instr_2*{instr_2}), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Blocktype_ok: `%|-%:%`(C, bt, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr_1*{instr_1}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2]*{t_2}, RETURN ?()}, instr_2*{instr_2}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:195.1-197.24
+  rule br {C : context, l : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BR_instr(l), `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- if (C.LABEL_context[l] = t*{t})
+
+  ;; 3-typing.watsup:199.1-201.24
+  rule br_if {C : context, l : labelidx, t* : valtype*}:
+    `%|-%:%`(C, BR_IF_instr(l), `%->%`(t*{t} :: [I32_valtype], t*{t}))
+    -- if (C.LABEL_context[l] = t*{t})
+
+  ;; 3-typing.watsup:203.1-206.42
+  rule br_table {C : context, l* : labelidx*, l' : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, BR_TABLE_instr(l*{l}, l'), `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- (Resulttype_sub: `|-%*<:%*`(t*{t}, C.LABEL_context[l]))*{l}
+    -- Resulttype_sub: `|-%*<:%*`(t*{t}, C.LABEL_context[l'])
+
+  ;; 3-typing.watsup:208.1-210.24
+  rule return {C : context, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, RETURN_instr, `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- if (C.RETURN_context = ?(t*{t}))
+
+  ;; 3-typing.watsup:212.1-214.33
+  rule call {C : context, t_1* : valtype*, t_2* : valtype*, x : idx}:
+    `%|-%:%`(C, CALL_instr(x), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- if (C.FUNC_context[x] = `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:216.1-219.26
+  rule call_indirect {C : context, ft : functype, lim : limits, t_1* : valtype*, t_2* : valtype*, x : idx}:
+    `%|-%:%`(C, CALL_INDIRECT_instr(x, ft), `%->%`(t_1*{t_1} :: [I32_valtype], t_2*{t_2}))
+    -- if (C.TABLE_context[x] = `%%`(lim, FUNCREF_reftype))
+    -- if (ft = `%->%`(t_1*{t_1}, t_2*{t_2}))
+
+  ;; 3-typing.watsup:222.1-223.37
+  rule const {C : context, c_nt : c_numtype, nt : numtype}:
+    `%|-%:%`(C, CONST_instr(nt, c_nt), `%->%`([], [$valtype_numtype(nt)]))
+
+  ;; 3-typing.watsup:225.1-226.31
+  rule unop {C : context, nt : numtype, unop : unop_numtype}:
+    `%|-%:%`(C, UNOP_instr(nt, unop), `%->%`([$valtype_numtype(nt)], [$valtype_numtype(nt)]))
+
+  ;; 3-typing.watsup:228.1-229.36
+  rule binop {C : context, binop : binop_numtype, nt : numtype}:
+    `%|-%:%`(C, BINOP_instr(nt, binop), `%->%`([$valtype_numtype(nt) $valtype_numtype(nt)], [$valtype_numtype(nt)]))
+
+  ;; 3-typing.watsup:231.1-232.36
+  rule testop {C : context, nt : numtype, testop : testop_numtype}:
+    `%|-%:%`(C, TESTOP_instr(nt, testop), `%->%`([$valtype_numtype(nt)], [I32_valtype]))
+
+  ;; 3-typing.watsup:234.1-235.37
+  rule relop {C : context, nt : numtype, relop : relop_numtype}:
+    `%|-%:%`(C, RELOP_instr(nt, relop), `%->%`([$valtype_numtype(nt) $valtype_numtype(nt)], [I32_valtype]))
+
+  ;; 3-typing.watsup:238.1-240.23
+  rule extend {C : context, n : n, nt : numtype, o0 : nat}:
+    `%|-%:%`(C, EXTEND_instr(nt, n), `%->%`([$valtype_numtype(nt)], [$valtype_numtype(nt)]))
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- if (n <= o0)
+
+  ;; 3-typing.watsup:242.1-245.34
+  rule reinterpret {C : context, nt_1 : numtype, nt_2 : numtype, o0 : nat, o1 : nat}:
+    `%|-%:%`(C, CVTOP_instr(nt_1, REINTERPRET_cvtop, nt_2, ?()), `%->%`([$valtype_numtype(nt_2)], [$valtype_numtype(nt_1)]))
+    -- if ($size($valtype_numtype(nt_1)) = ?(o0))
+    -- if ($size($valtype_numtype(nt_2)) = ?(o1))
+    -- if (nt_1 =/= nt_2)
+    -- if (o0 = o1)
+
+  ;; 3-typing.watsup:247.1-250.52
+  rule convert-i {C : context, in_1 : in, in_2 : in, sx? : sx?, o0 : nat, o1 : nat}:
+    `%|-%:%`(C, CVTOP_instr($numtype_in(in_1), CONVERT_cvtop, $numtype_in(in_2), sx?{sx}), `%->%`([$valtype_in(in_2)], [$valtype_in(in_1)]))
+    -- if ($size($valtype_in(in_1)) = ?(o0))
+    -- if ($size($valtype_in(in_2)) = ?(o1))
+    -- if (in_1 =/= in_2)
+    -- if ((sx?{sx} = ?()) <=> (o0 > o1))
+
+  ;; 3-typing.watsup:252.1-254.22
+  rule convert-f {C : context, fn_1 : fn, fn_2 : fn}:
+    `%|-%:%`(C, CVTOP_instr($numtype_fn(fn_1), CONVERT_cvtop, $numtype_fn(fn_2), ?()), `%->%`([$valtype_fn(fn_2)], [$valtype_fn(fn_1)]))
+    -- if (fn_1 =/= fn_2)
+
+  ;; 3-typing.watsup:257.1-258.35
+  rule ref.null {C : context, rt : reftype}:
+    `%|-%:%`(C, REF.NULL_instr(rt), `%->%`([], [$valtype_reftype(rt)]))
+
+  ;; 3-typing.watsup:260.1-262.23
+  rule ref.func {C : context, ft : functype, x : idx}:
+    `%|-%:%`(C, REF.FUNC_instr(x), `%->%`([], [FUNCREF_valtype]))
+    -- if (C.FUNC_context[x] = ft)
+
+  ;; 3-typing.watsup:264.1-265.31
+  rule ref.is_null {C : context, rt : reftype}:
+    `%|-%:%`(C, REF.IS_NULL_instr, `%->%`([$valtype_reftype(rt)], [I32_valtype]))
+
+  ;; 3-typing.watsup:268.1-270.23
+  rule local.get {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.GET_instr(x), `%->%`([], [t]))
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:272.1-274.23
+  rule local.set {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.SET_instr(x), `%->%`([t], []))
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:276.1-278.23
+  rule local.tee {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, LOCAL.TEE_instr(x), `%->%`([t], [t]))
+    -- if (C.LOCAL_context[x] = t)
+
+  ;; 3-typing.watsup:281.1-283.29
+  rule global.get {C : context, t : valtype, x : idx, w0 : ()?}:
+    `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(w0, t))
+
+  ;; 3-typing.watsup:285.1-287.28
+  rule global.set {C : context, t : valtype, x : idx}:
+    `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
+
+  ;; 3-typing.watsup:290.1-292.28
+  rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [$valtype_reftype(rt)]))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:294.1-296.28
+  rule table.set {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype $valtype_reftype(rt)], []))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:298.1-300.24
+  rule table.size {C : context, tt : tabletype, x : idx}:
+    `%|-%:%`(C, TABLE.SIZE_instr(x), `%->%`([], [I32_valtype]))
+    -- if (C.TABLE_context[x] = tt)
+
+  ;; 3-typing.watsup:302.1-304.28
+  rule table.grow {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([$valtype_reftype(rt) I32_valtype], [I32_valtype]))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:306.1-308.28
+  rule table.fill {C : context, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype $valtype_reftype(rt) I32_valtype], []))
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+
+  ;; 3-typing.watsup:310.1-313.32
+  rule table.copy {C : context, lim_1 : limits, lim_2 : limits, rt : reftype, x_1 : idx, x_2 : idx}:
+    `%|-%:%`(C, TABLE.COPY_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (C.TABLE_context[x_1] = `%%`(lim_1, rt))
+    -- if (C.TABLE_context[x_2] = `%%`(lim_2, rt))
+
+  ;; 3-typing.watsup:315.1-318.25
+  rule table.init {C : context, lim : limits, rt : reftype, x_1 : idx, x_2 : idx}:
+    `%|-%:%`(C, TABLE.INIT_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (C.TABLE_context[x_1] = `%%`(lim, rt))
+    -- if (C.ELEM_context[x_2] = rt)
+
+  ;; 3-typing.watsup:320.1-322.23
+  rule elem.drop {C : context, rt : reftype, x : idx}:
+    `%|-%:%`(C, ELEM.DROP_instr(x), `%->%`([], []))
+    -- if (C.ELEM_context[x] = rt)
+
+  ;; 3-typing.watsup:325.1-327.22
+  rule memory.size {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.SIZE_instr, `%->%`([], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:329.1-331.22
+  rule memory.grow {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.GROW_instr, `%->%`([I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:333.1-335.22
+  rule memory.fill {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.FILL_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:337.1-339.22
+  rule memory.copy {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY.COPY_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+
+  ;; 3-typing.watsup:341.1-344.23
+  rule memory.init {C : context, mt : memtype, x : idx}:
+    `%|-%:%`(C, MEMORY.INIT_instr(x), `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (C.MEM_context[0] = mt)
+    -- if (C.DATA_context[x] = OK)
+
+  ;; 3-typing.watsup:346.1-348.23
+  rule data.drop {C : context, x : idx}:
+    `%|-%:%`(C, DATA.DROP_instr(x), `%->%`([], []))
+    -- if (C.DATA_context[x] = OK)
+
+  ;; 3-typing.watsup:350.1-355.32
+  rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?, o0 : nat, o1? : nat?}:
+    `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [$valtype_numtype(nt)]))
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- (if ($size($valtype_numtype(nt)) = ?(o1)))?{o1}
+    -- if (C.MEM_context[0] = mt)
+    -- if ((2 ^ n_A) <= (o0 / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (o1 / 8))))?{n o1}
+    -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
+
+  ;; 3-typing.watsup:357.1-362.32
+  rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, o0 : nat, o1? : nat?}:
+    `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype $valtype_numtype(nt)], []))
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- (if ($size($valtype_numtype(nt)) = ?(o1)))?{o1}
+    -- if (C.MEM_context[0] = mt)
+    -- if ((2 ^ n_A) <= (o0 / 8))
+    -- (if (((2 ^ n_A) <= (n / 8)) /\ ((n / 8) < (o1 / 8))))?{n o1}
+    -- if ((n?{n} = ?()) \/ (nt = $numtype_in(in)))
+
+;; 3-typing.watsup:124.1-124.67
+relation InstrSeq_ok: `%|-%*:%`(context, instr*, functype)
+  ;; 3-typing.watsup:133.1-134.36
+  rule empty {C : context}:
+    `%|-%*:%`(C, [], `%->%`([], []))
+
+  ;; 3-typing.watsup:136.1-139.46
+  rule seq {C : context, instr_1 : instr, instr_2 : instr, t_1* : valtype*, t_2* : valtype*, t_3* : valtype*}:
+    `%|-%*:%`(C, [instr_1] :: instr_2*{}, `%->%`(t_1*{t_1}, t_3*{t_3}))
+    -- Instr_ok: `%|-%:%`(C, instr_1, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, [instr_2], `%->%`(t_2*{t_2}, t_3*{t_3}))
+
+  ;; 3-typing.watsup:141.1-146.38
+  rule weak {C : context, instr* : instr*, t'_1* : valtype*, t'_2* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%*:%`(C, instr*{instr}, `%->%`(t'_1*{t'_1}, t'_2*{t'_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Resulttype_sub: `|-%*<:%*`(t'_1*{t'_1}, t_1*{t_1})
+    -- Resulttype_sub: `|-%*<:%*`(t_2*{t_2}, t'_2*{t'_2})
+
+  ;; 3-typing.watsup:148.1-150.45
+  rule frame {C : context, instr* : instr*, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%*:%`(C, instr*{instr}, `%->%`(t*{t} :: t_1*{t_1}, t*{t} :: t_2*{t_2}))
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
+}
+
+;; 3-typing.watsup:125.1-125.71
+relation Expr_ok: `%|-%:%`(context, expr, resulttype)
+  ;; 3-typing.watsup:128.1-130.46
+  rule _ {C : context, instr* : instr*, t* : valtype*}:
+    `%|-%:%`(C, instr*{instr}, t*{t})
+    -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`([], t*{t}))
+
+;; 3-typing.watsup:367.1-367.78
+relation Instr_const: `%|-%CONST`(context, instr)
+  ;; 3-typing.watsup:371.1-372.26
+  rule const {C : context, c : c_numtype, nt : numtype}:
+    `%|-%CONST`(C, CONST_instr(nt, c))
+
+  ;; 3-typing.watsup:374.1-375.27
+  rule ref.null {C : context, rt : reftype}:
+    `%|-%CONST`(C, REF.NULL_instr(rt))
+
+  ;; 3-typing.watsup:377.1-378.26
+  rule ref.func {C : context, x : idx}:
+    `%|-%CONST`(C, REF.FUNC_instr(x))
+
+  ;; 3-typing.watsup:380.1-382.32
+  rule global.get {C : context, t : valtype, x : idx}:
+    `%|-%CONST`(C, GLOBAL.GET_instr(x))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(), t))
+
+;; 3-typing.watsup:368.1-368.77
+relation Expr_const: `%|-%CONST`(context, expr)
+  ;; 3-typing.watsup:385.1-386.38
+  rule _ {C : context, instr* : instr*}:
+    `%|-%CONST`(C, instr*{instr})
+    -- (Instr_const: `%|-%CONST`(C, instr))*{instr}
+
+;; 3-typing.watsup:369.1-369.78
+relation Expr_ok_const: `%|-%:%CONST`(context, expr, valtype)
+  ;; 3-typing.watsup:389.1-392.33
+  rule _ {C : context, expr : expr, t : valtype}:
+    `%|-%:%CONST`(C, expr, t)
+    -- Expr_ok: `%|-%:%`(C, expr, [t])
+    -- Expr_const: `%|-%CONST`(C, expr)
+
+;; 3-typing.watsup:397.1-397.73
+relation Func_ok: `%|-%:%`(context, func, functype)
+  ;; 3-typing.watsup:408.1-412.75
+  rule _ {C : context, expr : expr, ft : functype, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%:%`(C, `FUNC%%*%`(ft, t*{t}, expr), ft)
+    -- if (ft = `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- Functype_ok: `|-%:OK`(ft)
+    -- Expr_ok: `%|-%:%`(C ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL t_1*{t_1} :: t*{t}, LABEL [], RETURN ?()} ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [t_2*{t_2}], RETURN ?()} ++ {FUNC [], GLOBAL [], TABLE [], MEM [], ELEM [], DATA [], LOCAL [], LABEL [], RETURN ?(t_2*{t_2})}, expr, t_2*{t_2})
+
+;; 3-typing.watsup:398.1-398.75
+relation Global_ok: `%|-%:%`(context, global, globaltype)
+  ;; 3-typing.watsup:414.1-418.40
+  rule _ {C : context, expr : expr, gt : globaltype, t : valtype, w0 : ()?}:
+    `%|-%:%`(C, GLOBAL(gt, expr), gt)
+    -- Globaltype_ok: `|-%:OK`(gt)
+    -- if (gt = `MUT%?%`(w0, t))
+    -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
+
+;; 3-typing.watsup:399.1-399.74
+relation Table_ok: `%|-%:%`(context, table, tabletype)
+  ;; 3-typing.watsup:420.1-422.30
+  rule _ {C : context, tt : tabletype}:
+    `%|-%:%`(C, TABLE(tt), tt)
+    -- Tabletype_ok: `|-%:OK`(tt)
+
+;; 3-typing.watsup:400.1-400.72
+relation Mem_ok: `%|-%:%`(context, mem, memtype)
+  ;; 3-typing.watsup:424.1-426.28
+  rule _ {C : context, mt : memtype}:
+    `%|-%:%`(C, MEMORY(mt), mt)
+    -- Memtype_ok: `|-%:OK`(mt)
+
+;; 3-typing.watsup:403.1-403.77
+relation Elemmode_ok: `%|-%:%`(context, elemmode, reftype)
+  ;; 3-typing.watsup:437.1-440.45
+  rule active {C : context, expr : expr, lim : limits, rt : reftype, x : idx}:
+    `%|-%:%`(C, TABLE_elemmode(x, expr), rt)
+    -- if (C.TABLE_context[x] = `%%`(lim, rt))
+    -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*{}
+
+  ;; 3-typing.watsup:442.1-443.20
+  rule declare {C : context, rt : reftype}:
+    `%|-%:%`(C, DECLARE_elemmode, rt)
+
+;; 3-typing.watsup:401.1-401.73
+relation Elem_ok: `%|-%:%`(context, elem, reftype)
+  ;; 3-typing.watsup:428.1-431.40
+  rule _ {C : context, elemmode? : elemmode?, expr* : expr*, rt : reftype}:
+    `%|-%:%`(C, `ELEM%%*%?`(rt, expr*{expr}, elemmode?{elemmode}), rt)
+    -- (Expr_ok: `%|-%:%`(C, expr, [$valtype_reftype(rt)]))*{expr}
+    -- (Elemmode_ok: `%|-%:%`(C, elemmode, rt))?{elemmode}
+
+;; 3-typing.watsup:404.1-404.77
+relation Datamode_ok: `%|-%:OK`(context, datamode)
+  ;; 3-typing.watsup:445.1-448.45
+  rule _ {C : context, expr : expr, mt : memtype}:
+    `%|-%:OK`(C, MEMORY_datamode(0, expr))
+    -- if (C.MEM_context[0] = mt)
+    -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*{}
+
+;; 3-typing.watsup:402.1-402.73
+relation Data_ok: `%|-%:OK`(context, data)
+  ;; 3-typing.watsup:433.1-435.40
+  rule _ {C : context, b** : byte**, datamode? : datamode?}:
+    `%|-%:OK`(C, `DATA(*)%*%?`(b*{b}*{b}, datamode?{datamode}))
+    -- (Datamode_ok: `%|-%:OK`(C, datamode))?{datamode}
+
+;; 3-typing.watsup:405.1-405.74
+relation Start_ok: `%|-%:OK`(context, start)
+  ;; 3-typing.watsup:450.1-452.39
+  rule _ {C : context, x : idx}:
+    `%|-%:OK`(C, START(x))
+    -- if (C.FUNC_context[x] = `%->%`([], []))
+
+;; 3-typing.watsup:455.1-455.80
+relation Import_ok: `%|-%:%`(context, import, externtype)
+  ;; 3-typing.watsup:459.1-461.31
+  rule _ {C : context, name_1 : name, name_2 : name, xt : externtype}:
+    `%|-%:%`(C, IMPORT(name_1, name_2, xt), xt)
+    -- Externtype_ok: `|-%:OK`(xt)
+
+;; 3-typing.watsup:457.1-457.83
+relation Externuse_ok: `%|-%:%`(context, externuse, externtype)
+  ;; 3-typing.watsup:467.1-469.23
+  rule func {C : context, ft : functype, x : idx}:
+    `%|-%:%`(C, FUNC_externuse(x), FUNC_externtype(ft))
+    -- if (C.FUNC_context[x] = ft)
+
+  ;; 3-typing.watsup:471.1-473.25
+  rule global {C : context, gt : globaltype, x : idx}:
+    `%|-%:%`(C, GLOBAL_externuse(x), GLOBAL_externtype(gt))
+    -- if (C.GLOBAL_context[x] = gt)
+
+  ;; 3-typing.watsup:475.1-477.24
+  rule table {C : context, tt : tabletype, x : idx}:
+    `%|-%:%`(C, TABLE_externuse(x), TABLE_externtype(tt))
+    -- if (C.TABLE_context[x] = tt)
+
+  ;; 3-typing.watsup:479.1-481.22
+  rule mem {C : context, mt : memtype, x : idx}:
+    `%|-%:%`(C, MEMORY_externuse(x), MEMORY_externtype(mt))
+    -- if (C.MEM_context[x] = mt)
+
+;; 3-typing.watsup:456.1-456.80
+relation Export_ok: `%|-%:%`(context, export, externtype)
+  ;; 3-typing.watsup:463.1-465.39
+  rule _ {C : context, externuse : externuse, name : name, xt : externtype}:
+    `%|-%:%`(C, EXPORT(name, externuse), xt)
+    -- Externuse_ok: `%|-%:%`(C, externuse, xt)
+
+;; 3-typing.watsup:484.1-484.62
+relation Module_ok: `|-%:OK`(module)
+  ;; 3-typing.watsup:486.1-501.22
+  rule _ {C : context, data^n : data^n, elem* : elem*, export* : export*, ft* : functype*, func* : func*, global* : global*, gt* : globaltype*, import* : import*, mem* : mem*, mt* : memtype*, n : n, rt* : reftype*, start* : start*, table* : table*, tt* : tabletype*}:
+    `|-%:OK`(`MODULE%*%*%*%*%*%*%*%*%*`(import*{import}, func*{func}, global*{global}, table*{table}, mem*{mem}, elem*{elem}, data^n{data}, start*{start}, export*{export}))
+    -- if (C = {FUNC ft*{ft}, GLOBAL gt*{gt}, TABLE tt*{tt}, MEM mt*{mt}, ELEM rt*{rt}, DATA OK^n{}, LOCAL [], LABEL [], RETURN ?()})
+    -- (Func_ok: `%|-%:%`(C, func, ft))*{ft func}
+    -- (Global_ok: `%|-%:%`(C, global, gt))*{global gt}
+    -- (Table_ok: `%|-%:%`(C, table, tt))*{table tt}
+    -- (Mem_ok: `%|-%:%`(C, mem, mt))*{mem mt}
+    -- (Elem_ok: `%|-%:%`(C, elem, rt))*{elem rt}
+    -- (Data_ok: `%|-%:OK`(C, data))^n{data}
+    -- (Start_ok: `%|-%:OK`(C, start))*{start}
+    -- if (|mem*{mem}| <= 1)
+    -- if (|start*{start}| <= 1)
+
+;; 4-runtime.watsup:3.1-3.39
+syntax addr = nat
+
+;; 4-runtime.watsup:4.1-4.53
+syntax funcaddr = addr
+
+;; 4-runtime.watsup:5.1-5.53
+syntax globaladdr = addr
+
+;; 4-runtime.watsup:6.1-6.51
+syntax tableaddr = addr
+
+;; 4-runtime.watsup:7.1-7.50
+syntax memaddr = addr
+
+;; 4-runtime.watsup:8.1-8.49
+syntax elemaddr = addr
+
+;; 4-runtime.watsup:9.1-9.49
+syntax dataaddr = addr
+
+;; 4-runtime.watsup:10.1-10.51
+syntax labeladdr = addr
+
+;; 4-runtime.watsup:11.1-11.49
+syntax hostaddr = addr
+
+;; 4-runtime.watsup:24.1-25.24
+syntax num =
+  | CONST(numtype, c_numtype)
+
+;; 4-runtime.watsup:26.1-27.67
+syntax ref =
+  | REF.NULL(reftype)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+
+;; 4-runtime.watsup:28.1-29.10
+syntax val =
+  | CONST(numtype, c_numtype)
+  | REF.NULL(reftype)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+
+;; 4-runtime.watsup:31.1-32.18
+syntax result =
+  | _VALS(val*)
+  | TRAP
+
+;; 4-runtime.watsup:38.1-39.66
+syntax externval =
+  | FUNC(funcaddr)
+  | GLOBAL(globaladdr)
+  | TABLE(tableaddr)
+  | MEM(memaddr)
+
+;; 4-runtime.watsup:44.1-44.44
+def default_ : valtype -> val?
+  ;; 4-runtime.watsup:45.1-45.35
+  def default_(I32_valtype) = ?(CONST_val(I32_numtype, 0))
+  ;; 4-runtime.watsup:46.1-46.35
+  def default_(I64_valtype) = ?(CONST_val(I64_numtype, 0))
+  ;; 4-runtime.watsup:47.1-47.35
+  def default_(F32_valtype) = ?(CONST_val(F32_numtype, 0))
+  ;; 4-runtime.watsup:48.1-48.35
+  def default_(F64_valtype) = ?(CONST_val(F64_numtype, 0))
+  ;; 4-runtime.watsup:49.1-49.34
+  def {rt : reftype} default_($valtype_reftype(rt)) = ?(REF.NULL_val(rt))
+  def {x : valtype} default_(x) = ?()
+
+;; 4-runtime.watsup:60.1-60.71
+syntax exportinst = EXPORT(name, externval)
+
+;; 4-runtime.watsup:70.1-77.25
+syntax moduleinst = {FUNC funcaddr*, GLOBAL globaladdr*, TABLE tableaddr*, MEM memaddr*, ELEM elemaddr*, DATA dataaddr*, EXPORT exportinst*}
+
+;; 4-runtime.watsup:54.1-54.66
+syntax funcinst = `%;%`(moduleinst, func)
+
+;; 4-runtime.watsup:55.1-55.53
+syntax globalinst = val
+
+;; 4-runtime.watsup:56.1-56.52
+syntax tableinst = ref*
+
+;; 4-runtime.watsup:57.1-57.52
+syntax meminst = byte*
+
+;; 4-runtime.watsup:58.1-58.53
+syntax eleminst = ref*
+
+;; 4-runtime.watsup:59.1-59.51
+syntax datainst = byte*
+
+;; 4-runtime.watsup:62.1-68.21
+syntax store = {FUNC funcinst*, GLOBAL globalinst*, TABLE tableinst*, MEM meminst*, ELEM eleminst*, DATA datainst*}
+
+;; 4-runtime.watsup:79.1-81.24
+syntax frame = {LOCAL val*, MODULE moduleinst}
+
+;; 4-runtime.watsup:82.1-82.47
+syntax state = `%;%`(store, frame)
+
+;; 4-runtime.watsup:145.1-152.5
+rec {
+
+;; 4-runtime.watsup:145.1-152.5
+syntax admininstr =
+  | UNREACHABLE
+  | NOP
+  | DROP
+  | SELECT(valtype?)
+  | BLOCK(blocktype, instr*)
+  | LOOP(blocktype, instr*)
+  | IF(blocktype, instr*, instr*)
+  | BR(labelidx)
+  | BR_IF(labelidx)
+  | BR_TABLE(labelidx*, labelidx)
+  | CALL(funcidx)
+  | CALL_INDIRECT(tableidx, functype)
+  | RETURN
+  | CONST(numtype, c_numtype)
+  | UNOP(numtype, unop_numtype)
+  | BINOP(numtype, binop_numtype)
+  | TESTOP(numtype, testop_numtype)
+  | RELOP(numtype, relop_numtype)
+  | EXTEND(numtype, n)
+  | CVTOP(numtype, cvtop, numtype, sx?)
+  | REF.NULL(reftype)
+  | REF.FUNC(funcidx)
+  | REF.IS_NULL
+  | LOCAL.GET(localidx)
+  | LOCAL.SET(localidx)
+  | LOCAL.TEE(localidx)
+  | GLOBAL.GET(globalidx)
+  | GLOBAL.SET(globalidx)
+  | TABLE.GET(tableidx)
+  | TABLE.SET(tableidx)
+  | TABLE.SIZE(tableidx)
+  | TABLE.GROW(tableidx)
+  | TABLE.FILL(tableidx)
+  | TABLE.COPY(tableidx, tableidx)
+  | TABLE.INIT(tableidx, elemidx)
+  | ELEM.DROP(elemidx)
+  | MEMORY.SIZE
+  | MEMORY.GROW
+  | MEMORY.FILL
+  | MEMORY.COPY
+  | MEMORY.INIT(dataidx)
+  | DATA.DROP(dataidx)
+  | LOAD(numtype, (n, sx)?, u32, u32)
+  | STORE(numtype, n?, u32, u32)
+  | REF.FUNC_ADDR(funcaddr)
+  | REF.HOST_ADDR(hostaddr)
+  | CALL_ADDR(funcaddr)
+  | LABEL_(n, instr*, admininstr*)
+  | FRAME_(n, frame, admininstr*)
+  | TRAP
+}
+
+def admininstr_globalinst : globalinst -> admininstr
+  def {x0 : numtype, x1 : c_numtype} admininstr_globalinst(CONST_val(x0, x1)) = CONST_admininstr(x0, x1)
+  def {x : reftype} admininstr_globalinst(REF.NULL_val(x)) = REF.NULL_admininstr(x)
+  def {x : funcaddr} admininstr_globalinst(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
+  def {x : hostaddr} admininstr_globalinst(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
+
+def admininstr_instr : instr -> admininstr
+  def admininstr_instr(UNREACHABLE_instr) = UNREACHABLE_admininstr
+  def admininstr_instr(NOP_instr) = NOP_admininstr
+  def admininstr_instr(DROP_instr) = DROP_admininstr
+  def {x : valtype?} admininstr_instr(SELECT_instr(x)) = SELECT_admininstr(x)
+  def {x0 : blocktype, x1 : instr*} admininstr_instr(BLOCK_instr(x0, x1)) = BLOCK_admininstr(x0, x1)
+  def {x0 : blocktype, x1 : instr*} admininstr_instr(LOOP_instr(x0, x1)) = LOOP_admininstr(x0, x1)
+  def {x0 : blocktype, x1 : instr*, x2 : instr*} admininstr_instr(IF_instr(x0, x1, x2)) = IF_admininstr(x0, x1, x2)
+  def {x : labelidx} admininstr_instr(BR_instr(x)) = BR_admininstr(x)
+  def {x : labelidx} admininstr_instr(BR_IF_instr(x)) = BR_IF_admininstr(x)
+  def {x0 : labelidx*, x1 : labelidx} admininstr_instr(BR_TABLE_instr(x0, x1)) = BR_TABLE_admininstr(x0, x1)
+  def {x : funcidx} admininstr_instr(CALL_instr(x)) = CALL_admininstr(x)
+  def {x0 : tableidx, x1 : functype} admininstr_instr(CALL_INDIRECT_instr(x0, x1)) = CALL_INDIRECT_admininstr(x0, x1)
+  def admininstr_instr(RETURN_instr) = RETURN_admininstr
+  def {x0 : numtype, x1 : c_numtype} admininstr_instr(CONST_instr(x0, x1)) = CONST_admininstr(x0, x1)
+  def {x0 : numtype, x1 : unop_numtype} admininstr_instr(UNOP_instr(x0, x1)) = UNOP_admininstr(x0, x1)
+  def {x0 : numtype, x1 : binop_numtype} admininstr_instr(BINOP_instr(x0, x1)) = BINOP_admininstr(x0, x1)
+  def {x0 : numtype, x1 : testop_numtype} admininstr_instr(TESTOP_instr(x0, x1)) = TESTOP_admininstr(x0, x1)
+  def {x0 : numtype, x1 : relop_numtype} admininstr_instr(RELOP_instr(x0, x1)) = RELOP_admininstr(x0, x1)
+  def {x0 : numtype, x1 : n} admininstr_instr(EXTEND_instr(x0, x1)) = EXTEND_admininstr(x0, x1)
+  def {x0 : numtype, x1 : cvtop, x2 : numtype, x3 : sx?} admininstr_instr(CVTOP_instr(x0, x1, x2, x3)) = CVTOP_admininstr(x0, x1, x2, x3)
+  def {x : reftype} admininstr_instr(REF.NULL_instr(x)) = REF.NULL_admininstr(x)
+  def {x : funcidx} admininstr_instr(REF.FUNC_instr(x)) = REF.FUNC_admininstr(x)
+  def admininstr_instr(REF.IS_NULL_instr) = REF.IS_NULL_admininstr
+  def {x : localidx} admininstr_instr(LOCAL.GET_instr(x)) = LOCAL.GET_admininstr(x)
+  def {x : localidx} admininstr_instr(LOCAL.SET_instr(x)) = LOCAL.SET_admininstr(x)
+  def {x : localidx} admininstr_instr(LOCAL.TEE_instr(x)) = LOCAL.TEE_admininstr(x)
+  def {x : globalidx} admininstr_instr(GLOBAL.GET_instr(x)) = GLOBAL.GET_admininstr(x)
+  def {x : globalidx} admininstr_instr(GLOBAL.SET_instr(x)) = GLOBAL.SET_admininstr(x)
+  def {x : tableidx} admininstr_instr(TABLE.GET_instr(x)) = TABLE.GET_admininstr(x)
+  def {x : tableidx} admininstr_instr(TABLE.SET_instr(x)) = TABLE.SET_admininstr(x)
+  def {x : tableidx} admininstr_instr(TABLE.SIZE_instr(x)) = TABLE.SIZE_admininstr(x)
+  def {x : tableidx} admininstr_instr(TABLE.GROW_instr(x)) = TABLE.GROW_admininstr(x)
+  def {x : tableidx} admininstr_instr(TABLE.FILL_instr(x)) = TABLE.FILL_admininstr(x)
+  def {x0 : tableidx, x1 : tableidx} admininstr_instr(TABLE.COPY_instr(x0, x1)) = TABLE.COPY_admininstr(x0, x1)
+  def {x0 : tableidx, x1 : elemidx} admininstr_instr(TABLE.INIT_instr(x0, x1)) = TABLE.INIT_admininstr(x0, x1)
+  def {x : elemidx} admininstr_instr(ELEM.DROP_instr(x)) = ELEM.DROP_admininstr(x)
+  def admininstr_instr(MEMORY.SIZE_instr) = MEMORY.SIZE_admininstr
+  def admininstr_instr(MEMORY.GROW_instr) = MEMORY.GROW_admininstr
+  def admininstr_instr(MEMORY.FILL_instr) = MEMORY.FILL_admininstr
+  def admininstr_instr(MEMORY.COPY_instr) = MEMORY.COPY_admininstr
+  def {x : dataidx} admininstr_instr(MEMORY.INIT_instr(x)) = MEMORY.INIT_admininstr(x)
+  def {x : dataidx} admininstr_instr(DATA.DROP_instr(x)) = DATA.DROP_admininstr(x)
+  def {x0 : numtype, x1 : (n, sx)?, x2 : u32, x3 : u32} admininstr_instr(LOAD_instr(x0, x1, x2, x3)) = LOAD_admininstr(x0, x1, x2, x3)
+  def {x0 : numtype, x1 : n?, x2 : u32, x3 : u32} admininstr_instr(STORE_instr(x0, x1, x2, x3)) = STORE_admininstr(x0, x1, x2, x3)
+
+def admininstr_ref : ref -> admininstr
+  def {x : reftype} admininstr_ref(REF.NULL_ref(x)) = REF.NULL_admininstr(x)
+  def {x : funcaddr} admininstr_ref(REF.FUNC_ADDR_ref(x)) = REF.FUNC_ADDR_admininstr(x)
+  def {x : hostaddr} admininstr_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_admininstr(x)
+
+def admininstr_val : val -> admininstr
+  def {x0 : numtype, x1 : c_numtype} admininstr_val(CONST_val(x0, x1)) = CONST_admininstr(x0, x1)
+  def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
+  def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
+  def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
+
+;; 4-runtime.watsup:83.1-83.62
+syntax config = `%;%*`(state, admininstr*)
+
+;; 4-runtime.watsup:101.1-101.59
+def funcaddr : state -> funcaddr*
+  ;; 4-runtime.watsup:102.1-102.38
+  def {f : frame, s : store} funcaddr(`%;%`(s, f)) = f.MODULE_frame.FUNC_moduleinst
+
+;; 4-runtime.watsup:104.1-104.52
+def funcinst : state -> funcinst*
+  ;; 4-runtime.watsup:105.1-105.31
+  def {f : frame, s : store} funcinst(`%;%`(s, f)) = s.FUNC_store
+
+;; 4-runtime.watsup:107.1-107.67
+def func : (state, funcidx) -> funcinst
+  ;; 4-runtime.watsup:115.1-115.48
+  def {f : frame, s : store, x : idx} func(`%;%`(s, f), x) = s.FUNC_store[f.MODULE_frame.FUNC_moduleinst[x]]
+
+;; 4-runtime.watsup:108.1-108.69
+def global : (state, globalidx) -> globalinst
+  ;; 4-runtime.watsup:116.1-116.54
+  def {f : frame, s : store, x : idx} global(`%;%`(s, f), x) = s.GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]]
+
+;; 4-runtime.watsup:109.1-109.68
+def table : (state, tableidx) -> tableinst
+  ;; 4-runtime.watsup:117.1-117.51
+  def {f : frame, s : store, x : idx} table(`%;%`(s, f), x) = s.TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]]
+
+;; 4-runtime.watsup:110.1-110.66
+def mem : (state, memidx) -> meminst
+  ;; 4-runtime.watsup:118.1-118.45
+  def {f : frame, s : store, x : idx} mem(`%;%`(s, f), x) = s.MEM_store[f.MODULE_frame.MEM_moduleinst[x]]
+
+;; 4-runtime.watsup:111.1-111.67
+def elem : (state, tableidx) -> eleminst
+  ;; 4-runtime.watsup:119.1-119.48
+  def {f : frame, s : store, x : idx} elem(`%;%`(s, f), x) = s.ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]]
+
+;; 4-runtime.watsup:112.1-112.67
+def data : (state, dataidx) -> datainst
+  ;; 4-runtime.watsup:120.1-120.48
+  def {f : frame, s : store, x : idx} data(`%;%`(s, f), x) = s.DATA_store[f.MODULE_frame.DATA_moduleinst[x]]
+
+;; 4-runtime.watsup:113.1-113.68
+def local : (state, localidx) -> val
+  ;; 4-runtime.watsup:121.1-121.35
+  def {f : frame, s : store, x : idx} local(`%;%`(s, f), x) = f.LOCAL_frame[x]
+
+;; 4-runtime.watsup:124.1-124.78
+def with_local : (state, localidx, val) -> state
+  ;; 4-runtime.watsup:133.1-133.52
+  def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL_frame[x] = v])
+
+;; 4-runtime.watsup:125.1-125.79
+def with_global : (state, globalidx, val) -> state
+  ;; 4-runtime.watsup:134.1-134.71
+  def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
+
+;; 4-runtime.watsup:126.1-126.83
+def with_table : (state, tableidx, nat, ref) -> state
+  ;; 4-runtime.watsup:135.1-135.74
+  def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
+
+;; 4-runtime.watsup:127.1-127.80
+def with_tableext : (state, tableidx, ref*) -> state
+  ;; 4-runtime.watsup:136.1-136.75
+  def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
+
+;; 4-runtime.watsup:128.1-128.90
+def with_mem : (state, tableidx, nat, nat, byte*) -> state
+  ;; 4-runtime.watsup:137.1-137.77
+  def {b* : byte*, f : frame, i : nat, j : nat, s : store, x : idx} with_mem(`%;%`(s, f), x, i, j, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}], f)
+
+;; 4-runtime.watsup:129.1-129.78
+def with_memext : (state, tableidx, byte*) -> state
+  ;; 4-runtime.watsup:138.1-138.69
+  def {b* : byte*, f : frame, s : store, x : idx} with_memext(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}], f)
+
+;; 4-runtime.watsup:130.1-130.77
+def with_elem : (state, elemidx, ref*) -> state
+  ;; 4-runtime.watsup:139.1-139.67
+  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]] = r*{r}], f)
+
+;; 4-runtime.watsup:131.1-131.77
+def with_data : (state, dataidx, byte*) -> state
+  ;; 4-runtime.watsup:140.1-140.67
+  def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[DATA_store[f.MODULE_frame.DATA_moduleinst[x]] = b*{b}], f)
+
+;; 4-runtime.watsup:154.1-157.21
+rec {
+
+;; 4-runtime.watsup:154.1-157.21
+syntax E =
+  | _HOLE
+  | _SEQ(val*, E, instr*)
+  | LABEL_(n, instr*, E)
+}
+
+;; 5-numerics.watsup:3.1-3.79
+def unop : (unop_numtype, numtype, c_numtype) -> c_numtype*
+
+;; 5-numerics.watsup:4.1-4.80
+def binop : (binop_numtype, numtype, c_numtype, c_numtype) -> c_numtype*
+
+;; 5-numerics.watsup:5.1-5.79
+def testop : (testop_numtype, numtype, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:6.1-6.80
+def relop : (relop_numtype, numtype, c_numtype, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:8.1-8.84
+def ext : (nat, nat, sx, c_numtype) -> c_numtype
+
+;; 5-numerics.watsup:9.1-9.84
+def cvtop : (numtype, cvtop, numtype, sx?, c_numtype) -> c_numtype*
+
+;; 5-numerics.watsup:11.1-11.32
+def wrap_ : ((nat, nat), c_numtype) -> nat
+
+;; 5-numerics.watsup:13.1-13.28
+def bytes_ : (nat, c_numtype) -> byte*
+
+;; 6-reduction.watsup:4.1-4.63
+relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
+  ;; 6-reduction.watsup:16.1-17.24
+  rule unreachable:
+    `%*~>%*`([UNREACHABLE_admininstr], [TRAP_admininstr])
+
+  ;; 6-reduction.watsup:19.1-20.19
+  rule nop:
+    `%*~>%*`([NOP_admininstr], [])
+
+  ;; 6-reduction.watsup:22.1-23.24
+  rule drop {val : val}:
+    `%*~>%*`([$admininstr_val(val) DROP_admininstr], [])
+
+  ;; 6-reduction.watsup:26.1-28.16
+  rule select-true {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
+    `%*~>%*`([$admininstr_val(val_1) $admininstr_val(val_2) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [$admininstr_val(val_1)])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:30.1-32.14
+  rule select-false {c : c_numtype, t? : valtype?, val_1 : val, val_2 : val}:
+    `%*~>%*`([$admininstr_val(val_1) $admininstr_val(val_2) CONST_admininstr(I32_numtype, c) SELECT_admininstr(t?{t})], [$admininstr_val(val_2)])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:35.1-37.28
+  rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
+    `%*~>%*`($admininstr_val(val)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], $admininstr_val(val)^k{val} :: $admininstr_instr(instr)*{instr})])
+    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
+
+  ;; 6-reduction.watsup:39.1-41.28
+  rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
+    `%*~>%*`($admininstr_val(val)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(k, [LOOP_instr(bt, instr*{instr})], $admininstr_val(val)^k{val} :: $admininstr_instr(instr)*{instr})])
+    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
+
+  ;; 6-reduction.watsup:43.1-45.16
+  rule if-true {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*{instr_1}, instr_2*{instr_2})], [BLOCK_admininstr(bt, instr_1*{instr_1})])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:47.1-49.14
+  rule if-false {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) IF_admininstr(bt, instr_1*{instr_1}, instr_2*{instr_2})], [BLOCK_admininstr(bt, instr_2*{instr_2})])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:52.1-53.38
+  rule label-vals {instr* : instr*, n : n, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr*{instr}, $admininstr_val(val)*{val})], $admininstr_val(val)*{val})
+
+  ;; 6-reduction.watsup:57.1-58.69
+  rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, $admininstr_val(val')*{val'} :: $admininstr_val(val)^n{val} :: [BR_admininstr(0)] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)^n{val} :: $admininstr_instr(instr')*{instr'})
+
+  ;; 6-reduction.watsup:60.1-61.65
+  rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, $admininstr_val(val)*{val} :: [BR_admininstr(l + 1)] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)*{val} :: [BR_admininstr(l)])
+
+  ;; 6-reduction.watsup:64.1-66.16
+  rule br_if-true {c : c_numtype, l : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)], [BR_admininstr(l)])
+    -- if (c =/= 0)
+
+  ;; 6-reduction.watsup:68.1-70.14
+  rule br_if-false {c : c_numtype, l : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, c) BR_IF_admininstr(l)], [])
+    -- if (c = 0)
+
+  ;; 6-reduction.watsup:73.1-75.17
+  rule br_table-lt {i : nat, l* : labelidx*, l' : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')], [BR_admininstr(l*{l}[i])])
+    -- if (i < |l*{l}|)
+
+  ;; 6-reduction.watsup:77.1-79.18
+  rule br_table-ge {i : nat, l* : labelidx*, l' : labelidx}:
+    `%*~>%*`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')], [BR_admininstr(l')])
+    -- if (i >= |l*{l}|)
+
+  ;; 6-reduction.watsup:101.1-102.35
+  rule frame-vals {f : frame, n : n, val^n : val^n}:
+    `%*~>%*`([FRAME__admininstr(n, f, $admininstr_val(val)^n{val})], $admininstr_val(val)^n{val})
+
+  ;; 6-reduction.watsup:104.1-105.55
+  rule return-frame {f : frame, instr* : instr*, n : n, val^n : val^n, val'* : val*}:
+    `%*~>%*`([FRAME__admininstr(n, f, $admininstr_val(val')*{val'} :: $admininstr_val(val)^n{val} :: [RETURN_admininstr] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)^n{val})
+
+  ;; 6-reduction.watsup:107.1-108.60
+  rule return-label {instr* : instr*, instr'* : instr*, k : nat, val* : val*}:
+    `%*~>%*`([LABEL__admininstr(k, instr'*{instr'}, $admininstr_val(val)*{val} :: [RETURN_admininstr] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)*{val} :: [RETURN_admininstr])
+
+  ;; 6-reduction.watsup:111.1-113.33
+  rule unop-val {c : c_numtype, c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)], [CONST_admininstr(nt, c)])
+    -- if ($unop(unop, nt, c_1) = [c])
+
+  ;; 6-reduction.watsup:115.1-117.39
+  rule unop-trap {c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)], [TRAP_admininstr])
+    -- if ($unop(unop, nt, c_1) = [])
+
+  ;; 6-reduction.watsup:120.1-122.40
+  rule binop-val {binop : binop_numtype, c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)], [CONST_admininstr(nt, c)])
+    -- if ($binop(binop, nt, c_1, c_2) = [c])
+
+  ;; 6-reduction.watsup:124.1-126.46
+  rule binop-trap {binop : binop_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)], [TRAP_admininstr])
+    -- if ($binop(binop, nt, c_1, c_2) = [])
+
+  ;; 6-reduction.watsup:129.1-131.37
+  rule testop {c : c_numtype, c_1 : c_numtype, nt : numtype, testop : testop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) TESTOP_admininstr(nt, testop)], [CONST_admininstr(I32_numtype, c)])
+    -- if (c = $testop(testop, nt, c_1))
+
+  ;; 6-reduction.watsup:133.1-135.40
+  rule relop {c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype, relop : relop_numtype}:
+    `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) RELOP_admininstr(nt, relop)], [CONST_admininstr(I32_numtype, c)])
+    -- if (c = $relop(relop, nt, c_1, c_2))
+
+  ;; 6-reduction.watsup:138.1-139.70
+  rule extend {c : c_numtype, n : n, nt : numtype, o0 : nat}:
+    `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, o0, S_sx, c))])
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+
+  ;; 6-reduction.watsup:142.1-144.48
+  rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
+    `%*~>%*`([CONST_admininstr(nt_1, c_1) CVTOP_admininstr(nt_2, cvtop, nt_1, sx?{sx})], [CONST_admininstr(nt_2, c)])
+    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [c])
+
+  ;; 6-reduction.watsup:146.1-148.54
+  rule cvtop-trap {c_1 : c_numtype, cvtop : cvtop, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
+    `%*~>%*`([CONST_admininstr(nt_1, c_1) CVTOP_admininstr(nt_2, cvtop, nt_1, sx?{sx})], [TRAP_admininstr])
+    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [])
+
+  ;; 6-reduction.watsup:155.1-157.28
+  rule ref.is_null-true {rt : reftype, val : val}:
+    `%*~>%*`([$admininstr_val(val) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
+    -- if (val = REF.NULL_val(rt))
+
+  ;; 6-reduction.watsup:159.1-161.15
+  rule ref.is_null-false {val : val}:
+    `%*~>%*`([$admininstr_val(val) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:170.1-171.47
+  rule local.tee {val : val, x : idx}:
+    `%*~>%*`([$admininstr_val(val) LOCAL.TEE_admininstr(x)], [$admininstr_val(val) $admininstr_val(val) LOCAL.SET_admininstr(x)])
+
+;; 6-reduction.watsup:5.1-5.63
+relation Step_read: `%~>%*`(config, admininstr*)
+  ;; 6-reduction.watsup:82.1-83.47
+  rule call {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CALL_admininstr(x)]), [CALL_ADDR_admininstr($funcaddr(z)[x])])
+
+  ;; 6-reduction.watsup:85.1-89.17
+  rule call_indirect-call {a : addr, ft : functype, ft' : functype, i : nat, instr* : instr*, m : moduleinst, t* : valtype*, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [CALL_ADDR_admininstr(a)])
+    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(ft', t*{t}, instr*{instr})))
+    -- if (ft = ft')
+
+  ;; 6-reduction.watsup:91.1-93.15
+  rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [TRAP_admininstr])
+    -- otherwise
+
+  ;; 6-reduction.watsup:95.1-98.52
+  rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state, o0* : val*}:
+    `%~>%*`(`%;%*`(z, $admininstr_val(val)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], $admininstr_instr(instr)*{instr})])])
+    -- (if ($default_(t) = ?(o0)))*{t o0}
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
+    -- if (f = {LOCAL val^k{val} :: o0*{o0}, MODULE m})
+
+  ;; 6-reduction.watsup:151.1-152.53
+  rule ref.func {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [REF.FUNC_admininstr(x)]), [REF.FUNC_ADDR_admininstr($funcaddr(z)[x])])
+
+  ;; 6-reduction.watsup:164.1-165.37
+  rule local.get {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [LOCAL.GET_admininstr(x)]), [$admininstr_val($local(z, x))])
+
+  ;; 6-reduction.watsup:174.1-175.39
+  rule global.get {x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]), [$admininstr_globalinst($global(z, x))])
+
+  ;; 6-reduction.watsup:181.1-183.28
+  rule table.get-trap {i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:185.1-187.27
+  rule table.get-val {i : nat, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [$admininstr_ref($table(z, x)[i])])
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:198.1-200.27
+  rule table.size {n : n, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]), [CONST_admininstr(I32_numtype, n)])
+    -- if (|$table(z, x)| = n)
+
+  ;; 6-reduction.watsup:210.1-212.34
+  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
+    -- if ((i + n) > |$table(z, x)|)
+
+  ;; 6-reduction.watsup:214.1-217.14
+  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:219.1-223.15
+  rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) $admininstr_val(val) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) $admininstr_val(val) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:226.1-228.63
+  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [TRAP_admininstr])
+    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:230.1-233.14
+  rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:235.1-240.15
+  rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
+    -- otherwise
+    -- if (j <= i)
+
+  ;; 6-reduction.watsup:242.1-246.15
+  rule table.copy-gt {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, ((j + n) - 1)) CONST_admininstr(I32_numtype, ((i + n) - 1)) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:249.1-251.62
+  rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [TRAP_admininstr])
+    -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+  ;; 6-reduction.watsup:253.1-256.14
+  rule table.init-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:258.1-262.15
+  rule table.init-succ {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) $admininstr_ref($elem(z, y)[i]) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
+    -- otherwise
+
+  ;; 6-reduction.watsup:269.1-271.48
+  rule load-num-trap {i : nat, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) LOAD_admininstr(nt, ?(), n_A, n_O)]), [TRAP_admininstr])
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- if (((i + n_O) + (o0 / 8)) > |$mem(z, 0)|)
+
+  ;; 6-reduction.watsup:273.1-275.66
+  rule load-num-val {c : c_numtype, i : nat, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat, o1 : nat}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) LOAD_admininstr(nt, ?(), n_A, n_O)]), [CONST_admininstr(nt, c)])
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- if ($size($valtype_numtype(nt)) = ?(o1))
+    -- if ($bytes_(o0, c) = $mem(z, 0)[(i + n_O) : (o1 / 8)])
+
+  ;; 6-reduction.watsup:277.1-279.40
+  rule load-pack-trap {i : nat, n : n, n_A : n, n_O : n, nt : numtype, sx : sx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) LOAD_admininstr(nt, ?((n, sx)), n_A, n_O)]), [TRAP_admininstr])
+    -- if (((i + n_O) + (n / 8)) > |$mem(z, 0)|)
+
+  ;; 6-reduction.watsup:281.1-283.50
+  rule load-pack-val {c : c_numtype, i : nat, n : n, n_A : n, n_O : n, nt : numtype, sx : sx, z : state, o0 : nat}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) LOAD_admininstr(nt, ?((n, sx)), n_A, n_O)]), [CONST_admininstr(nt, $ext(n, o0, sx, c))])
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- if ($bytes_(n, c) = $mem(z, 0)[(i + n_O) : (n / 8)])
+
+  ;; 6-reduction.watsup:303.1-305.39
+  rule memory.size {n : n, z : state}:
+    `%~>%*`(`%;%*`(z, [MEMORY.SIZE_admininstr]), [CONST_admininstr(I32_numtype, n)])
+    -- if (((n * 64) * $Ki) = |$mem(z, 0)|)
+
+  ;; 6-reduction.watsup:315.1-317.32
+  rule memory.fill-trap {i : nat, n : n, val : val, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]), [TRAP_admininstr])
+    -- if ((i + n) > |$mem(z, 0)|)
+
+  ;; 6-reduction.watsup:319.1-322.14
+  rule memory.fill-zero {i : nat, n : n, val : val, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:324.1-328.15
+  rule memory.fill-succ {i : nat, n : n, val : val, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]), [CONST_admininstr(I32_numtype, i) $admininstr_val(val) STORE_admininstr(I32_numtype, ?(8), 0, 0) CONST_admininstr(I32_numtype, (i + 1)) $admininstr_val(val) CONST_admininstr(I32_numtype, (n - 1)) MEMORY.FILL_admininstr])
+    -- otherwise
+
+  ;; 6-reduction.watsup:331.1-333.59
+  rule memory.copy-trap {i : nat, j : nat, n : n, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]), [TRAP_admininstr])
+    -- if (((i + n) > |$mem(z, 0)|) \/ ((j + n) > |$mem(z, 0)|))
+
+  ;; 6-reduction.watsup:335.1-338.14
+  rule memory.copy-zero {i : nat, j : nat, n : n, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:340.1-345.15
+  rule memory.copy-le {i : nat, j : nat, n : n, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) LOAD_admininstr(I32_numtype, ?((8, U_sx)), 0, 0) STORE_admininstr(I32_numtype, ?(8), 0, 0) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) MEMORY.COPY_admininstr])
+    -- otherwise
+    -- if (j <= i)
+
+  ;; 6-reduction.watsup:347.1-351.15
+  rule memory.copy-gt {i : nat, j : nat, n : n, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]), [CONST_admininstr(I32_numtype, ((j + n) - 1)) CONST_admininstr(I32_numtype, ((i + n) - 1)) LOAD_admininstr(I32_numtype, ?((8, U_sx)), 0, 0) STORE_admininstr(I32_numtype, ?(8), 0, 0) CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, (n - 1)) MEMORY.COPY_admininstr])
+    -- otherwise
+
+  ;; 6-reduction.watsup:354.1-356.60
+  rule memory.init-trap {i : nat, j : nat, n : n, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]), [TRAP_admininstr])
+    -- if (((i + n) > |$data(z, x)|) \/ ((j + n) > |$mem(z, 0)|))
+
+  ;; 6-reduction.watsup:358.1-361.14
+  rule memory.init-zero {i : nat, j : nat, n : n, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]), [])
+    -- otherwise
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:363.1-367.15
+  rule memory.init-succ {i : nat, j : nat, n : n, x : idx, z : state}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, $data(z, x)[i]) STORE_admininstr(I32_numtype, ?(8), 0, 0) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) MEMORY.INIT_admininstr(x)])
+    -- otherwise
+
+;; 6-reduction.watsup:3.1-3.63
+relation Step: `%~>%`(config, config)
+  ;; 6-reduction.watsup:7.1-9.34
+  rule pure {instr* : instr*, instr'* : instr*, z : state}:
+    `%~>%`(`%;%*`(z, $admininstr_instr(instr)*{instr}), `%;%*`(z, $admininstr_instr(instr')*{instr'}))
+    -- Step_pure: `%*~>%*`($admininstr_instr(instr)*{instr}, $admininstr_instr(instr')*{instr'})
+
+  ;; 6-reduction.watsup:11.1-13.37
+  rule read {instr* : instr*, instr'* : instr*, z : state}:
+    `%~>%`(`%;%*`(z, $admininstr_instr(instr)*{instr}), `%;%*`(z, $admininstr_instr(instr')*{instr'}))
+    -- Step_read: `%~>%*`(`%;%*`(z, $admininstr_instr(instr)*{instr}), $admininstr_instr(instr')*{instr'})
+
+  ;; 6-reduction.watsup:167.1-168.60
+  rule local.set {val : val, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [$admininstr_val(val) LOCAL.SET_admininstr(x)]), `%;%*`($with_local(z, x, val), []))
+
+  ;; 6-reduction.watsup:177.1-178.62
+  rule global.set {val : val, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [$admininstr_val(val) GLOBAL.SET_admininstr(x)]), `%;%*`($with_global(z, x, val), []))
+
+  ;; 6-reduction.watsup:189.1-191.28
+  rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_ref(ref) TABLE.GET_admininstr(x)]), `%;%*`(z, [TRAP_admininstr]))
+    -- if (i >= |$table(z, x)|)
+
+  ;; 6-reduction.watsup:193.1-195.27
+  rule table.set-val {i : nat, ref : ref, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_ref(ref) TABLE.GET_admininstr(x)]), `%;%*`($with_table(z, x, i, ref), []))
+    -- if (i < |$table(z, x)|)
+
+  ;; 6-reduction.watsup:203.1-204.102
+  rule table.grow-succeed {n : n, ref : ref, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [$admininstr_ref(ref) CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), `%;%*`($with_tableext(z, x, ref^n{}), [CONST_admininstr(I32_numtype, |$table(z, x)|)]))
+
+  ;; 6-reduction.watsup:206.1-207.64
+  rule table.grow-fail {n : n, ref : ref, x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [$admininstr_ref(ref) CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), `%;%*`(z, [CONST_admininstr(I32_numtype, - 1)]))
+
+  ;; 6-reduction.watsup:265.1-266.59
+  rule elem.drop {x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [ELEM.DROP_admininstr(x)]), `%;%*`($with_elem(z, x, []), []))
+
+  ;; 6-reduction.watsup:286.1-288.48
+  rule store-num-trap {c : c_numtype, i : nat, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat}:
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(nt, c) STORE_admininstr(nt, ?(), n_A, n_O)]), `%;%*`(z, [TRAP_admininstr]))
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- if (((i + n_O) + (o0 / 8)) > |$mem(z, 0)|)
+
+  ;; 6-reduction.watsup:290.1-292.35
+  rule store-num-val {b* : byte*, c : c_numtype, i : nat, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat, o1 : nat}:
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(nt, c) STORE_admininstr(nt, ?(), n_A, n_O)]), `%;%*`($with_mem(z, 0, (i + n_O), (o0 / 8), b*{b}), []))
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- if ($size($valtype_numtype(nt)) = ?(o1))
+    -- if (b*{b} = $bytes_(o1, c))
+
+  ;; 6-reduction.watsup:294.1-296.40
+  rule store-pack-trap {c : c_numtype, i : nat, n : n, n_A : n, n_O : n, nt : numtype, z : state}:
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(nt, c) STORE_admininstr(nt, ?(n), n_A, n_O)]), `%;%*`(z, [TRAP_admininstr]))
+    -- if (((i + n_O) + (n / 8)) > |$mem(z, 0)|)
+
+  ;; 6-reduction.watsup:298.1-300.50
+  rule store-pack-val {b* : byte*, c : c_numtype, i : nat, n : n, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat}:
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(nt, c) STORE_admininstr(nt, ?(n), n_A, n_O)]), `%;%*`($with_mem(z, 0, (i + n_O), (n / 8), b*{b}), []))
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- if (b*{b} = $bytes_(n, $wrap_((o0, n), c)))
+
+  ;; 6-reduction.watsup:308.1-309.117
+  rule memory.grow-succeed {n : n, z : state}:
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) MEMORY.GROW_admininstr]), `%;%*`($with_memext(z, 0, 0^((n * 64) * $Ki){}), [CONST_admininstr(I32_numtype, (|$mem(z, 0)| / (64 * $Ki)))]))
+
+  ;; 6-reduction.watsup:311.1-312.59
+  rule memory.grow-fail {n : n, z : state}:
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) MEMORY.GROW_admininstr]), `%;%*`(z, [CONST_admininstr(I32_numtype, - 1)]))
+
+  ;; 6-reduction.watsup:370.1-371.59
+  rule data.drop {x : idx, z : state}:
+    `%~>%`(`%;%*`(z, [DATA.DROP_admininstr(x)]), `%;%*`($with_data(z, x, []), []))
+
 == IL Validation...
 == Side condition inference
 
@@ -7527,10 +9271,10 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:281.1-283.29
-  rule global.get {C : context, t : valtype, x : idx}:
+  rule global.get {C : context, t : valtype, x : idx, w0 : ()?}:
     `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
     -- if (x < |C.GLOBAL_context|)
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(()?{}, t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(w0, t))
 
   ;; 3-typing.watsup:285.1-287.28
   rule global.set {C : context, t : valtype, x : idx}:
@@ -7732,10 +9476,10 @@ relation Func_ok: `%|-%:%`(context, func, functype)
 ;; 3-typing.watsup:398.1-398.75
 relation Global_ok: `%|-%:%`(context, global, globaltype)
   ;; 3-typing.watsup:414.1-418.40
-  rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
+  rule _ {C : context, expr : expr, gt : globaltype, t : valtype, w0 : ()?}:
     `%|-%:%`(C, GLOBAL(gt, expr), gt)
     -- Globaltype_ok: `|-%:OK`(gt)
-    -- if (gt = `MUT%?%`(()?{}, t))
+    -- if (gt = `MUT%?%`(w0, t))
     -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
 
 ;; 3-typing.watsup:399.1-399.74
@@ -9330,10 +11074,10 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:281.1-283.29
-  rule global.get {C : context, t : valtype, x : idx}:
+  rule global.get {C : context, t : valtype, x : idx, w0 : ()?}:
     `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
     -- if (x < |C.GLOBAL_context|)
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(()?{}, t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(w0, t))
 
   ;; 3-typing.watsup:285.1-287.28
   rule global.set {C : context, t : valtype, x : idx}:
@@ -9535,10 +11279,10 @@ relation Func_ok: `%|-%:%`(context, func, functype)
 ;; 3-typing.watsup:398.1-398.75
 relation Global_ok: `%|-%:%`(context, global, globaltype)
   ;; 3-typing.watsup:414.1-418.40
-  rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
+  rule _ {C : context, expr : expr, gt : globaltype, t : valtype, w0 : ()?}:
     `%|-%:%`(C, GLOBAL(gt, expr), gt)
     -- Globaltype_ok: `|-%:OK`(gt)
-    -- if (gt = `MUT%?%`(()?{}, t))
+    -- if (gt = `MUT%?%`(w0, t))
     -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
 
 ;; 3-typing.watsup:399.1-399.74

From 447dd0aea9b9b3560b296d07e96df32a43edfe11 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Fri, 9 Jun 2023 10:13:14 +0200
Subject: [PATCH 94/98] Promote output

---
 spectec/test-frontend/TEST.md   |   14 +-
 spectec/test-haskell/SpecTec.hs |   40 +-
 spectec/test-lean4/SpecTec.lean |  127 ++--
 spectec/test-middlend/TEST.md   | 1216 ++++++++++++++++++-------------
 4 files changed, 778 insertions(+), 619 deletions(-)

diff --git a/spectec/test-frontend/TEST.md b/spectec/test-frontend/TEST.md
index 5a4ac1af54..00fcac1596 100644
--- a/spectec/test-frontend/TEST.md
+++ b/spectec/test-frontend/TEST.md
@@ -1193,23 +1193,13 @@ def with_memext : (state, tableidx, byte*) -> state
 
 ;; 4-runtime.watsup:131.1-131.77
 def with_elem : (state, elemidx, ref*) -> state
-<<<<<<< HEAD
-  ;; 4-runtime.watsup:140.1-140.69
-  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
-=======
-  ;; 4-runtime.watsup:139.1-139.67
+  ;; 4-runtime.watsup:140.1-140.67
   def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]] = r*{r}], f)
->>>>>>> @{-1}
 
 ;; 4-runtime.watsup:132.1-132.77
 def with_data : (state, dataidx, byte*) -> state
-<<<<<<< HEAD
-  ;; 4-runtime.watsup:141.1-141.65
-  def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
-=======
-  ;; 4-runtime.watsup:140.1-140.67
+  ;; 4-runtime.watsup:141.1-141.67
   def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[DATA_store[f.MODULE_frame.DATA_moduleinst[x]] = b*{b}], f)
->>>>>>> @{-1}
 
 ;; 4-runtime.watsup:155.1-158.21
 rec {
diff --git a/spectec/test-haskell/SpecTec.hs b/spectec/test-haskell/SpecTec.hs
index 8d49cf0db5..a3735ebf1a 100644
--- a/spectec/test-haskell/SpecTec.hs
+++ b/spectec/test-haskell/SpecTec.hs
@@ -754,7 +754,7 @@ data Admininstr
  | Admininstr_TRAP
 
 admininstr_globalinst :: Globalinst -> Admininstr
-admininstr_globalinst (Val_CONST x) = (Admininstr_CONST x)
+admininstr_globalinst (Val_CONST (x0, x1)) = (Admininstr_CONST (x0, x1))
 admininstr_globalinst (Val_REF_NULL x) = (Admininstr_REF_NULL x)
 admininstr_globalinst (Val_REF_FUNC_ADDR x) = (Admininstr_REF_FUNC_ADDR x)
 admininstr_globalinst (Val_REF_HOST_ADDR x) = (Admininstr_REF_HOST_ADDR x)
@@ -764,22 +764,22 @@ admininstr_instr Instr_UNREACHABLE = Admininstr_UNREACHABLE
 admininstr_instr Instr_NOP = Admininstr_NOP
 admininstr_instr Instr_DROP = Admininstr_DROP
 admininstr_instr (Instr_SELECT x) = (Admininstr_SELECT x)
-admininstr_instr (Instr_BLOCK x) = (Admininstr_BLOCK x)
-admininstr_instr (Instr_LOOP x) = (Admininstr_LOOP x)
-admininstr_instr (Instr_IF x) = (Admininstr_IF x)
+admininstr_instr (Instr_BLOCK (x0, x1)) = (Admininstr_BLOCK (x0, x1))
+admininstr_instr (Instr_LOOP (x0, x1)) = (Admininstr_LOOP (x0, x1))
+admininstr_instr (Instr_IF (x0, x1, x2)) = (Admininstr_IF (x0, x1, x2))
 admininstr_instr (Instr_BR x) = (Admininstr_BR x)
 admininstr_instr (Instr_BR_IF x) = (Admininstr_BR_IF x)
-admininstr_instr (Instr_BR_TABLE x) = (Admininstr_BR_TABLE x)
+admininstr_instr (Instr_BR_TABLE (x0, x1)) = (Admininstr_BR_TABLE (x0, x1))
 admininstr_instr (Instr_CALL x) = (Admininstr_CALL x)
-admininstr_instr (Instr_CALL_INDIRECT x) = (Admininstr_CALL_INDIRECT x)
+admininstr_instr (Instr_CALL_INDIRECT (x0, x1)) = (Admininstr_CALL_INDIRECT (x0, x1))
 admininstr_instr Instr_RETURN = Admininstr_RETURN
-admininstr_instr (Instr_CONST x) = (Admininstr_CONST x)
-admininstr_instr (Instr_UNOP x) = (Admininstr_UNOP x)
-admininstr_instr (Instr_BINOP x) = (Admininstr_BINOP x)
-admininstr_instr (Instr_TESTOP x) = (Admininstr_TESTOP x)
-admininstr_instr (Instr_RELOP x) = (Admininstr_RELOP x)
-admininstr_instr (Instr_EXTEND x) = (Admininstr_EXTEND x)
-admininstr_instr (Instr_CVTOP x) = (Admininstr_CVTOP x)
+admininstr_instr (Instr_CONST (x0, x1)) = (Admininstr_CONST (x0, x1))
+admininstr_instr (Instr_UNOP (x0, x1)) = (Admininstr_UNOP (x0, x1))
+admininstr_instr (Instr_BINOP (x0, x1)) = (Admininstr_BINOP (x0, x1))
+admininstr_instr (Instr_TESTOP (x0, x1)) = (Admininstr_TESTOP (x0, x1))
+admininstr_instr (Instr_RELOP (x0, x1)) = (Admininstr_RELOP (x0, x1))
+admininstr_instr (Instr_EXTEND (x0, x1)) = (Admininstr_EXTEND (x0, x1))
+admininstr_instr (Instr_CVTOP (x0, x1, x2, x3)) = (Admininstr_CVTOP (x0, x1, x2, x3))
 admininstr_instr (Instr_REF_NULL x) = (Admininstr_REF_NULL x)
 admininstr_instr (Instr_REF_FUNC x) = (Admininstr_REF_FUNC x)
 admininstr_instr Instr_REF_IS_NULL = Admininstr_REF_IS_NULL
@@ -793,8 +793,8 @@ admininstr_instr (Instr_TABLE_SET x) = (Admininstr_TABLE_SET x)
 admininstr_instr (Instr_TABLE_SIZE x) = (Admininstr_TABLE_SIZE x)
 admininstr_instr (Instr_TABLE_GROW x) = (Admininstr_TABLE_GROW x)
 admininstr_instr (Instr_TABLE_FILL x) = (Admininstr_TABLE_FILL x)
-admininstr_instr (Instr_TABLE_COPY x) = (Admininstr_TABLE_COPY x)
-admininstr_instr (Instr_TABLE_INIT x) = (Admininstr_TABLE_INIT x)
+admininstr_instr (Instr_TABLE_COPY (x0, x1)) = (Admininstr_TABLE_COPY (x0, x1))
+admininstr_instr (Instr_TABLE_INIT (x0, x1)) = (Admininstr_TABLE_INIT (x0, x1))
 admininstr_instr (Instr_ELEM_DROP x) = (Admininstr_ELEM_DROP x)
 admininstr_instr Instr_MEMORY_SIZE = Admininstr_MEMORY_SIZE
 admininstr_instr Instr_MEMORY_GROW = Admininstr_MEMORY_GROW
@@ -802,8 +802,8 @@ admininstr_instr Instr_MEMORY_FILL = Admininstr_MEMORY_FILL
 admininstr_instr Instr_MEMORY_COPY = Admininstr_MEMORY_COPY
 admininstr_instr (Instr_MEMORY_INIT x) = (Admininstr_MEMORY_INIT x)
 admininstr_instr (Instr_DATA_DROP x) = (Admininstr_DATA_DROP x)
-admininstr_instr (Instr_LOAD x) = (Admininstr_LOAD x)
-admininstr_instr (Instr_STORE x) = (Admininstr_STORE x)
+admininstr_instr (Instr_LOAD (x0, x1, x2, x3)) = (Admininstr_LOAD (x0, x1, x2, x3))
+admininstr_instr (Instr_STORE (x0, x1, x2, x3)) = (Admininstr_STORE (x0, x1, x2, x3))
 
 admininstr_ref :: Ref -> Admininstr
 admininstr_ref (Ref_REF_NULL x) = (Admininstr_REF_NULL x)
@@ -811,7 +811,7 @@ admininstr_ref (Ref_REF_FUNC_ADDR x) = (Admininstr_REF_FUNC_ADDR x)
 admininstr_ref (Ref_REF_HOST_ADDR x) = (Admininstr_REF_HOST_ADDR x)
 
 admininstr_val :: Val -> Admininstr
-admininstr_val (Val_CONST x) = (Admininstr_CONST x)
+admininstr_val (Val_CONST (x0, x1)) = (Admininstr_CONST (x0, x1))
 admininstr_val (Val_REF_NULL x) = (Admininstr_REF_NULL x)
 admininstr_val (Val_REF_FUNC_ADDR x) = (Admininstr_REF_FUNC_ADDR x)
 admininstr_val (Val_REF_HOST_ADDR x) = (Admininstr_REF_HOST_ADDR x)
@@ -896,12 +896,12 @@ with_memext ((s, f), x, b) = (undefined {- s[MEM_store[f.MODULE_frame.MEM_module
 
 
 with_elem :: (State, Elemidx, [Ref]) -> State
-with_elem ((s, f), x, r) = (undefined {- s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}] -}, f)
+with_elem ((s, f), x, r) = (undefined {- s[ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]] = r*{r}] -}, f)
 
 
 
 with_data :: (State, Dataidx, [Byte]) -> State
-with_data ((s, f), x, b) = (undefined {- s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}] -}, f)
+with_data ((s, f), x, b) = (undefined {- s[DATA_store[f.MODULE_frame.DATA_moduleinst[x]] = b*{b}] -}, f)
 
 
 
diff --git a/spectec/test-lean4/SpecTec.lean b/spectec/test-lean4/SpecTec.lean
index a98cd4a307..2b4e8fc463 100644
--- a/spectec/test-lean4/SpecTec.lean
+++ b/spectec/test-lean4/SpecTec.lean
@@ -810,11 +810,11 @@ inductive InstrSeq_ok : (Context × (List Instr) × Functype) -> Prop where
     (Instr_ok (C, instr_1, (t_1, t_2))) -> 
     (InstrSeq_ok (C, [instr_2], (t_2, t_3))) -> 
     (InstrSeq_ok (C, ([instr_1] ++ [instr_2]), (t_1, t_3)))
-  | weak (C : Context) (instr : (List Instr)) (t'_1 : Valtype) (t'_2 : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
+  | weak (C : Context) (instr : (List Instr)) (t'_1 : (List Valtype)) (t'_2 : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
     (InstrSeq_ok (C, instr, (t_1, t_2))) -> 
-    (Resulttype_sub ([t'_1], t_1)) -> 
+    (Resulttype_sub (t'_1, t_1)) -> 
     (Resulttype_sub (t_2, t'_2)) -> 
-    (InstrSeq_ok (C, instr, ([t'_1], t'_2)))
+    (InstrSeq_ok (C, instr, (t'_1, t'_2)))
   | frame (C : Context) (instr : (List Instr)) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) : 
     (InstrSeq_ok (C, instr, (t_1, t_2))) -> 
     (InstrSeq_ok (C, instr, ((t ++ t_1), (t ++ t_2))))end
@@ -977,7 +977,6 @@ inductive Module_ok : Module -> Prop where
     (table.length == tt.length) -> 
     (mem.length == mt.length) -> 
     (elem.length == rt.length) -> 
-    (data.length == n) -> 
     (C == {FUNC := ft, GLOBAL := gt, TABLE := tt, MEM := mt, ELEM := rt, DATA := [()], LOCAL := [], LABEL := [], RETURN := none}) -> 
     (Forall₂ (λ ft func ↦ (Func_ok (C, func, ft))) ft func) -> 
     (Forall₂ (λ «global» gt ↦ (Global_ok (C, «global», gt))) «global» gt) -> 
@@ -1218,7 +1217,7 @@ inductive Admininstr where
   deriving Inhabited, BEq
 
 def «$admininstr_globalinst» : Globalinst -> Admininstr
-  | (Val.CONST x) => (Admininstr.CONST x)
+  | (Val.CONST (x0, x1)) => (Admininstr.CONST (x0, x1))
   | (Val.REF_NULL x) => (Admininstr.REF_NULL x)
   | (Val.REF_FUNC_ADDR x) => (Admininstr.REF_FUNC_ADDR x)
   | (Val.REF_HOST_ADDR x) => (Admininstr.REF_HOST_ADDR x)
@@ -1228,22 +1227,22 @@ def «$admininstr_instr» : Instr -> Admininstr
   | Instr.NOP => Admininstr.NOP
   | Instr.DROP => Admininstr.DROP
   | (Instr.SELECT x) => (Admininstr.SELECT x)
-  | (Instr.BLOCK x) => (Admininstr.BLOCK x)
-  | (Instr.LOOP x) => (Admininstr.LOOP x)
-  | (Instr.IF x) => (Admininstr.IF x)
+  | (Instr.BLOCK (x0, x1)) => (Admininstr.BLOCK (x0, x1))
+  | (Instr.LOOP (x0, x1)) => (Admininstr.LOOP (x0, x1))
+  | (Instr.IF (x0, x1, x2)) => (Admininstr.IF (x0, x1, x2))
   | (Instr.BR x) => (Admininstr.BR x)
   | (Instr.BR_IF x) => (Admininstr.BR_IF x)
-  | (Instr.BR_TABLE x) => (Admininstr.BR_TABLE x)
+  | (Instr.BR_TABLE (x0, x1)) => (Admininstr.BR_TABLE (x0, x1))
   | (Instr.CALL x) => (Admininstr.CALL x)
-  | (Instr.CALL_INDIRECT x) => (Admininstr.CALL_INDIRECT x)
+  | (Instr.CALL_INDIRECT (x0, x1)) => (Admininstr.CALL_INDIRECT (x0, x1))
   | Instr.RETURN => Admininstr.RETURN
-  | (Instr.CONST x) => (Admininstr.CONST x)
-  | (Instr.UNOP x) => (Admininstr.UNOP x)
-  | (Instr.BINOP x) => (Admininstr.BINOP x)
-  | (Instr.TESTOP x) => (Admininstr.TESTOP x)
-  | (Instr.RELOP x) => (Admininstr.RELOP x)
-  | (Instr.EXTEND x) => (Admininstr.EXTEND x)
-  | (Instr.CVTOP x) => (Admininstr.CVTOP x)
+  | (Instr.CONST (x0, x1)) => (Admininstr.CONST (x0, x1))
+  | (Instr.UNOP (x0, x1)) => (Admininstr.UNOP (x0, x1))
+  | (Instr.BINOP (x0, x1)) => (Admininstr.BINOP (x0, x1))
+  | (Instr.TESTOP (x0, x1)) => (Admininstr.TESTOP (x0, x1))
+  | (Instr.RELOP (x0, x1)) => (Admininstr.RELOP (x0, x1))
+  | (Instr.EXTEND (x0, x1)) => (Admininstr.EXTEND (x0, x1))
+  | (Instr.CVTOP (x0, x1, x2, x3)) => (Admininstr.CVTOP (x0, x1, x2, x3))
   | (Instr.REF_NULL x) => (Admininstr.REF_NULL x)
   | (Instr.REF_FUNC x) => (Admininstr.REF_FUNC x)
   | Instr.REF_IS_NULL => Admininstr.REF_IS_NULL
@@ -1257,8 +1256,8 @@ def «$admininstr_instr» : Instr -> Admininstr
   | (Instr.TABLE_SIZE x) => (Admininstr.TABLE_SIZE x)
   | (Instr.TABLE_GROW x) => (Admininstr.TABLE_GROW x)
   | (Instr.TABLE_FILL x) => (Admininstr.TABLE_FILL x)
-  | (Instr.TABLE_COPY x) => (Admininstr.TABLE_COPY x)
-  | (Instr.TABLE_INIT x) => (Admininstr.TABLE_INIT x)
+  | (Instr.TABLE_COPY (x0, x1)) => (Admininstr.TABLE_COPY (x0, x1))
+  | (Instr.TABLE_INIT (x0, x1)) => (Admininstr.TABLE_INIT (x0, x1))
   | (Instr.ELEM_DROP x) => (Admininstr.ELEM_DROP x)
   | Instr.MEMORY_SIZE => Admininstr.MEMORY_SIZE
   | Instr.MEMORY_GROW => Admininstr.MEMORY_GROW
@@ -1266,8 +1265,8 @@ def «$admininstr_instr» : Instr -> Admininstr
   | Instr.MEMORY_COPY => Admininstr.MEMORY_COPY
   | (Instr.MEMORY_INIT x) => (Admininstr.MEMORY_INIT x)
   | (Instr.DATA_DROP x) => (Admininstr.DATA_DROP x)
-  | (Instr.LOAD x) => (Admininstr.LOAD x)
-  | (Instr.STORE x) => (Admininstr.STORE x)
+  | (Instr.LOAD (x0, x1, x2, x3)) => (Admininstr.LOAD (x0, x1, x2, x3))
+  | (Instr.STORE (x0, x1, x2, x3)) => (Admininstr.STORE (x0, x1, x2, x3))
 
 def «$admininstr_ref» : Ref -> Admininstr
   | (Ref.REF_NULL x) => (Admininstr.REF_NULL x)
@@ -1275,7 +1274,7 @@ def «$admininstr_ref» : Ref -> Admininstr
   | (Ref.REF_HOST_ADDR x) => (Admininstr.REF_HOST_ADDR x)
 
 def «$admininstr_val» : Val -> Admininstr
-  | (Val.CONST x) => (Admininstr.CONST x)
+  | (Val.CONST (x0, x1)) => (Admininstr.CONST (x0, x1))
   | (Val.REF_NULL x) => (Admininstr.REF_NULL x)
   | (Val.REF_FUNC_ADDR x) => (Admininstr.REF_FUNC_ADDR x)
   | (Val.REF_HOST_ADDR x) => (Admininstr.REF_HOST_ADDR x)
@@ -1360,12 +1359,12 @@ def «$with_memext» : (State × Tableidx × (List Byte)) -> State
 
 
 def «$with_elem» : (State × Elemidx × (List Ref)) -> State
-  | ((s, f), x, r) => ({s with TABLE := (s.TABLE.upd (f.MODULE.TABLE.get! x) r) }, f)
+  | ((s, f), x, r) => ({s with ELEM := (s.ELEM.upd (f.MODULE.ELEM.get! x) r) }, f)
 
 
 
 def «$with_data» : (State × Dataidx × (List Byte)) -> State
-  | ((s, f), x, b) => ({s with MEM := (s.MEM.upd (f.MODULE.MEM.get! x) b) }, f)
+  | ((s, f), x, b) => ({s with DATA := (s.DATA.upd (f.MODULE.DATA.get! x) b) }, f)
 
 
 
@@ -1426,17 +1425,11 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (c == 0) -> 
     (Step_pure ([(«$admininstr_val» val_1), («$admininstr_val» val_2), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.SELECT t)], [(«$admininstr_val» val_2)]))
   | block (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) : 
-    (t_1.length == k) -> 
-    (t_2.length == n) -> 
-    (val.length == k) -> 
     (bt == (t_1, t_2)) -> 
     (Step_pure (((List.map «$admininstr_val» val) ++ [(Admininstr.BLOCK (bt, instr))]), [(Admininstr.LABEL_ (n, [], ((List.map «$admininstr_val» val) ++ (List.map «$admininstr_instr» instr))))]))
   | loop (bt : Blocktype) (instr : (List Instr)) (k : Nat) (n : N) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) : 
-    (t_1.length == k) -> 
-    (t_2.length == n) -> 
-    (val.length == k) -> 
     (bt == (t_1, t_2)) -> 
-    (Step_pure (((List.map «$admininstr_val» val) ++ [(Admininstr.LOOP (bt, instr))]), [(Admininstr.LABEL_ (n, [(Instr.LOOP (bt, instr))], ((List.map «$admininstr_val» val) ++ (List.map «$admininstr_instr» instr))))]))
+    (Step_pure (((List.map «$admininstr_val» val) ++ [(Admininstr.LOOP (bt, instr))]), [(Admininstr.LABEL_ (k, [(Instr.LOOP (bt, instr))], ((List.map «$admininstr_val» val) ++ (List.map «$admininstr_instr» instr))))]))
   | if_true (bt : Blocktype) (c : C_numtype) (instr_1 : (List Instr)) (instr_2 : (List Instr)) : 
     (c != 0) -> 
     (Step_pure ([(Admininstr.CONST (Numtype.I32, c)), (Admininstr.IF (bt, instr_1, instr_2))], [(Admininstr.BLOCK (bt, instr_1))]))
@@ -1446,7 +1439,6 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
   | label_vals (instr : (List Instr)) (n : N) (val : (List Val)) : 
     (Step_pure ([(Admininstr.LABEL_ (n, instr, (List.map «$admininstr_val» val)))], (List.map «$admininstr_val» val)))
   | br_zero (instr : (List Instr)) (instr' : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) : 
-    (val.length == n) -> 
     (Step_pure ([(Admininstr.LABEL_ (n, instr', ((List.map «$admininstr_val» val') ++ ((List.map «$admininstr_val» val) ++ ([(Admininstr.BR 0)] ++ (List.map «$admininstr_instr» instr))))))], ((List.map «$admininstr_val» val) ++ (List.map «$admininstr_instr» instr'))))
   | br_succ (instr : (List Instr)) (instr' : (List Instr)) (l : Labelidx) (n : N) (val : (List Val)) : 
     (Step_pure ([(Admininstr.LABEL_ (n, instr', ((List.map «$admininstr_val» val) ++ ([(Admininstr.BR (l + 1))] ++ (List.map «$admininstr_instr» instr)))))], ((List.map «$admininstr_val» val) ++ [(Admininstr.BR l)])))
@@ -1463,10 +1455,8 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (i >= l.length) -> 
     (Step_pure ([(Admininstr.CONST (Numtype.I32, i)), (Admininstr.BR_TABLE (l, l'))], [(Admininstr.BR l')]))
   | frame_vals (f : Frame) (n : N) (val : (List Val)) : 
-    (val.length == n) -> 
     (Step_pure ([(Admininstr.FRAME_ (n, f, (List.map «$admininstr_val» val)))], (List.map «$admininstr_val» val)))
   | return_frame (f : Frame) (instr : (List Instr)) (n : N) (val : (List Val)) (val' : (List Val)) : 
-    (val.length == n) -> 
     (Step_pure ([(Admininstr.FRAME_ (n, f, ((List.map «$admininstr_val» val') ++ ((List.map «$admininstr_val» val) ++ ([Admininstr.RETURN] ++ (List.map «$admininstr_instr» instr))))))], (List.map «$admininstr_val» val)))
   | return_label (instr : (List Instr)) (instr' : (List Instr)) (k : Nat) (val : (List Val)) : 
     (Step_pure ([(Admininstr.LABEL_ (k, instr', ((List.map «$admininstr_val» val) ++ ([Admininstr.RETURN] ++ (List.map «$admininstr_instr» instr)))))], ((List.map «$admininstr_val» val) ++ [Admininstr.RETURN])))
@@ -1491,12 +1481,12 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
   | extend (c : C_numtype) (n : N) (nt : Numtype) (o0 : Nat) : 
     ((«$size» («$valtype_numtype» nt)) == (some o0)) -> 
     (Step_pure ([(Admininstr.CONST (nt, c)), (Admininstr.EXTEND (nt, n))], [(Admininstr.CONST (nt, («$ext» (n, o0, Sx.S, c))))]))
-  | cvtop_val (c : C_numtype) (c_1 : C_numtype) (cvtop : Cvtop) (nt : Numtype) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) : 
+  | cvtop_val (c : C_numtype) (c_1 : C_numtype) (cvtop : Cvtop) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) : 
     ((«$cvtop» (nt_1, cvtop, nt_2, sx, c_1)) == [c]) -> 
-    (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CVTOP (nt_1, cvtop, nt_2, sx))], [(Admininstr.CONST (nt, c))]))
-  | cvtop_trap (c_1 : C_numtype) (cvtop : Cvtop) (nt : Numtype) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) : 
+    (Step_pure ([(Admininstr.CONST (nt_1, c_1)), (Admininstr.CVTOP (nt_2, cvtop, nt_1, sx))], [(Admininstr.CONST (nt_2, c))]))
+  | cvtop_trap (c_1 : C_numtype) (cvtop : Cvtop) (nt_1 : Numtype) (nt_2 : Numtype) (sx : (Option Sx)) : 
     ((«$cvtop» (nt_1, cvtop, nt_2, sx, c_1)) == []) -> 
-    (Step_pure ([(Admininstr.CONST (nt, c_1)), (Admininstr.CVTOP (nt_1, cvtop, nt_2, sx))], [Admininstr.TRAP]))
+    (Step_pure ([(Admininstr.CONST (nt_1, c_1)), (Admininstr.CVTOP (nt_2, cvtop, nt_1, sx))], [Admininstr.TRAP]))
   | ref_is_null_true (rt : Reftype) (val : Val) : 
     (val == (Val.REF_NULL rt)) -> 
     (Step_pure ([(«$admininstr_val» val), Admininstr.REF_IS_NULL], [(Admininstr.CONST (Numtype.I32, 1))]))
@@ -1507,11 +1497,12 @@ inductive Step_pure : ((List Admininstr) × (List Admininstr)) -> Prop where
     (Step_pure ([(«$admininstr_val» val), (Admininstr.LOCAL_TEE x)], [(«$admininstr_val» val), («$admininstr_val» val), (Admininstr.LOCAL_SET x)]))
 
 inductive Step_read_before_call_indirect_trap : Config -> Prop where
-  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) : 
+  | call_indirect_call (a : Addr) (ft : Functype) (ft' : Functype) (i : Nat) (instr : (List Instr)) (m : Moduleinst) (t : (List Valtype)) (x : Idx) (z : State) : 
     (i < («$table» (z, x)).length) -> 
     (a < («$funcinst» z).length) -> 
     (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) -> 
-    (((«$funcinst» z).get! a) == (m, func)) -> 
+    (((«$funcinst» z).get! a) == (m, (ft', t, instr))) -> 
+    (ft == ft') -> 
     (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))
 
 inductive Step_read_before_table_fill_zero : Config -> Prop where
@@ -1585,7 +1576,7 @@ inductive Step_read_before_memory_fill_succ : Config -> Prop where
 
 inductive Step_read_before_memory_copy_zero : Config -> Prop where
   | memory_copy_trap (i : Nat) (j : Nat) (n : N) (z : State) : 
-    (((i + n) > («$table» (z, 0)).length) || ((j + n) > («$table» (z, 0)).length)) -> 
+    (((i + n) > («$mem» (z, 0)).length) || ((j + n) > («$mem» (z, 0)).length)) -> 
     (Step_read_before_memory_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))
 
 inductive Step_read_before_memory_copy_le : Config -> Prop where
@@ -1594,7 +1585,7 @@ inductive Step_read_before_memory_copy_le : Config -> Prop where
     (n == 0) -> 
     (Step_read_before_memory_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))
   | memory_copy_trap (i : Nat) (j : Nat) (n : N) (z : State) : 
-    (((i + n) > («$table» (z, 0)).length) || ((j + n) > («$table» (z, 0)).length)) -> 
+    (((i + n) > («$mem» (z, 0)).length) || ((j + n) > («$mem» (z, 0)).length)) -> 
     (Step_read_before_memory_copy_le (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))
 
 inductive Step_read_before_memory_copy_gt : Config -> Prop where
@@ -1607,12 +1598,12 @@ inductive Step_read_before_memory_copy_gt : Config -> Prop where
     (n == 0) -> 
     (Step_read_before_memory_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))
   | memory_copy_trap (i : Nat) (j : Nat) (n : N) (z : State) : 
-    (((i + n) > («$table» (z, 0)).length) || ((j + n) > («$table» (z, 0)).length)) -> 
+    (((i + n) > («$mem» (z, 0)).length) || ((j + n) > («$mem» (z, 0)).length)) -> 
     (Step_read_before_memory_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))
 
 inductive Step_read_before_memory_init_zero : Config -> Prop where
-  | memory_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
-    (((i + n) > («$data» (z, y)).length) || ((j + n) > («$mem» (z, 0)).length)) -> 
+  | memory_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (z : State) : 
+    (((i + n) > («$data» (z, x)).length) || ((j + n) > («$mem» (z, 0)).length)) -> 
     (Step_read_before_memory_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.MEMORY_INIT x)]))
 
 inductive Step_read_before_memory_init_succ : Config -> Prop where
@@ -1620,19 +1611,20 @@ inductive Step_read_before_memory_init_succ : Config -> Prop where
     (Not (Step_read_before_memory_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.MEMORY_INIT x)]))) -> 
     (n == 0) -> 
     (Step_read_before_memory_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.MEMORY_INIT x)]))
-  | memory_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
-    (((i + n) > («$data» (z, y)).length) || ((j + n) > («$mem» (z, 0)).length)) -> 
+  | memory_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (z : State) : 
+    (((i + n) > («$data» (z, x)).length) || ((j + n) > («$mem» (z, 0)).length)) -> 
     (Step_read_before_memory_init_succ (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.MEMORY_INIT x)]))
 
 inductive Step_read : (Config × (List Admininstr)) -> Prop where
   | call (x : Idx) (z : State) : 
     (x < («$funcaddr» z).length) -> 
     (Step_read ((z, [(Admininstr.CALL x)]), [(Admininstr.CALL_ADDR ((«$funcaddr» z).get! x))]))
-  | call_indirect_call (a : Addr) (ft : Functype) (func : Func) (i : Nat) (m : Moduleinst) (x : Idx) (z : State) : 
+  | call_indirect_call (a : Addr) (ft : Functype) (ft' : Functype) (i : Nat) (instr : (List Instr)) (m : Moduleinst) (t : (List Valtype)) (x : Idx) (z : State) : 
     (i < («$table» (z, x)).length) -> 
     (a < («$funcinst» z).length) -> 
     (((«$table» (z, x)).get! i) == (Ref.REF_FUNC_ADDR a)) -> 
-    (((«$funcinst» z).get! a) == (m, func)) -> 
+    (((«$funcinst» z).get! a) == (m, (ft', t, instr))) -> 
+    (ft == ft') -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]), [(Admininstr.CALL_ADDR a)]))
   | call_indirect_trap (ft : Functype) (i : Nat) (x : Idx) (z : State) : 
     (Not (Step_read_before_call_indirect_trap (z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CALL_INDIRECT (x, ft))]))) -> 
@@ -1640,9 +1632,6 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
   | call_addr (a : Addr) (f : Frame) (instr : (List Instr)) (k : Nat) (m : Moduleinst) (n : N) (t : (List Valtype)) (t_1 : (List Valtype)) (t_2 : (List Valtype)) (val : (List Val)) (z : State) (o0 : (List Val)) : 
     (t.length == o0.length) -> 
     (a < («$funcinst» z).length) -> 
-    (t_1.length == k) -> 
-    (t_2.length == n) -> 
-    (val.length == k) -> 
     (Forall₂ (λ t o0 ↦ ((«$default_» t) == (some o0))) t o0) -> 
     (((«$funcinst» z).get! a) == (m, ((t_1, t_2), t, instr))) -> 
     (f == {LOCAL := (val ++ o0), MODULE := m}) -> 
@@ -1686,7 +1675,7 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]), [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.TABLE_GET y), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_COPY (x, y))]))
   | table_copy_gt (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
     (Not (Step_read_before_table_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]))) -> 
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]), [(Admininstr.CONST (Numtype.I32, ((j + n) - 1))), (Admininstr.CONST (Numtype.I32, ((i + n) - 1))), (Admininstr.TABLE_GET y), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_COPY (x, y))]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_COPY (x, y))]), [(Admininstr.CONST (Numtype.I32, ((j + n) - 1))), (Admininstr.CONST (Numtype.I32, ((i + n) - 1))), (Admininstr.TABLE_GET y), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_COPY (x, y))]))
   | table_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
     (((i + n) > («$elem» (z, y)).length) || ((j + n) > («$table» (z, x)).length)) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), [Admininstr.TRAP]))
@@ -1700,7 +1689,7 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.TABLE_INIT (x, y))]), [(Admininstr.CONST (Numtype.I32, j)), («$admininstr_ref» ((«$elem» (z, y)).get! i)), (Admininstr.TABLE_SET x), (Admininstr.CONST (Numtype.I32, (j + 1))), (Admininstr.CONST (Numtype.I32, (i + 1))), (Admininstr.CONST (Numtype.I32, (n - 1))), (Admininstr.TABLE_INIT (x, y))]))
   | load_num_trap (i : Nat) (n_A : N) (n_O : N) (nt : Numtype) (z : State) (o0 : Nat) : 
     ((«$size» («$valtype_numtype» nt)) == (some o0)) -> 
-    (((i + n_O) + (((Nat.div o0) 8))) >= («$mem» (z, 0)).length) -> 
+    (((i + n_O) + (((Nat.div o0) 8))) > («$mem» (z, 0)).length) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.LOAD (nt, none, n_A, n_O))]), [Admininstr.TRAP]))
   | load_num_val (c : C_numtype) (i : Nat) (n_A : N) (n_O : N) (nt : Numtype) (z : State) (o0 : Nat) (o1 : Nat) : 
     ((«$size» («$valtype_numtype» nt)) == (some o0)) -> 
@@ -1708,11 +1697,15 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     ((«$bytes_» (o0, c)) == default /- $mem(z, 0)[(i + n_O) : (o1 / 8)] -/) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.LOAD (nt, none, n_A, n_O))]), [(Admininstr.CONST (nt, c))]))
   | load_pack_trap (i : Nat) (n : N) (n_A : N) (n_O : N) (nt : Numtype) (sx : Sx) (z : State) : 
-    (((i + n_O) + (((Nat.div n) 8))) >= («$mem» (z, 0)).length) -> 
+    (((i + n_O) + (((Nat.div n) 8))) > («$mem» (z, 0)).length) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.LOAD (nt, (some (n, sx)), n_A, n_O))]), [Admininstr.TRAP]))
-  | load_pack_val (c : C_numtype) (i : Nat) (n : N) (n_A : N) (n_O : N) (nt : Numtype) (sx : Sx) (z : State) : 
+  | load_pack_val (c : C_numtype) (i : Nat) (n : N) (n_A : N) (n_O : N) (nt : Numtype) (sx : Sx) (z : State) (o0 : Nat) : 
+    ((«$size» («$valtype_numtype» nt)) == (some o0)) -> 
     ((«$bytes_» (n, c)) == default /- $mem(z, 0)[(i + n_O) : (n / 8)] -/) -> 
-    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.LOAD (nt, (some (n, sx)), n_A, n_O))]), [(Admininstr.CONST (nt, c))]))
+    (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.LOAD (nt, (some (n, sx)), n_A, n_O))]), [(Admininstr.CONST (nt, («$ext» (n, o0, sx, c))))]))
+  | memory_size (n : N) (z : State) : 
+    (default /- ((n * 64) * $Ki) -/ == («$mem» (z, 0)).length) -> 
+    (Step_read ((z, [Admininstr.MEMORY_SIZE]), [(Admininstr.CONST (Numtype.I32, n))]))
   | memory_fill_trap (i : Nat) (n : N) (val : Val) (z : State) : 
     ((i + n) > («$mem» (z, 0)).length) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_FILL]), [Admininstr.TRAP]))
@@ -1724,7 +1717,7 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     (Not (Step_read_before_memory_fill_succ (z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_FILL]))) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_FILL]), [(Admininstr.CONST (Numtype.I32, i)), («$admininstr_val» val), (Admininstr.STORE (Numtype.I32, (some 8), 0, 0)), (Admininstr.CONST (Numtype.I32, (i + 1))), («$admininstr_val» val), (Admininstr.CONST (Numtype.I32, (n - 1))), Admininstr.MEMORY_FILL]))
   | memory_copy_trap (i : Nat) (j : Nat) (n : N) (z : State) : 
-    (((i + n) > («$table» (z, 0)).length) || ((j + n) > («$table» (z, 0)).length)) -> 
+    (((i + n) > («$mem» (z, 0)).length) || ((j + n) > («$mem» (z, 0)).length)) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]), [Admininstr.TRAP]))
   | memory_copy_zero (i : Nat) (j : Nat) (n : N) (z : State) : 
     (Not (Step_read_before_memory_copy_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))) -> 
@@ -1737,8 +1730,8 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
   | memory_copy_gt (i : Nat) (j : Nat) (n : N) (z : State) : 
     (Not (Step_read_before_memory_copy_gt (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]))) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_COPY]), [(Admininstr.CONST (Numtype.I32, ((j + n) - 1))), (Admininstr.CONST (Numtype.I32, ((i + n) - 1))), (Admininstr.LOAD (Numtype.I32, (some (8, Sx.U)), 0, 0)), (Admininstr.STORE (Numtype.I32, (some 8), 0, 0)), (Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, (n - 1))), Admininstr.MEMORY_COPY]))
-  | memory_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (y : Idx) (z : State) : 
-    (((i + n) > («$data» (z, y)).length) || ((j + n) > («$mem» (z, 0)).length)) -> 
+  | memory_init_trap (i : Nat) (j : Nat) (n : N) (x : Idx) (z : State) : 
+    (((i + n) > («$data» (z, x)).length) || ((j + n) > («$mem» (z, 0)).length)) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.MEMORY_INIT x)]), [Admininstr.TRAP]))
   | memory_init_zero (i : Nat) (j : Nat) (n : N) (x : Idx) (z : State) : 
     (Not (Step_read_before_memory_init_zero (z, [(Admininstr.CONST (Numtype.I32, j)), (Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, n)), (Admininstr.MEMORY_INIT x)]))) -> 
@@ -1774,22 +1767,22 @@ inductive Step : (Config × Config) -> Prop where
     (Step ((z, [(Admininstr.ELEM_DROP x)]), ((«$with_elem» (z, x, [])), [])))
   | store_num_trap (c : C_numtype) (i : Nat) (n_A : N) (n_O : N) (nt : Numtype) (z : State) (o0 : Nat) : 
     ((«$size» («$valtype_numtype» nt)) == (some o0)) -> 
-    (((i + n_O) + (((Nat.div o0) 8))) >= («$mem» (z, 0)).length) -> 
-    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.STORE (nt, none, n_A, n_O))]), (z, [Admininstr.TRAP])))
+    (((i + n_O) + (((Nat.div o0) 8))) > («$mem» (z, 0)).length) -> 
+    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (nt, c)), (Admininstr.STORE (nt, none, n_A, n_O))]), (z, [Admininstr.TRAP])))
   | store_num_val (b : (List Byte)) (c : C_numtype) (i : Nat) (n_A : N) (n_O : N) (nt : Numtype) (z : State) (o0 : Nat) (o1 : Nat) : 
     ((«$size» («$valtype_numtype» nt)) == (some o0)) -> 
     ((«$size» («$valtype_numtype» nt)) == (some o1)) -> 
     (b == («$bytes_» (o1, c))) -> 
-    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.STORE (nt, none, n_A, n_O))]), ((«$with_mem» (z, 0, (i + n_O), (((Nat.div o0) 8)), b)), [])))
+    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (nt, c)), (Admininstr.STORE (nt, none, n_A, n_O))]), ((«$with_mem» (z, 0, (i + n_O), (((Nat.div o0) 8)), b)), [])))
   | store_pack_trap (c : C_numtype) (i : Nat) (n : N) (n_A : N) (n_O : N) (nt : Numtype) (z : State) : 
-    (((i + n_O) + (((Nat.div n) 8))) >= («$mem» (z, 0)).length) -> 
-    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.STORE (nt, (some n), n_A, n_O))]), (z, [Admininstr.TRAP])))
+    (((i + n_O) + (((Nat.div n) 8))) > («$mem» (z, 0)).length) -> 
+    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (nt, c)), (Admininstr.STORE (nt, (some n), n_A, n_O))]), (z, [Admininstr.TRAP])))
   | store_pack_val (b : (List Byte)) (c : C_numtype) (i : Nat) (n : N) (n_A : N) (n_O : N) (nt : Numtype) (z : State) (o0 : Nat) : 
     ((«$size» («$valtype_numtype» nt)) == (some o0)) -> 
     (b == («$bytes_» (n, («$wrap_» ((o0, n), c))))) -> 
-    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (Numtype.I32, c)), (Admininstr.STORE (nt, (some n), n_A, n_O))]), ((«$with_mem» (z, 0, (i + n_O), (((Nat.div n) 8)), b)), [])))
+    (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (nt, c)), (Admininstr.STORE (nt, (some n), n_A, n_O))]), ((«$with_mem» (z, 0, (i + n_O), (((Nat.div n) 8)), b)), [])))
   | memory_grow_succeed (n : N) (z : State) : 
-    (Step ((z, [(Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_GROW]), ((«$with_memext» (z, 0, [0])), [(Admininstr.CONST (Numtype.I32, («$mem» (z, 0)).length))])))
+    (Step ((z, [(Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_GROW]), ((«$with_memext» (z, 0, [0])), [(Admininstr.CONST (Numtype.I32, (((Nat.div («$mem» (z, 0)).length) default /- (64 * $Ki) -/))))])))
   | memory_grow_fail (n : N) (z : State) : 
     (Step ((z, [(Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_GROW]), (z, [(Admininstr.CONST (Numtype.I32, (0 - 1)))])))
   | data_drop (x : Idx) (z : State) : 
diff --git a/spectec/test-middlend/TEST.md b/spectec/test-middlend/TEST.md
index 92decabbc1..71be2c9d13 100644
--- a/spectec/test-middlend/TEST.md
+++ b/spectec/test-middlend/TEST.md
@@ -1192,23 +1192,13 @@ def with_memext : (state, tableidx, byte*) -> state
 
 ;; 4-runtime.watsup:131.1-131.77
 def with_elem : (state, elemidx, ref*) -> state
-<<<<<<< HEAD
-  ;; 4-runtime.watsup:140.1-140.69
-  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
-=======
-  ;; 4-runtime.watsup:139.1-139.67
+  ;; 4-runtime.watsup:140.1-140.67
   def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]] = r*{r}], f)
->>>>>>> @{-1}
 
 ;; 4-runtime.watsup:132.1-132.77
 def with_data : (state, dataidx, byte*) -> state
-<<<<<<< HEAD
-  ;; 4-runtime.watsup:141.1-141.65
-  def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
-=======
-  ;; 4-runtime.watsup:140.1-140.67
+  ;; 4-runtime.watsup:141.1-141.67
   def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[DATA_store[f.MODULE_frame.DATA_moduleinst[x]] = b*{b}], f)
->>>>>>> @{-1}
 
 ;; 4-runtime.watsup:155.1-158.21
 rec {
@@ -2930,23 +2920,13 @@ def with_memext : (state, tableidx, byte*) -> state
 
 ;; 4-runtime.watsup:131.1-131.77
 def with_elem : (state, elemidx, ref*) -> state
-<<<<<<< HEAD
-  ;; 4-runtime.watsup:140.1-140.69
-  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
-=======
-  ;; 4-runtime.watsup:139.1-139.67
+  ;; 4-runtime.watsup:140.1-140.67
   def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]] = r*{r}], f)
->>>>>>> @{-1}
 
 ;; 4-runtime.watsup:132.1-132.77
 def with_data : (state, dataidx, byte*) -> state
-<<<<<<< HEAD
-  ;; 4-runtime.watsup:141.1-141.65
-  def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
-=======
-  ;; 4-runtime.watsup:140.1-140.67
+  ;; 4-runtime.watsup:141.1-141.67
   def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[DATA_store[f.MODULE_frame.DATA_moduleinst[x]] = b*{b}], f)
->>>>>>> @{-1}
 
 ;; 4-runtime.watsup:155.1-158.21
 rec {
@@ -4670,23 +4650,13 @@ def with_memext : (state, tableidx, byte*) -> state
 
 ;; 4-runtime.watsup:131.1-131.77
 def with_elem : (state, elemidx, ref*) -> state
-<<<<<<< HEAD
-  ;; 4-runtime.watsup:140.1-140.69
-  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
-=======
-  ;; 4-runtime.watsup:139.1-139.67
+  ;; 4-runtime.watsup:140.1-140.67
   def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]] = r*{r}], f)
->>>>>>> @{-1}
 
 ;; 4-runtime.watsup:132.1-132.77
 def with_data : (state, dataidx, byte*) -> state
-<<<<<<< HEAD
-  ;; 4-runtime.watsup:141.1-141.65
-  def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
-=======
-  ;; 4-runtime.watsup:140.1-140.67
+  ;; 4-runtime.watsup:141.1-141.67
   def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[DATA_store[f.MODULE_frame.DATA_moduleinst[x]] = b*{b}], f)
->>>>>>> @{-1}
 
 ;; 4-runtime.watsup:155.1-158.21
 rec {
@@ -6419,23 +6389,13 @@ def with_memext : (state, tableidx, byte*) -> state
 
 ;; 4-runtime.watsup:131.1-131.77
 def with_elem : (state, elemidx, ref*) -> state
-<<<<<<< HEAD
-  ;; 4-runtime.watsup:140.1-140.69
-  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
-=======
-  ;; 4-runtime.watsup:139.1-139.67
+  ;; 4-runtime.watsup:140.1-140.67
   def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]] = r*{r}], f)
->>>>>>> @{-1}
 
 ;; 4-runtime.watsup:132.1-132.77
 def with_data : (state, dataidx, byte*) -> state
-<<<<<<< HEAD
-  ;; 4-runtime.watsup:141.1-141.65
-  def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
-=======
-  ;; 4-runtime.watsup:140.1-140.67
+  ;; 4-runtime.watsup:141.1-141.67
   def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[DATA_store[f.MODULE_frame.DATA_moduleinst[x]] = b*{b}], f)
->>>>>>> @{-1}
 
 ;; 4-runtime.watsup:155.1-158.21
 rec {
@@ -6886,7 +6846,7 @@ relation Step: `%~>%`(config, config)
     `%~>%`(`%;%*`(z, [DATA.DROP_admininstr(x)]), `%;%*`($with_data(z, x, []), []))
 
 == IL Validation...
-== Wildcard elimination
+== Side condition inference
 
 ;; 1-syntax.watsup:3.1-3.15
 syntax n = nat
@@ -6999,43 +6959,46 @@ syntax resulttype = valtype*
 ;; 1-syntax.watsup:59.1-60.16
 syntax limits = `[%..%]`(u32, u32)
 
-;; 1-syntax.watsup:61.1-62.15
-syntax globaltype = `MUT%?%`(()?, valtype)
+;; 1-syntax.watsup:61.1-62.6
+syntax mutflag = MUT
+
+;; 1-syntax.watsup:63.1-64.19
+syntax globaltype = `%?%`(mutflag?, valtype)
 
-;; 1-syntax.watsup:63.1-64.27
+;; 1-syntax.watsup:65.1-66.27
 syntax functype = `%->%`(resulttype, resulttype)
 
-;; 1-syntax.watsup:65.1-66.17
+;; 1-syntax.watsup:67.1-68.17
 syntax tabletype = `%%`(limits, reftype)
 
-;; 1-syntax.watsup:67.1-68.12
+;; 1-syntax.watsup:69.1-70.12
 syntax memtype = `%I8`(limits)
 
-;; 1-syntax.watsup:69.1-70.10
+;; 1-syntax.watsup:71.1-72.10
 syntax elemtype = reftype
 
-;; 1-syntax.watsup:71.1-72.5
+;; 1-syntax.watsup:73.1-74.5
 syntax datatype = OK
 
-;; 1-syntax.watsup:73.1-74.69
+;; 1-syntax.watsup:75.1-76.69
 syntax externtype =
   | GLOBAL(globaltype)
   | FUNC(functype)
   | TABLE(tabletype)
   | MEMORY(memtype)
 
-;; 1-syntax.watsup:86.1-86.44
+;; 1-syntax.watsup:89.1-89.44
 syntax sx =
   | U
   | S
 
-;; 1-syntax.watsup:88.1-88.39
+;; 1-syntax.watsup:91.1-91.39
 syntax unop_IXX =
   | CLZ
   | CTZ
   | POPCNT
 
-;; 1-syntax.watsup:89.1-89.70
+;; 1-syntax.watsup:92.1-92.70
 syntax unop_FXX =
   | ABS
   | NEG
@@ -7045,7 +7008,7 @@ syntax unop_FXX =
   | TRUNC
   | NEAREST
 
-;; 1-syntax.watsup:91.1-93.62
+;; 1-syntax.watsup:94.1-96.62
 syntax binop_IXX =
   | ADD
   | SUB
@@ -7060,7 +7023,7 @@ syntax binop_IXX =
   | ROTL
   | ROTR
 
-;; 1-syntax.watsup:94.1-94.66
+;; 1-syntax.watsup:97.1-97.66
 syntax binop_FXX =
   | ADD
   | SUB
@@ -7070,15 +7033,15 @@ syntax binop_FXX =
   | MAX
   | COPYSIGN
 
-;; 1-syntax.watsup:96.1-96.26
+;; 1-syntax.watsup:99.1-99.26
 syntax testop_IXX =
   | EQZ
 
-;; 1-syntax.watsup:97.1-97.22
+;; 1-syntax.watsup:100.1-100.22
 syntax testop_FXX =
   |
 
-;; 1-syntax.watsup:99.1-100.108
+;; 1-syntax.watsup:102.1-103.108
 syntax relop_IXX =
   | EQ
   | NE
@@ -7087,7 +7050,7 @@ syntax relop_IXX =
   | LE(sx)
   | GE(sx)
 
-;; 1-syntax.watsup:101.1-101.49
+;; 1-syntax.watsup:104.1-104.49
 syntax relop_FXX =
   | EQ
   | NE
@@ -7096,44 +7059,44 @@ syntax relop_FXX =
   | LE
   | GE
 
-;; 1-syntax.watsup:103.1-103.50
+;; 1-syntax.watsup:106.1-106.50
 syntax unop_numtype =
   | _I(unop_IXX)
   | _F(unop_FXX)
 
-;; 1-syntax.watsup:104.1-104.53
+;; 1-syntax.watsup:107.1-107.53
 syntax binop_numtype =
   | _I(binop_IXX)
   | _F(binop_FXX)
 
-;; 1-syntax.watsup:105.1-105.56
+;; 1-syntax.watsup:108.1-108.56
 syntax testop_numtype =
   | _I(testop_IXX)
   | _F(testop_FXX)
 
-;; 1-syntax.watsup:106.1-106.53
+;; 1-syntax.watsup:109.1-109.53
 syntax relop_numtype =
   | _I(relop_IXX)
   | _F(relop_FXX)
 
-;; 1-syntax.watsup:107.1-107.39
+;; 1-syntax.watsup:110.1-110.39
 syntax cvtop =
   | CONVERT
   | REINTERPRET
 
-;; 1-syntax.watsup:117.1-117.23
+;; 1-syntax.watsup:120.1-120.23
 syntax c_numtype = nat
 
-;; 1-syntax.watsup:118.1-118.23
+;; 1-syntax.watsup:121.1-121.23
 syntax c_vectype = nat
 
-;; 1-syntax.watsup:121.1-121.52
+;; 1-syntax.watsup:124.1-124.52
 syntax blocktype = functype
 
-;; 1-syntax.watsup:156.1-177.80
+;; 1-syntax.watsup:159.1-180.80
 rec {
 
-;; 1-syntax.watsup:156.1-177.80
+;; 1-syntax.watsup:159.1-180.80
 syntax instr =
   | UNREACHABLE
   | NOP
@@ -7181,53 +7144,53 @@ syntax instr =
   | STORE(numtype, n?, u32, u32)
 }
 
-;; 1-syntax.watsup:179.1-180.9
+;; 1-syntax.watsup:182.1-183.9
 syntax expr = instr*
 
-;; 1-syntax.watsup:187.1-187.50
+;; 1-syntax.watsup:190.1-190.50
 syntax elemmode =
   | TABLE(tableidx, expr)
   | DECLARE
 
-;; 1-syntax.watsup:188.1-188.39
+;; 1-syntax.watsup:191.1-191.39
 syntax datamode =
   | MEMORY(memidx, expr)
 
-;; 1-syntax.watsup:190.1-191.30
+;; 1-syntax.watsup:193.1-194.30
 syntax func = `FUNC%%*%`(functype, valtype*, expr)
 
-;; 1-syntax.watsup:192.1-193.25
+;; 1-syntax.watsup:195.1-196.25
 syntax global = GLOBAL(globaltype, expr)
 
-;; 1-syntax.watsup:194.1-195.18
+;; 1-syntax.watsup:197.1-198.18
 syntax table = TABLE(tabletype)
 
-;; 1-syntax.watsup:196.1-197.17
+;; 1-syntax.watsup:199.1-200.17
 syntax mem = MEMORY(memtype)
 
-;; 1-syntax.watsup:198.1-199.31
+;; 1-syntax.watsup:201.1-202.31
 syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
 
-;; 1-syntax.watsup:200.1-201.26
+;; 1-syntax.watsup:203.1-204.26
 syntax data = `DATA(*)%*%?`(byte**, datamode?)
 
-;; 1-syntax.watsup:202.1-203.16
+;; 1-syntax.watsup:205.1-206.16
 syntax start = START(funcidx)
 
-;; 1-syntax.watsup:205.1-206.65
+;; 1-syntax.watsup:208.1-209.65
 syntax externuse =
   | FUNC(funcidx)
   | GLOBAL(globalidx)
   | TABLE(tableidx)
   | MEMORY(memidx)
 
-;; 1-syntax.watsup:207.1-208.24
+;; 1-syntax.watsup:210.1-211.24
 syntax export = EXPORT(name, externuse)
 
-;; 1-syntax.watsup:209.1-210.30
+;; 1-syntax.watsup:212.1-213.30
 syntax import = IMPORT(name, name, externtype)
 
-;; 1-syntax.watsup:212.1-213.70
+;; 1-syntax.watsup:215.1-216.70
 syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
 
 ;; 2-aux.watsup:3.1-3.14
@@ -7357,6 +7320,7 @@ relation Resulttype_sub: `|-%*<:%*`(valtype*, valtype*)
   ;; 3-typing.watsup:70.1-72.35
   rule _ {t_1* : valtype*, t_2* : valtype*}:
     `|-%*<:%*`(t_1*{t_1}, t_2*{t_2})
+    -- if (|t_1*{t_1}| = |t_2*{t_2}|)
     -- (Valtype_sub: `|-%<:%`(t_1, t_2))*{t_1 t_2}
 
 ;; 3-typing.watsup:75.1-75.75
@@ -7471,16 +7435,20 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
   ;; 3-typing.watsup:195.1-197.24
   rule br {C : context, l : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, BR_instr(l), `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- if (l < |C.LABEL_context|)
     -- if (C.LABEL_context[l] = t*{t})
 
   ;; 3-typing.watsup:199.1-201.24
   rule br_if {C : context, l : labelidx, t* : valtype*}:
     `%|-%:%`(C, BR_IF_instr(l), `%->%`(t*{t} :: [I32_valtype], t*{t}))
+    -- if (l < |C.LABEL_context|)
     -- if (C.LABEL_context[l] = t*{t})
 
   ;; 3-typing.watsup:203.1-206.42
   rule br_table {C : context, l* : labelidx*, l' : labelidx, t* : valtype*, t_1* : valtype*, t_2* : valtype*}:
     `%|-%:%`(C, BR_TABLE_instr(l*{l}, l'), `%->%`(t_1*{t_1} :: t*{t}, t_2*{t_2}))
+    -- (if (l < |C.LABEL_context|))*{l}
+    -- if (l' < |C.LABEL_context|)
     -- (Resulttype_sub: `|-%*<:%*`(t*{t}, C.LABEL_context[l]))*{l}
     -- Resulttype_sub: `|-%*<:%*`(t*{t}, C.LABEL_context[l'])
 
@@ -7492,11 +7460,13 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
   ;; 3-typing.watsup:212.1-214.33
   rule call {C : context, t_1* : valtype*, t_2* : valtype*, x : idx}:
     `%|-%:%`(C, CALL_instr(x), `%->%`(t_1*{t_1}, t_2*{t_2}))
+    -- if (x < |C.FUNC_context|)
     -- if (C.FUNC_context[x] = `%->%`(t_1*{t_1}, t_2*{t_2}))
 
   ;; 3-typing.watsup:216.1-219.26
   rule call_indirect {C : context, ft : functype, lim : limits, t_1* : valtype*, t_2* : valtype*, x : idx}:
     `%|-%:%`(C, CALL_INDIRECT_instr(x, ft), `%->%`(t_1*{t_1} :: [I32_valtype], t_2*{t_2}))
+    -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, FUNCREF_reftype))
     -- if (ft = `%->%`(t_1*{t_1}, t_2*{t_2}))
 
@@ -7554,6 +7524,7 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
   ;; 3-typing.watsup:260.1-262.23
   rule ref.func {C : context, ft : functype, x : idx}:
     `%|-%:%`(C, REF.FUNC_instr(x), `%->%`([], [FUNCREF_valtype]))
+    -- if (x < |C.FUNC_context|)
     -- if (C.FUNC_context[x] = ft)
 
   ;; 3-typing.watsup:264.1-265.31
@@ -7563,104 +7534,129 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
   ;; 3-typing.watsup:268.1-270.23
   rule local.get {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, LOCAL.GET_instr(x), `%->%`([], [t]))
+    -- if (x < |C.LOCAL_context|)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:272.1-274.23
   rule local.set {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, LOCAL.SET_instr(x), `%->%`([t], []))
+    -- if (x < |C.LOCAL_context|)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:276.1-278.23
   rule local.tee {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, LOCAL.TEE_instr(x), `%->%`([t], [t]))
+    -- if (x < |C.LOCAL_context|)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:281.1-283.29
-  rule global.get {C : context, t : valtype, x : idx, w0 : ()?}:
+  rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(w0, t))
+    -- if (x < |C.GLOBAL_context|)
+    -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
 
   ;; 3-typing.watsup:285.1-287.28
   rule global.set {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
+    -- if (x < |C.GLOBAL_context|)
+    -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
 
   ;; 3-typing.watsup:290.1-292.28
   rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
     `%|-%:%`(C, TABLE.GET_instr(x), `%->%`([I32_valtype], [$valtype_reftype(rt)]))
+    -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:294.1-296.28
   rule table.set {C : context, lim : limits, rt : reftype, x : idx}:
     `%|-%:%`(C, TABLE.SET_instr(x), `%->%`([I32_valtype $valtype_reftype(rt)], []))
+    -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:298.1-300.24
   rule table.size {C : context, tt : tabletype, x : idx}:
     `%|-%:%`(C, TABLE.SIZE_instr(x), `%->%`([], [I32_valtype]))
+    -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = tt)
 
   ;; 3-typing.watsup:302.1-304.28
   rule table.grow {C : context, lim : limits, rt : reftype, x : idx}:
     `%|-%:%`(C, TABLE.GROW_instr(x), `%->%`([$valtype_reftype(rt) I32_valtype], [I32_valtype]))
+    -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:306.1-308.28
   rule table.fill {C : context, lim : limits, rt : reftype, x : idx}:
     `%|-%:%`(C, TABLE.FILL_instr(x), `%->%`([I32_valtype $valtype_reftype(rt) I32_valtype], []))
+    -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
 
   ;; 3-typing.watsup:310.1-313.32
   rule table.copy {C : context, lim_1 : limits, lim_2 : limits, rt : reftype, x_1 : idx, x_2 : idx}:
     `%|-%:%`(C, TABLE.COPY_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (x_1 < |C.TABLE_context|)
+    -- if (x_2 < |C.TABLE_context|)
     -- if (C.TABLE_context[x_1] = `%%`(lim_1, rt))
     -- if (C.TABLE_context[x_2] = `%%`(lim_2, rt))
 
   ;; 3-typing.watsup:315.1-318.25
   rule table.init {C : context, lim : limits, rt : reftype, x_1 : idx, x_2 : idx}:
     `%|-%:%`(C, TABLE.INIT_instr(x_1, x_2), `%->%`([I32_valtype I32_valtype I32_valtype], []))
+    -- if (x_1 < |C.TABLE_context|)
+    -- if (x_2 < |C.ELEM_context|)
     -- if (C.TABLE_context[x_1] = `%%`(lim, rt))
     -- if (C.ELEM_context[x_2] = rt)
 
   ;; 3-typing.watsup:320.1-322.23
   rule elem.drop {C : context, rt : reftype, x : idx}:
     `%|-%:%`(C, ELEM.DROP_instr(x), `%->%`([], []))
+    -- if (x < |C.ELEM_context|)
     -- if (C.ELEM_context[x] = rt)
 
   ;; 3-typing.watsup:325.1-327.22
   rule memory.size {C : context, mt : memtype}:
     `%|-%:%`(C, MEMORY.SIZE_instr, `%->%`([], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
     -- if (C.MEM_context[0] = mt)
 
   ;; 3-typing.watsup:329.1-331.22
   rule memory.grow {C : context, mt : memtype}:
     `%|-%:%`(C, MEMORY.GROW_instr, `%->%`([I32_valtype], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
     -- if (C.MEM_context[0] = mt)
 
   ;; 3-typing.watsup:333.1-335.22
   rule memory.fill {C : context, mt : memtype}:
     `%|-%:%`(C, MEMORY.FILL_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
     -- if (C.MEM_context[0] = mt)
 
   ;; 3-typing.watsup:337.1-339.22
   rule memory.copy {C : context, mt : memtype}:
     `%|-%:%`(C, MEMORY.COPY_instr, `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
     -- if (C.MEM_context[0] = mt)
 
   ;; 3-typing.watsup:341.1-344.23
   rule memory.init {C : context, mt : memtype, x : idx}:
     `%|-%:%`(C, MEMORY.INIT_instr(x), `%->%`([I32_valtype I32_valtype I32_valtype], [I32_valtype]))
+    -- if (0 < |C.MEM_context|)
+    -- if (x < |C.DATA_context|)
     -- if (C.MEM_context[0] = mt)
     -- if (C.DATA_context[x] = OK)
 
   ;; 3-typing.watsup:346.1-348.23
   rule data.drop {C : context, x : idx}:
     `%|-%:%`(C, DATA.DROP_instr(x), `%->%`([], []))
+    -- if (x < |C.DATA_context|)
     -- if (C.DATA_context[x] = OK)
 
   ;; 3-typing.watsup:350.1-355.32
   rule load {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, sx? : sx?, o0 : nat, o1? : nat?}:
     `%|-%:%`(C, LOAD_instr(nt, (n, sx)?{n sx}, n_A, n_O), `%->%`([I32_valtype], [$valtype_numtype(nt)]))
+    -- if (0 < |C.MEM_context|)
+    -- if ((n?{n} = ?()) <=> (o1?{o1} = ?()))
+    -- if ((n?{n} = ?()) <=> (sx?{sx} = ?()))
     -- if ($size($valtype_numtype(nt)) = ?(o0))
     -- (if ($size($valtype_numtype(nt)) = ?(o1)))?{o1}
     -- if (C.MEM_context[0] = mt)
@@ -7671,6 +7667,8 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
   ;; 3-typing.watsup:357.1-362.32
   rule store {C : context, in : in, mt : memtype, n? : n?, n_A : n, n_O : n, nt : numtype, o0 : nat, o1? : nat?}:
     `%|-%:%`(C, STORE_instr(nt, n?{n}, n_A, n_O), `%->%`([I32_valtype $valtype_numtype(nt)], []))
+    -- if (0 < |C.MEM_context|)
+    -- if ((n?{n} = ?()) <=> (o1?{o1} = ?()))
     -- if ($size($valtype_numtype(nt)) = ?(o0))
     -- (if ($size($valtype_numtype(nt)) = ?(o1)))?{o1}
     -- if (C.MEM_context[0] = mt)
@@ -7727,7 +7725,8 @@ relation Instr_const: `%|-%CONST`(context, instr)
   ;; 3-typing.watsup:380.1-382.32
   rule global.get {C : context, t : valtype, x : idx}:
     `%|-%CONST`(C, GLOBAL.GET_instr(x))
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(), t))
+    -- if (x < |C.GLOBAL_context|)
+    -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
 
 ;; 3-typing.watsup:368.1-368.77
 relation Expr_const: `%|-%CONST`(context, expr)
@@ -7756,10 +7755,10 @@ relation Func_ok: `%|-%:%`(context, func, functype)
 ;; 3-typing.watsup:398.1-398.75
 relation Global_ok: `%|-%:%`(context, global, globaltype)
   ;; 3-typing.watsup:414.1-418.40
-  rule _ {C : context, expr : expr, gt : globaltype, t : valtype, w0 : ()?}:
+  rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
     `%|-%:%`(C, GLOBAL(gt, expr), gt)
     -- Globaltype_ok: `|-%:OK`(gt)
-    -- if (gt = `MUT%?%`(w0, t))
+    -- if (gt = `%?%`(MUT?{}, t))
     -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
 
 ;; 3-typing.watsup:399.1-399.74
@@ -7781,6 +7780,7 @@ relation Elemmode_ok: `%|-%:%`(context, elemmode, reftype)
   ;; 3-typing.watsup:437.1-440.45
   rule active {C : context, expr : expr, lim : limits, rt : reftype, x : idx}:
     `%|-%:%`(C, TABLE_elemmode(x, expr), rt)
+    -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = `%%`(lim, rt))
     -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*{}
 
@@ -7801,6 +7801,7 @@ relation Datamode_ok: `%|-%:OK`(context, datamode)
   ;; 3-typing.watsup:445.1-448.45
   rule _ {C : context, expr : expr, mt : memtype}:
     `%|-%:OK`(C, MEMORY_datamode(0, expr))
+    -- if (0 < |C.MEM_context|)
     -- if (C.MEM_context[0] = mt)
     -- (Expr_ok_const: `%|-%:%CONST`(C, expr, I32_valtype))*{}
 
@@ -7816,6 +7817,7 @@ relation Start_ok: `%|-%:OK`(context, start)
   ;; 3-typing.watsup:450.1-452.39
   rule _ {C : context, x : idx}:
     `%|-%:OK`(C, START(x))
+    -- if (x < |C.FUNC_context|)
     -- if (C.FUNC_context[x] = `%->%`([], []))
 
 ;; 3-typing.watsup:455.1-455.80
@@ -7830,21 +7832,25 @@ relation Externuse_ok: `%|-%:%`(context, externuse, externtype)
   ;; 3-typing.watsup:467.1-469.23
   rule func {C : context, ft : functype, x : idx}:
     `%|-%:%`(C, FUNC_externuse(x), FUNC_externtype(ft))
+    -- if (x < |C.FUNC_context|)
     -- if (C.FUNC_context[x] = ft)
 
   ;; 3-typing.watsup:471.1-473.25
   rule global {C : context, gt : globaltype, x : idx}:
     `%|-%:%`(C, GLOBAL_externuse(x), GLOBAL_externtype(gt))
+    -- if (x < |C.GLOBAL_context|)
     -- if (C.GLOBAL_context[x] = gt)
 
   ;; 3-typing.watsup:475.1-477.24
   rule table {C : context, tt : tabletype, x : idx}:
     `%|-%:%`(C, TABLE_externuse(x), TABLE_externtype(tt))
+    -- if (x < |C.TABLE_context|)
     -- if (C.TABLE_context[x] = tt)
 
   ;; 3-typing.watsup:479.1-481.22
   rule mem {C : context, mt : memtype, x : idx}:
     `%|-%:%`(C, MEMORY_externuse(x), MEMORY_externtype(mt))
+    -- if (x < |C.MEM_context|)
     -- if (C.MEM_context[x] = mt)
 
 ;; 3-typing.watsup:456.1-456.80
@@ -7859,6 +7865,11 @@ relation Module_ok: `|-%:OK`(module)
   ;; 3-typing.watsup:486.1-501.22
   rule _ {C : context, data^n : data^n, elem* : elem*, export* : export*, ft* : functype*, func* : func*, global* : global*, gt* : globaltype*, import* : import*, mem* : mem*, mt* : memtype*, n : n, rt* : reftype*, start* : start*, table* : table*, tt* : tabletype*}:
     `|-%:OK`(`MODULE%*%*%*%*%*%*%*%*%*`(import*{import}, func*{func}, global*{global}, table*{table}, mem*{mem}, elem*{elem}, data^n{data}, start*{start}, export*{export}))
+    -- if (|ft*{ft}| = |func*{func}|)
+    -- if (|global*{global}| = |gt*{gt}|)
+    -- if (|table*{table}| = |tt*{tt}|)
+    -- if (|mem*{mem}| = |mt*{mt}|)
+    -- if (|elem*{elem}| = |rt*{rt}|)
     -- if (C = {FUNC ft*{ft}, GLOBAL gt*{gt}, TABLE tt*{tt}, MEM mt*{mt}, ELEM rt*{rt}, DATA OK^n{}, LOCAL [], LABEL [], RETURN ?()})
     -- (Func_ok: `%|-%:%`(C, func, ft))*{ft func}
     -- (Global_ok: `%|-%:%`(C, global, gt))*{global gt}
@@ -7936,47 +7947,49 @@ def default_ : valtype -> val?
   def default_(F32_valtype) = ?(CONST_val(F32_numtype, 0))
   ;; 4-runtime.watsup:48.1-48.35
   def default_(F64_valtype) = ?(CONST_val(F64_numtype, 0))
-  ;; 4-runtime.watsup:49.1-49.34
-  def {rt : reftype} default_($valtype_reftype(rt)) = ?(REF.NULL_val(rt))
+  ;; 4-runtime.watsup:49.1-49.44
+  def default_(FUNCREF_valtype) = ?(REF.NULL_val(FUNCREF_reftype))
+  ;; 4-runtime.watsup:50.1-50.48
+  def default_(EXTERNREF_valtype) = ?(REF.NULL_val(EXTERNREF_reftype))
   def {x : valtype} default_(x) = ?()
 
-;; 4-runtime.watsup:60.1-60.71
+;; 4-runtime.watsup:61.1-61.71
 syntax exportinst = EXPORT(name, externval)
 
-;; 4-runtime.watsup:70.1-77.25
+;; 4-runtime.watsup:71.1-78.25
 syntax moduleinst = {FUNC funcaddr*, GLOBAL globaladdr*, TABLE tableaddr*, MEM memaddr*, ELEM elemaddr*, DATA dataaddr*, EXPORT exportinst*}
 
-;; 4-runtime.watsup:54.1-54.66
+;; 4-runtime.watsup:55.1-55.66
 syntax funcinst = `%;%`(moduleinst, func)
 
-;; 4-runtime.watsup:55.1-55.53
+;; 4-runtime.watsup:56.1-56.53
 syntax globalinst = val
 
-;; 4-runtime.watsup:56.1-56.52
+;; 4-runtime.watsup:57.1-57.52
 syntax tableinst = ref*
 
-;; 4-runtime.watsup:57.1-57.52
+;; 4-runtime.watsup:58.1-58.52
 syntax meminst = byte*
 
-;; 4-runtime.watsup:58.1-58.53
+;; 4-runtime.watsup:59.1-59.53
 syntax eleminst = ref*
 
-;; 4-runtime.watsup:59.1-59.51
+;; 4-runtime.watsup:60.1-60.51
 syntax datainst = byte*
 
-;; 4-runtime.watsup:62.1-68.21
+;; 4-runtime.watsup:63.1-69.21
 syntax store = {FUNC funcinst*, GLOBAL globalinst*, TABLE tableinst*, MEM meminst*, ELEM eleminst*, DATA datainst*}
 
-;; 4-runtime.watsup:79.1-81.24
+;; 4-runtime.watsup:80.1-82.24
 syntax frame = {LOCAL val*, MODULE moduleinst}
 
-;; 4-runtime.watsup:82.1-82.47
+;; 4-runtime.watsup:83.1-83.47
 syntax state = `%;%`(store, frame)
 
-;; 4-runtime.watsup:145.1-152.5
+;; 4-runtime.watsup:146.1-153.5
 rec {
 
-;; 4-runtime.watsup:145.1-152.5
+;; 4-runtime.watsup:146.1-153.5
 syntax admininstr =
   | UNREACHABLE
   | NOP
@@ -8093,98 +8106,98 @@ def admininstr_val : val -> admininstr
   def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
   def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
 
-;; 4-runtime.watsup:83.1-83.62
+;; 4-runtime.watsup:84.1-84.62
 syntax config = `%;%*`(state, admininstr*)
 
-;; 4-runtime.watsup:101.1-101.59
+;; 4-runtime.watsup:102.1-102.59
 def funcaddr : state -> funcaddr*
-  ;; 4-runtime.watsup:102.1-102.38
+  ;; 4-runtime.watsup:103.1-103.38
   def {f : frame, s : store} funcaddr(`%;%`(s, f)) = f.MODULE_frame.FUNC_moduleinst
 
-;; 4-runtime.watsup:104.1-104.52
+;; 4-runtime.watsup:105.1-105.52
 def funcinst : state -> funcinst*
-  ;; 4-runtime.watsup:105.1-105.31
+  ;; 4-runtime.watsup:106.1-106.31
   def {f : frame, s : store} funcinst(`%;%`(s, f)) = s.FUNC_store
 
-;; 4-runtime.watsup:107.1-107.67
+;; 4-runtime.watsup:108.1-108.67
 def func : (state, funcidx) -> funcinst
-  ;; 4-runtime.watsup:115.1-115.48
+  ;; 4-runtime.watsup:116.1-116.48
   def {f : frame, s : store, x : idx} func(`%;%`(s, f), x) = s.FUNC_store[f.MODULE_frame.FUNC_moduleinst[x]]
 
-;; 4-runtime.watsup:108.1-108.69
+;; 4-runtime.watsup:109.1-109.69
 def global : (state, globalidx) -> globalinst
-  ;; 4-runtime.watsup:116.1-116.54
+  ;; 4-runtime.watsup:117.1-117.54
   def {f : frame, s : store, x : idx} global(`%;%`(s, f), x) = s.GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]]
 
-;; 4-runtime.watsup:109.1-109.68
+;; 4-runtime.watsup:110.1-110.68
 def table : (state, tableidx) -> tableinst
-  ;; 4-runtime.watsup:117.1-117.51
+  ;; 4-runtime.watsup:118.1-118.51
   def {f : frame, s : store, x : idx} table(`%;%`(s, f), x) = s.TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]]
 
-;; 4-runtime.watsup:110.1-110.66
+;; 4-runtime.watsup:111.1-111.66
 def mem : (state, memidx) -> meminst
-  ;; 4-runtime.watsup:118.1-118.45
+  ;; 4-runtime.watsup:119.1-119.45
   def {f : frame, s : store, x : idx} mem(`%;%`(s, f), x) = s.MEM_store[f.MODULE_frame.MEM_moduleinst[x]]
 
-;; 4-runtime.watsup:111.1-111.67
+;; 4-runtime.watsup:112.1-112.67
 def elem : (state, tableidx) -> eleminst
-  ;; 4-runtime.watsup:119.1-119.48
+  ;; 4-runtime.watsup:120.1-120.48
   def {f : frame, s : store, x : idx} elem(`%;%`(s, f), x) = s.ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]]
 
-;; 4-runtime.watsup:112.1-112.67
+;; 4-runtime.watsup:113.1-113.67
 def data : (state, dataidx) -> datainst
-  ;; 4-runtime.watsup:120.1-120.48
+  ;; 4-runtime.watsup:121.1-121.48
   def {f : frame, s : store, x : idx} data(`%;%`(s, f), x) = s.DATA_store[f.MODULE_frame.DATA_moduleinst[x]]
 
-;; 4-runtime.watsup:113.1-113.68
+;; 4-runtime.watsup:114.1-114.68
 def local : (state, localidx) -> val
-  ;; 4-runtime.watsup:121.1-121.35
+  ;; 4-runtime.watsup:122.1-122.35
   def {f : frame, s : store, x : idx} local(`%;%`(s, f), x) = f.LOCAL_frame[x]
 
-;; 4-runtime.watsup:124.1-124.78
+;; 4-runtime.watsup:125.1-125.78
 def with_local : (state, localidx, val) -> state
-  ;; 4-runtime.watsup:133.1-133.52
+  ;; 4-runtime.watsup:134.1-134.52
   def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL_frame[x] = v])
 
-;; 4-runtime.watsup:125.1-125.79
+;; 4-runtime.watsup:126.1-126.79
 def with_global : (state, globalidx, val) -> state
-  ;; 4-runtime.watsup:134.1-134.71
+  ;; 4-runtime.watsup:135.1-135.71
   def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
 
-;; 4-runtime.watsup:126.1-126.83
+;; 4-runtime.watsup:127.1-127.83
 def with_table : (state, tableidx, nat, ref) -> state
-  ;; 4-runtime.watsup:135.1-135.74
+  ;; 4-runtime.watsup:136.1-136.74
   def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
 
-;; 4-runtime.watsup:127.1-127.80
+;; 4-runtime.watsup:128.1-128.80
 def with_tableext : (state, tableidx, ref*) -> state
-  ;; 4-runtime.watsup:136.1-136.75
+  ;; 4-runtime.watsup:137.1-137.75
   def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
 
-;; 4-runtime.watsup:128.1-128.90
+;; 4-runtime.watsup:129.1-129.90
 def with_mem : (state, tableidx, nat, nat, byte*) -> state
-  ;; 4-runtime.watsup:137.1-137.77
+  ;; 4-runtime.watsup:138.1-138.77
   def {b* : byte*, f : frame, i : nat, j : nat, s : store, x : idx} with_mem(`%;%`(s, f), x, i, j, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}], f)
 
-;; 4-runtime.watsup:129.1-129.78
+;; 4-runtime.watsup:130.1-130.78
 def with_memext : (state, tableidx, byte*) -> state
-  ;; 4-runtime.watsup:138.1-138.69
+  ;; 4-runtime.watsup:139.1-139.69
   def {b* : byte*, f : frame, s : store, x : idx} with_memext(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}], f)
 
-;; 4-runtime.watsup:130.1-130.77
+;; 4-runtime.watsup:131.1-131.77
 def with_elem : (state, elemidx, ref*) -> state
-  ;; 4-runtime.watsup:139.1-139.67
+  ;; 4-runtime.watsup:140.1-140.67
   def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]] = r*{r}], f)
 
-;; 4-runtime.watsup:131.1-131.77
+;; 4-runtime.watsup:132.1-132.77
 def with_data : (state, dataidx, byte*) -> state
-  ;; 4-runtime.watsup:140.1-140.67
+  ;; 4-runtime.watsup:141.1-141.67
   def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[DATA_store[f.MODULE_frame.DATA_moduleinst[x]] = b*{b}], f)
 
-;; 4-runtime.watsup:154.1-157.21
+;; 4-runtime.watsup:155.1-158.21
 rec {
 
-;; 4-runtime.watsup:154.1-157.21
+;; 4-runtime.watsup:155.1-158.21
 syntax E =
   | _HOLE
   | _SEQ(val*, E, instr*)
@@ -8367,10 +8380,13 @@ relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:82.1-83.47
   rule call {x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CALL_admininstr(x)]), [CALL_ADDR_admininstr($funcaddr(z)[x])])
+    -- if (x < |$funcaddr(z)|)
 
   ;; 6-reduction.watsup:85.1-89.17
   rule call_indirect-call {a : addr, ft : functype, ft' : functype, i : nat, instr* : instr*, m : moduleinst, t* : valtype*, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [CALL_ADDR_admininstr(a)])
+    -- if (i < |$table(z, x)|)
+    -- if (a < |$funcinst(z)|)
     -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
     -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(ft', t*{t}, instr*{instr})))
     -- if (ft = ft')
@@ -8383,6 +8399,8 @@ relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:95.1-98.52
   rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state, o0* : val*}:
     `%~>%*`(`%;%*`(z, $admininstr_val(val)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], $admininstr_instr(instr)*{instr})])])
+    -- if (|t*{t}| = |o0*{o0}|)
+    -- if (a < |$funcinst(z)|)
     -- (if ($default_(t) = ?(o0)))*{t o0}
     -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
     -- if (f = {LOCAL val^k{val} :: o0*{o0}, MODULE m})
@@ -8390,6 +8408,7 @@ relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:151.1-152.53
   rule ref.func {x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [REF.FUNC_admininstr(x)]), [REF.FUNC_ADDR_admininstr($funcaddr(z)[x])])
+    -- if (x < |$funcaddr(z)|)
 
   ;; 6-reduction.watsup:164.1-165.37
   rule local.get {x : idx, z : state}:
@@ -8466,6 +8485,7 @@ relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:258.1-262.15
   rule table.init-succ {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) $admininstr_ref($elem(z, y)[i]) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
+    -- if (i < |$elem(z, y)|)
     -- otherwise
 
   ;; 6-reduction.watsup:269.1-271.48
@@ -8549,6 +8569,7 @@ relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:363.1-367.15
   rule memory.init-succ {i : nat, j : nat, n : n, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, $data(z, x)[i]) STORE_admininstr(I32_numtype, ?(8), 0, 0) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) MEMORY.INIT_admininstr(x)])
+    -- if (i < |$data(z, x)|)
     -- otherwise
 
 ;; 6-reduction.watsup:3.1-3.63
@@ -8630,7 +8651,7 @@ relation Step: `%~>%`(config, config)
     `%~>%`(`%;%*`(z, [DATA.DROP_admininstr(x)]), `%;%*`($with_data(z, x, []), []))
 
 == IL Validation...
-== Side condition inference
+== Wildcard elimination
 
 ;; 1-syntax.watsup:3.1-3.15
 syntax n = nat
@@ -9334,17 +9355,10 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:281.1-283.29
-<<<<<<< HEAD
   rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
     -- if (x < |C.GLOBAL_context|)
     -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
-=======
-  rule global.get {C : context, t : valtype, x : idx, w0 : ()?}:
-    `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
-    -- if (x < |C.GLOBAL_context|)
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(w0, t))
->>>>>>> @{-1}
 
   ;; 3-typing.watsup:285.1-287.28
   rule global.set {C : context, t : valtype, x : idx}:
@@ -9546,14 +9560,10 @@ relation Func_ok: `%|-%:%`(context, func, functype)
 ;; 3-typing.watsup:398.1-398.75
 relation Global_ok: `%|-%:%`(context, global, globaltype)
   ;; 3-typing.watsup:414.1-418.40
-  rule _ {C : context, expr : expr, gt : globaltype, t : valtype, w0 : ()?}:
+  rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
     `%|-%:%`(C, GLOBAL(gt, expr), gt)
     -- Globaltype_ok: `|-%:OK`(gt)
-<<<<<<< HEAD
     -- if (gt = `%?%`(MUT?{}, t))
-=======
-    -- if (gt = `MUT%?%`(w0, t))
->>>>>>> @{-1}
     -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
 
 ;; 3-typing.watsup:399.1-399.74
@@ -9981,23 +9991,13 @@ def with_memext : (state, tableidx, byte*) -> state
 
 ;; 4-runtime.watsup:131.1-131.77
 def with_elem : (state, elemidx, ref*) -> state
-<<<<<<< HEAD
-  ;; 4-runtime.watsup:140.1-140.69
-  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
-=======
-  ;; 4-runtime.watsup:139.1-139.67
+  ;; 4-runtime.watsup:140.1-140.67
   def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]] = r*{r}], f)
->>>>>>> @{-1}
 
 ;; 4-runtime.watsup:132.1-132.77
 def with_data : (state, dataidx, byte*) -> state
-<<<<<<< HEAD
-  ;; 4-runtime.watsup:141.1-141.65
-  def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
-=======
-  ;; 4-runtime.watsup:140.1-140.67
+  ;; 4-runtime.watsup:141.1-141.67
   def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[DATA_store[f.MODULE_frame.DATA_moduleinst[x]] = b*{b}], f)
->>>>>>> @{-1}
 
 ;; 4-runtime.watsup:155.1-158.21
 rec {
@@ -10456,10 +10456,7 @@ relation Step: `%~>%`(config, config)
     `%~>%`(`%;%*`(z, [DATA.DROP_admininstr(x)]), `%;%*`($with_data(z, x, []), []))
 
 == IL Validation...
-== Animate
-Animation failed:if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(ft', t*{t}, instr*{instr})))
-Animation failed:if ($bytes_(o0, c) = $mem(z, 0)[(i + n_O) : (o1 / 8)])
-Animation failed:if ($bytes_(n, c) = $mem(z, 0)[(i + n_O) : (n / 8)])
+== Else elimination
 
 ;; 1-syntax.watsup:3.1-3.15
 syntax n = nat
@@ -10572,43 +10569,46 @@ syntax resulttype = valtype*
 ;; 1-syntax.watsup:59.1-60.16
 syntax limits = `[%..%]`(u32, u32)
 
-;; 1-syntax.watsup:61.1-62.15
-syntax globaltype = `MUT%?%`(()?, valtype)
+;; 1-syntax.watsup:61.1-62.6
+syntax mutflag = MUT
+
+;; 1-syntax.watsup:63.1-64.19
+syntax globaltype = `%?%`(mutflag?, valtype)
 
-;; 1-syntax.watsup:63.1-64.27
+;; 1-syntax.watsup:65.1-66.27
 syntax functype = `%->%`(resulttype, resulttype)
 
-;; 1-syntax.watsup:65.1-66.17
+;; 1-syntax.watsup:67.1-68.17
 syntax tabletype = `%%`(limits, reftype)
 
-;; 1-syntax.watsup:67.1-68.12
+;; 1-syntax.watsup:69.1-70.12
 syntax memtype = `%I8`(limits)
 
-;; 1-syntax.watsup:69.1-70.10
+;; 1-syntax.watsup:71.1-72.10
 syntax elemtype = reftype
 
-;; 1-syntax.watsup:71.1-72.5
+;; 1-syntax.watsup:73.1-74.5
 syntax datatype = OK
 
-;; 1-syntax.watsup:73.1-74.69
+;; 1-syntax.watsup:75.1-76.69
 syntax externtype =
   | GLOBAL(globaltype)
   | FUNC(functype)
   | TABLE(tabletype)
   | MEMORY(memtype)
 
-;; 1-syntax.watsup:86.1-86.44
+;; 1-syntax.watsup:89.1-89.44
 syntax sx =
   | U
   | S
 
-;; 1-syntax.watsup:88.1-88.39
+;; 1-syntax.watsup:91.1-91.39
 syntax unop_IXX =
   | CLZ
   | CTZ
   | POPCNT
 
-;; 1-syntax.watsup:89.1-89.70
+;; 1-syntax.watsup:92.1-92.70
 syntax unop_FXX =
   | ABS
   | NEG
@@ -10618,7 +10618,7 @@ syntax unop_FXX =
   | TRUNC
   | NEAREST
 
-;; 1-syntax.watsup:91.1-93.62
+;; 1-syntax.watsup:94.1-96.62
 syntax binop_IXX =
   | ADD
   | SUB
@@ -10633,7 +10633,7 @@ syntax binop_IXX =
   | ROTL
   | ROTR
 
-;; 1-syntax.watsup:94.1-94.66
+;; 1-syntax.watsup:97.1-97.66
 syntax binop_FXX =
   | ADD
   | SUB
@@ -10643,15 +10643,15 @@ syntax binop_FXX =
   | MAX
   | COPYSIGN
 
-;; 1-syntax.watsup:96.1-96.26
+;; 1-syntax.watsup:99.1-99.26
 syntax testop_IXX =
   | EQZ
 
-;; 1-syntax.watsup:97.1-97.22
+;; 1-syntax.watsup:100.1-100.22
 syntax testop_FXX =
   |
 
-;; 1-syntax.watsup:99.1-100.108
+;; 1-syntax.watsup:102.1-103.108
 syntax relop_IXX =
   | EQ
   | NE
@@ -10660,7 +10660,7 @@ syntax relop_IXX =
   | LE(sx)
   | GE(sx)
 
-;; 1-syntax.watsup:101.1-101.49
+;; 1-syntax.watsup:104.1-104.49
 syntax relop_FXX =
   | EQ
   | NE
@@ -10669,44 +10669,44 @@ syntax relop_FXX =
   | LE
   | GE
 
-;; 1-syntax.watsup:103.1-103.50
+;; 1-syntax.watsup:106.1-106.50
 syntax unop_numtype =
   | _I(unop_IXX)
   | _F(unop_FXX)
 
-;; 1-syntax.watsup:104.1-104.53
+;; 1-syntax.watsup:107.1-107.53
 syntax binop_numtype =
   | _I(binop_IXX)
   | _F(binop_FXX)
 
-;; 1-syntax.watsup:105.1-105.56
+;; 1-syntax.watsup:108.1-108.56
 syntax testop_numtype =
   | _I(testop_IXX)
   | _F(testop_FXX)
 
-;; 1-syntax.watsup:106.1-106.53
+;; 1-syntax.watsup:109.1-109.53
 syntax relop_numtype =
   | _I(relop_IXX)
   | _F(relop_FXX)
 
-;; 1-syntax.watsup:107.1-107.39
+;; 1-syntax.watsup:110.1-110.39
 syntax cvtop =
   | CONVERT
   | REINTERPRET
 
-;; 1-syntax.watsup:117.1-117.23
+;; 1-syntax.watsup:120.1-120.23
 syntax c_numtype = nat
 
-;; 1-syntax.watsup:118.1-118.23
+;; 1-syntax.watsup:121.1-121.23
 syntax c_vectype = nat
 
-;; 1-syntax.watsup:121.1-121.52
+;; 1-syntax.watsup:124.1-124.52
 syntax blocktype = functype
 
-;; 1-syntax.watsup:156.1-177.80
+;; 1-syntax.watsup:159.1-180.80
 rec {
 
-;; 1-syntax.watsup:156.1-177.80
+;; 1-syntax.watsup:159.1-180.80
 syntax instr =
   | UNREACHABLE
   | NOP
@@ -10754,53 +10754,53 @@ syntax instr =
   | STORE(numtype, n?, u32, u32)
 }
 
-;; 1-syntax.watsup:179.1-180.9
+;; 1-syntax.watsup:182.1-183.9
 syntax expr = instr*
 
-;; 1-syntax.watsup:187.1-187.50
+;; 1-syntax.watsup:190.1-190.50
 syntax elemmode =
   | TABLE(tableidx, expr)
   | DECLARE
 
-;; 1-syntax.watsup:188.1-188.39
+;; 1-syntax.watsup:191.1-191.39
 syntax datamode =
   | MEMORY(memidx, expr)
 
-;; 1-syntax.watsup:190.1-191.30
+;; 1-syntax.watsup:193.1-194.30
 syntax func = `FUNC%%*%`(functype, valtype*, expr)
 
-;; 1-syntax.watsup:192.1-193.25
+;; 1-syntax.watsup:195.1-196.25
 syntax global = GLOBAL(globaltype, expr)
 
-;; 1-syntax.watsup:194.1-195.18
+;; 1-syntax.watsup:197.1-198.18
 syntax table = TABLE(tabletype)
 
-;; 1-syntax.watsup:196.1-197.17
+;; 1-syntax.watsup:199.1-200.17
 syntax mem = MEMORY(memtype)
 
-;; 1-syntax.watsup:198.1-199.31
+;; 1-syntax.watsup:201.1-202.31
 syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
 
-;; 1-syntax.watsup:200.1-201.26
+;; 1-syntax.watsup:203.1-204.26
 syntax data = `DATA(*)%*%?`(byte**, datamode?)
 
-;; 1-syntax.watsup:202.1-203.16
+;; 1-syntax.watsup:205.1-206.16
 syntax start = START(funcidx)
 
-;; 1-syntax.watsup:205.1-206.65
+;; 1-syntax.watsup:208.1-209.65
 syntax externuse =
   | FUNC(funcidx)
   | GLOBAL(globalidx)
   | TABLE(tableidx)
   | MEMORY(memidx)
 
-;; 1-syntax.watsup:207.1-208.24
+;; 1-syntax.watsup:210.1-211.24
 syntax export = EXPORT(name, externuse)
 
-;; 1-syntax.watsup:209.1-210.30
+;; 1-syntax.watsup:212.1-213.30
 syntax import = IMPORT(name, name, externtype)
 
-;; 1-syntax.watsup:212.1-213.70
+;; 1-syntax.watsup:215.1-216.70
 syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
 
 ;; 2-aux.watsup:3.1-3.14
@@ -11160,16 +11160,16 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:281.1-283.29
-  rule global.get {C : context, t : valtype, x : idx, w0 : ()?}:
+  rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
     -- if (x < |C.GLOBAL_context|)
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(w0, t))
+    -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
 
   ;; 3-typing.watsup:285.1-287.28
   rule global.set {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
     -- if (x < |C.GLOBAL_context|)
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
+    -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
 
   ;; 3-typing.watsup:290.1-292.28
   rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
@@ -11336,7 +11336,7 @@ relation Instr_const: `%|-%CONST`(context, instr)
   rule global.get {C : context, t : valtype, x : idx}:
     `%|-%CONST`(C, GLOBAL.GET_instr(x))
     -- if (x < |C.GLOBAL_context|)
-    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(), t))
+    -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
 
 ;; 3-typing.watsup:368.1-368.77
 relation Expr_const: `%|-%CONST`(context, expr)
@@ -11365,10 +11365,10 @@ relation Func_ok: `%|-%:%`(context, func, functype)
 ;; 3-typing.watsup:398.1-398.75
 relation Global_ok: `%|-%:%`(context, global, globaltype)
   ;; 3-typing.watsup:414.1-418.40
-  rule _ {C : context, expr : expr, gt : globaltype, t : valtype, w0 : ()?}:
+  rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
     `%|-%:%`(C, GLOBAL(gt, expr), gt)
     -- Globaltype_ok: `|-%:OK`(gt)
-    -- if (gt = `MUT%?%`(w0, t))
+    -- if (gt = `%?%`(MUT?{}, t))
     -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
 
 ;; 3-typing.watsup:399.1-399.74
@@ -11557,47 +11557,49 @@ def default_ : valtype -> val?
   def default_(F32_valtype) = ?(CONST_val(F32_numtype, 0))
   ;; 4-runtime.watsup:48.1-48.35
   def default_(F64_valtype) = ?(CONST_val(F64_numtype, 0))
-  ;; 4-runtime.watsup:49.1-49.34
-  def {rt : reftype} default_($valtype_reftype(rt)) = ?(REF.NULL_val(rt))
+  ;; 4-runtime.watsup:49.1-49.44
+  def default_(FUNCREF_valtype) = ?(REF.NULL_val(FUNCREF_reftype))
+  ;; 4-runtime.watsup:50.1-50.48
+  def default_(EXTERNREF_valtype) = ?(REF.NULL_val(EXTERNREF_reftype))
   def {x : valtype} default_(x) = ?()
 
-;; 4-runtime.watsup:60.1-60.71
+;; 4-runtime.watsup:61.1-61.71
 syntax exportinst = EXPORT(name, externval)
 
-;; 4-runtime.watsup:70.1-77.25
+;; 4-runtime.watsup:71.1-78.25
 syntax moduleinst = {FUNC funcaddr*, GLOBAL globaladdr*, TABLE tableaddr*, MEM memaddr*, ELEM elemaddr*, DATA dataaddr*, EXPORT exportinst*}
 
-;; 4-runtime.watsup:54.1-54.66
+;; 4-runtime.watsup:55.1-55.66
 syntax funcinst = `%;%`(moduleinst, func)
 
-;; 4-runtime.watsup:55.1-55.53
+;; 4-runtime.watsup:56.1-56.53
 syntax globalinst = val
 
-;; 4-runtime.watsup:56.1-56.52
+;; 4-runtime.watsup:57.1-57.52
 syntax tableinst = ref*
 
-;; 4-runtime.watsup:57.1-57.52
+;; 4-runtime.watsup:58.1-58.52
 syntax meminst = byte*
 
-;; 4-runtime.watsup:58.1-58.53
+;; 4-runtime.watsup:59.1-59.53
 syntax eleminst = ref*
 
-;; 4-runtime.watsup:59.1-59.51
+;; 4-runtime.watsup:60.1-60.51
 syntax datainst = byte*
 
-;; 4-runtime.watsup:62.1-68.21
+;; 4-runtime.watsup:63.1-69.21
 syntax store = {FUNC funcinst*, GLOBAL globalinst*, TABLE tableinst*, MEM meminst*, ELEM eleminst*, DATA datainst*}
 
-;; 4-runtime.watsup:79.1-81.24
+;; 4-runtime.watsup:80.1-82.24
 syntax frame = {LOCAL val*, MODULE moduleinst}
 
-;; 4-runtime.watsup:82.1-82.47
+;; 4-runtime.watsup:83.1-83.47
 syntax state = `%;%`(store, frame)
 
-;; 4-runtime.watsup:145.1-152.5
+;; 4-runtime.watsup:146.1-153.5
 rec {
 
-;; 4-runtime.watsup:145.1-152.5
+;; 4-runtime.watsup:146.1-153.5
 syntax admininstr =
   | UNREACHABLE
   | NOP
@@ -11714,98 +11716,98 @@ def admininstr_val : val -> admininstr
   def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
   def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
 
-;; 4-runtime.watsup:83.1-83.62
+;; 4-runtime.watsup:84.1-84.62
 syntax config = `%;%*`(state, admininstr*)
 
-;; 4-runtime.watsup:101.1-101.59
+;; 4-runtime.watsup:102.1-102.59
 def funcaddr : state -> funcaddr*
-  ;; 4-runtime.watsup:102.1-102.38
+  ;; 4-runtime.watsup:103.1-103.38
   def {f : frame, s : store} funcaddr(`%;%`(s, f)) = f.MODULE_frame.FUNC_moduleinst
 
-;; 4-runtime.watsup:104.1-104.52
+;; 4-runtime.watsup:105.1-105.52
 def funcinst : state -> funcinst*
-  ;; 4-runtime.watsup:105.1-105.31
+  ;; 4-runtime.watsup:106.1-106.31
   def {f : frame, s : store} funcinst(`%;%`(s, f)) = s.FUNC_store
 
-;; 4-runtime.watsup:107.1-107.67
+;; 4-runtime.watsup:108.1-108.67
 def func : (state, funcidx) -> funcinst
-  ;; 4-runtime.watsup:115.1-115.48
+  ;; 4-runtime.watsup:116.1-116.48
   def {f : frame, s : store, x : idx} func(`%;%`(s, f), x) = s.FUNC_store[f.MODULE_frame.FUNC_moduleinst[x]]
 
-;; 4-runtime.watsup:108.1-108.69
+;; 4-runtime.watsup:109.1-109.69
 def global : (state, globalidx) -> globalinst
-  ;; 4-runtime.watsup:116.1-116.54
+  ;; 4-runtime.watsup:117.1-117.54
   def {f : frame, s : store, x : idx} global(`%;%`(s, f), x) = s.GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]]
 
-;; 4-runtime.watsup:109.1-109.68
+;; 4-runtime.watsup:110.1-110.68
 def table : (state, tableidx) -> tableinst
-  ;; 4-runtime.watsup:117.1-117.51
+  ;; 4-runtime.watsup:118.1-118.51
   def {f : frame, s : store, x : idx} table(`%;%`(s, f), x) = s.TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]]
 
-;; 4-runtime.watsup:110.1-110.66
+;; 4-runtime.watsup:111.1-111.66
 def mem : (state, memidx) -> meminst
-  ;; 4-runtime.watsup:118.1-118.45
+  ;; 4-runtime.watsup:119.1-119.45
   def {f : frame, s : store, x : idx} mem(`%;%`(s, f), x) = s.MEM_store[f.MODULE_frame.MEM_moduleinst[x]]
 
-;; 4-runtime.watsup:111.1-111.67
+;; 4-runtime.watsup:112.1-112.67
 def elem : (state, tableidx) -> eleminst
-  ;; 4-runtime.watsup:119.1-119.48
+  ;; 4-runtime.watsup:120.1-120.48
   def {f : frame, s : store, x : idx} elem(`%;%`(s, f), x) = s.ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]]
 
-;; 4-runtime.watsup:112.1-112.67
+;; 4-runtime.watsup:113.1-113.67
 def data : (state, dataidx) -> datainst
-  ;; 4-runtime.watsup:120.1-120.48
+  ;; 4-runtime.watsup:121.1-121.48
   def {f : frame, s : store, x : idx} data(`%;%`(s, f), x) = s.DATA_store[f.MODULE_frame.DATA_moduleinst[x]]
 
-;; 4-runtime.watsup:113.1-113.68
+;; 4-runtime.watsup:114.1-114.68
 def local : (state, localidx) -> val
-  ;; 4-runtime.watsup:121.1-121.35
+  ;; 4-runtime.watsup:122.1-122.35
   def {f : frame, s : store, x : idx} local(`%;%`(s, f), x) = f.LOCAL_frame[x]
 
-;; 4-runtime.watsup:124.1-124.78
+;; 4-runtime.watsup:125.1-125.78
 def with_local : (state, localidx, val) -> state
-  ;; 4-runtime.watsup:133.1-133.52
+  ;; 4-runtime.watsup:134.1-134.52
   def {f : frame, s : store, v : val, x : idx} with_local(`%;%`(s, f), x, v) = `%;%`(s, f[LOCAL_frame[x] = v])
 
-;; 4-runtime.watsup:125.1-125.79
+;; 4-runtime.watsup:126.1-126.79
 def with_global : (state, globalidx, val) -> state
-  ;; 4-runtime.watsup:134.1-134.71
+  ;; 4-runtime.watsup:135.1-135.71
   def {f : frame, s : store, v : val, x : idx} with_global(`%;%`(s, f), x, v) = `%;%`(s[GLOBAL_store[f.MODULE_frame.GLOBAL_moduleinst[x]] = v], f)
 
-;; 4-runtime.watsup:126.1-126.83
+;; 4-runtime.watsup:127.1-127.83
 def with_table : (state, tableidx, nat, ref) -> state
-  ;; 4-runtime.watsup:135.1-135.74
+  ;; 4-runtime.watsup:136.1-136.74
   def {f : frame, i : nat, r : ref, s : store, x : idx} with_table(`%;%`(s, f), x, i, r) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]][i] = r], f)
 
-;; 4-runtime.watsup:127.1-127.80
+;; 4-runtime.watsup:128.1-128.80
 def with_tableext : (state, tableidx, ref*) -> state
-  ;; 4-runtime.watsup:136.1-136.75
+  ;; 4-runtime.watsup:137.1-137.75
   def {f : frame, r* : ref*, s : store, x : idx} with_tableext(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] =.. r*{r}], f)
 
-;; 4-runtime.watsup:128.1-128.90
+;; 4-runtime.watsup:129.1-129.90
 def with_mem : (state, tableidx, nat, nat, byte*) -> state
-  ;; 4-runtime.watsup:137.1-137.77
+  ;; 4-runtime.watsup:138.1-138.77
   def {b* : byte*, f : frame, i : nat, j : nat, s : store, x : idx} with_mem(`%;%`(s, f), x, i, j, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]][i : j] = b*{b}], f)
 
-;; 4-runtime.watsup:129.1-129.78
+;; 4-runtime.watsup:130.1-130.78
 def with_memext : (state, tableidx, byte*) -> state
-  ;; 4-runtime.watsup:138.1-138.69
+  ;; 4-runtime.watsup:139.1-139.69
   def {b* : byte*, f : frame, s : store, x : idx} with_memext(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] =.. b*{b}], f)
 
-;; 4-runtime.watsup:130.1-130.77
+;; 4-runtime.watsup:131.1-131.77
 def with_elem : (state, elemidx, ref*) -> state
-  ;; 4-runtime.watsup:139.1-139.67
+  ;; 4-runtime.watsup:140.1-140.67
   def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]] = r*{r}], f)
 
-;; 4-runtime.watsup:131.1-131.77
+;; 4-runtime.watsup:132.1-132.77
 def with_data : (state, dataidx, byte*) -> state
-  ;; 4-runtime.watsup:140.1-140.67
+  ;; 4-runtime.watsup:141.1-141.67
   def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[DATA_store[f.MODULE_frame.DATA_moduleinst[x]] = b*{b}], f)
 
-;; 4-runtime.watsup:154.1-157.21
+;; 4-runtime.watsup:155.1-158.21
 rec {
 
-;; 4-runtime.watsup:154.1-157.21
+;; 4-runtime.watsup:155.1-158.21
 syntax E =
   | _HOLE
   | _SEQ(val*, E, instr*)
@@ -11836,6 +11838,13 @@ def wrap_ : ((nat, nat), c_numtype) -> nat
 ;; 5-numerics.watsup:13.1-13.28
 def bytes_ : (nat, c_numtype) -> byte*
 
+;; 6-reduction.watsup:159.1-161.15
+relation Step_pure_before_ref.is_null-false: `%`(admininstr*)
+  ;; 6-reduction.watsup:155.1-157.28
+  rule ref.is_null-true {rt : reftype, val : val}:
+    `%`([$admininstr_val(val) REF.IS_NULL_admininstr])
+    -- if (val = REF.NULL_val(rt))
+
 ;; 6-reduction.watsup:4.1-4.63
 relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:16.1-17.24
@@ -11863,12 +11872,12 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:35.1-37.28
   rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
     `%*~>%*`($admininstr_val(val)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], $admininstr_val(val)^k{val} :: $admininstr_instr(instr)*{instr})])
-    -- where `%->%`(t_1^k{t_1}, t_2^n{t_2}) = bt
+    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
 
   ;; 6-reduction.watsup:39.1-41.28
   rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
     `%*~>%*`($admininstr_val(val)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(k, [LOOP_instr(bt, instr*{instr})], $admininstr_val(val)^k{val} :: $admininstr_instr(instr)*{instr})])
-    -- where `%->%`(t_1^k{t_1}, t_2^n{t_2}) = bt
+    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
 
   ;; 6-reduction.watsup:43.1-45.16
   rule if-true {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
@@ -11927,7 +11936,7 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:111.1-113.33
   rule unop-val {c : c_numtype, c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
     `%*~>%*`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)], [CONST_admininstr(nt, c)])
-    -- where [c] = $unop(unop, nt, c_1)
+    -- if ($unop(unop, nt, c_1) = [c])
 
   ;; 6-reduction.watsup:115.1-117.39
   rule unop-trap {c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
@@ -11937,7 +11946,7 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:120.1-122.40
   rule binop-val {binop : binop_numtype, c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
     `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)], [CONST_admininstr(nt, c)])
-    -- where [c] = $binop(binop, nt, c_1, c_2)
+    -- if ($binop(binop, nt, c_1, c_2) = [c])
 
   ;; 6-reduction.watsup:124.1-126.46
   rule binop-trap {binop : binop_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
@@ -11947,22 +11956,22 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:129.1-131.37
   rule testop {c : c_numtype, c_1 : c_numtype, nt : numtype, testop : testop_numtype}:
     `%*~>%*`([CONST_admininstr(nt, c_1) TESTOP_admininstr(nt, testop)], [CONST_admininstr(I32_numtype, c)])
-    -- where c = $testop(testop, nt, c_1)
+    -- if (c = $testop(testop, nt, c_1))
 
   ;; 6-reduction.watsup:133.1-135.40
   rule relop {c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype, relop : relop_numtype}:
     `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) RELOP_admininstr(nt, relop)], [CONST_admininstr(I32_numtype, c)])
-    -- where c = $relop(relop, nt, c_1, c_2)
+    -- if (c = $relop(relop, nt, c_1, c_2))
 
   ;; 6-reduction.watsup:138.1-139.70
   rule extend {c : c_numtype, n : n, nt : numtype, o0 : nat}:
     `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, o0, S_sx, c))])
-    -- where ?(o0) = $size($valtype_numtype(nt))
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
 
   ;; 6-reduction.watsup:142.1-144.48
   rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
     `%*~>%*`([CONST_admininstr(nt_1, c_1) CVTOP_admininstr(nt_2, cvtop, nt_1, sx?{sx})], [CONST_admininstr(nt_2, c)])
-    -- where [c] = $cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1)
+    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [c])
 
   ;; 6-reduction.watsup:146.1-148.54
   rule cvtop-trap {c_1 : c_numtype, cvtop : cvtop, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
@@ -11972,17 +11981,186 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:155.1-157.28
   rule ref.is_null-true {rt : reftype, val : val}:
     `%*~>%*`([$admininstr_val(val) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
-    -- where REF.NULL_val(rt) = val
+    -- if (val = REF.NULL_val(rt))
 
   ;; 6-reduction.watsup:159.1-161.15
   rule ref.is_null-false {val : val}:
     `%*~>%*`([$admininstr_val(val) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
-    -- otherwise
+    -- unless Step_pure_before_ref.is_null-false: `%`([$admininstr_val(val) REF.IS_NULL_admininstr])
 
   ;; 6-reduction.watsup:170.1-171.47
   rule local.tee {val : val, x : idx}:
     `%*~>%*`([$admininstr_val(val) LOCAL.TEE_admininstr(x)], [$admininstr_val(val) $admininstr_val(val) LOCAL.SET_admininstr(x)])
 
+;; 6-reduction.watsup:91.1-93.15
+relation Step_read_before_call_indirect-trap: `%`(config)
+  ;; 6-reduction.watsup:85.1-89.17
+  rule call_indirect-call {a : addr, ft : functype, ft' : functype, i : nat, instr* : instr*, m : moduleinst, t* : valtype*, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
+    -- if (i < |$table(z, x)|)
+    -- if (a < |$funcinst(z)|)
+    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(ft', t*{t}, instr*{instr})))
+    -- if (ft = ft')
+
+;; 6-reduction.watsup:214.1-217.14
+relation Step_read_before_table.fill-zero: `%`(config)
+  ;; 6-reduction.watsup:210.1-212.34
+  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- if ((i + n) > |$table(z, x)|)
+
+;; 6-reduction.watsup:219.1-223.15
+relation Step_read_before_table.fill-succ: `%`(config)
+  ;; 6-reduction.watsup:214.1-217.14
+  rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:210.1-212.34
+  rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
+    -- if ((i + n) > |$table(z, x)|)
+
+;; 6-reduction.watsup:230.1-233.14
+relation Step_read_before_table.copy-zero: `%`(config)
+  ;; 6-reduction.watsup:226.1-228.63
+  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+;; 6-reduction.watsup:235.1-240.15
+relation Step_read_before_table.copy-le: `%`(config)
+  ;; 6-reduction.watsup:230.1-233.14
+  rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- unless Step_read_before_table.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:226.1-228.63
+  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+;; 6-reduction.watsup:242.1-246.15
+relation Step_read_before_table.copy-gt: `%`(config)
+  ;; 6-reduction.watsup:235.1-240.15
+  rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- unless Step_read_before_table.copy-le: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (j <= i)
+
+  ;; 6-reduction.watsup:230.1-233.14
+  rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- unless Step_read_before_table.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:226.1-228.63
+  rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
+    -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+;; 6-reduction.watsup:253.1-256.14
+relation Step_read_before_table.init-zero: `%`(config)
+  ;; 6-reduction.watsup:249.1-251.62
+  rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
+    -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+;; 6-reduction.watsup:258.1-262.15
+relation Step_read_before_table.init-succ: `%`(config)
+  ;; 6-reduction.watsup:253.1-256.14
+  rule table.init-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
+    -- unless Step_read_before_table.init-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:249.1-251.62
+  rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
+    -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
+
+;; 6-reduction.watsup:319.1-322.14
+relation Step_read_before_memory.fill-zero: `%`(config)
+  ;; 6-reduction.watsup:315.1-317.32
+  rule memory.fill-trap {i : nat, n : n, val : val, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]))
+    -- if ((i + n) > |$mem(z, 0)|)
+
+;; 6-reduction.watsup:324.1-328.15
+relation Step_read_before_memory.fill-succ: `%`(config)
+  ;; 6-reduction.watsup:319.1-322.14
+  rule memory.fill-zero {i : nat, n : n, val : val, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]))
+    -- unless Step_read_before_memory.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]))
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:315.1-317.32
+  rule memory.fill-trap {i : nat, n : n, val : val, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]))
+    -- if ((i + n) > |$mem(z, 0)|)
+
+;; 6-reduction.watsup:335.1-338.14
+relation Step_read_before_memory.copy-zero: `%`(config)
+  ;; 6-reduction.watsup:331.1-333.59
+  rule memory.copy-trap {i : nat, j : nat, n : n, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
+    -- if (((i + n) > |$mem(z, 0)|) \/ ((j + n) > |$mem(z, 0)|))
+
+;; 6-reduction.watsup:340.1-345.15
+relation Step_read_before_memory.copy-le: `%`(config)
+  ;; 6-reduction.watsup:335.1-338.14
+  rule memory.copy-zero {i : nat, j : nat, n : n, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
+    -- unless Step_read_before_memory.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:331.1-333.59
+  rule memory.copy-trap {i : nat, j : nat, n : n, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
+    -- if (((i + n) > |$mem(z, 0)|) \/ ((j + n) > |$mem(z, 0)|))
+
+;; 6-reduction.watsup:347.1-351.15
+relation Step_read_before_memory.copy-gt: `%`(config)
+  ;; 6-reduction.watsup:340.1-345.15
+  rule memory.copy-le {i : nat, j : nat, n : n, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
+    -- unless Step_read_before_memory.copy-le: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
+    -- if (j <= i)
+
+  ;; 6-reduction.watsup:335.1-338.14
+  rule memory.copy-zero {i : nat, j : nat, n : n, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
+    -- unless Step_read_before_memory.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:331.1-333.59
+  rule memory.copy-trap {i : nat, j : nat, n : n, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
+    -- if (((i + n) > |$mem(z, 0)|) \/ ((j + n) > |$mem(z, 0)|))
+
+;; 6-reduction.watsup:358.1-361.14
+relation Step_read_before_memory.init-zero: `%`(config)
+  ;; 6-reduction.watsup:354.1-356.60
+  rule memory.init-trap {i : nat, j : nat, n : n, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]))
+    -- if (((i + n) > |$data(z, x)|) \/ ((j + n) > |$mem(z, 0)|))
+
+;; 6-reduction.watsup:363.1-367.15
+relation Step_read_before_memory.init-succ: `%`(config)
+  ;; 6-reduction.watsup:358.1-361.14
+  rule memory.init-zero {i : nat, j : nat, n : n, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]))
+    -- unless Step_read_before_memory.init-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]))
+    -- if (n = 0)
+
+  ;; 6-reduction.watsup:354.1-356.60
+  rule memory.init-trap {i : nat, j : nat, n : n, x : idx, z : state}:
+    `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]))
+    -- if (((i + n) > |$data(z, x)|) \/ ((j + n) > |$mem(z, 0)|))
+
 ;; 6-reduction.watsup:5.1-5.63
 relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:82.1-83.47
@@ -11994,24 +12172,24 @@ relation Step_read: `%~>%*`(config, admininstr*)
   rule call_indirect-call {a : addr, ft : functype, ft' : functype, i : nat, instr* : instr*, m : moduleinst, t* : valtype*, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [CALL_ADDR_admininstr(a)])
     -- if (i < |$table(z, x)|)
-    -- where REF.FUNC_ADDR_ref(a) = $table(z, x)[i]
-    -- where ft' = ft
     -- if (a < |$funcinst(z)|)
-    -- where `%;%`(m, `FUNC%%*%`(ft', t*{t}, instr*{instr})) = $funcinst(z)[a]
+    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(ft', t*{t}, instr*{instr})))
+    -- if (ft = ft')
 
   ;; 6-reduction.watsup:91.1-93.15
   rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [TRAP_admininstr])
-    -- otherwise
+    -- unless Step_read_before_call_indirect-trap: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
 
   ;; 6-reduction.watsup:95.1-98.52
   rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state, o0* : val*}:
     `%~>%*`(`%;%*`(z, $admininstr_val(val)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], $admininstr_instr(instr)*{instr})])])
+    -- if (|t*{t}| = |o0*{o0}|)
     -- if (a < |$funcinst(z)|)
-    -- where `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})) = $funcinst(z)[a]
-    -- where |o0*{o0}| = |t*{t}|
     -- (if ($default_(t) = ?(o0)))*{t o0}
-    -- where f = {LOCAL val^k{val} :: o0*{o0}, MODULE m}
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
+    -- if (f = {LOCAL val^k{val} :: o0*{o0}, MODULE m})
 
   ;; 6-reduction.watsup:151.1-152.53
   rule ref.func {x : idx, z : state}:
@@ -12039,7 +12217,7 @@ relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:198.1-200.27
   rule table.size {n : n, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]), [CONST_admininstr(I32_numtype, n)])
-    -- where n = |$table(z, x)|
+    -- if (|$table(z, x)| = n)
 
   ;; 6-reduction.watsup:210.1-212.34
   rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
@@ -12049,13 +12227,13 @@ relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:214.1-217.14
   rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
-    -- otherwise
+    -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
     -- if (n = 0)
 
   ;; 6-reduction.watsup:219.1-223.15
   rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) $admininstr_val(val) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) $admininstr_val(val) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
-    -- otherwise
+    -- unless Step_read_before_table.fill-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
 
   ;; 6-reduction.watsup:226.1-228.63
   rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
@@ -12065,19 +12243,19 @@ relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:230.1-233.14
   rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [])
-    -- otherwise
+    -- unless Step_read_before_table.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- if (n = 0)
 
   ;; 6-reduction.watsup:235.1-240.15
   rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
-    -- otherwise
+    -- unless Step_read_before_table.copy-le: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- if (j <= i)
 
   ;; 6-reduction.watsup:242.1-246.15
   rule table.copy-gt {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, ((j + n) - 1)) CONST_admininstr(I32_numtype, ((i + n) - 1)) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
-    -- otherwise
+    -- unless Step_read_before_table.copy-gt: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
 
   ;; 6-reduction.watsup:249.1-251.62
   rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
@@ -12087,27 +12265,27 @@ relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:253.1-256.14
   rule table.init-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [])
-    -- otherwise
+    -- unless Step_read_before_table.init-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
     -- if (n = 0)
 
   ;; 6-reduction.watsup:258.1-262.15
   rule table.init-succ {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) $admininstr_ref($elem(z, y)[i]) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
-    -- otherwise
     -- if (i < |$elem(z, y)|)
+    -- unless Step_read_before_table.init-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
 
   ;; 6-reduction.watsup:269.1-271.48
   rule load-num-trap {i : nat, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) LOAD_admininstr(nt, ?(), n_A, n_O)]), [TRAP_admininstr])
-    -- where ?(o0) = $size($valtype_numtype(nt))
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
     -- if (((i + n_O) + (o0 / 8)) > |$mem(z, 0)|)
 
   ;; 6-reduction.watsup:273.1-275.66
   rule load-num-val {c : c_numtype, i : nat, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat, o1 : nat}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) LOAD_admininstr(nt, ?(), n_A, n_O)]), [CONST_admininstr(nt, c)])
-    -- where ?(o0) = $size($valtype_numtype(nt))
-    -- where ?(o1) = $size($valtype_numtype(nt))
-    -- where $bytes_(o0, c) = $mem(z, 0)[(i + n_O) : (o1 / 8)]
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- if ($size($valtype_numtype(nt)) = ?(o1))
+    -- if ($bytes_(o0, c) = $mem(z, 0)[(i + n_O) : (o1 / 8)])
 
   ;; 6-reduction.watsup:277.1-279.40
   rule load-pack-trap {i : nat, n : n, n_A : n, n_O : n, nt : numtype, sx : sx, z : state}:
@@ -12117,13 +12295,13 @@ relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:281.1-283.50
   rule load-pack-val {c : c_numtype, i : nat, n : n, n_A : n, n_O : n, nt : numtype, sx : sx, z : state, o0 : nat}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) LOAD_admininstr(nt, ?((n, sx)), n_A, n_O)]), [CONST_admininstr(nt, $ext(n, o0, sx, c))])
-    -- where ?(o0) = $size($valtype_numtype(nt))
-    -- where $bytes_(n, c) = $mem(z, 0)[(i + n_O) : (n / 8)]
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- if ($bytes_(n, c) = $mem(z, 0)[(i + n_O) : (n / 8)])
 
   ;; 6-reduction.watsup:303.1-305.39
   rule memory.size {n : n, z : state}:
     `%~>%*`(`%;%*`(z, [MEMORY.SIZE_admininstr]), [CONST_admininstr(I32_numtype, n)])
-    -- where ((n * 64) * $Ki) = |$mem(z, 0)|
+    -- if (((n * 64) * $Ki) = |$mem(z, 0)|)
 
   ;; 6-reduction.watsup:315.1-317.32
   rule memory.fill-trap {i : nat, n : n, val : val, z : state}:
@@ -12133,13 +12311,13 @@ relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:319.1-322.14
   rule memory.fill-zero {i : nat, n : n, val : val, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]), [])
-    -- otherwise
+    -- unless Step_read_before_memory.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]))
     -- if (n = 0)
 
   ;; 6-reduction.watsup:324.1-328.15
   rule memory.fill-succ {i : nat, n : n, val : val, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]), [CONST_admininstr(I32_numtype, i) $admininstr_val(val) STORE_admininstr(I32_numtype, ?(8), 0, 0) CONST_admininstr(I32_numtype, (i + 1)) $admininstr_val(val) CONST_admininstr(I32_numtype, (n - 1)) MEMORY.FILL_admininstr])
-    -- otherwise
+    -- unless Step_read_before_memory.fill-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]))
 
   ;; 6-reduction.watsup:331.1-333.59
   rule memory.copy-trap {i : nat, j : nat, n : n, z : state}:
@@ -12149,19 +12327,19 @@ relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:335.1-338.14
   rule memory.copy-zero {i : nat, j : nat, n : n, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]), [])
-    -- otherwise
+    -- unless Step_read_before_memory.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
     -- if (n = 0)
 
   ;; 6-reduction.watsup:340.1-345.15
   rule memory.copy-le {i : nat, j : nat, n : n, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) LOAD_admininstr(I32_numtype, ?((8, U_sx)), 0, 0) STORE_admininstr(I32_numtype, ?(8), 0, 0) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) MEMORY.COPY_admininstr])
-    -- otherwise
+    -- unless Step_read_before_memory.copy-le: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
     -- if (j <= i)
 
   ;; 6-reduction.watsup:347.1-351.15
   rule memory.copy-gt {i : nat, j : nat, n : n, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]), [CONST_admininstr(I32_numtype, ((j + n) - 1)) CONST_admininstr(I32_numtype, ((i + n) - 1)) LOAD_admininstr(I32_numtype, ?((8, U_sx)), 0, 0) STORE_admininstr(I32_numtype, ?(8), 0, 0) CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, (n - 1)) MEMORY.COPY_admininstr])
-    -- otherwise
+    -- unless Step_read_before_memory.copy-gt: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
 
   ;; 6-reduction.watsup:354.1-356.60
   rule memory.init-trap {i : nat, j : nat, n : n, x : idx, z : state}:
@@ -12171,14 +12349,14 @@ relation Step_read: `%~>%*`(config, admininstr*)
   ;; 6-reduction.watsup:358.1-361.14
   rule memory.init-zero {i : nat, j : nat, n : n, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]), [])
-    -- otherwise
+    -- unless Step_read_before_memory.init-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]))
     -- if (n = 0)
 
   ;; 6-reduction.watsup:363.1-367.15
   rule memory.init-succ {i : nat, j : nat, n : n, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, $data(z, x)[i]) STORE_admininstr(I32_numtype, ?(8), 0, 0) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) MEMORY.INIT_admininstr(x)])
-    -- otherwise
     -- if (i < |$data(z, x)|)
+    -- unless Step_read_before_memory.init-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]))
 
 ;; 6-reduction.watsup:3.1-3.63
 relation Step: `%~>%`(config, config)
@@ -12225,15 +12403,15 @@ relation Step: `%~>%`(config, config)
   ;; 6-reduction.watsup:286.1-288.48
   rule store-num-trap {c : c_numtype, i : nat, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat}:
     `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(nt, c) STORE_admininstr(nt, ?(), n_A, n_O)]), `%;%*`(z, [TRAP_admininstr]))
-    -- where ?(o0) = $size($valtype_numtype(nt))
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
     -- if (((i + n_O) + (o0 / 8)) > |$mem(z, 0)|)
 
   ;; 6-reduction.watsup:290.1-292.35
   rule store-num-val {b* : byte*, c : c_numtype, i : nat, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat, o1 : nat}:
     `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(nt, c) STORE_admininstr(nt, ?(), n_A, n_O)]), `%;%*`($with_mem(z, 0, (i + n_O), (o0 / 8), b*{b}), []))
-    -- where ?(o0) = $size($valtype_numtype(nt))
-    -- where ?(o1) = $size($valtype_numtype(nt))
-    -- where b*{b} = $bytes_(o1, c)
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- if ($size($valtype_numtype(nt)) = ?(o1))
+    -- if (b*{b} = $bytes_(o1, c))
 
   ;; 6-reduction.watsup:294.1-296.40
   rule store-pack-trap {c : c_numtype, i : nat, n : n, n_A : n, n_O : n, nt : numtype, z : state}:
@@ -12243,8 +12421,8 @@ relation Step: `%~>%`(config, config)
   ;; 6-reduction.watsup:298.1-300.50
   rule store-pack-val {b* : byte*, c : c_numtype, i : nat, n : n, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat}:
     `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(nt, c) STORE_admininstr(nt, ?(n), n_A, n_O)]), `%;%*`($with_mem(z, 0, (i + n_O), (n / 8), b*{b}), []))
-    -- where ?(o0) = $size($valtype_numtype(nt))
-    -- where b*{b} = $bytes_(n, $wrap_((o0, n), c))
+    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- if (b*{b} = $bytes_(n, $wrap_((o0, n), c)))
 
   ;; 6-reduction.watsup:308.1-309.117
   rule memory.grow-succeed {n : n, z : state}:
@@ -12259,7 +12437,10 @@ relation Step: `%~>%`(config, config)
     `%~>%`(`%;%*`(z, [DATA.DROP_admininstr(x)]), `%;%*`($with_data(z, x, []), []))
 
 == IL Validation...
-== Else elimination
+== Animate
+Animation failed:if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(ft', t*{t}, instr*{instr})))
+Animation failed:if ($bytes_(o0, c) = $mem(z, 0)[(i + n_O) : (o1 / 8)])
+Animation failed:if ($bytes_(n, c) = $mem(z, 0)[(i + n_O) : (n / 8)])
 
 ;; 1-syntax.watsup:3.1-3.15
 syntax n = nat
@@ -13102,10 +13283,10 @@ relation InstrSeq_ok: `%|-%*:%`(context, instr*, functype)
     -- InstrSeq_ok: `%|-%*:%`(C, [instr_2], `%->%`(t_2*{t_2}, t_3*{t_3}))
 
   ;; 3-typing.watsup:141.1-146.38
-  rule weak {C : context, instr* : instr*, t'_1 : valtype, t'_2* : valtype*, t_1* : valtype*, t_2* : valtype*}:
-    `%|-%*:%`(C, instr*{instr}, `%->%`([t'_1], t'_2*{t'_2}))
+  rule weak {C : context, instr* : instr*, t'_1* : valtype*, t'_2* : valtype*, t_1* : valtype*, t_2* : valtype*}:
+    `%|-%*:%`(C, instr*{instr}, `%->%`(t'_1*{t'_1}, t'_2*{t'_2}))
     -- InstrSeq_ok: `%|-%*:%`(C, instr*{instr}, `%->%`(t_1*{t_1}, t_2*{t_2}))
-    -- Resulttype_sub: `|-%*<:%*`(t'_1*{}, t_1*{t_1})
+    -- Resulttype_sub: `|-%*<:%*`(t'_1*{t'_1}, t_1*{t_1})
     -- Resulttype_sub: `|-%*<:%*`(t_2*{t_2}, t'_2*{t'_2})
 
   ;; 3-typing.watsup:148.1-150.45
@@ -13283,7 +13464,6 @@ relation Module_ok: `|-%:OK`(module)
     -- if (|table*{table}| = |tt*{tt}|)
     -- if (|mem*{mem}| = |mt*{mt}|)
     -- if (|elem*{elem}| = |rt*{rt}|)
-    -- if (|data^n{data}| = n)
     -- if (C = {FUNC ft*{ft}, GLOBAL gt*{gt}, TABLE tt*{tt}, MEM mt*{mt}, ELEM rt*{rt}, DATA OK^n{}, LOCAL [], LABEL [], RETURN ?()})
     -- (Func_ok: `%|-%:%`(C, func, ft))*{ft func}
     -- (Global_ok: `%|-%:%`(C, global, gt))*{global gt}
@@ -13458,7 +13638,7 @@ syntax admininstr =
 }
 
 def admininstr_globalinst : globalinst -> admininstr
-  def {x : (numtype, c_numtype)} admininstr_globalinst(CONST_val(x)) = CONST_admininstr(x)
+  def {x0 : numtype, x1 : c_numtype} admininstr_globalinst(CONST_val(x0, x1)) = CONST_admininstr(x0, x1)
   def {x : reftype} admininstr_globalinst(REF.NULL_val(x)) = REF.NULL_admininstr(x)
   def {x : funcaddr} admininstr_globalinst(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
   def {x : hostaddr} admininstr_globalinst(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
@@ -13468,22 +13648,22 @@ def admininstr_instr : instr -> admininstr
   def admininstr_instr(NOP_instr) = NOP_admininstr
   def admininstr_instr(DROP_instr) = DROP_admininstr
   def {x : valtype?} admininstr_instr(SELECT_instr(x)) = SELECT_admininstr(x)
-  def {x : (blocktype, instr*)} admininstr_instr(BLOCK_instr(x)) = BLOCK_admininstr(x)
-  def {x : (blocktype, instr*)} admininstr_instr(LOOP_instr(x)) = LOOP_admininstr(x)
-  def {x : (blocktype, instr*, instr*)} admininstr_instr(IF_instr(x)) = IF_admininstr(x)
+  def {x0 : blocktype, x1 : instr*} admininstr_instr(BLOCK_instr(x0, x1)) = BLOCK_admininstr(x0, x1)
+  def {x0 : blocktype, x1 : instr*} admininstr_instr(LOOP_instr(x0, x1)) = LOOP_admininstr(x0, x1)
+  def {x0 : blocktype, x1 : instr*, x2 : instr*} admininstr_instr(IF_instr(x0, x1, x2)) = IF_admininstr(x0, x1, x2)
   def {x : labelidx} admininstr_instr(BR_instr(x)) = BR_admininstr(x)
   def {x : labelidx} admininstr_instr(BR_IF_instr(x)) = BR_IF_admininstr(x)
-  def {x : (labelidx*, labelidx)} admininstr_instr(BR_TABLE_instr(x)) = BR_TABLE_admininstr(x)
+  def {x0 : labelidx*, x1 : labelidx} admininstr_instr(BR_TABLE_instr(x0, x1)) = BR_TABLE_admininstr(x0, x1)
   def {x : funcidx} admininstr_instr(CALL_instr(x)) = CALL_admininstr(x)
-  def {x : (tableidx, functype)} admininstr_instr(CALL_INDIRECT_instr(x)) = CALL_INDIRECT_admininstr(x)
+  def {x0 : tableidx, x1 : functype} admininstr_instr(CALL_INDIRECT_instr(x0, x1)) = CALL_INDIRECT_admininstr(x0, x1)
   def admininstr_instr(RETURN_instr) = RETURN_admininstr
-  def {x : (numtype, c_numtype)} admininstr_instr(CONST_instr(x)) = CONST_admininstr(x)
-  def {x : (numtype, unop_numtype)} admininstr_instr(UNOP_instr(x)) = UNOP_admininstr(x)
-  def {x : (numtype, binop_numtype)} admininstr_instr(BINOP_instr(x)) = BINOP_admininstr(x)
-  def {x : (numtype, testop_numtype)} admininstr_instr(TESTOP_instr(x)) = TESTOP_admininstr(x)
-  def {x : (numtype, relop_numtype)} admininstr_instr(RELOP_instr(x)) = RELOP_admininstr(x)
-  def {x : (numtype, n)} admininstr_instr(EXTEND_instr(x)) = EXTEND_admininstr(x)
-  def {x : (numtype, cvtop, numtype, sx?)} admininstr_instr(CVTOP_instr(x)) = CVTOP_admininstr(x)
+  def {x0 : numtype, x1 : c_numtype} admininstr_instr(CONST_instr(x0, x1)) = CONST_admininstr(x0, x1)
+  def {x0 : numtype, x1 : unop_numtype} admininstr_instr(UNOP_instr(x0, x1)) = UNOP_admininstr(x0, x1)
+  def {x0 : numtype, x1 : binop_numtype} admininstr_instr(BINOP_instr(x0, x1)) = BINOP_admininstr(x0, x1)
+  def {x0 : numtype, x1 : testop_numtype} admininstr_instr(TESTOP_instr(x0, x1)) = TESTOP_admininstr(x0, x1)
+  def {x0 : numtype, x1 : relop_numtype} admininstr_instr(RELOP_instr(x0, x1)) = RELOP_admininstr(x0, x1)
+  def {x0 : numtype, x1 : n} admininstr_instr(EXTEND_instr(x0, x1)) = EXTEND_admininstr(x0, x1)
+  def {x0 : numtype, x1 : cvtop, x2 : numtype, x3 : sx?} admininstr_instr(CVTOP_instr(x0, x1, x2, x3)) = CVTOP_admininstr(x0, x1, x2, x3)
   def {x : reftype} admininstr_instr(REF.NULL_instr(x)) = REF.NULL_admininstr(x)
   def {x : funcidx} admininstr_instr(REF.FUNC_instr(x)) = REF.FUNC_admininstr(x)
   def admininstr_instr(REF.IS_NULL_instr) = REF.IS_NULL_admininstr
@@ -13497,8 +13677,8 @@ def admininstr_instr : instr -> admininstr
   def {x : tableidx} admininstr_instr(TABLE.SIZE_instr(x)) = TABLE.SIZE_admininstr(x)
   def {x : tableidx} admininstr_instr(TABLE.GROW_instr(x)) = TABLE.GROW_admininstr(x)
   def {x : tableidx} admininstr_instr(TABLE.FILL_instr(x)) = TABLE.FILL_admininstr(x)
-  def {x : (tableidx, tableidx)} admininstr_instr(TABLE.COPY_instr(x)) = TABLE.COPY_admininstr(x)
-  def {x : (tableidx, elemidx)} admininstr_instr(TABLE.INIT_instr(x)) = TABLE.INIT_admininstr(x)
+  def {x0 : tableidx, x1 : tableidx} admininstr_instr(TABLE.COPY_instr(x0, x1)) = TABLE.COPY_admininstr(x0, x1)
+  def {x0 : tableidx, x1 : elemidx} admininstr_instr(TABLE.INIT_instr(x0, x1)) = TABLE.INIT_admininstr(x0, x1)
   def {x : elemidx} admininstr_instr(ELEM.DROP_instr(x)) = ELEM.DROP_admininstr(x)
   def admininstr_instr(MEMORY.SIZE_instr) = MEMORY.SIZE_admininstr
   def admininstr_instr(MEMORY.GROW_instr) = MEMORY.GROW_admininstr
@@ -13506,8 +13686,8 @@ def admininstr_instr : instr -> admininstr
   def admininstr_instr(MEMORY.COPY_instr) = MEMORY.COPY_admininstr
   def {x : dataidx} admininstr_instr(MEMORY.INIT_instr(x)) = MEMORY.INIT_admininstr(x)
   def {x : dataidx} admininstr_instr(DATA.DROP_instr(x)) = DATA.DROP_admininstr(x)
-  def {x : (numtype, (n, sx)?, u32, u32)} admininstr_instr(LOAD_instr(x)) = LOAD_admininstr(x)
-  def {x : (numtype, n?, u32, u32)} admininstr_instr(STORE_instr(x)) = STORE_admininstr(x)
+  def {x0 : numtype, x1 : (n, sx)?, x2 : u32, x3 : u32} admininstr_instr(LOAD_instr(x0, x1, x2, x3)) = LOAD_admininstr(x0, x1, x2, x3)
+  def {x0 : numtype, x1 : n?, x2 : u32, x3 : u32} admininstr_instr(STORE_instr(x0, x1, x2, x3)) = STORE_admininstr(x0, x1, x2, x3)
 
 def admininstr_ref : ref -> admininstr
   def {x : reftype} admininstr_ref(REF.NULL_ref(x)) = REF.NULL_admininstr(x)
@@ -13515,7 +13695,7 @@ def admininstr_ref : ref -> admininstr
   def {x : hostaddr} admininstr_ref(REF.HOST_ADDR_ref(x)) = REF.HOST_ADDR_admininstr(x)
 
 def admininstr_val : val -> admininstr
-  def {x : (numtype, c_numtype)} admininstr_val(CONST_val(x)) = CONST_admininstr(x)
+  def {x0 : numtype, x1 : c_numtype} admininstr_val(CONST_val(x0, x1)) = CONST_admininstr(x0, x1)
   def {x : reftype} admininstr_val(REF.NULL_val(x)) = REF.NULL_admininstr(x)
   def {x : funcaddr} admininstr_val(REF.FUNC_ADDR_val(x)) = REF.FUNC_ADDR_admininstr(x)
   def {x : hostaddr} admininstr_val(REF.HOST_ADDR_val(x)) = REF.HOST_ADDR_admininstr(x)
@@ -13600,13 +13780,13 @@ def with_memext : (state, tableidx, byte*) -> state
 
 ;; 4-runtime.watsup:131.1-131.77
 def with_elem : (state, elemidx, ref*) -> state
-  ;; 4-runtime.watsup:140.1-140.69
-  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[TABLE_store[f.MODULE_frame.TABLE_moduleinst[x]] = r*{r}], f)
+  ;; 4-runtime.watsup:140.1-140.67
+  def {f : frame, r* : ref*, s : store, x : idx} with_elem(`%;%`(s, f), x, r*{r}) = `%;%`(s[ELEM_store[f.MODULE_frame.ELEM_moduleinst[x]] = r*{r}], f)
 
 ;; 4-runtime.watsup:132.1-132.77
 def with_data : (state, dataidx, byte*) -> state
-  ;; 4-runtime.watsup:141.1-141.65
-  def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[MEM_store[f.MODULE_frame.MEM_moduleinst[x]] = b*{b}], f)
+  ;; 4-runtime.watsup:141.1-141.67
+  def {b* : byte*, f : frame, s : store, x : idx} with_data(`%;%`(s, f), x, b*{b}) = `%;%`(s[DATA_store[f.MODULE_frame.DATA_moduleinst[x]] = b*{b}], f)
 
 ;; 4-runtime.watsup:155.1-158.21
 rec {
@@ -13642,9 +13822,9 @@ def wrap_ : ((nat, nat), c_numtype) -> nat
 ;; 5-numerics.watsup:13.1-13.28
 def bytes_ : (nat, c_numtype) -> byte*
 
-;; 6-reduction.watsup:158.1-160.15
+;; 6-reduction.watsup:159.1-161.15
 relation Step_pure_before_ref.is_null-false: `%`(admininstr*)
-  ;; 6-reduction.watsup:154.1-156.28
+  ;; 6-reduction.watsup:155.1-157.28
   rule ref.is_null-true {rt : reftype, val : val}:
     `%`([$admininstr_val(val) REF.IS_NULL_admininstr])
     -- if (val = REF.NULL_val(rt))
@@ -13676,18 +13856,12 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:35.1-37.28
   rule block {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
     `%*~>%*`($admininstr_val(val)^k{val} :: [BLOCK_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [], $admininstr_val(val)^k{val} :: $admininstr_instr(instr)*{instr})])
-    -- if (|t_1^k{t_1}| = k)
-    -- if (|t_2^n{t_2}| = n)
-    -- if (|val^k{val}| = k)
-    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
+    -- where `%->%`(t_1^k{t_1}, t_2^n{t_2}) = bt
 
   ;; 6-reduction.watsup:39.1-41.28
   rule loop {bt : blocktype, instr* : instr*, k : nat, n : n, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k}:
-    `%*~>%*`($admininstr_val(val)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(n, [LOOP_instr(bt, instr*{instr})], $admininstr_val(val)^k{val} :: $admininstr_instr(instr)*{instr})])
-    -- if (|t_1^k{t_1}| = k)
-    -- if (|t_2^n{t_2}| = n)
-    -- if (|val^k{val}| = k)
-    -- if (bt = `%->%`(t_1^k{t_1}, t_2^n{t_2}))
+    `%*~>%*`($admininstr_val(val)^k{val} :: [LOOP_admininstr(bt, instr*{instr})], [LABEL__admininstr(k, [LOOP_instr(bt, instr*{instr})], $admininstr_val(val)^k{val} :: $admininstr_instr(instr)*{instr})])
+    -- where `%->%`(t_1^k{t_1}, t_2^n{t_2}) = bt
 
   ;; 6-reduction.watsup:43.1-45.16
   rule if-true {bt : blocktype, c : c_numtype, instr_1* : instr*, instr_2* : instr*}:
@@ -13706,7 +13880,6 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
   ;; 6-reduction.watsup:57.1-58.69
   rule br-zero {instr* : instr*, instr'* : instr*, n : n, val^n : val^n, val'* : val*}:
     `%*~>%*`([LABEL__admininstr(n, instr'*{instr'}, $admininstr_val(val')*{val'} :: $admininstr_val(val)^n{val} :: [BR_admininstr(0)] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)^n{val} :: $admininstr_instr(instr')*{instr'})
-    -- if (|val^n{val}| = n)
 
   ;; 6-reduction.watsup:60.1-61.65
   rule br-succ {instr* : instr*, instr'* : instr*, l : labelidx, n : n, val* : val*}:
@@ -13732,246 +13905,245 @@ relation Step_pure: `%*~>%*`(admininstr*, admininstr*)
     `%*~>%*`([CONST_admininstr(I32_numtype, i) BR_TABLE_admininstr(l*{l}, l')], [BR_admininstr(l')])
     -- if (i >= |l*{l}|)
 
-  ;; 6-reduction.watsup:100.1-101.35
+  ;; 6-reduction.watsup:101.1-102.35
   rule frame-vals {f : frame, n : n, val^n : val^n}:
     `%*~>%*`([FRAME__admininstr(n, f, $admininstr_val(val)^n{val})], $admininstr_val(val)^n{val})
-    -- if (|val^n{val}| = n)
 
-  ;; 6-reduction.watsup:103.1-104.55
+  ;; 6-reduction.watsup:104.1-105.55
   rule return-frame {f : frame, instr* : instr*, n : n, val^n : val^n, val'* : val*}:
     `%*~>%*`([FRAME__admininstr(n, f, $admininstr_val(val')*{val'} :: $admininstr_val(val)^n{val} :: [RETURN_admininstr] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)^n{val})
-    -- if (|val^n{val}| = n)
 
-  ;; 6-reduction.watsup:106.1-107.60
+  ;; 6-reduction.watsup:107.1-108.60
   rule return-label {instr* : instr*, instr'* : instr*, k : nat, val* : val*}:
     `%*~>%*`([LABEL__admininstr(k, instr'*{instr'}, $admininstr_val(val)*{val} :: [RETURN_admininstr] :: $admininstr_instr(instr)*{instr})], $admininstr_val(val)*{val} :: [RETURN_admininstr])
 
-  ;; 6-reduction.watsup:110.1-112.33
+  ;; 6-reduction.watsup:111.1-113.33
   rule unop-val {c : c_numtype, c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
     `%*~>%*`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)], [CONST_admininstr(nt, c)])
-    -- if ($unop(unop, nt, c_1) = [c])
+    -- where [c] = $unop(unop, nt, c_1)
 
-  ;; 6-reduction.watsup:114.1-116.39
+  ;; 6-reduction.watsup:115.1-117.39
   rule unop-trap {c_1 : c_numtype, nt : numtype, unop : unop_numtype}:
     `%*~>%*`([CONST_admininstr(nt, c_1) UNOP_admininstr(nt, unop)], [TRAP_admininstr])
     -- if ($unop(unop, nt, c_1) = [])
 
-  ;; 6-reduction.watsup:119.1-121.40
+  ;; 6-reduction.watsup:120.1-122.40
   rule binop-val {binop : binop_numtype, c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
     `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)], [CONST_admininstr(nt, c)])
-    -- if ($binop(binop, nt, c_1, c_2) = [c])
+    -- where [c] = $binop(binop, nt, c_1, c_2)
 
-  ;; 6-reduction.watsup:123.1-125.46
+  ;; 6-reduction.watsup:124.1-126.46
   rule binop-trap {binop : binop_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype}:
     `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) BINOP_admininstr(nt, binop)], [TRAP_admininstr])
     -- if ($binop(binop, nt, c_1, c_2) = [])
 
-  ;; 6-reduction.watsup:128.1-130.37
+  ;; 6-reduction.watsup:129.1-131.37
   rule testop {c : c_numtype, c_1 : c_numtype, nt : numtype, testop : testop_numtype}:
     `%*~>%*`([CONST_admininstr(nt, c_1) TESTOP_admininstr(nt, testop)], [CONST_admininstr(I32_numtype, c)])
-    -- if (c = $testop(testop, nt, c_1))
+    -- where c = $testop(testop, nt, c_1)
 
-  ;; 6-reduction.watsup:132.1-134.40
+  ;; 6-reduction.watsup:133.1-135.40
   rule relop {c : c_numtype, c_1 : c_numtype, c_2 : c_numtype, nt : numtype, relop : relop_numtype}:
     `%*~>%*`([CONST_admininstr(nt, c_1) CONST_admininstr(nt, c_2) RELOP_admininstr(nt, relop)], [CONST_admininstr(I32_numtype, c)])
-    -- if (c = $relop(relop, nt, c_1, c_2))
+    -- where c = $relop(relop, nt, c_1, c_2)
 
-  ;; 6-reduction.watsup:137.1-138.70
+  ;; 6-reduction.watsup:138.1-139.70
   rule extend {c : c_numtype, n : n, nt : numtype, o0 : nat}:
     `%*~>%*`([CONST_admininstr(nt, c) EXTEND_admininstr(nt, n)], [CONST_admininstr(nt, $ext(n, o0, S_sx, c))])
-    -- if ($size($valtype_numtype(nt)) = ?(o0))
+    -- where ?(o0) = $size($valtype_numtype(nt))
 
-  ;; 6-reduction.watsup:141.1-143.48
-  rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
-    `%*~>%*`([CONST_admininstr(nt, c_1) CVTOP_admininstr(nt_1, cvtop, nt_2, sx?{sx})], [CONST_admininstr(nt, c)])
-    -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [c])
+  ;; 6-reduction.watsup:142.1-144.48
+  rule cvtop-val {c : c_numtype, c_1 : c_numtype, cvtop : cvtop, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
+    `%*~>%*`([CONST_admininstr(nt_1, c_1) CVTOP_admininstr(nt_2, cvtop, nt_1, sx?{sx})], [CONST_admininstr(nt_2, c)])
+    -- where [c] = $cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1)
 
-  ;; 6-reduction.watsup:145.1-147.54
-  rule cvtop-trap {c_1 : c_numtype, cvtop : cvtop, nt : numtype, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
-    `%*~>%*`([CONST_admininstr(nt, c_1) CVTOP_admininstr(nt_1, cvtop, nt_2, sx?{sx})], [TRAP_admininstr])
+  ;; 6-reduction.watsup:146.1-148.54
+  rule cvtop-trap {c_1 : c_numtype, cvtop : cvtop, nt_1 : numtype, nt_2 : numtype, sx? : sx?}:
+    `%*~>%*`([CONST_admininstr(nt_1, c_1) CVTOP_admininstr(nt_2, cvtop, nt_1, sx?{sx})], [TRAP_admininstr])
     -- if ($cvtop(nt_1, cvtop, nt_2, sx?{sx}, c_1) = [])
 
-  ;; 6-reduction.watsup:154.1-156.28
+  ;; 6-reduction.watsup:155.1-157.28
   rule ref.is_null-true {rt : reftype, val : val}:
     `%*~>%*`([$admininstr_val(val) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 1)])
-    -- if (val = REF.NULL_val(rt))
+    -- where REF.NULL_val(rt) = val
 
-  ;; 6-reduction.watsup:158.1-160.15
+  ;; 6-reduction.watsup:159.1-161.15
   rule ref.is_null-false {val : val}:
     `%*~>%*`([$admininstr_val(val) REF.IS_NULL_admininstr], [CONST_admininstr(I32_numtype, 0)])
     -- unless Step_pure_before_ref.is_null-false: `%`([$admininstr_val(val) REF.IS_NULL_admininstr])
 
-  ;; 6-reduction.watsup:169.1-170.47
+  ;; 6-reduction.watsup:170.1-171.47
   rule local.tee {val : val, x : idx}:
     `%*~>%*`([$admininstr_val(val) LOCAL.TEE_admininstr(x)], [$admininstr_val(val) $admininstr_val(val) LOCAL.SET_admininstr(x)])
 
-;; 6-reduction.watsup:90.1-92.15
+;; 6-reduction.watsup:91.1-93.15
 relation Step_read_before_call_indirect-trap: `%`(config)
-  ;; 6-reduction.watsup:85.1-88.34
-  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
+  ;; 6-reduction.watsup:85.1-89.17
+  rule call_indirect-call {a : addr, ft : functype, ft' : functype, i : nat, instr* : instr*, m : moduleinst, t* : valtype*, x : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
     -- if (i < |$table(z, x)|)
     -- if (a < |$funcinst(z)|)
     -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
-    -- if ($funcinst(z)[a] = `%;%`(m, func))
+    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(ft', t*{t}, instr*{instr})))
+    -- if (ft = ft')
 
-;; 6-reduction.watsup:213.1-216.14
+;; 6-reduction.watsup:214.1-217.14
 relation Step_read_before_table.fill-zero: `%`(config)
-  ;; 6-reduction.watsup:209.1-211.34
+  ;; 6-reduction.watsup:210.1-212.34
   rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
     -- if ((i + n) > |$table(z, x)|)
 
-;; 6-reduction.watsup:218.1-222.15
+;; 6-reduction.watsup:219.1-223.15
 relation Step_read_before_table.fill-succ: `%`(config)
-  ;; 6-reduction.watsup:213.1-216.14
+  ;; 6-reduction.watsup:214.1-217.14
   rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
     -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
     -- if (n = 0)
 
-  ;; 6-reduction.watsup:209.1-211.34
+  ;; 6-reduction.watsup:210.1-212.34
   rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
     -- if ((i + n) > |$table(z, x)|)
 
-;; 6-reduction.watsup:229.1-232.14
+;; 6-reduction.watsup:230.1-233.14
 relation Step_read_before_table.copy-zero: `%`(config)
-  ;; 6-reduction.watsup:225.1-227.63
+  ;; 6-reduction.watsup:226.1-228.63
   rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
 
-;; 6-reduction.watsup:234.1-239.15
+;; 6-reduction.watsup:235.1-240.15
 relation Step_read_before_table.copy-le: `%`(config)
-  ;; 6-reduction.watsup:229.1-232.14
+  ;; 6-reduction.watsup:230.1-233.14
   rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- unless Step_read_before_table.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- if (n = 0)
 
-  ;; 6-reduction.watsup:225.1-227.63
+  ;; 6-reduction.watsup:226.1-228.63
   rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
 
-;; 6-reduction.watsup:241.1-245.15
+;; 6-reduction.watsup:242.1-246.15
 relation Step_read_before_table.copy-gt: `%`(config)
-  ;; 6-reduction.watsup:234.1-239.15
+  ;; 6-reduction.watsup:235.1-240.15
   rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- unless Step_read_before_table.copy-le: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- if (j <= i)
 
-  ;; 6-reduction.watsup:229.1-232.14
+  ;; 6-reduction.watsup:230.1-233.14
   rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- unless Step_read_before_table.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- if (n = 0)
 
-  ;; 6-reduction.watsup:225.1-227.63
+  ;; 6-reduction.watsup:226.1-228.63
   rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
 
-;; 6-reduction.watsup:252.1-255.14
+;; 6-reduction.watsup:253.1-256.14
 relation Step_read_before_table.init-zero: `%`(config)
-  ;; 6-reduction.watsup:248.1-250.62
+  ;; 6-reduction.watsup:249.1-251.62
   rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
     -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
 
-;; 6-reduction.watsup:257.1-261.15
+;; 6-reduction.watsup:258.1-262.15
 relation Step_read_before_table.init-succ: `%`(config)
-  ;; 6-reduction.watsup:252.1-255.14
+  ;; 6-reduction.watsup:253.1-256.14
   rule table.init-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
     -- unless Step_read_before_table.init-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
     -- if (n = 0)
 
-  ;; 6-reduction.watsup:248.1-250.62
+  ;; 6-reduction.watsup:249.1-251.62
   rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
     -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
 
-;; 6-reduction.watsup:313.1-316.14
+;; 6-reduction.watsup:319.1-322.14
 relation Step_read_before_memory.fill-zero: `%`(config)
-  ;; 6-reduction.watsup:309.1-311.32
+  ;; 6-reduction.watsup:315.1-317.32
   rule memory.fill-trap {i : nat, n : n, val : val, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]))
     -- if ((i + n) > |$mem(z, 0)|)
 
-;; 6-reduction.watsup:318.1-322.15
+;; 6-reduction.watsup:324.1-328.15
 relation Step_read_before_memory.fill-succ: `%`(config)
-  ;; 6-reduction.watsup:313.1-316.14
+  ;; 6-reduction.watsup:319.1-322.14
   rule memory.fill-zero {i : nat, n : n, val : val, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]))
     -- unless Step_read_before_memory.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]))
     -- if (n = 0)
 
-  ;; 6-reduction.watsup:309.1-311.32
+  ;; 6-reduction.watsup:315.1-317.32
   rule memory.fill-trap {i : nat, n : n, val : val, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]))
     -- if ((i + n) > |$mem(z, 0)|)
 
-;; 6-reduction.watsup:329.1-332.14
+;; 6-reduction.watsup:335.1-338.14
 relation Step_read_before_memory.copy-zero: `%`(config)
-  ;; 6-reduction.watsup:325.1-327.63
+  ;; 6-reduction.watsup:331.1-333.59
   rule memory.copy-trap {i : nat, j : nat, n : n, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
-    -- if (((i + n) > |$table(z, 0)|) \/ ((j + n) > |$table(z, 0)|))
+    -- if (((i + n) > |$mem(z, 0)|) \/ ((j + n) > |$mem(z, 0)|))
 
-;; 6-reduction.watsup:334.1-339.15
+;; 6-reduction.watsup:340.1-345.15
 relation Step_read_before_memory.copy-le: `%`(config)
-  ;; 6-reduction.watsup:329.1-332.14
+  ;; 6-reduction.watsup:335.1-338.14
   rule memory.copy-zero {i : nat, j : nat, n : n, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
     -- unless Step_read_before_memory.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
     -- if (n = 0)
 
-  ;; 6-reduction.watsup:325.1-327.63
+  ;; 6-reduction.watsup:331.1-333.59
   rule memory.copy-trap {i : nat, j : nat, n : n, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
-    -- if (((i + n) > |$table(z, 0)|) \/ ((j + n) > |$table(z, 0)|))
+    -- if (((i + n) > |$mem(z, 0)|) \/ ((j + n) > |$mem(z, 0)|))
 
-;; 6-reduction.watsup:341.1-345.15
+;; 6-reduction.watsup:347.1-351.15
 relation Step_read_before_memory.copy-gt: `%`(config)
-  ;; 6-reduction.watsup:334.1-339.15
+  ;; 6-reduction.watsup:340.1-345.15
   rule memory.copy-le {i : nat, j : nat, n : n, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
     -- unless Step_read_before_memory.copy-le: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
     -- if (j <= i)
 
-  ;; 6-reduction.watsup:329.1-332.14
+  ;; 6-reduction.watsup:335.1-338.14
   rule memory.copy-zero {i : nat, j : nat, n : n, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
     -- unless Step_read_before_memory.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
     -- if (n = 0)
 
-  ;; 6-reduction.watsup:325.1-327.63
+  ;; 6-reduction.watsup:331.1-333.59
   rule memory.copy-trap {i : nat, j : nat, n : n, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
-    -- if (((i + n) > |$table(z, 0)|) \/ ((j + n) > |$table(z, 0)|))
+    -- if (((i + n) > |$mem(z, 0)|) \/ ((j + n) > |$mem(z, 0)|))
 
-;; 6-reduction.watsup:352.1-355.14
+;; 6-reduction.watsup:358.1-361.14
 relation Step_read_before_memory.init-zero: `%`(config)
-  ;; 6-reduction.watsup:348.1-350.60
-  rule memory.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+  ;; 6-reduction.watsup:354.1-356.60
+  rule memory.init-trap {i : nat, j : nat, n : n, x : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]))
-    -- if (((i + n) > |$data(z, y)|) \/ ((j + n) > |$mem(z, 0)|))
+    -- if (((i + n) > |$data(z, x)|) \/ ((j + n) > |$mem(z, 0)|))
 
-;; 6-reduction.watsup:357.1-361.15
+;; 6-reduction.watsup:363.1-367.15
 relation Step_read_before_memory.init-succ: `%`(config)
-  ;; 6-reduction.watsup:352.1-355.14
+  ;; 6-reduction.watsup:358.1-361.14
   rule memory.init-zero {i : nat, j : nat, n : n, x : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]))
     -- unless Step_read_before_memory.init-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]))
     -- if (n = 0)
 
-  ;; 6-reduction.watsup:348.1-350.60
-  rule memory.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+  ;; 6-reduction.watsup:354.1-356.60
+  rule memory.init-trap {i : nat, j : nat, n : n, x : idx, z : state}:
     `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]))
-    -- if (((i + n) > |$data(z, y)|) \/ ((j + n) > |$mem(z, 0)|))
+    -- if (((i + n) > |$data(z, x)|) \/ ((j + n) > |$mem(z, 0)|))
 
 ;; 6-reduction.watsup:5.1-5.63
 relation Step_read: `%~>%*`(config, admininstr*)
@@ -13980,187 +14152,191 @@ relation Step_read: `%~>%*`(config, admininstr*)
     `%~>%*`(`%;%*`(z, [CALL_admininstr(x)]), [CALL_ADDR_admininstr($funcaddr(z)[x])])
     -- if (x < |$funcaddr(z)|)
 
-  ;; 6-reduction.watsup:85.1-88.34
-  rule call_indirect-call {a : addr, ft : functype, func : func, i : nat, m : moduleinst, x : idx, z : state}:
+  ;; 6-reduction.watsup:85.1-89.17
+  rule call_indirect-call {a : addr, ft : functype, ft' : functype, i : nat, instr* : instr*, m : moduleinst, t* : valtype*, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [CALL_ADDR_admininstr(a)])
     -- if (i < |$table(z, x)|)
+    -- where REF.FUNC_ADDR_ref(a) = $table(z, x)[i]
+    -- where ft' = ft
     -- if (a < |$funcinst(z)|)
-    -- if ($table(z, x)[i] = REF.FUNC_ADDR_ref(a))
-    -- if ($funcinst(z)[a] = `%;%`(m, func))
+    -- where `%;%`(m, `FUNC%%*%`(ft', t*{t}, instr*{instr})) = $funcinst(z)[a]
 
-  ;; 6-reduction.watsup:90.1-92.15
+  ;; 6-reduction.watsup:91.1-93.15
   rule call_indirect-trap {ft : functype, i : nat, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]), [TRAP_admininstr])
     -- unless Step_read_before_call_indirect-trap: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CALL_INDIRECT_admininstr(x, ft)]))
 
-  ;; 6-reduction.watsup:94.1-97.52
+  ;; 6-reduction.watsup:95.1-98.52
   rule call_addr {a : addr, f : frame, instr* : instr*, k : nat, m : moduleinst, n : n, t* : valtype*, t_1^k : valtype^k, t_2^n : valtype^n, val^k : val^k, z : state, o0* : val*}:
     `%~>%*`(`%;%*`(z, $admininstr_val(val)^k{val} :: [CALL_ADDR_admininstr(a)]), [FRAME__admininstr(n, f, [LABEL__admininstr(n, [], $admininstr_instr(instr)*{instr})])])
-    -- if (|t*{t}| = |o0*{o0}|)
     -- if (a < |$funcinst(z)|)
-    -- if (|t_1^k{t_1}| = k)
-    -- if (|t_2^n{t_2}| = n)
-    -- if (|val^k{val}| = k)
+    -- where `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})) = $funcinst(z)[a]
+    -- where |o0*{o0}| = |t*{t}|
     -- (if ($default_(t) = ?(o0)))*{t o0}
-    -- if ($funcinst(z)[a] = `%;%`(m, `FUNC%%*%`(`%->%`(t_1^k{t_1}, t_2^n{t_2}), t*{t}, instr*{instr})))
-    -- if (f = {LOCAL val^k{val} :: o0*{o0}, MODULE m})
+    -- where f = {LOCAL val^k{val} :: o0*{o0}, MODULE m}
 
-  ;; 6-reduction.watsup:150.1-151.53
+  ;; 6-reduction.watsup:151.1-152.53
   rule ref.func {x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [REF.FUNC_admininstr(x)]), [REF.FUNC_ADDR_admininstr($funcaddr(z)[x])])
     -- if (x < |$funcaddr(z)|)
 
-  ;; 6-reduction.watsup:163.1-164.37
+  ;; 6-reduction.watsup:164.1-165.37
   rule local.get {x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [LOCAL.GET_admininstr(x)]), [$admininstr_val($local(z, x))])
 
-  ;; 6-reduction.watsup:173.1-174.39
+  ;; 6-reduction.watsup:174.1-175.39
   rule global.get {x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [GLOBAL.GET_admininstr(x)]), [$admininstr_globalinst($global(z, x))])
 
-  ;; 6-reduction.watsup:180.1-182.28
+  ;; 6-reduction.watsup:181.1-183.28
   rule table.get-trap {i : nat, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [TRAP_admininstr])
     -- if (i >= |$table(z, x)|)
 
-  ;; 6-reduction.watsup:184.1-186.27
+  ;; 6-reduction.watsup:185.1-187.27
   rule table.get-val {i : nat, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(x)]), [$admininstr_ref($table(z, x)[i])])
     -- if (i < |$table(z, x)|)
 
-  ;; 6-reduction.watsup:197.1-199.27
+  ;; 6-reduction.watsup:198.1-200.27
   rule table.size {n : n, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [TABLE.SIZE_admininstr(x)]), [CONST_admininstr(I32_numtype, n)])
-    -- if (|$table(z, x)| = n)
+    -- where n = |$table(z, x)|
 
-  ;; 6-reduction.watsup:209.1-211.34
+  ;; 6-reduction.watsup:210.1-212.34
   rule table.fill-trap {i : nat, n : n, val : val, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [TRAP_admininstr])
     -- if ((i + n) > |$table(z, x)|)
 
-  ;; 6-reduction.watsup:213.1-216.14
+  ;; 6-reduction.watsup:214.1-217.14
   rule table.fill-zero {i : nat, n : n, val : val, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [])
     -- unless Step_read_before_table.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
     -- if (n = 0)
 
-  ;; 6-reduction.watsup:218.1-222.15
+  ;; 6-reduction.watsup:219.1-223.15
   rule table.fill-succ {i : nat, n : n, val : val, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]), [CONST_admininstr(I32_numtype, i) $admininstr_val(val) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (i + 1)) $admininstr_val(val) CONST_admininstr(I32_numtype, (n - 1)) TABLE.FILL_admininstr(x)])
     -- unless Step_read_before_table.fill-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) TABLE.FILL_admininstr(x)]))
 
-  ;; 6-reduction.watsup:225.1-227.63
+  ;; 6-reduction.watsup:226.1-228.63
   rule table.copy-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [TRAP_admininstr])
     -- if (((i + n) > |$table(z, y)|) \/ ((j + n) > |$table(z, x)|))
 
-  ;; 6-reduction.watsup:229.1-232.14
+  ;; 6-reduction.watsup:230.1-233.14
   rule table.copy-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [])
     -- unless Step_read_before_table.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- if (n = 0)
 
-  ;; 6-reduction.watsup:234.1-239.15
+  ;; 6-reduction.watsup:235.1-240.15
   rule table.copy-le {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
     -- unless Step_read_before_table.copy-le: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
     -- if (j <= i)
 
-  ;; 6-reduction.watsup:241.1-245.15
+  ;; 6-reduction.watsup:242.1-246.15
   rule table.copy-gt {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, ((j + n) - 1)) CONST_admininstr(I32_numtype, ((i + n) - 1)) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]), [CONST_admininstr(I32_numtype, ((j + n) - 1)) CONST_admininstr(I32_numtype, ((i + n) - 1)) TABLE.GET_admininstr(y) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, (n - 1)) TABLE.COPY_admininstr(x, y)])
     -- unless Step_read_before_table.copy-gt: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.COPY_admininstr(x, y)]))
 
-  ;; 6-reduction.watsup:248.1-250.62
+  ;; 6-reduction.watsup:249.1-251.62
   rule table.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [TRAP_admininstr])
     -- if (((i + n) > |$elem(z, y)|) \/ ((j + n) > |$table(z, x)|))
 
-  ;; 6-reduction.watsup:252.1-255.14
+  ;; 6-reduction.watsup:253.1-256.14
   rule table.init-zero {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [])
     -- unless Step_read_before_table.init-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
     -- if (n = 0)
 
-  ;; 6-reduction.watsup:257.1-261.15
+  ;; 6-reduction.watsup:258.1-262.15
   rule table.init-succ {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]), [CONST_admininstr(I32_numtype, j) $admininstr_ref($elem(z, y)[i]) TABLE.SET_admininstr(x) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) TABLE.INIT_admininstr(x, y)])
     -- if (i < |$elem(z, y)|)
     -- unless Step_read_before_table.init-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) TABLE.INIT_admininstr(x, y)]))
 
-  ;; 6-reduction.watsup:268.1-270.49
+  ;; 6-reduction.watsup:269.1-271.48
   rule load-num-trap {i : nat, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) LOAD_admininstr(nt, ?(), n_A, n_O)]), [TRAP_admininstr])
-    -- if ($size($valtype_numtype(nt)) = ?(o0))
-    -- if (((i + n_O) + (o0 / 8)) >= |$mem(z, 0)|)
+    -- where ?(o0) = $size($valtype_numtype(nt))
+    -- if (((i + n_O) + (o0 / 8)) > |$mem(z, 0)|)
 
-  ;; 6-reduction.watsup:272.1-274.66
+  ;; 6-reduction.watsup:273.1-275.66
   rule load-num-val {c : c_numtype, i : nat, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat, o1 : nat}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) LOAD_admininstr(nt, ?(), n_A, n_O)]), [CONST_admininstr(nt, c)])
-    -- if ($size($valtype_numtype(nt)) = ?(o0))
-    -- if ($size($valtype_numtype(nt)) = ?(o1))
-    -- if ($bytes_(o0, c) = $mem(z, 0)[(i + n_O) : (o1 / 8)])
+    -- where ?(o0) = $size($valtype_numtype(nt))
+    -- where ?(o1) = $size($valtype_numtype(nt))
+    -- where $bytes_(o0, c) = $mem(z, 0)[(i + n_O) : (o1 / 8)]
 
-  ;; 6-reduction.watsup:276.1-278.41
+  ;; 6-reduction.watsup:277.1-279.40
   rule load-pack-trap {i : nat, n : n, n_A : n, n_O : n, nt : numtype, sx : sx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) LOAD_admininstr(nt, ?((n, sx)), n_A, n_O)]), [TRAP_admininstr])
-    -- if (((i + n_O) + (n / 8)) >= |$mem(z, 0)|)
+    -- if (((i + n_O) + (n / 8)) > |$mem(z, 0)|)
 
-  ;; 6-reduction.watsup:280.1-282.50
-  rule load-pack-val {c : c_numtype, i : nat, n : n, n_A : n, n_O : n, nt : numtype, sx : sx, z : state}:
-    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) LOAD_admininstr(nt, ?((n, sx)), n_A, n_O)]), [CONST_admininstr(nt, c)])
-    -- if ($bytes_(n, c) = $mem(z, 0)[(i + n_O) : (n / 8)])
+  ;; 6-reduction.watsup:281.1-283.50
+  rule load-pack-val {c : c_numtype, i : nat, n : n, n_A : n, n_O : n, nt : numtype, sx : sx, z : state, o0 : nat}:
+    `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) LOAD_admininstr(nt, ?((n, sx)), n_A, n_O)]), [CONST_admininstr(nt, $ext(n, o0, sx, c))])
+    -- where ?(o0) = $size($valtype_numtype(nt))
+    -- where $bytes_(n, c) = $mem(z, 0)[(i + n_O) : (n / 8)]
+
+  ;; 6-reduction.watsup:303.1-305.39
+  rule memory.size {n : n, z : state}:
+    `%~>%*`(`%;%*`(z, [MEMORY.SIZE_admininstr]), [CONST_admininstr(I32_numtype, n)])
+    -- where ((n * 64) * $Ki) = |$mem(z, 0)|
 
-  ;; 6-reduction.watsup:309.1-311.32
+  ;; 6-reduction.watsup:315.1-317.32
   rule memory.fill-trap {i : nat, n : n, val : val, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]), [TRAP_admininstr])
     -- if ((i + n) > |$mem(z, 0)|)
 
-  ;; 6-reduction.watsup:313.1-316.14
+  ;; 6-reduction.watsup:319.1-322.14
   rule memory.fill-zero {i : nat, n : n, val : val, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]), [])
     -- unless Step_read_before_memory.fill-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]))
     -- if (n = 0)
 
-  ;; 6-reduction.watsup:318.1-322.15
+  ;; 6-reduction.watsup:324.1-328.15
   rule memory.fill-succ {i : nat, n : n, val : val, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]), [CONST_admininstr(I32_numtype, i) $admininstr_val(val) STORE_admininstr(I32_numtype, ?(8), 0, 0) CONST_admininstr(I32_numtype, (i + 1)) $admininstr_val(val) CONST_admininstr(I32_numtype, (n - 1)) MEMORY.FILL_admininstr])
     -- unless Step_read_before_memory.fill-succ: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_val(val) CONST_admininstr(I32_numtype, n) MEMORY.FILL_admininstr]))
 
-  ;; 6-reduction.watsup:325.1-327.63
+  ;; 6-reduction.watsup:331.1-333.59
   rule memory.copy-trap {i : nat, j : nat, n : n, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]), [TRAP_admininstr])
-    -- if (((i + n) > |$table(z, 0)|) \/ ((j + n) > |$table(z, 0)|))
+    -- if (((i + n) > |$mem(z, 0)|) \/ ((j + n) > |$mem(z, 0)|))
 
-  ;; 6-reduction.watsup:329.1-332.14
+  ;; 6-reduction.watsup:335.1-338.14
   rule memory.copy-zero {i : nat, j : nat, n : n, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]), [])
     -- unless Step_read_before_memory.copy-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
     -- if (n = 0)
 
-  ;; 6-reduction.watsup:334.1-339.15
+  ;; 6-reduction.watsup:340.1-345.15
   rule memory.copy-le {i : nat, j : nat, n : n, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) LOAD_admininstr(I32_numtype, ?((8, U_sx)), 0, 0) STORE_admininstr(I32_numtype, ?(8), 0, 0) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) MEMORY.COPY_admininstr])
     -- unless Step_read_before_memory.copy-le: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
     -- if (j <= i)
 
-  ;; 6-reduction.watsup:341.1-345.15
+  ;; 6-reduction.watsup:347.1-351.15
   rule memory.copy-gt {i : nat, j : nat, n : n, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]), [CONST_admininstr(I32_numtype, ((j + n) - 1)) CONST_admininstr(I32_numtype, ((i + n) - 1)) LOAD_admininstr(I32_numtype, ?((8, U_sx)), 0, 0) STORE_admininstr(I32_numtype, ?(8), 0, 0) CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, (n - 1)) MEMORY.COPY_admininstr])
     -- unless Step_read_before_memory.copy-gt: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.COPY_admininstr]))
 
-  ;; 6-reduction.watsup:348.1-350.60
-  rule memory.init-trap {i : nat, j : nat, n : n, x : idx, y : idx, z : state}:
+  ;; 6-reduction.watsup:354.1-356.60
+  rule memory.init-trap {i : nat, j : nat, n : n, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]), [TRAP_admininstr])
-    -- if (((i + n) > |$data(z, y)|) \/ ((j + n) > |$mem(z, 0)|))
+    -- if (((i + n) > |$data(z, x)|) \/ ((j + n) > |$mem(z, 0)|))
 
-  ;; 6-reduction.watsup:352.1-355.14
+  ;; 6-reduction.watsup:358.1-361.14
   rule memory.init-zero {i : nat, j : nat, n : n, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]), [])
     -- unless Step_read_before_memory.init-zero: `%`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]))
     -- if (n = 0)
 
-  ;; 6-reduction.watsup:357.1-361.15
+  ;; 6-reduction.watsup:363.1-367.15
   rule memory.init-succ {i : nat, j : nat, n : n, x : idx, z : state}:
     `%~>%*`(`%;%*`(z, [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, n) MEMORY.INIT_admininstr(x)]), [CONST_admininstr(I32_numtype, j) CONST_admininstr(I32_numtype, $data(z, x)[i]) STORE_admininstr(I32_numtype, ?(8), 0, 0) CONST_admininstr(I32_numtype, (j + 1)) CONST_admininstr(I32_numtype, (i + 1)) CONST_admininstr(I32_numtype, (n - 1)) MEMORY.INIT_admininstr(x)])
     -- if (i < |$data(z, x)|)
@@ -14178,69 +14354,69 @@ relation Step: `%~>%`(config, config)
     `%~>%`(`%;%*`(z, $admininstr_instr(instr)*{instr}), `%;%*`(z, $admininstr_instr(instr')*{instr'}))
     -- Step_read: `%~>%*`(`%;%*`(z, $admininstr_instr(instr)*{instr}), $admininstr_instr(instr')*{instr'})
 
-  ;; 6-reduction.watsup:166.1-167.60
+  ;; 6-reduction.watsup:167.1-168.60
   rule local.set {val : val, x : idx, z : state}:
     `%~>%`(`%;%*`(z, [$admininstr_val(val) LOCAL.SET_admininstr(x)]), `%;%*`($with_local(z, x, val), []))
 
-  ;; 6-reduction.watsup:176.1-177.62
+  ;; 6-reduction.watsup:177.1-178.62
   rule global.set {val : val, x : idx, z : state}:
     `%~>%`(`%;%*`(z, [$admininstr_val(val) GLOBAL.SET_admininstr(x)]), `%;%*`($with_global(z, x, val), []))
 
-  ;; 6-reduction.watsup:188.1-190.28
+  ;; 6-reduction.watsup:189.1-191.28
   rule table.set-trap {i : nat, ref : ref, x : idx, z : state}:
     `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_ref(ref) TABLE.GET_admininstr(x)]), `%;%*`(z, [TRAP_admininstr]))
     -- if (i >= |$table(z, x)|)
 
-  ;; 6-reduction.watsup:192.1-194.27
+  ;; 6-reduction.watsup:193.1-195.27
   rule table.set-val {i : nat, ref : ref, x : idx, z : state}:
     `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) $admininstr_ref(ref) TABLE.GET_admininstr(x)]), `%;%*`($with_table(z, x, i, ref), []))
     -- if (i < |$table(z, x)|)
 
-  ;; 6-reduction.watsup:202.1-203.102
+  ;; 6-reduction.watsup:203.1-204.102
   rule table.grow-succeed {n : n, ref : ref, x : idx, z : state}:
     `%~>%`(`%;%*`(z, [$admininstr_ref(ref) CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), `%;%*`($with_tableext(z, x, ref^n{}), [CONST_admininstr(I32_numtype, |$table(z, x)|)]))
 
-  ;; 6-reduction.watsup:205.1-206.64
+  ;; 6-reduction.watsup:206.1-207.64
   rule table.grow-fail {n : n, ref : ref, x : idx, z : state}:
     `%~>%`(`%;%*`(z, [$admininstr_ref(ref) CONST_admininstr(I32_numtype, n) TABLE.GROW_admininstr(x)]), `%;%*`(z, [CONST_admininstr(I32_numtype, - 1)]))
 
-  ;; 6-reduction.watsup:264.1-265.59
+  ;; 6-reduction.watsup:265.1-266.59
   rule elem.drop {x : idx, z : state}:
     `%~>%`(`%;%*`(z, [ELEM.DROP_admininstr(x)]), `%;%*`($with_elem(z, x, []), []))
 
-  ;; 6-reduction.watsup:285.1-287.49
+  ;; 6-reduction.watsup:286.1-288.48
   rule store-num-trap {c : c_numtype, i : nat, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat}:
-    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, c) STORE_admininstr(nt, ?(), n_A, n_O)]), `%;%*`(z, [TRAP_admininstr]))
-    -- if ($size($valtype_numtype(nt)) = ?(o0))
-    -- if (((i + n_O) + (o0 / 8)) >= |$mem(z, 0)|)
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(nt, c) STORE_admininstr(nt, ?(), n_A, n_O)]), `%;%*`(z, [TRAP_admininstr]))
+    -- where ?(o0) = $size($valtype_numtype(nt))
+    -- if (((i + n_O) + (o0 / 8)) > |$mem(z, 0)|)
 
-  ;; 6-reduction.watsup:289.1-291.35
+  ;; 6-reduction.watsup:290.1-292.35
   rule store-num-val {b* : byte*, c : c_numtype, i : nat, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat, o1 : nat}:
-    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, c) STORE_admininstr(nt, ?(), n_A, n_O)]), `%;%*`($with_mem(z, 0, (i + n_O), (o0 / 8), b*{b}), []))
-    -- if ($size($valtype_numtype(nt)) = ?(o0))
-    -- if ($size($valtype_numtype(nt)) = ?(o1))
-    -- if (b*{b} = $bytes_(o1, c))
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(nt, c) STORE_admininstr(nt, ?(), n_A, n_O)]), `%;%*`($with_mem(z, 0, (i + n_O), (o0 / 8), b*{b}), []))
+    -- where ?(o0) = $size($valtype_numtype(nt))
+    -- where ?(o1) = $size($valtype_numtype(nt))
+    -- where b*{b} = $bytes_(o1, c)
 
-  ;; 6-reduction.watsup:293.1-295.41
+  ;; 6-reduction.watsup:294.1-296.40
   rule store-pack-trap {c : c_numtype, i : nat, n : n, n_A : n, n_O : n, nt : numtype, z : state}:
-    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, c) STORE_admininstr(nt, ?(n), n_A, n_O)]), `%;%*`(z, [TRAP_admininstr]))
-    -- if (((i + n_O) + (n / 8)) >= |$mem(z, 0)|)
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(nt, c) STORE_admininstr(nt, ?(n), n_A, n_O)]), `%;%*`(z, [TRAP_admininstr]))
+    -- if (((i + n_O) + (n / 8)) > |$mem(z, 0)|)
 
-  ;; 6-reduction.watsup:297.1-299.50
+  ;; 6-reduction.watsup:298.1-300.50
   rule store-pack-val {b* : byte*, c : c_numtype, i : nat, n : n, n_A : n, n_O : n, nt : numtype, z : state, o0 : nat}:
-    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(I32_numtype, c) STORE_admininstr(nt, ?(n), n_A, n_O)]), `%;%*`($with_mem(z, 0, (i + n_O), (n / 8), b*{b}), []))
-    -- if ($size($valtype_numtype(nt)) = ?(o0))
-    -- if (b*{b} = $bytes_(n, $wrap_((o0, n), c)))
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, i) CONST_admininstr(nt, c) STORE_admininstr(nt, ?(n), n_A, n_O)]), `%;%*`($with_mem(z, 0, (i + n_O), (n / 8), b*{b}), []))
+    -- where ?(o0) = $size($valtype_numtype(nt))
+    -- where b*{b} = $bytes_(n, $wrap_((o0, n), c))
 
-  ;; 6-reduction.watsup:302.1-303.104
+  ;; 6-reduction.watsup:308.1-309.117
   rule memory.grow-succeed {n : n, z : state}:
-    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) MEMORY.GROW_admininstr]), `%;%*`($with_memext(z, 0, 0^((n * 64) * $Ki){}), [CONST_admininstr(I32_numtype, |$mem(z, 0)|)]))
+    `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) MEMORY.GROW_admininstr]), `%;%*`($with_memext(z, 0, 0^((n * 64) * $Ki){}), [CONST_admininstr(I32_numtype, (|$mem(z, 0)| / (64 * $Ki)))]))
 
-  ;; 6-reduction.watsup:305.1-306.59
+  ;; 6-reduction.watsup:311.1-312.59
   rule memory.grow-fail {n : n, z : state}:
     `%~>%`(`%;%*`(z, [CONST_admininstr(I32_numtype, n) MEMORY.GROW_admininstr]), `%;%*`(z, [CONST_admininstr(I32_numtype, - 1)]))
 
-  ;; 6-reduction.watsup:364.1-365.59
+  ;; 6-reduction.watsup:370.1-371.59
   rule data.drop {x : idx, z : state}:
     `%~>%`(`%;%*`(z, [DATA.DROP_admininstr(x)]), `%;%*`($with_data(z, x, []), []))
 

From 1fabac89c8b02e5a7af1f2a2fe9c8a653a333ec8 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Fri, 9 Jun 2023 10:15:25 +0200
Subject: [PATCH 95/98] Undo spec change about MUT?

---
 spectec/spec/1-syntax.watsup    |   5 +-
 spectec/spec/3-typing.watsup    |   2 +-
 spectec/src/exe-watsup/main.ml  |   2 +-
 spectec/test-frontend/TEST.md   | 100 ++---
 spectec/test-haskell/SpecTec.hs |   6 +-
 spectec/test-latex/TEST.md      |   1 -
 spectec/test-lean4/SpecTec.lean |  14 +-
 spectec/test-middlend/TEST.md   | 766 ++++++++++++++++----------------
 8 files changed, 428 insertions(+), 468 deletions(-)

diff --git a/spectec/spec/1-syntax.watsup b/spectec/spec/1-syntax.watsup
index 9b51689fb8..c95fb67dca 100644
--- a/spectec/spec/1-syntax.watsup
+++ b/spectec/spec/1-syntax.watsup
@@ -58,10 +58,8 @@ syntax resulttype hint(desc "result type") =
 
 syntax limits hint(desc "limits") =
   `[u32 .. u32]
-syntax mutflag hint(desc "mutability flag") =
-  MUT
 syntax globaltype hint(desc "global type") =
-  mutflag? valtype
+  MUT? valtype
 syntax functype hint(desc "function type") =
   resulttype -> resulttype
 syntax tabletype hint(desc "table type") =
@@ -78,7 +76,6 @@ syntax externtype hint(desc "external type") =
 var lim : limits
 var ft : functype
 var gt : globaltype
-var mut : mutflag
 var tt : tabletype
 var mt : memtype
 var xt : externtype
diff --git a/spectec/spec/3-typing.watsup b/spectec/spec/3-typing.watsup
index af1c6c276e..75904e2709 100644
--- a/spectec/spec/3-typing.watsup
+++ b/spectec/spec/3-typing.watsup
@@ -280,7 +280,7 @@ rule Instr_ok/local.tee:
 
 rule Instr_ok/global.get:
   C |- GLOBAL.GET x : epsilon -> t
-  -- if C.GLOBAL[x] = mut? t
+  -- if C.GLOBAL[x] = MUT? t
 
 rule Instr_ok/global.set:
   C |- GLOBAL.SET x : t -> epsilon
diff --git a/spectec/src/exe-watsup/main.ml b/spectec/src/exe-watsup/main.ml
index 5596933f54..bfbb855a4d 100644
--- a/spectec/src/exe-watsup/main.ml
+++ b/spectec/src/exe-watsup/main.ml
@@ -145,7 +145,7 @@ let () =
       )
     in
 
-    let il = if not !pass_wild || !target = Lean4 then il else
+    let il = if not (!pass_wild || !target = Lean4) then il else
       ( log "Wildcard elimination";
         let il = Middlend.Wild.transform il in
         if !print_all_il then
diff --git a/spectec/test-frontend/TEST.md b/spectec/test-frontend/TEST.md
index 00fcac1596..032073fa39 100644
--- a/spectec/test-frontend/TEST.md
+++ b/spectec/test-frontend/TEST.md
@@ -88,46 +88,43 @@ syntax resulttype = valtype*
 ;; 1-syntax.watsup:59.1-60.16
 syntax limits = `[%..%]`(u32, u32)
 
-;; 1-syntax.watsup:61.1-62.6
-syntax mutflag = MUT
+;; 1-syntax.watsup:61.1-62.15
+syntax globaltype = `MUT%?%`(()?, valtype)
 
-;; 1-syntax.watsup:63.1-64.19
-syntax globaltype = `%?%`(mutflag?, valtype)
-
-;; 1-syntax.watsup:65.1-66.27
+;; 1-syntax.watsup:63.1-64.27
 syntax functype = `%->%`(resulttype, resulttype)
 
-;; 1-syntax.watsup:67.1-68.17
+;; 1-syntax.watsup:65.1-66.17
 syntax tabletype = `%%`(limits, reftype)
 
-;; 1-syntax.watsup:69.1-70.12
+;; 1-syntax.watsup:67.1-68.12
 syntax memtype = `%I8`(limits)
 
-;; 1-syntax.watsup:71.1-72.10
+;; 1-syntax.watsup:69.1-70.10
 syntax elemtype = reftype
 
-;; 1-syntax.watsup:73.1-74.5
+;; 1-syntax.watsup:71.1-72.5
 syntax datatype = OK
 
-;; 1-syntax.watsup:75.1-76.69
+;; 1-syntax.watsup:73.1-74.69
 syntax externtype =
   | GLOBAL(globaltype)
   | FUNC(functype)
   | TABLE(tabletype)
   | MEMORY(memtype)
 
-;; 1-syntax.watsup:89.1-89.44
+;; 1-syntax.watsup:86.1-86.44
 syntax sx =
   | U
   | S
 
-;; 1-syntax.watsup:91.1-91.39
+;; 1-syntax.watsup:88.1-88.39
 syntax unop_IXX =
   | CLZ
   | CTZ
   | POPCNT
 
-;; 1-syntax.watsup:92.1-92.70
+;; 1-syntax.watsup:89.1-89.70
 syntax unop_FXX =
   | ABS
   | NEG
@@ -137,7 +134,7 @@ syntax unop_FXX =
   | TRUNC
   | NEAREST
 
-;; 1-syntax.watsup:94.1-96.62
+;; 1-syntax.watsup:91.1-93.62
 syntax binop_IXX =
   | ADD
   | SUB
@@ -152,7 +149,7 @@ syntax binop_IXX =
   | ROTL
   | ROTR
 
-;; 1-syntax.watsup:97.1-97.66
+;; 1-syntax.watsup:94.1-94.66
 syntax binop_FXX =
   | ADD
   | SUB
@@ -162,15 +159,15 @@ syntax binop_FXX =
   | MAX
   | COPYSIGN
 
-;; 1-syntax.watsup:99.1-99.26
+;; 1-syntax.watsup:96.1-96.26
 syntax testop_IXX =
   | EQZ
 
-;; 1-syntax.watsup:100.1-100.22
+;; 1-syntax.watsup:97.1-97.22
 syntax testop_FXX =
   |
 
-;; 1-syntax.watsup:102.1-103.108
+;; 1-syntax.watsup:99.1-100.108
 syntax relop_IXX =
   | EQ
   | NE
@@ -179,7 +176,7 @@ syntax relop_IXX =
   | LE(sx)
   | GE(sx)
 
-;; 1-syntax.watsup:104.1-104.49
+;; 1-syntax.watsup:101.1-101.49
 syntax relop_FXX =
   | EQ
   | NE
@@ -188,44 +185,44 @@ syntax relop_FXX =
   | LE
   | GE
 
-;; 1-syntax.watsup:106.1-106.50
+;; 1-syntax.watsup:103.1-103.50
 syntax unop_numtype =
   | _I(unop_IXX)
   | _F(unop_FXX)
 
-;; 1-syntax.watsup:107.1-107.53
+;; 1-syntax.watsup:104.1-104.53
 syntax binop_numtype =
   | _I(binop_IXX)
   | _F(binop_FXX)
 
-;; 1-syntax.watsup:108.1-108.56
+;; 1-syntax.watsup:105.1-105.56
 syntax testop_numtype =
   | _I(testop_IXX)
   | _F(testop_FXX)
 
-;; 1-syntax.watsup:109.1-109.53
+;; 1-syntax.watsup:106.1-106.53
 syntax relop_numtype =
   | _I(relop_IXX)
   | _F(relop_FXX)
 
-;; 1-syntax.watsup:110.1-110.39
+;; 1-syntax.watsup:107.1-107.39
 syntax cvtop =
   | CONVERT
   | REINTERPRET
 
-;; 1-syntax.watsup:120.1-120.23
+;; 1-syntax.watsup:117.1-117.23
 syntax c_numtype = nat
 
-;; 1-syntax.watsup:121.1-121.23
+;; 1-syntax.watsup:118.1-118.23
 syntax c_vectype = nat
 
-;; 1-syntax.watsup:124.1-124.52
+;; 1-syntax.watsup:121.1-121.52
 syntax blocktype = functype
 
-;; 1-syntax.watsup:159.1-180.80
+;; 1-syntax.watsup:156.1-177.80
 rec {
 
-;; 1-syntax.watsup:159.1-180.80
+;; 1-syntax.watsup:156.1-177.80
 syntax instr =
   | UNREACHABLE
   | NOP
@@ -273,53 +270,53 @@ syntax instr =
   | STORE(numtype, n?, u32, u32)
 }
 
-;; 1-syntax.watsup:182.1-183.9
+;; 1-syntax.watsup:179.1-180.9
 syntax expr = instr*
 
-;; 1-syntax.watsup:190.1-190.50
+;; 1-syntax.watsup:187.1-187.50
 syntax elemmode =
   | TABLE(tableidx, expr)
   | DECLARE
 
-;; 1-syntax.watsup:191.1-191.39
+;; 1-syntax.watsup:188.1-188.39
 syntax datamode =
   | MEMORY(memidx, expr)
 
-;; 1-syntax.watsup:193.1-194.30
+;; 1-syntax.watsup:190.1-191.30
 syntax func = `FUNC%%*%`(functype, valtype*, expr)
 
-;; 1-syntax.watsup:195.1-196.25
+;; 1-syntax.watsup:192.1-193.25
 syntax global = GLOBAL(globaltype, expr)
 
-;; 1-syntax.watsup:197.1-198.18
+;; 1-syntax.watsup:194.1-195.18
 syntax table = TABLE(tabletype)
 
-;; 1-syntax.watsup:199.1-200.17
+;; 1-syntax.watsup:196.1-197.17
 syntax mem = MEMORY(memtype)
 
-;; 1-syntax.watsup:201.1-202.31
+;; 1-syntax.watsup:198.1-199.31
 syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
 
-;; 1-syntax.watsup:203.1-204.26
+;; 1-syntax.watsup:200.1-201.26
 syntax data = `DATA(*)%*%?`(byte**, datamode?)
 
-;; 1-syntax.watsup:205.1-206.16
+;; 1-syntax.watsup:202.1-203.16
 syntax start = START(funcidx)
 
-;; 1-syntax.watsup:208.1-209.65
+;; 1-syntax.watsup:205.1-206.65
 syntax externuse =
   | FUNC(funcidx)
   | GLOBAL(globalidx)
   | TABLE(tableidx)
   | MEMORY(memidx)
 
-;; 1-syntax.watsup:210.1-211.24
+;; 1-syntax.watsup:207.1-208.24
 syntax export = EXPORT(name, externuse)
 
-;; 1-syntax.watsup:212.1-213.30
+;; 1-syntax.watsup:209.1-210.30
 syntax import = IMPORT(name, name, externtype)
 
-;; 1-syntax.watsup:215.1-216.70
+;; 1-syntax.watsup:212.1-213.70
 syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
 
 ;; 2-aux.watsup:3.1-3.14
@@ -662,14 +659,14 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:281.1-283.29
-  rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
+  rule global.get {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
-    -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(()?{}, t))
 
   ;; 3-typing.watsup:285.1-287.28
   rule global.set {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
-    -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
 
   ;; 3-typing.watsup:290.1-292.28
   rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
@@ -809,7 +806,7 @@ relation Instr_const: `%|-%CONST`(context, instr)
   ;; 3-typing.watsup:380.1-382.32
   rule global.get {C : context, t : valtype, x : idx}:
     `%|-%CONST`(C, GLOBAL.GET_instr(x))
-    -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(), t))
 
 ;; 3-typing.watsup:368.1-368.77
 relation Expr_const: `%|-%CONST`(context, expr)
@@ -841,7 +838,7 @@ relation Global_ok: `%|-%:%`(context, global, globaltype)
   rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
     `%|-%:%`(C, GLOBAL(gt, expr), gt)
     -- Globaltype_ok: `|-%:OK`(gt)
-    -- if (gt = `%?%`(MUT?{}, t))
+    -- if (gt = `MUT%?%`(()?{}, t))
     -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
 
 ;; 3-typing.watsup:399.1-399.74
@@ -1695,8 +1692,7 @@ $$
 \begin{array}{@{}lrrl@{}}
 \mbox{(result type)} & \mathit{resulttype} &::=& {\mathit{valtype}^\ast} \\
 \mbox{(limits)} & \mathit{limits} &::=& [\mathit{u{\scriptstyle32}} .. \mathit{u{\scriptstyle32}}] \\
-\mbox{(mutability flag)} & \mathit{mutflag} &::=& \mathsf{mut} \\
-\mbox{(global type)} & \mathit{globaltype} &::=& {\mathit{mutflag}^?}~\mathit{valtype} \\
+\mbox{(global type)} & \mathit{globaltype} &::=& {\mathsf{mut}^?}~\mathit{valtype} \\
 \mbox{(function type)} & \mathit{functype} &::=& \mathit{resulttype} \rightarrow \mathit{resulttype} \\
 \mbox{(table type)} & \mathit{tabletype} &::=& \mathit{limits}~\mathit{reftype} \\
 \mbox{(memory type)} & \mathit{memtype} &::=& \mathit{limits}~\mathsf{i{\scriptstyle8}} \\
@@ -2576,7 +2572,7 @@ $$
 $$
 \begin{array}{@{}c@{}}\displaystyle
 \frac{
-\mathit{C}.\mathsf{global}[\mathit{x}] = {\mathit{mut}^?}~\mathit{t}
+\mathit{C}.\mathsf{global}[\mathit{x}] = {\mathsf{mut}^?}~\mathit{t}
 }{
 \mathit{C} \vdash \mathsf{global.get}~\mathit{x} : \epsilon \rightarrow \mathit{t}
 } \, {[\textsc{\scriptsize T{-}global.get}]}
diff --git a/spectec/test-haskell/SpecTec.hs b/spectec/test-haskell/SpecTec.hs
index a3735ebf1a..f683dd746c 100644
--- a/spectec/test-haskell/SpecTec.hs
+++ b/spectec/test-haskell/SpecTec.hs
@@ -133,11 +133,7 @@ type Limits = {- mixop: `[%..%]` -} (U32, U32)
 
 
 
-type Mutflag = {- mixop: MUT -} ()
-
-
-
-type Globaltype = {- mixop: `%?%` -} ((Maybe Mutflag), Valtype)
+type Globaltype = {- mixop: `MUT%?%` -} ((Maybe ()), Valtype)
 
 
 
diff --git a/spectec/test-latex/TEST.md b/spectec/test-latex/TEST.md
index 03adf7971f..38434e3249 100644
--- a/spectec/test-latex/TEST.md
+++ b/spectec/test-latex/TEST.md
@@ -58,7 +58,6 @@ warning: syntax `memidx` was never spliced
 warning: syntax `meminst` was never spliced
 warning: syntax `module` was never spliced
 warning: syntax `moduleinst` was never spliced
-warning: syntax `mutflag` was never spliced
 warning: syntax `n` was never spliced
 warning: syntax `name` was never spliced
 warning: syntax `num` was never spliced
diff --git a/spectec/test-lean4/SpecTec.lean b/spectec/test-lean4/SpecTec.lean
index 2b4e8fc463..752a74b28c 100644
--- a/spectec/test-lean4/SpecTec.lean
+++ b/spectec/test-lean4/SpecTec.lean
@@ -166,11 +166,7 @@ def «$valtype_fn» : Fn -> Valtype
 
 
 
-@[reducible] def Mutflag := /- mixop: MUT -/ Unit
-
-
-
-@[reducible] def Globaltype := /- mixop: `%?%` -/ ((Option Mutflag) × Valtype)
+@[reducible] def Globaltype := /- mixop: `MUT%?%` -/ ((Option Unit) × Valtype)
 
 
 
@@ -712,9 +708,9 @@ inductive Instr_ok : (Context × Instr × Functype) -> Prop where
     (x < C.LOCAL.length) -> 
     ((C.LOCAL.get! x) == t) -> 
     (Instr_ok (C, (Instr.LOCAL_TEE x), ([t], [t])))
-  | global_get (C : Context) («mut» : (Option Mutflag)) (t : Valtype) (x : Idx) : 
+  | global_get (C : Context) (t : Valtype) (x : Idx) (w0 : (Option Unit)) : 
     (x < C.GLOBAL.length) -> 
-    ((C.GLOBAL.get! x) == («mut», t)) -> 
+    ((C.GLOBAL.get! x) == (w0, t)) -> 
     (Instr_ok (C, (Instr.GLOBAL_GET x), ([], [t])))
   | global_set (C : Context) (t : Valtype) (x : Idx) : 
     (x < C.GLOBAL.length) -> 
@@ -871,9 +867,9 @@ inductive Func_ok : (Context × Func × Functype) -> Prop where
 
 
 inductive Global_ok : (Context × Global × Globaltype) -> Prop where
-  | rule_0 (C : Context) (expr : Expr) (gt : Globaltype) (t : Valtype) : 
+  | rule_0 (C : Context) (expr : Expr) (gt : Globaltype) (t : Valtype) (w0 : (Option Unit)) : 
     (Globaltype_ok gt) -> 
-    (gt == ((some ()), t)) -> 
+    (gt == (w0, t)) -> 
     (Expr_ok_const (C, expr, t)) -> 
     (Global_ok (C, (gt, expr), gt))
 
diff --git a/spectec/test-middlend/TEST.md b/spectec/test-middlend/TEST.md
index 71be2c9d13..a427b8961d 100644
--- a/spectec/test-middlend/TEST.md
+++ b/spectec/test-middlend/TEST.md
@@ -87,46 +87,43 @@ syntax resulttype = valtype*
 ;; 1-syntax.watsup:59.1-60.16
 syntax limits = `[%..%]`(u32, u32)
 
-;; 1-syntax.watsup:61.1-62.6
-syntax mutflag = MUT
+;; 1-syntax.watsup:61.1-62.15
+syntax globaltype = `MUT%?%`(()?, valtype)
 
-;; 1-syntax.watsup:63.1-64.19
-syntax globaltype = `%?%`(mutflag?, valtype)
-
-;; 1-syntax.watsup:65.1-66.27
+;; 1-syntax.watsup:63.1-64.27
 syntax functype = `%->%`(resulttype, resulttype)
 
-;; 1-syntax.watsup:67.1-68.17
+;; 1-syntax.watsup:65.1-66.17
 syntax tabletype = `%%`(limits, reftype)
 
-;; 1-syntax.watsup:69.1-70.12
+;; 1-syntax.watsup:67.1-68.12
 syntax memtype = `%I8`(limits)
 
-;; 1-syntax.watsup:71.1-72.10
+;; 1-syntax.watsup:69.1-70.10
 syntax elemtype = reftype
 
-;; 1-syntax.watsup:73.1-74.5
+;; 1-syntax.watsup:71.1-72.5
 syntax datatype = OK
 
-;; 1-syntax.watsup:75.1-76.69
+;; 1-syntax.watsup:73.1-74.69
 syntax externtype =
   | GLOBAL(globaltype)
   | FUNC(functype)
   | TABLE(tabletype)
   | MEMORY(memtype)
 
-;; 1-syntax.watsup:89.1-89.44
+;; 1-syntax.watsup:86.1-86.44
 syntax sx =
   | U
   | S
 
-;; 1-syntax.watsup:91.1-91.39
+;; 1-syntax.watsup:88.1-88.39
 syntax unop_IXX =
   | CLZ
   | CTZ
   | POPCNT
 
-;; 1-syntax.watsup:92.1-92.70
+;; 1-syntax.watsup:89.1-89.70
 syntax unop_FXX =
   | ABS
   | NEG
@@ -136,7 +133,7 @@ syntax unop_FXX =
   | TRUNC
   | NEAREST
 
-;; 1-syntax.watsup:94.1-96.62
+;; 1-syntax.watsup:91.1-93.62
 syntax binop_IXX =
   | ADD
   | SUB
@@ -151,7 +148,7 @@ syntax binop_IXX =
   | ROTL
   | ROTR
 
-;; 1-syntax.watsup:97.1-97.66
+;; 1-syntax.watsup:94.1-94.66
 syntax binop_FXX =
   | ADD
   | SUB
@@ -161,15 +158,15 @@ syntax binop_FXX =
   | MAX
   | COPYSIGN
 
-;; 1-syntax.watsup:99.1-99.26
+;; 1-syntax.watsup:96.1-96.26
 syntax testop_IXX =
   | EQZ
 
-;; 1-syntax.watsup:100.1-100.22
+;; 1-syntax.watsup:97.1-97.22
 syntax testop_FXX =
   |
 
-;; 1-syntax.watsup:102.1-103.108
+;; 1-syntax.watsup:99.1-100.108
 syntax relop_IXX =
   | EQ
   | NE
@@ -178,7 +175,7 @@ syntax relop_IXX =
   | LE(sx)
   | GE(sx)
 
-;; 1-syntax.watsup:104.1-104.49
+;; 1-syntax.watsup:101.1-101.49
 syntax relop_FXX =
   | EQ
   | NE
@@ -187,44 +184,44 @@ syntax relop_FXX =
   | LE
   | GE
 
-;; 1-syntax.watsup:106.1-106.50
+;; 1-syntax.watsup:103.1-103.50
 syntax unop_numtype =
   | _I(unop_IXX)
   | _F(unop_FXX)
 
-;; 1-syntax.watsup:107.1-107.53
+;; 1-syntax.watsup:104.1-104.53
 syntax binop_numtype =
   | _I(binop_IXX)
   | _F(binop_FXX)
 
-;; 1-syntax.watsup:108.1-108.56
+;; 1-syntax.watsup:105.1-105.56
 syntax testop_numtype =
   | _I(testop_IXX)
   | _F(testop_FXX)
 
-;; 1-syntax.watsup:109.1-109.53
+;; 1-syntax.watsup:106.1-106.53
 syntax relop_numtype =
   | _I(relop_IXX)
   | _F(relop_FXX)
 
-;; 1-syntax.watsup:110.1-110.39
+;; 1-syntax.watsup:107.1-107.39
 syntax cvtop =
   | CONVERT
   | REINTERPRET
 
-;; 1-syntax.watsup:120.1-120.23
+;; 1-syntax.watsup:117.1-117.23
 syntax c_numtype = nat
 
-;; 1-syntax.watsup:121.1-121.23
+;; 1-syntax.watsup:118.1-118.23
 syntax c_vectype = nat
 
-;; 1-syntax.watsup:124.1-124.52
+;; 1-syntax.watsup:121.1-121.52
 syntax blocktype = functype
 
-;; 1-syntax.watsup:159.1-180.80
+;; 1-syntax.watsup:156.1-177.80
 rec {
 
-;; 1-syntax.watsup:159.1-180.80
+;; 1-syntax.watsup:156.1-177.80
 syntax instr =
   | UNREACHABLE
   | NOP
@@ -272,53 +269,53 @@ syntax instr =
   | STORE(numtype, n?, u32, u32)
 }
 
-;; 1-syntax.watsup:182.1-183.9
+;; 1-syntax.watsup:179.1-180.9
 syntax expr = instr*
 
-;; 1-syntax.watsup:190.1-190.50
+;; 1-syntax.watsup:187.1-187.50
 syntax elemmode =
   | TABLE(tableidx, expr)
   | DECLARE
 
-;; 1-syntax.watsup:191.1-191.39
+;; 1-syntax.watsup:188.1-188.39
 syntax datamode =
   | MEMORY(memidx, expr)
 
-;; 1-syntax.watsup:193.1-194.30
+;; 1-syntax.watsup:190.1-191.30
 syntax func = `FUNC%%*%`(functype, valtype*, expr)
 
-;; 1-syntax.watsup:195.1-196.25
+;; 1-syntax.watsup:192.1-193.25
 syntax global = GLOBAL(globaltype, expr)
 
-;; 1-syntax.watsup:197.1-198.18
+;; 1-syntax.watsup:194.1-195.18
 syntax table = TABLE(tabletype)
 
-;; 1-syntax.watsup:199.1-200.17
+;; 1-syntax.watsup:196.1-197.17
 syntax mem = MEMORY(memtype)
 
-;; 1-syntax.watsup:201.1-202.31
+;; 1-syntax.watsup:198.1-199.31
 syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
 
-;; 1-syntax.watsup:203.1-204.26
+;; 1-syntax.watsup:200.1-201.26
 syntax data = `DATA(*)%*%?`(byte**, datamode?)
 
-;; 1-syntax.watsup:205.1-206.16
+;; 1-syntax.watsup:202.1-203.16
 syntax start = START(funcidx)
 
-;; 1-syntax.watsup:208.1-209.65
+;; 1-syntax.watsup:205.1-206.65
 syntax externuse =
   | FUNC(funcidx)
   | GLOBAL(globalidx)
   | TABLE(tableidx)
   | MEMORY(memidx)
 
-;; 1-syntax.watsup:210.1-211.24
+;; 1-syntax.watsup:207.1-208.24
 syntax export = EXPORT(name, externuse)
 
-;; 1-syntax.watsup:212.1-213.30
+;; 1-syntax.watsup:209.1-210.30
 syntax import = IMPORT(name, name, externtype)
 
-;; 1-syntax.watsup:215.1-216.70
+;; 1-syntax.watsup:212.1-213.70
 syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
 
 ;; 2-aux.watsup:3.1-3.14
@@ -661,14 +658,14 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:281.1-283.29
-  rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
+  rule global.get {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
-    -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(()?{}, t))
 
   ;; 3-typing.watsup:285.1-287.28
   rule global.set {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
-    -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
 
   ;; 3-typing.watsup:290.1-292.28
   rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
@@ -808,7 +805,7 @@ relation Instr_const: `%|-%CONST`(context, instr)
   ;; 3-typing.watsup:380.1-382.32
   rule global.get {C : context, t : valtype, x : idx}:
     `%|-%CONST`(C, GLOBAL.GET_instr(x))
-    -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(), t))
 
 ;; 3-typing.watsup:368.1-368.77
 relation Expr_const: `%|-%CONST`(context, expr)
@@ -840,7 +837,7 @@ relation Global_ok: `%|-%:%`(context, global, globaltype)
   rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
     `%|-%:%`(C, GLOBAL(gt, expr), gt)
     -- Globaltype_ok: `|-%:OK`(gt)
-    -- if (gt = `%?%`(MUT?{}, t))
+    -- if (gt = `MUT%?%`(()?{}, t))
     -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
 
 ;; 3-typing.watsup:399.1-399.74
@@ -1752,46 +1749,43 @@ syntax resulttype = valtype*
 ;; 1-syntax.watsup:59.1-60.16
 syntax limits = `[%..%]`(u32, u32)
 
-;; 1-syntax.watsup:61.1-62.6
-syntax mutflag = MUT
+;; 1-syntax.watsup:61.1-62.15
+syntax globaltype = `MUT%?%`(()?, valtype)
 
-;; 1-syntax.watsup:63.1-64.19
-syntax globaltype = `%?%`(mutflag?, valtype)
-
-;; 1-syntax.watsup:65.1-66.27
+;; 1-syntax.watsup:63.1-64.27
 syntax functype = `%->%`(resulttype, resulttype)
 
-;; 1-syntax.watsup:67.1-68.17
+;; 1-syntax.watsup:65.1-66.17
 syntax tabletype = `%%`(limits, reftype)
 
-;; 1-syntax.watsup:69.1-70.12
+;; 1-syntax.watsup:67.1-68.12
 syntax memtype = `%I8`(limits)
 
-;; 1-syntax.watsup:71.1-72.10
+;; 1-syntax.watsup:69.1-70.10
 syntax elemtype = reftype
 
-;; 1-syntax.watsup:73.1-74.5
+;; 1-syntax.watsup:71.1-72.5
 syntax datatype = OK
 
-;; 1-syntax.watsup:75.1-76.69
+;; 1-syntax.watsup:73.1-74.69
 syntax externtype =
   | GLOBAL(globaltype)
   | FUNC(functype)
   | TABLE(tabletype)
   | MEMORY(memtype)
 
-;; 1-syntax.watsup:89.1-89.44
+;; 1-syntax.watsup:86.1-86.44
 syntax sx =
   | U
   | S
 
-;; 1-syntax.watsup:91.1-91.39
+;; 1-syntax.watsup:88.1-88.39
 syntax unop_IXX =
   | CLZ
   | CTZ
   | POPCNT
 
-;; 1-syntax.watsup:92.1-92.70
+;; 1-syntax.watsup:89.1-89.70
 syntax unop_FXX =
   | ABS
   | NEG
@@ -1801,7 +1795,7 @@ syntax unop_FXX =
   | TRUNC
   | NEAREST
 
-;; 1-syntax.watsup:94.1-96.62
+;; 1-syntax.watsup:91.1-93.62
 syntax binop_IXX =
   | ADD
   | SUB
@@ -1816,7 +1810,7 @@ syntax binop_IXX =
   | ROTL
   | ROTR
 
-;; 1-syntax.watsup:97.1-97.66
+;; 1-syntax.watsup:94.1-94.66
 syntax binop_FXX =
   | ADD
   | SUB
@@ -1826,15 +1820,15 @@ syntax binop_FXX =
   | MAX
   | COPYSIGN
 
-;; 1-syntax.watsup:99.1-99.26
+;; 1-syntax.watsup:96.1-96.26
 syntax testop_IXX =
   | EQZ
 
-;; 1-syntax.watsup:100.1-100.22
+;; 1-syntax.watsup:97.1-97.22
 syntax testop_FXX =
   |
 
-;; 1-syntax.watsup:102.1-103.108
+;; 1-syntax.watsup:99.1-100.108
 syntax relop_IXX =
   | EQ
   | NE
@@ -1843,7 +1837,7 @@ syntax relop_IXX =
   | LE(sx)
   | GE(sx)
 
-;; 1-syntax.watsup:104.1-104.49
+;; 1-syntax.watsup:101.1-101.49
 syntax relop_FXX =
   | EQ
   | NE
@@ -1852,44 +1846,44 @@ syntax relop_FXX =
   | LE
   | GE
 
-;; 1-syntax.watsup:106.1-106.50
+;; 1-syntax.watsup:103.1-103.50
 syntax unop_numtype =
   | _I(unop_IXX)
   | _F(unop_FXX)
 
-;; 1-syntax.watsup:107.1-107.53
+;; 1-syntax.watsup:104.1-104.53
 syntax binop_numtype =
   | _I(binop_IXX)
   | _F(binop_FXX)
 
-;; 1-syntax.watsup:108.1-108.56
+;; 1-syntax.watsup:105.1-105.56
 syntax testop_numtype =
   | _I(testop_IXX)
   | _F(testop_FXX)
 
-;; 1-syntax.watsup:109.1-109.53
+;; 1-syntax.watsup:106.1-106.53
 syntax relop_numtype =
   | _I(relop_IXX)
   | _F(relop_FXX)
 
-;; 1-syntax.watsup:110.1-110.39
+;; 1-syntax.watsup:107.1-107.39
 syntax cvtop =
   | CONVERT
   | REINTERPRET
 
-;; 1-syntax.watsup:120.1-120.23
+;; 1-syntax.watsup:117.1-117.23
 syntax c_numtype = nat
 
-;; 1-syntax.watsup:121.1-121.23
+;; 1-syntax.watsup:118.1-118.23
 syntax c_vectype = nat
 
-;; 1-syntax.watsup:124.1-124.52
+;; 1-syntax.watsup:121.1-121.52
 syntax blocktype = functype
 
-;; 1-syntax.watsup:159.1-180.80
+;; 1-syntax.watsup:156.1-177.80
 rec {
 
-;; 1-syntax.watsup:159.1-180.80
+;; 1-syntax.watsup:156.1-177.80
 syntax instr =
   | UNREACHABLE
   | NOP
@@ -1937,53 +1931,53 @@ syntax instr =
   | STORE(numtype, n?, u32, u32)
 }
 
-;; 1-syntax.watsup:182.1-183.9
+;; 1-syntax.watsup:179.1-180.9
 syntax expr = instr*
 
-;; 1-syntax.watsup:190.1-190.50
+;; 1-syntax.watsup:187.1-187.50
 syntax elemmode =
   | TABLE(tableidx, expr)
   | DECLARE
 
-;; 1-syntax.watsup:191.1-191.39
+;; 1-syntax.watsup:188.1-188.39
 syntax datamode =
   | MEMORY(memidx, expr)
 
-;; 1-syntax.watsup:193.1-194.30
+;; 1-syntax.watsup:190.1-191.30
 syntax func = `FUNC%%*%`(functype, valtype*, expr)
 
-;; 1-syntax.watsup:195.1-196.25
+;; 1-syntax.watsup:192.1-193.25
 syntax global = GLOBAL(globaltype, expr)
 
-;; 1-syntax.watsup:197.1-198.18
+;; 1-syntax.watsup:194.1-195.18
 syntax table = TABLE(tabletype)
 
-;; 1-syntax.watsup:199.1-200.17
+;; 1-syntax.watsup:196.1-197.17
 syntax mem = MEMORY(memtype)
 
-;; 1-syntax.watsup:201.1-202.31
+;; 1-syntax.watsup:198.1-199.31
 syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
 
-;; 1-syntax.watsup:203.1-204.26
+;; 1-syntax.watsup:200.1-201.26
 syntax data = `DATA(*)%*%?`(byte**, datamode?)
 
-;; 1-syntax.watsup:205.1-206.16
+;; 1-syntax.watsup:202.1-203.16
 syntax start = START(funcidx)
 
-;; 1-syntax.watsup:208.1-209.65
+;; 1-syntax.watsup:205.1-206.65
 syntax externuse =
   | FUNC(funcidx)
   | GLOBAL(globalidx)
   | TABLE(tableidx)
   | MEMORY(memidx)
 
-;; 1-syntax.watsup:210.1-211.24
+;; 1-syntax.watsup:207.1-208.24
 syntax export = EXPORT(name, externuse)
 
-;; 1-syntax.watsup:212.1-213.30
+;; 1-syntax.watsup:209.1-210.30
 syntax import = IMPORT(name, name, externtype)
 
-;; 1-syntax.watsup:215.1-216.70
+;; 1-syntax.watsup:212.1-213.70
 syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
 
 ;; 2-aux.watsup:3.1-3.14
@@ -2326,14 +2320,14 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:281.1-283.29
-  rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
+  rule global.get {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
-    -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(()?{}, t))
 
   ;; 3-typing.watsup:285.1-287.28
   rule global.set {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
-    -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
 
   ;; 3-typing.watsup:290.1-292.28
   rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
@@ -2473,7 +2467,7 @@ relation Instr_const: `%|-%CONST`(context, instr)
   ;; 3-typing.watsup:380.1-382.32
   rule global.get {C : context, t : valtype, x : idx}:
     `%|-%CONST`(C, GLOBAL.GET_instr(x))
-    -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(), t))
 
 ;; 3-typing.watsup:368.1-368.77
 relation Expr_const: `%|-%CONST`(context, expr)
@@ -2505,7 +2499,7 @@ relation Global_ok: `%|-%:%`(context, global, globaltype)
   rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
     `%|-%:%`(C, GLOBAL(gt, expr), gt)
     -- Globaltype_ok: `|-%:OK`(gt)
-    -- if (gt = `%?%`(MUT?{}, t))
+    -- if (gt = `MUT%?%`(()?{}, t))
     -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
 
 ;; 3-typing.watsup:399.1-399.74
@@ -3480,46 +3474,43 @@ syntax resulttype = valtype*
 ;; 1-syntax.watsup:59.1-60.16
 syntax limits = `[%..%]`(u32, u32)
 
-;; 1-syntax.watsup:61.1-62.6
-syntax mutflag = MUT
+;; 1-syntax.watsup:61.1-62.15
+syntax globaltype = `MUT%?%`(()?, valtype)
 
-;; 1-syntax.watsup:63.1-64.19
-syntax globaltype = `%?%`(mutflag?, valtype)
-
-;; 1-syntax.watsup:65.1-66.27
+;; 1-syntax.watsup:63.1-64.27
 syntax functype = `%->%`(resulttype, resulttype)
 
-;; 1-syntax.watsup:67.1-68.17
+;; 1-syntax.watsup:65.1-66.17
 syntax tabletype = `%%`(limits, reftype)
 
-;; 1-syntax.watsup:69.1-70.12
+;; 1-syntax.watsup:67.1-68.12
 syntax memtype = `%I8`(limits)
 
-;; 1-syntax.watsup:71.1-72.10
+;; 1-syntax.watsup:69.1-70.10
 syntax elemtype = reftype
 
-;; 1-syntax.watsup:73.1-74.5
+;; 1-syntax.watsup:71.1-72.5
 syntax datatype = OK
 
-;; 1-syntax.watsup:75.1-76.69
+;; 1-syntax.watsup:73.1-74.69
 syntax externtype =
   | GLOBAL(globaltype)
   | FUNC(functype)
   | TABLE(tabletype)
   | MEMORY(memtype)
 
-;; 1-syntax.watsup:89.1-89.44
+;; 1-syntax.watsup:86.1-86.44
 syntax sx =
   | U
   | S
 
-;; 1-syntax.watsup:91.1-91.39
+;; 1-syntax.watsup:88.1-88.39
 syntax unop_IXX =
   | CLZ
   | CTZ
   | POPCNT
 
-;; 1-syntax.watsup:92.1-92.70
+;; 1-syntax.watsup:89.1-89.70
 syntax unop_FXX =
   | ABS
   | NEG
@@ -3529,7 +3520,7 @@ syntax unop_FXX =
   | TRUNC
   | NEAREST
 
-;; 1-syntax.watsup:94.1-96.62
+;; 1-syntax.watsup:91.1-93.62
 syntax binop_IXX =
   | ADD
   | SUB
@@ -3544,7 +3535,7 @@ syntax binop_IXX =
   | ROTL
   | ROTR
 
-;; 1-syntax.watsup:97.1-97.66
+;; 1-syntax.watsup:94.1-94.66
 syntax binop_FXX =
   | ADD
   | SUB
@@ -3554,15 +3545,15 @@ syntax binop_FXX =
   | MAX
   | COPYSIGN
 
-;; 1-syntax.watsup:99.1-99.26
+;; 1-syntax.watsup:96.1-96.26
 syntax testop_IXX =
   | EQZ
 
-;; 1-syntax.watsup:100.1-100.22
+;; 1-syntax.watsup:97.1-97.22
 syntax testop_FXX =
   |
 
-;; 1-syntax.watsup:102.1-103.108
+;; 1-syntax.watsup:99.1-100.108
 syntax relop_IXX =
   | EQ
   | NE
@@ -3571,7 +3562,7 @@ syntax relop_IXX =
   | LE(sx)
   | GE(sx)
 
-;; 1-syntax.watsup:104.1-104.49
+;; 1-syntax.watsup:101.1-101.49
 syntax relop_FXX =
   | EQ
   | NE
@@ -3580,44 +3571,44 @@ syntax relop_FXX =
   | LE
   | GE
 
-;; 1-syntax.watsup:106.1-106.50
+;; 1-syntax.watsup:103.1-103.50
 syntax unop_numtype =
   | _I(unop_IXX)
   | _F(unop_FXX)
 
-;; 1-syntax.watsup:107.1-107.53
+;; 1-syntax.watsup:104.1-104.53
 syntax binop_numtype =
   | _I(binop_IXX)
   | _F(binop_FXX)
 
-;; 1-syntax.watsup:108.1-108.56
+;; 1-syntax.watsup:105.1-105.56
 syntax testop_numtype =
   | _I(testop_IXX)
   | _F(testop_FXX)
 
-;; 1-syntax.watsup:109.1-109.53
+;; 1-syntax.watsup:106.1-106.53
 syntax relop_numtype =
   | _I(relop_IXX)
   | _F(relop_FXX)
 
-;; 1-syntax.watsup:110.1-110.39
+;; 1-syntax.watsup:107.1-107.39
 syntax cvtop =
   | CONVERT
   | REINTERPRET
 
-;; 1-syntax.watsup:120.1-120.23
+;; 1-syntax.watsup:117.1-117.23
 syntax c_numtype = nat
 
-;; 1-syntax.watsup:121.1-121.23
+;; 1-syntax.watsup:118.1-118.23
 syntax c_vectype = nat
 
-;; 1-syntax.watsup:124.1-124.52
+;; 1-syntax.watsup:121.1-121.52
 syntax blocktype = functype
 
-;; 1-syntax.watsup:159.1-180.80
+;; 1-syntax.watsup:156.1-177.80
 rec {
 
-;; 1-syntax.watsup:159.1-180.80
+;; 1-syntax.watsup:156.1-177.80
 syntax instr =
   | UNREACHABLE
   | NOP
@@ -3665,53 +3656,53 @@ syntax instr =
   | STORE(numtype, n?, u32, u32)
 }
 
-;; 1-syntax.watsup:182.1-183.9
+;; 1-syntax.watsup:179.1-180.9
 syntax expr = instr*
 
-;; 1-syntax.watsup:190.1-190.50
+;; 1-syntax.watsup:187.1-187.50
 syntax elemmode =
   | TABLE(tableidx, expr)
   | DECLARE
 
-;; 1-syntax.watsup:191.1-191.39
+;; 1-syntax.watsup:188.1-188.39
 syntax datamode =
   | MEMORY(memidx, expr)
 
-;; 1-syntax.watsup:193.1-194.30
+;; 1-syntax.watsup:190.1-191.30
 syntax func = `FUNC%%*%`(functype, valtype*, expr)
 
-;; 1-syntax.watsup:195.1-196.25
+;; 1-syntax.watsup:192.1-193.25
 syntax global = GLOBAL(globaltype, expr)
 
-;; 1-syntax.watsup:197.1-198.18
+;; 1-syntax.watsup:194.1-195.18
 syntax table = TABLE(tabletype)
 
-;; 1-syntax.watsup:199.1-200.17
+;; 1-syntax.watsup:196.1-197.17
 syntax mem = MEMORY(memtype)
 
-;; 1-syntax.watsup:201.1-202.31
+;; 1-syntax.watsup:198.1-199.31
 syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
 
-;; 1-syntax.watsup:203.1-204.26
+;; 1-syntax.watsup:200.1-201.26
 syntax data = `DATA(*)%*%?`(byte**, datamode?)
 
-;; 1-syntax.watsup:205.1-206.16
+;; 1-syntax.watsup:202.1-203.16
 syntax start = START(funcidx)
 
-;; 1-syntax.watsup:208.1-209.65
+;; 1-syntax.watsup:205.1-206.65
 syntax externuse =
   | FUNC(funcidx)
   | GLOBAL(globalidx)
   | TABLE(tableidx)
   | MEMORY(memidx)
 
-;; 1-syntax.watsup:210.1-211.24
+;; 1-syntax.watsup:207.1-208.24
 syntax export = EXPORT(name, externuse)
 
-;; 1-syntax.watsup:212.1-213.30
+;; 1-syntax.watsup:209.1-210.30
 syntax import = IMPORT(name, name, externtype)
 
-;; 1-syntax.watsup:215.1-216.70
+;; 1-syntax.watsup:212.1-213.70
 syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
 
 ;; 2-aux.watsup:3.1-3.14
@@ -4055,14 +4046,14 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:281.1-283.29
-  rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
+  rule global.get {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
-    -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(()?{}, t))
 
   ;; 3-typing.watsup:285.1-287.28
   rule global.set {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
-    -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
 
   ;; 3-typing.watsup:290.1-292.28
   rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
@@ -4202,7 +4193,7 @@ relation Instr_const: `%|-%CONST`(context, instr)
   ;; 3-typing.watsup:380.1-382.32
   rule global.get {C : context, t : valtype, x : idx}:
     `%|-%CONST`(C, GLOBAL.GET_instr(x))
-    -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(), t))
 
 ;; 3-typing.watsup:368.1-368.77
 relation Expr_const: `%|-%CONST`(context, expr)
@@ -4234,7 +4225,7 @@ relation Global_ok: `%|-%:%`(context, global, globaltype)
   rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
     `%|-%:%`(C, GLOBAL(gt, expr), gt)
     -- Globaltype_ok: `|-%:OK`(gt)
-    -- if (gt = `%?%`(MUT?{}, t))
+    -- if (gt = `MUT%?%`(()?{}, t))
     -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
 
 ;; 3-typing.watsup:399.1-399.74
@@ -5210,46 +5201,43 @@ syntax resulttype = valtype*
 ;; 1-syntax.watsup:59.1-60.16
 syntax limits = `[%..%]`(u32, u32)
 
-;; 1-syntax.watsup:61.1-62.6
-syntax mutflag = MUT
+;; 1-syntax.watsup:61.1-62.15
+syntax globaltype = `MUT%?%`(()?, valtype)
 
-;; 1-syntax.watsup:63.1-64.19
-syntax globaltype = `%?%`(mutflag?, valtype)
-
-;; 1-syntax.watsup:65.1-66.27
+;; 1-syntax.watsup:63.1-64.27
 syntax functype = `%->%`(resulttype, resulttype)
 
-;; 1-syntax.watsup:67.1-68.17
+;; 1-syntax.watsup:65.1-66.17
 syntax tabletype = `%%`(limits, reftype)
 
-;; 1-syntax.watsup:69.1-70.12
+;; 1-syntax.watsup:67.1-68.12
 syntax memtype = `%I8`(limits)
 
-;; 1-syntax.watsup:71.1-72.10
+;; 1-syntax.watsup:69.1-70.10
 syntax elemtype = reftype
 
-;; 1-syntax.watsup:73.1-74.5
+;; 1-syntax.watsup:71.1-72.5
 syntax datatype = OK
 
-;; 1-syntax.watsup:75.1-76.69
+;; 1-syntax.watsup:73.1-74.69
 syntax externtype =
   | GLOBAL(globaltype)
   | FUNC(functype)
   | TABLE(tabletype)
   | MEMORY(memtype)
 
-;; 1-syntax.watsup:89.1-89.44
+;; 1-syntax.watsup:86.1-86.44
 syntax sx =
   | U
   | S
 
-;; 1-syntax.watsup:91.1-91.39
+;; 1-syntax.watsup:88.1-88.39
 syntax unop_IXX =
   | CLZ
   | CTZ
   | POPCNT
 
-;; 1-syntax.watsup:92.1-92.70
+;; 1-syntax.watsup:89.1-89.70
 syntax unop_FXX =
   | ABS
   | NEG
@@ -5259,7 +5247,7 @@ syntax unop_FXX =
   | TRUNC
   | NEAREST
 
-;; 1-syntax.watsup:94.1-96.62
+;; 1-syntax.watsup:91.1-93.62
 syntax binop_IXX =
   | ADD
   | SUB
@@ -5274,7 +5262,7 @@ syntax binop_IXX =
   | ROTL
   | ROTR
 
-;; 1-syntax.watsup:97.1-97.66
+;; 1-syntax.watsup:94.1-94.66
 syntax binop_FXX =
   | ADD
   | SUB
@@ -5284,15 +5272,15 @@ syntax binop_FXX =
   | MAX
   | COPYSIGN
 
-;; 1-syntax.watsup:99.1-99.26
+;; 1-syntax.watsup:96.1-96.26
 syntax testop_IXX =
   | EQZ
 
-;; 1-syntax.watsup:100.1-100.22
+;; 1-syntax.watsup:97.1-97.22
 syntax testop_FXX =
   |
 
-;; 1-syntax.watsup:102.1-103.108
+;; 1-syntax.watsup:99.1-100.108
 syntax relop_IXX =
   | EQ
   | NE
@@ -5301,7 +5289,7 @@ syntax relop_IXX =
   | LE(sx)
   | GE(sx)
 
-;; 1-syntax.watsup:104.1-104.49
+;; 1-syntax.watsup:101.1-101.49
 syntax relop_FXX =
   | EQ
   | NE
@@ -5310,44 +5298,44 @@ syntax relop_FXX =
   | LE
   | GE
 
-;; 1-syntax.watsup:106.1-106.50
+;; 1-syntax.watsup:103.1-103.50
 syntax unop_numtype =
   | _I(unop_IXX)
   | _F(unop_FXX)
 
-;; 1-syntax.watsup:107.1-107.53
+;; 1-syntax.watsup:104.1-104.53
 syntax binop_numtype =
   | _I(binop_IXX)
   | _F(binop_FXX)
 
-;; 1-syntax.watsup:108.1-108.56
+;; 1-syntax.watsup:105.1-105.56
 syntax testop_numtype =
   | _I(testop_IXX)
   | _F(testop_FXX)
 
-;; 1-syntax.watsup:109.1-109.53
+;; 1-syntax.watsup:106.1-106.53
 syntax relop_numtype =
   | _I(relop_IXX)
   | _F(relop_FXX)
 
-;; 1-syntax.watsup:110.1-110.39
+;; 1-syntax.watsup:107.1-107.39
 syntax cvtop =
   | CONVERT
   | REINTERPRET
 
-;; 1-syntax.watsup:120.1-120.23
+;; 1-syntax.watsup:117.1-117.23
 syntax c_numtype = nat
 
-;; 1-syntax.watsup:121.1-121.23
+;; 1-syntax.watsup:118.1-118.23
 syntax c_vectype = nat
 
-;; 1-syntax.watsup:124.1-124.52
+;; 1-syntax.watsup:121.1-121.52
 syntax blocktype = functype
 
-;; 1-syntax.watsup:159.1-180.80
+;; 1-syntax.watsup:156.1-177.80
 rec {
 
-;; 1-syntax.watsup:159.1-180.80
+;; 1-syntax.watsup:156.1-177.80
 syntax instr =
   | UNREACHABLE
   | NOP
@@ -5395,53 +5383,53 @@ syntax instr =
   | STORE(numtype, n?, u32, u32)
 }
 
-;; 1-syntax.watsup:182.1-183.9
+;; 1-syntax.watsup:179.1-180.9
 syntax expr = instr*
 
-;; 1-syntax.watsup:190.1-190.50
+;; 1-syntax.watsup:187.1-187.50
 syntax elemmode =
   | TABLE(tableidx, expr)
   | DECLARE
 
-;; 1-syntax.watsup:191.1-191.39
+;; 1-syntax.watsup:188.1-188.39
 syntax datamode =
   | MEMORY(memidx, expr)
 
-;; 1-syntax.watsup:193.1-194.30
+;; 1-syntax.watsup:190.1-191.30
 syntax func = `FUNC%%*%`(functype, valtype*, expr)
 
-;; 1-syntax.watsup:195.1-196.25
+;; 1-syntax.watsup:192.1-193.25
 syntax global = GLOBAL(globaltype, expr)
 
-;; 1-syntax.watsup:197.1-198.18
+;; 1-syntax.watsup:194.1-195.18
 syntax table = TABLE(tabletype)
 
-;; 1-syntax.watsup:199.1-200.17
+;; 1-syntax.watsup:196.1-197.17
 syntax mem = MEMORY(memtype)
 
-;; 1-syntax.watsup:201.1-202.31
+;; 1-syntax.watsup:198.1-199.31
 syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
 
-;; 1-syntax.watsup:203.1-204.26
+;; 1-syntax.watsup:200.1-201.26
 syntax data = `DATA(*)%*%?`(byte**, datamode?)
 
-;; 1-syntax.watsup:205.1-206.16
+;; 1-syntax.watsup:202.1-203.16
 syntax start = START(funcidx)
 
-;; 1-syntax.watsup:208.1-209.65
+;; 1-syntax.watsup:205.1-206.65
 syntax externuse =
   | FUNC(funcidx)
   | GLOBAL(globalidx)
   | TABLE(tableidx)
   | MEMORY(memidx)
 
-;; 1-syntax.watsup:210.1-211.24
+;; 1-syntax.watsup:207.1-208.24
 syntax export = EXPORT(name, externuse)
 
-;; 1-syntax.watsup:212.1-213.30
+;; 1-syntax.watsup:209.1-210.30
 syntax import = IMPORT(name, name, externtype)
 
-;; 1-syntax.watsup:215.1-216.70
+;; 1-syntax.watsup:212.1-213.70
 syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
 
 ;; 2-aux.watsup:3.1-3.14
@@ -5790,14 +5778,14 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:281.1-283.29
-  rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
+  rule global.get {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
-    -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(()?{}, t))
 
   ;; 3-typing.watsup:285.1-287.28
   rule global.set {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
-    -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
 
   ;; 3-typing.watsup:290.1-292.28
   rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
@@ -5941,7 +5929,7 @@ relation Instr_const: `%|-%CONST`(context, instr)
   ;; 3-typing.watsup:380.1-382.32
   rule global.get {C : context, t : valtype, x : idx}:
     `%|-%CONST`(C, GLOBAL.GET_instr(x))
-    -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(), t))
 
 ;; 3-typing.watsup:368.1-368.77
 relation Expr_const: `%|-%CONST`(context, expr)
@@ -5973,7 +5961,7 @@ relation Global_ok: `%|-%:%`(context, global, globaltype)
   rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
     `%|-%:%`(C, GLOBAL(gt, expr), gt)
     -- Globaltype_ok: `|-%:OK`(gt)
-    -- if (gt = `%?%`(MUT?{}, t))
+    -- if (gt = `MUT%?%`(()?{}, t))
     -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
 
 ;; 3-typing.watsup:399.1-399.74
@@ -6959,46 +6947,43 @@ syntax resulttype = valtype*
 ;; 1-syntax.watsup:59.1-60.16
 syntax limits = `[%..%]`(u32, u32)
 
-;; 1-syntax.watsup:61.1-62.6
-syntax mutflag = MUT
+;; 1-syntax.watsup:61.1-62.15
+syntax globaltype = `MUT%?%`(()?, valtype)
 
-;; 1-syntax.watsup:63.1-64.19
-syntax globaltype = `%?%`(mutflag?, valtype)
-
-;; 1-syntax.watsup:65.1-66.27
+;; 1-syntax.watsup:63.1-64.27
 syntax functype = `%->%`(resulttype, resulttype)
 
-;; 1-syntax.watsup:67.1-68.17
+;; 1-syntax.watsup:65.1-66.17
 syntax tabletype = `%%`(limits, reftype)
 
-;; 1-syntax.watsup:69.1-70.12
+;; 1-syntax.watsup:67.1-68.12
 syntax memtype = `%I8`(limits)
 
-;; 1-syntax.watsup:71.1-72.10
+;; 1-syntax.watsup:69.1-70.10
 syntax elemtype = reftype
 
-;; 1-syntax.watsup:73.1-74.5
+;; 1-syntax.watsup:71.1-72.5
 syntax datatype = OK
 
-;; 1-syntax.watsup:75.1-76.69
+;; 1-syntax.watsup:73.1-74.69
 syntax externtype =
   | GLOBAL(globaltype)
   | FUNC(functype)
   | TABLE(tabletype)
   | MEMORY(memtype)
 
-;; 1-syntax.watsup:89.1-89.44
+;; 1-syntax.watsup:86.1-86.44
 syntax sx =
   | U
   | S
 
-;; 1-syntax.watsup:91.1-91.39
+;; 1-syntax.watsup:88.1-88.39
 syntax unop_IXX =
   | CLZ
   | CTZ
   | POPCNT
 
-;; 1-syntax.watsup:92.1-92.70
+;; 1-syntax.watsup:89.1-89.70
 syntax unop_FXX =
   | ABS
   | NEG
@@ -7008,7 +6993,7 @@ syntax unop_FXX =
   | TRUNC
   | NEAREST
 
-;; 1-syntax.watsup:94.1-96.62
+;; 1-syntax.watsup:91.1-93.62
 syntax binop_IXX =
   | ADD
   | SUB
@@ -7023,7 +7008,7 @@ syntax binop_IXX =
   | ROTL
   | ROTR
 
-;; 1-syntax.watsup:97.1-97.66
+;; 1-syntax.watsup:94.1-94.66
 syntax binop_FXX =
   | ADD
   | SUB
@@ -7033,15 +7018,15 @@ syntax binop_FXX =
   | MAX
   | COPYSIGN
 
-;; 1-syntax.watsup:99.1-99.26
+;; 1-syntax.watsup:96.1-96.26
 syntax testop_IXX =
   | EQZ
 
-;; 1-syntax.watsup:100.1-100.22
+;; 1-syntax.watsup:97.1-97.22
 syntax testop_FXX =
   |
 
-;; 1-syntax.watsup:102.1-103.108
+;; 1-syntax.watsup:99.1-100.108
 syntax relop_IXX =
   | EQ
   | NE
@@ -7050,7 +7035,7 @@ syntax relop_IXX =
   | LE(sx)
   | GE(sx)
 
-;; 1-syntax.watsup:104.1-104.49
+;; 1-syntax.watsup:101.1-101.49
 syntax relop_FXX =
   | EQ
   | NE
@@ -7059,44 +7044,44 @@ syntax relop_FXX =
   | LE
   | GE
 
-;; 1-syntax.watsup:106.1-106.50
+;; 1-syntax.watsup:103.1-103.50
 syntax unop_numtype =
   | _I(unop_IXX)
   | _F(unop_FXX)
 
-;; 1-syntax.watsup:107.1-107.53
+;; 1-syntax.watsup:104.1-104.53
 syntax binop_numtype =
   | _I(binop_IXX)
   | _F(binop_FXX)
 
-;; 1-syntax.watsup:108.1-108.56
+;; 1-syntax.watsup:105.1-105.56
 syntax testop_numtype =
   | _I(testop_IXX)
   | _F(testop_FXX)
 
-;; 1-syntax.watsup:109.1-109.53
+;; 1-syntax.watsup:106.1-106.53
 syntax relop_numtype =
   | _I(relop_IXX)
   | _F(relop_FXX)
 
-;; 1-syntax.watsup:110.1-110.39
+;; 1-syntax.watsup:107.1-107.39
 syntax cvtop =
   | CONVERT
   | REINTERPRET
 
-;; 1-syntax.watsup:120.1-120.23
+;; 1-syntax.watsup:117.1-117.23
 syntax c_numtype = nat
 
-;; 1-syntax.watsup:121.1-121.23
+;; 1-syntax.watsup:118.1-118.23
 syntax c_vectype = nat
 
-;; 1-syntax.watsup:124.1-124.52
+;; 1-syntax.watsup:121.1-121.52
 syntax blocktype = functype
 
-;; 1-syntax.watsup:159.1-180.80
+;; 1-syntax.watsup:156.1-177.80
 rec {
 
-;; 1-syntax.watsup:159.1-180.80
+;; 1-syntax.watsup:156.1-177.80
 syntax instr =
   | UNREACHABLE
   | NOP
@@ -7144,53 +7129,53 @@ syntax instr =
   | STORE(numtype, n?, u32, u32)
 }
 
-;; 1-syntax.watsup:182.1-183.9
+;; 1-syntax.watsup:179.1-180.9
 syntax expr = instr*
 
-;; 1-syntax.watsup:190.1-190.50
+;; 1-syntax.watsup:187.1-187.50
 syntax elemmode =
   | TABLE(tableidx, expr)
   | DECLARE
 
-;; 1-syntax.watsup:191.1-191.39
+;; 1-syntax.watsup:188.1-188.39
 syntax datamode =
   | MEMORY(memidx, expr)
 
-;; 1-syntax.watsup:193.1-194.30
+;; 1-syntax.watsup:190.1-191.30
 syntax func = `FUNC%%*%`(functype, valtype*, expr)
 
-;; 1-syntax.watsup:195.1-196.25
+;; 1-syntax.watsup:192.1-193.25
 syntax global = GLOBAL(globaltype, expr)
 
-;; 1-syntax.watsup:197.1-198.18
+;; 1-syntax.watsup:194.1-195.18
 syntax table = TABLE(tabletype)
 
-;; 1-syntax.watsup:199.1-200.17
+;; 1-syntax.watsup:196.1-197.17
 syntax mem = MEMORY(memtype)
 
-;; 1-syntax.watsup:201.1-202.31
+;; 1-syntax.watsup:198.1-199.31
 syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
 
-;; 1-syntax.watsup:203.1-204.26
+;; 1-syntax.watsup:200.1-201.26
 syntax data = `DATA(*)%*%?`(byte**, datamode?)
 
-;; 1-syntax.watsup:205.1-206.16
+;; 1-syntax.watsup:202.1-203.16
 syntax start = START(funcidx)
 
-;; 1-syntax.watsup:208.1-209.65
+;; 1-syntax.watsup:205.1-206.65
 syntax externuse =
   | FUNC(funcidx)
   | GLOBAL(globalidx)
   | TABLE(tableidx)
   | MEMORY(memidx)
 
-;; 1-syntax.watsup:210.1-211.24
+;; 1-syntax.watsup:207.1-208.24
 syntax export = EXPORT(name, externuse)
 
-;; 1-syntax.watsup:212.1-213.30
+;; 1-syntax.watsup:209.1-210.30
 syntax import = IMPORT(name, name, externtype)
 
-;; 1-syntax.watsup:215.1-216.70
+;; 1-syntax.watsup:212.1-213.70
 syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
 
 ;; 2-aux.watsup:3.1-3.14
@@ -7550,16 +7535,16 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:281.1-283.29
-  rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
+  rule global.get {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
     -- if (x < |C.GLOBAL_context|)
-    -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(()?{}, t))
 
   ;; 3-typing.watsup:285.1-287.28
   rule global.set {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
     -- if (x < |C.GLOBAL_context|)
-    -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
 
   ;; 3-typing.watsup:290.1-292.28
   rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
@@ -7726,7 +7711,7 @@ relation Instr_const: `%|-%CONST`(context, instr)
   rule global.get {C : context, t : valtype, x : idx}:
     `%|-%CONST`(C, GLOBAL.GET_instr(x))
     -- if (x < |C.GLOBAL_context|)
-    -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(), t))
 
 ;; 3-typing.watsup:368.1-368.77
 relation Expr_const: `%|-%CONST`(context, expr)
@@ -7758,7 +7743,7 @@ relation Global_ok: `%|-%:%`(context, global, globaltype)
   rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
     `%|-%:%`(C, GLOBAL(gt, expr), gt)
     -- Globaltype_ok: `|-%:OK`(gt)
-    -- if (gt = `%?%`(MUT?{}, t))
+    -- if (gt = `MUT%?%`(()?{}, t))
     -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
 
 ;; 3-typing.watsup:399.1-399.74
@@ -8764,46 +8749,43 @@ syntax resulttype = valtype*
 ;; 1-syntax.watsup:59.1-60.16
 syntax limits = `[%..%]`(u32, u32)
 
-;; 1-syntax.watsup:61.1-62.6
-syntax mutflag = MUT
+;; 1-syntax.watsup:61.1-62.15
+syntax globaltype = `MUT%?%`(()?, valtype)
 
-;; 1-syntax.watsup:63.1-64.19
-syntax globaltype = `%?%`(mutflag?, valtype)
-
-;; 1-syntax.watsup:65.1-66.27
+;; 1-syntax.watsup:63.1-64.27
 syntax functype = `%->%`(resulttype, resulttype)
 
-;; 1-syntax.watsup:67.1-68.17
+;; 1-syntax.watsup:65.1-66.17
 syntax tabletype = `%%`(limits, reftype)
 
-;; 1-syntax.watsup:69.1-70.12
+;; 1-syntax.watsup:67.1-68.12
 syntax memtype = `%I8`(limits)
 
-;; 1-syntax.watsup:71.1-72.10
+;; 1-syntax.watsup:69.1-70.10
 syntax elemtype = reftype
 
-;; 1-syntax.watsup:73.1-74.5
+;; 1-syntax.watsup:71.1-72.5
 syntax datatype = OK
 
-;; 1-syntax.watsup:75.1-76.69
+;; 1-syntax.watsup:73.1-74.69
 syntax externtype =
   | GLOBAL(globaltype)
   | FUNC(functype)
   | TABLE(tabletype)
   | MEMORY(memtype)
 
-;; 1-syntax.watsup:89.1-89.44
+;; 1-syntax.watsup:86.1-86.44
 syntax sx =
   | U
   | S
 
-;; 1-syntax.watsup:91.1-91.39
+;; 1-syntax.watsup:88.1-88.39
 syntax unop_IXX =
   | CLZ
   | CTZ
   | POPCNT
 
-;; 1-syntax.watsup:92.1-92.70
+;; 1-syntax.watsup:89.1-89.70
 syntax unop_FXX =
   | ABS
   | NEG
@@ -8813,7 +8795,7 @@ syntax unop_FXX =
   | TRUNC
   | NEAREST
 
-;; 1-syntax.watsup:94.1-96.62
+;; 1-syntax.watsup:91.1-93.62
 syntax binop_IXX =
   | ADD
   | SUB
@@ -8828,7 +8810,7 @@ syntax binop_IXX =
   | ROTL
   | ROTR
 
-;; 1-syntax.watsup:97.1-97.66
+;; 1-syntax.watsup:94.1-94.66
 syntax binop_FXX =
   | ADD
   | SUB
@@ -8838,15 +8820,15 @@ syntax binop_FXX =
   | MAX
   | COPYSIGN
 
-;; 1-syntax.watsup:99.1-99.26
+;; 1-syntax.watsup:96.1-96.26
 syntax testop_IXX =
   | EQZ
 
-;; 1-syntax.watsup:100.1-100.22
+;; 1-syntax.watsup:97.1-97.22
 syntax testop_FXX =
   |
 
-;; 1-syntax.watsup:102.1-103.108
+;; 1-syntax.watsup:99.1-100.108
 syntax relop_IXX =
   | EQ
   | NE
@@ -8855,7 +8837,7 @@ syntax relop_IXX =
   | LE(sx)
   | GE(sx)
 
-;; 1-syntax.watsup:104.1-104.49
+;; 1-syntax.watsup:101.1-101.49
 syntax relop_FXX =
   | EQ
   | NE
@@ -8864,44 +8846,44 @@ syntax relop_FXX =
   | LE
   | GE
 
-;; 1-syntax.watsup:106.1-106.50
+;; 1-syntax.watsup:103.1-103.50
 syntax unop_numtype =
   | _I(unop_IXX)
   | _F(unop_FXX)
 
-;; 1-syntax.watsup:107.1-107.53
+;; 1-syntax.watsup:104.1-104.53
 syntax binop_numtype =
   | _I(binop_IXX)
   | _F(binop_FXX)
 
-;; 1-syntax.watsup:108.1-108.56
+;; 1-syntax.watsup:105.1-105.56
 syntax testop_numtype =
   | _I(testop_IXX)
   | _F(testop_FXX)
 
-;; 1-syntax.watsup:109.1-109.53
+;; 1-syntax.watsup:106.1-106.53
 syntax relop_numtype =
   | _I(relop_IXX)
   | _F(relop_FXX)
 
-;; 1-syntax.watsup:110.1-110.39
+;; 1-syntax.watsup:107.1-107.39
 syntax cvtop =
   | CONVERT
   | REINTERPRET
 
-;; 1-syntax.watsup:120.1-120.23
+;; 1-syntax.watsup:117.1-117.23
 syntax c_numtype = nat
 
-;; 1-syntax.watsup:121.1-121.23
+;; 1-syntax.watsup:118.1-118.23
 syntax c_vectype = nat
 
-;; 1-syntax.watsup:124.1-124.52
+;; 1-syntax.watsup:121.1-121.52
 syntax blocktype = functype
 
-;; 1-syntax.watsup:159.1-180.80
+;; 1-syntax.watsup:156.1-177.80
 rec {
 
-;; 1-syntax.watsup:159.1-180.80
+;; 1-syntax.watsup:156.1-177.80
 syntax instr =
   | UNREACHABLE
   | NOP
@@ -8949,53 +8931,53 @@ syntax instr =
   | STORE(numtype, n?, u32, u32)
 }
 
-;; 1-syntax.watsup:182.1-183.9
+;; 1-syntax.watsup:179.1-180.9
 syntax expr = instr*
 
-;; 1-syntax.watsup:190.1-190.50
+;; 1-syntax.watsup:187.1-187.50
 syntax elemmode =
   | TABLE(tableidx, expr)
   | DECLARE
 
-;; 1-syntax.watsup:191.1-191.39
+;; 1-syntax.watsup:188.1-188.39
 syntax datamode =
   | MEMORY(memidx, expr)
 
-;; 1-syntax.watsup:193.1-194.30
+;; 1-syntax.watsup:190.1-191.30
 syntax func = `FUNC%%*%`(functype, valtype*, expr)
 
-;; 1-syntax.watsup:195.1-196.25
+;; 1-syntax.watsup:192.1-193.25
 syntax global = GLOBAL(globaltype, expr)
 
-;; 1-syntax.watsup:197.1-198.18
+;; 1-syntax.watsup:194.1-195.18
 syntax table = TABLE(tabletype)
 
-;; 1-syntax.watsup:199.1-200.17
+;; 1-syntax.watsup:196.1-197.17
 syntax mem = MEMORY(memtype)
 
-;; 1-syntax.watsup:201.1-202.31
+;; 1-syntax.watsup:198.1-199.31
 syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
 
-;; 1-syntax.watsup:203.1-204.26
+;; 1-syntax.watsup:200.1-201.26
 syntax data = `DATA(*)%*%?`(byte**, datamode?)
 
-;; 1-syntax.watsup:205.1-206.16
+;; 1-syntax.watsup:202.1-203.16
 syntax start = START(funcidx)
 
-;; 1-syntax.watsup:208.1-209.65
+;; 1-syntax.watsup:205.1-206.65
 syntax externuse =
   | FUNC(funcidx)
   | GLOBAL(globalidx)
   | TABLE(tableidx)
   | MEMORY(memidx)
 
-;; 1-syntax.watsup:210.1-211.24
+;; 1-syntax.watsup:207.1-208.24
 syntax export = EXPORT(name, externuse)
 
-;; 1-syntax.watsup:212.1-213.30
+;; 1-syntax.watsup:209.1-210.30
 syntax import = IMPORT(name, name, externtype)
 
-;; 1-syntax.watsup:215.1-216.70
+;; 1-syntax.watsup:212.1-213.70
 syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
 
 ;; 2-aux.watsup:3.1-3.14
@@ -9355,16 +9337,16 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:281.1-283.29
-  rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
+  rule global.get {C : context, t : valtype, x : idx, w0 : ()?}:
     `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
     -- if (x < |C.GLOBAL_context|)
-    -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(w0, t))
 
   ;; 3-typing.watsup:285.1-287.28
   rule global.set {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
     -- if (x < |C.GLOBAL_context|)
-    -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
 
   ;; 3-typing.watsup:290.1-292.28
   rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
@@ -9531,7 +9513,7 @@ relation Instr_const: `%|-%CONST`(context, instr)
   rule global.get {C : context, t : valtype, x : idx}:
     `%|-%CONST`(C, GLOBAL.GET_instr(x))
     -- if (x < |C.GLOBAL_context|)
-    -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(), t))
 
 ;; 3-typing.watsup:368.1-368.77
 relation Expr_const: `%|-%CONST`(context, expr)
@@ -9560,10 +9542,10 @@ relation Func_ok: `%|-%:%`(context, func, functype)
 ;; 3-typing.watsup:398.1-398.75
 relation Global_ok: `%|-%:%`(context, global, globaltype)
   ;; 3-typing.watsup:414.1-418.40
-  rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
+  rule _ {C : context, expr : expr, gt : globaltype, t : valtype, w0 : ()?}:
     `%|-%:%`(C, GLOBAL(gt, expr), gt)
     -- Globaltype_ok: `|-%:OK`(gt)
-    -- if (gt = `%?%`(MUT?{}, t))
+    -- if (gt = `MUT%?%`(w0, t))
     -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
 
 ;; 3-typing.watsup:399.1-399.74
@@ -10569,46 +10551,43 @@ syntax resulttype = valtype*
 ;; 1-syntax.watsup:59.1-60.16
 syntax limits = `[%..%]`(u32, u32)
 
-;; 1-syntax.watsup:61.1-62.6
-syntax mutflag = MUT
+;; 1-syntax.watsup:61.1-62.15
+syntax globaltype = `MUT%?%`(()?, valtype)
 
-;; 1-syntax.watsup:63.1-64.19
-syntax globaltype = `%?%`(mutflag?, valtype)
-
-;; 1-syntax.watsup:65.1-66.27
+;; 1-syntax.watsup:63.1-64.27
 syntax functype = `%->%`(resulttype, resulttype)
 
-;; 1-syntax.watsup:67.1-68.17
+;; 1-syntax.watsup:65.1-66.17
 syntax tabletype = `%%`(limits, reftype)
 
-;; 1-syntax.watsup:69.1-70.12
+;; 1-syntax.watsup:67.1-68.12
 syntax memtype = `%I8`(limits)
 
-;; 1-syntax.watsup:71.1-72.10
+;; 1-syntax.watsup:69.1-70.10
 syntax elemtype = reftype
 
-;; 1-syntax.watsup:73.1-74.5
+;; 1-syntax.watsup:71.1-72.5
 syntax datatype = OK
 
-;; 1-syntax.watsup:75.1-76.69
+;; 1-syntax.watsup:73.1-74.69
 syntax externtype =
   | GLOBAL(globaltype)
   | FUNC(functype)
   | TABLE(tabletype)
   | MEMORY(memtype)
 
-;; 1-syntax.watsup:89.1-89.44
+;; 1-syntax.watsup:86.1-86.44
 syntax sx =
   | U
   | S
 
-;; 1-syntax.watsup:91.1-91.39
+;; 1-syntax.watsup:88.1-88.39
 syntax unop_IXX =
   | CLZ
   | CTZ
   | POPCNT
 
-;; 1-syntax.watsup:92.1-92.70
+;; 1-syntax.watsup:89.1-89.70
 syntax unop_FXX =
   | ABS
   | NEG
@@ -10618,7 +10597,7 @@ syntax unop_FXX =
   | TRUNC
   | NEAREST
 
-;; 1-syntax.watsup:94.1-96.62
+;; 1-syntax.watsup:91.1-93.62
 syntax binop_IXX =
   | ADD
   | SUB
@@ -10633,7 +10612,7 @@ syntax binop_IXX =
   | ROTL
   | ROTR
 
-;; 1-syntax.watsup:97.1-97.66
+;; 1-syntax.watsup:94.1-94.66
 syntax binop_FXX =
   | ADD
   | SUB
@@ -10643,15 +10622,15 @@ syntax binop_FXX =
   | MAX
   | COPYSIGN
 
-;; 1-syntax.watsup:99.1-99.26
+;; 1-syntax.watsup:96.1-96.26
 syntax testop_IXX =
   | EQZ
 
-;; 1-syntax.watsup:100.1-100.22
+;; 1-syntax.watsup:97.1-97.22
 syntax testop_FXX =
   |
 
-;; 1-syntax.watsup:102.1-103.108
+;; 1-syntax.watsup:99.1-100.108
 syntax relop_IXX =
   | EQ
   | NE
@@ -10660,7 +10639,7 @@ syntax relop_IXX =
   | LE(sx)
   | GE(sx)
 
-;; 1-syntax.watsup:104.1-104.49
+;; 1-syntax.watsup:101.1-101.49
 syntax relop_FXX =
   | EQ
   | NE
@@ -10669,44 +10648,44 @@ syntax relop_FXX =
   | LE
   | GE
 
-;; 1-syntax.watsup:106.1-106.50
+;; 1-syntax.watsup:103.1-103.50
 syntax unop_numtype =
   | _I(unop_IXX)
   | _F(unop_FXX)
 
-;; 1-syntax.watsup:107.1-107.53
+;; 1-syntax.watsup:104.1-104.53
 syntax binop_numtype =
   | _I(binop_IXX)
   | _F(binop_FXX)
 
-;; 1-syntax.watsup:108.1-108.56
+;; 1-syntax.watsup:105.1-105.56
 syntax testop_numtype =
   | _I(testop_IXX)
   | _F(testop_FXX)
 
-;; 1-syntax.watsup:109.1-109.53
+;; 1-syntax.watsup:106.1-106.53
 syntax relop_numtype =
   | _I(relop_IXX)
   | _F(relop_FXX)
 
-;; 1-syntax.watsup:110.1-110.39
+;; 1-syntax.watsup:107.1-107.39
 syntax cvtop =
   | CONVERT
   | REINTERPRET
 
-;; 1-syntax.watsup:120.1-120.23
+;; 1-syntax.watsup:117.1-117.23
 syntax c_numtype = nat
 
-;; 1-syntax.watsup:121.1-121.23
+;; 1-syntax.watsup:118.1-118.23
 syntax c_vectype = nat
 
-;; 1-syntax.watsup:124.1-124.52
+;; 1-syntax.watsup:121.1-121.52
 syntax blocktype = functype
 
-;; 1-syntax.watsup:159.1-180.80
+;; 1-syntax.watsup:156.1-177.80
 rec {
 
-;; 1-syntax.watsup:159.1-180.80
+;; 1-syntax.watsup:156.1-177.80
 syntax instr =
   | UNREACHABLE
   | NOP
@@ -10754,53 +10733,53 @@ syntax instr =
   | STORE(numtype, n?, u32, u32)
 }
 
-;; 1-syntax.watsup:182.1-183.9
+;; 1-syntax.watsup:179.1-180.9
 syntax expr = instr*
 
-;; 1-syntax.watsup:190.1-190.50
+;; 1-syntax.watsup:187.1-187.50
 syntax elemmode =
   | TABLE(tableidx, expr)
   | DECLARE
 
-;; 1-syntax.watsup:191.1-191.39
+;; 1-syntax.watsup:188.1-188.39
 syntax datamode =
   | MEMORY(memidx, expr)
 
-;; 1-syntax.watsup:193.1-194.30
+;; 1-syntax.watsup:190.1-191.30
 syntax func = `FUNC%%*%`(functype, valtype*, expr)
 
-;; 1-syntax.watsup:195.1-196.25
+;; 1-syntax.watsup:192.1-193.25
 syntax global = GLOBAL(globaltype, expr)
 
-;; 1-syntax.watsup:197.1-198.18
+;; 1-syntax.watsup:194.1-195.18
 syntax table = TABLE(tabletype)
 
-;; 1-syntax.watsup:199.1-200.17
+;; 1-syntax.watsup:196.1-197.17
 syntax mem = MEMORY(memtype)
 
-;; 1-syntax.watsup:201.1-202.31
+;; 1-syntax.watsup:198.1-199.31
 syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
 
-;; 1-syntax.watsup:203.1-204.26
+;; 1-syntax.watsup:200.1-201.26
 syntax data = `DATA(*)%*%?`(byte**, datamode?)
 
-;; 1-syntax.watsup:205.1-206.16
+;; 1-syntax.watsup:202.1-203.16
 syntax start = START(funcidx)
 
-;; 1-syntax.watsup:208.1-209.65
+;; 1-syntax.watsup:205.1-206.65
 syntax externuse =
   | FUNC(funcidx)
   | GLOBAL(globalidx)
   | TABLE(tableidx)
   | MEMORY(memidx)
 
-;; 1-syntax.watsup:210.1-211.24
+;; 1-syntax.watsup:207.1-208.24
 syntax export = EXPORT(name, externuse)
 
-;; 1-syntax.watsup:212.1-213.30
+;; 1-syntax.watsup:209.1-210.30
 syntax import = IMPORT(name, name, externtype)
 
-;; 1-syntax.watsup:215.1-216.70
+;; 1-syntax.watsup:212.1-213.70
 syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
 
 ;; 2-aux.watsup:3.1-3.14
@@ -11160,16 +11139,16 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:281.1-283.29
-  rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
+  rule global.get {C : context, t : valtype, x : idx, w0 : ()?}:
     `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
     -- if (x < |C.GLOBAL_context|)
-    -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(w0, t))
 
   ;; 3-typing.watsup:285.1-287.28
   rule global.set {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
     -- if (x < |C.GLOBAL_context|)
-    -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
 
   ;; 3-typing.watsup:290.1-292.28
   rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
@@ -11336,7 +11315,7 @@ relation Instr_const: `%|-%CONST`(context, instr)
   rule global.get {C : context, t : valtype, x : idx}:
     `%|-%CONST`(C, GLOBAL.GET_instr(x))
     -- if (x < |C.GLOBAL_context|)
-    -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(), t))
 
 ;; 3-typing.watsup:368.1-368.77
 relation Expr_const: `%|-%CONST`(context, expr)
@@ -11365,10 +11344,10 @@ relation Func_ok: `%|-%:%`(context, func, functype)
 ;; 3-typing.watsup:398.1-398.75
 relation Global_ok: `%|-%:%`(context, global, globaltype)
   ;; 3-typing.watsup:414.1-418.40
-  rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
+  rule _ {C : context, expr : expr, gt : globaltype, t : valtype, w0 : ()?}:
     `%|-%:%`(C, GLOBAL(gt, expr), gt)
     -- Globaltype_ok: `|-%:OK`(gt)
-    -- if (gt = `%?%`(MUT?{}, t))
+    -- if (gt = `MUT%?%`(w0, t))
     -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
 
 ;; 3-typing.watsup:399.1-399.74
@@ -12553,46 +12532,43 @@ syntax resulttype = valtype*
 ;; 1-syntax.watsup:59.1-60.16
 syntax limits = `[%..%]`(u32, u32)
 
-;; 1-syntax.watsup:61.1-62.6
-syntax mutflag = MUT
+;; 1-syntax.watsup:61.1-62.15
+syntax globaltype = `MUT%?%`(()?, valtype)
 
-;; 1-syntax.watsup:63.1-64.19
-syntax globaltype = `%?%`(mutflag?, valtype)
-
-;; 1-syntax.watsup:65.1-66.27
+;; 1-syntax.watsup:63.1-64.27
 syntax functype = `%->%`(resulttype, resulttype)
 
-;; 1-syntax.watsup:67.1-68.17
+;; 1-syntax.watsup:65.1-66.17
 syntax tabletype = `%%`(limits, reftype)
 
-;; 1-syntax.watsup:69.1-70.12
+;; 1-syntax.watsup:67.1-68.12
 syntax memtype = `%I8`(limits)
 
-;; 1-syntax.watsup:71.1-72.10
+;; 1-syntax.watsup:69.1-70.10
 syntax elemtype = reftype
 
-;; 1-syntax.watsup:73.1-74.5
+;; 1-syntax.watsup:71.1-72.5
 syntax datatype = OK
 
-;; 1-syntax.watsup:75.1-76.69
+;; 1-syntax.watsup:73.1-74.69
 syntax externtype =
   | GLOBAL(globaltype)
   | FUNC(functype)
   | TABLE(tabletype)
   | MEMORY(memtype)
 
-;; 1-syntax.watsup:89.1-89.44
+;; 1-syntax.watsup:86.1-86.44
 syntax sx =
   | U
   | S
 
-;; 1-syntax.watsup:91.1-91.39
+;; 1-syntax.watsup:88.1-88.39
 syntax unop_IXX =
   | CLZ
   | CTZ
   | POPCNT
 
-;; 1-syntax.watsup:92.1-92.70
+;; 1-syntax.watsup:89.1-89.70
 syntax unop_FXX =
   | ABS
   | NEG
@@ -12602,7 +12578,7 @@ syntax unop_FXX =
   | TRUNC
   | NEAREST
 
-;; 1-syntax.watsup:94.1-96.62
+;; 1-syntax.watsup:91.1-93.62
 syntax binop_IXX =
   | ADD
   | SUB
@@ -12617,7 +12593,7 @@ syntax binop_IXX =
   | ROTL
   | ROTR
 
-;; 1-syntax.watsup:97.1-97.66
+;; 1-syntax.watsup:94.1-94.66
 syntax binop_FXX =
   | ADD
   | SUB
@@ -12627,15 +12603,15 @@ syntax binop_FXX =
   | MAX
   | COPYSIGN
 
-;; 1-syntax.watsup:99.1-99.26
+;; 1-syntax.watsup:96.1-96.26
 syntax testop_IXX =
   | EQZ
 
-;; 1-syntax.watsup:100.1-100.22
+;; 1-syntax.watsup:97.1-97.22
 syntax testop_FXX =
   |
 
-;; 1-syntax.watsup:102.1-103.108
+;; 1-syntax.watsup:99.1-100.108
 syntax relop_IXX =
   | EQ
   | NE
@@ -12644,7 +12620,7 @@ syntax relop_IXX =
   | LE(sx)
   | GE(sx)
 
-;; 1-syntax.watsup:104.1-104.49
+;; 1-syntax.watsup:101.1-101.49
 syntax relop_FXX =
   | EQ
   | NE
@@ -12653,44 +12629,44 @@ syntax relop_FXX =
   | LE
   | GE
 
-;; 1-syntax.watsup:106.1-106.50
+;; 1-syntax.watsup:103.1-103.50
 syntax unop_numtype =
   | _I(unop_IXX)
   | _F(unop_FXX)
 
-;; 1-syntax.watsup:107.1-107.53
+;; 1-syntax.watsup:104.1-104.53
 syntax binop_numtype =
   | _I(binop_IXX)
   | _F(binop_FXX)
 
-;; 1-syntax.watsup:108.1-108.56
+;; 1-syntax.watsup:105.1-105.56
 syntax testop_numtype =
   | _I(testop_IXX)
   | _F(testop_FXX)
 
-;; 1-syntax.watsup:109.1-109.53
+;; 1-syntax.watsup:106.1-106.53
 syntax relop_numtype =
   | _I(relop_IXX)
   | _F(relop_FXX)
 
-;; 1-syntax.watsup:110.1-110.39
+;; 1-syntax.watsup:107.1-107.39
 syntax cvtop =
   | CONVERT
   | REINTERPRET
 
-;; 1-syntax.watsup:120.1-120.23
+;; 1-syntax.watsup:117.1-117.23
 syntax c_numtype = nat
 
-;; 1-syntax.watsup:121.1-121.23
+;; 1-syntax.watsup:118.1-118.23
 syntax c_vectype = nat
 
-;; 1-syntax.watsup:124.1-124.52
+;; 1-syntax.watsup:121.1-121.52
 syntax blocktype = functype
 
-;; 1-syntax.watsup:159.1-180.80
+;; 1-syntax.watsup:156.1-177.80
 rec {
 
-;; 1-syntax.watsup:159.1-180.80
+;; 1-syntax.watsup:156.1-177.80
 syntax instr =
   | UNREACHABLE
   | NOP
@@ -12738,53 +12714,53 @@ syntax instr =
   | STORE(numtype, n?, u32, u32)
 }
 
-;; 1-syntax.watsup:182.1-183.9
+;; 1-syntax.watsup:179.1-180.9
 syntax expr = instr*
 
-;; 1-syntax.watsup:190.1-190.50
+;; 1-syntax.watsup:187.1-187.50
 syntax elemmode =
   | TABLE(tableidx, expr)
   | DECLARE
 
-;; 1-syntax.watsup:191.1-191.39
+;; 1-syntax.watsup:188.1-188.39
 syntax datamode =
   | MEMORY(memidx, expr)
 
-;; 1-syntax.watsup:193.1-194.30
+;; 1-syntax.watsup:190.1-191.30
 syntax func = `FUNC%%*%`(functype, valtype*, expr)
 
-;; 1-syntax.watsup:195.1-196.25
+;; 1-syntax.watsup:192.1-193.25
 syntax global = GLOBAL(globaltype, expr)
 
-;; 1-syntax.watsup:197.1-198.18
+;; 1-syntax.watsup:194.1-195.18
 syntax table = TABLE(tabletype)
 
-;; 1-syntax.watsup:199.1-200.17
+;; 1-syntax.watsup:196.1-197.17
 syntax mem = MEMORY(memtype)
 
-;; 1-syntax.watsup:201.1-202.31
+;; 1-syntax.watsup:198.1-199.31
 syntax elem = `ELEM%%*%?`(reftype, expr*, elemmode?)
 
-;; 1-syntax.watsup:203.1-204.26
+;; 1-syntax.watsup:200.1-201.26
 syntax data = `DATA(*)%*%?`(byte**, datamode?)
 
-;; 1-syntax.watsup:205.1-206.16
+;; 1-syntax.watsup:202.1-203.16
 syntax start = START(funcidx)
 
-;; 1-syntax.watsup:208.1-209.65
+;; 1-syntax.watsup:205.1-206.65
 syntax externuse =
   | FUNC(funcidx)
   | GLOBAL(globalidx)
   | TABLE(tableidx)
   | MEMORY(memidx)
 
-;; 1-syntax.watsup:210.1-211.24
+;; 1-syntax.watsup:207.1-208.24
 syntax export = EXPORT(name, externuse)
 
-;; 1-syntax.watsup:212.1-213.30
+;; 1-syntax.watsup:209.1-210.30
 syntax import = IMPORT(name, name, externtype)
 
-;; 1-syntax.watsup:215.1-216.70
+;; 1-syntax.watsup:212.1-213.70
 syntax module = `MODULE%*%*%*%*%*%*%*%*%*`(import*, func*, global*, table*, mem*, elem*, data*, start*, export*)
 
 ;; 2-aux.watsup:3.1-3.14
@@ -13144,16 +13120,16 @@ relation Instr_ok: `%|-%:%`(context, instr, functype)
     -- if (C.LOCAL_context[x] = t)
 
   ;; 3-typing.watsup:281.1-283.29
-  rule global.get {C : context, mut? : mutflag?, t : valtype, x : idx}:
+  rule global.get {C : context, t : valtype, x : idx, w0 : ()?}:
     `%|-%:%`(C, GLOBAL.GET_instr(x), `%->%`([], [t]))
     -- if (x < |C.GLOBAL_context|)
-    -- if (C.GLOBAL_context[x] = `%?%`(mut?{mut}, t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(w0, t))
 
   ;; 3-typing.watsup:285.1-287.28
   rule global.set {C : context, t : valtype, x : idx}:
     `%|-%:%`(C, GLOBAL.SET_instr(x), `%->%`([t], []))
     -- if (x < |C.GLOBAL_context|)
-    -- if (C.GLOBAL_context[x] = `%?%`(?(MUT), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(()), t))
 
   ;; 3-typing.watsup:290.1-292.28
   rule table.get {C : context, lim : limits, rt : reftype, x : idx}:
@@ -13320,7 +13296,7 @@ relation Instr_const: `%|-%CONST`(context, instr)
   rule global.get {C : context, t : valtype, x : idx}:
     `%|-%CONST`(C, GLOBAL.GET_instr(x))
     -- if (x < |C.GLOBAL_context|)
-    -- if (C.GLOBAL_context[x] = `%?%`(?(), t))
+    -- if (C.GLOBAL_context[x] = `MUT%?%`(?(), t))
 
 ;; 3-typing.watsup:368.1-368.77
 relation Expr_const: `%|-%CONST`(context, expr)
@@ -13349,10 +13325,10 @@ relation Func_ok: `%|-%:%`(context, func, functype)
 ;; 3-typing.watsup:398.1-398.75
 relation Global_ok: `%|-%:%`(context, global, globaltype)
   ;; 3-typing.watsup:414.1-418.40
-  rule _ {C : context, expr : expr, gt : globaltype, t : valtype}:
+  rule _ {C : context, expr : expr, gt : globaltype, t : valtype, w0 : ()?}:
     `%|-%:%`(C, GLOBAL(gt, expr), gt)
     -- Globaltype_ok: `|-%:OK`(gt)
-    -- if (gt = `%?%`(MUT?{}, t))
+    -- if (gt = `MUT%?%`(w0, t))
     -- Expr_ok_const: `%|-%:%CONST`(C, expr, t)
 
 ;; 3-typing.watsup:399.1-399.74

From 7beb979f94cae154733110d4a903cc691a853838 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Fri, 9 Jun 2023 10:17:52 +0200
Subject: [PATCH 96/98] Lean: Implement MulOp

---
 spectec/src/backend-lean4/gen.ml | 3 ++-
 spectec/test-lean4/SpecTec.lean  | 6 +++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index 2872a60183..ab1de20d3b 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -129,6 +129,7 @@ let rec render_exp (exp : exp) = match exp.it with
   | UnE (MinusOp, e1)      -> parens ("0 - " ^ render_exp e1)
   | BinE (AddOp, e1, e2)   -> parens (render_exp e1 ^ " + " ^ render_exp e2)
   | BinE (SubOp, e1, e2)   -> parens (render_exp e1 ^ " - " ^ render_exp e2)
+  | BinE (MulOp, e1, e2)   -> parens (render_exp e1 ^ " * " ^ render_exp e2)
   | BinE (ExpOp, e1, e2)   -> parens ("Nat.pow" $$ render_exp e1 $$ render_exp e2)
   | BinE (DivOp, e1, e2)   -> parens ("Nat.div" $$ render_exp e1 $$ render_exp e2)
   | BinE (AndOp, e1, e2)   -> parens (render_exp e1 ^ " && "  ^ render_exp e2)
@@ -156,7 +157,7 @@ and render_path (path : path) old_val (k : string -> string) : string = match pa
      "{" ^ old_val ^ " with " ^  render_field_name a ^ " := " ^ k (render_dot old_val a) ^ " }"
     )
   | SliceP (_path', _e1, _e2) ->
-    "default /- TODO -/"
+    "default /- TODO: SliceP -/"
   | IdxP (path', idx_exp) ->
     render_path path' old_val (fun old_val ->
       "(" ^ old_val ^ ".upd " ^ render_exp idx_exp ^ " " ^ k (render_idx old_val idx_exp) ^ ")"
diff --git a/spectec/test-lean4/SpecTec.lean b/spectec/test-lean4/SpecTec.lean
index 752a74b28c..8bec160b08 100644
--- a/spectec/test-lean4/SpecTec.lean
+++ b/spectec/test-lean4/SpecTec.lean
@@ -1345,7 +1345,7 @@ def «$with_tableext» : (State × Tableidx × (List Ref)) -> State
 
 
 def «$with_mem» : (State × Tableidx × Nat × Nat × (List Byte)) -> State
-  | ((s, f), x, i, j, b) => (default /- TODO -/, f)
+  | ((s, f), x, i, j, b) => (default /- TODO: SliceP -/, f)
 
 
 
@@ -1700,7 +1700,7 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
     ((«$bytes_» (n, c)) == default /- $mem(z, 0)[(i + n_O) : (n / 8)] -/) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.LOAD (nt, (some (n, sx)), n_A, n_O))]), [(Admininstr.CONST (nt, («$ext» (n, o0, sx, c))))]))
   | memory_size (n : N) (z : State) : 
-    (default /- ((n * 64) * $Ki) -/ == («$mem» (z, 0)).length) -> 
+    (((n * 64) * («$Ki» ())) == («$mem» (z, 0)).length) -> 
     (Step_read ((z, [Admininstr.MEMORY_SIZE]), [(Admininstr.CONST (Numtype.I32, n))]))
   | memory_fill_trap (i : Nat) (n : N) (val : Val) (z : State) : 
     ((i + n) > («$mem» (z, 0)).length) -> 
@@ -1778,7 +1778,7 @@ inductive Step : (Config × Config) -> Prop where
     (b == («$bytes_» (n, («$wrap_» ((o0, n), c))))) -> 
     (Step ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.CONST (nt, c)), (Admininstr.STORE (nt, (some n), n_A, n_O))]), ((«$with_mem» (z, 0, (i + n_O), (((Nat.div n) 8)), b)), [])))
   | memory_grow_succeed (n : N) (z : State) : 
-    (Step ((z, [(Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_GROW]), ((«$with_memext» (z, 0, [0])), [(Admininstr.CONST (Numtype.I32, (((Nat.div («$mem» (z, 0)).length) default /- (64 * $Ki) -/))))])))
+    (Step ((z, [(Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_GROW]), ((«$with_memext» (z, 0, [0])), [(Admininstr.CONST (Numtype.I32, (((Nat.div («$mem» (z, 0)).length) (64 * («$Ki» ()))))))])))
   | memory_grow_fail (n : N) (z : State) : 
     (Step ((z, [(Admininstr.CONST (Numtype.I32, n)), Admininstr.MEMORY_GROW]), (z, [(Admininstr.CONST (Numtype.I32, (0 - 1)))])))
   | data_drop (x : Idx) (z : State) : 

From b794380a8adc763fbfd1b0d67962175793d1cc42 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Thu, 29 Jun 2023 18:41:25 +0200
Subject: [PATCH 97/98] Implement SliceE and SliceP

---
 spectec/src/backend-lean4/gen.ml | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/spectec/src/backend-lean4/gen.ml b/spectec/src/backend-lean4/gen.ml
index ab1de20d3b..f0fc51566c 100644
--- a/spectec/src/backend-lean4/gen.ml
+++ b/spectec/src/backend-lean4/gen.ml
@@ -124,6 +124,7 @@ let rec render_exp (exp : exp) = match exp.it with
   | ExtE (exp1, path, exp2) ->
     render_path path (render_exp exp1) (fun old_val -> "List.append" $$$ [old_val;  render_exp exp2])
   | IdxE (e1, e2) -> render_idx (render_exp e1) e2
+  | SliceE (e1, e2, e3) -> render_slice (render_exp e1) e2 e3
   | LenE e -> render_exp e ^ ".length"
   | CallE (id, e) -> render_fun_id id $$ render_exp e
   | UnE (MinusOp, e1)      -> parens ("0 - " ^ render_exp e1)
@@ -149,6 +150,8 @@ and render_dot e_string a = e_string ^ "." ^ render_field_name a
 
 and render_idx e_string exp = parens (e_string ^ ".get! " ^ render_exp exp)
 
+and render_slice e_string e1 e2 = parens (e_string ^ ".slice " ^ render_exp e1 ^ " " ^ render_exp e2)
+
 (* The path is inside out, in a way, hence the continuation passing style here *)
 and render_path (path : path) old_val (k : string -> string) : string = match path.it with
   | RootP -> k old_val
@@ -156,8 +159,10 @@ and render_path (path : path) old_val (k : string -> string) : string = match pa
     render_path path' old_val (fun old_val ->
      "{" ^ old_val ^ " with " ^  render_field_name a ^ " := " ^ k (render_dot old_val a) ^ " }"
     )
-  | SliceP (_path', _e1, _e2) ->
-    "default /- TODO: SliceP -/"
+  | SliceP (path', idx1_exp, idx2_exp) ->
+    render_path path' old_val (fun old_val ->
+      "(" ^ old_val ^ ".upds " ^ render_exp idx1_exp ^ " " ^ render_exp idx2_exp ^ " " ^ k (render_slice old_val idx1_exp idx2_exp) ^ ")"
+    )
   | IdxP (path', idx_exp) ->
     render_path path' old_val (fun old_val ->
       "(" ^ old_val ^ ".upd " ^ render_exp idx_exp ^ " " ^ k (render_idx old_val idx_exp) ^ ")"
@@ -294,9 +299,13 @@ let gen_string (el : script) =
   "  | none => List.nil\n" ^
   "  | some x => [x]\n" ^
   "def List.upd : List α → Nat → α → List α\n" ^
-  "| [], _, _ => []\n" ^
-  "| x::xs, 0, y => y :: xs\n" ^
-  "| x::xs, n+1, y => x :: xs.upd n y\n" ^
+  "  | [], _, _ => []\n" ^
+  "  | x::xs, 0, y => y :: xs\n" ^
+  "  | x::xs, n+1, y => x :: xs.upd n y\n" ^
+  "def List.upds : List α → Nat → Nat → List α → List α\n" ^
+  "  | xs, n, m, ys => xs.take n ++ ys ++ xs.drop (n + m)\n" ^
+  "def List.slice : List α → Nat → Nat → List α\n" ^
+  "  | xs, n, m => (xs.drop n)\n" ^
   "\n\n" ^
   "/- Now, the generated code -/\n" ^
   "\n" ^

From 8a83393841d7348f5618ed918abee3efab454121 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Thu, 29 Jun 2023 19:04:10 +0200
Subject: [PATCH 98/98] Forgot to promote

---
 spectec/test-lean4/SpecTec.lean | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/spectec/test-lean4/SpecTec.lean b/spectec/test-lean4/SpecTec.lean
index 88314d32d1..c6095c8364 100644
--- a/spectec/test-lean4/SpecTec.lean
+++ b/spectec/test-lean4/SpecTec.lean
@@ -23,9 +23,13 @@ def Option.toList : Option α → List α
   | none => List.nil
   | some x => [x]
 def List.upd : List α → Nat → α → List α
-| [], _, _ => []
-| x::xs, 0, y => y :: xs
-| x::xs, n+1, y => x :: xs.upd n y
+  | [], _, _ => []
+  | x::xs, 0, y => y :: xs
+  | x::xs, n+1, y => x :: xs.upd n y
+def List.upds : List α → Nat → Nat → List α → List α
+  | xs, n, m, ys => xs.take n ++ ys ++ xs.drop (n + m)
+def List.slice : List α → Nat → Nat → List α
+  | xs, n, m => (xs.drop n)
 
 
 /- Now, the generated code -/
@@ -1344,7 +1348,7 @@ def «$with_tableext» : (State × Tableidx × (List Ref)) -> State
 
 
 def «$with_mem» : (State × Tableidx × Nat × Nat × (List Byte)) -> State
-  | ((s, f), x, i, j, b) => (default /- TODO: SliceP -/, f)
+  | ((s, f), x, i, j, b) => ({s with MEM := (s.MEM.upd (f.MODULE.MEM.get! x) ((s.MEM.get! (f.MODULE.MEM.get! x)).upds i j b)) }, f)
 
 
 
@@ -1689,14 +1693,14 @@ inductive Step_read : (Config × (List Admininstr)) -> Prop where
   | load_num_val (c : C_numtype) (i : Nat) (n_A : N) (n_O : N) (nt : Numtype) (z : State) (o0 : Nat) (o1 : Nat) : 
     ((«$size» («$valtype_numtype» nt)) == (some o0)) -> 
     ((«$size» («$valtype_numtype» nt)) == (some o1)) -> 
-    ((«$bytes_» (o0, c)) == default /- $mem(z, 0)[(i + n_O) : (o1 / 8)] -/) -> 
+    ((«$bytes_» (o0, c)) == ((«$mem» (z, 0)).slice (i + n_O) (((Nat.div o1) 8)))) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.LOAD (nt, none, n_A, n_O))]), [(Admininstr.CONST (nt, c))]))
   | load_pack_trap (i : Nat) (n : N) (n_A : N) (n_O : N) (nt : Numtype) (sx : Sx) (z : State) : 
     (((i + n_O) + (((Nat.div n) 8))) > («$mem» (z, 0)).length) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.LOAD (nt, (some (n, sx)), n_A, n_O))]), [Admininstr.TRAP]))
   | load_pack_val (c : C_numtype) (i : Nat) (n : N) (n_A : N) (n_O : N) (nt : Numtype) (sx : Sx) (z : State) (o0 : Nat) : 
     ((«$size» («$valtype_numtype» nt)) == (some o0)) -> 
-    ((«$bytes_» (n, c)) == default /- $mem(z, 0)[(i + n_O) : (n / 8)] -/) -> 
+    ((«$bytes_» (n, c)) == ((«$mem» (z, 0)).slice (i + n_O) (((Nat.div n) 8)))) -> 
     (Step_read ((z, [(Admininstr.CONST (Numtype.I32, i)), (Admininstr.LOAD (nt, (some (n, sx)), n_A, n_O))]), [(Admininstr.CONST (nt, («$ext» (n, o0, sx, c))))]))
   | memory_size (n : N) (z : State) : 
     (((n * 64) * («$Ki» ())) == («$mem» (z, 0)).length) ->