From 9919c270092ea77a633af5fc70d5531242ed8096 Mon Sep 17 00:00:00 2001
From: 0xGeorgii <accembler@gmail.com>
Date: Mon, 17 Aug 2026 08:19:36 +0900
Subject: [PATCH] HAssert aggregates

Closes #355
---
 CHANGELOG.md                                  |    5 +
 core/hassert/README.md                        |   10 +-
 core/hassert/src/codec.rs                     |   76 +-
 core/hassert/src/ir.rs                        |   46 +-
 core/hassert/src/lib.rs                       |   16 +-
 core/wasm-codegen/README.md                   |   18 +-
 .../docs/specification-obligations.md         |  303 +++
 core/wasm-codegen/src/hassert/diag.rs         |   79 +-
 core/wasm-codegen/src/hassert/mod.rs          |   15 +
 core/wasm-codegen/src/hassert/tests.rs        | 1834 ++++++++++++-
 core/wasm-codegen/src/hassert/translate.rs    | 2260 +++++++++++++++--
 core/wasm-to-v/ROCQ_CONTRACT.md               |   80 +-
 core/wasm-to-v/rocq-stub/README.md            |   61 +-
 .../rocq-stub/wasm_verifier/Assertions.v      |   12 +-
 core/wasm-to-v/src/hassert_print.rs           |   10 +-
 tests/src/codegen/wasm/multi_file.rs          |   16 +-
 tests/src/hassert_translation.rs              |  281 ++
 tests/src/rocq_typecheck.rs                   |  242 +-
 tests/src/spec_propagation.rs                 |   43 +-
 tests/test_data/inf/spec_aggregate_values.inf |   61 +
 .../test_data/inf/spec_bounded_iteration.inf  |   75 +
 .../inf/spec_quantifier_alternation.inf       |  118 +
 tests/test_data/rocq/spec_aggregate_values.v  |  104 +
 tests/test_data/rocq/spec_bounded_iteration.v |   87 +
 .../rocq/spec_quantifier_alternation.v        |  115 +
 25 files changed, 5593 insertions(+), 374 deletions(-)
 create mode 100644 core/wasm-codegen/docs/specification-obligations.md
 create mode 100644 tests/test_data/inf/spec_aggregate_values.inf
 create mode 100644 tests/test_data/inf/spec_bounded_iteration.inf
 create mode 100644 tests/test_data/inf/spec_quantifier_alternation.inf
 create mode 100644 tests/test_data/rocq/spec_aggregate_values.v
 create mode 100644 tests/test_data/rocq/spec_bounded_iteration.v
 create mode 100644 tests/test_data/rocq/spec_quantifier_alternation.v

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4f6dfc5f..7fe57005 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -180,6 +180,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Rocq Translation
 
+- Specifications can now state aggregate, element-wise and alternating-quantifier properties directly, instead of being rejected outright. A compound `@`, a compound parameter, an array or struct literal, and a copy of one are translated to a shape-preserving tree of *scalar leaves*: one universal slot with its own `HA_has_type` guard per leaf (one `HA_ex` binder per leaf in an existential context), enumerated arrays row-major and struct fields in layout order, allocated parameters-first-in-declaration-order then each `@` in binding order. So `let a: [i32; 3] = @; assert(a[0] <= a[0]);` produces a real obligation where it was **P008**, `a[0]` and `p.x` resolve against that tree at translation time where they were **P002**, and aggregate `==`/`!=` in assertion position is the leafwise conjunction (or its De Morgan dual) — `==` compares values, and an aggregate's value is exactly its ordered leaves. The supported surface is deliberately equal to the executable aggregate `@` surface, since proof mode lowers spec bodies through the same unrolling: arrays of scalars at any rank, and structs whose fields are scalars or one-dimensional scalar arrays. Arrays of structs (**A028**) and structs with struct or multidimensional-array fields (**A027**) stay rejected on every specification path — `@`, parameters and literals alike — so neither surface is wider than the other. An index the translation cannot fold binds a witness pinned by the unsigned range bound `i <u N` **first**, then one implication per element, which is what makes bounded iteration expressible: a `forall` binding an array and an index, assuming a bound on every element and a range for the index, and asserting the bound at that index emits a real obligation that discharges against the verifier (`tests/test_data/inf/spec_bounded_iteration.inf`). Out of range that definition is unsatisfiable and the enclosing atom is refuted — `a[i]` denotes *the element at index `i`, which exists*, a definedness rule rather than a mirror of any runtime check, since proof mode emits no bounds check at all; the alternative, a guarded implication leaving an out-of-range read vacuously satisfied, is exactly what **P010** rejects elsewhere. Constant steps of a chain descend first, so `m[1][j]` splits over the selected row, while two non-constant steps in one chain are **P002**. A `forall` block inside an `exists`/`assume` block of a `forall`/plain spec function now emits a real universal binder — new IR node `HAssert::All`, printed as wasm-verifier's derived `Hall`, carried on new `inference.hspecs` assert tag `0x0B` (section version stays **2**: the change is additive, an older decoder fails loudly with `UnknownHassertTag(0x0B)`, the linker decodes hspecs only from the main module, and recompilation rather than migration is the compatibility story) and declared in the vendored `coqc` stub. A free slot there would have been quantified by `ValidSpec`'s outer universal, turning `∃k. ∀x. P` into `∀x. ∃k. P` silently — which is why **P007** is lifted only for that nesting and kept inside `exists`/`unique`-quantified bodies, where every `@` is a hidden choice parameter the judgment quantifies operationally. Two new fatal diagnostics come with the encoding: **P013**, a per-spec-function running budget of 64 quantified scalar leaves (each leaf costs a binder level and a guard level, and the levels accumulate across every introduction in the function, so a per-introduction cap would not bound the shared assertion-depth budget; checked from the declared type before any leaf is materialized), and **P014**, a constant-*folded* out-of-bounds index (`const K: i32 = 5; a[K]`, `a[1 + 4]`), stating the same fact **A037** states for a direct-literal index at the spellings A037's pattern cannot see. One usability trap is inherent to the definedness rule and is documented rather than diagnosed: the emitted range bound is unsigned, so a *signed* index needs both `0 <= i` and `i < N` before its element denotes at all — supplying only the upper bound compiles clean and yields an obligation that is false, surfacing later as an unprovable Rocq goal. The two bounds are necessary, not sufficient: they make the element exist, while a claim about its *value* still needs hypotheses about the element's value, since a compound `@` states only the typing of its leaves. A `u32` index needs no lower bound and yields a simpler obligation. Unaffected: every committed `.v` golden is byte-identical, as is every proof-mode `.wasm` (the pass is read-only over the typed AST), and compile mode has no obligations; no previously emitted obligation shape changes, so no downstream proof needs restating. Migration: none — programs that compiled still compile, and programs that were rejected may now translate ([#355])
 - A data byte with no `byte_scope` notation now reaches the emitted `.v` as `(encode 18%Zst)` instead of `(encode 18%Z)`, and a module carrying a data segment claims that key in its preamble with a second conditional line — `Local Delimit Scope Z_scope with Zst.`, next to the `Open Scope byte_scope.` it already emitted. `%Zst` is a private delimiting key for the same standard `Z_scope` the literal always lived in (a Rocq scope may carry several keys), so the term denotes exactly what it denoted before. It is claimed because the `Z` key is not reliably `Z_scope`'s: mathcomp's algebra library delimits its own `int_scope` with it (`ssrint.v`, alongside a `Number Notation` on `int`), so in any file whose `Import`/`Export` chain applies that `Delimit` the argument of `(encode 18%Z)` re-reads as mathcomp's `int` and stops elaborating against `encode : Z -> byte`. Two files can be that file — the emitted `.v` itself, should the backend build behind its preamble ever re-export mathcomp algebra, and a consumer that imports it and restates emitted data bytes in its own text. Delimiting is last-writer-wins — whichever `Delimit` the chain applies last decides the key; an explicit `%Z` is read through the key regardless of which scopes are open, so `Open Scope Z_scope.` recovers nothing, and nothing a consumer writes downstream repairs a file that failed to compile on its own. Re-delimiting is the one measure that works, and taking a private key rather than taking `Z` back leaves mathcomp's own `%Z` intact for anything read alongside the module, while `Local` keeps the key from leaking to consumers that import the file. Unaffected: the 244 byte values that have a notation keep their `#78` spelling, and every module without a data segment is byte-identical, preamble included — Inference codegen emits no data segment, so no committed `.v` golden or corpus output moves and only foreign or statically-linked `.wasm` reaches the changed spelling. A downstream file that restates emitted data bytes in its own text must carry the same `Local Delimit` line ([#416])
 - The emitted `Ma` memarg helper in every Rocq `.v` file now binds `ofs al` instead of `of al` (`Definition Ma ofs al := {|memarg_offset := ofs; memarg_align := al|}.`): `of` is an ordinary identifier in vanilla Rocq but a keyword under ssreflect, so a consumer importing mathcomp ahead of the emitted definitions hit a parse error on that preamble line before reaching anything the file states. `Ma` is always applied positionally (`Ma 0%N 2%N`), so no call site or downstream proof changes, and every emitted `.v` differs by exactly this one line ([#412])
 - `wasm-to-v` no longer drops a table import's element type. `translate_module_import_desc`'s `TypeRef::Table` arm applied the contract's `MID_table : table_type -> module_import_desc` to a bare `limits` record instead of the two-field `table_type` (`{|tt_limits; tt_elem_type|}`) the constructor actually takes — the shape looked right because its neighbour `MID_mem` really does take a bare `limits`, since the contract's `memory_type` *is* `limits`. `coqc` rejects the result outright (`The term "{| lim_min := …; lim_max := … |}" has type "limits" while it is expected to have type "table_type"`), so any table import produced a `.v` that does not type-check. No fixture in the `coqc` gate had ever imported a table — Inference codegen does emit an import for every `extern fn`, but the static-merge linker (`inference-wasm-linker`) is fail-closed on imports (`LinkError::UnsatisfiedImport`), and `infc` runs that link, aborting on failure, before `-v` translation starts, so no import from the normal pipeline ever reaches the translator — so the arm was reachable only from a foreign or hand-assembled `.wasm` fed to `wasm_to_v` directly, and the defect went uncaught until the [#401] coverage work's `module_surface` fixture became the first gated module to import one. `MID_table` is now applied to `{|tt_limits := <limits>; tt_elem_type := <reference_type>|}`, pinned by both a `funcref` and an explicit-max `externref` table import in a new unit test (`an_imported_table_carries_its_element_type`, `core/wasm-to-v/src/lib.rs`) and by the `module_surface` gate fixture. Unaffected: every other import descriptor, and every committed corpus `.v` golden, since none of Inference codegen's own imports reach `wasm_to_v` — the fail-closed linker resolves them, or the build aborts, before translation runs ([#402])
@@ -193,6 +194,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Documentation
 
+- New `core/wasm-codegen/docs/specification-obligations.md` for readers of an emitted `.v` — usually someone whose proof did not close: the two kinds of obligation and the asymmetry between them, aggregates as ordered scalar leaves with the enumeration and allocation rules that fix every `T_local` index in a goal, one fully expanded three-leaf obligation, the definedness reading of `a[i]` beside the both-bounds requirement a signed index carries, quantifier alternation, the caps, and a table of every kept rejection with its reason. `core/wasm-to-v/ROCQ_CONTRACT.md` gains the matching contract rows (aggregate introduction, aggregate copy, constant and non-constant access, leafwise aggregate comparison) and its **P001**–**P014** registry is brought current ([#355])
+- Proof-mode diagnostics reworded now that the aggregate encoding makes several of them inaccurate. **P004**'s tail said "only bool, integer, and enum values can" at every site, which read as a rule the language no longer has — the parameter position accepts `[i32; 3]` and rejects `[Point; 2]`, and the reason is the shape rather than aggregation — so all its sites now name the representable surface exactly, and an aggregate read *whole* where a term is required (an aggregate call argument, most often) gets its own wording instead, since the shared one would have rejected `[i32; 2]` while listing arrays of integers as nameable. **P003**'s "is not supported" read as a schedule for a decision that is permanent, and now states the rule: a specification names values, not storage. `loop` is lifted out of the shared no-encoding template — the constructs sharing it have nothing to be rewritten *as*, while a loop's purpose in a specification is exactly what quantifying an index and constraining it says directly — and its message names that idiom. **P007**, **P008** and **P004** in an `exists`/`unique` body now name the quantifier that makes the construct impossible, because the identical declaration translates in a `forall` body, and they point at the `forall`-bodied alternative. Every message naming a quantifier takes the article that word is spoken with, which also corrects **P011**'s "an `unique`-quantified" ([#355])
 - New `core/wasm-to-v/ROCQ_CONTRACT.md` documenting the external Rocq predicates (`ValidModule` 1-arg, new `ValidSpec`), the emitted proof-skeleton shape, and spec-map precedence rules ([issue#17])
 - Rewrite `core/wasm-to-v/ROCQ_CONTRACT.md` for the wasm-verifier/vanilla-WasmCert target (hassert-valued `ValidSpec`, worked `.v` example, migration section); also rewrite `rocq-stub/README.md` and the `core/wasm-to-v/README.md` non-det section
 - Add compilation targets matrix documentation (`book/compilation_targets.md`): Compile/Proof x Debug/Release x with/without non-det operations ([issue#97])
@@ -242,6 +245,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Testing
 
+- Three new `coqc`-gate corpus fixtures cover the aggregate work end to end — `spec_aggregate_values.inf` (leaf encoding, enumeration order across ranks and struct field widths, literals, copies, leafwise comparison, existential leaves), `spec_bounded_iteration.inf` (the symbolic-index witness, a constant step descending before a symbolic one, a field step, and both the signed and unsigned index spellings) and `spec_quantifier_alternation.inf` (∃∀ nesting, with `"Hall "` added to `REQUIRED_CONSTRUCTS` as a needle the alternation fixture uniquely produces). Every obligation of all three was additionally proved `Qed` against real wasm-verifier before the goldens were committed, which is how the bounded-iteration fixture's first draft was caught: it emitted a *false* obligation — an index constrained only from above, refutable at `i = -1` — and was rewritten rather than shipped as the documented example of the encoding ([#355])
 - The `coqc` gate now also audits, mechanically, that every constructor the vendored stub declares is elaborated by some module the gate compiles, closing what a hand-maintained needle list alone could not catch — the exact gap the [#230] `BI_forall` arity bug shipped through. New fixtures take obligation-printer operator coverage from 3 of 23 arms reachable at both `i32` and `i64` to full coverage, plus WASM module/instruction and `hassert`-printer surfaces no Inference source reaches. Seven stub declarations the emitter can never produce were deleted rather than exempted (see `rocq-stub/README.md`). This proves the stub is fully exercised, not that it still matches wasm-verifier's real `Assertions.v` ([#359]) ([#401])
 - `infs` unit tests that write an executable stub and spawn it no longer fail intermittently with `ETXTBSY`; a shared `retry_while_exec_busy` helper retries spawns racing fork-inherited write descriptors ([#345])
 - Tests outside `apps/infs` no longer race on fixed temporary paths — the class [#331] closed inside `apps/infs` and left standing elsewhere; every scratch path now comes from a `tempfile::TempDir`, fixing two live defects in codegen and cross-compiler tests ([#343])
@@ -594,3 +598,4 @@ Initial tagged release.
 [#412]: https://github.com/Inferara/inference/issues/412
 [#413]: https://github.com/Inferara/inference/issues/413
 [#416]: https://github.com/Inferara/inference/issues/416
+[#355]: https://github.com/Inferara/inference/issues/355
diff --git a/core/hassert/README.md b/core/hassert/README.md
index 46a6ea13..4a7dced0 100644
--- a/core/hassert/README.md
+++ b/core/hassert/README.md
@@ -29,10 +29,13 @@ pub enum HAssert {
     Ex(Box<HAssert>),
     TermEq(HTerm, HTerm), HasType(HTerm, HNumType), Defined(HTerm),
     AppOk(HFnRef, Vec<HTerm>),
+    All(Box<HAssert>),
 }
 ```
 
-Each variant mirrors a wasm-verifier inductive (`HA_not`, `HA_and`, `Himpl`, `Hor`, `HA_ex`, `term_eq`, `HA_has_type`, `HA_defined`, `HA_app_ok`) — the variant doc comments name the counterpart.
+Each variant mirrors a wasm-verifier inductive (`HA_not`, `HA_and`, `Himpl`, `Hor`, `HA_ex`, `term_eq`, `HA_has_type`, `HA_defined`, `HA_app_ok`, `Hall`) — the variant doc comments name the counterpart.
+
+`All` sits last against its meaning: the wire tags follow declaration order and are part of the format, so a new variant is appended rather than filed beside the relative it reads like.
 
 Each obligation entry carries its quantifier kind alongside the tree:
 
@@ -53,7 +56,9 @@ The IR omits everything an Inference specification can never contain, so an ill-
 - **No heap fragment.** `HA_emp`/`HA_star`/`HA_iter`/`HA_pto`/`HA_size` are absent; memory constructs are not translatable.
 - **No general `HA_pred`.** `TermEq` is the only predicate form, enforcing wasm-verifier's `pred_eq`/2 discipline by construction.
 
-**Implication and disjunction are explicit nodes** (`Imp`, `Or`), not their classical De Morgan encodings. wasm-verifier's `Himpl`/`Hor` are definitionally-transparent `Definition`s, so a downstream printer can render these nodes as `Himpl`/`Hor` without ever pattern-matching an encoding.
+**Implication, disjunction and universal quantification are explicit nodes** (`Imp`, `Or`, `All`), not their classical De Morgan encodings. wasm-verifier's `Himpl`/`Hor`/`Hall` are definitionally-transparent `Definition`s, so a downstream printer can render these nodes by name without ever pattern-matching an encoding.
+
+`All` earns its place twice over. Beyond legibility, the downstream `ValidSpec` judgment quantifies the payload's free variables universally from outside, so an inner universal encoded as anything but a binder of its own would be bound out there instead — turning `∃x. ∀y. P` into `∀y. ∃x. P` without a trace.
 
 ### Symbolic function references
 
@@ -69,6 +74,7 @@ Constructors on `HAssert` apply the `True`-simplifications that keep a translate
 | `imp(p, q)` | `⊤ → q = q`, `p → ⊤ = ⊤` |
 | `or(a, b)`  | `⊤ ∨ x = ⊤`, `x ∨ ⊤ = ⊤` (`⊤` absorbing, the dual of its being the identity for `and`) |
 | `ex(body)`  | `∃x. ⊤ = ⊤` |
+| `all(body)` | `∀x. ⊤ = ⊤` (the dual of `ex`, sound because the domain is never empty) |
 | `nz(t)`     | `¬(t = 0)` |
 | `eqz(t)`    | `t = 0` |
 
diff --git a/core/hassert/src/codec.rs b/core/hassert/src/codec.rs
index 28f9dd4b..402e3fd8 100644
--- a/core/hassert/src/codec.rs
+++ b/core/hassert/src/codec.rs
@@ -58,6 +58,7 @@
 //!   0x08 HasType  term numtype
 //!   0x09 Defined  term
 //!   0x0A AppOk    symbol_idx:varu32  arg_count:varu32  term * arg_count
+//!   0x0B All      hassert
 //!
 //! term := tag:u8, then:
 //!   0x00 Const    hconst
@@ -79,7 +80,16 @@
 //! ```
 //!
 //! The tag values are stable and part of the format: they follow each enum's
-//! declaration order in [`crate::ir`].
+//! declaration order in [`crate::ir`]. A new constructor therefore appends both
+//! a variant and a tag; it never takes a value in the middle, however closely it
+//! is related to the variant it reads like.
+//!
+//! Adding a tag is *additive* and does not move [`HSPECS_SECTION_VERSION`]: a
+//! decoder that predates the tag rejects the payload loudly with
+//! [`DecodeError::UnknownHassertTag`], the section is proof-mode intermediate
+//! data, and recompilation rather than migration is the compatibility story. A
+//! version bump is for a change that reshapes entries the old decoder would
+//! otherwise misread.
 
 use crate::ir::{
     HAssert, HBinop, HConst, HFnRef, HNumType, HRelop, HSpecEntry, HSpecMap, HTerm, ReachMeta,
@@ -315,7 +325,9 @@ fn validate_assert(
     }
     match a {
         HAssert::True | HAssert::False => Ok(()),
-        HAssert::Not(x) | HAssert::Ex(x) => validate_assert(spec, function, x, depth + 1),
+        HAssert::Not(x) | HAssert::Ex(x) | HAssert::All(x) => {
+            validate_assert(spec, function, x, depth + 1)
+        }
         HAssert::And(l, r) | HAssert::Imp(l, r) | HAssert::Or(l, r) => {
             validate_assert(spec, function, l, depth + 1)?;
             validate_assert(spec, function, r, depth + 1)
@@ -548,6 +560,7 @@ fn decode_assert(r: &mut Reader, symbols: &[String], depth: usize) -> Result<HAs
             let f = resolve_symbol(symbols, r.read_u32()?)?;
             HAssert::AppOk(f, decode_args(r, symbols, 1)?)
         }
+        0x0B => HAssert::All(Box::new(decode_assert(r, symbols, depth + 1)?)),
         other => return Err(DecodeError::UnknownHassertTag(other)),
     })
 }
@@ -675,7 +688,7 @@ fn ascending(prev: Option<&str>, name: &str) -> bool {
 fn collect_assert_symbols<'a>(a: &'a HAssert, acc: &mut Vec<&'a str>) {
     match a {
         HAssert::True | HAssert::False => {}
-        HAssert::Not(x) | HAssert::Ex(x) => collect_assert_symbols(x, acc),
+        HAssert::Not(x) | HAssert::Ex(x) | HAssert::All(x) => collect_assert_symbols(x, acc),
         HAssert::And(l, r) | HAssert::Imp(l, r) | HAssert::Or(l, r) => {
             collect_assert_symbols(l, acc);
             collect_assert_symbols(r, acc);
@@ -783,6 +796,10 @@ fn encode_assert(a: &HAssert, symbols: &[&str], out: &mut Vec<u8>) {
                 encode_term(arg, symbols, out);
             }
         }
+        HAssert::All(x) => {
+            out.push(0x0B);
+            encode_assert(x, symbols, out);
+        }
     }
 }
 
@@ -1121,15 +1138,17 @@ mod tests {
     }
 
     /// A tree exercising every `HAssert`, `HTerm`, `HConst`, binop, relop, and
-    /// number type, plus `App`/`AppOk` symbol references.
+    /// number type, plus `App`/`AppOk` symbol references. Both binders appear,
+    /// nested one inside the other, so their tags cannot be swapped without
+    /// this round trip noticing.
     fn kitchen_sink() -> HAssert {
         let call = HTerm::App(href("callee"), vec![HTerm::Local(0), HTerm::LVar(1)]);
         HAssert::And(
             Box::new(HAssert::Imp(
                 Box::new(HAssert::Or(
                     Box::new(HAssert::Not(Box::new(HAssert::False))),
-                    Box::new(HAssert::Ex(Box::new(HAssert::Defined(HTerm::Const(
-                        HConst::I64(-9),
+                    Box::new(HAssert::All(Box::new(HAssert::Ex(Box::new(
+                        HAssert::Defined(HTerm::Const(HConst::I64(-9))),
                     ))))),
                 )),
                 Box::new(HAssert::HasType(
@@ -1349,6 +1368,51 @@ mod tests {
         assert_eq!(decode(&bytes), Err(DecodeError::TreeTooDeep));
     }
 
+    /// The universal binder costs a level exactly as every other one-child node
+    /// does, on both the decode and the `validate` side. Built as a spine of
+    /// `All`s so a node the depth walkers forgot to count would let a tree past
+    /// the cap through.
+    #[test]
+    fn the_universal_binder_counts_a_depth_level() {
+        let all_spine = |n: usize| (1..n).fold(HAssert::True, |acc, _| HAssert::All(Box::new(acc)));
+        let at_cap = map_of(vec![("s", vec![forall("f", all_spine(MAX_TREE_DEPTH))])]);
+        assert_eq!(validate(&at_cap), Ok(()));
+        assert_eq!(decode(&encode(&at_cap)).unwrap(), at_cap);
+
+        let past_cap = map_of(vec![(
+            "s",
+            vec![forall("f", all_spine(MAX_TREE_DEPTH + 1))],
+        )]);
+        assert_eq!(
+            validate(&past_cap),
+            Err(PayloadError::TreeTooDeep {
+                spec: "s".to_string(),
+                function: "f".to_string(),
+            })
+        );
+
+        // Decode past the cap is reached through a hand-built spine, since
+        // `encode` refuses an over-deep tree by contract. `validate` is an
+        // independent walker, so only this half can catch a decode arm that
+        // recurses without counting its level — the case that turns a crafted
+        // payload into unbounded recursion instead of `TreeTooDeep`.
+        let mut bytes = vec![2, 1, 1, b'f', 1, 1, b's', 1, 0, 0x00];
+        bytes.resize(bytes.len() + MAX_TREE_DEPTH, 0x0B);
+        bytes.push(0x00);
+        assert_eq!(decode(&bytes), Err(DecodeError::TreeTooDeep));
+    }
+
+    /// The assertion tag table is closed at the universal binder: the first
+    /// unassigned value must still be a clean rejection, so a payload written by
+    /// a *newer* producer fails loudly here instead of being misparsed.
+    #[test]
+    fn rejects_the_first_unassigned_hassert_tag() {
+        assert_eq!(
+            decode(&[2, 1, 1, b'f', 1, 1, b'S', 1, 0, 0x00, 0x0C]),
+            Err(DecodeError::UnknownHassertTag(0x0C))
+        );
+    }
+
     #[test]
     fn rejects_an_unsupported_version() {
         // The sentinel must stay one past the current version: when the format
diff --git a/core/hassert/src/ir.rs b/core/hassert/src/ir.rs
index 7f93234c..beadde6d 100644
--- a/core/hassert/src/ir.rs
+++ b/core/hassert/src/ir.rs
@@ -98,12 +98,18 @@ pub enum HTerm {
     Relop(HNumType, HRelop, Box<HTerm>, Box<HTerm>),
 }
 
-/// An assertion, mirroring the `hassert` inductive plus its two transparent
-/// sugars `Himpl`/`Hor` (`Assertions.v`).
+/// An assertion, mirroring the `hassert` inductive plus its three transparent
+/// sugars `Himpl`/`Hor`/`Hall` (`Assertions.v`).
 ///
 /// The heap fragment (`HA_emp`/`HA_star`/`HA_iter`/`HA_pto`/`HA_size`) and the
 /// general `HA_pred` are omitted: memory constructs are never produced, and
 /// [`Self::TermEq`] is the only predicate form (the `pred_eq`/2 discipline).
+///
+/// **Declaration order is the wire format.** `codec.rs` assigns each variant a
+/// tag by its position here, and those tags are part of the `inference.hspecs`
+/// format — so a new variant is *appended*, never inserted beside a relative it
+/// reads like ([`Self::All`] belongs next to [`Self::Ex`] by meaning and last
+/// by contract).
 #[derive(Clone, PartialEq, Eq, Debug)]
 pub enum HAssert {
     /// `HA_true` — ⊤.
@@ -133,6 +139,14 @@ pub enum HAssert {
     /// arity (including a `void` result, where the scalar `T_app` is never
     /// defined).
     AppOk(HFnRef, Vec<HTerm>),
+    /// `Hall` — ∀x. H, the transparent sugar `HA_not (HA_ex (HA_not H))`,
+    /// binding de Bruijn logical variable 0 in its body exactly as
+    /// [`Self::Ex`] does. Kept explicit like [`Self::Imp`]/[`Self::Or`] so the
+    /// printer renders `Hall` without pattern-matching an encoding.
+    ///
+    /// Declared last on purpose, against meaning: see the type's own note —
+    /// the tag order is the declaration order and is part of the wire format.
+    All(Box<HAssert>),
 }
 
 impl HAssert {
@@ -178,6 +192,18 @@ impl HAssert {
         }
     }
 
+    /// Universal quantification, simplifying `∀x. ⊤ = ⊤` — the dual of
+    /// [`Self::ex`], and sound for the same reason: the assertion language's
+    /// domain is never empty, so a body that claims nothing claims nothing
+    /// under either quantifier. The body binds de Bruijn logical variable 0.
+    #[must_use = "builds an assertion"]
+    pub fn all(body: HAssert) -> HAssert {
+        match body {
+            HAssert::True => HAssert::True,
+            body => HAssert::All(Box::new(body)),
+        }
+    }
+
     /// "τ is non-zero": `¬(τ = 0)`, mirroring the canonical `nz` helper. The
     /// zero constant is always i32 — every truthiness position (a relop
     /// result, a bool, a `&&`/`||` result, a bool-returning call) is i32 in
@@ -319,6 +345,22 @@ mod tests {
         assert_eq!(HAssert::ex(body.clone()), HAssert::Ex(Box::new(body)));
     }
 
+    #[test]
+    fn all_simplifies_a_trivial_body() {
+        assert_eq!(HAssert::all(HAssert::True), HAssert::True);
+        let body = HAssert::Defined(HTerm::LVar(0));
+        assert_eq!(HAssert::all(body.clone()), HAssert::All(Box::new(body)));
+    }
+
+    /// The two binders are distinct nodes over the same body: nothing in the
+    /// IR lets an `Ex` stand in for an `All`, which is the whole reason the
+    /// universal binder is explicit rather than the `¬∃¬` encoding.
+    #[test]
+    fn all_is_not_ex_over_the_same_body() {
+        let body = HAssert::Defined(HTerm::LVar(0));
+        assert_ne!(HAssert::all(body.clone()), HAssert::ex(body));
+    }
+
     #[test]
     fn nz_and_eqz_compare_against_the_i32_zero() {
         let t = HTerm::Local(3);
diff --git a/core/hassert/src/lib.rs b/core/hassert/src/lib.rs
index 6fa0c938..978f4a8b 100644
--- a/core/hassert/src/lib.rs
+++ b/core/hassert/src/lib.rs
@@ -42,11 +42,17 @@
 //! - no general `HA_pred`: [`HAssert::TermEq`] is the only predicate form,
 //!   enforcing wasm-verifier's `pred_eq`/2 discipline by construction.
 //!
-//! Implication and disjunction are *explicit* [`HAssert::Imp`]/[`HAssert::Or`]
-//! nodes rather than their classical De Morgan encodings. wasm-verifier's
-//! `Himpl`/`Hor` are definitionally-transparent `Definition`s, so the
-//! downstream printer can render these nodes as `Himpl`/`Hor` without ever
-//! pattern-matching an encoding.
+//! Implication, disjunction and universal quantification are *explicit*
+//! [`HAssert::Imp`]/[`HAssert::Or`]/[`HAssert::All`] nodes rather than their
+//! classical De Morgan encodings. wasm-verifier's `Himpl`/`Hor`/`Hall` are
+//! definitionally-transparent `Definition`s, so the downstream printer can
+//! render these nodes by name without ever pattern-matching an encoding.
+//!
+//! [`HAssert::All`] is also what keeps quantifier *alternation* honest. The
+//! downstream `ValidSpec` judgment already quantifies the payload's free
+//! variables universally, so encoding an inner universal as anything but a
+//! binder of its own — a free slot, say — would read as an outer `∀` over an
+//! inner `∃` and silently swap the two.
 
 #![warn(clippy::pedantic)]
 
diff --git a/core/wasm-codegen/README.md b/core/wasm-codegen/README.md
index 9c34b5b8..62cd393e 100644
--- a/core/wasm-codegen/README.md
+++ b/core/wasm-codegen/README.md
@@ -214,6 +214,16 @@ truncation plus its sign/zero-extending typed load already realize the
 domain. See [docs/local-variables-lowering.md](docs/local-variables-lowering.md)
 and [docs/arrays-and-memory.md](docs/arrays-and-memory.md).
 
+In proof mode a compound `@` also has to be given a meaning in the specification
+function's *obligation*, and there the two quantifiers part ways: a `forall`
+specification is a claim about values, so an aggregate can become as many logical
+variables as it has scalar leaves; an `exists`/`unique` specification is a claim
+about one actual run of its own compiled body, where an aggregate is a single
+pointer into memory and each choice arrives as one scalar parameter — so there,
+aggregates must still be taken apart by hand. See
+[docs/specification-obligations.md](docs/specification-obligations.md) for the
+leaf encoding, the slot-allocation rule, and the diagnostics that draw the line.
+
 ### Forall Block
 
 Universal quantification - all execution paths inside the block must be reachable.
@@ -363,6 +373,7 @@ The `codegen` function:
 - **Type system** - Generic types and function types are not yet fully implemented
 - **Recursion with compound types** - Functions using arrays or structs cannot currently recurse (no stack overflow analysis). Recursion detection and stack bounds checking are future work.
 - **Return-path analysis** - The analysis pass (rule A007) detects non-void functions missing a `return` on all paths and emits a compile-time error before codegen is reached. An `unreachable` trap is also emitted as a defence-in-depth runtime safety net; see [docs/conditionals-lowering.md](docs/conditionals-lowering.md).
+- **Specification obligations** - A specification names aggregates by their ordered scalar leaves, over the same surface the executable aggregate `@` supports: arrays of scalars at any rank, and structs whose fields are scalars or one-dimensional scalar arrays. Arrays of structs (A028) and structs with struct or multidimensional-array fields (A027) are rejected on every specification path — `@`, parameters, literals. One access chain may carry one non-constant index; a spec function may quantify 64 scalar leaves in total (P013). Compound `@` and compound parameters are rejected inside `exists`/`unique`-quantified functions, where each choice arrives as one scalar parameter of the run the obligation talks about, and so is a nested `forall` (P008/P004/P007) — inside a `forall`/plain function the same nesting emits a real universal binder. Reassignment, `loop`/`break`, `**`, string literals, and aggregate call arguments and compound call results stay rejected. Memory-content assertions (addresses, points-to, iterated heaps) are out of scope. See [docs/specification-obligations.md](docs/specification-obligations.md).
 
 ## Documentation
 
@@ -394,6 +405,11 @@ Detailed design documents live in `docs/`:
 - [docs/loops-lowering.md](docs/loops-lowering.md) - How `loop`/`break` statements are
   lowered to WASM structured control flow (`block`/`loop`/`br`), `LoopContext` depth
   tracking, and interaction with non-det blocks, if-statements, and array frames.
+- [docs/specification-obligations.md](docs/specification-obligations.md) - What a `spec`
+  function becomes in proof mode: aggregates as ordered scalar leaves, the slot-allocation
+  rule that fixes every `T_local` index in an emitted goal, one fully expanded obligation,
+  the definedness rule for `a[i]` (and the both-bounds requirement a signed index carries),
+  quantifier alternation, the caps, and the table of kept rejections.
 
 ## Module Organization
 
@@ -403,7 +419,7 @@ Detailed design documents live in `docs/`:
 - `errors.rs` - `CodegenError` enum for function call lowering failures, spec-name validation, and proof-mode `hassert` translation failures (`UntranslatableSpec`, `HspecTreeTooDeep`)
 - `output.rs` - `CodegenOutput` containing WASM bytes, metadata, and (proof mode only) the per-spec `hassert` obligation map (`hspecs()`)
 - `target.rs` - Compilation target definitions (`Wasm32`, `Soroban`) and the requestable post-MVP instruction families (`EmitFeatures`)
-- `hassert/` - Proof-mode-only pass translating each `spec` free function into a `hassert` verification obligation — kind-tagged, so a `forall`/plain body yields a `ValidSpec` payload and an `exists`/`unique` body a reachability payload with its entry arity and source-visible slots — read-only over the typed AST (`mod.rs`: `translate_spec_fns` entry point and callee resolution index; `translate.rs`: the right-folded statement/term translator with its `Univ`/`Exist`/`Reach` modes; `reach.rs`: the reachability pre-scan whose `ChoicePlan` maps each scalar `@` to its appended choice parameter, shared by signature registration, body lowering, and payload translation; `diag.rs`: the `P001`–`P012` diagnostic registry). See [`core/wasm-to-v/ROCQ_CONTRACT.md`](../wasm-to-v/ROCQ_CONTRACT.md) for the full translation scheme
+- `hassert/` - Proof-mode-only pass translating each `spec` free function into a `hassert` verification obligation — kind-tagged, so a `forall`/plain body yields a `ValidSpec` payload and an `exists`/`unique` body a reachability payload with its entry arity and source-visible slots — read-only over the typed AST (`mod.rs`: `translate_spec_fns` entry point and callee resolution index; `translate.rs`: the right-folded statement/term translator with its `Univ`/`UnivLvl`/`Exist`/`Reach` modes, the `AggValue` leaf tree that aggregate values translate to, and the pinned-witness machinery short-circuit operators and non-constant indices share; `reach.rs`: the reachability pre-scan whose `ChoicePlan` maps each scalar `@` to its appended choice parameter, shared by signature registration, body lowering, and payload translation; `diag.rs`: the `P001`–`P014` diagnostic registry). See [`docs/specification-obligations.md`](docs/specification-obligations.md) for the obligation shapes a specification author reads, and [`core/wasm-to-v/ROCQ_CONTRACT.md`](../wasm-to-v/ROCQ_CONTRACT.md) for the full translation scheme
 - `hspecs_section.rs` - Encodes the obligation map into the `inference.hspecs` custom WASM section (via the shared `inference-hassert` codec) and the fail-closed pre-encode depth guard
 
 ## Testing
diff --git a/core/wasm-codegen/docs/specification-obligations.md b/core/wasm-codegen/docs/specification-obligations.md
new file mode 100644
index 00000000..96d8514e
--- /dev/null
+++ b/core/wasm-codegen/docs/specification-obligations.md
@@ -0,0 +1,303 @@
+# Specification Obligations
+
+This document describes what a `spec` function becomes in proof mode: how aggregate values,
+element access and quantifier nesting are encoded as a `hassert` proof obligation, which
+slot each value gets, and which properties are provable as a result. It is written for
+someone reading an emitted `.v` file — usually because a proof did not close.
+
+## Prerequisites
+
+Readers should be familiar with:
+
+- Inference `spec` blocks and the non-deterministic constructs `forall`, `exists`,
+  `assume`, `unique` and uzumaki (`@`) — see
+  [Inference Language Specification](https://github.com/Inferara/inference-language-spec)
+- The proof-mode pipeline and the shape of an emitted `.v` file, described in
+  [`core/wasm-to-v/ROCQ_CONTRACT.md`](../../wasm-to-v/ROCQ_CONTRACT.md)
+- The overall compilation pipeline described in `core/wasm-codegen/README.md`
+
+## The Two Kinds of Obligation
+
+A `forall`-quantified (or plain) spec function states a property of *values*, and becomes a
+`ValidSpec` payload: the downstream judgment quantifies every slot the payload reads, over
+valuations it constrains in no way.
+
+An `exists`- or `unique`-quantified spec function states that some run of *its own compiled
+body* exists (or is unique), and becomes a reachability payload: the body is compiled to
+real WebAssembly with one hidden trailing choice parameter per scalar `@`, and the judgment
+runs it.
+
+That difference decides almost everything below, and one sentence carries it:
+
+> A `forall` specification is a claim about values, so an aggregate can become as many
+> logical variables as it has scalar leaves; an `exists`/`unique` specification is a claim
+> about one actual run of its own compiled body, where an aggregate is a single pointer into
+> memory and each choice arrives as one scalar parameter — so there, aggregates must still
+> be taken apart by hand.
+
+## Aggregates Are Their Scalar Leaves
+
+There is no aggregate *term*. An aggregate — a compound `@`, a compound parameter, an array
+or struct literal, or a copy of one — is translated to a shape-preserving tree whose leaves
+are ordinary scalar terms. A field access or a constant index selects a child of that tree
+at translation time and never appears in the obligation; only the leaves do.
+
+### The Supported Shapes
+
+| Shape | Supported |
+| --- | --- |
+| `[i32; 3]`, `[[i32; 2]; 2]`, arrays of scalars at any rank | yes |
+| a struct whose fields are scalars, or *one-dimensional* scalar arrays | yes |
+| `[Point; 2]` — an array of structs | no |
+| a struct with a struct field, or a multidimensional array field | no |
+| a field-less struct, or a zero-length array | no — and unreachable: **A045** rejects the first as a value type and the type checker rejects the second |
+
+Note the rank asymmetry: an array of scalars nests to any depth, while a struct field may be
+a scalar or a one-dimensional array of scalars and no deeper.
+
+The rule behind the table: *a specification's aggregate support cannot exceed the executable
+language's aggregate `@` support*, because proof mode lowers spec bodies through the same
+unrolling. Analysis rules **A027** (struct with compound fields) and **A028** (array of
+structs) draw that boundary, and they are mode-blind — they fire inside a spec body exactly
+as they fire in executable code, so in a normal `infc` build an out-of-surface `@` is
+reported by analysis first.
+
+The translator keeps its own rejection for the same shape all the same, and that rejection is
+not dead: the corpus gate and the unit-test pipelines run parse → type-check → codegen with
+no analysis pass at all, so there it is the only guard. (This is the same reason **P014**
+exists beside **A037**.) Out-of-surface *parameters* and *literals* have no analysis rule at
+any time and are rejected by the translator alone, as **P004** and **P002** — so the two
+surfaces stay the same width whichever position the aggregate appears in.
+
+### Slot Allocation
+
+Two rules fix every `T_local` index in an emitted payload:
+
+- **Enumeration order** within one aggregate: arrays row-major, struct fields in layout
+  order, recursing. Over the shapes both sides support — which, by the table above, is every
+  shape that gets this far — it is the same order the runtime unrolling of a compound `@`
+  uses.
+- **Allocation order** within one spec function: parameters first, in declaration order,
+  then each `@` in binding order — one slot per scalar leaf.
+
+Leaf order stops being an implementation detail the moment a proof fails and you read
+`T_local 2` in a goal, so these are part of the contract.
+
+A *rejected* declaration still costs slots, which matters when you are counting your way back
+from a goal to the source. A refused non-scalar parameter and a refused out-of-surface
+compound `@` each consume exactly one slot, and an aggregate refused for overrunning the leaf
+budget consumes its whole leaf count — in every case the counter advances without anything
+being emitted, so every later slot number keeps the position the source gives it.
+
+In a universal payload a typing guard is emitted for **every** leaf, including leaves the
+claim never reads. Guards are antecedents, so the extra ones only weaken the obligation;
+uniformity is preferred to a use analysis that would make slot numbering depend on what the
+body happens to mention. The cost is worth knowing: an N-leaf aggregate puts N guards in
+front of every obligation of its function. An *existential* leaf carries no guard — the
+prover chooses the value, so there is no unconstrained valuation to constrain — and a
+literal's leaves are constants that neither bind a variable nor guard one.
+
+### One Obligation, Fully Expanded
+
+```inference
+spec AggregateValues {
+  fn leaf_bounds() forall {
+    let a: [i32; 3] = @;
+    assert(a[0] <= a[0]);
+  }
+}
+```
+
+emits (on one line — the layout below is this document's reflow, not the emitter's)
+
+```coq
+Definition spec_aggregate_values__AggregateValues_hspec1 : hassert :=
+  Himpl (HA_and (HA_has_type (T_local 0%N) T_i32)
+        (HA_and (HA_has_type (T_local 1%N) T_i32)
+                (HA_has_type (T_local 2%N) T_i32)))
+        (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_le SX_S))
+                                  (T_local 0%N) (T_local 0%N))
+                         (T_const (Vi32 0)))).
+```
+
+Three leaves, three slots, three guards drained together at the first structural statement;
+the claim reads slot 0 twice, and slots 1 and 2 are quantified but unread. `a[0] <= a[0]` is
+a *relop* rather than a logical comparison because the obligation must speak the arithmetic
+the compiled program executes, at that operator's own width and signedness.
+
+### Aggregate Equality
+
+`a == b` at aggregate type, in assertion position, is the conjunction of per-leaf equalities;
+`a != b` is the dual disjunction. This is the intended language rule: `==` compares values,
+and an aggregate's value is exactly its ordered scalar leaves. Aggregate comparison in
+*term* position (inside arithmetic) is rejected — there is no aggregate term to compute with.
+
+## An Element at a Non-Constant Index
+
+A constant index resolves at translation time. A non-constant one names an element the
+translation cannot pick, so it binds a fresh logical variable `v` pinned by
+
+```text
+(i <u N) ∧ ⋀_{c<N} Himpl (i = c) (v = leaf c)
+```
+
+The range bound is the first conjunct, so a reader of a failing goal meets it before the case
+split. A chain may carry **one** such index: constant steps descend eagerly, so `m[1][j]`
+splits over the two elements of the already-selected row `[1]`, while `m[i][j]` is rejected —
+the split would be the product of the two extents, and one obligation carries one case split
+per chain.
+
+### `a[i]` Means "The Element at `i`, Which Exists"
+
+`a[i]` in a specification is not "whatever is stored at index `i`" — it is *the element at
+index `i`, which exists*. The obligation defines that element only where `i` is in range, so
+`assert(a[i] == a[i])` is not a tautology: it claims that `i` is a valid index and that the
+element there equals itself. Constrain the index first, and the claim becomes provable:
+
+```inference
+forall {
+  let a: [i32; 3] = @;
+  let i: i32 = @;
+  assume { assert(0 <= i && i < 3); }
+  assert(a[i] == a[i]);
+}
+```
+
+This is deliberate. The alternative — treating an out-of-range access as vacuously satisfied
+— would hand you a proof that says nothing about most values of `i`, and Inference already
+rejects an obligation that says nothing (**P010**).
+
+Nothing in proof mode emits a bounds check, so this is a definedness rule rather than a
+mirror of any runtime trap.
+
+### A Signed Index Needs Both Bounds
+
+The emitted range bound is a single **unsigned** comparison, `i <u N`, and no lower bound is
+missing: a negative index arrives as a huge unsigned value and fails `<u N` on its own.
+
+The consequence is a trap worth stating plainly. When the index is *signed*, an `assume` that
+supplies only the upper bound compiles clean and produces an obligation that is **false**.
+Nothing diagnoses it; it surfaces later as a Rocq goal that will not close.
+
+```inference
+// WRONG — compiles, emits an obligation that cannot be proved.
+// `i = -1` satisfies the signed `i < 3` and fails the element's unsigned range bound,
+// so the element is undefined at an index the assume admits.
+forall {
+  let a: [i32; 3] = @;
+  let i: i32 = @;
+  assume { assert(i < 3); }
+  assert(a[i] == a[i]);
+}
+```
+
+```inference
+// RIGHT — the signed lower bound is what bridges to the unsigned range bound.
+forall {
+  let a: [i32; 3] = @;
+  let i: i32 = @;
+  assume { assert(0 <= i && i < 3); }
+  assert(a[i] == a[i]);
+}
+```
+
+Both bounds are *necessary*, not sufficient: they make the element denote, and nothing more.
+A claim about the element's value needs hypotheses about the element's value as well, because
+a compound `@` states only the typing of its leaves — every leaf ranges over the whole width.
+So `assert(a[i] >= 0)` does not follow from the bounds alone; it follows from the bounds *and*
+an assumption covering every element, which is what the corpus fixture states:
+
+```inference
+// From tests/test_data/inf/spec_bounded_iteration.inf — every obligation in that file is
+// discharged against wasm-verifier, so this shape is known to close.
+forall {
+  let a: [i32; 3] = @;
+  let i: i32 = @;
+  assume { assert(a[0] >= 0 && a[1] >= 0); }
+  assume { assert(a[2] >= 0); }
+  assume { assert(0 <= i && i < 3); }
+  assert(a[i] >= 0);
+}
+```
+
+An unsigned index needs no lower bound at all, because its source guard lowers to an unsigned
+comparison that exactly complements the emitted range bound. The obligation is
+correspondingly simpler — one comparison in the antecedent instead of two, and one fewer
+nested implication when the lower bound would have been written as its own `assume` block:
+
+```inference
+// SIMPLEST — `i < 3` lowers unsigned at `u32`, complementing the range bound directly.
+forall {
+  let a: [i32; 3] = @;
+  let i: u32 = @;
+  assume { assert(i < 3); }
+  assert(a[i] == a[i]);
+}
+```
+
+Each operator follows its own operand's type rather than a per-function mode, so an unsigned
+index may compare unsigned while a claim about `i32` elements stays signed. Note also that
+the typing guard records only a **width**: over `[i32; 3]` the index takes slot 3 (slots 0-2
+are the array's leaves) and is guarded `HA_has_type (T_local 3%N) T_i32` whether it is
+declared `i32` or `u32`, so the index's signedness is carried entirely by the relop
+spellings, and no downstream proof can catch a wrong operator choice for you.
+
+## Alternating Quantifiers
+
+A `forall` block nested inside an `exists` or `assume` block of a universal spec function
+binds a real universal variable and emits `Hall`, so `∃k. ∀x. P` stays in that order. Giving
+the inner `@` a free slot instead would let the outer judgment quantify it, silently turning
+the claim into `∀x. ∃k. P` — a different and weaker property.
+
+The same nesting inside an `exists`/`unique`-quantified function is **P007**. There every `@`
+is a hidden choice parameter the judgment quantifies operationally, so a universal binder
+over one has no representation; move the universal claim into its own `forall`-bodied spec
+function.
+
+## Caps
+
+- **64 scalar leaves per spec function**, cumulative across every aggregate introduction
+  (**P013**). The resource being protected is assertion-tree depth, and what a leaf costs
+  depends on where it comes from: a leaf of a universal `@` or parameter costs a typing-guard
+  level; a leaf of a `@` inside a nested `forall` costs a guard level *and* a `Hall` level; a
+  leaf of an existential `@` costs one `HA_ex` level and no guard at all (a prover-chosen
+  value needs no stated typing); and a literal's leaves are constants that bind nothing and
+  guard nothing, nesting only one conjunct apiece through a leafwise comparison. All of those
+  accumulate across every introduction in the function until a structural statement drains
+  the guards, so a per-introduction cap would not bound the resource it names. The executable
+  unrolling's own cap is far larger; the two measure different things (instruction count
+  versus obligation nesting depth).
+- **One non-constant index per access chain** (**P002**).
+- **`MAX_TREE_DEPTH` = 256 assertion-tree levels** overall — 255 usable in practice — enforced
+  by a fail-closed pre-encode gate that names the offending spec and function
+  (`CodegenError::HspecTreeTooDeep`).
+
+## What Stays Rejected, and Why
+
+| Code | Construct | Reason |
+| --- | --- | --- |
+| P002 | `loop`, `break` | a loop states a property only through an invariant this translation cannot infer; quantify an index and constrain it instead |
+| P002 | `**`, string literals, nested `unique` blocks | no assertion encoding |
+| P002 | an array/struct literal read in scalar term position, or written at an out-of-surface shape | a literal becomes one term per scalar leaf, so there is neither a whole-value term nor a leaf tree to build |
+| P002 | an access chain with two non-constant indices, or one whose non-constant index lands on an aggregate rather than a scalar leaf | one obligation carries one case split per chain, and the split has to end at a leaf |
+| P003 | reassignment | a specification names values, not storage — every name stands for one value throughout the claim |
+| P004 | `unit`, a function type, an out-of-surface aggregate *parameter* | not representable |
+| P004 | an aggregate read whole in term position, an aggregate call argument included | an aggregate is not a term; name the component you mean |
+| P004 | an *aggregate* parameter of an `exists`/`unique` body | the obligation denotes against a real frame, where the parameter is one pointer local |
+| P005 | a call that is not a `T_app`: an `extern` callee ("external functions carry no verified body"), an instance method, one that does not resolve to a module-defined function, a non-deterministic-bodied callee, or — in term position only — one whose result is not a single scalar, compound or `unit` alike | the symbol has to name a function of the emitted module, applied at its real signature; a bare call *statement* is unaffected, becoming `HA_app_ok` at any result arity |
+| P007 | `forall` inside an `exists`/`unique` body | see *Alternating Quantifiers* |
+| P008 | an out-of-surface compound `@` in **any** body; any compound `@` in an `exists`/`unique` body | out of surface, there is no leaf tree to build; in a reachability body a choice arrives as one scalar parameter of the run |
+| P014 | a constant-folded out-of-bounds index | the same fact analysis rule A037 states, at the spelling A037 cannot see |
+
+Memory-content assertions — addresses, points-to, iterated heaps — are out of scope entirely.
+The surface language cannot express them, and the properties this encoding *can* state are
+claims about aggregate values rather than about particular heap cells, which is what quantified
+scalar leaves express exactly.
+
+## Related Documents
+
+- [`core/wasm-to-v/ROCQ_CONTRACT.md`](../../wasm-to-v/ROCQ_CONTRACT.md) — the emitted `.v`
+  contract, including the full `P001`–`P014` registry
+- [`docs/arrays-and-memory.md`](arrays-and-memory.md) — the executable lowering of the same
+  aggregates, including `compute_struct_field_layout`, whose order the leaf enumeration
+  shares
diff --git a/core/wasm-codegen/src/hassert/diag.rs b/core/wasm-codegen/src/hassert/diag.rs
index 4eeb2a90..7f97f414 100644
--- a/core/wasm-codegen/src/hassert/diag.rs
+++ b/core/wasm-codegen/src/hassert/diag.rs
@@ -29,20 +29,67 @@ pub(crate) enum PCode {
     /// Spec function body is `assume`-quantified. `assume` is not a
     /// quantifier — with no enclosing `forall` there is no claim to prove.
     P001,
-    /// A construct with no assertion encoding (`loop`, `break`, `unique` block,
-    /// `**`, a literal that is not a scalar, memory access).
+    /// A construct with no assertion encoding: `loop`, `break`, a nested
+    /// `unique` block, `**`, a string literal, an array/struct literal read in
+    /// scalar term position or written at a shape outside the supported
+    /// surface, or an access chain the element encoding cannot pin — one
+    /// carrying more than one non-constant index, or one whose non-constant
+    /// index lands on an aggregate rather than a scalar leaf.
+    ///
+    /// Four of these carry their own message instead of the shared template,
+    /// because the template's "this has no encoding; move the logic into an
+    /// executable helper" is either false or useless for them. `loop`: a
+    /// loop's purpose in a specification — saying something about every
+    /// element — is precisely what quantifying an index and constraining it
+    /// says directly, so its message names that idiom. The out-of-surface
+    /// literal: literals encode now, so the restriction is the *shape*, and
+    /// the helper remedy dead-ends (a compound result is [`PCode::P005`], a
+    /// compound argument [`PCode::P004`]). And each access-chain case, which
+    /// states what the encoding can pin and how to get there.
     P002,
-    /// Reassignment (`Stmt::Assign`) in a specification body.
+    /// Reassignment (`Stmt::Assign`) in a specification body — a permanent
+    /// rule, not a pending feature. A specification names values, not storage:
+    /// every name stands for one value throughout the claim, which is what
+    /// lets the translation read a name as the same term wherever it appears.
+    /// Supporting mutation would mean per-branch value versioning across
+    /// quantifier scopes for no expressive gain over a fresh `let`.
     P003,
-    /// A non-scalar type in a term, parameter, or `@` position.
+    /// A type with no place in a specification term. Three wordings live under
+    /// this code, because three different facts land here:
+    ///
+    /// - the type is not representable at all — `unit`, a function type, or an
+    ///   aggregate outside the representable surface (arrays of scalars at any
+    ///   rank, and structs whose fields are scalars or *one-dimensional* scalar
+    ///   arrays: the executable aggregate `@` surface, bounded by analysis
+    ///   rules A027/A028);
+    /// - the type is representable but was read *whole* where a term is
+    ///   required — an aggregate call argument, most often. The surface
+    ///   enumeration above would contradict this rejection, so the message
+    ///   states the real fact instead: an aggregate is not a term;
+    /// - the declaration is an *aggregate* parameter of an `exists`/`unique`
+    ///   body, which the identical declaration in a `forall` body would
+    ///   leaf-expand. The message names the quantifier, since that — not the
+    ///   type — is what rules it out: the obligation denotes against the frame
+    ///   an actual run reaches, where the parameter is one pointer local. A
+    ///   non-scalar, non-aggregate parameter there is unrepresentable for the
+    ///   first reason instead, and takes the first wording.
     P004,
     /// A call that cannot be represented as a `T_app` term.
     P005,
     /// `@` outside a `let` right-hand side or a call-argument position.
     P006,
-    /// A `forall` block nested inside an `exists` context.
+    /// A `forall` block nested inside an `exists` context of an
+    /// `exists`/`unique`-quantified body. Inside a universal body the same
+    /// nesting translates — the inner block binds a universal logical variable
+    /// per `@` — but a reachability body's `@`s are choice parameters its
+    /// judgment quantifies operationally, so a universal binder over one has no
+    /// representation.
     P007,
-    /// `@` at a compound (array/struct) type.
+    /// `@` at a compound (array/struct) type — in a reachability body, where a
+    /// choice arrives as one scalar parameter of the run the obligation talks
+    /// about, or in any body at a shape outside the representable surface. A
+    /// supported-shape compound `@` in a universal body quantifies one variable
+    /// per scalar leaf instead of raising this.
     P008,
     /// A specification *method* carrying a proof obligation the translation
     /// cannot deliver — quantified, or plain but claiming a property. A method
@@ -62,6 +109,24 @@ pub(crate) enum PCode {
     /// nothing names is excluded from that face, which would silently weaken
     /// the judgment; binding it first (`let c: i32 = @;`) makes it count.
     P012,
+    /// An aggregate introduction (a compound `@`, a compound parameter, or an
+    /// array/struct literal) whose scalar leaves would push the specification
+    /// function past its cumulative quantified-leaf budget
+    /// (`SPEC_FN_MAX_QUANTIFIED_LEAVES`). A quantified leaf brings a binder and
+    /// a typing guard, each one assertion-tree level; a literal's leaves are
+    /// constants and still nest one level apiece through a leafwise
+    /// comparison. Either way the levels accumulate across every introduction
+    /// in the function, so the budget is a per-function total, not a
+    /// per-introduction cap.
+    P013,
+    /// A constant-folded array index that is out of bounds for the accessed
+    /// array — `const K: i32 = 5; a[K]`, or `a[1 + 4]`, on `[i32; 3]`. States
+    /// the same fact analysis rule A037 states for a *direct-literal* index;
+    /// A037's pattern requires the literal directly under the access, so an
+    /// index named through a constant or computed from constants reaches the
+    /// translator even with analysis on, and the no-analysis codegen paths make
+    /// this the only guard for any of the spellings.
+    P014,
 }
 
 impl fmt::Display for PCode {
@@ -79,6 +144,8 @@ impl fmt::Display for PCode {
             PCode::P010 => "P010",
             PCode::P011 => "P011",
             PCode::P012 => "P012",
+            PCode::P013 => "P013",
+            PCode::P014 => "P014",
         };
         f.write_str(code)
     }
diff --git a/core/wasm-codegen/src/hassert/mod.rs b/core/wasm-codegen/src/hassert/mod.rs
index bfa54b7c..eae5e125 100644
--- a/core/wasm-codegen/src/hassert/mod.rs
+++ b/core/wasm-codegen/src/hassert/mod.rs
@@ -68,6 +68,21 @@
 //! accumulate down the statement fold — but a witness bound by a pure `let` or
 //! a `const` scopes over the rest of its block, so its two levels sit above
 //! every statement that follows and a chain of such bindings adds up.
+//!
+//! An aggregate is the largest single consumer, and what a leaf costs depends
+//! on where it comes from: a universal `@` or parameter leaf costs a typing-
+//! guard level; a leaf bound under a nested `forall` costs a guard level *and*
+//! an `All` level; an existential leaf costs one `Ex` level and no guard (a
+//! prover-chosen value states no typing); and a literal's leaves bind nothing
+//! and guard nothing, nesting only one conjunct apiece through a leafwise
+//! comparison. All of them accumulate across every aggregate introduction in
+//! the function, which is why the leaf budget
+//! (`SPEC_FN_MAX_QUANTIFIED_LEAVES`, `P013`) is a per-function running total
+//! rather than a per-introduction cap — a cap that let each of four parameters
+//! through individually would still reach the encoder's backstop between them.
+//! `P013` is checked from the declared type *before* any leaf is materialized,
+//! so an over-budget declaration never builds the deep tree it is being
+//! rejected for.
 //! Overrunning the cap is not an encoder hazard: the pre-encode gate
 //! ([`check_payload`](crate::hspecs_section::check_payload)) already turns an
 //! over-deep tree into a
diff --git a/core/wasm-codegen/src/hassert/tests.rs b/core/wasm-codegen/src/hassert/tests.rs
index 38f62ce0..0b68d833 100644
--- a/core/wasm-codegen/src/hassert/tests.rs
+++ b/core/wasm-codegen/src/hassert/tests.rs
@@ -172,6 +172,9 @@ fn or(a: HAssert, b: HAssert) -> HAssert {
 fn ex(a: HAssert) -> HAssert {
     HAssert::Ex(Box::new(a))
 }
+fn all(a: HAssert) -> HAssert {
+    HAssert::All(Box::new(a))
+}
 fn teq(a: HTerm, b: HTerm) -> HAssert {
     HAssert::TermEq(a, b)
 }
@@ -210,6 +213,9 @@ fn gts(l: HTerm, r: HTerm) -> HTerm {
 fn lts(l: HTerm, r: HTerm) -> HTerm {
     rel(HNumType::I32, HRelop::LtS, l, r)
 }
+fn ges(l: HTerm, r: HTerm) -> HTerm {
+    rel(HNumType::I32, HRelop::GeS, l, r)
+}
 fn rems(l: HTerm, r: HTerm) -> HTerm {
     bin(HNumType::I32, HBinop::RemS, l, r)
 }
@@ -1639,7 +1645,9 @@ fn unguarded_reads(assertion: &HAssert, guarded: &[u32], out: &mut Vec<u32>) {
         // A constant reads nothing, and a typing or definedness atom states a
         // slot's premise rather than relying on one.
         HAssert::True | HAssert::False | HAssert::HasType(_, _) | HAssert::Defined(_) => {}
-        HAssert::Not(inner) | HAssert::Ex(inner) => unguarded_reads(inner, guarded, out),
+        HAssert::Not(inner) | HAssert::Ex(inner) | HAssert::All(inner) => {
+            unguarded_reads(inner, guarded, out);
+        }
         HAssert::And(l, r) | HAssert::Or(l, r) => {
             unguarded_reads(l, guarded, out);
             unguarded_reads(r, guarded, out);
@@ -1779,16 +1787,129 @@ fn p002_rejects_constructs_without_an_encoding() {
     assert!(err(unique_src).contains("error[P002]"));
 }
 
+/// `loop` has its own message: the constructs sharing `error_no_encoding` have
+/// no substitute to point at, while a loop's whole purpose — saying something
+/// about every element — is exactly what quantifying says directly.
+#[test]
+fn p002_points_a_loop_at_the_quantifier_idiom() {
+    let e = err("spec S { fn f() forall { let n: i32 = @; loop { assert(n > 0); } } }");
+    assert!(
+        e.contains(
+            "`loop` has no encoding in the verification assertion language: a loop states a \
+             property only through an invariant this translation cannot infer"
+        ) && e.contains("constrain the index in an `assume` block"),
+        "{e}"
+    );
+}
+
+/// The shared `error_no_encoding` template still serves every other construct;
+/// lifting `loop` out of it must not have reworded its neighbours.
+#[test]
+fn the_shared_no_encoding_template_is_unchanged() {
+    let e = err("spec S { fn f() forall { let n: i32 = @; unique { assert(n > 0); } } }");
+    assert!(
+        e.contains(
+            "`unique` block has no encoding in the verification assertion language; remove it \
+             from the spec body or move the logic into an executable helper function"
+        ),
+        "{e}"
+    );
+}
+
 #[test]
 fn p003_rejects_reassignment() {
     let src = "spec S { fn f() forall { let a: i32 = @; let mut b: i32 = a; b = b + 1; assert(b > 0); } }";
     assert!(err(src).contains("error[P003]"));
 }
 
+/// The `P003` decision is permanent, so the message states a rule rather than a
+/// gap: nothing in it should read as "not yet".
+#[test]
+fn p003_states_a_rule_rather_than_a_schedule() {
+    let e = err(
+        "spec S { fn f() forall { let a: i32 = @; let mut b: i32 = a; b = b + 1; assert(b > 0); } }",
+    );
+    assert!(
+        e.contains(
+            "reassignment has no place in a specification body: a specification names values, \
+             not storage"
+        ) && e.contains("bind a new `let` for the new value"),
+        "{e}"
+    );
+    assert!(
+        !e.contains("not supported") && !e.contains("not yet"),
+        "a permanent rule must not be worded as a pending feature: {e}"
+    );
+}
+
+/// A parameter of a supported aggregate shape now leaf-expands; what stays
+/// `P004` is the out-of-surface shape — here an array of structs, the same
+/// boundary A028 draws for the executable `@`.
+#[test]
+fn p004_rejects_an_out_of_surface_compound_parameter() {
+    let src = "\
+struct P { x: i32; }
+spec S { fn f(ps: [P; 2]) forall { let n: i32 = @; assert(n > 0); } }
+";
+    let e = err(src);
+    assert!(e.contains("error[P004]"), "{e}");
+    assert!(
+        e.contains(
+            "type `[P; 2]` cannot appear in a specification term; a term is a bool, an \
+             integer, or an enum value, and the only aggregates a specification names are \
+             arrays of those at any rank and structs whose fields are those or one-dimensional \
+             arrays of those"
+        ),
+        "P004 must name the whole representable surface, not the scalar part of it: {e}"
+    );
+}
+
+/// The surface clause has to be exact about rank, because the two aggregate
+/// kinds differ: an array of scalars nests to any depth, a struct field may be
+/// a scalar or a one-dimensional array of scalars and no deeper. A struct with
+/// a multidimensional array field is rejected, so the clause must not name that
+/// field shape as legal.
+#[test]
+fn the_surface_clause_does_not_promise_a_multidimensional_struct_field() {
+    let deep = err("\
+struct Deep { grid: [[i32; 2]; 2]; tag: i32; }
+spec S { fn f(d: Deep) forall { let n: i32 = @; assert(n > 0); } }
+");
+    assert!(deep.contains("error[P004]"), "{deep}");
+    assert!(
+        deep.contains("structs whose fields are those or one-dimensional arrays of those"),
+        "{deep}"
+    );
+
+    // The rank claim the same clause makes for arrays is the permissive one,
+    // and it is true: a rank-3 scalar array is in surface.
+    let rank_three = "spec S { fn f() forall { let m: [[[i32; 2]; 2]; 2] = @; \
+                      assert(m[0][0][0] >= m[0][0][0]); } }";
+    let _ = ok(rank_three);
+}
+
+/// An aggregate read whole where a term is required is a different mistake from
+/// an unrepresentable type, and says so. Passing an aggregate to a call is the
+/// commonest way to arrive: the compiled callee takes a pointer, so the symbol
+/// a `T_app` names could not be applied to leaves.
 #[test]
-fn p004_rejects_a_compound_parameter() {
-    let src = "spec S { fn f(arr: [i32; 3]) forall { let n: i32 = @; assert(n > 0); } }";
-    assert!(err(src).contains("error[P004]"));
+fn an_aggregate_in_term_position_is_told_it_is_not_a_term() {
+    let e = err("\
+fn head(v: [i32; 2]) -> i32 { return v[0]; }
+spec S { fn f() forall { let a: [i32; 2] = @; assert(head(a) == a[0]); } }
+");
+    assert!(e.contains("error[P004]"), "{e}");
+    assert!(
+        e.contains(
+            "type `[i32; 2]` is an aggregate, and a term is one scalar value: a specification \
+             names an aggregate by its scalar leaves rather than as a value of its own"
+        ) && e.contains("name the component you mean"),
+        "{e}"
+    );
+    assert!(
+        !e.contains("the only aggregates a specification names"),
+        "the surface enumeration would contradict this very rejection: {e}"
+    );
 }
 
 #[test]
@@ -1809,21 +1930,28 @@ spec S { fn f() forall { let a: i32 = @; assert(helper() == a); } }
     assert!(err(nondet_src).contains("error[P005]"));
 }
 
+/// A `@` at a supported aggregate shape now leaf-expands; what stays `P008`
+/// is the out-of-surface shape — an array of structs (`A028`'s boundary),
+/// reachable here because this harness runs no analysis.
 #[test]
-fn p007_rejects_a_forall_block_inside_an_exists_block() {
-    let src = "spec S { fn f() forall { let n: i32 = @; exists { forall { assert(n > 0); } } } }";
-    assert!(err(src).contains("error[P007]"));
-}
-
-#[test]
-fn p008_rejects_a_compound_uzumaki() {
-    let src = "spec S { fn f() forall { let arr: [i32; 3] = @; let n: i32 = @; assert(n > 0); } }";
+fn p008_rejects_an_out_of_surface_compound_uzumaki() {
+    let src = "\
+struct P { x: i32; }
+spec S { fn f() forall { let ps: [P; 2] = @; let n: i32 = @; assert(n > 0); } }
+";
     let e = err(src);
     assert!(e.contains("error[P008]"), "{e}");
+    // The universal wording names the *shape* restriction, not a missing
+    // encoding: a compound `@` encodes now, so "has no assertion encoding"
+    // would state a rule the language no longer has.
     assert!(
-        e.contains("has no assertion encoding"),
-        "the universal-mode wording must stay unchanged: {e}"
+        e.contains(
+            "uzumaki (@) over compound type `[P; 2]` quantifies a shape the assertion encoding \
+             cannot take apart"
+        ) && e.contains("structs whose fields are scalars or one-dimensional arrays of those"),
+        "{e}"
     );
+    assert!(!e.contains("has no assertion encoding"), "{e}");
 }
 
 #[test]
@@ -1844,8 +1972,12 @@ spec S {
 
 #[test]
 fn every_diagnostic_is_collected_before_failing() {
-    // A compound parameter (P004) and a loop (P002) in the same body.
-    let src = "spec S { fn f(arr: [i32; 2]) forall { let n: i32 = @; loop { } } }";
+    // An out-of-surface compound parameter (P004) and a loop (P002) in the
+    // same body.
+    let src = "\
+struct P { x: i32; }
+spec S { fn f(ps: [P; 2]) forall { let n: i32 = @; loop { } } }
+";
     let e = err(src);
     assert!(e.contains("error[P004]"), "{e}");
     assert!(e.contains("error[P002]"), "{e}");
@@ -2119,7 +2251,7 @@ fn an_earlier_diagnostic_suppresses_the_vacuity_report() {
     assert!(looped.contains("error[P002]"), "{looped}");
     assert!(!looped.contains("P010"), "{looped}");
 
-    let compound = err("spec S { fn f(arr: [i32; 3]) forall { } }");
+    let compound = err("struct P { x: i32; }\nspec S { fn f(ps: [P; 2]) forall { } }");
     assert!(compound.contains("error[P004]"), "{compound}");
     assert!(!compound.contains("P010"), "{compound}");
 }
@@ -2284,7 +2416,9 @@ fn assert_no_typing_guards(h: &HAssert) {
                 "a reachability payload must carry no typing guard, found HasType({t:?}, {ty:?})"
             )
         }
-        HAssert::Not(inner) | HAssert::Ex(inner) => assert_no_typing_guards(inner),
+        HAssert::Not(inner) | HAssert::Ex(inner) | HAssert::All(inner) => {
+            assert_no_typing_guards(inner);
+        }
         HAssert::And(l, r) | HAssert::Imp(l, r) | HAssert::Or(l, r) => {
             assert_no_typing_guards(l);
             assert_no_typing_guards(r);
@@ -2516,12 +2650,78 @@ fn p011_rejects_a_call_to_a_reachability_spec_function() {
       }");
     assert!(from_exists.contains("error[P011]"), "{from_exists}");
     assert!(
-        from_exists.contains("`unique`-quantified spec function"),
+        from_exists.contains("is a `unique`-quantified spec function"),
         "{from_exists}"
     );
     assert!(!from_exists.contains("P005"), "{from_exists}");
 }
 
+/// Every message that names a quantifier takes the article the word is spoken
+/// with — `unique` reads as a consonant despite its leading vowel letter, so a
+/// leading-vowel test would write "an `unique`" at each of these sites.
+///
+/// Both quantifiers are pinned at all four families. The article helper's
+/// fallback is `"a"`, so only the `exists` arm can regress silently, and P011
+/// is the family where such a regression would otherwise leave the suite green.
+#[test]
+fn a_named_quantifier_takes_its_spoken_article() {
+    let call = err("spec S {
+        fn u() unique { let n: i32 = @; assert(n == 1); }
+        fn f() exists { u(); assert(1 == 1); }
+      }");
+    let uzumaki =
+        err("spec S { fn f() unique { let a: [i32; 2] = @; let n: i32 = @; assert(n > 0); } }");
+    let parameter = err("spec S { fn f(a: [i32; 2]) unique { let c: i32 = @; assert(c > 0); } }");
+    let nested = err("spec S { fn f() unique { let n: i32 = @; forall { assert(n > 0); } } }");
+    for message in [&call, &uzumaki, &parameter, &nested] {
+        assert!(message.contains("a `unique`-quantified"), "{message}");
+        assert!(!message.contains("an `unique`"), "{message}");
+    }
+
+    let exists_call = err("spec S {
+        fn e() exists { let n: i32 = @; assert(n > 0); }
+        fn f() forall { let a: i32 = @; e(); assert(a >= a); }
+      }");
+    let exists_uzumaki =
+        err("spec S { fn f() exists { let a: [i32; 2] = @; let n: i32 = @; assert(n > 0); } }");
+    let exists_parameter =
+        err("spec S { fn f(a: [i32; 2]) exists { let c: i32 = @; assert(c > 0); } }");
+    let exists_nested =
+        err("spec S { fn f() exists { let n: i32 = @; forall { assert(n > 0); } } }");
+    for message in [
+        &exists_call,
+        &exists_uzumaki,
+        &exists_parameter,
+        &exists_nested,
+    ] {
+        assert!(message.contains("an `exists`-quantified"), "{message}");
+        assert!(!message.contains(" a `exists`"), "{message}");
+    }
+}
+
+/// A compound `@` in *call-argument* position of a reachability body is the
+/// second spelling of the same mistake, and reads the same: the pre-scan plans
+/// only scalar choices, so an unplanned argument lands on its own emit path.
+///
+/// Analysis rule A014 rejects this spelling first whenever analysis runs, but
+/// the corpus and unit pipelines go parse → typecheck → codegen without it, so
+/// the translator's own rejection is the only guard there — the same reason
+/// `P014` exists beside A037.
+#[test]
+fn a_compound_argument_uzumaki_in_a_reach_body_reads_like_the_let_form() {
+    let src = "fn g(v: [i32; 2]) -> i32 { return v[0]; }
+        spec S { fn f() exists { assert(g(@) == 0); } }";
+    let e = err(src);
+    assert!(e.contains("error[P008]"), "{e}");
+    assert!(
+        e.contains(
+            "uzumaki (@) over compound type `[i32; 2]` cannot be a reachability choice: this \
+             is an `exists`-quantified spec function"
+        ) && e.contains("state the property in a `forall`-bodied spec function"),
+        "{e}"
+    );
+}
+
 /// The same rejection reaches the term translator through the same resolve
 /// path. A reachability callee is void by construction (the no-return rule),
 /// so no value-demanding position can hold one in a type-correct program; the
@@ -2564,16 +2764,33 @@ fn p012_rejects_an_anonymous_choice_in_a_unique_body_only() {
 }
 
 /// A compound `@` in a reachability body keeps `P008` but explains the
-/// reachability-specific impossibility: a choice arrives as one scalar WASM
-/// parameter. (The universal-mode wording is pinned unchanged in section 11.)
+/// reachability-specific impossibility: this quantifier's obligation is about
+/// one actual run, whose choices arrive one scalar at a time. The wording must
+/// name the quantifier — the identical declaration leaf-expands in a `forall`
+/// body — and must offer the `forall`-bodied alternative.
 #[test]
 fn p008_speaks_reachability_for_a_compound_choice_in_a_reach_body() {
     let e =
         err("spec S { fn f() exists { let arr: [i32; 2] = @; let n: i32 = @; assert(n > 0); } }");
     assert!(e.contains("error[P008]"), "{e}");
     assert!(
-        e.contains("cannot be a reachability choice")
-            && e.contains("arrives as one scalar WASM parameter"),
+        e.contains(
+            "uzumaki (@) over compound type `[i32; 2]` cannot be a reachability choice: this \
+             is an `exists`-quantified spec function"
+        ) && e.contains("each choice arrives as one scalar parameter of that run")
+            && e.contains("state the property in a `forall`-bodied spec function"),
+        "{e}"
+    );
+}
+
+/// The same rejection in a `unique` body names *its* quantifier, with the
+/// article the word takes when spoken.
+#[test]
+fn p008_names_the_unique_quantifier_in_a_unique_body() {
+    let e =
+        err("spec S { fn f() unique { let arr: [i32; 2] = @; let n: i32 = @; assert(n > 0); } }");
+    assert!(
+        e.contains("this is a `unique`-quantified spec function"),
         "{e}"
     );
 }
@@ -2652,3 +2869,1574 @@ spec S {
         })
     );
 }
+
+// ----- 15. aggregate values (leaf encoding) -------------------------------
+
+/// The issue's acceptance shape: a compound `@` binds one guarded universal
+/// slot per scalar leaf, and a constant-index read is that leaf's term.
+#[test]
+fn aggregate_uzumaki_binds_one_guarded_slot_per_leaf() {
+    assert_eq!(
+        obligation_of("", "forall { let a: [i32; 3] = @; assert(a[0] <= a[0]); }"),
+        imp(
+            and(guard(0), and(guard(1), guard(2))),
+            nz(rel(HNumType::I32, HRelop::LeS, local(0), local(0)))
+        )
+    );
+}
+
+/// A multi-rank scalar array enumerates row-major — the same order the
+/// runtime unrolling walks — so `m[i][j]` is leaf `i * cols + j`.
+#[test]
+fn multi_rank_array_leaves_enumerate_row_major() {
+    assert_eq!(
+        obligation_of(
+            "",
+            "forall { let m: [[i32; 2]; 2] = @; assert(m[1][0] > m[0][1]); }"
+        ),
+        imp(
+            and(guard(0), and(guard(1), and(guard(2), guard(3)))),
+            nz(gts(local(2), local(1)))
+        )
+    );
+}
+
+/// Struct leaves follow field-layout order (declaration order), each guarded
+/// at its own width, and a 1-D scalar-array field contributes its elements in
+/// place — the mixed chain `r.row[k]` lands on the right leaf.
+#[test]
+fn struct_uzumaki_leaves_follow_field_layout_order_and_widths() {
+    let prelude = "struct Rec { lo: i32; wide: i64; row: [i32; 2]; }";
+    assert_eq!(
+        obligation_of(
+            prelude,
+            "forall { let r: Rec = @; assert(r.wide > 0); assert(r.row[1] >= r.row[0]); }"
+        ),
+        imp(
+            and(
+                guard(0),
+                and(hastype(local(1), HNumType::I64), and(guard(2), guard(3)))
+            ),
+            and(
+                nz(rel(HNumType::I64, HRelop::GtS, local(1), i64c(0))),
+                nz(rel(HNumType::I32, HRelop::GeS, local(3), local(2)))
+            )
+        )
+    );
+}
+
+/// A compound parameter takes one slot and one guard per leaf, ahead of the
+/// parameters declared after it, so slot numbers stay source-aligned.
+#[test]
+fn compound_parameter_binds_leaf_slots_before_later_parameters() {
+    let source = "spec S { fn all_ge(a: [i32; 3], b: i32) forall { assert(a[0] >= b); } }";
+    assert_eq!(
+        sole_obligation(&ok(source), "S"),
+        imp(
+            and(guard(0), and(guard(1), and(guard(2), guard(3)))),
+            nz(rel(HNumType::I32, HRelop::GeS, local(0), local(3)))
+        )
+    );
+}
+
+/// An ignored compound parameter consumes and guards its leaf slots exactly
+/// like a named one — uniformity keeps later slot numbers source-aligned.
+#[test]
+fn ignored_compound_parameter_still_consumes_and_guards_its_leaf_slots() {
+    let source = "spec S { fn f(_: [i32; 2], b: i32) forall { assert(b > 0); } }";
+    assert_eq!(
+        sole_obligation(&ok(source), "S"),
+        imp(
+            and(guard(0), and(guard(1), guard(2))),
+            nz(gts(local(2), i32c(0)))
+        )
+    );
+}
+
+/// A struct parameter leaf-expands like a struct `@`.
+#[test]
+fn struct_parameter_binds_leaf_slots() {
+    let source = "\
+struct Pt { x: i32; y: i32; }
+spec S { fn f(p: Pt) forall { assert(p.x == p.y); } }
+";
+    assert_eq!(
+        sole_obligation(&ok(source), "S"),
+        imp(and(guard(0), guard(1)), nz(eqs(local(0), local(1))))
+    );
+}
+
+/// A cross-module struct type behaves exactly like an unqualified one: the
+/// `lib::Pair` spelling resolves through the qualified-path lookup and
+/// leaf-expands, both as a parameter and as a `@`.
+#[test]
+fn cross_module_struct_types_leaf_expand_like_unqualified_ones() {
+    let ctx = type_check_multi(&[
+        (
+            vec![],
+            "use lib;\nspec S {\n  fn f(p: lib::Pair) forall {\n    assert(p.a == p.b);\n  }\n  fn g() forall {\n    let q: lib::Pair = @;\n    assert(q.b >= q.a);\n  }\n}\n",
+        ),
+        (vec!["lib"], "pub struct Pair { a: i32; b: i32; }\n"),
+    ]);
+    let (map, diagnostics) = translate(&ctx);
+    assert!(
+        diagnostics.is_empty(),
+        "unexpected diagnostics: {diagnostics:?}"
+    );
+    assert_eq!(
+        obligation_named(&map, "S", "S.f"),
+        imp(and(guard(0), guard(1)), nz(eqs(local(0), local(1))))
+    );
+    assert_eq!(
+        obligation_named(&map, "S", "S.g"),
+        imp(
+            and(guard(0), guard(1)),
+            nz(rel(HNumType::I32, HRelop::GeS, local(1), local(0)))
+        )
+    );
+}
+
+/// An aggregate `@` inside an `assume`/`exists` context binds one nested
+/// `HA_ex` per leaf, levels in enumeration order.
+#[test]
+fn aggregate_uzumaki_in_an_exists_block_binds_nested_ex_binders() {
+    let body = "forall { let n: i32 = @; exists { let a: [i32; 2] = @; assert(a[0] == n && a[1] == a[0]); } }";
+    assert_eq!(
+        obligation_of("", body),
+        imp(
+            guard(0),
+            ex(ex(and(teq(lvar(1), local(0)), teq(lvar(0), lvar(1)))))
+        )
+    );
+}
+
+/// An array literal is a value tree: a constant-index read of it is the
+/// element's own translated term.
+#[test]
+fn array_literal_elements_resolve_by_constant_index() {
+    assert_eq!(
+        obligation_of(
+            "",
+            "forall { let v: [i32; 3] = [1, 2, 3]; assert(v[1] == 2); }"
+        ),
+        nz(eqs(i32c(2), i32c(2)))
+    );
+}
+
+/// A struct literal's fields reorder from source order to field-layout order;
+/// access is by name, so the reordering is unobservable.
+#[test]
+fn struct_literal_fields_resolve_by_name_across_reordering() {
+    let prelude = "struct Pt { x: i32; y: i32; }";
+    assert_eq!(
+        obligation_of(
+            prelude,
+            "forall { let p: Pt = Pt { y: 5, x: 4 }; assert(p.x < p.y); }"
+        ),
+        nz(lts(i32c(4), i32c(5)))
+    );
+}
+
+/// Nested literals are part of the enclosing introduction and resolve through
+/// constant-index chains.
+#[test]
+fn nested_array_literal_resolves_through_a_constant_chain() {
+    assert_eq!(
+        obligation_of(
+            "",
+            "forall { let m: [[i32; 2]; 2] = [[1, 2], [3, 4]]; assert(m[1][0] == 3); }"
+        ),
+        nz(eqs(i32c(3), i32c(3)))
+    );
+}
+
+/// A block-local `const` at an aggregate type binds a value tree like a pure
+/// `let`.
+#[test]
+fn aggregate_const_binds_a_value_tree() {
+    assert_eq!(
+        obligation_of(
+            "",
+            "forall { const C: [i32; 2] = [7, 8]; assert(C[0] == 7); }"
+        ),
+        nz(eqs(i32c(7), i32c(7)))
+    );
+}
+
+/// An aggregate copy (`let b: T = a;`) clones the bound value tree —
+/// value-copy semantics make the pure inlining exact.
+#[test]
+fn aggregate_copy_clones_the_bound_value() {
+    assert_eq!(
+        obligation_of(
+            "",
+            "forall { let a: [i32; 2] = @; let b: [i32; 2] = a; assert(b[1] == a[1]); }"
+        ),
+        imp(and(guard(0), guard(1)), nz(eqs(local(1), local(1))))
+    );
+}
+
+/// Aggregate `==` in assertion position is the leafwise conjunction of
+/// per-leaf `term_eq`, in leaf enumeration order.
+#[test]
+fn aggregate_equality_is_a_leafwise_conjunction() {
+    assert_eq!(
+        obligation_of(
+            "",
+            "forall { let a: [i32; 2] = @; let b: [i32; 2] = @; assert(a == b); }"
+        ),
+        imp(
+            and(guard(0), and(guard(1), and(guard(2), guard(3)))),
+            and(teq(local(0), local(2)), teq(local(1), local(3)))
+        )
+    );
+}
+
+/// Aggregate `!=` is the De Morgan dual — a disjunction of negated per-leaf
+/// equalities — and a negated `==` flips to the same shape.
+#[test]
+fn aggregate_inequality_and_negated_equality_are_the_leafwise_dual() {
+    let expected = imp(
+        and(guard(0), and(guard(1), and(guard(2), guard(3)))),
+        or(not(teq(local(0), local(2))), not(teq(local(1), local(3)))),
+    );
+    assert_eq!(
+        obligation_of(
+            "",
+            "forall { let a: [i32; 2] = @; let b: [i32; 2] = @; assert(a != b); }"
+        ),
+        expected
+    );
+    assert_eq!(
+        obligation_of(
+            "",
+            "forall { let a: [i32; 2] = @; let b: [i32; 2] = @; assert(!(a == b)); }"
+        ),
+        expected
+    );
+}
+
+/// An aggregate compared against a literal reads the literal's leaf terms.
+#[test]
+fn aggregate_equality_against_a_literal_uses_its_leaf_terms() {
+    let prelude = "struct Pt { x: i32; y: i32; }";
+    assert_eq!(
+        obligation_of(
+            prelude,
+            "forall { let p: Pt = @; assert(p == Pt { x: 1, y: 2 }); }"
+        ),
+        imp(
+            and(guard(0), guard(1)),
+            and(teq(local(0), i32c(1)), teq(local(1), i32c(2)))
+        )
+    );
+}
+
+/// Aggregate comparison in *term* position stays rejected: an aggregate is
+/// not a term.
+#[test]
+fn aggregate_comparison_in_term_position_stays_rejected() {
+    let src = "\
+spec S { fn f() forall { let a: [i32; 2] = @; let b: [i32; 2] = @; let t: bool = a == b; assert(t); } }
+";
+    let e = err(src);
+    assert!(e.contains("error[P004]"), "{e}");
+}
+
+/// A folded-constant in-range index resolves like a literal one.
+#[test]
+fn folded_constant_index_resolves_in_range() {
+    assert_eq!(
+        obligation_of(
+            "",
+            "forall { let a: [i32; 3] = @; const K: i32 = 2; assert(a[K] > 0); }"
+        ),
+        imp(
+            and(guard(0), and(guard(1), guard(2))),
+            nz(gts(local(2), i32c(0)))
+        )
+    );
+}
+
+/// A folded-constant out-of-bounds index is `P014` — the same fact A037
+/// states for the direct-literal spelling, at the path A037's pattern cannot
+/// see.
+#[test]
+fn p014_rejects_a_folded_constant_out_of_bounds_index() {
+    let src =
+        "spec S { fn f() forall { let a: [i32; 3] = @; const K: i32 = 5; assert(a[K] > 0); } }";
+    let e = err(src);
+    assert!(e.contains("error[P014]"), "{e}");
+    assert!(
+        e.contains("array index 5 is out of bounds for array of length 3; valid indices are 0..3"),
+        "{e}"
+    );
+}
+
+/// An in-range unsigned constant index resolves too: reading the fold at the
+/// index's own signedness must not cost the positive path.
+#[test]
+fn folded_unsigned_constant_index_resolves_in_range() {
+    assert_eq!(
+        obligation_of(
+            "",
+            "forall { let a: [i32; 3] = @; const K: u32 = 2; assert(a[K] > 0); }"
+        ),
+        imp(
+            and(guard(0), and(guard(1), guard(2))),
+            nz(gts(local(2), i32c(0)))
+        )
+    );
+}
+
+/// `P014` names the index the source wrote. An unsigned constant rides in the
+/// term language at its signed bit pattern, and reporting that pattern would
+/// name a number found nowhere in the program.
+#[test]
+fn p014_names_an_unsigned_index_as_the_source_wrote_it() {
+    let out_of_bounds = |declaration: &str| {
+        err(&format!(
+            "spec S {{ fn f() forall {{ let a: [i32; 3] = @; {declaration} \
+             assert(a[K] > 0); }} }}"
+        ))
+    };
+    // All ones at 32 bits, which reads back as `-1` when read signed.
+    let max = out_of_bounds("const K: u32 = 4294967295;");
+    assert!(max.contains("error[P014]"), "{max}");
+    assert!(
+        max.contains("array index 4294967295 is out of bounds for array of length 3"),
+        "{max}"
+    );
+    // One past the signed maximum, where a signed reading shows as `i32::MIN`
+    // instead — a different wrong number, so the two cases discriminate.
+    let past_signed_max = out_of_bounds("const K: u32 = 2147483648;");
+    assert!(
+        past_signed_max.contains("array index 2147483648 is out of bounds for array of length 3"),
+        "{past_signed_max}"
+    );
+    // The widest index a program can name still reports whole.
+    let widest = out_of_bounds("const K: u64 = 18446744073709551615;");
+    assert!(
+        widest.contains("array index 18446744073709551615 is out of bounds for array of length 3"),
+        "{widest}"
+    );
+    // An unsigned index small enough to read the same either way.
+    let small = out_of_bounds("const K: u32 = 5;");
+    assert!(
+        small.contains("array index 5 is out of bounds for array of length 3"),
+        "{small}"
+    );
+    // A signed index keeps reading signed.
+    let signed = out_of_bounds("const K: i32 = 7;");
+    assert!(
+        signed.contains("array index 7 is out of bounds for array of length 3"),
+        "{signed}"
+    );
+}
+
+/// This harness runs no analysis, so a direct-literal OOB index (A037's case)
+/// reaches the translator too; `P014` is the only guard on this path.
+#[test]
+fn p014_also_guards_the_direct_literal_spelling_on_no_analysis_paths() {
+    let src = "spec S { fn f() forall { let a: [i32; 3] = @; assert(a[5] > 0); } }";
+    let e = err(src);
+    assert!(e.contains("error[P014]"), "{e}");
+}
+
+/// An index computed from constants is as statically certain as one written
+/// out, so it is folded and reported the same way. Left symbolic it would be
+/// defined by cases against a closed term nothing satisfies — an unprovable
+/// goal in place of a diagnostic.
+#[test]
+fn p014_rejects_an_out_of_bounds_arithmetic_index() {
+    let e = err("spec S { fn f() forall { let a: [i32; 2] = @; assert(a[1 + 1] == 0); } }");
+    assert!(e.contains("error[P014]"), "{e}");
+    assert!(
+        e.contains("array index 2 is out of bounds for array of length 2; valid indices are 0..2"),
+        "{e}"
+    );
+}
+
+/// The same for arithmetic over a named constant, which A037 cannot see even
+/// with analysis on.
+#[test]
+fn p014_rejects_an_out_of_bounds_index_computed_from_a_constant() {
+    let e = err(
+        "spec S { fn f() forall { let a: [i32; 2] = @; const K: i32 = 1; assert(a[K + 1] == 0); } }",
+    );
+    assert!(e.contains("error[P014]"), "{e}");
+    assert!(
+        e.contains("array index 2 is out of bounds for array of length 2; valid indices are 0..2"),
+        "{e}"
+    );
+}
+
+/// An in-range arithmetic index descends to its element like any other
+/// constant — the fold must not cost the positive path a real term and hand
+/// back a case split instead.
+#[test]
+fn an_in_range_arithmetic_index_descends_to_its_element() {
+    assert_eq!(
+        obligation_of("", "forall { let a: [i32; 3] = @; assert(a[0 + 1] > 0); }"),
+        imp(
+            and(guard(0), and(guard(1), guard(2))),
+            nz(gts(local(1), i32c(0)))
+        )
+    );
+}
+
+/// Arithmetic at an unsigned index type folds at that type's own reading, so
+/// an in-range result descends and an out-of-range one is named as the source
+/// computes it.
+#[test]
+fn an_unsigned_arithmetic_index_folds_at_its_own_signedness() {
+    assert_eq!(
+        obligation_of(
+            "",
+            "forall { let a: [i32; 3] = @; const K: u32 = 1; assert(a[K + 1] > 0); }"
+        ),
+        imp(
+            and(guard(0), and(guard(1), guard(2))),
+            nz(gts(local(2), i32c(0)))
+        )
+    );
+    let e = err(
+        "spec S { fn f() forall { let a: [i32; 3] = @; const K: u32 = 2; \
+         assert(a[K * 2] > 0); } }",
+    );
+    assert!(e.contains("error[P014]"), "{e}");
+    assert!(
+        e.contains("array index 4 is out of bounds for array of length 3"),
+        "{e}"
+    );
+}
+
+/// Arithmetic the source's own width would wrap is not folded: the symbolic
+/// path carries that wrap faithfully, and guessing an unwrapped number would
+/// name an index the program never computes.
+#[test]
+fn arithmetic_that_wraps_its_width_is_left_to_the_case_split() {
+    let source = "forall { let a: [i32; 2] = @; const K: u32 = 4294967295; \
+                  assert(a[K + 1] == a[0]); }";
+    // `K + 1` wraps to `0` at `u32`, which is in range — so no `P014`, and the
+    // index is defined by cases over a closed term the assertion language
+    // evaluates at the same width.
+    let obligation = obligation_of("", source);
+    let index = bin(HNumType::I32, HBinop::Add, i32c(-1), i32c(1));
+    let definition = element_def(&index, &lvar(0), &[local(0), local(1)]);
+    assert_eq!(
+        obligation,
+        imp(
+            and(guard(0), guard(1)),
+            ex(and(definition, nz(eqs(lvar(0), local(0)))))
+        )
+    );
+}
+
+/// An operation with no reading as a number stays unfolded rather than being
+/// guessed at: a bitwise operator names a bit pattern, not a number the fold
+/// could resolve to an element. A division by zero never arrives here to be
+/// folded — the type checker rejects it — so the fold's guard against it is
+/// defensive only.
+#[test]
+fn an_undecidable_index_operation_is_left_to_the_case_split() {
+    let shift = obligation_of(
+        "",
+        "forall { let a: [i32; 2] = @; assert(a[1 << 1] == a[0]); }",
+    );
+    let index = bin(HNumType::I32, HBinop::Shl, i32c(1), i32c(1));
+    assert_eq!(
+        shift,
+        imp(
+            and(guard(0), guard(1)),
+            ex(and(
+                element_def(&index, &lvar(0), &[local(0), local(1)]),
+                nz(eqs(lvar(0), local(0)))
+            ))
+        )
+    );
+}
+
+// ----- 15a. the cumulative leaf budget (P013) ----------------------------
+
+/// A single introduction past the cap is `P013`, reported from the type
+/// before anything is materialized.
+#[test]
+fn p013_rejects_a_single_oversized_uzumaki() {
+    let src = "spec S { fn f() forall { let big: [i32; 65] = @; assert(big[0] > 0); } }";
+    let e = err(src);
+    assert!(e.contains("error[P013]"), "{e}");
+    assert!(
+        e.contains(
+            "uzumaki (@) over compound type `[i32; 65]` quantifies 65 scalar leaves, and this \
+             specification already quantifies 0 of the 64 one function may hold"
+        ),
+        "{e}"
+    );
+}
+
+/// The budget is a per-function running total: introductions each under the
+/// cap still cross it together, and the report lands on the crossing
+/// introduction with the cumulative context — never on the encoder backstop.
+#[test]
+fn p013_reports_the_crossing_introduction_cumulatively() {
+    let src = "spec S { fn f(a: [i32; 40], b: [i32; 40]) forall { assert(a[0] == b[0]); } }";
+    let ctx = type_check(src);
+    let (_, diagnostics) = translate(&ctx);
+    assert_eq!(
+        diagnostics.len(),
+        1,
+        "the sentinel keeps later reads silent: {diagnostics:?}"
+    );
+    assert!(diagnostics[0].contains("error[P013]"), "{diagnostics:?}");
+    assert!(
+        diagnostics[0].contains(
+            "parameter `b` of type `[i32; 40]` contributes 40 scalar leaves, and this \
+             specification already quantifies 40 of the 64 one function may hold"
+        ),
+        "{diagnostics:?}"
+    );
+}
+
+/// A literal introduction counts against the same budget, with its own
+/// remedy wording — and its own reason: a literal's leaves are constants, so
+/// the message names the nesting they cost rather than the quantified
+/// variables and typing guards they never create.
+#[test]
+fn p013_counts_literal_introductions_against_the_same_budget() {
+    let src = "\
+spec S { fn f() forall { let a: [i32; 60] = @; let v: [i32; 8] = [1, 2, 3, 4, 5, 6, 7, 8]; assert(v[0] == a[0]); } }
+";
+    let ctx = type_check(src);
+    let (_, diagnostics) = translate(&ctx);
+    assert_eq!(diagnostics.len(), 1, "{diagnostics:?}");
+    assert!(diagnostics[0].contains("error[P013]"), "{diagnostics:?}");
+    assert!(
+        diagnostics[0].contains(
+            "this `[i32; 8]` literal has 8 scalar leaves, and this specification already \
+             quantifies 60 of the 64 one function may hold: each leaf becomes a term of its \
+             own, a comparison against the value nests one conjunct per leaf, and the \
+             assertion encoding caps how deeply one obligation may nest; build a smaller \
+             value, or state the property over the elements it reads"
+        ),
+        "{diagnostics:?}"
+    );
+    assert!(
+        !diagnostics[0].contains("quantified variable"),
+        "a literal's leaves bind no variables: {diagnostics:?}"
+    );
+}
+
+/// Through the whole code generator, a budget overrun is the named `P013`
+/// rejection, never the encoder's `HspecTreeTooDeep` backstop — the failure
+/// the cumulative cap exists to preempt.
+#[test]
+fn budget_overrun_never_reaches_the_encoder_backstop() {
+    let source = "spec S { fn f(a: [i32; 64], b: [i32; 64], c: [i32; 64], d: [i32; 64]) \
+                  forall { assert(a[0] == b[0]); } }"
+        .to_string();
+    let err = proof_codegen(source).expect_err("an over-budget spec must fail code generation");
+    match err {
+        CodegenError::UntranslatableSpec(details) => {
+            assert!(details.contains("error[P013]"), "{details}");
+        }
+        other => panic!("expected UntranslatableSpec carrying P013, got: {other:?}"),
+    }
+}
+
+/// Exactly the cap in one function still translates — the budget bounds the
+/// guard chain, and 64 guards fit the encoder with room for the claim.
+#[test]
+fn a_full_budget_introduction_still_translates() {
+    let source = "spec S { fn f(a: [i32; 64]) forall { assert(a[0] == a[63]); } }".to_string();
+    let size = proof_codegen(source)
+        .expect("a spec at exactly the leaf budget must survive the whole code generator");
+    assert!(size > 0, "code generation produced an empty module");
+}
+
+// ----- 15b. sentinels, out-of-surface shapes, kept rejections -------------
+
+/// One rejected aggregate yields exactly one diagnostic: every later read of
+/// the sentinel resolves silently instead of cascading into further errors.
+#[test]
+fn a_rejected_aggregate_is_reported_exactly_once() {
+    let src = "\
+struct P { x: i32; }
+spec S { fn f() forall { let ps: [P; 2] = @; assert(ps[0].x > 0 && ps[1].x > 0); } }
+";
+    let ctx = type_check(src);
+    let (_, diagnostics) = translate(&ctx);
+    assert_eq!(
+        diagnostics.len(),
+        1,
+        "the sentinel must keep reads of a rejected aggregate silent: {diagnostics:?}"
+    );
+    assert!(diagnostics[0].contains("error[P008]"), "{diagnostics:?}");
+}
+
+/// The same one-mistake-one-message discipline for an out-of-surface
+/// parameter.
+#[test]
+fn a_rejected_parameter_is_reported_exactly_once() {
+    let src = "\
+struct P { x: i32; }
+spec S { fn f(ps: [P; 2]) forall { assert(ps[0].x == 1); } }
+";
+    let ctx = type_check(src);
+    let (_, diagnostics) = translate(&ctx);
+    assert_eq!(diagnostics.len(), 1, "{diagnostics:?}");
+    assert!(diagnostics[0].contains("error[P004]"), "{diagnostics:?}");
+}
+
+/// A struct containing a struct field is out of the surface on every path —
+/// `@` (P008) and parameter (P004) — the boundary A027 draws for the
+/// executable unrolling.
+#[test]
+fn struct_in_struct_stays_rejected_on_every_path() {
+    let prelude = "struct In { v: i32; }\nstruct Out { a: In; }\n";
+    let via_uzumaki = err(&format!(
+        "{prelude}spec S {{ fn f() forall {{ let o: Out = @; assert(o.a.v > 0); }} }}"
+    ));
+    assert!(via_uzumaki.contains("error[P008]"), "{via_uzumaki}");
+    let via_parameter = err(&format!(
+        "{prelude}spec S {{ fn f(o: Out) forall {{ assert(o.a.v > 0); }} }}"
+    ));
+    assert!(via_parameter.contains("error[P004]"), "{via_parameter}");
+}
+
+/// The `::`-qualified spelling of a struct is rejected exactly like the
+/// unqualified spelling of the same struct: an out-of-surface `@` is `P008`
+/// under both, because one spelling-total classifier answers for every way a
+/// struct type can be named. A partial classifier here would hand the
+/// cross-module spelling the `P004` the byte-identical single-file shape does
+/// not get.
+#[test]
+fn a_qualified_struct_uzumaki_is_rejected_like_the_unqualified_one() {
+    let ctx = type_check_multi(&[
+        (
+            vec![],
+            "use geom;\nspec S {\n  fn f() forall {\n    let o: geom::Outer = @;\n    \
+             assert(o.a.v > 0);\n  }\n}\n",
+        ),
+        (
+            vec!["geom"],
+            "pub struct In { v: i32; }\npub struct Outer { a: In; }\n",
+        ),
+    ]);
+    let (_, diagnostics) = translate(&ctx);
+    assert_eq!(diagnostics.len(), 1, "{diagnostics:?}");
+    assert!(diagnostics[0].contains("error[P008]"), "{diagnostics:?}");
+    assert!(
+        diagnostics[0].contains(
+            "uzumaki (@) over compound type `geom::Outer` quantifies a shape the assertion \
+             encoding cannot take apart"
+        ),
+        "{diagnostics:?}"
+    );
+}
+
+/// The call-argument spelling of a compound reachability choice classifies the
+/// same way as the `let` spelling, for every way a struct type can be named.
+/// The two sites read the type from different places — the `let` from its
+/// declaration, the argument from the checker's record for the `@` — so a
+/// classifier that agreed only on the unqualified spelling would hand the
+/// cross-module one the term-surface `P004` instead of the reachability `P008`.
+#[test]
+fn a_qualified_struct_argument_uzumaki_in_a_reach_body_is_rejected_like_the_let_form() {
+    let ctx = type_check_multi(&[
+        (
+            vec![],
+            "use geom;\nfn take(o: geom::Outer) -> i32 { return o.a.v; }\nspec S {\n  \
+             fn f() exists {\n    assert(take(@) == 0);\n  }\n}\n",
+        ),
+        (
+            vec!["geom"],
+            "pub struct In { v: i32; }\npub struct Outer { a: In; }\n",
+        ),
+    ]);
+    let (_, diagnostics) = translate(&ctx);
+    assert_eq!(diagnostics.len(), 1, "{diagnostics:?}");
+    assert!(diagnostics[0].contains("error[P008]"), "{diagnostics:?}");
+    // The rendered type is pinned, not just the code: the two sites read the
+    // type from different places, so a classifier that agreed on the code
+    // while the argument form rendered a bare `Outer` would still be two
+    // messages for one mistake.
+    assert!(
+        diagnostics[0].contains(
+            "uzumaki (@) over compound type `geom::Outer` cannot be a reachability choice"
+        ),
+        "{diagnostics:?}"
+    );
+}
+
+/// An out-of-surface declared type keeps its right-hand side's own `P002`:
+/// the aggregate binding translates the literal as a term, and a literal has
+/// no term encoding. Both bindings that take that path — the `let` and the
+/// block-local `const` — are pinned, because routing either shape-miss
+/// through the non-scalar diagnostic would silently downgrade the message to
+/// `P004` with the rest of the suite still green.
+#[test]
+fn an_out_of_surface_literal_keeps_the_pre_existing_p002() {
+    let one_p002 = |binding: &str| {
+        let src = format!(
+            "struct P {{ x: i32; }}\nspec S {{ fn f() forall {{ {binding} \
+             assert(ps[0].x == 1); }} }}\n"
+        );
+        let ctx = type_check(&src);
+        let (_, diagnostics) = translate(&ctx);
+        assert_eq!(diagnostics.len(), 1, "{diagnostics:?}");
+        assert!(diagnostics[0].contains("error[P002]"), "{diagnostics:?}");
+        assert!(
+            diagnostics[0].contains(
+                "an array literal has no encoding in the verification assertion language"
+            ),
+            "{diagnostics:?}"
+        );
+    };
+    one_p002("let ps: [P; 2] = [P { x: 1 }, P { x: 2 }];");
+    one_p002("const ps: [P; 2] = [P { x: 1 }, P { x: 2 }];");
+}
+
+/// The other way an out-of-surface literal is reached — as an operand of an
+/// aggregate comparison, where no declared type screens it first — states the
+/// shape restriction rather than borrowing the shared no-encoding template. A
+/// literal of a supported shape encodes now, so "has no encoding" would name a
+/// rule the language dropped, and the template's "move the logic into an
+/// executable helper" remedy dead-ends on a compound result.
+#[test]
+fn an_out_of_surface_literal_operand_states_the_shape_restriction() {
+    let src = "\
+struct P { x: i32; }
+spec S { fn f(a: [P; 2]) forall { assert(a == [P { x: 1 }, P { x: 2 }]); } }
+";
+    let ctx = type_check(src);
+    let (_, diagnostics) = translate(&ctx);
+    // Two independent mistakes, two messages: `P004` for the out-of-surface
+    // parameter and `P002` for the literal. The count is the assertion that
+    // matters — this is the one body exercising the sentinel discipline with
+    // two mistakes at once, so a parameter that started cascading into the
+    // comparison would show up here as a third message and nowhere else.
+    assert_eq!(diagnostics.len(), 2, "{diagnostics:?}");
+    let joined = diagnostics.join("\n");
+    assert!(joined.contains("error[P004]"), "{joined}");
+    assert!(joined.contains("error[P002]"), "{joined}");
+    assert!(
+        joined.contains("an array literal of this shape has no assertion encoding")
+            && joined.contains("build the components you need as separate values"),
+        "{joined}"
+    );
+}
+
+/// A struct with a multidimensional-array field is out of the surface too
+/// (A027 permits only 1-D scalar-array fields).
+#[test]
+fn struct_with_multidim_array_field_stays_rejected() {
+    let src = "\
+struct M { g: [[i32; 2]; 2]; }
+spec S { fn f(m: M) forall { assert(m.g[0][0] > 0); } }
+";
+    let e = err(src);
+    assert!(e.contains("error[P004]"), "{e}");
+}
+
+/// A field-less struct type-checks (A045 rejects it only under analysis, and
+/// this harness runs none), and an empty leaf list would silently ⊤-collapse
+/// an introduction — so the zero-leaf shape is classified out of the surface
+/// and keeps the pre-existing rejections instead.
+#[test]
+fn a_zero_leaf_struct_is_out_of_the_surface_on_every_path() {
+    let prelude = "struct E { }\n";
+    let via_parameter = err(&format!(
+        "{prelude}spec S {{ fn f(e: E) forall {{ let n: i32 = @; assert(n > 0); }} }}"
+    ));
+    assert!(via_parameter.contains("error[P004]"), "{via_parameter}");
+    let via_uzumaki = err(&format!(
+        "{prelude}spec S {{ fn f() forall {{ let e: E = @; let n: i32 = @; assert(n > 0); }} }}"
+    ));
+    assert!(via_uzumaki.contains("error[P008]"), "{via_uzumaki}");
+}
+
+/// A zero-length array never reaches the translator at all: the type checker
+/// rejects the type, which is what keeps the other zero-leaf spelling
+/// unreachable.
+#[test]
+fn a_zero_length_array_is_rejected_by_the_type_checker() {
+    let parsed = inference_parser::parse("spec S { fn f(a: [i32; 0]) forall { assert(1 > 0); } }");
+    assert!(parsed.errors.is_empty(), "{:?}", parsed.errors);
+    assert!(
+        TypeCheckerBuilder::build_typed_context(parsed.arena).is_err(),
+        "a zero-length array type must be rejected before translation"
+    );
+}
+
+/// Reachability mode keeps both rejections: a compound parameter stays
+/// `P004` and a compound `@` stays `P008` (reachability wording). The
+/// parameter rejection is load-bearing alignment, not conservatism: the
+/// downstream judgment reads the k-th choice at frame slot `entry_arity + k`,
+/// so every declared parameter must keep costing exactly one payload slot —
+/// leaf expansion would misalign every choice after it.
+#[test]
+fn reach_mode_keeps_compound_parameter_and_uzumaki_rejections() {
+    let param =
+        err("spec S { fn f(a: [i32; 2], x: i32) exists { let c: i32 = @; assert(x == c); } }");
+    assert!(param.contains("error[P004]"), "{param}");
+    assert!(
+        param.contains(
+            "parameter `a` of type `[i32; 2]` cannot appear in an `exists`-quantified spec \
+             function"
+        ) && param.contains("is one pointer local"),
+        "the reach-mode P004 must name the quantifier, since the same declaration \
+         leaf-expands in a `forall` body: {param}"
+    );
+
+    let uzumaki = err("spec S { fn f(x: i32) exists { let a: [i32; 2] = @; assert(x > 0); } }");
+    assert!(uzumaki.contains("error[P008]"), "{uzumaki}");
+    assert!(
+        uzumaki.contains("cannot be a reachability choice"),
+        "the reachability P008 wording must stay unchanged: {uzumaki}"
+    );
+}
+
+/// A `@` bound after a compound parameter takes the next slot past the
+/// parameter's leaves — source alignment holds across the expansion.
+#[test]
+fn uzumaki_after_a_compound_parameter_takes_the_next_leaf_slot() {
+    let source = "spec S { fn f(a: [i32; 2]) forall { let n: i32 = @; assert(n > a[1]); } }";
+    assert_eq!(
+        sole_obligation(&ok(source), "S"),
+        imp(
+            and(guard(0), and(guard(1), guard(2))),
+            nz(gts(local(2), local(1)))
+        )
+    );
+}
+
+/// A short-circuit witness inside a literal element scopes over the rest of
+/// the block through the same `scoped_over_rest` path a pure `let`'s witness
+/// takes: the binder wraps everything that can read the bound aggregate, and
+/// the slot guards pending at the binding drain around it.
+#[test]
+fn witness_inside_a_literal_element_scopes_over_the_rest() {
+    let body = "forall { let p: bool = @; let q: bool = @; \
+                let flags: [bool; 2] = [p && q, p]; assert(flags[0] == flags[1]); }";
+    let witness_def = or(
+        and(nz(local(0)), teq(lvar(0), local(1))),
+        and(eqz(local(0)), teq(lvar(0), i32c(0))),
+    );
+    assert_eq!(
+        obligation_of("", body),
+        imp(
+            and(guard(0), guard(1)),
+            ex(and(witness_def, nz(eqs(lvar(0), local(0)))))
+        )
+    );
+}
+
+// ----- 15c. non-constant index access (bounded iteration) -----------------
+
+fn ltu(l: HTerm, r: HTerm) -> HTerm {
+    rel(HNumType::I32, HRelop::LtU, l, r)
+}
+
+/// The constraint a non-constant index pins its element with: the unsigned
+/// range bound as the *first* conjunct, then one implication per element.
+/// Built independently of the pass, so a change to either half shows up as a
+/// tree mismatch rather than as a silently different obligation.
+fn element_def(index: &HTerm, witness: &HTerm, leaves: &[HTerm]) -> HAssert {
+    let extent = i32::try_from(leaves.len()).expect("test extents are small");
+    let cases = leaves
+        .iter()
+        .enumerate()
+        .rev()
+        .fold(HAssert::True, |acc, (case, leaf)| {
+            let case = i32::try_from(case).expect("test extents are small");
+            HAssert::and(
+                imp(
+                    teq(index.clone(), i32c(case)),
+                    teq(witness.clone(), leaf.clone()),
+                ),
+                acc,
+            )
+        });
+    and(nz(ltu(index.clone(), i32c(extent))), cases)
+}
+
+/// A non-constant index binds one witness for the element, defined by the
+/// index's unsigned range and one case per element of the array.
+#[test]
+fn a_non_constant_index_pins_its_element_by_cases() {
+    let body = "forall { let a: [i32; 2] = @; let i: i32 = @; assert(a[i] > 0); }";
+    let definition = element_def(&local(2), &lvar(0), &[local(0), local(1)]);
+    assert_eq!(
+        obligation_of("", body),
+        imp(
+            and(guard(0), and(guard(1), guard(2))),
+            ex(and(definition, nz(gts(lvar(0), i32c(0)))))
+        )
+    );
+}
+
+/// The range bound leads the definition. A reader of a failing goal meets the
+/// condition under which the element is defined before the case analysis that
+/// says which element it is, so the ordering is pinned on its own rather than
+/// only inside a whole-tree compare.
+#[test]
+fn the_range_bound_is_the_first_conjunct_of_the_definition() {
+    let body = "forall { let a: [i32; 3] = @; let i: i32 = @; assert(a[i] > 0); }";
+    let HAssert::Imp(_, consequent) = obligation_of("", body) else {
+        panic!("a body with slot guards states them as an antecedent");
+    };
+    let HAssert::Ex(atom) = *consequent else {
+        panic!("a non-constant index binds a witness");
+    };
+    let HAssert::And(definition, _) = *atom else {
+        panic!("the witness definition is conjoined with the claim");
+    };
+    let HAssert::And(range, _) = *definition else {
+        panic!("the definition is the range bound and the case split");
+    };
+    assert_eq!(*range, nz(ltu(local(3), i32c(3))));
+}
+
+/// The issue's bounded-iteration acceptance shape, end to end through the
+/// translator: an array `@`, an index `@`, a range `assume`, and a claim about
+/// the element at that index. Each of the two reads binds its own witness,
+/// both pinned to the same element.
+#[test]
+fn the_bounded_iteration_idiom_translates() {
+    let body = "forall { let a: [i32; 3] = @; let i: i32 = @; \
+                assume { assert(0 <= i && i < 3); } assert(a[i] == a[i]); }";
+    let leaves = [local(0), local(1), local(2)];
+    // Both witnesses read as de Bruijn index 0 inside their own binder.
+    let definition = || element_def(&local(3), &lvar(0), &leaves);
+    let filter = and(
+        nz(rel(HNumType::I32, HRelop::LeS, i32c(0), local(3))),
+        nz(lts(local(3), i32c(3))),
+    );
+    assert_eq!(
+        obligation_of("", body),
+        imp(
+            and(
+                guard(0),
+                and(guard(1), and(guard(2), and(guard(3), filter)))
+            ),
+            ex(and(
+                definition(),
+                ex(and(definition(), nz(eqs(lvar(1), lvar(0)))))
+            ))
+        )
+    );
+}
+
+/// Constant steps of a chain descend eagerly, so `m[1][j]` splits over the
+/// already-selected row alone — one case per element of that row, not per
+/// element of the matrix.
+#[test]
+fn constant_steps_descend_before_the_non_constant_one() {
+    let body = "forall { let m: [[i32; 2]; 2] = @; let j: i32 = @; assert(m[1][j] > 0); }";
+    let definition = element_def(&local(4), &lvar(0), &[local(2), local(3)]);
+    assert_eq!(
+        obligation_of("", body),
+        imp(
+            and(
+                guard(0),
+                and(guard(1), and(guard(2), and(guard(3), guard(4))))
+            ),
+            ex(and(definition, nz(gts(lvar(0), i32c(0)))))
+        )
+    );
+}
+
+/// A constant step *after* the non-constant one applies inside the split:
+/// `m[i][0]` is one case per row, each case naming that row's first element —
+/// not a split whose result is indexed again.
+#[test]
+fn a_constant_step_after_the_non_constant_one_applies_inside_the_split() {
+    let body = "forall { let m: [[i32; 2]; 2] = @; let i: i32 = @; assert(m[i][0] > 0); }";
+    let definition = element_def(&local(4), &lvar(0), &[local(0), local(2)]);
+    assert_eq!(
+        obligation_of("", body),
+        imp(
+            and(
+                guard(0),
+                and(guard(1), and(guard(2), and(guard(3), guard(4))))
+            ),
+            ex(and(definition, nz(gts(lvar(0), i32c(0)))))
+        )
+    );
+}
+
+/// A struct field selects the array before the index splits it.
+#[test]
+fn a_field_step_precedes_the_non_constant_index() {
+    let prelude = "struct Rec { lo: i32; row: [i32; 2]; }";
+    let body = "forall { let r: Rec = @; let k: i32 = @; assert(r.row[k] > 0); }";
+    let definition = element_def(&local(3), &lvar(0), &[local(1), local(2)]);
+    assert_eq!(
+        obligation_of(prelude, body),
+        imp(
+            and(guard(0), and(guard(1), and(guard(2), guard(3)))),
+            ex(and(definition, nz(gts(lvar(0), i32c(0)))))
+        )
+    );
+}
+
+/// A literal's elements are constants, and a non-constant index over them
+/// splits on those constants — the encoding does not care where a leaf came
+/// from.
+#[test]
+fn a_non_constant_index_reads_a_literal_by_cases() {
+    let body = "forall { let v: [i32; 2] = [7, 8]; let i: i32 = @; assert(v[i] > 0); }";
+    let definition = element_def(&local(0), &lvar(0), &[i32c(7), i32c(8)]);
+    assert_eq!(
+        obligation_of("", body),
+        imp(guard(0), ex(and(definition, nz(gts(lvar(0), i32c(0))))))
+    );
+}
+
+/// Two non-constant indices in one chain are rejected: the split would be the
+/// product of the two extents, and one obligation carries one split per chain.
+#[test]
+fn two_non_constant_indices_in_one_chain_are_rejected() {
+    let src = "spec S { fn f() forall { let m: [[i32; 2]; 2] = @; let i: i32 = @; \
+               let j: i32 = @; assert(m[i][j] > 0); } }";
+    let e = err(src);
+    assert!(e.contains("error[P002]"), "{e}");
+    assert!(
+        e.contains(
+            "an access chain with more than one non-constant index has no assertion encoding: \
+             each non-constant index defines the element by cases, and one obligation supports \
+             one such case split per chain; make all but one index constant, or assert over the \
+             constant-index elements directly"
+        ),
+        "{e}"
+    );
+}
+
+/// A chain that ends on an aggregate is rejected with its own message: a case
+/// split pins one value, and an aggregate element would need one binder per
+/// leaf of the selected sub-tree. The remedy names the shape that works, since
+/// indexing itself does encode and moving the access into a helper would only
+/// meet `P004` on the aggregate argument.
+#[test]
+fn a_non_constant_index_onto_an_aggregate_is_rejected() {
+    let src = "spec S { fn f() forall { let m: [[i32; 2]; 2] = @; let i: i32 = @; \
+               let row: [i32; 2] = m[i]; assert(row[0] > 0); } }";
+    let e = err(src);
+    assert!(e.contains("error[P002]"), "{e}");
+    assert!(
+        e.contains(
+            "an access chain whose non-constant index selects an aggregate has no assertion \
+             encoding: only a scalar leaf can be named by cases, and every candidate element here \
+             would itself be an aggregate — there is no single term to define; index through to a \
+             scalar (`m[i][0]`), or make the index constant"
+        ),
+        "{e}"
+    );
+}
+
+/// The constraint rides into the arm that evaluates the access, exactly like
+/// any other witness constraint: in the right operand of `&&` it joins the
+/// conjunct the source only evaluates when the left one holds.
+#[test]
+fn a_non_constant_index_in_a_conjunction_rides_into_its_arm() {
+    let body = "forall { let a: [i32; 2] = @; let i: i32 = @; assert(i == 0 && a[i] > 0); }";
+    let definition = element_def(&local(2), &lvar(0), &[local(0), local(1)]);
+    assert_eq!(
+        obligation_of("", body),
+        imp(
+            and(guard(0), and(guard(1), guard(2))),
+            ex(and(
+                nz(eqs(local(2), i32c(0))),
+                and(definition, nz(gts(lvar(0), i32c(0))))
+            ))
+        )
+    );
+}
+
+/// The same in the right operand of `||`, where the arm is the one the source
+/// reaches only when the left disjunct fails.
+#[test]
+fn a_non_constant_index_in_a_disjunction_rides_into_its_arm() {
+    let body = "forall { let a: [i32; 2] = @; let i: i32 = @; assert(i > 1 || a[i] > 0); }";
+    let definition = element_def(&local(2), &lvar(0), &[local(0), local(1)]);
+    assert_eq!(
+        obligation_of("", body),
+        imp(
+            and(guard(0), and(guard(1), guard(2))),
+            ex(or(
+                nz(gts(local(2), i32c(1))),
+                and(definition, nz(gts(lvar(0), i32c(0))))
+            ))
+        )
+    );
+}
+
+/// In falsiness position the same movement happens through the De Morgan
+/// dual: negating `x || a[i] > 0` puts the access in the second conjunct.
+#[test]
+fn a_non_constant_index_moves_with_its_arm_in_falsiness_position() {
+    let body = "forall { let a: [i32; 2] = @; let i: i32 = @; assert(!(i > 1 || a[i] > 0)); }";
+    let definition = element_def(&local(2), &lvar(0), &[local(0), local(1)]);
+    assert_eq!(
+        obligation_of("", body),
+        imp(
+            and(guard(0), and(guard(1), guard(2))),
+            ex(and(
+                eqz(gts(local(2), i32c(1))),
+                and(definition, eqz(gts(lvar(0), i32c(0))))
+            ))
+        )
+    );
+}
+
+/// In *both* polarities the definition is **conjoined** with the claim, never
+/// made its antecedent. That is what makes an out-of-range index refute the
+/// atom rather than discharge it vacuously: the range bound is demanded
+/// alongside the claim, so no index outside `0..N` satisfies the existential.
+/// The element is defined only where it exists — a definedness rule, not a
+/// mirror of any runtime check.
+#[test]
+fn an_out_of_range_index_refutes_the_atom_in_both_polarities() {
+    let definition = element_def(&local(2), &lvar(0), &[local(0), local(1)]);
+    let claim_shape = |source_assert: &str, claim: HAssert| {
+        let body = format!("forall {{ let a: [i32; 2] = @; let i: i32 = @; {source_assert} }}");
+        assert_eq!(
+            obligation_of("", &body),
+            imp(
+                and(guard(0), and(guard(1), guard(2))),
+                ex(and(definition.clone(), claim))
+            )
+        );
+    };
+    claim_shape("assert(a[i] > 0);", nz(gts(lvar(0), i32c(0))));
+    claim_shape("assert(!(a[i] > 0));", eqz(gts(lvar(0), i32c(0))));
+}
+
+/// Inside an `assume` block the access translates the same way; the block's
+/// existential statement semantics change what the atom becomes, not how the
+/// element is defined.
+#[test]
+fn a_non_constant_index_under_assume_keeps_its_definition() {
+    let body = "forall { let a: [i32; 2] = @; let i: i32 = @; \
+                assume { assert(a[i] > 0); } assert(i >= 0); }";
+    let definition = element_def(&local(2), &lvar(0), &[local(0), local(1)]);
+    assert_eq!(
+        obligation_of("", body),
+        imp(
+            and(
+                guard(0),
+                and(
+                    guard(1),
+                    and(guard(2), ex(and(definition, nz(gts(lvar(0), i32c(0))))))
+                )
+            ),
+            nz(rel(HNumType::I32, HRelop::GeS, local(2), i32c(0)))
+        )
+    );
+}
+
+/// A pure `let` of an element scopes the witness over the rest of the block,
+/// where the inlined term is read — the `scoped_over_rest` path a
+/// short-circuit witness already takes.
+#[test]
+fn an_element_bound_by_a_pure_let_scopes_over_the_rest() {
+    let body = "forall { let a: [i32; 2] = @; let i: i32 = @; let x: i32 = a[i]; \
+                assert(x > 0); }";
+    let definition = element_def(&local(2), &lvar(0), &[local(0), local(1)]);
+    assert_eq!(
+        obligation_of("", body),
+        imp(
+            and(guard(0), and(guard(1), guard(2))),
+            ex(and(definition, nz(gts(lvar(0), i32c(0)))))
+        )
+    );
+}
+
+/// In an existential context the leaves are logical variables rather than
+/// slots, and the element's own binder takes the level past them.
+#[test]
+fn a_non_constant_index_in_an_exists_block_splits_over_lvar_leaves() {
+    let body = "forall { let n: i32 = @; exists { let a: [i32; 2] = @; let i: i32 = @; \
+                assert(a[i] == n); } }";
+    // Inside the four binders the array's leaves read as indices 3 and 2, the
+    // index variable as 1, and the element's own witness as 0.
+    let definition = element_def(&lvar(1), &lvar(0), &[lvar(3), lvar(2)]);
+    assert_eq!(
+        obligation_of("", body),
+        imp(
+            guard(0),
+            ex(ex(ex(ex(and(definition, teq(lvar(0), local(0)))))))
+        )
+    );
+}
+
+/// The index's own numeric class carries into the range bound and the case
+/// equalities, so a wider index type stays well-typed. (Analysis rule A019
+/// rejects a 64-bit index before this in a real build; this harness runs no
+/// analysis, which is exactly why the translator must still be total here.)
+#[test]
+fn the_index_class_carries_into_the_range_bound() {
+    let body = "forall { let a: [i32; 2] = @; let i: i64 = @; assert(a[i] > 0); }";
+    let index = || local(2);
+    let definition = and(
+        nz(rel(HNumType::I64, HRelop::LtU, index(), i64c(2))),
+        HAssert::and(
+            imp(teq(index(), i64c(0)), teq(lvar(0), local(0))),
+            imp(teq(index(), i64c(1)), teq(lvar(0), local(1))),
+        ),
+    );
+    assert_eq!(
+        obligation_of("", body),
+        imp(
+            and(guard(0), and(guard(1), hastype(local(2), HNumType::I64))),
+            ex(and(definition, nz(gts(lvar(0), i32c(0)))))
+        )
+    );
+}
+
+/// An index carries its own signedness into the comparison the source writes,
+/// while the element's range bound is unsigned whatever the index type is.
+///
+/// Nothing downstream can catch a wrong choice here: the type guard records
+/// only the width, so `u32` and `i32` indices are indistinguishable in the
+/// payload apart from these operator spellings, and the range reasoning is
+/// sound only when the source comparison and the range bound agree about which
+/// values are in range.
+#[test]
+fn an_index_comparison_carries_the_index_types_signedness() {
+    let unsigned = obligation_of(
+        "",
+        "forall { let a: [i32; 2] = @; let i: u32 = @; assert(i > 1 || a[i] > 0); }",
+    );
+    let signed = obligation_of(
+        "",
+        "forall { let a: [i32; 2] = @; let i: i32 = @; assert(i > 1 || a[i] > 0); }",
+    );
+    let element = |guard_of_index: HTerm| {
+        ex(HAssert::or(
+            nz(guard_of_index),
+            and(
+                element_def(&local(2), &lvar(0), &[local(0), local(1)]),
+                nz(gts(lvar(0), i32c(0))),
+            ),
+        ))
+    };
+    assert_eq!(
+        unsigned,
+        imp(
+            and(guard(0), and(guard(1), guard(2))),
+            element(rel(HNumType::I32, HRelop::GtU, local(2), i32c(1)))
+        )
+    );
+    assert_eq!(
+        signed,
+        imp(
+            and(guard(0), and(guard(1), guard(2))),
+            element(gts(local(2), i32c(1)))
+        )
+    );
+}
+
+/// A non-constant index over an aggregate reachability mode already rejected
+/// adds no second message: the sentinel swallows the read, so one mistake
+/// still yields one diagnostic.
+#[test]
+fn a_non_constant_index_on_a_rejected_aggregate_stays_silent() {
+    let src = "spec S { fn f(x: i32) exists { let a: [i32; 2] = @; let i: i32 = @; \
+               assert(a[i] == x); } }";
+    let ctx = type_check(src);
+    let (_, diagnostics) = translate(&ctx);
+    assert_eq!(
+        diagnostics.len(),
+        1,
+        "only the rejected compound `@` may be reported: {diagnostics:?}"
+    );
+    assert!(diagnostics[0].contains("error[P008]"), "{diagnostics:?}");
+}
+
+// ----- 16. quantifier alternation (the nested universal binder) ------------
+
+/// A `@` bound inside a `forall` block adds a `+` over the enclosing
+/// existential witness — the canonical `∃k. ∀x. x + k = x`.
+///
+/// Three things are pinned at once. The `Hall` sits *inside* the `HA_ex`, which
+/// is the whole point: a slot standing in for the inner `forall` would be
+/// quantified by the downstream judgment, outside the existential, and the
+/// alternation would silently swap. The universal variable states its own
+/// typing as an antecedent *within* its binder, because a `T_lvar` names
+/// nothing outside the quantifier that introduced it. And the two contexts
+/// read `==` differently in the same obligation — a witness equation under the
+/// `assume`, a refutable relop under the `assert`.
+#[test]
+fn a_forall_block_inside_an_exists_block_binds_a_universal_variable() {
+    let body = "forall { exists { let k: i32 = @; assume { assert(k == 0); } \
+                forall { let x: i32 = @; assert(x + k == x); } } }";
+    assert_eq!(
+        obligation_of("", body),
+        ex(and(
+            teq(lvar(0), i32c(0)),
+            all(imp(
+                hastype(lvar(0), HNumType::I32),
+                nz(eqs(
+                    bin(HNumType::I32, HBinop::Add, lvar(0), lvar(1)),
+                    lvar(0)
+                ))
+            ))
+        ))
+    );
+}
+
+/// An `assume` block translates existentially even under universal
+/// quantification, so a `forall` nested in one alternates the same way — and
+/// the resulting `Hall` lands in the antecedent the `assume` already builds.
+#[test]
+fn a_forall_block_inside_an_assume_block_alternates_the_same_way() {
+    let body = "forall { let n: i32 = @; assume { forall { let x: i32 = @; assert(x >= x); } } \
+                assert(n >= n); }";
+    assert_eq!(
+        obligation_of("", body),
+        imp(
+            and(
+                guard(0),
+                all(imp(
+                    hastype(lvar(0), HNumType::I32),
+                    nz(ges(lvar(0), lvar(0)))
+                ))
+            ),
+            nz(ges(local(0), local(0)))
+        )
+    );
+}
+
+/// The `if`-branch twin of the block form: the branch block itself carries the
+/// `forall` kind, so the alternation appears inside one arm of the existential
+/// disjunction rather than beside it.
+#[test]
+fn a_forall_if_branch_alternates_under_an_exists_context() {
+    let body = "forall { let n: i32 = @; exists { if n > 0 forall { let x: i32 = @; \
+                assert(x >= x); } } }";
+    let cond = || gts(local(0), i32c(0));
+    assert_eq!(
+        obligation_of("", body),
+        imp(
+            guard(0),
+            or(
+                and(
+                    nz(cond()),
+                    all(imp(
+                        hastype(lvar(0), HNumType::I32),
+                        nz(ges(lvar(0), lvar(0)))
+                    ))
+                ),
+                eqz(cond())
+            )
+        )
+    );
+}
+
+/// An aggregate `@` under the nested quantifier binds one universal variable
+/// per scalar leaf — the Phase-1 leaf machinery on the level channel — so a
+/// two-element array nests two `Hall`s over one shared guard antecedent.
+#[test]
+fn an_aggregate_uzumaki_under_the_nested_quantifier_binds_one_variable_per_leaf() {
+    let body = "forall { exists { let k: i32 = @; assume { assert(k == 0); } \
+                forall { let a: [i32; 2] = @; assert(a[0] == a[1]); } } }";
+    assert_eq!(
+        obligation_of("", body),
+        ex(and(
+            teq(lvar(0), i32c(0)),
+            all(all(imp(
+                and(
+                    hastype(lvar(1), HNumType::I32),
+                    hastype(lvar(0), HNumType::I32)
+                ),
+                nz(eqs(lvar(1), lvar(0)))
+            )))
+        ))
+    );
+}
+
+/// The two binder channels share one level counter, so a block that introduces
+/// both a universal variable and a short-circuit witness must nest them in
+/// allocation order and index every read at its own depth. This is the only
+/// place the universal and existential allocators meet, and the lowering pass's
+/// scope assertion is the only thing that would notice a miscount — loudly, but
+/// only if some test walks the shape.
+#[test]
+fn a_universal_variable_and_a_witness_interleave_in_one_block() {
+    let body = "forall { exists { let k: i32 = @; assume { assert(k == 0); } \
+                forall { let x: i32 = @; let safe: bool = x == 0 || x != 0; \
+                assert(safe); } } }";
+    // Inside the `Hall`: x is index 0, the witness index 0 under its own `HA_ex`
+    // and x becomes index 1 there.
+    let witness_def = or_witness(
+        lvar(0),
+        eqs(lvar(1), i32c(0)),
+        rel(HNumType::I32, HRelop::Ne, lvar(1), i32c(0)),
+    );
+    assert_eq!(
+        obligation_of("", body),
+        ex(and(
+            teq(lvar(0), i32c(0)),
+            all(imp(
+                hastype(lvar(0), HNumType::I32),
+                ex(and(witness_def, nz(lvar(0))))
+            ))
+        ))
+    );
+}
+
+/// A call-argument `@` has no name to bind, so its universal binder wraps the
+/// enclosing statement's atom directly — and carries its typing guard with it,
+/// as an antecedent inside the binder rather than through the guard channel the
+/// named form uses. The channel would drain *around* the statement, where the
+/// variable is no longer bound.
+#[test]
+fn a_call_argument_uzumaki_under_the_nested_quantifier_carries_its_own_guard() {
+    let prelude = "fn sq(n: i32) -> i32 {\n  return n * n;\n}";
+    let body = "forall { exists { let k: i32 = @; assume { assert(k == 0); } \
+                forall { assert(sq(@) >= k); } } }";
+    assert_eq!(
+        obligation_of(prelude, body),
+        ex(and(
+            teq(lvar(0), i32c(0)),
+            all(imp(
+                hastype(lvar(0), HNumType::I32),
+                nz(ges(app("sq", vec![lvar(0)]), lvar(1)))
+            ))
+        ))
+    );
+}
+
+/// The nested universal's typing guard never escapes its binder. Here the
+/// enclosing block continues after the alternation, so the outer drain happens
+/// at a statement the `Hall` does not enclose: what it carries is the *slot*
+/// guard alone, and the logical variable's guard stays inside.
+///
+/// The distinction is not cosmetic. A `T_local` guard is meaningful wherever it
+/// is written; a `T_lvar` guard outside its quantifier names nothing, and the
+/// downstream strictification would collapse it, silently hardening the
+/// obligation.
+#[test]
+fn a_nested_universal_guard_stays_inside_its_binder() {
+    let body = "forall { let n: i32 = @; exists { forall { let x: i32 = @; assert(x >= x); } } \
+                assert(n >= n); }";
+    assert_eq!(
+        obligation_of("", body),
+        imp(
+            guard(0),
+            and(
+                all(imp(
+                    hastype(lvar(0), HNumType::I32),
+                    nz(ges(lvar(0), lvar(0)))
+                )),
+                nz(ges(local(0), local(0)))
+            )
+        )
+    );
+}
+
+/// Statement semantics inside the nested block are universal throughout: an
+/// `assume` becomes the antecedent of what follows, not a conjunct, and it
+/// fuses with the pending typing guard exactly as it does at the top level.
+/// The `assume`'s own body still translates existentially, one level further
+/// in — alternation recurses.
+#[test]
+fn a_nested_forall_reads_assume_as_an_antecedent() {
+    let body = "forall { exists { let k: i32 = @; forall { let x: i32 = @; \
+                assume { assert(x == 1); } assert(x + k == k + 1); } } }";
+    assert_eq!(
+        obligation_of("", body),
+        ex(all(imp(
+            and(hastype(lvar(0), HNumType::I32), teq(lvar(0), i32c(1))),
+            nz(eqs(
+                bin(HNumType::I32, HBinop::Add, lvar(0), lvar(1)),
+                bin(HNumType::I32, HBinop::Add, lvar(1), i32c(1))
+            ))
+        )))
+    );
+}
+
+/// An `if` inside the nested universal block reads with universal statement
+/// semantics — both arms are implications the payload must satisfy — rather
+/// than the existential reading, where the arms are a disjunction of
+/// conjunctions. Nothing else pins which `t_if` arm the new mode takes: both
+/// arms accept it, so routing it to the existential one would compile and leave
+/// every suite green while silently changing the obligation.
+#[test]
+fn an_if_inside_the_nested_universal_block_reads_universally() {
+    let body = "forall { exists { let k: i32 = @; forall { let x: i32 = @; \
+                if x > 0 { assert(k == 1); } else { assert(k == 2); } } } }";
+    assert_eq!(
+        obligation_of("", body),
+        ex(all(imp(
+            hastype(lvar(0), HNumType::I32),
+            and(
+                imp(nz(gts(lvar(0), i32c(0))), nz(eqs(lvar(1), i32c(1)))),
+                imp(
+                    HAssert::eqz(gts(lvar(0), i32c(0))),
+                    nz(eqs(lvar(1), i32c(2)))
+                )
+            )
+        )))
+    );
+}
+
+/// `P007` survives where the lift cannot reach: inside an `exists`/`unique`
+/// body every `@` is a hidden trailing choice parameter the downstream judgment
+/// quantifies operationally, so a universal binder over one would need a
+/// choice-plan and lowering redesign rather than translator work. Both the
+/// block form and the `if`-branch form keep the rejection.
+#[test]
+fn p007_is_kept_for_a_forall_if_branch_in_a_reachability_body() {
+    let src = "spec S { fn f(x: i32) exists { let n: i32 = @; if n > 0 forall { \
+               assert(n > x); } } }";
+    let e = err(src);
+    assert!(e.contains("error[P007]"), "{e}");
+}
+
+/// The surviving `P007` names the quantifier that makes the nesting impossible,
+/// since the identical nesting translates in a `forall`/plain body. Both forms
+/// — the block and the `if` branch — raise the one message, and a `unique` body
+/// names its own word.
+#[test]
+fn p007_names_the_reachability_quantifier_at_both_forms() {
+    let opening = "a `forall` block has no encoding inside an `exists`-quantified spec function";
+    let remedy = "move the universal claim into its own `forall`-bodied spec function";
+
+    let block = err("spec S { fn f() exists { let n: i32 = @; forall { assert(n > 0); } } }");
+    assert!(block.contains(opening) && block.contains(remedy), "{block}");
+
+    let branch_src = "spec S { fn f(x: i32) exists { let n: i32 = @; \
+                      if n > 0 forall { assert(n > x); } } }";
+    let branch = err(branch_src);
+    assert!(
+        branch.contains(opening) && branch.contains(remedy),
+        "{branch}"
+    );
+
+    let unique_opening = "a `forall` block has no encoding inside a `unique`-quantified \
+                          spec function";
+    let unique = err("spec S { fn f() unique { let n: i32 = @; forall { assert(n > 0); } } }");
+    assert!(unique.contains(unique_opening), "{unique}");
+}
+
+/// The nested universal binder is a real `Hall`, never an `HA_ex`. Reading the
+/// binder off the tree rather than comparing the whole obligation keeps this
+/// pinned even if the surrounding shape changes.
+#[test]
+fn the_nested_universal_binder_is_not_an_existential() {
+    let body = "forall { exists { let k: i32 = @; assume { assert(k == 0); } \
+                forall { let x: i32 = @; assert(x >= k); } } }";
+    let HAssert::Ex(outer) = obligation_of("", body) else {
+        panic!("the enclosing `exists` binds the witness");
+    };
+    let HAssert::And(_, inner) = *outer else {
+        panic!("the existential conjoins its filter with the nested claim");
+    };
+    assert!(
+        matches!(*inner, HAssert::All(_)),
+        "the nested `forall` must bind a universal variable, got {inner:?}"
+    );
+}
diff --git a/core/wasm-codegen/src/hassert/translate.rs b/core/wasm-codegen/src/hassert/translate.rs
index 515306f7..dbd638ca 100644
--- a/core/wasm-codegen/src/hassert/translate.rs
+++ b/core/wasm-codegen/src/hassert/translate.rs
@@ -2,10 +2,32 @@
 //!
 //! One [`SpecFnTranslator`] per specification function walks its typed AST and
 //! produces a single [`HAssert`] obligation. The scheme is a right-folded
-//! statement translator with three modes ([`Mode::Univ`]/[`Mode::Exist`]/
-//! [`Mode::Reach`]) and a small term translator that mirrors the WASM operators
-//! code generation emits for the same expressions, so the obligation speaks the
-//! same numeric language as the compiled body it constrains.
+//! statement translator with four modes ([`Mode::Univ`]/[`Mode::UnivLvl`]/
+//! [`Mode::Exist`]/[`Mode::Reach`]) and a small term translator that mirrors the
+//! WASM operators code generation emits for the same expressions, so the
+//! obligation speaks the same numeric language as the compiled body it
+//! constrains.
+//!
+//! ## Alternating quantifiers need a real universal binder
+//!
+//! A `forall` block nested inside an existential context — an `exists` block, an
+//! `assume` block, or a `forall`-kinded `if` branch of one — states a universal
+//! claim *under* an existential one. Its statements read universally, but its
+//! `@`s cannot take quantifier slots: the downstream judgment quantifies every
+//! slot a payload reads, from outside the whole obligation, so a slot here would
+//! be bound outside the enclosing `HA_ex` and `∃x. ∀y. P` would silently become
+//! `∀y. ∃x. P` — a different and weaker property, and the reason this nesting
+//! was rejected before there was a binder to express it.
+//!
+//! [`Mode::UnivLvl`] is that combination: universal statement semantics on the
+//! level channel, wrapped in [`HAssert::All`]. Its typing guards name
+//! [`HTerm::LVar`]s, which is why they must be discharged inside their own
+//! binder — a `T_lvar` written outside its quantifier names nothing, and the
+//! downstream strictification would collapse the guard rather than reject it,
+//! quietly hardening the obligation. Both channels that carry a guard keep it
+//! inside: the named form pushes it through the guard channel, whose `all` wrap
+//! encloses the translation that drains it, while the anonymous call-argument
+//! form carries it on the binder itself.
 //!
 //! ## Reachability bodies read their choices from the frame
 //!
@@ -55,6 +77,61 @@
 //! that introduces no slot is untouched — its antecedent is `⊤`, which
 //! [`HAssert::imp`] absorbs (issue #353).
 //!
+//! ## An aggregate is its ordered scalar leaves
+//!
+//! There is no aggregate *term*. An aggregate introduction — a compound `@`, a
+//! compound parameter, an array or struct literal, a copy of one — is
+//! translated to a shape-preserving tree ([`AggValue`]) whose leaves are
+//! ordinary scalar terms, and every field or constant-index read selects a
+//! child of that tree at translation time. Nothing about the aggregate survives
+//! into the obligation except the leaves the claim actually mentions, and the
+//! guards over all of them.
+//!
+//! **Enumeration order** is arrays row-major and struct fields in
+//! `compute_struct_field_layout` order, recursing — the order the runtime
+//! unrolling of a compound `@` uses, over the shapes both sides support
+//! (arrays of scalars at any rank; structs whose fields are scalars or
+//! one-dimensional scalar arrays). **Allocation order** is parameters first in
+//! declaration order, then each `@` in binding order, one slot per scalar leaf.
+//! Those two rules together fix every `T_local` index in the emitted payload,
+//! and the indices are user-visible the moment a proof fails, so they are part
+//! of the contract rather than an implementation detail.
+//!
+//! In a universal payload a guard is pushed for *every* leaf, including leaves
+//! the claim never reads. The guards are antecedents, so extra ones only weaken
+//! the obligation, and uniformity beats a use analysis that would make the slot
+//! numbering depend on what the body happens to mention. The cost is real and
+//! worth knowing: an N-leaf aggregate puts N guards in front of every
+//! obligation of its function. An existential leaf carries no guard — the
+//! prover chooses the value, so there is no unconstrained valuation to
+//! constrain — and a literal's leaves are constants that neither bind nor
+//! guard.
+//!
+//! A rejected introduction still advances the slot counter — one slot for a
+//! refused non-scalar parameter, the full leaf count for an aggregate over the
+//! budget — so a diagnostic never shifts the slot numbers of the declarations
+//! after it.
+//!
+//! For `fn f() forall { let a: [i32; 3] = @; assert(a[0] <= a[2]); }` that is
+//!
+//! ```text
+//! Himpl (HA_has_type (T_local 0) T_i32 ∧
+//!        HA_has_type (T_local 1) T_i32 ∧
+//!        HA_has_type (T_local 2) T_i32)
+//!       (T_relop ROI_le (T_local 0) (T_local 2) ≠ 0)
+//! ```
+//!
+//! — three slots for the three leaves, guarded together because the guards drain
+//! at the first structural statement, and the claim reading slots 0 and 2 while
+//! slot 1 is quantified and unread.
+//!
+//! (Emitted output is one line; the layout above is this comment's.)
+//!
+//! The size of that expansion is what [`SPEC_FN_MAX_QUANTIFIED_LEAVES`] bounds,
+//! and it is a per-function running total rather than a per-introduction cap,
+//! because the levels of every introduction — guards here, `All` and `Ex`
+//! binders elsewhere — nest into one chain.
+//!
 //! ## Short-circuit `&&`/`||` become pinned witnesses
 //!
 //! The term language is strict: every constructor demands each operand denote,
@@ -86,6 +163,37 @@
 //!
 //! Witnesses are the reason [`HAssert::Ex`] now appears under [`Mode::Univ`]:
 //! before this, a binder could only come from an existential `@`.
+//!
+//! ## A non-constant index defines its element by cases
+//!
+//! An aggregate is translated to its ordered scalar leaves, so a *constant*
+//! index resolves at translation time — the access is simply that leaf's term.
+//! A non-constant index names an element the translation cannot pick, so it
+//! borrows the witness machinery one more time: `a[i]` over an `N`-element
+//! array is a fresh binder `v` pinned by
+//!
+//! ```text
+//! (i <u N) ∧ ⋀_{c<N} Himpl (i = c) (v = leaf c)
+//! ```
+//!
+//! The range bound is the **first** conjunct — a reader of a failing goal
+//! should meet it before the case split — and it is a single *unsigned*
+//! comparison, under which a negative index is a huge value, so no lower bound
+//! is missing rather than merely omitted.
+//!
+//! Out of range the definition is unsatisfiable and the enclosing atom is
+//! refuted. That is a definedness rule, not a mirror of any runtime check
+//! (proof-mode modules emit no bounds check at all): `a[i]` denotes *the
+//! element at index `i`, which exists*, and the constraint saying which element
+//! that is exists only where `i` is in range. The alternative — a guarded
+//! implication that leaves an out-of-range read vacuously satisfied — would
+//! hand back a proof saying nothing about most values of `i`, which is the very
+//! thing [`PCode::P010`] rejects elsewhere.
+//!
+//! Constant steps of an access chain descend eagerly, so `m[1][j]` is a
+//! symbolic read of one already-selected row. A chain with two non-constant
+//! steps is rejected: the split would be their product, and one obligation
+//! carries one such split per chain.
 
 use inference_ast::arena::AstArena;
 use inference_ast::ids::{BlockId, DefId, ExprId, IdentId, StmtId, TypeId};
@@ -104,14 +212,24 @@ use super::reach::ChoicePlan;
 
 /// Polarity of the surrounding quantification.
 ///
-/// The mode decides how `@`, `assume`, `if`, and `==` are encoded. It does
-/// *not* decide whether an `HA_ex` binder can appear: a short-circuit witness
-/// is bound in either mode.
+/// A mode answers two independent questions, which is why the predicates below
+/// exist rather than bare equality tests: how *statements* read (`assume`, `if`
+/// and `==` are universal or existential), and which *channel* a `@` binds
+/// through (a `T_local` slot, a `T_lvar` level, or the frame slot of a planned
+/// choice parameter). Neither answer decides whether an `HA_ex` binder can
+/// appear: a short-circuit witness is bound in every mode.
 #[derive(Clone, Copy, PartialEq, Eq)]
 enum Mode {
     /// Universal context: `assume` filters (antecedent), `if` is a
     /// conjunction of guarded implications, `@` takes a `T_local` slot.
     Univ,
+    /// Universal context nested inside an existential one — a `forall` block
+    /// under an `exists`/`assume` block. Statements read exactly as under
+    /// [`Mode::Univ`], but a `@` binds a *logical variable* wrapped in
+    /// [`HAssert::All`] rather than a slot: the enclosing existential already
+    /// binds levels, and a free slot here would be quantified by the outer
+    /// judgment instead, silently turning `∃x. ∀y` into `∀y. ∃x`.
+    UnivLvl,
     /// Existential context: `assume` constrains the witness (conjunct), `if` is
     /// a strict disjunction of guarded conjunctions, `@` binds an `HA_ex`
     /// logical variable.
@@ -124,6 +242,32 @@ enum Mode {
     Reach,
 }
 
+impl Mode {
+    /// Whether statements read universally: an `assume` block becomes the
+    /// antecedent of what follows, an `if` a conjunction of guarded
+    /// implications, an `==` the refutable `nz (T_relop … eq …)` rather than a
+    /// witness equation. This is also the axis the typing-guard channel follows
+    /// — only a universal payload states the typing of the variables it reads,
+    /// because only it is evaluated over valuations nothing constrains.
+    fn is_universal(self) -> bool {
+        matches!(self, Mode::Univ | Mode::UnivLvl)
+    }
+
+    /// Whether a `@` reads the frame slot of the choice parameter the pre-scan
+    /// planned for it instead of introducing a quantified variable of its own.
+    fn binds_choice_slots(self) -> bool {
+        matches!(self, Mode::Reach)
+    }
+
+    /// Whether a quantified introduction consumes fresh `T_local` slots from
+    /// this function's own counter. True only for [`Mode::Univ`]: the nested
+    /// universal mode binds levels, and a reachability `@` reads a slot the
+    /// pre-scan already assigned rather than allocating one.
+    fn allocates_slots(self) -> bool {
+        matches!(self, Mode::Univ)
+    }
+}
+
 /// The reachability context of the function being translated, present exactly
 /// while its `exists`/`unique` body translates in [`Mode::Reach`].
 struct ReachCtx<'a> {
@@ -147,6 +291,161 @@ enum Binding {
     /// keeps its absolute level, so the term re-indexes correctly wherever it is
     /// later embedded.
     Term(HTerm),
+    /// An aggregate value — a compound `@`, a compound parameter, an
+    /// array/struct literal, or a copy of one — held as its leaf tree.
+    Aggregate(AggValue),
+}
+
+/// Cumulative cap on the quantified scalar leaves one specification function
+/// may introduce, shared by every aggregate introduction (compound `@`s,
+/// compound parameters, and array/struct literals) — [`PCode::P013`] past it.
+///
+/// The resource the cap protects is the assertion-tree depth budget
+/// (`inference_hassert::MAX_TREE_DEPTH`, measured at 255 usable levels): slot
+/// guards nest right-associated one level per leaf and accumulate across *all*
+/// introductions until the first structural statement, so a per-introduction
+/// cap would not bound the resource it names — four introductions of 64 leaves
+/// each would still overrun the encoder. 64 as a per-function total is safe
+/// with roughly half the measured ceiling to spare for the obligation itself,
+/// in universal and existential positions alike. The check must run against
+/// the *type* before any leaf is materialized: the translator keeps going
+/// after a diagnostic, and a materialized many-thousand-node conjunction
+/// overflows the stack in its derived `Drop` — the exact hazard the codec's
+/// `MAX_TREE_DEPTH` documentation names.
+const SPEC_FN_MAX_QUANTIFIED_LEAVES: u32 = 64;
+
+/// A translated aggregate value: the shape-preserving tree whose leaves are
+/// ordinary scalar terms. Arrays hold children in index order (row-major
+/// overall); structs hold `(field_name, child)` in field-layout order — the
+/// declaration order `compute_struct_field_layout` also lays fields out in,
+/// and the same order the runtime `@`-unrolling enumerates for the shapes
+/// both sides support.
+#[derive(Clone, Debug)]
+enum AggValue {
+    /// A scalar leaf's term. The leaf's numeric class lives on the
+    /// [`AggShape`] the introduction materialized from — no reader of a built
+    /// value consumes it, so the value tree does not carry it.
+    Scalar(HTerm),
+    /// An array, children in index order.
+    Array(Vec<AggValue>),
+    /// A struct, `(field_name, child)` in field-layout order.
+    Struct(Vec<(String, AggValue)>),
+    /// Bound in place of a rejected aggregate (out-of-surface shape, leaf
+    /// budget, or a rejected introduction mode): any read at any path resolves
+    /// to a silent zero sentinel without a second diagnostic — one mistake,
+    /// one message.
+    Sentinel,
+}
+
+impl AggValue {
+    /// Appends this value's scalar leaf terms in enumeration order. Returns
+    /// `false` — leaving `out` unreliable — if a [`AggValue::Sentinel`] is
+    /// anywhere in the tree, so the caller can fall silent instead of building
+    /// a claim over an already-diagnosed value.
+    fn collect_leaves(&self, out: &mut Vec<HTerm>) -> bool {
+        match self {
+            AggValue::Scalar(term) => {
+                out.push(term.clone());
+                true
+            }
+            AggValue::Array(children) => children.iter().all(|child| child.collect_leaves(out)),
+            AggValue::Struct(fields) => fields.iter().all(|(_, child)| child.collect_leaves(out)),
+            AggValue::Sentinel => false,
+        }
+    }
+}
+
+/// One step of an access chain, carrying the access expression it was written
+/// as so a rejection points at the step the author can change.
+#[derive(Clone, Copy)]
+enum AccessStep {
+    /// `.name`, read against a struct value.
+    Field { at: ExprId, name: IdentId },
+    /// `[index]`, read against an array value. Whether the index is constant
+    /// is decided when the step is walked, not when the chain is split.
+    Index { at: ExprId, index: ExprId },
+}
+
+/// What an access chain has resolved to partway through.
+///
+/// A chain carries one value until a non-constant index is met; from there it
+/// carries one candidate per element of the indexed array, and every remaining
+/// step applies to all of them. The candidates are siblings of a single
+/// element type, so each later step resolves identically for each — which is
+/// what lets the step decision be taken once, and a bad step report once.
+enum ChainValue {
+    /// No non-constant index yet.
+    One(AggValue),
+    /// One non-constant index taken: its translated term, the numeric class
+    /// that term rides in, and the candidates in index order.
+    Split {
+        index: HTerm,
+        class: HNumType,
+        candidates: Vec<AggValue>,
+    },
+}
+
+impl ChainValue {
+    /// The candidate every step decision is taken against.
+    fn sample(&self) -> &AggValue {
+        match self {
+            ChainValue::One(value) => value,
+            ChainValue::Split { candidates, .. } => candidates
+                .first()
+                .expect("a split carries the elements of a positive-length array"),
+        }
+    }
+
+    /// Applies a decided step to every candidate, keeping the split.
+    fn map(self, select: impl Fn(&AggValue) -> AggValue) -> ChainValue {
+        match self {
+            ChainValue::One(value) => ChainValue::One(select(&value)),
+            ChainValue::Split {
+                index,
+                class,
+                candidates,
+            } => ChainValue::Split {
+                index,
+                class,
+                candidates: candidates.iter().map(select).collect(),
+            },
+        }
+    }
+}
+
+/// The leaf skeleton of a *supported* aggregate type. The supported surface
+/// equals the executable `@` surface (spec aggregate support must not exceed
+/// it while proof mode lowers spec bodies): scalar arrays of any rank, and
+/// flat structs whose fields are scalars or one-dimensional scalar arrays —
+/// exactly the boundary analysis rules A027/A028 keep for the executable
+/// unrolling. Out-of-surface shapes (arrays of structs, structs with struct
+/// or multidimensional-array fields) never get a shape and keep their
+/// pre-existing rejections.
+///
+/// A shape is the unit the leaf budget is checked against: its leaf count is a
+/// product over the type's structure, computable without materializing a
+/// single leaf.
+enum AggShape {
+    /// A scalar leaf at its numeric class.
+    Scalar(HNumType),
+    /// An array of `u32` children of one shape.
+    Array(Box<AggShape>, u32),
+    /// A struct, `(field_name, field_shape)` in field-layout order.
+    Struct(Vec<(String, AggShape)>),
+}
+
+impl AggShape {
+    /// The number of scalar leaves, saturating — the budget check only needs
+    /// "over the cap", and the cap is far below the saturation point.
+    fn leaf_count(&self) -> u32 {
+        match self {
+            AggShape::Scalar(_) => 1,
+            AggShape::Array(elem, len) => elem.leaf_count().saturating_mul(*len),
+            AggShape::Struct(fields) => fields
+                .iter()
+                .fold(0u32, |acc, (_, f)| acc.saturating_add(f.leaf_count())),
+        }
+    }
 }
 
 /// Why a callee cannot serve a specification claim, deciding which diagnostic
@@ -173,18 +472,41 @@ enum ResultClass {
     Compound,
 }
 
+/// Which quantifier wraps a pending binder, and therefore how its definition
+/// attaches to the body it is wrapped around.
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Binder {
+    /// `∃v. (definition ∧ body)` — a short-circuit witness, an element pinned
+    /// by a non-constant index, or a call-argument `@` in an existential
+    /// context. The definition *pins* the variable, so it is a conjunct.
+    Ex,
+    /// `∀v. (definition → body)` — a call-argument `@` under
+    /// [`Mode::UnivLvl`]. Nothing pins a universally quantified value; its
+    /// definition is the typing guard its readers depend on, which is an
+    /// assumption rather than a claim, so it enters as an antecedent. This is
+    /// also what keeps such a guard *inside* its own binder: a `T_lvar` guard
+    /// that escaped its quantifier would name a variable nothing binds.
+    All,
+}
+
+/// One binder allocated but not yet wrapped around the assertion that reads it.
+struct PendingBinder {
+    quant: Binder,
+    definition: HAssert,
+}
+
 /// Pending binders taken off the stack as one group, ready to be wrapped.
 ///
-/// The level of the group's first binder travels with the definitions because
-/// wrapping needs both: the definitions become the `HA_ex` bodies, and the
+/// The level of the group's first binder travels with the binders because
+/// wrapping needs both: the definitions become the quantifier bodies, and the
 /// levels name the variables whose occurrence decides which definitions survive.
 /// Deriving the level at the split — rather than reading `depth` at the wrap —
 /// is what keeps a group correct when binders allocated before it are left
 /// behind for an enclosing wrap.
 struct PendingGroup {
-    /// One definition per binder, in allocation order; the first is outermost.
-    defs: Vec<HAssert>,
-    /// The absolute level of the first binder in `defs`.
+    /// One entry per binder, in allocation order; the first is outermost.
+    binders: Vec<PendingBinder>,
+    /// The absolute level of the first binder in `binders`.
     base_level: u32,
 }
 
@@ -205,14 +527,22 @@ pub(super) struct SpecFnTranslator<'a> {
     /// entry `i` is the *defining constraint* of the binder at level
     /// `depth + i`.
     ///
-    /// A binder nothing pins carries [`HAssert::True`] — a call-argument `@`,
-    /// which the prover chooses freely, or a witness whose constraint moved
-    /// into a conditional arm. Every allocation site drains its own binders
-    /// around its own statement, so this is empty at every statement boundary.
-    pending: Vec<HAssert>,
+    /// A binder nothing pins carries [`HAssert::True`] — an existential
+    /// call-argument `@`, which the prover chooses freely, or a witness whose
+    /// constraint moved into a conditional arm. Every allocation site drains
+    /// its own binders around its own statement, so this is empty at every
+    /// statement boundary.
+    pending: Vec<PendingBinder>,
     /// Typing guards for the universal slots introduced since the last
     /// structural statement, in introduction order, awaiting their drain.
     univ_guards: Vec<HAssert>,
+    /// Running total of quantified scalar leaves this function's aggregate
+    /// introductions have materialized, checked against
+    /// [`SPEC_FN_MAX_QUANTIFIED_LEAVES`] *before* each introduction
+    /// materializes anything. Scalar introductions are deliberately uncounted:
+    /// the cap targets the aggregate amplification, and many-scalar bodies
+    /// keep their pre-existing encoder backstop.
+    leaves_introduced: u32,
     /// The reachability context, `Some` exactly while an `exists`/`unique`
     /// body translates in [`Mode::Reach`].
     reach: Option<ReachCtx<'a>>,
@@ -237,6 +567,7 @@ impl<'a> SpecFnTranslator<'a> {
             depth: 0,
             pending: Vec::new(),
             univ_guards: Vec::new(),
+            leaves_introduced: 0,
             reach: None,
             env: FxHashMap::default(),
             diags: Vec::new(),
@@ -307,46 +638,130 @@ impl<'a> SpecFnTranslator<'a> {
         lower_assert(&raw, 0)
     }
 
-    /// Binds each parameter to a slot in declaration order.
+    /// Binds each parameter in declaration order: a scalar to its slot, a
+    /// supported-shape aggregate to its leaf slots.
     fn bind_parameters(&mut self, args: &[inference_ast::nodes::ArgData], mode: Mode) {
         for arg in args {
             match &arg.kind {
                 ArgKind::Named { name, ty, .. } => {
-                    let slot = self.parameter_slot(arg.location, *ty, mode);
-                    self.env
-                        .insert(self.arena[*name].name.clone(), Binding::Slot(slot));
+                    let param_name = self.arena[*name].name.clone();
+                    let binding = self.parameter_binding(arg.location, *ty, mode, &param_name);
+                    self.env.insert(param_name, binding);
                 }
                 ArgKind::Ignored { ty } => {
-                    let _ = self.parameter_slot(arg.location, *ty, mode);
+                    let _ = self.parameter_binding(arg.location, *ty, mode, "_");
                 }
                 ArgKind::SelfRef { .. } | ArgKind::TypeOnly(_) => {}
             }
         }
     }
 
-    /// Consumes the slot a parameter occupies and, under universal
-    /// quantification, records the typing guard its readers depend on. An
+    /// Consumes the slots a parameter occupies and, under universal
+    /// quantification, records the typing guards its readers depend on. An
     /// ignored parameter is guarded like a named one: the guard is inert for a
-    /// slot the payload never reads, and uniformity beats a use analysis. A
-    /// non-scalar parameter type is [`PCode::P004`]; its slot is still consumed
-    /// so later slot numbers stay aligned with the source, and it contributes
-    /// no guard — it has no numeric typing to state.
+    /// slot the payload never reads, and uniformity beats a use analysis.
+    ///
+    /// A scalar takes one slot. A supported-shape aggregate (scalar arrays of
+    /// any rank; flat structs with scalar or 1-D scalar-array fields) takes
+    /// one slot and one guard per scalar leaf in a universal payload —
+    /// `ValidSpec` evaluates the payload over unconstrained valuations, so
+    /// leaf slots are free names rather than frame locals, and the leaf
+    /// expansion deliberately abandons the one-pointer-local coincidence the
+    /// compiled function keeps. An out-of-surface aggregate, and any
+    /// non-scalar in [`Mode::Reach`], stays [`PCode::P004`]; its single slot
+    /// is still consumed so later slot numbers stay aligned with the source
+    /// (in reachability mode this alignment is load-bearing, not merely tidy:
+    /// the downstream judgment reads choices at `entry_arity + k`, so every
+    /// declared parameter must keep costing exactly one payload slot), and an
+    /// aggregate binds a sentinel so one mistake yields one message.
     ///
     /// A reachability payload pushes no guard for any slot: it denotes against
     /// the frame an actual execution reaches, where every slot already carries
     /// its runtime type, so a stated typing would be dead weight the downstream
     /// exemplars do not carry.
-    fn parameter_slot(&mut self, location: Location, ty: TypeId, mode: Mode) -> u32 {
-        let scalar = self.type_is_scalar(ty);
-        if !scalar {
-            self.error(PCode::P004, location, self.non_scalar_message(ty));
+    fn parameter_binding(
+        &mut self,
+        location: Location,
+        ty: TypeId,
+        mode: Mode,
+        name: &str,
+    ) -> Binding {
+        if self.type_is_scalar(ty) {
+            let slot = self.next_slot();
+            if mode.is_universal() {
+                let width = self.declared_class(ty);
+                self.push_univ_guard(slot, width);
+            }
+            return Binding::Slot(slot);
+        }
+        if !mode.binds_choice_slots()
+            && let Some(shape) = self.agg_shape_of_type(ty)
+        {
+            let count = shape.leaf_count();
+            if self.leaf_budget_exceeded(count) {
+                self.error(
+                    PCode::P013,
+                    location,
+                    format!(
+                        "parameter `{name}` of type `{}` contributes {count} scalar leaves, and \
+                         this specification already quantifies {} of the \
+                         {SPEC_FN_MAX_QUANTIFIED_LEAVES} one function may hold: every leaf \
+                         becomes its own quantified variable with its own typing guard, and the \
+                         assertion encoding caps how deeply one obligation may nest; take the \
+                         components the property reads as scalar parameters instead",
+                        TypeInfo::from_type_id(self.arena, ty),
+                        self.leaves_introduced,
+                    ),
+                );
+                // Counter arithmetic only — nothing is materialized, so later
+                // slot numbers stay source-aligned without a guard chain whose
+                // very depth is the problem being reported.
+                self.slots += count;
+                return Binding::Aggregate(AggValue::Sentinel);
+            }
+            self.leaves_introduced += count;
+            let value = match mode {
+                Mode::Univ => self.univ_agg_value(&shape),
+                Mode::UnivLvl | Mode::Exist | Mode::Reach => unreachable!(
+                    "parameters bind at function entry, whose only modes are universal and \
+                     reachability — the nested universal and existential modes are entered by a \
+                     block, which has no parameters"
+                ),
+            };
+            return Binding::Aggregate(value);
         }
+        let aggregate = self.type_is_aggregate(ty);
+        let message = if aggregate && mode.binds_choice_slots() {
+            self.reach_parameter_message(name, ty)
+        } else {
+            self.non_scalar_message(ty)
+        };
+        self.error(PCode::P004, location, message);
         let slot = self.next_slot();
-        if scalar && mode == Mode::Univ {
-            let width = self.declared_class(ty);
-            self.push_univ_guard(slot, width);
+        if aggregate {
+            Binding::Aggregate(AggValue::Sentinel)
+        } else {
+            Binding::Slot(slot)
         }
-        slot
+    }
+
+    /// The reachability-body [`PCode::P004`] message for a compound parameter.
+    /// A universal payload leaf-expands the same declaration, so the wording
+    /// names the quantifier rather than the type: what rules it out here is
+    /// that the obligation denotes against a frame an actual run reaches, in
+    /// which the parameter is one pointer local.
+    fn reach_parameter_message(&self, name: &str, ty: TypeId) -> String {
+        let kind = self.reach_kind();
+        let article = quantifier_article(kind);
+        let rendered = TypeInfo::from_type_id(self.arena, ty).to_string();
+        format!(
+            "parameter `{name}` of type `{rendered}` cannot appear in {article} \
+             `{kind}`-quantified spec function: its obligation denotes against the frame an \
+             actual run reaches, where a `{rendered}` value is one pointer local; take the \
+             scalar components as separate parameters, or state the property in a \
+             `forall`-bodied spec function, where a compound parameter quantifies one variable \
+             per scalar leaf"
+        )
     }
 
     // ----- statement-list translation -----------------------------------
@@ -414,14 +829,27 @@ impl<'a> SpecFnTranslator<'a> {
                 self.error(
                     PCode::P003,
                     self.arena[stmt_id].location,
-                    "reassignment is not supported in specification bodies; bind a new `let` \
-                     instead"
+                    "reassignment has no place in a specification body: a specification names \
+                     values, not storage — every name stands for one value throughout the \
+                     claim, which is what lets the translation read a name as the same term \
+                     wherever it appears; bind a new `let` for the new value"
                         .to_string(),
                 );
                 self.t_stmts(rest, mode)
             }
             Stmt::Loop { .. } => {
-                self.error_no_encoding(self.arena[stmt_id].location, "`loop`");
+                self.error(
+                    PCode::P002,
+                    self.arena[stmt_id].location,
+                    "`loop` has no encoding in the verification assertion language: a loop \
+                     states a property only through an invariant this translation cannot \
+                     infer, while a specification states the same property directly by \
+                     quantifying; to say something about every element of an aggregate, bind \
+                     it with `@`, bind an index with `@`, constrain the index in an `assume` \
+                     block, and assert the property at that index; to compute a value, move \
+                     the computation into an executable function the spec calls"
+                        .to_string(),
+                );
                 self.t_stmts(rest, mode)
             }
             Stmt::Break => {
@@ -445,11 +873,11 @@ impl<'a> SpecFnTranslator<'a> {
     fn t_structural(&mut self, contribution: HAssert, rest: &[StmtId], mode: Mode) -> HAssert {
         let antecedent = self.drain_guards_over(HAssert::True);
         debug_assert!(
-            mode == Mode::Univ || antecedent == HAssert::True,
+            mode.is_universal() || antecedent == HAssert::True,
             "typing guards pend only under universal quantification: existential translation \
-             introduces no universal slot, and reachability translation deliberately pushes no \
-             guard for any slot (its payload denotes against the real reached frame), so none \
-             can be pending in either mode"
+             pins its variables with defining constraints instead, and reachability translation \
+             deliberately pushes no guard for any slot (its payload denotes against the real \
+             reached frame), so none can be pending in either mode"
         );
         let tail = self.t_stmts(rest, mode);
         HAssert::imp(antecedent, HAssert::and(contribution, tail))
@@ -470,6 +898,21 @@ impl<'a> SpecFnTranslator<'a> {
             .push(HAssert::HasType(HTerm::Local(slot), width));
     }
 
+    /// Records the typing a newly-introduced universal *logical variable*
+    /// depends on ([`Mode::UnivLvl`]).
+    ///
+    /// The guard travels the same channel as a slot's, but unlike a `T_local` —
+    /// which names something wherever it is written — a `T_lvar` is meaningful
+    /// only inside the binder that introduced it. Every caller must therefore
+    /// keep the drain within its own [`HAssert::all`] wrap, which the
+    /// statement-list translation does by construction: the wrap encloses the
+    /// translation of the rest of the block, and that is where the drain
+    /// happens.
+    fn push_lvar_guard(&mut self, level: u32, width: HNumType) {
+        self.univ_guards
+            .push(HAssert::HasType(HTerm::LVar(level), width));
+    }
+
     /// `let` translation. A bare `@` right-hand side binds a slot (universal) or
     /// an existential binder; any other right-hand side is a pure `let`, inlined
     /// as a term.
@@ -488,20 +931,70 @@ impl<'a> SpecFnTranslator<'a> {
         };
 
         if matches!(self.arena[value_expr].kind, Expr::Uzumaki) {
-            let scalar = self.type_is_scalar(ty);
-            if !scalar {
-                self.emit_non_scalar_uzumaki(ty, self.arena[value_expr].location, mode);
-            }
+            return self.t_uzumaki_let(name, ty, value_expr, rest, mode);
+        }
+
+        // Pure aggregate `let`: the right-hand side is a value tree (a
+        // literal, a copy of another aggregate, or a field/element read of
+        // one), bound whole. Value-copy semantics make the pure inlining
+        // exact, so a copy is a clone of the bound tree.
+        if self.type_is_aggregate(ty) {
+            let base = self.pending.len();
+            let value = if self.agg_shape_of_type(ty).is_none() {
+                // An out-of-surface declared type keeps its pre-existing
+                // right-hand-side diagnostics; the sentinel keeps its reads
+                // from stacking further messages onto the same mistake.
+                let _ = self.term(value_expr, mode);
+                AggValue::Sentinel
+            } else {
+                self.agg_value(value_expr, mode)
+            };
+            let group = self.split_pending(base);
+            self.env.insert(name, Binding::Aggregate(value));
+            return self.scoped_over_rest(group, rest, mode);
+        }
+
+        // Pure `let`: translate the right-hand side once, then inline it. A
+        // call-argument `@` or a short-circuit witness in the right-hand side
+        // introduces binders that must scope over the rest of the block, since
+        // that is where the inlined term is read.
+        let base = self.pending.len();
+        let term = self.term(value_expr, mode);
+        let group = self.split_pending(base);
+        self.env.insert(name, Binding::Term(term));
+        self.scoped_over_rest(group, rest, mode)
+    }
+
+    /// `let x: T = @;` — a scalar binds one slot (universal), one existential
+    /// binder, or its choice parameter (reachability); a compound type
+    /// dispatches to the leaf expansion.
+    fn t_uzumaki_let(
+        &mut self,
+        name: String,
+        ty: TypeId,
+        value_expr: ExprId,
+        rest: &[StmtId],
+        mode: Mode,
+    ) -> HAssert {
+        if self.type_is_scalar(ty) {
             return match mode {
                 Mode::Univ => {
                     let slot = self.next_slot();
-                    if scalar {
-                        let width = self.declared_class(ty);
-                        self.push_univ_guard(slot, width);
-                    }
+                    let width = self.declared_class(ty);
+                    self.push_univ_guard(slot, width);
                     self.env.insert(name, Binding::Slot(slot));
                     self.t_stmts(rest, Mode::Univ)
                 }
+                Mode::UnivLvl => {
+                    let level = self.depth;
+                    let width = self.declared_class(ty);
+                    self.push_lvar_guard(level, width);
+                    self.env.insert(name, Binding::Level(level));
+                    self.depth += 1;
+                    let body = self.t_stmts(rest, Mode::UnivLvl);
+                    self.depth -= 1;
+                    HAssert::all(body)
+                }
                 Mode::Exist => {
                     let level = self.depth;
                     self.env.insert(name, Binding::Level(level));
@@ -514,27 +1007,157 @@ impl<'a> SpecFnTranslator<'a> {
                     // The choice already lives in its appended parameter: code
                     // generation normalized the drawn value into the parameter
                     // itself, so the payload reads the same frame slot the
-                    // compiled body binds — no binder, no guard. A non-scalar
-                    // `@` was never planned and already carries its diagnostic
-                    // above, so only the scalar case binds.
-                    if scalar {
-                        let slot = self.choice_slot(value_expr);
-                        self.env.insert(name, Binding::Slot(slot));
-                    }
+                    // compiled body binds — no binder, no guard.
+                    let slot = self.choice_slot(value_expr);
+                    self.env.insert(name, Binding::Slot(slot));
                     self.t_stmts(rest, Mode::Reach)
                 }
             };
         }
+        self.t_compound_uzumaki_let(name, ty, value_expr, rest, mode)
+    }
+
+    /// A compound-type `let … = @;`. A supported shape quantifies one variable
+    /// per scalar leaf (slots under universal quantification, nested `Hall`
+    /// binders under nested-universal, nested `HA_ex` binders under
+    /// existential), subject to the cumulative leaf budget.
+    /// [`Mode::Reach`] keeps its rejection: there a `@` is an operationally
+    /// existential choice parameter shared with the compiled body, arriving as
+    /// one scalar parameter per choice, and an aggregate cannot be represented
+    /// without a choice-plan and lowering redesign.
+    fn t_compound_uzumaki_let(
+        &mut self,
+        name: String,
+        ty: TypeId,
+        value_expr: ExprId,
+        rest: &[StmtId],
+        mode: Mode,
+    ) -> HAssert {
+        if !mode.binds_choice_slots()
+            && let Some(shape) = self.agg_shape_of_type(ty)
+        {
+            let count = shape.leaf_count();
+            if self.leaf_budget_exceeded(count) {
+                self.error(
+                    PCode::P013,
+                    self.arena[value_expr].location,
+                    format!(
+                        "uzumaki (@) over compound type `{}` quantifies {count} scalar leaves, \
+                         and this specification already quantifies {} of the \
+                         {SPEC_FN_MAX_QUANTIFIED_LEAVES} one function may hold: every leaf \
+                         becomes its own quantified variable with its own typing guard, and the \
+                         assertion encoding caps how deeply one obligation may nest; quantify a \
+                         smaller aggregate, or only the components the property actually reads",
+                        TypeInfo::from_type_id(self.arena, ty),
+                        self.leaves_introduced,
+                    ),
+                );
+                if mode.allocates_slots() {
+                    // Counter-only slot advance: source alignment without
+                    // materializing the guard chain being reported.
+                    self.slots += count;
+                }
+                self.env
+                    .insert(name, Binding::Aggregate(AggValue::Sentinel));
+                return self.t_stmts(rest, mode);
+            }
+            self.leaves_introduced += count;
+            return match mode {
+                Mode::Univ => {
+                    let value = self.univ_agg_value(&shape);
+                    self.env.insert(name, Binding::Aggregate(value));
+                    self.t_stmts(rest, Mode::Univ)
+                }
+                Mode::UnivLvl => {
+                    let mut next_level = self.depth;
+                    let value = self.univ_lvl_agg_value(&shape, &mut next_level);
+                    self.env.insert(name, Binding::Aggregate(value));
+                    self.depth += count;
+                    let body = self.t_stmts(rest, Mode::UnivLvl);
+                    self.depth -= count;
+                    (0..count).fold(body, |acc, _| HAssert::all(acc))
+                }
+                Mode::Exist => {
+                    let mut next_level = self.depth;
+                    let value = exist_agg_value(&shape, &mut next_level);
+                    self.env.insert(name, Binding::Aggregate(value));
+                    self.depth += count;
+                    let body = self.t_stmts(rest, Mode::Exist);
+                    self.depth -= count;
+                    (0..count).fold(body, |acc, _| HAssert::ex(acc))
+                }
+                Mode::Reach => unreachable!("excluded above"),
+            };
+        }
+        self.t_rejected_compound_uzumaki_let(name, ty, value_expr, rest, mode)
+    }
 
-        // Pure `let`: translate the right-hand side once, then inline it. A
-        // call-argument `@` or a short-circuit witness in the right-hand side
-        // introduces binders that must scope over the rest of the block, since
-        // that is where the inlined term is read.
-        let base = self.pending.len();
-        let term = self.term(value_expr, mode);
-        let group = self.split_pending(base);
-        self.env.insert(name, Binding::Term(term));
-        self.scoped_over_rest(group, rest, mode)
+    /// The rejected half of a compound `let … = @;`: an out-of-surface compound,
+    /// another non-scalar type, or any of them in reachability mode.
+    ///
+    /// The rejection is raised once and the binding still made, so the rest of
+    /// the block translates against something: an aggregate gets a sentinel
+    /// (its reads resolve silently, keeping one mistake to one message) and
+    /// anything else gets the binding its mode would have given it, so later
+    /// slot numbers and binder levels stay where the source puts them.
+    fn t_rejected_compound_uzumaki_let(
+        &mut self,
+        name: String,
+        ty: TypeId,
+        value_expr: ExprId,
+        rest: &[StmtId],
+        mode: Mode,
+    ) -> HAssert {
+        self.emit_non_scalar_uzumaki(ty, self.arena[value_expr].location, mode);
+        let aggregate = self.type_is_aggregate(ty);
+        match mode {
+            Mode::Univ => {
+                let slot = self.next_slot();
+                let binding = if aggregate {
+                    Binding::Aggregate(AggValue::Sentinel)
+                } else {
+                    Binding::Slot(slot)
+                };
+                self.env.insert(name, binding);
+                self.t_stmts(rest, Mode::Univ)
+            }
+            Mode::UnivLvl => {
+                let level = self.depth;
+                let binding = if aggregate {
+                    Binding::Aggregate(AggValue::Sentinel)
+                } else {
+                    Binding::Level(level)
+                };
+                self.env.insert(name, binding);
+                self.depth += 1;
+                let body = self.t_stmts(rest, Mode::UnivLvl);
+                self.depth -= 1;
+                HAssert::all(body)
+            }
+            Mode::Exist => {
+                let level = self.depth;
+                let binding = if aggregate {
+                    Binding::Aggregate(AggValue::Sentinel)
+                } else {
+                    Binding::Level(level)
+                };
+                self.env.insert(name, binding);
+                self.depth += 1;
+                let body = self.t_stmts(rest, Mode::Exist);
+                self.depth -= 1;
+                HAssert::ex(body)
+            }
+            Mode::Reach => {
+                // A non-scalar `@` was never planned and already carries its
+                // diagnostic above; an aggregate binds the sentinel so its
+                // reads do not cascade.
+                if aggregate {
+                    self.env
+                        .insert(name, Binding::Aggregate(AggValue::Sentinel));
+                }
+                self.t_stmts(rest, Mode::Reach)
+            }
+        }
     }
 
     /// Scopes the binders `defs` introduced by a pure `let` or a `const` over
@@ -551,7 +1174,7 @@ impl<'a> SpecFnTranslator<'a> {
     /// A binding that introduced no binder drains nothing, so a `let` without a
     /// witness keeps the guard pending for the next structural statement.
     fn scoped_over_rest(&mut self, group: PendingGroup, rest: &[StmtId], mode: Mode) -> HAssert {
-        if group.defs.is_empty() {
+        if group.binders.is_empty() {
             return self.t_stmts(rest, mode);
         }
         let antecedent = self.drain_guards_over(HAssert::True);
@@ -568,10 +1191,10 @@ impl<'a> SpecFnTranslator<'a> {
         F: FnOnce(&mut Self) -> HAssert,
     {
         let outer_depth = self.depth;
-        self.depth = group.base_level + level_count(group.defs.len());
+        self.depth = group.base_level + level_count(group.binders.len());
         let body = f(self);
         self.depth = outer_depth;
-        wrap_existentials(body, group)
+        wrap_binders(body, group)
     }
 
     /// A bare `if`, translated to its own contribution alone — the caller folds
@@ -595,10 +1218,10 @@ impl<'a> SpecFnTranslator<'a> {
         let cond = self.term(condition, mode);
         let group = self.split_pending(base);
         self.scoped_under(group, |s| match mode {
-            Mode::Univ => {
-                let then_h = s.scoped_block(then_block, s.branch_mode(then_block, Mode::Univ));
+            Mode::Univ | Mode::UnivLvl => {
+                let then_h = s.scoped_block(then_block, s.branch_mode(then_block, mode));
                 if let Some(else_id) = else_block {
-                    let else_h = s.scoped_block(else_id, s.branch_mode(else_id, Mode::Univ));
+                    let else_h = s.scoped_block(else_id, s.branch_mode(else_id, mode));
                     HAssert::and(
                         HAssert::imp(HAssert::nz(cond.clone()), then_h),
                         HAssert::imp(HAssert::eqz(cond), else_h),
@@ -612,11 +1235,11 @@ impl<'a> SpecFnTranslator<'a> {
             // enclosing mode so a reachability branch keeps reading its choice
             // parameters.
             Mode::Exist | Mode::Reach => {
-                s.check_branch_forall(then_block);
-                let then_h = s.scoped_block(then_block, mode);
+                s.check_branch_forall(then_block, mode);
+                let then_h = s.scoped_block(then_block, s.branch_mode(then_block, mode));
                 if let Some(else_id) = else_block {
-                    s.check_branch_forall(else_id);
-                    let else_h = s.scoped_block(else_id, mode);
+                    s.check_branch_forall(else_id, mode);
+                    let else_h = s.scoped_block(else_id, s.branch_mode(else_id, mode));
                     HAssert::or(
                         HAssert::and(HAssert::nz(cond.clone()), then_h),
                         HAssert::and(HAssert::eqz(cond), else_h),
@@ -647,7 +1270,7 @@ impl<'a> SpecFnTranslator<'a> {
         // translating in reachability mode: its `@`s are choice parameters of
         // the enclosing function (the pre-scan hoisted them), so an
         // existential binder here would name a value the frame already holds.
-        let nested_exist_mode = if mode == Mode::Reach {
+        let nested_exist_mode = if mode.binds_choice_slots() {
             Mode::Reach
         } else {
             Mode::Exist
@@ -656,9 +1279,9 @@ impl<'a> SpecFnTranslator<'a> {
             BlockKind::Assume => {
                 let body = self.scoped_block(block_id, nested_exist_mode);
                 match mode {
-                    Mode::Univ => {
+                    Mode::Univ | Mode::UnivLvl => {
                         let antecedent = self.drain_guards_over(body);
-                        HAssert::imp(antecedent, self.t_stmts(rest, Mode::Univ))
+                        HAssert::imp(antecedent, self.t_stmts(rest, mode))
                     }
                     Mode::Exist | Mode::Reach => HAssert::and(body, self.t_stmts(rest, mode)),
                 }
@@ -668,16 +1291,16 @@ impl<'a> SpecFnTranslator<'a> {
                 self.t_structural(body, rest, mode)
             }
             BlockKind::Forall => {
-                if matches!(mode, Mode::Exist | Mode::Reach) {
-                    self.error(
-                        PCode::P007,
-                        self.arena[block_id].location,
-                        "a `forall` block inside an `exists` block is not yet supported in \
-                         assertion emission"
-                            .to_string(),
-                    );
+                if mode.binds_choice_slots() {
+                    self.error_reach_forall(self.arena[block_id].location);
                 }
-                let body = self.scoped_block(block_id, mode);
+                // Under an existential context the nested block is the
+                // alternation itself: its statements read universally while its
+                // `@`s bind logical variables, so the claim comes back as a
+                // `Hall` the enclosing `HA_ex` encloses — the one shape a free
+                // slot could not express, since the outer judgment would
+                // quantify it and swap the two quantifiers.
+                let body = self.scoped_block(block_id, self.branch_mode(block_id, mode));
                 self.t_structural(body, rest, mode)
             }
             BlockKind::Exists => {
@@ -719,11 +1342,28 @@ impl<'a> SpecFnTranslator<'a> {
     /// binders in its initializer scope over the rest of the block, where the
     /// inlined term is read.
     fn bind_const(&mut self, def_id: DefId, rest: &[StmtId], mode: Mode) -> HAssert {
-        let Def::Constant { name, value, .. } = &self.arena[def_id].kind else {
+        let Def::Constant {
+            name, value, ty, ..
+        } = &self.arena[def_id].kind
+        else {
             return self.t_stmts(rest, mode);
         };
-        let (name, value) = (*name, *value);
+        let (name, value, ty) = (*name, *value, *ty);
         let base = self.pending.len();
+        // An aggregate `const` binds a value tree exactly like an aggregate
+        // pure `let`.
+        if self.type_is_aggregate(ty) {
+            let agg = if self.agg_shape_of_type(ty).is_none() {
+                let _ = self.term(value, mode);
+                AggValue::Sentinel
+            } else {
+                self.agg_value(value, mode)
+            };
+            let group = self.split_pending(base);
+            self.env
+                .insert(self.arena[name].name.clone(), Binding::Aggregate(agg));
+            return self.scoped_over_rest(group, rest, mode);
+        }
         let term = self.term(value, mode);
         let group = self.split_pending(base);
         self.env
@@ -820,14 +1460,30 @@ impl<'a> SpecFnTranslator<'a> {
                 let (right_h, right_defs) = self.capture_definitions(|s| s.n_expr(right, mode));
                 return HAssert::and(left_h, HAssert::and(right_defs, right_h));
             }
+            // A negated aggregate comparison flips to its leafwise dual; the
+            // generic atom below would demand the aggregate as a single term.
+            Expr::Binary {
+                left,
+                right,
+                op: op @ (OperatorKind::Eq | OperatorKind::Ne),
+            } if self.expr_is_aggregate(*left) || self.expr_is_aggregate(*right) => {
+                let (left, right) = (*left, *right);
+                let negated = matches!(op, OperatorKind::Eq);
+                return self.aggregate_comparison(left, right, negated, mode);
+            }
             _ => {}
         }
         // Atom: the strict positive zero-equality.
         HAssert::eqz(self.term(expr, mode))
     }
 
-    /// A comparison in assertion position. `==` is the one operator whose
-    /// encoding depends on the mode: strict `term_eq` on the existential and
+    /// A comparison in assertion position. An aggregate `==`/`!=` leaves
+    /// first, through [`Self::aggregate_comparison`], which is leafwise
+    /// `term_eq` in every mode; the mode dispatch below governs *scalar*
+    /// comparison alone.
+    ///
+    /// Among scalar comparisons, `==` is the one operator whose encoding
+    /// depends on the mode: strict `term_eq` on the existential and
     /// reachability paths, `nz(relop)` under universal quantification — which
     /// the verifier's strictified reading makes just as strict (a non-denoting relop refutes
     /// the obligation rather than discharging it, which is what the slot
@@ -839,6 +1495,32 @@ impl<'a> SpecFnTranslator<'a> {
     /// (`Assertions.ktrue`) under which a negated equality already demands that
     /// both sides denote, so the definedness a disequality needs comes from the
     /// relop itself rather than from an emitted conjunct.
+    ///
+    /// That leaves scalar `!=` in a relop where scalar `==` is in a `term_eq`,
+    /// and the asymmetry is kept deliberately rather than by omission. A
+    /// downstream proof pays for it — one that assumes `a[0] != 3` and concludes
+    /// over a leafwise aggregate disequality has to bridge "the `ne` relop is
+    /// nonzero" to "these values differ" — and matching `!=` to `term_eq` would
+    /// remove that step.
+    ///
+    /// The rule that keeps it is **positional, not operator-wise**. The
+    /// existential and reachability modes are the positions that *pin* a value:
+    /// an existential `@`'s witness, and — since an `assume` body translates in
+    /// [`Mode::Exist`] even inside a universal function — the antecedent of a
+    /// universal claim. `term_eq` is the pinning form, so `==` takes it there
+    /// and the refutable relop in a claim position, which is exactly why the
+    /// same operator flips between the two. `!=` never pins anything: there is
+    /// no value it names, only a computation whose result must be nonzero, so it
+    /// stays with the operator the program executes, at that operator's own
+    /// width and signedness. Encoding it as `¬term_eq` would state a
+    /// disequality of mathematical values where the program compares two i32
+    /// registers — the same class of divergence the eager `&&`/`||` term had.
+    ///
+    /// The aggregate arm above is not an exception to that rule but a different
+    /// question answered by the language: `==` at aggregate type compares
+    /// *values*, and an aggregate's value is its ordered scalar leaves, so it is
+    /// leafwise in every mode. The compiled comparison of frame pointers is the
+    /// side that must change, tracked separately.
     fn p_comparison(
         &mut self,
         left: ExprId,
@@ -846,12 +1528,22 @@ impl<'a> SpecFnTranslator<'a> {
         op: &OperatorKind,
         mode: Mode,
     ) -> HAssert {
+        if matches!(op, OperatorKind::Eq | OperatorKind::Ne)
+            && (self.expr_is_aggregate(left) || self.expr_is_aggregate(right))
+        {
+            let negated = matches!(op, OperatorKind::Ne);
+            return self.aggregate_comparison(left, right, negated, mode);
+        }
         let (num_ty, unsigned) = self.operand_class(left);
         let ta = self.term(left, mode);
         let tb = self.term(right, mode);
         match op {
             OperatorKind::Eq => match mode {
-                Mode::Univ => HAssert::nz(relop(num_ty, HRelop::Eq, ta, tb)),
+                // Both universal modes take the refutable relop reading; only
+                // the binder channel differs between them, and an `==` reads no
+                // binder. Folding either into the existential arm would flip
+                // the polarity of every equality in a universal claim.
+                Mode::Univ | Mode::UnivLvl => HAssert::nz(relop(num_ty, HRelop::Eq, ta, tb)),
                 Mode::Exist | Mode::Reach => HAssert::TermEq(ta, tb),
             },
             OperatorKind::Ne => HAssert::nz(relop(num_ty, HRelop::Ne, ta, tb)),
@@ -909,13 +1601,21 @@ impl<'a> SpecFnTranslator<'a> {
                 );
                 zero_sentinel()
             }
-            Expr::ArrayIndexAccess { .. } => {
-                self.error_no_encoding(self.arena[expr].location, "array indexing");
-                zero_sentinel()
-            }
-            Expr::MemberAccess { .. } => {
-                self.error_no_encoding(self.arena[expr].location, "struct field access");
-                zero_sentinel()
+            Expr::ArrayIndexAccess { .. } | Expr::MemberAccess { .. } => {
+                // A scalar read out of an aggregate: resolve the access chain
+                // against the value tree and take the leaf's term.
+                match self.agg_value(expr, mode) {
+                    AggValue::Scalar(term) => term,
+                    AggValue::Sentinel => zero_sentinel(),
+                    AggValue::Array(_) | AggValue::Struct(_) => {
+                        // An aggregate-valued access read in scalar term
+                        // position — ill-typed source the checker rejects
+                        // before translation; kept as a diagnostic rather
+                        // than an invariant so a checker gap degrades softly.
+                        self.error_non_scalar_expr(expr);
+                        zero_sentinel()
+                    }
+                }
             }
             Expr::StructLiteral { .. } => {
                 self.error_no_encoding(self.arena[expr].location, "a struct literal");
@@ -933,9 +1633,7 @@ impl<'a> SpecFnTranslator<'a> {
                 self.error(
                     PCode::P004,
                     self.arena[expr].location,
-                    "type `unit` cannot appear in a specification term; only bool, integer, \
-                     and enum values can"
-                        .to_string(),
+                    non_scalar_term_message(&"unit"),
                 );
                 zero_sentinel()
             }
@@ -965,10 +1663,7 @@ impl<'a> SpecFnTranslator<'a> {
                 self.error(
                     PCode::P004,
                     self.arena[expr].location,
-                    format!(
-                        "type `{other}` cannot appear in a specification term; only bool, \
-                         integer, and enum values can"
-                    ),
+                    non_scalar_term_message(&other),
                 );
                 zero_sentinel()
             }
@@ -994,9 +1689,7 @@ impl<'a> SpecFnTranslator<'a> {
             self.error(
                 PCode::P004,
                 self.arena[expr].location,
-                "type of this value cannot appear in a specification term; only bool, integer, \
-                 and enum values can"
-                    .to_string(),
+                unknown_type_term_message(),
             );
             zero_sentinel()
         }
@@ -1004,26 +1697,19 @@ impl<'a> SpecFnTranslator<'a> {
 
     /// An identifier, resolved through the environment. A universal slot becomes
     /// `T_local`; an existential variable becomes `T_lvar` at its level (finalized
-    /// later); a pure `let` inlines its stored term.
+    /// later); a pure `let` inlines its stored term. An aggregate binding read
+    /// whole in scalar term position is rejected — an aggregate is not a term —
+    /// except for the sentinel of an already-rejected aggregate, which stays
+    /// silent so one mistake yields one message.
     fn identifier(&mut self, expr: ExprId, ident_id: IdentId) -> HTerm {
         let name = &self.arena[ident_id].name;
         match self.env.get(name) {
             Some(Binding::Slot(n)) => HTerm::Local(*n),
             Some(Binding::Level(level)) => HTerm::LVar(*level),
-            Some(Binding::Term(term)) => term.clone(),
-            None => {
-                let rendered = self
-                    .ctx
-                    .get_node_typeinfo(node_expr(expr))
-                    .map_or_else(|| "this value".to_string(), |t| t.to_string());
-                self.error(
-                    PCode::P004,
-                    self.arena[expr].location,
-                    format!(
-                        "type `{rendered}` cannot appear in a specification term; only bool, \
-                         integer, and enum values can"
-                    ),
-                );
+            Some(Binding::Term(term) | Binding::Aggregate(AggValue::Scalar(term))) => term.clone(),
+            Some(Binding::Aggregate(AggValue::Sentinel)) => zero_sentinel(),
+            Some(Binding::Aggregate(_)) | None => {
+                self.error_non_scalar_expr(expr);
                 zero_sentinel()
             }
         }
@@ -1250,14 +1936,15 @@ impl<'a> SpecFnTranslator<'a> {
     }
 
     /// A `@` in call-argument position: an anonymous universal slot, a pending
-    /// existential binder to be wrapped around the enclosing statement, or —
-    /// in a reachability body — the choice parameter the pre-scan planned for
-    /// it. An anonymous slot has no declared type, so its guard width comes
-    /// from the type recorded for the argument.
+    /// binder (universal or existential, per the context) to be wrapped around
+    /// the enclosing statement, or — in a reachability body — the choice
+    /// parameter the pre-scan planned for it. An anonymous `@` has no declared
+    /// type, so its guard width comes from the type recorded for the argument.
     ///
     /// Unlike a short-circuit witness, this binder carries no defining
-    /// constraint: `@` *is* the prover's free choice, so pinning it to a value
-    /// would be the opposite of what it means.
+    /// constraint: `@` *is* the free choice, so pinning it to a value would be
+    /// the opposite of what it means. A nested-universal binder still carries
+    /// its typing guard, which assumes rather than pins.
     ///
     /// A reachability body reads the raw choice parameter: code generation
     /// normalizes an anonymous narrow choice at its use site, not in the
@@ -1276,6 +1963,10 @@ impl<'a> SpecFnTranslator<'a> {
                 self.push_univ_guard(slot, width);
                 HTerm::Local(slot)
             }
+            Mode::UnivLvl => {
+                let width = self.expr_class(arg);
+                self.bind_universal(width)
+            }
             Mode::Exist => self.bind_witness(|_| HAssert::True),
             Mode::Reach => {
                 let (planned, unique) = {
@@ -1483,7 +2174,7 @@ impl<'a> SpecFnTranslator<'a> {
         let base = self.pending.len();
         let atom = f(self);
         let group = self.split_pending(base);
-        wrap_existentials(atom, group)
+        wrap_binders(atom, group)
     }
 
     /// Translates a block's statements as a fresh environment scope, so a
@@ -1501,26 +2192,34 @@ impl<'a> SpecFnTranslator<'a> {
         result
     }
 
-    /// The translation mode of an `if` branch: existential when the branch block
-    /// is an `exists` block, otherwise the enclosing mode.
+    /// The translation mode of a nested block — an `if` branch or a block
+    /// statement — from the block's own kind and the enclosing mode: an
+    /// `exists` block translates existentially, a `forall` block inside an
+    /// existential context translates in the nested universal mode, and every
+    /// other block inherits the enclosing mode.
+    ///
+    /// A reachability body is the exception on both counts and keeps its own
+    /// mode throughout: its `@`s are choice parameters the enclosing function
+    /// already planned, so neither a fresh existential binder nor a universal
+    /// one can name them.
     fn branch_mode(&self, block_id: BlockId, outer: Mode) -> Mode {
+        if outer.binds_choice_slots() {
+            return outer;
+        }
         match self.arena[block_id].block_kind {
             BlockKind::Exists => Mode::Exist,
+            BlockKind::Forall if outer == Mode::Exist => Mode::UnivLvl,
             _ => outer,
         }
     }
 
-    /// Records [`PCode::P007`] when an existential `if` branch is a `forall`
-    /// block, which needs a `Hall` over logical variables (deferred).
-    fn check_branch_forall(&mut self, block_id: BlockId) {
-        if self.arena[block_id].block_kind == BlockKind::Forall {
-            self.error(
-                PCode::P007,
-                self.arena[block_id].location,
-                "a `forall` block inside an `exists` block is not yet supported in assertion \
-                 emission"
-                    .to_string(),
-            );
+    /// Records [`PCode::P007`] when a `forall` `if` branch appears inside a
+    /// reachability body, where a universal binder over an operationally
+    /// quantified choice has no representation. Under an ordinary existential
+    /// context the branch translates instead, in [`Mode::UnivLvl`].
+    fn check_branch_forall(&mut self, block_id: BlockId, mode: Mode) {
+        if mode.binds_choice_slots() && self.arena[block_id].block_kind == BlockKind::Forall {
+            self.error_reach_forall(self.arena[block_id].location);
         }
     }
 
@@ -1528,13 +2227,19 @@ impl<'a> SpecFnTranslator<'a> {
     /// as `lower_binary_expression` reads the left operand's.
     fn operand_class(&self, expr: ExprId) -> (HNumType, bool) {
         let kind = self.ctx.get_node_typeinfo(node_expr(expr)).map(|t| t.kind);
-        let unsigned = matches!(
-            kind,
-            Some(TypeInfoKind::Number(
-                NumberType::U8 | NumberType::U16 | NumberType::U32 | NumberType::U64
-            ))
-        );
-        (num_class(kind.as_ref()), unsigned)
+        (num_class(kind.as_ref()), kind_is_unsigned(kind.as_ref()))
+    }
+
+    /// Whether an expression's recorded type is an unsigned number. An
+    /// expression the checker left untyped reads signed, the same latitude
+    /// [`Self::operand_class`] takes for its number class.
+    fn expr_is_unsigned(&self, expr: ExprId) -> bool {
+        kind_is_unsigned(
+            self.ctx
+                .get_node_typeinfo(node_expr(expr))
+                .map(|t| t.kind)
+                .as_ref(),
+        )
     }
 
     /// The number class of an expression, defaulting to i32 with the same
@@ -1556,75 +2261,836 @@ impl<'a> SpecFnTranslator<'a> {
     /// Whether a declared type is a scalar the term language can represent (a
     /// bool, an integer, or an enum).
     fn type_is_scalar(&self, ty: TypeId) -> bool {
-        match TypeInfo::from_type_id(self.arena, ty).kind {
-            TypeInfoKind::Bool | TypeInfoKind::Number(_) => true,
-            TypeInfoKind::Custom(name) => {
-                self.ctx.lookup_enum_in(&name, self.module_path).is_some()
-            }
+        self.kind_is_scalar_in(
+            &TypeInfo::from_type_id(self.arena, ty).kind,
+            self.module_path,
+        )
+    }
+
+    /// Whether a type kind is a scalar as referenced from the file whose
+    /// module path is `module_path` — the resolution scope matters because a
+    /// bare enum name resolves relative to its referencing file, and a struct
+    /// *field's* type resolves relative to the struct's defining file.
+    fn kind_is_scalar_in(&self, kind: &TypeInfoKind, module_path: &[String]) -> bool {
+        match kind {
+            TypeInfoKind::Bool | TypeInfoKind::Number(_) | TypeInfoKind::Enum(_, _) => true,
+            TypeInfoKind::Custom(name) => self.ctx.lookup_enum_in(name, module_path).is_some(),
             TypeInfoKind::Qualified(path) => {
                 let segments: Vec<String> = path.split("::").map(str::to_string).collect();
-                self.ctx.qualified_path_is_enum(&segments, self.module_path)
+                self.ctx.qualified_path_is_enum(&segments, module_path)
             }
             _ => false,
         }
     }
 
-    /// Renders the diagnostic message for a non-scalar type in term/parameter
-    /// position.
-    fn non_scalar_message(&self, ty: TypeId) -> String {
-        format!(
-            "type `{}` cannot appear in a specification term; only bool, integer, and enum \
-             values can",
-            TypeInfo::from_type_id(self.arena, ty)
-        )
+    /// Whether a declared type spells an aggregate (an array or a struct),
+    /// supported shape or not.
+    fn type_is_aggregate(&self, ty: TypeId) -> bool {
+        self.kind_is_aggregate(&TypeInfo::from_type_id(self.arena, ty).kind)
     }
 
-    /// Emits the right diagnostic for a `@` at a non-scalar type: [`PCode::P008`]
-    /// for a compound (array/struct) type, [`PCode::P004`] otherwise. The
-    /// `P008` wording is mode-aware — in a reachability body the reason a
-    /// compound `@` is impossible is different (a choice arrives as one scalar
-    /// parameter), and the universal wording stays byte-identical.
-    fn emit_non_scalar_uzumaki(&mut self, ty: TypeId, location: Location, mode: Mode) {
-        let type_info = TypeInfo::from_type_id(self.arena, ty);
-        let compound = match &type_info.kind {
-            TypeInfoKind::Array(_, _) => true,
+    /// Whether an expression's recorded type is an aggregate.
+    fn expr_is_aggregate(&self, expr: ExprId) -> bool {
+        self.ctx
+            .get_node_typeinfo(node_expr(expr))
+            .is_some_and(|t| self.kind_is_aggregate(&t.kind))
+    }
+
+    /// Whether a type kind is an aggregate under any of its spellings —
+    /// `Array`, resolved `Struct`, or a `Custom`/`Qualified` name that
+    /// resolves to a struct. Spelling-total on purpose: a cross-module struct
+    /// type must classify exactly like an unqualified one.
+    fn kind_is_aggregate(&self, kind: &TypeInfoKind) -> bool {
+        match kind {
+            TypeInfoKind::Array(_, _) | TypeInfoKind::Struct(_, _) => true,
+            _ => self.struct_info_of_kind(kind).is_some(),
+        }
+    }
+
+    /// Resolves a type kind to the struct it names, across every spelling a
+    /// struct type reaches this pass under: a resolved `Struct` by its
+    /// canonical key, a bare `Custom` name relative to the current file, and a
+    /// `::`-qualified path walked from the current file. A name that resolves
+    /// to an enum is a scalar, never a struct.
+    fn struct_info_of_kind(
+        &self,
+        kind: &TypeInfoKind,
+    ) -> Option<inference_type_checker::StructInfo> {
+        match kind {
+            TypeInfoKind::Struct(_, key) => self.ctx.lookup_struct(key),
             TypeInfoKind::Custom(name) => {
-                self.ctx.lookup_struct_in(name, self.module_path).is_some()
+                if self.ctx.lookup_enum_in(name, self.module_path).is_some() {
+                    return None;
+                }
+                self.ctx.lookup_struct_in(name, self.module_path)
             }
-            _ => false,
-        };
-        if compound {
-            let message = if mode == Mode::Reach {
-                format!(
-                    "uzumaki (@) over compound type `{type_info}` cannot be a reachability \
-                     choice: a choice arrives as one scalar WASM parameter, and a value of type \
-                     `{type_info}` lives in linear memory; quantify its scalar components \
-                     individually"
-                )
-            } else {
-                format!(
-                    "uzumaki (@) over compound type `{type_info}` has no assertion encoding; \
-                     quantify scalar components individually"
+            TypeInfoKind::Qualified(path) => {
+                let segments: Vec<String> = path.split("::").map(str::to_string).collect();
+                if self.ctx.qualified_path_is_enum(&segments, self.module_path) {
+                    return None;
+                }
+                self.ctx
+                    .lookup_struct_by_qualified_path(&segments, self.module_path)
+            }
+            _ => None,
+        }
+    }
+
+    /// The leaf skeleton of a declared type, when it is in the supported
+    /// aggregate surface — `None` for scalars and for out-of-surface shapes.
+    fn agg_shape_of_type(&self, ty: TypeId) -> Option<AggShape> {
+        self.agg_shape_of_kind(&TypeInfo::from_type_id(self.arena, ty).kind)
+    }
+
+    /// The leaf skeleton of a type kind, when it is in the supported aggregate
+    /// surface: a scalar array of any rank, or a flat struct whose fields are
+    /// scalars or 1-D scalar arrays — the same boundary analysis rules
+    /// A027/A028 keep for the executable `@` unrolling, so the specification
+    /// surface never exceeds the executable one.
+    ///
+    /// A zero-leaf shape (a field-less struct, a zero-length array) reports as
+    /// out-of-surface rather than as an empty leaf list: the ⊤-absorbing
+    /// constructors would silently collapse an empty introduction into a
+    /// vacuous obligation, and A045 / the positive-array-length rule exclude
+    /// those types from the executable surface anyway.
+    fn agg_shape_of_kind(&self, kind: &TypeInfoKind) -> Option<AggShape> {
+        let shape = if let TypeInfoKind::Array(elem, len) = kind {
+            AggShape::Array(Box::new(self.scalar_array_shape(&elem.kind)?), *len)
+        } else {
+            let info = self.struct_info_of_kind(kind)?;
+            self.flat_struct_shape(&info)?
+        };
+        (shape.leaf_count() > 0).then_some(shape)
+    }
+
+    /// The shape of a scalar array's element: scalar leaves at any rank; an
+    /// element that is (or contains) a struct is out of the surface (A028).
+    fn scalar_array_shape(&self, kind: &TypeInfoKind) -> Option<AggShape> {
+        match kind {
+            TypeInfoKind::Array(elem, len) => Some(AggShape::Array(
+                Box::new(self.scalar_array_shape(&elem.kind)?),
+                *len,
+            )),
+            _ if self.kind_is_scalar_in(kind, self.module_path) => {
+                Some(AggShape::Scalar(num_class(Some(kind))))
+            }
+            _ => None,
+        }
+    }
+
+    /// The shape of a flat struct: fields in declaration order — the order
+    /// `compute_struct_field_layout` also lays them out in, and the order the
+    /// runtime unrolling enumerates — each a scalar or a 1-D scalar array.
+    /// Field types resolve relative to the struct's *defining* file, exactly
+    /// as the layout computation resolves them (#63). A struct field or a
+    /// multidimensional-array field puts the whole struct out of the surface
+    /// (A027).
+    fn flat_struct_shape(&self, info: &inference_type_checker::StructInfo) -> Option<AggShape> {
+        let defining = self.ctx.module_path_of_scope(info.definition_scope_id);
+        let mut fields = Vec::with_capacity(info.fields.len());
+        for field in &info.fields {
+            let kind = &field.type_info.kind;
+            let shape = if self.kind_is_scalar_in(kind, &defining) {
+                AggShape::Scalar(num_class(Some(kind)))
+            } else if let TypeInfoKind::Array(elem, len) = kind
+                && self.kind_is_scalar_in(&elem.kind, &defining)
+            {
+                AggShape::Array(
+                    Box::new(AggShape::Scalar(num_class(Some(&elem.kind)))),
+                    *len,
                 )
+            } else {
+                return None;
             };
-            self.error(PCode::P008, location, message);
-        } else {
+            fields.push((field.name.clone(), shape));
+        }
+        Some(AggShape::Struct(fields))
+    }
+
+    /// Whether admitting `count` more quantified leaves would overrun the
+    /// per-function budget. Checked before anything is materialized.
+    fn leaf_budget_exceeded(&self, count: u32) -> bool {
+        debug_assert!(
+            count > 0,
+            "zero-leaf aggregates are out of the supported surface (A045 rejects field-less \
+             structs as value types; array lengths are positive), so an introduction always \
+             brings at least one leaf"
+        );
+        self.leaves_introduced.saturating_add(count) > SPEC_FN_MAX_QUANTIFIED_LEAVES
+    }
+
+    /// Materializes a universal aggregate introduction: one fresh slot and one
+    /// typing guard per scalar leaf, in enumeration order.
+    fn univ_agg_value(&mut self, shape: &AggShape) -> AggValue {
+        match shape {
+            AggShape::Scalar(width) => {
+                let slot = self.next_slot();
+                self.push_univ_guard(slot, *width);
+                AggValue::Scalar(HTerm::Local(slot))
+            }
+            AggShape::Array(elem, len) => {
+                AggValue::Array((0..*len).map(|_| self.univ_agg_value(elem)).collect())
+            }
+            AggShape::Struct(fields) => AggValue::Struct(
+                fields
+                    .iter()
+                    .map(|(name, field)| (name.clone(), self.univ_agg_value(field)))
+                    .collect(),
+            ),
+        }
+    }
+
+    /// Materializes a nested-universal aggregate introduction: consecutive
+    /// absolute binder levels from `*next_level`, one per scalar leaf in
+    /// enumeration order, each with the typing guard its readers depend on.
+    ///
+    /// The guards go through the pending channel, so the caller's
+    /// [`HAssert::all`] wraps must enclose the translation that drains them.
+    fn univ_lvl_agg_value(&mut self, shape: &AggShape, next_level: &mut u32) -> AggValue {
+        match shape {
+            AggShape::Scalar(width) => {
+                let level = *next_level;
+                *next_level += 1;
+                self.push_lvar_guard(level, *width);
+                AggValue::Scalar(HTerm::LVar(level))
+            }
+            AggShape::Array(elem, len) => AggValue::Array(
+                (0..*len)
+                    .map(|_| self.univ_lvl_agg_value(elem, next_level))
+                    .collect(),
+            ),
+            AggShape::Struct(fields) => AggValue::Struct(
+                fields
+                    .iter()
+                    .map(|(name, field)| (name.clone(), self.univ_lvl_agg_value(field, next_level)))
+                    .collect(),
+            ),
+        }
+    }
+
+    /// Resolves an aggregate-position expression to its value tree: a bound
+    /// aggregate, a field or constant-index read of one, or a literal. Any
+    /// other expression keeps the diagnostics its scalar-position translation
+    /// raises (a compound call result stays [`PCode::P005`], a string literal
+    /// [`PCode::P002`], …) and resolves to the sentinel.
+    fn agg_value(&mut self, expr: ExprId, mode: Mode) -> AggValue {
+        match &self.arena[expr].kind {
+            Expr::Parenthesized { expr: inner } => {
+                let inner = *inner;
+                self.agg_value(inner, mode)
+            }
+            Expr::Identifier(ident_id) => {
+                let name = self.arena[*ident_id].name.clone();
+                if let Some(Binding::Aggregate(value)) = self.env.get(&name) {
+                    value.clone()
+                } else {
+                    self.error_non_scalar_expr(expr);
+                    AggValue::Sentinel
+                }
+            }
+            Expr::MemberAccess { .. } | Expr::ArrayIndexAccess { .. } => {
+                self.access_chain(expr, mode)
+            }
+            Expr::ArrayLiteral { .. } | Expr::StructLiteral { .. } => {
+                self.literal_introduction(expr, mode)
+            }
+            _ => {
+                let _ = self.term(expr, mode);
+                AggValue::Sentinel
+            }
+        }
+    }
+
+    /// Resolves a whole field/index access chain against the value tree its
+    /// base resolves to.
+    ///
+    /// The chain is walked outward from the base rather than folded inward per
+    /// node, because a non-constant index does not resolve to a value at the
+    /// step that reads it: it selects among the elements, and the steps after
+    /// it apply to every candidate before the case split names one. `m[i][0]`
+    /// is therefore one split over the rows with `[0]` applied inside it, not
+    /// a split whose result is then indexed again.
+    fn access_chain(&mut self, expr: ExprId, mode: Mode) -> AggValue {
+        let (base_expr, steps) = self.split_access_chain(expr);
+        let mut current = ChainValue::One(self.agg_value(base_expr, mode));
+        for step in &steps {
+            match self.walk_step(current, step, mode) {
+                Some(next) => current = next,
+                None => return AggValue::Sentinel,
+            }
+        }
+        match current {
+            ChainValue::One(value) => value,
+            ChainValue::Split {
+                index,
+                class,
+                candidates,
+            } => self.symbolic_element(expr, &index, class, &candidates),
+        }
+    }
+
+    /// Peels an access chain into the expression it reads from and its steps,
+    /// outermost last. Parentheses are transparent at every level.
+    fn split_access_chain(&self, expr: ExprId) -> (ExprId, Vec<AccessStep>) {
+        let mut steps = Vec::new();
+        let mut current = expr;
+        loop {
+            match &self.arena[current].kind {
+                Expr::Parenthesized { expr: inner } => current = *inner,
+                Expr::MemberAccess { expr: base, name } => {
+                    steps.push(AccessStep::Field {
+                        at: current,
+                        name: *name,
+                    });
+                    current = *base;
+                }
+                Expr::ArrayIndexAccess { array, index } => {
+                    steps.push(AccessStep::Index {
+                        at: current,
+                        index: *index,
+                    });
+                    current = *array;
+                }
+                _ => break,
+            }
+        }
+        steps.reverse();
+        (current, steps)
+    }
+
+    /// Walks one step of a chain. `None` means the step was rejected and its
+    /// diagnostic recorded, or that the chain already carries a sentinel.
+    fn walk_step(
+        &mut self,
+        current: ChainValue,
+        step: &AccessStep,
+        mode: Mode,
+    ) -> Option<ChainValue> {
+        if matches!(current.sample(), AggValue::Sentinel) {
+            // Already reported where the aggregate was introduced.
+            return None;
+        }
+        match *step {
+            AccessStep::Field { at, name } => {
+                let field = self.arena[name].name.clone();
+                let position = match current.sample() {
+                    AggValue::Struct(fields) => fields.iter().position(|(n, _)| *n == field),
+                    _ => None,
+                };
+                let Some(position) = position else {
+                    // A field read of a non-struct, or a field the struct does
+                    // not have — ill-typed source the checker rejects before
+                    // translation, kept as a diagnostic so a checker gap
+                    // degrades softly.
+                    self.error_non_scalar_expr(at);
+                    return None;
+                };
+                Some(current.map(|value| field_child(value, position)))
+            }
+            AccessStep::Index { at, index } => {
+                let AggValue::Array(children) = current.sample() else {
+                    self.error_non_scalar_expr(at);
+                    return None;
+                };
+                let len = children.len();
+                match self.fold_const_index(index) {
+                    Some(k) => {
+                        let position = usize::try_from(k).ok().filter(|p| *p < len);
+                        let Some(position) = position else {
+                            return self.reject_out_of_bounds(index, k, len);
+                        };
+                        Some(current.map(|value| element_child(value, position)))
+                    }
+                    None => self.split_at_symbolic_index(current, at, index, mode),
+                }
+            }
+        }
+    }
+
+    /// A constant index outside the array: the same fact `A037` states for a
+    /// direct-literal index, at the folded-constant path `A037`'s pattern
+    /// cannot see — and the no-analysis code generation paths make this the
+    /// only guard for either spelling.
+    fn reject_out_of_bounds(&mut self, index: ExprId, k: i128, len: usize) -> Option<ChainValue> {
+        self.error(
+            PCode::P014,
+            self.arena[index].location,
+            format!(
+                "array index {k} is out of bounds for array of length {len}; valid indices are \
+                 0..{len}"
+            ),
+        );
+        None
+    }
+
+    /// Takes the chain's one non-constant index step: the array's elements
+    /// become the candidates a later case split chooses among.
+    fn split_at_symbolic_index(
+        &mut self,
+        current: ChainValue,
+        at: ExprId,
+        index: ExprId,
+        mode: Mode,
+    ) -> Option<ChainValue> {
+        let candidates = match current {
+            ChainValue::One(AggValue::Array(candidates)) => candidates,
+            ChainValue::One(_) => {
+                unreachable!("the caller rejects an index step that does not read an array")
+            }
+            ChainValue::Split { .. } => {
+                // A second non-constant index in one chain. The case split it
+                // would need is the product of the two extents, which is the
+                // only way one access can multiply an obligation's size — and
+                // nothing in the supported idioms asks for it.
+                self.error(
+                    PCode::P002,
+                    self.arena[at].location,
+                    "an access chain with more than one non-constant index has no assertion \
+                     encoding: each non-constant index defines the element by cases, and one \
+                     obligation supports one such case split per chain; make all but one index \
+                     constant, or assert over the constant-index elements directly"
+                        .to_string(),
+                );
+                return None;
+            }
+        };
+        // The index is translated once, before the element's binder is
+        // allocated, so a witness the index expression itself introduces sits
+        // outside the element's own.
+        let class = num_class(
+            self.ctx
+                .get_node_typeinfo(node_expr(index))
+                .map(|t| t.kind)
+                .as_ref(),
+        );
+        let term = self.term(index, mode);
+        Some(ChainValue::Split {
+            index: term,
+            class,
+            candidates,
+        })
+    }
+
+    /// Pins the element a non-constant index selects: a fresh binder defined
+    /// by the index's range and one case per element.
+    ///
+    /// The range bound leads the definition — it is what a reader of a failing
+    /// goal should meet first — and it is the single unsigned comparison
+    /// `i <u N`: at unsigned width a negative index is a huge value, so there
+    /// is no lower bound to add. An out-of-range index leaves the definition
+    /// unsatisfiable, refuting the atom that reads the element; the element is
+    /// defined only where it exists.
+    fn symbolic_element(
+        &mut self,
+        chain: ExprId,
+        index: &HTerm,
+        class: HNumType,
+        candidates: &[AggValue],
+    ) -> AggValue {
+        let mut leaves = Vec::with_capacity(candidates.len());
+        for candidate in candidates {
+            match candidate {
+                AggValue::Scalar(term) => leaves.push(term.clone()),
+                AggValue::Sentinel => return AggValue::Sentinel,
+                AggValue::Array(_) | AggValue::Struct(_) => {
+                    // The chain does not end at a scalar: a case split pins
+                    // one value, and an aggregate element would need one
+                    // binder per leaf of the selected sub-tree.
+                    self.error(
+                        PCode::P002,
+                        self.arena[chain].location,
+                        "an access chain whose non-constant index selects an aggregate has no \
+                         assertion encoding: only a scalar leaf can be named by cases, and every \
+                         candidate element here would itself be an aggregate — there is no single \
+                         term to define; index through to a scalar (`m[i][0]`), or make the index \
+                         constant"
+                            .to_string(),
+                    );
+                    return AggValue::Sentinel;
+                }
+            }
+        }
+        let extent = index_const(class, leaves.len());
+        let range = HAssert::nz(relop(class, HRelop::LtU, index.clone(), extent));
+        let index = index.clone();
+        let element = self.bind_witness(move |v| {
+            let cases = leaves
+                .into_iter()
+                .enumerate()
+                .map(|(case, leaf)| {
+                    HAssert::imp(
+                        HAssert::TermEq(index.clone(), index_const(class, case)),
+                        HAssert::TermEq(v.clone(), leaf),
+                    )
+                })
+                .collect();
+            HAssert::and(range, conjoin(cases))
+        });
+        AggValue::Scalar(element)
+    }
+
+    /// An array/struct literal in aggregate position: an introduction of
+    /// scalar leaves, checked against the leaf budget from its recorded type
+    /// *before* any child is translated. Out-of-surface literal shapes keep
+    /// the pre-existing [`PCode::P002`] rejection.
+    ///
+    /// A literal's leaves are constants — they bind no variable and carry no
+    /// typing guard — and still cost the full budget: a leafwise comparison
+    /// nests one conjunct per leaf whichever side the leaf came from, and that
+    /// nesting is what the budget bounds.
+    fn literal_introduction(&mut self, expr: ExprId, mode: Mode) -> AggValue {
+        let construct = match &self.arena[expr].kind {
+            Expr::StructLiteral { .. } => "a struct literal",
+            _ => "an array literal",
+        };
+        let Some(shape) = self
+            .ctx
+            .get_node_typeinfo(node_expr(expr))
+            .and_then(|info| self.agg_shape_of_kind(&info.kind))
+        else {
+            // Its own call site rather than the shared no-encoding template:
+            // a literal of a supported shape encodes now, so the template's
+            // "has no encoding" would name a rule the language dropped, and
+            // its "move the logic into an executable helper" remedy dead-ends
+            // — a compound call result is `P005` and a compound argument
+            // `P004`.
             self.error(
-                PCode::P004,
-                location,
+                PCode::P002,
+                self.arena[expr].location,
+                format!(
+                    "{construct} of this shape has no assertion encoding: a literal becomes one \
+                     term per scalar leaf, which reaches through arrays of scalars at any rank \
+                     and structs whose fields are scalars or one-dimensional arrays of those, \
+                     and no deeper; build the components you need as separate values"
+                ),
+            );
+            return AggValue::Sentinel;
+        };
+        let count = shape.leaf_count();
+        if self.leaf_budget_exceeded(count) {
+            let rendered = self
+                .ctx
+                .get_node_typeinfo(node_expr(expr))
+                .map_or_else(|| "this value".to_string(), |t| t.to_string());
+            self.error(
+                PCode::P013,
+                self.arena[expr].location,
                 format!(
-                    "type `{type_info}` cannot appear in a specification term; only bool, \
-                     integer, and enum values can"
+                    "this `{rendered}` literal has {count} scalar leaves, and this \
+                     specification already quantifies {} of the \
+                     {SPEC_FN_MAX_QUANTIFIED_LEAVES} one function may hold: each leaf becomes a \
+                     term of its own, a comparison against the value nests one conjunct per \
+                     leaf, and the assertion encoding caps how deeply one obligation may nest; \
+                     build a smaller value, or state the property over the elements it reads",
+                    self.leaves_introduced,
                 ),
             );
+            return AggValue::Sentinel;
+        }
+        self.leaves_introduced += count;
+        self.literal_value(expr, &shape, mode)
+    }
+
+    /// Builds a literal's value tree against its shape. Children are built in
+    /// shape order — a struct literal's fields are reordered from source order
+    /// to field-layout order, so one canonical leaf order holds everywhere;
+    /// access is by name, so the reordering is unobservable.
+    fn literal_value(&mut self, expr: ExprId, shape: &AggShape, mode: Mode) -> AggValue {
+        match &self.arena[expr].kind {
+            Expr::ArrayLiteral { elements } => {
+                let elements = elements.clone();
+                let AggShape::Array(elem_shape, len) = shape else {
+                    self.error_non_scalar_expr(expr);
+                    return AggValue::Sentinel;
+                };
+                debug_assert_eq!(
+                    elements.len(),
+                    *len as usize,
+                    "a type-checked array literal has exactly its type's element count"
+                );
+                AggValue::Array(
+                    elements
+                        .iter()
+                        .map(|element| self.literal_child(*element, elem_shape, mode))
+                        .collect(),
+                )
+            }
+            Expr::StructLiteral { fields, .. } => {
+                let fields = fields.clone();
+                let AggShape::Struct(field_shapes) = shape else {
+                    self.error_non_scalar_expr(expr);
+                    return AggValue::Sentinel;
+                };
+                let mut children = Vec::with_capacity(field_shapes.len());
+                for (field_name, field_shape) in field_shapes {
+                    let field_expr = fields
+                        .iter()
+                        .find(|(id, _)| self.arena[*id].name == *field_name)
+                        .map_or_else(
+                            || {
+                                panic!(
+                                    "struct literal reached hassert translation without field \
+                                     `{field_name}` — the type checker rejects an incomplete \
+                                     literal"
+                                )
+                            },
+                            |&(_, field_expr)| field_expr,
+                        );
+                    children.push((
+                        field_name.clone(),
+                        self.literal_child(field_expr, field_shape, mode),
+                    ));
+                }
+                AggValue::Struct(children)
+            }
+            _ => {
+                self.error_non_scalar_expr(expr);
+                AggValue::Sentinel
+            }
+        }
+    }
+
+    /// One literal child against its shape: a scalar child is an ordinary
+    /// term (its witnesses pend as usual and scope over wherever the enclosing
+    /// binding is read); a nested literal is part of the enclosing
+    /// introduction, so it bypasses the budget re-count; anything else
+    /// aggregate-shaped resolves as a value.
+    fn literal_child(&mut self, expr: ExprId, shape: &AggShape, mode: Mode) -> AggValue {
+        let mut child = expr;
+        while let Expr::Parenthesized { expr: inner } = &self.arena[child].kind {
+            child = *inner;
+        }
+        if let AggShape::Scalar(_) = shape {
+            let term = self.term(child, mode);
+            return AggValue::Scalar(term);
+        }
+        match &self.arena[child].kind {
+            Expr::ArrayLiteral { .. } | Expr::StructLiteral { .. } => {
+                self.literal_value(child, shape, mode)
+            }
+            _ => self.agg_value(child, mode),
+        }
+    }
+
+    /// Folds an index expression to the integer it denotes: a number literal,
+    /// an identifier inlined as a constant term (a `const` or a pure `let` of a
+    /// literal), or arithmetic over operands that themselves fold. Any other
+    /// index is non-constant.
+    ///
+    /// Arithmetic folds because an index the source computes from constants is
+    /// as statically certain as one it writes out, and an index this returns
+    /// `None` for is defined by cases instead — which for a certainly
+    /// out-of-range index would bury an authoring error in an unprovable goal
+    /// rather than name it.
+    ///
+    /// The result is the number the source names, read at its recorded type's
+    /// signedness — not the bit pattern the term language carries it at, under
+    /// which an unsigned index would fold to a negative number no reader could
+    /// find in the program. `i128` holds every width at either reading, so no
+    /// intermediate result wraps unseen.
+    ///
+    /// An operation whose result leaves the width the source computes it at
+    /// stays unfolded, as does one with no total reading (division by zero, and
+    /// the bitwise and shift operators, whose meaning is a bit pattern rather
+    /// than a number this fold could name). The symbolic path is the faithful
+    /// answer there: the index becomes a closed term the assertion language
+    /// evaluates at the source's own width, wrapping exactly where the source
+    /// wraps.
+    fn fold_const_index(&self, index: ExprId) -> Option<i128> {
+        match &self.arena[index].kind {
+            Expr::Parenthesized { expr } => self.fold_const_index(*expr),
+            Expr::NumberLiteral { value } => {
+                let Some(TypeInfoKind::Number(width)) =
+                    self.ctx.get_node_typeinfo(node_expr(index)).map(|t| t.kind)
+                else {
+                    return None;
+                };
+                Some(number_value(width, value))
+            }
+            Expr::Identifier(ident_id) => {
+                let Some(Binding::Term(HTerm::Const(constant))) =
+                    self.env.get(&self.arena[*ident_id].name)
+                else {
+                    return None;
+                };
+                Some(const_value(*constant, self.expr_is_unsigned(index)))
+            }
+            Expr::Binary { left, right, op } => {
+                let left = self.fold_const_index(*left)?;
+                let right = self.fold_const_index(*right)?;
+                let folded = match op {
+                    OperatorKind::Add => left.checked_add(right),
+                    OperatorKind::Sub => left.checked_sub(right),
+                    OperatorKind::Mul => left.checked_mul(right),
+                    OperatorKind::Div => left.checked_div(right),
+                    OperatorKind::Mod => left.checked_rem(right),
+                    _ => None,
+                }?;
+                self.at_source_width(index, folded)
+            }
+            Expr::PrefixUnary {
+                expr,
+                op: UnaryOperatorKind::Neg,
+            } => {
+                let value = self.fold_const_index(*expr)?;
+                self.at_source_width(index, value.checked_neg()?)
+            }
+            _ => None,
+        }
+    }
+
+    /// A folded value, kept only when the width the source computes it at can
+    /// name it — an expression the checker left untyped names nothing, so it
+    /// does not fold either.
+    fn at_source_width(&self, expr: ExprId, value: i128) -> Option<i128> {
+        let Some(TypeInfoKind::Number(width)) =
+            self.ctx.get_node_typeinfo(node_expr(expr)).map(|t| t.kind)
+        else {
+            return None;
+        };
+        width_names(width, value).then_some(value)
+    }
+
+    /// An aggregate `==`/`!=` in assertion position: leafwise equality over
+    /// the two value trees — the conjunction of per-leaf `term_eq` for
+    /// equality; for inequality (and for a negated equality) the De Morgan
+    /// dual, a disjunction of negated per-leaf equalities.
+    ///
+    /// Leafwise is the language rule: `==` compares values, and an
+    /// aggregate's value is exactly its ordered scalar leaves. The executable
+    /// lowering currently compares frame *pointers* for the same source
+    /// expression, contradicting the language's value-copy semantics — a
+    /// defect on the executable side, tracked separately, not a precedent
+    /// this encoding follows. Aggregate comparison in *term* position stays
+    /// rejected.
+    fn aggregate_comparison(
+        &mut self,
+        left: ExprId,
+        right: ExprId,
+        negated: bool,
+        mode: Mode,
+    ) -> HAssert {
+        let left_value = self.agg_value(left, mode);
+        let right_value = self.agg_value(right, mode);
+        let mut left_leaves = Vec::new();
+        let mut right_leaves = Vec::new();
+        if !left_value.collect_leaves(&mut left_leaves)
+            || !right_value.collect_leaves(&mut right_leaves)
+        {
+            // A sentinel operand already carries its diagnostic; a claim
+            // built over it would be about a value the source never defined.
+            return HAssert::True;
+        }
+        debug_assert_eq!(
+            left_leaves.len(),
+            right_leaves.len(),
+            "a type-checked aggregate comparison has operands of one shape"
+        );
+        let pairs = left_leaves.into_iter().zip(right_leaves);
+        if negated {
+            disjoin(
+                pairs
+                    .map(|(l, r)| HAssert::Not(Box::new(HAssert::TermEq(l, r))))
+                    .collect(),
+            )
+        } else {
+            conjoin(pairs.map(|(l, r)| HAssert::TermEq(l, r)).collect())
+        }
+    }
+
+    /// The non-scalar-in-term-position diagnostic, rendered from the
+    /// expression's recorded type.
+    ///
+    /// An aggregate reaching here is a different mistake from a `unit` or a
+    /// function type reaching here, and gets a different message. Its type is
+    /// perfectly nameable in a specification — it just is not a *term*, and the
+    /// shared wording, which ends by listing the aggregates a specification
+    /// names, would reject `[i32; 2]` while saying arrays of integers are
+    /// nameable. The commonest way to arrive is passing an aggregate to a call,
+    /// which stays rejected because the callee's real signature takes a pointer.
+    /// The untyped fallback keeps the shared wording: nothing is known there,
+    /// least of all that the value is an aggregate — and it is defensive, since
+    /// the type checker records a type for every expression it accepts.
+    fn error_non_scalar_expr(&mut self, expr: ExprId) {
+        let message = match self.ctx.get_node_typeinfo(node_expr(expr)) {
+            Some(info) if self.kind_is_aggregate(&info.kind) => aggregate_not_a_term_message(&info),
+            Some(info) => non_scalar_term_message(&info),
+            None => unknown_type_term_message(),
+        };
+        self.error(PCode::P004, self.arena[expr].location, message);
+    }
+
+    /// Renders the diagnostic message for a non-scalar type in term/parameter
+    /// position.
+    fn non_scalar_message(&self, ty: TypeId) -> String {
+        non_scalar_term_message(&TypeInfo::from_type_id(self.arena, ty))
+    }
+
+    /// Emits the right diagnostic for a `@` at a non-scalar type: [`PCode::P008`]
+    /// for a compound (array/struct) type, [`PCode::P004`] otherwise. The
+    /// `P008` wording is mode-aware — in a reachability body the reason a
+    /// compound `@` is impossible is different (a choice arrives as one scalar
+    /// parameter of the run the obligation is about), while a universal body
+    /// reaches this at all only for a shape outside the representable surface.
+    /// The universal wording says so: a compound `@` has an encoding now, so a
+    /// message claiming it has none would name a rule the language dropped.
+    ///
+    /// Which of the two a type gets is decided by the spelling-total
+    /// [`Self::kind_is_aggregate`], the same classifier that chooses the
+    /// sentinel binding at the call site: a struct named through a
+    /// `::`-qualified path is the same rejection as the unqualified spelling
+    /// of the same struct, never a different diagnostic.
+    fn emit_non_scalar_uzumaki(&mut self, ty: TypeId, location: Location, mode: Mode) {
+        let type_info = TypeInfo::from_type_id(self.arena, ty);
+        if self.kind_is_aggregate(&type_info.kind) {
+            let rendered = type_info.to_string();
+            let message = if mode.binds_choice_slots() {
+                self.reach_uzumaki_message(&rendered)
+            } else {
+                format!(
+                    "uzumaki (@) over compound type `{rendered}` quantifies a shape the \
+                     assertion encoding cannot take apart: an aggregate becomes one quantified \
+                     variable per scalar leaf, which reaches through arrays of scalars at any \
+                     rank and structs whose fields are scalars or one-dimensional arrays of \
+                     those, and no deeper; quantify the components you need individually"
+                )
+            };
+            self.error(PCode::P008, location, message);
+        } else {
+            self.error(PCode::P004, location, non_scalar_term_message(&type_info));
         }
     }
 
+    /// The reachability-body [`PCode::P008`] message, shared by the `let` form
+    /// and the call-argument form so the two spellings of the same mistake read
+    /// alike. Both remedies it offers are real: a component-wise `@` works here,
+    /// and a `forall`-bodied spec function takes the aggregate whole.
+    fn reach_uzumaki_message(&self, rendered: &str) -> String {
+        let kind = self.reach_kind();
+        let article = quantifier_article(kind);
+        format!(
+            "uzumaki (@) over compound type `{rendered}` cannot be a reachability choice: this \
+             is {article} `{kind}`-quantified spec function, whose obligation is about an actual \
+             run of its own body — each choice arrives as one scalar parameter of that run, and \
+             a `{rendered}` value lives in linear memory; bind one `@` per scalar component \
+             here, or state the property in a `forall`-bodied spec function, where an aggregate \
+             `@` quantifies one variable per scalar leaf"
+        )
+    }
+
     /// The `@` the pre-scan did not plan, reached in call-argument position of
     /// a reachability body. The pre-scan plans every scalar `@`, so an
     /// unplanned one is at a non-scalar type: a compound gets the reachability
     /// [`PCode::P008`] wording, anything else the standard non-scalar
     /// [`PCode::P004`] text.
+    ///
+    /// Only the compound arm is reachable from source; the other two are
+    /// defensive and deliberately untested. A non-scalar, non-aggregate
+    /// argument type would have to be a `string`, a `unit` or a function type,
+    /// none of which survives code generation's own value-type check to reach
+    /// this pass, and an argument with no recorded type would be a type-checker
+    /// gap. They stay as honest diagnostics rather than `unreachable!` so such
+    /// a gap degrades into a message instead of aborting the compiler.
     fn emit_unplanned_reach_argument(&mut self, arg: ExprId) {
         let location = self.arena[arg].location;
         let kind = self.ctx.get_node_typeinfo(node_expr(arg)).map(|t| t.kind);
@@ -1634,35 +3100,14 @@ impl<'a> SpecFnTranslator<'a> {
                 | TypeInfoKind::Struct(_, _)
                 | TypeInfoKind::Custom(_)),
             ) => {
-                self.error(
-                    PCode::P008,
-                    location,
-                    format!(
-                        "uzumaki (@) over compound type `{kind}` cannot be a reachability \
-                         choice: a choice arrives as one scalar WASM parameter, and a value of \
-                         type `{kind}` lives in linear memory; quantify its scalar components \
-                         individually"
-                    ),
-                );
+                let message = self.reach_uzumaki_message(&kind.to_string());
+                self.error(PCode::P008, location, message);
             }
             Some(kind) => {
-                self.error(
-                    PCode::P004,
-                    location,
-                    format!(
-                        "type `{kind}` cannot appear in a specification term; only bool, \
-                         integer, and enum values can"
-                    ),
-                );
+                self.error(PCode::P004, location, non_scalar_term_message(&kind));
             }
             None => {
-                self.error(
-                    PCode::P004,
-                    location,
-                    "type of this value cannot appear in a specification term; only bool, \
-                     integer, and enum values can"
-                        .to_string(),
-                );
+                self.error(PCode::P004, location, unknown_type_term_message());
             }
         }
     }
@@ -1728,26 +3173,50 @@ impl<'a> SpecFnTranslator<'a> {
     {
         let witness = HTerm::LVar(self.depth + self.pending_len());
         let definition = define(&witness);
-        self.pending.push(definition);
+        self.pending.push(PendingBinder {
+            quant: Binder::Ex,
+            definition,
+        });
         witness
     }
 
+    /// Allocates the next pending binder as a *universal* one, carrying the
+    /// typing guard its readers depend on.
+    ///
+    /// The guard rides with the binder rather than through the `univ_guards`
+    /// channel because this binder is wrapped around the enclosing statement's
+    /// atom, while that channel drains around the statement — outside the
+    /// wrap, where the variable is no longer bound.
+    fn bind_universal(&mut self, width: HNumType) -> HTerm {
+        let variable = HTerm::LVar(self.depth + self.pending_len());
+        self.pending.push(PendingBinder {
+            quant: Binder::All,
+            definition: HAssert::HasType(variable.clone(), width),
+        });
+        variable
+    }
+
     /// Removes the binders allocated since `base` as one group.
     fn split_pending(&mut self, base: usize) -> PendingGroup {
         PendingGroup {
             base_level: self.depth + level_count(base),
-            defs: self.pending.split_off(base),
+            binders: self.pending.split_off(base),
         }
     }
 
-    /// Runs `f` and takes away the *definitions* of every binder it introduced,
-    /// returning them conjoined in allocation order.
+    /// Runs `f` and takes away the *definitions* of every existential binder it
+    /// introduced, returning them conjoined in allocation order.
     ///
     /// This is how a constraint reaches the arm that evaluates it. Only the
     /// definitions move: each binder stays pending with a `⊤` definition, so
     /// the levels allocated inside `f` remain valid and the `HA_ex`s still hoist
     /// to the enclosing atom. A binder left unconstrained that way is exactly
     /// right — on the arm the source skips, nothing reads it.
+    ///
+    /// A *universal* binder keeps its definition where it is. That definition is
+    /// a typing guard, which assumes rather than demands, so leaving it at the
+    /// wrap costs the skipped arm nothing; moving it would turn the assumption
+    /// into a conjunct the proof has to establish for every value.
     fn capture_definitions<T, F>(&mut self, f: F) -> (T, HAssert)
     where
         F: FnOnce(&mut Self) -> T,
@@ -1756,7 +3225,8 @@ impl<'a> SpecFnTranslator<'a> {
         let value = f(self);
         let taken: Vec<HAssert> = self.pending[base..]
             .iter_mut()
-            .map(|definition| std::mem::replace(definition, HAssert::True))
+            .filter(|binder| binder.quant == Binder::Ex)
+            .map(|binder| std::mem::replace(&mut binder.definition, HAssert::True))
             .collect();
         (value, conjoin(taken))
     }
@@ -1770,6 +3240,18 @@ impl<'a> SpecFnTranslator<'a> {
         ));
     }
 
+    /// The quantifier word of the body being translated, for a diagnostic that
+    /// explains a restriction specific to reachability. Only a reachability
+    /// body has one, and every message that interpolates it is raised on a
+    /// path [`Mode::binds_choice_slots`] already guarded, so the fallback is
+    /// unreachable rather than a default worth choosing.
+    fn reach_kind(&self) -> &'static str {
+        match &self.reach {
+            Some(reach) if reach.unique => "unique",
+            _ => "exists",
+        }
+    }
+
     fn error_no_encoding(&mut self, location: Location, construct: &str) {
         self.error(
             PCode::P002,
@@ -1781,6 +3263,27 @@ impl<'a> SpecFnTranslator<'a> {
         );
     }
 
+    /// The one [`PCode::P007`] message, raised from the block form and from the
+    /// `if`-branch form alike. The restriction it reports is specific to a
+    /// reachability body — inside a `forall`/plain one the same nesting binds
+    /// a universal logical variable per `@` and translates — so the wording
+    /// names the quantifier that makes it impossible rather than the shape.
+    fn error_reach_forall(&mut self, location: Location) {
+        let kind = self.reach_kind();
+        let article = quantifier_article(kind);
+        self.error(
+            PCode::P007,
+            location,
+            format!(
+                "a `forall` block has no encoding inside {article} `{kind}`-quantified spec \
+                 function: this function's obligation is about one actual run of its own body, \
+                 where every `@` is a choice that run makes, so there is no way to also range \
+                 over all values inside it; move the universal claim into its own \
+                 `forall`-bodied spec function"
+            ),
+        );
+    }
+
     fn error_call(&mut self, function: ExprId, reason: &str) {
         let name = self.call_display_name(function);
         self.error(
@@ -1798,15 +3301,16 @@ impl<'a> SpecFnTranslator<'a> {
             CalleeError::NotApplicable(reason) => self.error_call(function, reason),
             CalleeError::ReachabilitySpec { kind } => {
                 let name = self.call_display_name(function);
+                let article = quantifier_article(kind);
                 self.error(
                     PCode::P011,
                     self.arena[function].location,
                     format!(
-                        "call to `{name}` is not allowed: `{name}` is an `{kind}`-quantified \
-                         spec function, and its obligation is a claim about running its own \
-                         body with its own choices — there is no predicate to apply here; state \
-                         the property you want directly in this body, or move the shared part \
-                         into an ordinary function both spec functions can call"
+                        "call to `{name}` is not allowed: `{name}` is {article} \
+                         `{kind}`-quantified spec function, and its obligation is a claim about \
+                         running its own body with its own choices — there is no predicate to \
+                         apply here; state the property you want directly in this body, or move \
+                         the shared part into an ordinary function both spec functions can call"
                     ),
                 );
             }
@@ -1826,6 +3330,13 @@ impl<'a> SpecFnTranslator<'a> {
 }
 
 // ----- free helpers -----------------------------------------------------
+//
+// Diagnostic messages live at their call sites — `diag.rs` carries codes and
+// their rationale, never text. The few message builders below are the
+// exception, and the rule for joining them is narrow: a wording moves here only
+// when the *same fact* is stated from more than one site, so that the sites
+// cannot drift apart on it. A wording used once stays where it is raised, even
+// when it is long, because that is where a reader looks for it.
 
 /// A distinct signed-relop selector, so [`signed_relop`] reads clearly.
 #[derive(Clone, Copy)]
@@ -1837,6 +3348,69 @@ enum Ordered {
 }
 use Ordered::{Ge, Gt, Le, Lt};
 
+/// The indefinite article a quantifier word takes when a diagnostic names it:
+/// *an* `exists`-quantified function, *a* `unique`-quantified one. A reader
+/// speaks the word even though it renders in backticks, so the article follows
+/// its sound — which is why the two words are spelled out here rather than
+/// tested for a leading vowel letter, the rule that gets `unique` wrong. The
+/// only producers are [`SpecFnTranslator::reach_kind`] and
+/// [`SpecFnTranslator::reachability_kind`], both of which yield `"exists"` or
+/// `"unique"`.
+fn quantifier_article(kind: &str) -> &'static str {
+    match kind {
+        "exists" => "an",
+        _ => "a",
+    }
+}
+
+/// The one wording for a type with no place in a specification term, rendered
+/// from whichever spelling of the type the site has to hand.
+///
+/// The tail names the *whole* representable surface rather than the scalar part
+/// of it. Aggregates became nameable when the leaf encoding landed, so a message
+/// claiming that only scalars can appear would now be read as a rule the
+/// language does not have — the parameter site accepts `[i32; 3]` and rejects
+/// `[Point; 2]`, and the reason is the shape, not aggregation. Naming the
+/// supported shapes is also the whole remedy: there is nothing to rewrite for a
+/// `unit` or a function type, and for an over-deep aggregate the fix is to
+/// flatten it.
+fn non_scalar_term_message(ty: &impl std::fmt::Display) -> String {
+    format!("type `{ty}` cannot appear in a specification term; {TERM_SURFACE}")
+}
+
+/// [`non_scalar_term_message`] for a site whose expression the type checker left
+/// untyped, where naming the type is not an option.
+fn unknown_type_term_message() -> String {
+    format!("type of this value cannot appear in a specification term; {TERM_SURFACE}")
+}
+
+/// The diagnostic for an aggregate read whole where a scalar term is required —
+/// most often an aggregate passed to a call, whose compiled callee takes a
+/// pointer. Distinct from [`non_scalar_term_message`] because the type is not
+/// the problem: a specification names this very type, just never as one value.
+fn aggregate_not_a_term_message(ty: &impl std::fmt::Display) -> String {
+    format!(
+        "type `{ty}` is an aggregate, and a term is one scalar value: a specification names an \
+         aggregate by its scalar leaves rather than as a value of its own, so there is nothing \
+         here for the whole of it to denote; name the component you mean, such as `a[0]` or \
+         `p.x`"
+    )
+}
+
+/// The representable surface, as one clause both messages above end with.
+///
+/// The rank asymmetry is real and must be spelled out: an array of scalars
+/// nests to any depth, while a struct field may be a scalar or a
+/// one-dimensional array of scalars and no deeper — the same boundary analysis
+/// rules A027/A028 draw for the executable aggregate `@`, which this surface is
+/// deliberately equal to. A tail that said "such arrays" for the struct case
+/// would name `[[i32; 2]; 2]` as a legal field while rejecting the struct that
+/// has one.
+const TERM_SURFACE: &str = "a term is a bool, an integer, or an enum value, and the only \
+                            aggregates a specification names are arrays of those at any rank \
+                            and structs whose fields are those or one-dimensional arrays of \
+                            those";
+
 fn signed_relop(unsigned: bool, op: Ordered) -> HRelop {
     match (op, unsigned) {
         (Lt, false) => HRelop::LtS,
@@ -1862,6 +3436,48 @@ fn zero_sentinel() -> HTerm {
     HTerm::Const(HConst::I32(0))
 }
 
+/// An index constant at the class the chain's index term rides in, so the
+/// range comparison and the per-case equalities are well-typed at the width
+/// the index itself was translated at.
+///
+/// Every value passed here is an array extent or a position within one, and an
+/// array that reached a value tree is inside the per-function leaf budget — so
+/// the width conversion is an invariant of the introduction rules rather than a
+/// case to handle.
+fn index_const(class: HNumType, value: usize) -> HTerm {
+    let value = i64::try_from(value).expect("an array extent is within the spec leaf budget");
+    HTerm::Const(match class {
+        HNumType::I32 => HConst::I32(
+            i32::try_from(value).expect("an array extent is within the spec leaf budget"),
+        ),
+        HNumType::I64 => HConst::I64(value),
+    })
+}
+
+/// The field at `position` of a struct candidate. A candidate of another shape
+/// carries a sentinel from its own introduction — siblings of one element type
+/// cannot differ in shape.
+fn field_child(value: &AggValue, position: usize) -> AggValue {
+    match value {
+        AggValue::Struct(fields) => fields
+            .get(position)
+            .map_or(AggValue::Sentinel, |(_, child)| child.clone()),
+        _ => AggValue::Sentinel,
+    }
+}
+
+/// The element at `position` of an array candidate, on the same terms as
+/// [`field_child`].
+fn element_child(value: &AggValue, position: usize) -> AggValue {
+    match value {
+        AggValue::Array(children) => children
+            .get(position)
+            .cloned()
+            .unwrap_or(AggValue::Sentinel),
+        _ => AggValue::Sentinel,
+    }
+}
+
 /// The constant a number literal denotes at the width recorded for it, chosen
 /// exactly as code generation lowers the same literal: every width below 64 bits
 /// rides in an `i32` constant, and an unsigned value is reinterpreted as the
@@ -1880,6 +3496,41 @@ fn number_const(width: NumberType, value: &str) -> HConst {
     }
 }
 
+/// The number a literal names, read at the width recorded for it. This is the
+/// value the author wrote; [`number_const`] is the same literal as the *term*
+/// encoding carries it, which for an unsigned width is a different number with
+/// the same bit pattern — the constant to compute with, never the one to name
+/// back to the author.
+fn number_value(width: NumberType, value: &str) -> i128 {
+    match width {
+        NumberType::I8 | NumberType::I16 | NumberType::I32 => {
+            i128::from(parse_at::<i32>(value, width))
+        }
+        NumberType::U8 => i128::from(parse_at::<u8>(value, width)),
+        NumberType::U16 => i128::from(parse_at::<u16>(value, width)),
+        NumberType::U32 => i128::from(parse_at::<u32>(value, width)),
+        NumberType::I64 => i128::from(parse_at::<i64>(value, width)),
+        NumberType::U64 => i128::from(parse_at::<u64>(value, width)),
+    }
+}
+
+/// Whether a width can name a number, at the same reading [`number_value`]
+/// gives: an unsigned width names from zero up, a signed one names its
+/// two's-complement range.
+fn width_names(width: NumberType, value: i128) -> bool {
+    let range = match width {
+        NumberType::I8 => i128::from(i8::MIN)..=i128::from(i8::MAX),
+        NumberType::I16 => i128::from(i16::MIN)..=i128::from(i16::MAX),
+        NumberType::I32 => i128::from(i32::MIN)..=i128::from(i32::MAX),
+        NumberType::I64 => i128::from(i64::MIN)..=i128::from(i64::MAX),
+        NumberType::U8 => 0..=i128::from(u8::MAX),
+        NumberType::U16 => 0..=i128::from(u16::MAX),
+        NumberType::U32 => 0..=i128::from(u32::MAX),
+        NumberType::U64 => 0..=i128::from(u64::MAX),
+    };
+    range.contains(&value)
+}
+
 /// A literal's text read at the width recorded for it. A value that does not fit
 /// that width has already been rejected by the literal-range analysis rule, so a
 /// parse failure here is a compiler bug — silently reading `0` instead would make
@@ -1946,6 +3597,19 @@ fn narrows(op: &OperatorKind) -> bool {
     )
 }
 
+/// Whether a type kind is one of the unsigned number widths — the widths whose
+/// values the term language carries at their signed bit pattern, so that both
+/// the choice of relational operator and the reading back of a constant depend
+/// on it. An unrecorded type reads signed.
+fn kind_is_unsigned(kind: Option<&TypeInfoKind>) -> bool {
+    matches!(
+        kind,
+        Some(TypeInfoKind::Number(
+            NumberType::U8 | NumberType::U16 | NumberType::U32 | NumberType::U64
+        ))
+    )
+}
+
 /// The number class a scalar's values ride in: `i64` and `u64` at 64 bits,
 /// every other scalar — bool, enums, and the sub-word integer widths — at 32.
 fn num_class(kind: Option<&TypeInfoKind>) -> HNumType {
@@ -1975,11 +3639,64 @@ fn conjoin(assertions: Vec<HAssert>) -> HAssert {
         .fold(HAssert::True, |acc, assertion| HAssert::and(assertion, acc))
 }
 
-/// Wraps `body` in one `HA_ex` per entry of `defs`, whose binders occupy levels
+/// Right-folds assertions into one disjunction, `⊥` for none:
+/// `a₀ ∨ (a₁ ∨ (… ∨ aₙ))`. The primitive `Or` node, not the ⊤-absorbing smart
+/// constructor: the clauses here are never `⊤`, and the fold must not collapse.
+fn disjoin(assertions: Vec<HAssert>) -> HAssert {
+    assertions
+        .into_iter()
+        .rev()
+        .reduce(|acc, assertion| HAssert::Or(Box::new(assertion), Box::new(acc)))
+        .unwrap_or(HAssert::False)
+}
+
+/// Materializes an existential aggregate introduction: consecutive absolute
+/// binder levels starting at `*next_level`, one per scalar leaf, in
+/// enumeration order.
+fn exist_agg_value(shape: &AggShape, next_level: &mut u32) -> AggValue {
+    match shape {
+        AggShape::Scalar(_) => {
+            let level = *next_level;
+            *next_level += 1;
+            AggValue::Scalar(HTerm::LVar(level))
+        }
+        AggShape::Array(elem, len) => AggValue::Array(
+            (0..*len)
+                .map(|_| exist_agg_value(elem, next_level))
+                .collect(),
+        ),
+        AggShape::Struct(fields) => AggValue::Struct(
+            fields
+                .iter()
+                .map(|(name, field)| (name.clone(), exist_agg_value(field, next_level)))
+                .collect(),
+        ),
+    }
+}
+
+/// A stored constant read back as the number its type names. An unsigned
+/// constant rides in the term language at its signed bit pattern, so reading it
+/// as the source spelled it undoes that reinterpretation.
+fn const_value(constant: HConst, unsigned: bool) -> i128 {
+    match (constant, unsigned) {
+        (HConst::I32(v), false) => i128::from(v),
+        (HConst::I32(v), true) => i128::from(v.cast_unsigned()),
+        (HConst::I64(v), false) => i128::from(v),
+        (HConst::I64(v), true) => i128::from(v.cast_unsigned()),
+    }
+}
+
+/// Wraps `body` in one quantifier per entry of `binders`, which occupy levels
 /// `base_level ..` in allocation order. Folding innermost-first puts the
 /// first-allocated binder outermost, so a later definition may name an earlier
 /// binder: `∃v₀. (def₀ ∧ ∃v₁. (def₁ ∧ … ∧ body))`.
 ///
+/// The two quantifiers attach their definitions differently, because the
+/// definitions mean different things: an existential binder is *pinned* by its
+/// constraint (a conjunct), while a universal binder is *typed* by its guard (an
+/// antecedent). Both readings keep the definition inside its own binder, which
+/// is what lets the variable appear in it at all.
+///
 /// A binder whose variable does not occur in the accumulated body is emitted
 /// *without* its definition. A definition pins a value, so keeping one for a
 /// variable nothing reads would turn a specification that claims nothing into a
@@ -1987,17 +3704,22 @@ fn conjoin(assertions: Vec<HAssert>) -> HAssert {
 /// `HA_true`. Only the definition is dropped, never the binder: dropping the
 /// binder would shift the level of every binder allocated inside it. The
 /// innermost-first order lets one dropped definition cascade outward, and
-/// [`HAssert::ex`] collapses the resulting `∃x. ⊤` away.
-fn wrap_existentials(body: HAssert, group: PendingGroup) -> HAssert {
-    let PendingGroup { defs, base_level } = group;
-    let mut level = base_level + level_count(defs.len());
+/// [`HAssert::ex`]/[`HAssert::all`] collapse the resulting `∃x. ⊤`/`∀x. ⊤` away.
+fn wrap_binders(body: HAssert, group: PendingGroup) -> HAssert {
+    let PendingGroup {
+        binders,
+        base_level,
+    } = group;
+    let mut level = base_level + level_count(binders.len());
     let mut acc = body;
-    for definition in defs.into_iter().rev() {
+    for binder in binders.into_iter().rev() {
         level -= 1;
-        acc = if assert_mentions_level(&acc, level) {
-            HAssert::ex(HAssert::and(definition, acc))
-        } else {
-            HAssert::ex(acc)
+        let read = assert_mentions_level(&acc, level);
+        acc = match (binder.quant, read) {
+            (Binder::Ex, true) => HAssert::ex(HAssert::and(binder.definition, acc)),
+            (Binder::Ex, false) => HAssert::ex(acc),
+            (Binder::All, true) => HAssert::all(HAssert::imp(binder.definition, acc)),
+            (Binder::All, false) => HAssert::all(acc),
         };
     }
     acc
@@ -2008,7 +3730,9 @@ fn wrap_existentials(body: HAssert, group: PendingGroup) -> HAssert {
 fn assert_mentions_level(assertion: &HAssert, level: u32) -> bool {
     match assertion {
         HAssert::True | HAssert::False => false,
-        HAssert::Not(inner) | HAssert::Ex(inner) => assert_mentions_level(inner, level),
+        HAssert::Not(inner) | HAssert::Ex(inner) | HAssert::All(inner) => {
+            assert_mentions_level(inner, level)
+        }
         HAssert::And(l, r) | HAssert::Imp(l, r) | HAssert::Or(l, r) => {
             assert_mentions_level(l, level) || assert_mentions_level(r, level)
         }
@@ -2034,7 +3758,7 @@ fn node_expr(expr: ExprId) -> inference_ast::ids::NodeId {
 }
 
 /// Rewrites logical-variable levels to de Bruijn indices, descending under each
-/// `HA_ex` binder.
+/// binder — `HA_ex` and `Hall` alike, since both bind index 0 in their body.
 fn lower_assert(assertion: &HAssert, depth: u32) -> HAssert {
     match assertion {
         HAssert::True => HAssert::True,
@@ -2053,6 +3777,7 @@ fn lower_assert(assertion: &HAssert, depth: u32) -> HAssert {
             Box::new(lower_assert(r, depth)),
         ),
         HAssert::Ex(body) => HAssert::Ex(Box::new(lower_assert(body, depth + 1))),
+        HAssert::All(body) => HAssert::All(Box::new(lower_assert(body, depth + 1))),
         HAssert::TermEq(a, b) => HAssert::TermEq(lower_term(a, depth), lower_term(b, depth)),
         HAssert::HasType(t, ty) => HAssert::HasType(lower_term(t, depth), *ty),
         HAssert::Defined(t) => HAssert::Defined(lower_term(t, depth)),
@@ -2205,6 +3930,53 @@ mod tests {
         assert_eq!(number_const(NumberType::I16, "40000"), HConst::I32(40000));
     }
 
+    /// One literal has two readings, and the pair must not be confused:
+    /// [`number_const`] is the term encoding, where an unsigned value rides at
+    /// its signed bit pattern, while [`number_value`] is the number the source
+    /// names — the only one a diagnostic may quote back. The all-ones patterns
+    /// alone would not discriminate, so each width also takes a value where the
+    /// two readings differ without being `-1`.
+    #[test]
+    fn a_literal_reads_one_way_as_a_term_and_another_as_a_number() {
+        assert_eq!(number_const(NumberType::U32, "4294967295"), HConst::I32(-1));
+        assert_eq!(number_value(NumberType::U32, "4294967295"), 4_294_967_295);
+        assert_eq!(
+            number_const(NumberType::U32, "2147483648"),
+            HConst::I32(i32::MIN)
+        );
+        assert_eq!(number_value(NumberType::U32, "2147483648"), 2_147_483_648);
+        assert_eq!(
+            number_const(NumberType::U64, "18446744073709551615"),
+            HConst::I64(-1)
+        );
+        assert_eq!(
+            number_value(NumberType::U64, "18446744073709551615"),
+            i128::from(u64::MAX)
+        );
+        // Signed widths and the small unsigned widths read alike both ways.
+        assert_eq!(
+            number_value(NumberType::I32, "-2147483648"),
+            i128::from(i32::MIN)
+        );
+        assert_eq!(
+            number_value(NumberType::I64, "-9223372036854775808"),
+            i128::from(i64::MIN)
+        );
+        assert_eq!(number_value(NumberType::U8, "255"), 255);
+        assert_eq!(number_value(NumberType::U16, "65535"), 65535);
+    }
+
+    /// The same reinterpretation in reverse, for a constant already stored as a
+    /// term: it reads back at the signedness of the type that named it.
+    #[test]
+    fn a_stored_constant_reads_back_at_its_declared_signedness() {
+        assert_eq!(const_value(HConst::I32(-1), true), i128::from(u32::MAX));
+        assert_eq!(const_value(HConst::I32(-1), false), -1);
+        assert_eq!(const_value(HConst::I64(-1), true), i128::from(u64::MAX));
+        assert_eq!(const_value(HConst::I64(-1), false), -1);
+        assert_eq!(const_value(HConst::I32(255), true), 255);
+    }
+
     /// Each width's parse is an invariant too: the literal-range rule accepted
     /// the value at this width, so a failure to parse it is a compiler bug and
     /// must not silently denote zero. One case per distinct arm of the table.
diff --git a/core/wasm-to-v/ROCQ_CONTRACT.md b/core/wasm-to-v/ROCQ_CONTRACT.md
index efafce5c..9ac8e5e9 100644
--- a/core/wasm-to-v/ROCQ_CONTRACT.md
+++ b/core/wasm-to-v/ROCQ_CONTRACT.md
@@ -169,9 +169,10 @@ Within that context, the translator depends on:
 - The sugar `Definition`s built on `hassert`, referenced by name from the
   printer rather than re-derived: `term_eq a b := HA_pred pred_eq (a ::
   b :: nil)`, `Himpl p q := HA_not (HA_and p (HA_not q))`,
-  `Hor p q := HA_not (HA_and (HA_not p) (HA_not q))`. `Hall` (the
-  universal-quantifier sugar) exists in the library but is not emitted by
-  this milestone (see [Translation scheme summary](#translation-scheme-summary)).
+  `Hor p q := HA_not (HA_and (HA_not p) (HA_not q))`, and
+  `Hall body := HA_not (HA_ex (HA_not body))` — the universal-quantifier
+  sugar, whose body binds logical de Bruijn index 0 exactly as `HA_ex`
+  does. A `forall` block nested inside an `exists` context emits it.
 
   **Real library versus vendored stub.** Both bullets above describe
   wasm-verifier's own `theories/Assertions.v` — the library an emitted
@@ -179,8 +180,8 @@ Within that context, the translator depends on:
   contract *with*. The vendored signature stub in
   [`rocq-stub/`](rocq-stub/README.md) is deliberately **strictly
   smaller**: it declares only the subset the emitter can actually print,
-  so `T_global`, the entire heap fragment (`HA_emp`, `HA_star`,
-  `HA_iter`, `HA_pto`, `HA_size`) and `Hall` are absent from it. That is
+  so `T_global` and the entire heap fragment (`HA_emp`, `HA_star`,
+  `HA_iter`, `HA_pto`, `HA_size`) are absent from it. That is
   not a contract gap. A name the real library has and the stub omits is a
   name no emitted module may mention, and the local `coqc` gate turns any
   accidental mention of one into an unbound-constructor error instead of
@@ -1074,7 +1075,7 @@ entries are matched by name, not position.
   declaration. The check is purely lexical (mode-independent) and fires
   in both compile and proof modes, so no Inference-compiled program can
   reach the codegen stage with non-det syntax outside a spec.
-- **P001–P012** (fatal, `core/wasm-codegen/src/hassert/diag.rs`): a
+- **P001–P014** (fatal, `core/wasm-codegen/src/hassert/diag.rs`): a
   specification function that cannot be encoded as an obligation — or
   whose obligation says nothing — aborts code generation
   (`CodegenError::UntranslatableSpec`) rather than silently emitting an
@@ -1084,17 +1085,19 @@ entries are matched by name, not position.
   | Code | Condition |
   | --- | --- |
   | P001 | Body is `assume`-quantified. `assume` is not a quantifier — it only reinterprets a failing path as a filtered-out one for an enclosing `forall` — so a standalone `assume` body states no property. (`forall`/plain bodies translate to `ValidSpec` obligations; `exists`/`unique` bodies to reachability obligations; nested `exists`/`assume` blocks are supported in every translatable body) |
-  | P002 | A construct with no assertion encoding: `loop`, `break`, a nested `unique` *block*, `**`, array indexing, struct field access, a struct/array/string literal |
-  | P003 | Reassignment (`Stmt::Assign`) in a specification body |
-  | P004 | A non-scalar type in a term, parameter, or `@` position (only bool, integer, and enum values are representable) |
+  | P002 | A construct with no assertion encoding: `loop`, `break`, a nested `unique` *block*, `**`, a string literal, an array/struct literal read in scalar term position or written at a shape outside the representable surface, or an access chain the element encoding cannot pin — one carrying more than one non-constant index, or one whose non-constant index lands on an aggregate rather than a scalar leaf. Four of these carry their own message rather than the shared no-encoding template, because the template's "this has no encoding; move the logic into a helper" is false or useless for them: `loop` (a loop's purpose in a specification is exactly what quantifying an index and constraining it says directly), an out-of-surface literal (literals encode now — the restriction is the shape, and the helper remedy dead-ends because a compound call result is P005 and a compound call argument P004: a `T_app` symbol resolves to the compiled function, whose real signature takes and returns pointers, so leaf-expanding an application would change its arity and detach the symbol from the function it names), and each of the two access-chain cases |
+  | P003 | Reassignment (`Stmt::Assign`) in a specification body. A permanent rule, not a pending feature: a specification names values, not storage, so every name stands for one value throughout the claim — which is what lets the translation read a name as the same term wherever it appears. Mutation would need per-branch value versioning across quantifier scopes for no expressive gain over a fresh `let` |
+  | P004 | A type with no place in a specification term — `unit`, a string, a function type — or an aggregate outside the representable surface: arrays of scalars at any rank and structs whose fields are scalars or one-dimensional scalar arrays (the executable aggregate `@` surface, bounded by analysis rules A027/A028). Two further wordings live under this code: an aggregate read *whole* where a term is required (an aggregate call argument, most often — its type is nameable, it is just not a term) and any *aggregate* parameter of an `exists`/`unique` body, whose obligation denotes against a real frame in which the parameter is one pointer local. A non-scalar, non-aggregate parameter there is unrepresentable for the first reason instead, and takes the first wording |
   | P005 | A call that cannot be represented as a `T_app`/`HA_app_ok` term: an external function, an instance method, an unresolved target, a non-deterministic-bodied callee, or (in term position specifically) a non-scalar result |
   | P006 | A bare `@` outside a `let` right-hand side or a call-argument position |
-  | P007 | A `forall` block nested inside an `exists` context — an `exists`/`unique` body included (needs `Hall`, deferred past this milestone; lifting it must also restore the `Hall` `Definition` to `rocq-stub/wasm_verifier/Assertions.v`, which omits it as unemittable) |
-  | P008 | `@` at a compound (array/struct) type. In an `exists`/`unique` body the message explains the reachability-specific reason: a choice arrives as one scalar WASM parameter, and a compound value lives in linear memory — quantify its scalar components individually |
+  | P007 | A `forall` block nested inside an `exists`/`unique`-quantified body. Inside a `forall`/plain body the same nesting translates: the inner block binds a `Hall` logical variable per `@` and the alternation is emitted as written. A reachability body cannot: there every `@` is a hidden trailing choice parameter the judgment quantifies operationally, and a universal binder over one would need a choice-plan and lowering redesign |
+  | P008 | `@` at a compound (array/struct) type outside the representable surface, or at any compound type in an `exists`/`unique` body. In a `forall`/plain body a supported-shape compound `@` quantifies one universal slot per scalar leaf instead of raising this; in a reachability body the message names the quantifier, since the identical declaration translates in a `forall` body — the obligation there is about one actual run, each of whose choices arrives as one scalar parameter, and a compound value lives in linear memory |
   | P009 | A specification *method* that carries a proof obligation the translation cannot deliver — quantified (any kind, `exists`/`unique` included: a method has no obligation channel), or plain but carrying an `assert` at any depth. Never silently dropped, since a method has no free-function fallback path. A plain method that asserts nothing stays a helper and is not reported, a non-deterministic block that claims nothing included |
   | P010 | A specification function whose obligation collapses to the vacuous `HA_true`: an empty or assert-free body, a body that only computes (`return`, pure `let`/`const`), a trailing `assume` (`Imp(p, ⊤) = ⊤`), or an `if` whose branches all vacuate. An obligation any proof discharges without reading the program is indistinguishable from no verification at all, so a computing helper belongs at file scope, where a specification function can still apply it as a `T_app`. Applies to every kind — an `exists`/`unique` body that asserts nothing is P010, not P001 |
   | P011 | A call from any specification body to an `exists`/`unique`-quantified spec function. Such a function is the subject of a reachability judgment about running its own body with its own choices — not a callable predicate — and its compiled form carries hidden trailing choice parameters no call site supplies. State the property directly, or move the shared part into an ordinary function both spec functions can call |
   | P012 | An anonymous (call-argument) `@` in a `unique`-quantified body: a choice nothing names has no source-visible face, so it cannot distinguish exit states — bind it first (`let c: i32 = @;`). Legal in `exists` bodies, where the visible-locals projection is inert |
+  | P013 | An aggregate introduction — a compound `@`, a compound parameter, or an array/struct literal — whose scalar leaves would push the specification function past `SPEC_FN_MAX_QUANTIFIED_LEAVES` (64). A quantified leaf brings a binder and a typing guard, one assertion-tree level each, and a literal's leaves still nest one level apiece through a leafwise comparison; the levels accumulate across every introduction in the function, so the budget is a per-function running total rather than a per-introduction cap, and it is checked from the declared type before any leaf is materialized |
+  | P014 | A constant-*folded* array index that is out of bounds — `const K: i32 = 5; a[K]`, or `a[1 + 4]`, on `[i32; 3]`. States the same fact analysis rule A037 states for a direct-literal index; A037's pattern requires the literal directly under the access, so a named or computed constant reaches the translator even with analysis on, and the codegen paths that skip analysis make this the only guard for any of the spellings |
 
 - **The reachability pre-scan's no-return rule** (fatal,
   `core/wasm-codegen/src/hassert/reach.rs`): an `exists`/`unique` body
@@ -1197,12 +1200,20 @@ If a downstream proof consumed either of the earlier shapes:
 ## Translation scheme summary
 
 Each specification free function translates to one `hassert` via a
-right-folded statement translator with three modes
+right-folded statement translator with four modes
 (`core/wasm-codegen/src/hassert/translate.rs`): universal
-(`Mode::Univ`, a `forall`/plain body's own statements), existential
-(`Mode::Exist`, statements inside a nested `exists` block), and
+(`Mode::Univ`, a `forall`/plain body's own statements), nested universal
+(`Mode::UnivLvl`, a `forall` block inside an `exists`/`assume` context),
+existential (`Mode::Exist`, statements inside a nested `exists` block), and
 reachability (`Mode::Reach`, the whole body of an `exists`/`unique`
-function). `Mode::Reach` reuses `Mode::Exist`'s statement semantics —
+function). `Mode::UnivLvl` keeps `Mode::Univ`'s statement semantics — an
+`assume` is an antecedent, an `if` a conjunction of guarded implications —
+but binds on the logical-variable channel instead of the slot channel: each
+`@` takes a `T_lvar` level under a `Hall` wrap, carrying its own
+`HA_has_type (T_lvar n)` guard. That is what keeps an alternating claim
+alternating; binding a nested `forall`'s `@` to a slot would read as
+`∀x ∃m` under `ValidSpec`'s outer universal, silently weakening the
+claim the source wrote. `Mode::Reach` reuses `Mode::Exist`'s statement semantics —
 an `assume` block is a conjunct, an `if` a strict disjunction of guarded
 conjunctions — but binds every `@` to the `T_local` slot of its own
 choice parameter (no `HA_ex` binder, no `HA_has_type` guard; see
@@ -1213,7 +1224,13 @@ The table below shows the two payload polarities:
 | --- | --- | --- |
 | Parameter / forall-context `@` | `T_local` slot (sequential, never rewound), plus a pending `HA_has_type (T_local i) T_i32`/`T_i64` typing guard for the slot (64-bit for `i64`/`u64`, i32 for every other scalar) | — |
 | Pending slot guards | Discharged at the next structural statement: fused into an immediately-following `assume`'s antecedent as `HA_and (guard, …, assume-body)`, otherwise an `Himpl` antecedent over the statement's claim conjoined with the rest of the block; a slot introduced after the last structural statement guards nothing (an unread slot introduced earlier is still guarded — uniformity beats a use analysis). A pure `let`/`const` is not structural, but one that binds a short-circuit witness drains here too, so the guard dominates the `HA_ex` instead of sitting inside it — the witness constraint reads the very slot the guard types | — (a prover-chosen `HA_ex` variable needs no typing guard) |
-| Call-argument / `let`-bound `@` | (not applicable — only forall context takes slots) | `HA_ex` binder at the binding point; body uses `T_lvar` at its de Bruijn index, resolved by a final level-to-index pass (no shifting needed while building) |
+| Call-argument / `let`-bound `@` | `Mode::Univ` takes a slot as above; under `Mode::UnivLvl` it takes a `Hall` binder instead, with its `HA_has_type (T_lvar n)` guard as that binder's own antecedent | `HA_ex` binder at the binding point; body uses `T_lvar` at its de Bruijn index, resolved by a final level-to-index pass (no shifting needed while building) |
+| Universal binder (`Mode::UnivLvl`) | `Hall` (the derived `HA_not (HA_ex (HA_not _))`, declared in the stub) wrapping the rest of the block; an aggregate `@` binds one level per scalar leaf, each guarded. **A `T_lvar` guard must be drained inside its own `Hall`**: `term_unsafe d (T_lvar n)` holds once the index escapes its binder, and `strictify` then collapses that guard to `HA_false`, deleting the antecedent and leaving a strictly harder obligation that still compiles. Guard placement here is a soundness-of-meaning rule, not a formatting choice | — |
+| Aggregate introduction (compound `@`, compound parameter, array/struct literal) | No aggregate term exists: the value becomes a shape-preserving tree of scalar leaves, one slot and one `HA_has_type` guard per leaf in enumeration order (arrays row-major, struct fields in layout order, recursing). Allocation across a function is parameters in declaration order, then each `@` in binding order. A literal's leaves are constants — no slot, no guard — but still count against the budget, since a leafwise comparison nests one conjunct per leaf whichever side it came from. Capped at 64 leaves per spec function (`P013`) | One `HA_ex` binder per leaf, consecutive levels, the block's translation wrapped in that many binders; no typing guard, since a prover-chosen value states none |
+| Aggregate *copy* (`let b = a;`) | Clones the bound leaf tree — value-copy semantics make the pure inlining exact. No slot, no guard, no binder, and nothing charged to the leaf budget | same |
+| `e.f`, `e[k]` with a foldable constant `k` | Resolved at translation time against the leaf tree; the access never appears in the obligation, only the selected leaf's term. A folded out-of-bounds `k` is `P014` | same |
+| `e[i]` with a non-constant `i` | A fresh `HA_ex` witness `v` pinned by `HA_and (nz (relop LtU i N)) (⋀_{c<N} Himpl (term_eq i c) (term_eq v (leaf c)))` — the unsigned range bound **first**, then one implication per element. Out of range the definition is unsatisfiable and the enclosing atom is refuted: `a[i]` denotes *the element at index `i`, which exists*. Constant steps of a chain descend first, so `m[1][j]` splits over the selected row. Two `P002`s guard the shape: a chain with two non-constant steps (the split would be their product), and a chain whose non-constant step selects an aggregate rather than a scalar leaf (there is no single term for the cases to define) | same |
+| `a == b` / `a != b` at aggregate type, assertion position | Leafwise: the conjunction of per-leaf `term_eq`, or its De Morgan dual for the negation. `==` compares values, and an aggregate's value is exactly its ordered scalar leaves | same |
 | `assume { … }` | Implication antecedent (`Himpl`) | Conjunct (`HA_and`) |
 | `if c { A } else { B }` | `HA_and (Himpl (nz c) A') (Himpl (eqz c) B')` | Strict `HA_or (HA_and (nz c) A') (HA_and (eqz c) B')` — no witness is fabricated via undefinedness |
 | `&&` (assertion position) | `HA_and (left', HA_and (Cᵣ, right'))` | same |
@@ -1226,6 +1243,32 @@ The table below shows the two payload polarities:
 | A call in term position | `T_app` (single scalar result required) | same |
 | A bare call statement | `HA_app_ok`, any result arity | same |
 
+The `==`/`!=` split in that table is deliberate, not an oversight, and a
+consumer feels it: an assumption `a[0] != 3` arrives as "the `ne` relop is
+nonzero" while a leafwise aggregate conclusion is stated with `term_eq`, so a
+proof relating the two pays a bridging step.
+
+The rule behind the split is **positional, not operator-wise**. The existential
+column above — which `Mode::Reach` shares — holds the positions that *pin* a
+value: an existential
+`@`'s witness, and — since an `assume` body translates existentially even inside
+a `forall` function — the antecedent of a universal claim. `term_eq` is the
+pinning form, so `==` takes it in those positions and the refutable relop in a
+claim position; that is why the same operator appears in both columns with
+different encodings. `!=` pins nothing — there is no value it names, only a
+computation whose result must be nonzero — so it stays with the operator the
+program executes, at that operator's own width and signedness. Encoding it as
+`¬term_eq` would state a disequality of mathematical values where the program
+compares two registers, the same class of divergence the eager `&&`/`||` term
+had before it became a pinned witness. The bridging step is the cost of that
+fidelity.
+
+Aggregate `==`/`!=` is not an exception to that rule but a different question,
+answered by the language rather than by the encoding: `==` at aggregate type
+compares *values*, and an aggregate's value is its ordered scalar leaves, so it
+is leafwise in every mode. The compiled comparison of frame pointers is the side
+that must change; it is tracked as a separate defect.
+
 The binary-operator table (`+`, `-`, `*`, `/`, `%`, bitwise, shifts,
 comparisons) mirrors `lower_binary_expression` exactly: number class and
 signedness come from the left operand's type, sub-word results are
@@ -1274,6 +1317,11 @@ whole translation.
   against locally, and how the `coqc` gate uses it.
 - `core/hassert/src/ir.rs`, `core/hassert/src/codec.rs` — the `HAssert`/
   `HTerm` IR and the `inference.hspecs` wire format.
+- [`core/wasm-codegen/docs/specification-obligations.md`](../wasm-codegen/docs/specification-obligations.md)
+  — the same translation read from the specification author's side: what
+  each construct becomes, which slot each value gets, and which
+  properties are provable as a result. Start there if you are reading an
+  emitted obligation because a proof did not close.
 - `core/wasm-codegen/src/hassert/` — the specification-to-`hassert`
   translation pass and its `P0xx` diagnostics.
 - `core/wasm-to-v/src/translator.rs`, `src/hassert_print.rs` — the
diff --git a/core/wasm-to-v/rocq-stub/README.md b/core/wasm-to-v/rocq-stub/README.md
index 984762b6..1383e04d 100644
--- a/core/wasm-to-v/rocq-stub/README.md
+++ b/core/wasm-to-v/rocq-stub/README.md
@@ -49,7 +49,7 @@ Two logical namespaces, mapped by `_CoqProject`:
 | `wasm/numerics.v` | `i32`/`i64`, `Wasm_int.int_of_Z`, `i32m`/`i64m` (used by `Vi32`/`Vi64`) | Vanilla WasmCert |
 | `wasm/datatypes.v` | Value/number/reference types, integer operator families, `memarg`, the `basic_instruction` inductive, and the module/section records | Vanilla WasmCert |
 | `wasm/host.v` | The `host` typeclass every emitted theorem is stated under (`Class host := {}`) | Vanilla WasmCert |
-| `wasm_verifier/Assertions.v` | The `term`/`hassert` inductives and the `term_eq`/`Himpl`/`Hor` sugar — the emittable subset of wasm-verifier's `Assertions.v`, see [Narrowed to what the emitter can print](#narrowed-to-what-the-emitter-can-print) | wasm-verifier, `Assertions.v` |
+| `wasm_verifier/Assertions.v` | The `term`/`hassert` inductives and the `term_eq`/`Himpl`/`Hor`/`Hall` sugar — the emittable subset of wasm-verifier's `Assertions.v`, see [Narrowed to what the emitter can print](#narrowed-to-what-the-emitter-can-print) | wasm-verifier, `Assertions.v` |
 | `wasm_verifier/Verifier.v` | `Parameter ValidModule : module -> Prop` and `Parameter ValidSpec : forall `{ho:host}, module -> list hassert -> Prop`, the two predicates every emitted module's theorems reference (the reachability pair lives in `Exists.v`) | wasm-verifier, `Verifier.v` |
 | `wasm_verifier/Exists.v` | The concrete `Record reachability_spec` (a `Parameter` type has no fields to elaborate the emitted `{| … |}` literals against) and the `ValidExistsSpec`/`ValidUniqueSpec` predicates the kind-selected theorems for `exists`/`unique`-bodied spec functions reference | wasm-verifier, `theories/Exists.v` |
 | `_CoqProject` | Maps both physical directories to their logical library names | — |
@@ -201,7 +201,7 @@ drift out of agreement with the real library and the gate still goes
 green — precisely the [#230] failure class this stub exists to catch. So
 under [#401] the assertion layer was cut down to the names the emitter
 can actually print. Everything left in `Assertions.v` is now reachable
-from some fixture in the gate's corpus; these seven were removed:
+from some fixture in the gate's corpus; these six were removed:
 
 | Removed declaration | Kind | Why the emitter cannot produce it |
 | --- | --- | --- |
@@ -211,21 +211,30 @@ from some fixture in the gate's corpus; these seven were removed:
 | `HA_iter : term -> term -> hassert -> hassert` | `hassert` constructor — iterated heap fragment | Heap fragment: no `HAssert` variant, no assertion tag, no printer arm; the memory constructs behind it are rejected as **P002**. |
 | `HA_pto : term -> term -> hassert` | `hassert` constructor — points-to | Heap fragment: no `HAssert` variant, no assertion tag, no printer arm; the memory constructs behind it are rejected as **P002**. |
 | `HA_size : term -> hassert` | `hassert` constructor — heap/memory size | Heap fragment: no `HAssert` variant, no assertion tag, no printer arm; the memory constructs behind it are rejected as **P002**. |
-| `Hall (body : hassert) : hassert` | sugar `Definition` — universal quantifier | No `HAssert` variant, no assertion tag, no printer arm. The one construct that would need it is a `forall` block nested inside an `exists` context, which code generation rejects as **P007**. |
+
+`Hall` was the seventh row until the universal binder became emittable:
+a `forall` block nested inside an `exists` context now translates rather
+than raising **P007**, so `Assertions.v` declares
+`Hall (body : hassert) : hassert` again and
+`spec_quantifier_alternation.inf` is its corpus producer. **P007**
+survives only for a `forall` block inside an `exists`/`unique`-quantified
+body, where the nested block would have to bind a universal variable over
+choices the reachability judgment quantifies operationally — a rejection
+about the reachability ABI, not about the assertion language, so it no
+longer keeps any name off this stub.
 
 "Cannot produce" is three mechanical facts per row, not a judgement
 call. `core/hassert/src/ir.rs` has no `HTerm`/`HAssert` variant for any
-of the seven. `core/hassert/src/codec.rs` decodes a **closed** tag table
-— assertions `0x00`–`0x0A`, terms `0x00`–`0x05`, anything else is a
+of the six. `core/hassert/src/codec.rs` decodes a **closed** tag table
+— assertions `0x00`–`0x0B`, terms `0x00`–`0x05`, anything else is a
 `DecodeError::UnknownHassertTag`/`UnknownTermTag` — and no tag in it
 yields one. `core/wasm-to-v/src/hassert_print.rs` matches both IR enums
 exhaustively and has no arm that could write one of these names. The
-`P002`/`P007` rejections in the table are the *fourth* line of defense,
-not the load-bearing one: they explain why the IR was designed without
-the variants in the first place. Both rejections are mode-independent —
-a memory construct in an `exists`/`unique` (reachability) body is the
-same `P002`, and a `forall` block nested in one the same `P007` — so
-the reachability kinds opened no path to any of the seven.
+`P002` rejections in the table are the *fourth* line of defense, not the
+load-bearing one: they explain why the IR was designed without the
+variants in the first place. That rejection is mode-independent — a
+memory construct in an `exists`/`unique` (reachability) body is the same
+`P002` — so the reachability kinds opened no path to any of the six.
 
 `HA_pred` and `pred_eq` stay, even though the printer never writes
 either name. `term_eq`, which it writes constantly, is defined as
@@ -237,37 +246,35 @@ sugar rather than by name.
 
 ### Checklist for the real-library swap-in ([#359])
 
-Whoever wires the real libraries in inherits three consequences of this
-narrowing. None of them is a blocker; all three are easy to get subtly
-wrong.
+Whoever wires the real libraries in inherits two consequences of this
+narrowing. Neither is a blocker; both are easy to get subtly wrong.
 
-- **The stub-drift check must treat exactly these seven rows as the
-  expected deltas, and fail on an eighth.** The point of a narrowed stub
+- **The stub-drift check must treat exactly these six rows as the
+  expected deltas, and fail on a seventh.** The point of a narrowed stub
   is only worth having if the narrowing is itself pinned: a mechanical
   comparison against the real `Assertions.v` should assert that the set
   of declarations present there and absent here is *precisely* the table
-  above. An eighth missing name means either the real library grew
+  above. A seventh missing name means either the real library grew
   something this stub should mirror, or someone quietly deleted a
   reachable declaration — both are failures, and neither is visible if
   the check only asks "is the stub a subset?".
-- **Pointing `-Q` at the real `theories/` restores all seven, and that
+- **Pointing `-Q` at the real `theories/` restores all six, and that
   is a widening, not a break.** The real library declares the full
   assertion language; compiling the same corpus against it will simply
-  have seven more names in scope that nothing mentions. No emitted module
+  have six more names in scope that nothing mentions. No emitted module
   changes, no fixture needs touching. What is lost in the swap is the
   narrowing's *secondary* benefit — an accidental `HA_pto` becoming an
   unbound-constructor error locally — so if that guard is wanted after
   the swap, it has to move somewhere that still enforces it (the emitter,
   or the drift check above), because the real library will happily accept
   it.
-- **Lifting P007 puts `Hall` back on the emitted surface, so its
-  `Definition` must return in the same change.** Supporting a `forall`
-  nested inside an `exists` means the printer starts writing `Hall` by
-  name; against this stub that is an immediate unbound-constructor error.
-  Re-add `Definition Hall (body : hassert) : hassert := HA_not (HA_ex
-  (HA_not body)).`, drop its row from the table above, and add a corpus
-  fixture that actually emits it — the same three steps any other newly
-  reachable declaration needs.
+
+`Hall`'s return is the worked example of the reverse move, and the
+template for the next name that becomes emittable: a `Definition`
+restored here, its row dropped from the table above, and a corpus fixture
+that actually emits it — because a declaration nothing produces is a
+declaration `coqc` never elaborates, which is the state this narrowing
+exists to prevent.
 
 ## Follow-up: swap in the real libraries
 
diff --git a/core/wasm-to-v/rocq-stub/wasm_verifier/Assertions.v b/core/wasm-to-v/rocq-stub/wasm_verifier/Assertions.v
index 8509a3cc..f3896d71 100644
--- a/core/wasm-to-v/rocq-stub/wasm_verifier/Assertions.v
+++ b/core/wasm-to-v/rocq-stub/wasm_verifier/Assertions.v
@@ -61,11 +61,11 @@ Definition pred_eq : nat := 0.
 (* Term-equality assertion  tau1 = tau2. *)
 Definition term_eq (a b : term) : hassert := HA_pred pred_eq (a :: b :: nil).
 
-(* [hassert] has no primitive implication or disjunction constructor; these are
-   the standard classical De Morgan encodings, mirrored as
-   definitionally-transparent Definitions so the emitter can print them by
-   name. The library's matching universal-quantifier sugar [Hall] is not
-   declared: the only construct that would emit it is a `forall` block nested
-   inside an `exists` context, which code generation rejects as P007. *)
+(* [hassert] has no primitive implication, disjunction or universal-quantifier
+   constructor; these are the standard classical De Morgan encodings, mirrored
+   as definitionally-transparent Definitions so the emitter can print them by
+   name. [Hall]'s body binds logical de Bruijn index 0, exactly like the
+   [HA_ex] it is built from. *)
 Definition Himpl (p q : hassert) : hassert := HA_not (HA_and p (HA_not q)).
 Definition Hor (p q : hassert) : hassert := HA_not (HA_and (HA_not p) (HA_not q)).
+Definition Hall (body : hassert) : hassert := HA_not (HA_ex (HA_not body)).
diff --git a/core/wasm-to-v/src/hassert_print.rs b/core/wasm-to-v/src/hassert_print.rs
index e0c592a0..b8e84118 100644
--- a/core/wasm-to-v/src/hassert_print.rs
+++ b/core/wasm-to-v/src/hassert_print.rs
@@ -5,10 +5,11 @@
 //! carries each applied function symbol to its `mod_funcs` index (computed by
 //! the translator against the emitted module's function layout). The printer
 //! mirrors the wasm-verifier `Assertions.v` constructors one-to-one, with the
-//! only sugar being the three definitionally-transparent forms the IR keeps
+//! only sugar being the four definitionally-transparent forms the IR keeps
 //! explicit: [`HAssert::TermEq`] → `term_eq`, [`HAssert::Imp`] → `Himpl`,
-//! [`HAssert::Or`] → `Hor`. Every compound argument is parenthesized, so the
-//! output is unambiguous regardless of Gallina's application/precedence rules.
+//! [`HAssert::Or`] → `Hor`, [`HAssert::All`] → `Hall`. Every compound argument
+//! is parenthesized, so the output is unambiguous regardless of Gallina's
+//! application/precedence rules.
 
 use crate::gallina::z_literal;
 use inference_hassert::{HAssert, HBinop, HConst, HFnRef, HNumType, HRelop, HTerm};
@@ -30,7 +31,7 @@ pub(crate) fn print_assert(a: &HAssert, resolved: &FxHashMap<String, u32>) -> St
 pub(crate) fn collect_symbols<'a>(a: &'a HAssert, acc: &mut Vec<&'a str>) {
     match a {
         HAssert::True | HAssert::False => {}
-        HAssert::Not(x) | HAssert::Ex(x) => collect_symbols(x, acc),
+        HAssert::Not(x) | HAssert::Ex(x) | HAssert::All(x) => collect_symbols(x, acc),
         HAssert::And(l, r) | HAssert::Imp(l, r) | HAssert::Or(l, r) => {
             collect_symbols(l, acc);
             collect_symbols(r, acc);
@@ -74,6 +75,7 @@ fn assert_str(a: &HAssert, r: &FxHashMap<String, u32>) -> String {
         HAssert::Imp(l, rr) => format!("Himpl {} {}", paren_assert(l, r), paren_assert(rr, r)),
         HAssert::Or(l, rr) => format!("Hor {} {}", paren_assert(l, r), paren_assert(rr, r)),
         HAssert::Ex(body) => format!("HA_ex {}", paren_assert(body, r)),
+        HAssert::All(body) => format!("Hall {}", paren_assert(body, r)),
         HAssert::TermEq(l, rr) => format!("term_eq {} {}", paren_term(l, r), paren_term(rr, r)),
         HAssert::HasType(t, ty) => format!("HA_has_type {} {}", paren_term(t, r), numtype(*ty)),
         HAssert::Defined(t) => format!("HA_defined {}", paren_term(t, r)),
diff --git a/tests/src/codegen/wasm/multi_file.rs b/tests/src/codegen/wasm/multi_file.rs
index 44a924bc..66e5619c 100644
--- a/tests/src/codegen/wasm/multi_file.rs
+++ b/tests/src/codegen/wasm/multi_file.rs
@@ -376,10 +376,12 @@ spec LibSpec {
 #[test]
 fn field_position_uzumaki_with_qualified_cross_file_struct_is_rejected() {
     // A field-position uzumaki on a qualified cross-file struct type
-    // (`lib::geom::Point { x: @, y: @ }`) inside a spec's `forall`: the struct
-    // literal and the subsequent `p.x` field access have no `hassert` encoding,
-    // so proof-mode codegen rejects the spec with `P002` (previously it produced
-    // WASM because the obligation pass was additive; the flip makes it fatal).
+    // (`lib::geom::Point { x: @, y: @ }`) inside a spec's `forall`: the
+    // qualified literal itself now resolves and binds a leaf value tree
+    // (cross-file struct types classify exactly like local ones), but `@` is
+    // an introduction form only where a `let` or a call argument binds it —
+    // a literal field is neither, so proof-mode codegen rejects each
+    // field-position `@` with `P006`.
     let main = "\
 use lib::geom;
 
@@ -395,10 +397,10 @@ pub fn main() {}
     let geom = "pub struct Point { x: i32; y: i32; }";
 
     let err = try_proof_codegen_multi_file(&[(vec![], main), (vec!["lib", "geom"], geom)])
-        .expect_err("a struct-valued cross-file spec body has no assertion encoding");
+        .expect_err("a field-position uzumaki has no binding to introduce it");
     assert!(
-        err.to_string().contains("P002"),
-        "expected a P002 rejection for the struct construct; got:\n{err}"
+        err.to_string().contains("P006"),
+        "expected a P006 rejection for each field-position uzumaki; got:\n{err}"
     );
 }
 
diff --git a/tests/src/hassert_translation.rs b/tests/src/hassert_translation.rs
index b2b5536e..759a56cc 100644
--- a/tests/src/hassert_translation.rs
+++ b/tests/src/hassert_translation.rs
@@ -92,6 +92,9 @@ fn imp(a: HAssert, b: HAssert) -> HAssert {
 fn ex(a: HAssert) -> HAssert {
     HAssert::Ex(Box::new(a))
 }
+fn all(a: HAssert) -> HAssert {
+    HAssert::All(Box::new(a))
+}
 fn teq(a: HTerm, b: HTerm) -> HAssert {
     HAssert::TermEq(a, b)
 }
@@ -440,3 +443,281 @@ spec prime_properties {
     let output = codegen_output(source);
     assert!(output.hspecs().is_empty());
 }
+
+/// The issue's acceptance shape survives the whole pipeline: a compound `@`
+/// binds one guarded universal slot per scalar leaf, and the constant-index
+/// read is that leaf's term.
+#[test]
+fn aggregate_uzumaki_produces_leaf_slots_end_to_end() {
+    let source = "\
+spec Agg {
+  fn leaf_bounds() forall {
+    let a: [i32; 3] = @;
+    assert(a[0] <= a[0]);
+  }
+}
+";
+    let expected = imp(
+        and(
+            hastype(local(0), HNumType::I32),
+            and(
+                hastype(local(1), HNumType::I32),
+                hastype(local(2), HNumType::I32),
+            ),
+        ),
+        nz(rel(HRelop::LeS, local(0), local(0))),
+    );
+    assert_eq!(sole_obligation(&proof_hspecs(source), "Agg"), expected);
+}
+
+/// A struct parameter leaf-expands through real code generation — the
+/// compiled function keeps its single pointer parameter while the payload
+/// quantifies one slot per scalar leaf, at each leaf's own width.
+#[test]
+fn struct_parameter_leaves_carry_their_widths_end_to_end() {
+    let source = "\
+struct Rec {
+  lo: i32;
+  wide: i64;
+  row: [i32; 2];
+}
+
+spec Agg {
+  fn record(r: Rec) forall {
+    assert(r.wide > r.wide - 1);
+  }
+}
+";
+    let expected = imp(
+        and(
+            hastype(local(0), HNumType::I32),
+            and(
+                hastype(local(1), HNumType::I64),
+                and(
+                    hastype(local(2), HNumType::I32),
+                    hastype(local(3), HNumType::I32),
+                ),
+            ),
+        ),
+        nz(rel64(
+            HRelop::GtS,
+            local(1),
+            HTerm::Binop(
+                HNumType::I64,
+                HBinop::Sub,
+                Box::new(local(1)),
+                Box::new(i64c(1)),
+            ),
+        )),
+    );
+    assert_eq!(sole_obligation(&proof_hspecs(source), "Agg"), expected);
+}
+
+/// Aggregate equality is leafwise through the whole pipeline, and a bound
+/// literal's leaves are its own translated constants. (The literal is bound
+/// by a `let` rather than written as a comparison operand because the
+/// executable lowering of the same body only places a literal where an
+/// enclosing variable names its frame slot.)
+#[test]
+fn aggregate_equality_is_leafwise_end_to_end() {
+    let source = "\
+spec Agg {
+  fn pinned() forall {
+    let a: [i32; 2] = @;
+    let b: [i32; 2] = [1, 2];
+    assert(a == b);
+  }
+}
+";
+    let expected = imp(
+        and(
+            hastype(local(0), HNumType::I32),
+            hastype(local(1), HNumType::I32),
+        ),
+        and(teq(local(0), i32c(1)), teq(local(1), i32c(2))),
+    );
+    assert_eq!(sole_obligation(&proof_hspecs(source), "Agg"), expected);
+}
+
+/// The constraint a non-constant index pins its element with, built
+/// independently of the pass: the unsigned range bound first, then one
+/// implication per element.
+fn element_def(index: &HTerm, witness: &HTerm, leaves: &[HTerm]) -> HAssert {
+    let extent = i32::try_from(leaves.len()).expect("test extents are small");
+    let cases = leaves
+        .iter()
+        .enumerate()
+        .rev()
+        .fold(HAssert::True, |acc, (case, leaf)| {
+            let case = i32::try_from(case).expect("test extents are small");
+            HAssert::and(
+                imp(
+                    teq(index.clone(), i32c(case)),
+                    teq(witness.clone(), leaf.clone()),
+                ),
+                acc,
+            )
+        });
+    and(nz(rel(HRelop::LtU, index.clone(), i32c(extent))), cases)
+}
+
+/// The issue's bounded-iteration acceptance shape survives the whole pipeline:
+/// an array `@`, an index `@`, a range `assume`, and a claim about the element
+/// at that index. The element is a fresh binder defined by the index's
+/// unsigned range and one case per element, and the definition is conjoined
+/// with the claim — which is what makes an out-of-range index refute the
+/// obligation rather than discharge it vacuously.
+#[test]
+fn bounded_iteration_pins_its_element_by_cases_end_to_end() {
+    let source = "\
+spec Iter {
+  fn element_defined() forall {
+    let a: [i32; 3] = @;
+    let i: i32 = @;
+    assume { assert(0 <= i && i < 3); }
+    assert(a[i] == a[i]);
+  }
+}
+";
+    let leaves = [local(0), local(1), local(2)];
+    // Both reads bind their own witness; each reads as de Bruijn index 0
+    // inside its own binder.
+    let definition = || element_def(&local(3), &lvar(0), &leaves);
+    let filter = and(
+        nz(rel(HRelop::LeS, i32c(0), local(3))),
+        nz(rel(HRelop::LtS, local(3), i32c(3))),
+    );
+    let expected = imp(
+        and(
+            hastype(local(0), HNumType::I32),
+            and(
+                hastype(local(1), HNumType::I32),
+                and(
+                    hastype(local(2), HNumType::I32),
+                    and(hastype(local(3), HNumType::I32), filter),
+                ),
+            ),
+        ),
+        ex(and(
+            definition(),
+            ex(and(definition(), nz(rel(HRelop::Eq, lvar(1), lvar(0))))),
+        )),
+    );
+    assert_eq!(sole_obligation(&proof_hspecs(source), "Iter"), expected);
+}
+
+/// A constant step of an access chain descends before the non-constant one, so
+/// `m[1][j]` splits over the two elements of row `[1]` rather than over the
+/// four elements of the matrix.
+#[test]
+fn a_constant_step_descends_before_the_non_constant_one_end_to_end() {
+    let source = "\
+spec Iter {
+  fn matrix_row(j: i32) forall {
+    let m: [[i32; 2]; 2] = @;
+    assert(m[1][j] == m[1][0]);
+  }
+}
+";
+    // Slot 0 is the declared parameter `j`; the matrix takes slots 1..4.
+    let definition = element_def(&local(0), &lvar(0), &[local(3), local(4)]);
+    let expected = imp(
+        and(
+            hastype(local(0), HNumType::I32),
+            and(
+                hastype(local(1), HNumType::I32),
+                and(
+                    hastype(local(2), HNumType::I32),
+                    and(
+                        hastype(local(3), HNumType::I32),
+                        hastype(local(4), HNumType::I32),
+                    ),
+                ),
+            ),
+        ),
+        ex(and(definition, nz(rel(HRelop::Eq, lvar(0), local(3))))),
+    );
+    assert_eq!(sole_obligation(&proof_hspecs(source), "Iter"), expected);
+}
+
+/// Quantifier alternation survives the whole pipeline: a `forall` block nested
+/// inside an `exists` block binds a universal *logical variable* under the
+/// existential witness, with its typing stated as an antecedent inside its own
+/// binder.
+///
+/// The nesting order is the claim. A slot standing in for the inner `forall`
+/// would be quantified by the downstream judgment — outside the `HA_ex` — and
+/// `∃k. ∀x` would silently read as `∀x. ∃k`, which is a different and weaker
+/// property.
+#[test]
+fn quantifier_alternation_nests_a_universal_under_an_existential_end_to_end() {
+    let source = "\
+spec Alt {
+  fn additive_identity() forall {
+    exists {
+      let k: i32 = @;
+      assume { assert(k == 0); }
+      forall {
+        let x: i32 = @;
+        assert(x + k == x);
+      }
+    }
+  }
+}
+";
+    let expected = ex(and(
+        teq(lvar(0), i32c(0)),
+        all(imp(
+            hastype(lvar(0), HNumType::I32),
+            nz(rel(
+                HRelop::Eq,
+                HTerm::Binop(
+                    HNumType::I32,
+                    HBinop::Add,
+                    Box::new(lvar(0)),
+                    Box::new(lvar(1)),
+                ),
+                lvar(0),
+            )),
+        )),
+    ));
+    assert_eq!(sole_obligation(&proof_hspecs(source), "Alt"), expected);
+}
+
+/// The alternation fixture the `coqc` corpus compiles also translates through
+/// real code generation, and every one of its obligations carries a universal
+/// binder — the fixture is the gate's only producer of one, so a body that
+/// stopped emitting it would leave that stub declaration unelaborated.
+#[test]
+fn quantifier_alternation_fixture_emits_a_universal_binder_in_every_obligation() {
+    let map = proof_hspecs(&read_inf("spec_quantifier_alternation.inf"));
+    let entries = map
+        .get("QuantifierAlternation")
+        .expect("the alternation spec must produce obligations");
+    assert_eq!(entries.len(), 6, "one obligation per spec free function");
+    for entry in entries {
+        assert!(
+            binds_a_universal(&entry.hassert),
+            "`{}` must bind a universal logical variable: {:?}",
+            entry.fn_symbol.0,
+            entry.hassert
+        );
+    }
+}
+
+/// Whether the tree binds a universal logical variable anywhere.
+fn binds_a_universal(a: &HAssert) -> bool {
+    match a {
+        HAssert::All(_) => true,
+        HAssert::Not(x) | HAssert::Ex(x) => binds_a_universal(x),
+        HAssert::And(l, r) | HAssert::Imp(l, r) | HAssert::Or(l, r) => {
+            binds_a_universal(l) || binds_a_universal(r)
+        }
+        HAssert::True
+        | HAssert::False
+        | HAssert::TermEq(_, _)
+        | HAssert::HasType(_, _)
+        | HAssert::Defined(_)
+        | HAssert::AppOk(_, _) => false,
+    }
+}
diff --git a/tests/src/rocq_typecheck.rs b/tests/src/rocq_typecheck.rs
index 000c9e58..eecf6754 100644
--- a/tests/src/rocq_typecheck.rs
+++ b/tests/src/rocq_typecheck.rs
@@ -56,9 +56,14 @@ mod gate {
     /// `core/wasm-codegen/src/hassert/tests.rs` and end-to-end by
     /// `build_v_rejects_unique_block_with_p002` in `apps/infs`).
     ///
-    /// The last two entries exist for operator coverage rather than for a proof
-    /// shape: between them they put every arithmetic, bitwise, shift and
-    /// comparison operator the obligation printer can spell into a fixture
+    /// `spec_quantifier_alternation.inf` is the sole producer of the `Hall`
+    /// universal-binder sugar: only a `forall` block nested inside an
+    /// existential context emits one, so without this fixture that stub
+    /// declaration would never be elaborated by the compile below.
+    ///
+    /// The operator-matrix entries exist for operator coverage rather than for
+    /// a proof shape: between them they put every arithmetic, bitwise, shift
+    /// and comparison operator the obligation printer can spell into a fixture
     /// `coqc` elaborates. They are split by theme rather than merged because a
     /// gate failure should name the operator family it is about (#401).
     const CORPUS: &[(&str, &str)] = &[
@@ -81,6 +86,12 @@ mod gate {
         ("rocq_exists_spec.inf", "rocq_exists_spec"),
         ("rocq_unique_spec.inf", "rocq_unique_spec"),
         ("spec_mixed_kinds.inf", "spec_mixed_kinds"),
+        ("spec_aggregate_values.inf", "spec_aggregate_values"),
+        ("spec_bounded_iteration.inf", "spec_bounded_iteration"),
+        (
+            "spec_quantifier_alternation.inf",
+            "spec_quantifier_alternation",
+        ),
     ];
 
     /// Constructs the corpus must keep exercising, in the emitted `.v`. Two
@@ -135,6 +146,12 @@ mod gate {
         "T_app ",
         "T_local ",
         "HA_ex",
+        // The universal binder, reached only by a `forall` block nested inside
+        // an existential context. `spec_quantifier_alternation.inf` is its sole
+        // producer, so without that fixture `coqc` would never elaborate the
+        // `Hall` Definition and a drift in it would pass unnoticed — the hole
+        // this needle list exists to keep closed.
+        "Hall ",
         "HA_has_type ",
         "BT_valtype (Some",
         // The reachability grammar, in its applied forms: the kind-selected
@@ -2530,6 +2547,196 @@ Definition a_definition (x : nat) : nat := x.
         );
     }
 
+    /// Committed `.v` golden for the aggregate-values fixture. Regenerate with
+    /// the `#[ignore]`d [`regenerate::regenerate_aggregate_values_v`] after an
+    /// intentional emitter change.
+    fn aggregate_values_golden_path() -> PathBuf {
+        get_test_data_path()
+            .join("rocq")
+            .join("spec_aggregate_values.v")
+    }
+
+    /// The proof-mode `.v` for the aggregate-values fixture must match a
+    /// committed golden byte-for-byte, and the golden must carry the leaf
+    /// encoding's contract shape: a compound `@` and a compound parameter
+    /// quantify one `T_local` slot per scalar leaf, each leading its
+    /// antecedent with an `HA_has_type` guard at the leaf's own width; an
+    /// aggregate `==` is a leafwise `term_eq` conjunction; an aggregate `@`
+    /// under an `exists` block binds nested `HA_ex` binders. No memory atom
+    /// exists to be emitted — the pure fragment is the whole encoding.
+    #[test]
+    fn spec_aggregate_values_matches_committed_v_golden() {
+        let generated = generate_v("spec_aggregate_values.inf", "spec_aggregate_values");
+        let golden_path = aggregate_values_golden_path();
+        let golden = std::fs::read_to_string(&golden_path).unwrap_or_else(|e| {
+            panic!(
+                "read {} ({e}); regenerate with \
+                 `cargo test -p inference-tests regenerate_aggregate_values_v -- --ignored`",
+                golden_path.display()
+            )
+        });
+        assert_eq!(
+            generated,
+            golden,
+            "proof-mode `.v` for spec_aggregate_values.inf drifted from the committed \
+             golden {}; if the emitter change was intentional, regenerate with \
+             `cargo test -p inference-tests regenerate_aggregate_values_v -- --ignored`",
+            golden_path.display()
+        );
+
+        // Contract shape, asserted independently of the byte compare so a
+        // future regeneration cannot launder an encoding regression into the
+        // committed file.
+        assert!(
+            golden.contains("HA_has_type (T_local 2%N) T_i32"),
+            "a 3-leaf array `@` must guard its third leaf slot:\n{golden}"
+        );
+        assert!(
+            golden.contains("HA_has_type (T_local 1%N) T_i64"),
+            "a struct's `i64` field leaf must be guarded at its own width:\n{golden}"
+        );
+        assert!(
+            golden.contains("term_eq (T_local 0%N) (T_local 2%N)"),
+            "aggregate `==` must be the leafwise `term_eq` of matching leaves:\n{golden}"
+        );
+        assert!(
+            golden.contains("HA_ex (HA_ex"),
+            "an aggregate `@` in an `exists` block must bind one nested `HA_ex` \
+             per leaf:\n{golden}"
+        );
+        assert!(
+            !golden.contains("HA_pto") && !golden.contains("HA_iter"),
+            "the leaf encoding is pure — no memory atom may appear:\n{golden}"
+        );
+    }
+
+    /// Committed `.v` golden for the bounded-iteration fixture. Regenerate
+    /// with the `#[ignore]`d [`regenerate::regenerate_bounded_iteration_v`]
+    /// after an intentional emitter change.
+    fn bounded_iteration_golden_path() -> PathBuf {
+        get_test_data_path()
+            .join("rocq")
+            .join("spec_bounded_iteration.v")
+    }
+
+    /// The proof-mode `.v` for the bounded-iteration fixture must match a
+    /// committed golden byte-for-byte, and the golden must carry the
+    /// non-constant index's contract shape: the element is a fresh `HA_ex`
+    /// binder whose definition leads with the *unsigned* range bound and then
+    /// names one case per element. The range bound is conjoined with the claim
+    /// rather than guarding it, which is what makes an out-of-range index
+    /// refute the obligation instead of discharging it vacuously.
+    #[test]
+    fn spec_bounded_iteration_matches_committed_v_golden() {
+        let generated = generate_v("spec_bounded_iteration.inf", "spec_bounded_iteration");
+        let golden_path = bounded_iteration_golden_path();
+        let golden = std::fs::read_to_string(&golden_path).unwrap_or_else(|e| {
+            panic!(
+                "read {} ({e}); regenerate with \
+                 `cargo test -p inference-tests regenerate_bounded_iteration_v -- --ignored`",
+                golden_path.display()
+            )
+        });
+        assert_eq!(
+            generated,
+            golden,
+            "proof-mode `.v` for spec_bounded_iteration.inf drifted from the committed \
+             golden {}; if the emitter change was intentional, regenerate with \
+             `cargo test -p inference-tests regenerate_bounded_iteration_v -- --ignored`",
+            golden_path.display()
+        );
+
+        // Contract shape, asserted independently of the byte compare so a
+        // future regeneration cannot launder an encoding regression into the
+        // committed file.
+        assert!(
+            golden.contains("T_relop T_i32 (Relop_i (ROI_lt SX_U))"),
+            "the element's range bound must be the term-level *unsigned* `<`; a signed \
+             comparison would leave a negative index unconstrained:\n{golden}"
+        );
+        assert!(
+            golden.contains(
+                "HA_ex (HA_and (HA_and (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_lt SX_U))"
+            ),
+            "the element is a fresh binder whose definition is *conjoined* with the claim and \
+             leads with the range bound — conjoined is what refutes an out-of-range index \
+             instead of discharging it vacuously:\n{golden}"
+        );
+        assert!(
+            golden.contains("Himpl (term_eq (T_local"),
+            "the element must be defined by cases over its index:\n{golden}"
+        );
+        assert!(
+            !golden.contains("HA_pto") && !golden.contains("HA_iter"),
+            "the element encoding is pure — no memory atom may appear:\n{golden}"
+        );
+    }
+
+    /// Committed `.v` golden for the quantifier-alternation fixture.
+    /// Regenerate with the `#[ignore]`d
+    /// [`regenerate::regenerate_quantifier_alternation_v`] after an intentional
+    /// emitter change.
+    fn quantifier_alternation_golden_path() -> PathBuf {
+        get_test_data_path()
+            .join("rocq")
+            .join("spec_quantifier_alternation.v")
+    }
+
+    /// The proof-mode `.v` for the quantifier-alternation fixture must match a
+    /// committed golden byte-for-byte, and the golden must carry the
+    /// alternation's contract shape: a `Hall` *inside* the enclosing `HA_ex`
+    /// (the other order is the swap the encoding exists to prevent), a typing
+    /// guard for the universal variable stated as an antecedent within its own
+    /// binder, and one `Hall` per scalar leaf of an aggregate `@`.
+    #[test]
+    fn spec_quantifier_alternation_matches_committed_v_golden() {
+        let generated = generate_v(
+            "spec_quantifier_alternation.inf",
+            "spec_quantifier_alternation",
+        );
+        let golden_path = quantifier_alternation_golden_path();
+        let golden = std::fs::read_to_string(&golden_path).unwrap_or_else(|e| {
+            panic!(
+                "read {} ({e}); regenerate with \
+                 `cargo test -p inference-tests regenerate_quantifier_alternation_v -- --ignored`",
+                golden_path.display()
+            )
+        });
+        assert_eq!(
+            generated,
+            golden,
+            "proof-mode `.v` for spec_quantifier_alternation.inf drifted from the committed \
+             golden {}; if the emitter change was intentional, regenerate with \
+             `cargo test -p inference-tests regenerate_quantifier_alternation_v -- --ignored`",
+            golden_path.display()
+        );
+
+        // Contract shape, asserted independently of the byte compare so a
+        // future regeneration cannot launder an encoding regression into the
+        // committed file.
+        assert!(
+            golden.contains("HA_ex (HA_and (term_eq (T_lvar 0) (T_const (Vi32 0))) (Hall "),
+            "the universal binder must sit INSIDE the existential one; the other order is \
+             the alternation swap the explicit binder exists to prevent:\n{golden}"
+        );
+        assert!(
+            golden.contains("Hall (Himpl (HA_has_type (T_lvar 0) T_i32)"),
+            "a nested-universal `@` must state its typing as an antecedent within its own \
+             binder — a `T_lvar` guard outside its quantifier names nothing:\n{golden}"
+        );
+        assert!(
+            golden.contains("Hall (Hall (Himpl (HA_and (HA_has_type (T_lvar 1) T_i32)"),
+            "an aggregate `@` under the nested quantifier must bind one `Hall` per scalar \
+             leaf over one shared guard antecedent:\n{golden}"
+        );
+        assert!(
+            golden.contains("Hall (Himpl (HA_has_type (T_lvar 0) T_i32) (HA_ex (HA_and (Hor "),
+            "the two binder channels must interleave inside one block: a short-circuit \
+             witness allocated after a universal variable is bound within it, off the same \
+             level counter:\n{golden}"
+        );
+    }
+
     /// Committed `.v` golden for the `unique`-kind reachability fixture.
     /// Regenerate with the `#[ignore]`d [`regenerate::regenerate_unique_spec_v`]
     /// after an intentional emitter change.
@@ -2605,8 +2812,9 @@ Definition a_definition (x : nat) : nat := x.
     #[cfg(test)]
     mod regenerate {
         use super::{
-            exists_spec_golden_path, generate_v, literal_ctx_golden_path, prime_golden_path,
-            unique_spec_golden_path,
+            aggregate_values_golden_path, bounded_iteration_golden_path, exists_spec_golden_path,
+            generate_v, literal_ctx_golden_path, prime_golden_path,
+            quantifier_alternation_golden_path, unique_spec_golden_path,
         };
         use std::path::Path;
 
@@ -2646,5 +2854,29 @@ Definition a_definition (x : nat) : nat := x.
             let v = generate_v("rocq_unique_spec.inf", "rocq_unique_spec");
             write_golden(&v, &unique_spec_golden_path());
         }
+
+        #[test]
+        #[ignore]
+        fn regenerate_aggregate_values_v() {
+            let v = generate_v("spec_aggregate_values.inf", "spec_aggregate_values");
+            write_golden(&v, &aggregate_values_golden_path());
+        }
+
+        #[test]
+        #[ignore]
+        fn regenerate_bounded_iteration_v() {
+            let v = generate_v("spec_bounded_iteration.inf", "spec_bounded_iteration");
+            write_golden(&v, &bounded_iteration_golden_path());
+        }
+
+        #[test]
+        #[ignore]
+        fn regenerate_quantifier_alternation_v() {
+            let v = generate_v(
+                "spec_quantifier_alternation.inf",
+                "spec_quantifier_alternation",
+            );
+            write_golden(&v, &quantifier_alternation_golden_path());
+        }
     }
 }
diff --git a/tests/src/spec_propagation.rs b/tests/src/spec_propagation.rs
index cc584260..23e1bedf 100644
--- a/tests/src/spec_propagation.rs
+++ b/tests/src/spec_propagation.rs
@@ -262,20 +262,22 @@ mod scenario_2_export_gating {
     }
 }
 
-// A spec whose body builds or reads a struct has no assertion encoding, so
-// proof-mode codegen now rejects it (the obligation is a required deliverable).
+// A spec body that builds and reads flat struct values now encodes them as
+// scalar leaf trees. What stays rejected in a literal is a field-position
+// uzumaki: `@` is an introduction form only where a `let` or a call argument
+// binds it, and a literal field is neither.
 #[cfg(test)]
-mod spec_struct_value_is_rejected {
+mod spec_struct_values {
     use super::helpers::try_compile;
     use inference_wasm_codegen::CompilationMode;
 
-    /// A struct literal (with field-position uzumaki) and a subsequent field
-    /// access in a spec `forall` body have no `hassert` encoding, so proof-mode
-    /// codegen fails with `P002`. (Previously this compiled to WASM because the
-    /// obligation pass was additive; the flip to fatal makes an untranslatable
-    /// spec a hard error.)
+    /// A field-position `@` inside a struct literal is not an introduction
+    /// form — `@` is bound by a `let` or a call argument — so proof-mode
+    /// codegen rejects it with `P006`, whose message names both sanctioned
+    /// positions. (Bind the whole struct with `let p: Point = @;` to
+    /// quantify per leaf instead.)
     #[test]
-    fn field_position_uzumaki_struct_in_spec_forall_is_rejected() {
+    fn field_position_uzumaki_in_a_spec_literal_is_rejected() {
         let source = r#"
             struct Point { x: i32; y: i32; }
             spec S {
@@ -286,18 +288,20 @@ mod spec_struct_value_is_rejected {
             }
         "#;
         let err = try_compile(source, CompilationMode::Proof)
-            .expect_err("a struct-valued spec body has no assertion encoding");
+            .expect_err("a field-position uzumaki has no binding to introduce it");
         let msg = err.to_string();
         assert!(
-            msg.contains("P002") && msg.contains("struct"),
-            "expected a P002 rejection naming the struct construct; got:\n{msg}"
+            msg.contains("P006"),
+            "expected a P006 rejection for the field-position uzumaki; got:\n{msg}"
         );
     }
 
-    /// The typed-let form (`let a: i32 = @; Point { x: a }`) reads a struct field
-    /// in the assertion, so it is rejected for the same reason.
+    /// The typed-let form (`let a: i32 = @; Point { x: a }`) is now fully
+    /// encodable: the literal binds a leaf value tree over the already-bound
+    /// slots, and the field read resolves to a slot term — proof-mode
+    /// codegen succeeds and carries the obligation.
     #[test]
-    fn typed_let_struct_in_spec_forall_is_rejected() {
+    fn typed_let_struct_in_spec_forall_now_encodes() {
         let source = r#"
             struct Point { x: i32; y: i32; }
             spec S {
@@ -309,12 +313,11 @@ mod spec_struct_value_is_rejected {
                 }
             }
         "#;
-        let err = try_compile(source, CompilationMode::Proof)
-            .expect_err("a struct-valued spec body has no assertion encoding");
-        let msg = err.to_string();
+        let output = try_compile(source, CompilationMode::Proof)
+            .expect("a flat struct value in a spec body now encodes as leaf terms");
         assert!(
-            msg.contains("P002"),
-            "expected a P002 rejection for the struct construct; got:\n{msg}"
+            !output.hspecs().is_empty(),
+            "the spec must carry its obligation"
         );
     }
 }
diff --git a/tests/test_data/inf/spec_aggregate_values.inf b/tests/test_data/inf/spec_aggregate_values.inf
new file mode 100644
index 00000000..711c7680
--- /dev/null
+++ b/tests/test_data/inf/spec_aggregate_values.inf
@@ -0,0 +1,61 @@
+// Aggregate values in specification bodies: compound `@` and compound
+// parameters quantify one universal slot per scalar leaf (arrays row-major,
+// struct fields in layout order), array/struct literals and copies bind leaf
+// value trees, field and constant-index access resolve against those trees at
+// translation time, and aggregate `==`/`!=` in assertion position is leafwise.
+fn sum_pair(a: i32, b: i32) -> i32 {
+  return a + b;
+}
+
+struct Rec {
+  lo: i32;
+  wide: i64;
+  row: [i32; 2];
+}
+
+spec AggregateValues {
+  fn leaf_bounds() forall {
+    let a: [i32; 3] = @;
+    assert(a[0] <= a[0]);
+  }
+
+  fn matrix_order() forall {
+    let m: [[i32; 2]; 2] = @;
+    assume { assert(m[0][1] > m[1][0]); }
+    assert(m[0][1] >= m[1][0]);
+  }
+
+  fn record_fields(r: Rec) forall {
+    assume { assert(r.wide > 0); }
+    assert(r.row[1] >= r.row[0] || r.wide > 0);
+  }
+
+  fn literal_values() forall {
+    let v: [i32; 3] = [1, 2, 3];
+    let w: [i32; 3] = v;
+    assert(sum_pair(w[0], v[1]) == 3);
+  }
+
+  fn leafwise_equality() forall {
+    let a: [i32; 2] = @;
+    let b: [i32; 2] = @;
+    assume { assert(a[0] == b[0] && a[1] == b[1]); }
+    assert(a == b);
+  }
+
+  fn leafwise_inequality() forall {
+    let a: [i32; 2] = @;
+    let c: [i32; 2] = [3, 4];
+    assume { assert(a[0] != 3); }
+    assert(a != c);
+  }
+
+  fn exists_leaves() forall {
+    let n: i32 = @;
+    assume { assert(n == 3); }
+    exists {
+      let pair: [i32; 2] = @;
+      assert(pair[0] + pair[1] == n);
+    }
+  }
+}
diff --git a/tests/test_data/inf/spec_bounded_iteration.inf b/tests/test_data/inf/spec_bounded_iteration.inf
new file mode 100644
index 00000000..2e0dc244
--- /dev/null
+++ b/tests/test_data/inf/spec_bounded_iteration.inf
@@ -0,0 +1,75 @@
+// Bounded iteration in specification bodies: an index the translation cannot
+// fold names its element by cases — the unsigned range bound first, then one
+// implication per element of the array. Constant steps of an access chain
+// descend before the non-constant one, so `m[1][j]` splits over the row `[1]`
+// already selected; a struct field selects the array the same way.
+//
+// That range bound is unsigned at every index type, so a signed index needs a
+// lower bound as well as an upper one before a claim about its element holds:
+// a negative index is a huge unsigned value, which no signed upper-bound test
+// rules out.
+struct Rec {
+  tag: i32;
+  row: [i32; 2];
+}
+
+spec BoundedIteration {
+  // The element at an unconstrained index is defined only where the index is
+  // in range, so the claim carries that condition rather than reading as a
+  // tautology.
+  fn element_defined() forall {
+    let a: [i32; 3] = @;
+    let i: i32 = @;
+    assume { assert(0 <= i && i < 3); }
+    assert(a[i] == a[i]);
+  }
+
+  // The bounded-iteration property itself: every element satisfies P, so the
+  // element at any in-range index does.
+  fn every_element_is_bounded() forall {
+    let a: [i32; 3] = @;
+    let i: i32 = @;
+    assume { assert(a[0] >= 0 && a[1] >= 0); }
+    assume { assert(a[2] >= 0); }
+    assume { assert(0 <= i && i < 3); }
+    assert(a[i] >= 0);
+  }
+
+  // A constant step descends first: the split is over the two elements of row
+  // `[1]`, never over the four elements of the matrix.
+  fn matrix_row(j: i32) forall {
+    let m: [[i32; 2]; 2] = @;
+    assume { assert(j == 0); }
+    assert(m[1][j] == m[1][0]);
+  }
+
+  // A field step selects the array, then the non-constant index splits it.
+  fn record_row(r: Rec, k: i32) forall {
+    assume { assert(r.row[0] == r.row[1]); }
+    assume { assert(0 <= k && k < 2); }
+    assert(r.row[k] == r.row[0]);
+  }
+
+  // The element's defining constraint travels into the arm that evaluates it:
+  // the right operand of `||` is reached only when the left disjunct fails.
+  // The index is signed, so it carries its own lower bound — without it the
+  // left arm's signed `i > 1` and the element's unsigned range bound leave the
+  // negative indices to neither arm, and the claim is false.
+  fn guarded_by_a_disjunction() forall {
+    let a: [i32; 2] = @;
+    let i: i32 = @;
+    assume { assert(a[0] > 0 && a[1] > 0); }
+    assume { assert(0 <= i); }
+    assert(i > 1 || a[i] > 0);
+  }
+
+  // The unsigned spelling of the same claim needs no such bound: `i > 1` lowers
+  // unsigned here, exactly complementing the range bound, so between them the
+  // two arms cover every value the index can take.
+  fn guarded_by_an_unsigned_disjunction() forall {
+    let a: [i32; 2] = @;
+    let i: u32 = @;
+    assume { assert(a[0] > 0 && a[1] > 0); }
+    assert(i > 1 || a[i] > 0);
+  }
+}
diff --git a/tests/test_data/inf/spec_quantifier_alternation.inf b/tests/test_data/inf/spec_quantifier_alternation.inf
new file mode 100644
index 00000000..5983951f
--- /dev/null
+++ b/tests/test_data/inf/spec_quantifier_alternation.inf
@@ -0,0 +1,118 @@
+// Quantifier alternation in specification bodies: a `forall` block nested
+// inside an existential context (an `exists` block, an `assume` block, or an
+// `if` branch of one) states a universal claim *under* the existential one, and
+// is emitted with the library's `Hall` sugar — this fixture is the corpus
+// producer for it.
+//
+// The nesting needs a real binder rather than a fresh quantifier slot. The
+// downstream `ValidSpec` judgment already quantifies every slot the payload
+// reads, so a slot standing in for the inner `forall` would be quantified
+// outside the enclosing `HA_ex`: `∃x. ∀y. P` would silently become `∀y. ∃x. P`,
+// the swap the rejection this fixture lifts existed to prevent.
+//
+// Inside such a block a `@` binds one logical variable per scalar leaf, each
+// stating its own typing — the guard is an *antecedent inside the binder*,
+// because a `T_lvar` names nothing outside the quantifier that introduced it.
+// The claims are chosen to be true, so the emitted obligations are dischargeable
+// rather than merely well-typed.
+fn twice(n: i32) -> i32 {
+    return n + n;
+}
+
+fn zero_of(n: i32) -> i32 {
+    return n - n;
+}
+
+spec QuantifierAlternation {
+    // The canonical alternation: some value leaves every value unchanged under
+    // addition. `k` is the existential witness, `x` the universal variable.
+    fn additive_identity() forall {
+        exists {
+            let k: i32 = @;
+            assume {
+                assert(k == 0);
+            }
+            forall {
+                let x: i32 = @;
+                assert(x + k == x);
+            }
+        }
+    }
+
+    // A universal claim as a *filter*: an `assume` block translates
+    // existentially, so a `forall` inside one alternates the same way, and the
+    // resulting `Hall` lands in the antecedent of what follows.
+    fn filtered_by_a_universal(lo: i32) forall {
+        assume {
+            forall {
+                let x: i32 = @;
+                assert(twice(x) == x + x);
+            }
+        }
+        assert(twice(lo) == lo + lo);
+    }
+
+    // The `if`-branch twin of the block form: the branch block itself carries
+    // the `forall` kind, so the alternation appears inside one arm of the
+    // existential disjunction.
+    fn branch_alternation(n: i32) forall {
+        exists {
+            let m: i32 = @;
+            assume {
+                assert(m == n);
+            }
+            if m == n forall {
+                let x: i32 = @;
+                assert(x + m == x + n);
+            }
+        }
+    }
+
+    // An aggregate `@` under the nested quantifier binds one variable per
+    // scalar leaf, so a two-element array nests two `Hall`s over one shared
+    // antecedent of two typing guards.
+    fn aggregate_alternation() forall {
+        exists {
+            let k: i32 = @;
+            assume {
+                assert(k == 0);
+            }
+            forall {
+                let a: [i32; 2] = @;
+                assert(a[0] + k == a[0]);
+            }
+        }
+    }
+
+    // Both binder channels at once: the block introduces a universal variable
+    // and a term-position `||` whose witness is existential, so a `Hall` and an
+    // `HA_ex` interleave over one shared level counter.
+    fn interleaved_binders() forall {
+        exists {
+            let k: i32 = @;
+            assume {
+                assert(k == 0);
+            }
+            forall {
+                let x: i32 = @;
+                let safe: bool = x == 0 || twice(x) == x + x;
+                assert(safe || k != 0);
+            }
+        }
+    }
+
+    // A call-argument `@` under the nested quantifier: it has no name to bind,
+    // so its binder wraps the statement's atom directly and carries its typing
+    // guard with it.
+    fn anonymous_universal_choice() forall {
+        exists {
+            let k: i32 = @;
+            assume {
+                assert(k == 0);
+            }
+            forall {
+                assert(zero_of(@) == k);
+            }
+        }
+    }
+}
diff --git a/tests/test_data/rocq/spec_aggregate_values.v b/tests/test_data/rocq/spec_aggregate_values.v
new file mode 100644
index 00000000..dc980a48
--- /dev/null
+++ b/tests/test_data/rocq/spec_aggregate_values.v
@@ -0,0 +1,104 @@
+Require Import List.
+Require Import String.
+Require Import BinNat.
+Require Import ZArith.
+From Wasm Require Import bytes numerics datatypes host.
+From WasmVerifier Require Import Assertions Verifier.
+
+Definition Vi32 i := VAL_int32 (Wasm_int.int_of_Z i32m i).
+Definition Vi64 i := VAL_int64 (Wasm_int.int_of_Z i64m i).
+Definition Mt l et := {|modtab_type := {|tt_limits := l; tt_elem_type := et|}|}.
+Definition Mm l := {|modmem_type := l|}.
+Definition Mg mut t init := {|modglob_type := {|tg_mut := mut; tg_t := t|}; modglob_init := init|}.
+
+Definition Mi m n d := {|
+  imp_module := list_byte_of_string m;
+  imp_name := list_byte_of_string n;
+  imp_desc := d;
+|}.
+
+Definition Me n d := {|
+  modexp_name := list_byte_of_string n;
+  modexp_desc := d;
+|}.
+
+Definition Ma ofs al := {|memarg_offset := ofs; memarg_align := al|}.
+
+Definition sum_pair : module_func := {|
+  modfunc_type := 0%N;
+  modfunc_locals := nil;
+  modfunc_body :=
+    BI_local_get 0%N (*a*) ::
+    BI_local_get 1%N (*b*) ::
+    BI_binop T_i32 (Binop_i BOI_add) ::
+    BI_return ::
+    BI_unreachable ::
+    nil;
+|}.
+
+Definition spec_aggregate_values : module := {|
+  mod_types :=
+    Tf (T_num T_i32 :: T_num T_i32 :: nil) (T_num T_i32 :: nil) ::
+    Tf (nil) (nil) ::
+    Tf (nil) (nil) ::
+    Tf (T_num T_i32 :: nil) (nil) ::
+    Tf (nil) (nil) ::
+    Tf (nil) (nil) ::
+    Tf (nil) (nil) ::
+    Tf (nil) (nil) ::
+    nil;
+  mod_funcs :=
+    sum_pair ::
+    nil;
+  mod_tables :=
+    nil;
+  mod_mems :=
+    Mm {|lim_min := 1%N; lim_max := Some(1%N)|} ::
+    nil;
+  mod_globals :=
+    Mg MUT_var (T_num T_i32) (    BI_const_num (Vi32 65536) ::
+    nil) ::
+    nil;
+  mod_elems :=
+    nil;
+  mod_datas :=
+    nil;
+  mod_start := None;
+  mod_imports :=
+    nil;
+  mod_exports :=
+    Me "memory" (MED_mem 0%N) ::
+    Me "__stack_pointer" (MED_global 0%N) ::
+    nil;
+|}.
+
+Definition spec_aggregate_values__AggregateValues_hspec1 : hassert :=
+  Himpl (HA_and (HA_has_type (T_local 0%N) T_i32) (HA_and (HA_has_type (T_local 1%N) T_i32) (HA_has_type (T_local 2%N) T_i32))) (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_le SX_S)) (T_local 0%N) (T_local 0%N)) (T_const (Vi32 0)))).
+Definition spec_aggregate_values__AggregateValues_hspec2 : hassert :=
+  Himpl (HA_and (HA_has_type (T_local 0%N) T_i32) (HA_and (HA_has_type (T_local 1%N) T_i32) (HA_and (HA_has_type (T_local 2%N) T_i32) (HA_and (HA_has_type (T_local 3%N) T_i32) (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_gt SX_S)) (T_local 1%N) (T_local 2%N)) (T_const (Vi32 0)))))))) (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_ge SX_S)) (T_local 1%N) (T_local 2%N)) (T_const (Vi32 0)))).
+Definition spec_aggregate_values__AggregateValues_hspec3 : hassert :=
+  Himpl (HA_and (HA_has_type (T_local 0%N) T_i32) (HA_and (HA_has_type (T_local 1%N) T_i64) (HA_and (HA_has_type (T_local 2%N) T_i32) (HA_and (HA_has_type (T_local 3%N) T_i32) (HA_not (term_eq (T_relop T_i64 (Relop_i (ROI_gt SX_S)) (T_local 1%N) (T_const (Vi64 0))) (T_const (Vi32 0)))))))) (Hor (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_ge SX_S)) (T_local 3%N) (T_local 2%N)) (T_const (Vi32 0)))) (HA_not (term_eq (T_relop T_i64 (Relop_i (ROI_gt SX_S)) (T_local 1%N) (T_const (Vi64 0))) (T_const (Vi32 0))))).
+Definition spec_aggregate_values__AggregateValues_hspec4 : hassert :=
+  HA_not (term_eq (T_relop T_i32 (Relop_i ROI_eq) (T_app 0 ((T_const (Vi32 1)) :: (T_const (Vi32 2)) :: nil)) (T_const (Vi32 3))) (T_const (Vi32 0))).
+Definition spec_aggregate_values__AggregateValues_hspec5 : hassert :=
+  Himpl (HA_and (HA_has_type (T_local 0%N) T_i32) (HA_and (HA_has_type (T_local 1%N) T_i32) (HA_and (HA_has_type (T_local 2%N) T_i32) (HA_and (HA_has_type (T_local 3%N) T_i32) (HA_and (term_eq (T_local 0%N) (T_local 2%N)) (term_eq (T_local 1%N) (T_local 3%N))))))) (HA_and (term_eq (T_local 0%N) (T_local 2%N)) (term_eq (T_local 1%N) (T_local 3%N))).
+Definition spec_aggregate_values__AggregateValues_hspec6 : hassert :=
+  Himpl (HA_and (HA_has_type (T_local 0%N) T_i32) (HA_and (HA_has_type (T_local 1%N) T_i32) (HA_not (term_eq (T_relop T_i32 (Relop_i ROI_ne) (T_local 0%N) (T_const (Vi32 3))) (T_const (Vi32 0)))))) (Hor (HA_not (term_eq (T_local 0%N) (T_const (Vi32 3)))) (HA_not (term_eq (T_local 1%N) (T_const (Vi32 4))))).
+Definition spec_aggregate_values__AggregateValues_hspec7 : hassert :=
+  Himpl (HA_and (HA_has_type (T_local 0%N) T_i32) (term_eq (T_local 0%N) (T_const (Vi32 3)))) (HA_ex (HA_ex (term_eq (T_binop T_i32 (Binop_i BOI_add) (T_lvar 1) (T_lvar 0)) (T_local 0%N)))).
+Definition spec_aggregate_values__AggregateValues_specs : list hassert := (spec_aggregate_values__AggregateValues_hspec1 :: spec_aggregate_values__AggregateValues_hspec2 :: spec_aggregate_values__AggregateValues_hspec3 :: spec_aggregate_values__AggregateValues_hspec4 :: spec_aggregate_values__AggregateValues_hspec5 :: spec_aggregate_values__AggregateValues_hspec6 :: spec_aggregate_values__AggregateValues_hspec7 :: nil).
+
+Section Host.
+Context `{ho: host}.
+
+Theorem valid_spec_aggregate_values : ValidModule spec_aggregate_values.
+Proof.
+  (* TODO: fill the proof *)
+Qed.
+
+Theorem valid_spec_aggregate_values__AggregateValues : ValidSpec spec_aggregate_values spec_aggregate_values__AggregateValues_specs.
+Proof.
+  (* TODO: fill the proof *)
+Qed.
+
+End Host.
diff --git a/tests/test_data/rocq/spec_bounded_iteration.v b/tests/test_data/rocq/spec_bounded_iteration.v
new file mode 100644
index 00000000..22f0bb60
--- /dev/null
+++ b/tests/test_data/rocq/spec_bounded_iteration.v
@@ -0,0 +1,87 @@
+Require Import List.
+Require Import String.
+Require Import BinNat.
+Require Import ZArith.
+From Wasm Require Import bytes numerics datatypes host.
+From WasmVerifier Require Import Assertions Verifier.
+
+Definition Vi32 i := VAL_int32 (Wasm_int.int_of_Z i32m i).
+Definition Vi64 i := VAL_int64 (Wasm_int.int_of_Z i64m i).
+Definition Mt l et := {|modtab_type := {|tt_limits := l; tt_elem_type := et|}|}.
+Definition Mm l := {|modmem_type := l|}.
+Definition Mg mut t init := {|modglob_type := {|tg_mut := mut; tg_t := t|}; modglob_init := init|}.
+
+Definition Mi m n d := {|
+  imp_module := list_byte_of_string m;
+  imp_name := list_byte_of_string n;
+  imp_desc := d;
+|}.
+
+Definition Me n d := {|
+  modexp_name := list_byte_of_string n;
+  modexp_desc := d;
+|}.
+
+Definition Ma ofs al := {|memarg_offset := ofs; memarg_align := al|}.
+
+Definition spec_bounded_iteration : module := {|
+  mod_types :=
+    Tf (nil) (nil) ::
+    Tf (nil) (nil) ::
+    Tf (T_num T_i32 :: nil) (nil) ::
+    Tf (T_num T_i32 :: T_num T_i32 :: nil) (nil) ::
+    Tf (nil) (nil) ::
+    Tf (nil) (nil) ::
+    nil;
+  mod_funcs :=
+    nil;
+  mod_tables :=
+    nil;
+  mod_mems :=
+    Mm {|lim_min := 1%N; lim_max := Some(1%N)|} ::
+    nil;
+  mod_globals :=
+    Mg MUT_var (T_num T_i32) (    BI_const_num (Vi32 65536) ::
+    nil) ::
+    nil;
+  mod_elems :=
+    nil;
+  mod_datas :=
+    nil;
+  mod_start := None;
+  mod_imports :=
+    nil;
+  mod_exports :=
+    Me "memory" (MED_mem 0%N) ::
+    Me "__stack_pointer" (MED_global 0%N) ::
+    nil;
+|}.
+
+Definition spec_bounded_iteration__BoundedIteration_hspec1 : hassert :=
+  Himpl (HA_and (HA_has_type (T_local 0%N) T_i32) (HA_and (HA_has_type (T_local 1%N) T_i32) (HA_and (HA_has_type (T_local 2%N) T_i32) (HA_and (HA_has_type (T_local 3%N) T_i32) (HA_and (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_le SX_S)) (T_const (Vi32 0)) (T_local 3%N)) (T_const (Vi32 0)))) (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_lt SX_S)) (T_local 3%N) (T_const (Vi32 3))) (T_const (Vi32 0))))))))) (HA_ex (HA_and (HA_and (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_lt SX_U)) (T_local 3%N) (T_const (Vi32 3))) (T_const (Vi32 0)))) (HA_and (Himpl (term_eq (T_local 3%N) (T_const (Vi32 0))) (term_eq (T_lvar 0) (T_local 0%N))) (HA_and (Himpl (term_eq (T_local 3%N) (T_const (Vi32 1))) (term_eq (T_lvar 0) (T_local 1%N))) (Himpl (term_eq (T_local 3%N) (T_const (Vi32 2))) (term_eq (T_lvar 0) (T_local 2%N)))))) (HA_ex (HA_and (HA_and (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_lt SX_U)) (T_local 3%N) (T_const (Vi32 3))) (T_const (Vi32 0)))) (HA_and (Himpl (term_eq (T_local 3%N) (T_const (Vi32 0))) (term_eq (T_lvar 0) (T_local 0%N))) (HA_and (Himpl (term_eq (T_local 3%N) (T_const (Vi32 1))) (term_eq (T_lvar 0) (T_local 1%N))) (Himpl (term_eq (T_local 3%N) (T_const (Vi32 2))) (term_eq (T_lvar 0) (T_local 2%N)))))) (HA_not (term_eq (T_relop T_i32 (Relop_i ROI_eq) (T_lvar 1) (T_lvar 0)) (T_const (Vi32 0)))))))).
+Definition spec_bounded_iteration__BoundedIteration_hspec2 : hassert :=
+  Himpl (HA_and (HA_has_type (T_local 0%N) T_i32) (HA_and (HA_has_type (T_local 1%N) T_i32) (HA_and (HA_has_type (T_local 2%N) T_i32) (HA_and (HA_has_type (T_local 3%N) T_i32) (HA_and (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_ge SX_S)) (T_local 0%N) (T_const (Vi32 0))) (T_const (Vi32 0)))) (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_ge SX_S)) (T_local 1%N) (T_const (Vi32 0))) (T_const (Vi32 0))))))))) (Himpl (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_ge SX_S)) (T_local 2%N) (T_const (Vi32 0))) (T_const (Vi32 0)))) (Himpl (HA_and (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_le SX_S)) (T_const (Vi32 0)) (T_local 3%N)) (T_const (Vi32 0)))) (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_lt SX_S)) (T_local 3%N) (T_const (Vi32 3))) (T_const (Vi32 0))))) (HA_ex (HA_and (HA_and (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_lt SX_U)) (T_local 3%N) (T_const (Vi32 3))) (T_const (Vi32 0)))) (HA_and (Himpl (term_eq (T_local 3%N) (T_const (Vi32 0))) (term_eq (T_lvar 0) (T_local 0%N))) (HA_and (Himpl (term_eq (T_local 3%N) (T_const (Vi32 1))) (term_eq (T_lvar 0) (T_local 1%N))) (Himpl (term_eq (T_local 3%N) (T_const (Vi32 2))) (term_eq (T_lvar 0) (T_local 2%N)))))) (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_ge SX_S)) (T_lvar 0) (T_const (Vi32 0))) (T_const (Vi32 0)))))))).
+Definition spec_bounded_iteration__BoundedIteration_hspec3 : hassert :=
+  Himpl (HA_and (HA_has_type (T_local 0%N) T_i32) (HA_and (HA_has_type (T_local 1%N) T_i32) (HA_and (HA_has_type (T_local 2%N) T_i32) (HA_and (HA_has_type (T_local 3%N) T_i32) (HA_and (HA_has_type (T_local 4%N) T_i32) (term_eq (T_local 0%N) (T_const (Vi32 0)))))))) (HA_ex (HA_and (HA_and (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_lt SX_U)) (T_local 0%N) (T_const (Vi32 2))) (T_const (Vi32 0)))) (HA_and (Himpl (term_eq (T_local 0%N) (T_const (Vi32 0))) (term_eq (T_lvar 0) (T_local 3%N))) (Himpl (term_eq (T_local 0%N) (T_const (Vi32 1))) (term_eq (T_lvar 0) (T_local 4%N))))) (HA_not (term_eq (T_relop T_i32 (Relop_i ROI_eq) (T_lvar 0) (T_local 3%N)) (T_const (Vi32 0)))))).
+Definition spec_bounded_iteration__BoundedIteration_hspec4 : hassert :=
+  Himpl (HA_and (HA_has_type (T_local 0%N) T_i32) (HA_and (HA_has_type (T_local 1%N) T_i32) (HA_and (HA_has_type (T_local 2%N) T_i32) (HA_and (HA_has_type (T_local 3%N) T_i32) (term_eq (T_local 1%N) (T_local 2%N)))))) (Himpl (HA_and (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_le SX_S)) (T_const (Vi32 0)) (T_local 3%N)) (T_const (Vi32 0)))) (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_lt SX_S)) (T_local 3%N) (T_const (Vi32 2))) (T_const (Vi32 0))))) (HA_ex (HA_and (HA_and (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_lt SX_U)) (T_local 3%N) (T_const (Vi32 2))) (T_const (Vi32 0)))) (HA_and (Himpl (term_eq (T_local 3%N) (T_const (Vi32 0))) (term_eq (T_lvar 0) (T_local 1%N))) (Himpl (term_eq (T_local 3%N) (T_const (Vi32 1))) (term_eq (T_lvar 0) (T_local 2%N))))) (HA_not (term_eq (T_relop T_i32 (Relop_i ROI_eq) (T_lvar 0) (T_local 1%N)) (T_const (Vi32 0))))))).
+Definition spec_bounded_iteration__BoundedIteration_hspec5 : hassert :=
+  Himpl (HA_and (HA_has_type (T_local 0%N) T_i32) (HA_and (HA_has_type (T_local 1%N) T_i32) (HA_and (HA_has_type (T_local 2%N) T_i32) (HA_and (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_gt SX_S)) (T_local 0%N) (T_const (Vi32 0))) (T_const (Vi32 0)))) (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_gt SX_S)) (T_local 1%N) (T_const (Vi32 0))) (T_const (Vi32 0)))))))) (Himpl (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_le SX_S)) (T_const (Vi32 0)) (T_local 2%N)) (T_const (Vi32 0)))) (HA_ex (Hor (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_gt SX_S)) (T_local 2%N) (T_const (Vi32 1))) (T_const (Vi32 0)))) (HA_and (HA_and (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_lt SX_U)) (T_local 2%N) (T_const (Vi32 2))) (T_const (Vi32 0)))) (HA_and (Himpl (term_eq (T_local 2%N) (T_const (Vi32 0))) (term_eq (T_lvar 0) (T_local 0%N))) (Himpl (term_eq (T_local 2%N) (T_const (Vi32 1))) (term_eq (T_lvar 0) (T_local 1%N))))) (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_gt SX_S)) (T_lvar 0) (T_const (Vi32 0))) (T_const (Vi32 0)))))))).
+Definition spec_bounded_iteration__BoundedIteration_hspec6 : hassert :=
+  Himpl (HA_and (HA_has_type (T_local 0%N) T_i32) (HA_and (HA_has_type (T_local 1%N) T_i32) (HA_and (HA_has_type (T_local 2%N) T_i32) (HA_and (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_gt SX_S)) (T_local 0%N) (T_const (Vi32 0))) (T_const (Vi32 0)))) (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_gt SX_S)) (T_local 1%N) (T_const (Vi32 0))) (T_const (Vi32 0)))))))) (HA_ex (Hor (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_gt SX_U)) (T_local 2%N) (T_const (Vi32 1))) (T_const (Vi32 0)))) (HA_and (HA_and (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_lt SX_U)) (T_local 2%N) (T_const (Vi32 2))) (T_const (Vi32 0)))) (HA_and (Himpl (term_eq (T_local 2%N) (T_const (Vi32 0))) (term_eq (T_lvar 0) (T_local 0%N))) (Himpl (term_eq (T_local 2%N) (T_const (Vi32 1))) (term_eq (T_lvar 0) (T_local 1%N))))) (HA_not (term_eq (T_relop T_i32 (Relop_i (ROI_gt SX_S)) (T_lvar 0) (T_const (Vi32 0))) (T_const (Vi32 0))))))).
+Definition spec_bounded_iteration__BoundedIteration_specs : list hassert := (spec_bounded_iteration__BoundedIteration_hspec1 :: spec_bounded_iteration__BoundedIteration_hspec2 :: spec_bounded_iteration__BoundedIteration_hspec3 :: spec_bounded_iteration__BoundedIteration_hspec4 :: spec_bounded_iteration__BoundedIteration_hspec5 :: spec_bounded_iteration__BoundedIteration_hspec6 :: nil).
+
+Section Host.
+Context `{ho: host}.
+
+Theorem valid_spec_bounded_iteration : ValidModule spec_bounded_iteration.
+Proof.
+  (* TODO: fill the proof *)
+Qed.
+
+Theorem valid_spec_bounded_iteration__BoundedIteration : ValidSpec spec_bounded_iteration spec_bounded_iteration__BoundedIteration_specs.
+Proof.
+  (* TODO: fill the proof *)
+Qed.
+
+End Host.
diff --git a/tests/test_data/rocq/spec_quantifier_alternation.v b/tests/test_data/rocq/spec_quantifier_alternation.v
new file mode 100644
index 00000000..db456b80
--- /dev/null
+++ b/tests/test_data/rocq/spec_quantifier_alternation.v
@@ -0,0 +1,115 @@
+Require Import List.
+Require Import String.
+Require Import BinNat.
+Require Import ZArith.
+From Wasm Require Import bytes numerics datatypes host.
+From WasmVerifier Require Import Assertions Verifier.
+
+Definition Vi32 i := VAL_int32 (Wasm_int.int_of_Z i32m i).
+Definition Vi64 i := VAL_int64 (Wasm_int.int_of_Z i64m i).
+Definition Mt l et := {|modtab_type := {|tt_limits := l; tt_elem_type := et|}|}.
+Definition Mm l := {|modmem_type := l|}.
+Definition Mg mut t init := {|modglob_type := {|tg_mut := mut; tg_t := t|}; modglob_init := init|}.
+
+Definition Mi m n d := {|
+  imp_module := list_byte_of_string m;
+  imp_name := list_byte_of_string n;
+  imp_desc := d;
+|}.
+
+Definition Me n d := {|
+  modexp_name := list_byte_of_string n;
+  modexp_desc := d;
+|}.
+
+Definition Ma ofs al := {|memarg_offset := ofs; memarg_align := al|}.
+
+Definition twice : module_func := {|
+  modfunc_type := 0%N;
+  modfunc_locals := nil;
+  modfunc_body :=
+    BI_local_get 0%N (*n*) ::
+    BI_local_get 0%N (*n*) ::
+    BI_binop T_i32 (Binop_i BOI_add) ::
+    BI_return ::
+    BI_unreachable ::
+    nil;
+|}.
+
+Definition zero_of : module_func := {|
+  modfunc_type := 1%N;
+  modfunc_locals := nil;
+  modfunc_body :=
+    BI_local_get 0%N (*n*) ::
+    BI_local_get 0%N (*n*) ::
+    BI_binop T_i32 (Binop_i BOI_sub) ::
+    BI_return ::
+    BI_unreachable ::
+    nil;
+|}.
+
+Definition spec_quantifier_alternation : module := {|
+  mod_types :=
+    Tf (T_num T_i32 :: nil) (T_num T_i32 :: nil) ::
+    Tf (T_num T_i32 :: nil) (T_num T_i32 :: nil) ::
+    Tf (nil) (nil) ::
+    Tf (T_num T_i32 :: nil) (nil) ::
+    Tf (T_num T_i32 :: nil) (nil) ::
+    Tf (nil) (nil) ::
+    Tf (nil) (nil) ::
+    Tf (nil) (nil) ::
+    nil;
+  mod_funcs :=
+    twice ::
+    zero_of ::
+    nil;
+  mod_tables :=
+    nil;
+  mod_mems :=
+    Mm {|lim_min := 1%N; lim_max := Some(1%N)|} ::
+    nil;
+  mod_globals :=
+    Mg MUT_var (T_num T_i32) (    BI_const_num (Vi32 65536) ::
+    nil) ::
+    nil;
+  mod_elems :=
+    nil;
+  mod_datas :=
+    nil;
+  mod_start := None;
+  mod_imports :=
+    nil;
+  mod_exports :=
+    Me "memory" (MED_mem 0%N) ::
+    Me "__stack_pointer" (MED_global 0%N) ::
+    nil;
+|}.
+
+Definition spec_quantifier_alternation__QuantifierAlternation_hspec1 : hassert :=
+  HA_ex (HA_and (term_eq (T_lvar 0) (T_const (Vi32 0))) (Hall (Himpl (HA_has_type (T_lvar 0) T_i32) (HA_not (term_eq (T_relop T_i32 (Relop_i ROI_eq) (T_binop T_i32 (Binop_i BOI_add) (T_lvar 0) (T_lvar 1)) (T_lvar 0)) (T_const (Vi32 0))))))).
+Definition spec_quantifier_alternation__QuantifierAlternation_hspec2 : hassert :=
+  Himpl (HA_and (HA_has_type (T_local 0%N) T_i32) (Hall (Himpl (HA_has_type (T_lvar 0) T_i32) (HA_not (term_eq (T_relop T_i32 (Relop_i ROI_eq) (T_app 0 ((T_lvar 0) :: nil)) (T_binop T_i32 (Binop_i BOI_add) (T_lvar 0) (T_lvar 0))) (T_const (Vi32 0))))))) (HA_not (term_eq (T_relop T_i32 (Relop_i ROI_eq) (T_app 0 ((T_local 0%N) :: nil)) (T_binop T_i32 (Binop_i BOI_add) (T_local 0%N) (T_local 0%N))) (T_const (Vi32 0)))).
+Definition spec_quantifier_alternation__QuantifierAlternation_hspec3 : hassert :=
+  Himpl (HA_has_type (T_local 0%N) T_i32) (HA_ex (HA_and (term_eq (T_lvar 0) (T_local 0%N)) (Hor (HA_and (HA_not (term_eq (T_relop T_i32 (Relop_i ROI_eq) (T_lvar 0) (T_local 0%N)) (T_const (Vi32 0)))) (Hall (Himpl (HA_has_type (T_lvar 0) T_i32) (HA_not (term_eq (T_relop T_i32 (Relop_i ROI_eq) (T_binop T_i32 (Binop_i BOI_add) (T_lvar 0) (T_lvar 1)) (T_binop T_i32 (Binop_i BOI_add) (T_lvar 0) (T_local 0%N))) (T_const (Vi32 0))))))) (term_eq (T_relop T_i32 (Relop_i ROI_eq) (T_lvar 0) (T_local 0%N)) (T_const (Vi32 0)))))).
+Definition spec_quantifier_alternation__QuantifierAlternation_hspec4 : hassert :=
+  HA_ex (HA_and (term_eq (T_lvar 0) (T_const (Vi32 0))) (Hall (Hall (Himpl (HA_and (HA_has_type (T_lvar 1) T_i32) (HA_has_type (T_lvar 0) T_i32)) (HA_not (term_eq (T_relop T_i32 (Relop_i ROI_eq) (T_binop T_i32 (Binop_i BOI_add) (T_lvar 1) (T_lvar 2)) (T_lvar 1)) (T_const (Vi32 0)))))))).
+Definition spec_quantifier_alternation__QuantifierAlternation_hspec5 : hassert :=
+  HA_ex (HA_and (term_eq (T_lvar 0) (T_const (Vi32 0))) (Hall (Himpl (HA_has_type (T_lvar 0) T_i32) (HA_ex (HA_and (Hor (HA_and (HA_not (term_eq (T_relop T_i32 (Relop_i ROI_eq) (T_lvar 1) (T_const (Vi32 0))) (T_const (Vi32 0)))) (term_eq (T_lvar 0) (T_const (Vi32 1)))) (HA_and (term_eq (T_relop T_i32 (Relop_i ROI_eq) (T_lvar 1) (T_const (Vi32 0))) (T_const (Vi32 0))) (term_eq (T_lvar 0) (T_relop T_i32 (Relop_i ROI_eq) (T_app 0 ((T_lvar 1) :: nil)) (T_binop T_i32 (Binop_i BOI_add) (T_lvar 1) (T_lvar 1)))))) (Hor (HA_not (term_eq (T_lvar 0) (T_const (Vi32 0)))) (HA_not (term_eq (T_relop T_i32 (Relop_i ROI_ne) (T_lvar 2) (T_const (Vi32 0))) (T_const (Vi32 0)))))))))).
+Definition spec_quantifier_alternation__QuantifierAlternation_hspec6 : hassert :=
+  HA_ex (HA_and (term_eq (T_lvar 0) (T_const (Vi32 0))) (Hall (Himpl (HA_has_type (T_lvar 0) T_i32) (HA_not (term_eq (T_relop T_i32 (Relop_i ROI_eq) (T_app 1 ((T_lvar 0) :: nil)) (T_lvar 1)) (T_const (Vi32 0))))))).
+Definition spec_quantifier_alternation__QuantifierAlternation_specs : list hassert := (spec_quantifier_alternation__QuantifierAlternation_hspec1 :: spec_quantifier_alternation__QuantifierAlternation_hspec2 :: spec_quantifier_alternation__QuantifierAlternation_hspec3 :: spec_quantifier_alternation__QuantifierAlternation_hspec4 :: spec_quantifier_alternation__QuantifierAlternation_hspec5 :: spec_quantifier_alternation__QuantifierAlternation_hspec6 :: nil).
+
+Section Host.
+Context `{ho: host}.
+
+Theorem valid_spec_quantifier_alternation : ValidModule spec_quantifier_alternation.
+Proof.
+  (* TODO: fill the proof *)
+Qed.
+
+Theorem valid_spec_quantifier_alternation__QuantifierAlternation : ValidSpec spec_quantifier_alternation spec_quantifier_alternation__QuantifierAlternation_specs.
+Proof.
+  (* TODO: fill the proof *)
+Qed.
+
+End Host.