From e2fef1a5c986aff4c9975b1376bcc0fc0bb87940 Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Fri, 9 Jun 2023 10:06:43 +0200
Subject: Reorganize a bit the Lean library

---
 backends/lean/Base/Primitives.lean | 650 +++++++++++++++++++++++++++++++++++++
 1 file changed, 650 insertions(+)
 create mode 100644 backends/lean/Base/Primitives.lean

(limited to 'backends/lean/Base/Primitives.lean')

diff --git a/backends/lean/Base/Primitives.lean b/backends/lean/Base/Primitives.lean
new file mode 100644
index 00000000..d3de1d10
--- /dev/null
+++ b/backends/lean/Base/Primitives.lean
@@ -0,0 +1,650 @@
+import Lean
+import Lean.Meta.Tactic.Simp
+import Init.Data.List.Basic
+import Mathlib.Tactic.RunCmd
+import Mathlib.Tactic.Linarith
+
+--------------------
+-- ASSERT COMMAND --Std.
+--------------------
+
+open Lean Elab Command Term Meta
+
+syntax (name := assert) "#assert" term: command
+
+@[command_elab assert]
+unsafe
+def assertImpl : CommandElab := fun (_stx: Syntax) => do
+  runTermElabM (fun _ => do
+    let r ← evalTerm Bool (mkConst ``Bool) _stx[1]
+    if not r then
+      logInfo "Assertion failed for: "
+      logInfo _stx[1]
+      logError "Expression reduced to false"
+    pure ())
+
+#eval 2 == 2
+#assert (2 == 2)
+
+-------------
+-- PRELUDE --
+-------------
+
+-- Results & monadic combinators
+
+inductive Error where
+   | assertionFailure: Error
+   | integerOverflow: Error
+   | divisionByZero: Error
+   | arrayOutOfBounds: Error
+   | maximumSizeExceeded: Error
+   | panic: Error
+deriving Repr, BEq
+
+open Error
+
+inductive Result (α : Type u) where
+  | ret (v: α): Result α
+  | fail (e: Error): Result α
+deriving Repr, BEq
+
+open Result
+
+instance Result_Inhabited (α : Type u) : Inhabited (Result α) :=
+  Inhabited.mk (fail panic)
+
+/- HELPERS -/
+
+def ret? {α: Type} (r: Result α): Bool :=
+  match r with
+  | Result.ret _ => true
+  | Result.fail _ => false
+
+def massert (b:Bool) : Result Unit :=
+  if b then .ret () else fail assertionFailure
+
+def eval_global {α: Type} (x: Result α) (_: ret? x): α :=
+  match x with
+  | Result.fail _ => by contradiction
+  | Result.ret x => x
+
+/- DO-DSL SUPPORT -/
+
+def bind (x: Result α) (f: α -> Result β) : Result β :=
+  match x with
+  | ret v  => f v 
+  | fail v => fail v
+
+-- Allows using Result in do-blocks
+instance : Bind Result where
+  bind := bind
+
+-- Allows using return x in do-blocks
+instance : Pure Result where
+  pure := fun x => ret x
+
+/- CUSTOM-DSL SUPPORT -/
+
+-- Let-binding the Result of a monadic operation is oftentimes not sufficient,
+-- because we may need a hypothesis for equational reasoning in the scope. We
+-- rely on subtype, and a custom let-binding operator, in effect recreating our
+-- own variant of the do-dsl
+
+def Result.attach {α: Type} (o : Result α): Result { x : α // o = ret x } :=
+  match o with
+  | .ret x => .ret ⟨x, rfl⟩
+  | .fail e => .fail e
+
+macro "let" e:term " ⟵ " f:term : doElem =>
+  `(doElem| let ⟨$e, h⟩ ← Result.attach $f)
+
+-- TODO: any way to factorize both definitions?
+macro "let" e:term " <-- " f:term : doElem =>
+  `(doElem| let ⟨$e, h⟩ ← Result.attach $f)
+
+-- We call the hypothesis `h`, in effect making it unavailable to the user
+-- (because too much shadowing). But in practice, once can use the French single
+-- quote notation (input with f< and f>), where `‹ h ›` finds a suitable
+-- hypothesis in the context, this is equivalent to `have x: h := by assumption in x`
+#eval do
+  let y <-- .ret (0: Nat)
+  let _: y = 0 := by cases ‹ ret 0 = ret y › ; decide
+  let r: { x: Nat // x = 0 } := ⟨ y, by assumption ⟩
+  .ret r
+
+----------------------
+-- MACHINE INTEGERS --
+----------------------
+
+-- We redefine our machine integers types.
+
+-- For Isize/Usize, we reuse `getNumBits` from `USize`. You cannot reduce `getNumBits`
+-- using the simplifier, meaning that proofs do not depend on the compile-time value of
+-- USize.size. (Lean assumes 32 or 64-bit platforms, and Rust doesn't really support, at
+-- least officially, 16-bit microcontrollers, so this seems like a fine design decision
+-- for now.)
+
+-- Note from Chris Bailey: "If there's more than one salient property of your
+-- definition then the subtyping strategy might get messy, and the property part
+-- of a subtype is less discoverable by the simplifier or tactics like
+-- library_search." So, we will not add refinements on the return values of the
+-- operations defined on Primitives, but will rather rely on custom lemmas to
+-- invert on possible return values of the primitive operations.
+
+-- Machine integer constants, done via `ofNatCore`, which requires a proof that
+-- the `Nat` fits within the desired integer type. We provide a custom tactic.
+
+open System.Platform.getNumBits
+
+-- TODO: is there a way of only importing System.Platform.getNumBits?
+--
+@[simp] def size_num_bits : Nat := (System.Platform.getNumBits ()).val
+
+-- Remark: Lean seems to use < for the comparisons with the upper bounds by convention.
+-- We keep the F* convention for now.
+@[simp] def Isize.min : Int := - (HPow.hPow 2 (size_num_bits - 1))
+@[simp] def Isize.max : Int := (HPow.hPow 2 (size_num_bits - 1)) - 1
+@[simp] def I8.min    : Int := - (HPow.hPow 2 7)
+@[simp] def I8.max    : Int := HPow.hPow 2 7 - 1
+@[simp] def I16.min   : Int := - (HPow.hPow 2 15)
+@[simp] def I16.max   : Int := HPow.hPow 2 15 - 1
+@[simp] def I32.min   : Int := -(HPow.hPow 2 31)
+@[simp] def I32.max   : Int := HPow.hPow 2 31 - 1
+@[simp] def I64.min   : Int := -(HPow.hPow 2 63)
+@[simp] def I64.max   : Int := HPow.hPow 2 63 - 1
+@[simp] def I128.min  : Int := -(HPow.hPow 2 127)
+@[simp] def I128.max  : Int := HPow.hPow 2 127 - 1
+@[simp] def Usize.min : Int := 0
+@[simp] def Usize.max : Int := HPow.hPow 2 size_num_bits - 1
+@[simp] def U8.min    : Int := 0
+@[simp] def U8.max    : Int := HPow.hPow 2 8 - 1
+@[simp] def U16.min   : Int := 0
+@[simp] def U16.max   : Int := HPow.hPow 2 16 - 1
+@[simp] def U32.min   : Int := 0
+@[simp] def U32.max   : Int := HPow.hPow 2 32 - 1
+@[simp] def U64.min   : Int := 0
+@[simp] def U64.max   : Int := HPow.hPow 2 64 - 1
+@[simp] def U128.min  : Int := 0
+@[simp] def U128.max  : Int := HPow.hPow 2 128 - 1
+
+#assert (I8.min   == -128)
+#assert (I8.max   == 127)
+#assert (I16.min  == -32768)
+#assert (I16.max  == 32767)
+#assert (I32.min  == -2147483648)
+#assert (I32.max  == 2147483647)
+#assert (I64.min  == -9223372036854775808)
+#assert (I64.max  == 9223372036854775807)
+#assert (I128.min == -170141183460469231731687303715884105728)
+#assert (I128.max == 170141183460469231731687303715884105727)
+#assert (U8.min   == 0)
+#assert (U8.max   == 255)
+#assert (U16.min  == 0)
+#assert (U16.max  == 65535)
+#assert (U32.min  == 0)
+#assert (U32.max  == 4294967295)
+#assert (U64.min  == 0)
+#assert (U64.max  == 18446744073709551615)
+#assert (U128.min == 0)
+#assert (U128.max == 340282366920938463463374607431768211455)
+
+inductive ScalarTy :=
+| Isize
+| I8
+| I16
+| I32
+| I64
+| I128
+| Usize
+| U8
+| U16
+| U32
+| U64
+| U128
+
+def Scalar.min (ty : ScalarTy) : Int :=
+  match ty with
+  | .Isize => Isize.min
+  | .I8    => I8.min
+  | .I16   => I16.min
+  | .I32   => I32.min
+  | .I64   => I64.min
+  | .I128  => I128.min
+  | .Usize => Usize.min
+  | .U8    => U8.min
+  | .U16   => U16.min
+  | .U32   => U32.min
+  | .U64   => U64.min
+  | .U128  => U128.min
+
+def Scalar.max (ty : ScalarTy) : Int :=
+  match ty with
+  | .Isize => Isize.max
+  | .I8    => I8.max
+  | .I16   => I16.max
+  | .I32   => I32.max
+  | .I64   => I64.max
+  | .I128  => I128.max
+  | .Usize => Usize.max
+  | .U8    => U8.max
+  | .U16   => U16.max
+  | .U32   => U32.max
+  | .U64   => U64.max
+  | .U128  => U128.max
+
+-- "Conservative" bounds
+-- We use those because we can't compare to the isize bounds (which can't
+-- reduce at compile-time). Whenever we perform an arithmetic operation like
+-- addition we need to check that the result is in bounds: we first compare
+-- to the conservative bounds, which reduce, then compare to the real bounds.
+-- This is useful for the various #asserts that we want to reduce at
+-- type-checking time.
+def Scalar.cMin (ty : ScalarTy) : Int :=
+  match ty with
+  | .Isize => I32.min
+  | _ => Scalar.min ty
+
+def Scalar.cMax (ty : ScalarTy) : Int :=
+  match ty with
+  | .Isize => I32.max
+  | .Usize => U32.max
+  | _ => Scalar.max ty
+
+theorem Scalar.cMin_bound ty : Scalar.min ty ≤ Scalar.cMin ty := by
+  cases ty <;> simp [Scalar.min, Scalar.max, Scalar.cMin, Scalar.cMax] at *
+  cases System.Platform.numBits_eq <;>
+  unfold System.Platform.numBits at * <;>
+  simp [*]
+
+theorem Scalar.cMax_bound ty : Scalar.cMax ty ≤ Scalar.max ty := by
+  cases ty <;> simp [Scalar.min, Scalar.max, Scalar.cMin, Scalar.cMax] at * <;>
+  cases System.Platform.numBits_eq <;>
+  unfold System.Platform.numBits at * <;>
+  simp [*]
+
+theorem Scalar.cMin_suffices ty (h : Scalar.cMin ty ≤ x) : Scalar.min ty ≤ x := by
+  cases ty <;> simp [Scalar.min, Scalar.max, Scalar.cMin, Scalar.cMax] at * <;>
+  cases System.Platform.numBits_eq <;>
+  unfold System.Platform.numBits at * <;>
+  simp [*] at *
+  -- TODO: I would have expected terms like `-(1 + 1) ^ 63` to be simplified
+  linarith
+
+theorem Scalar.cMax_suffices ty (h : x ≤ Scalar.cMax ty) : x ≤ Scalar.max ty := by
+  cases ty <;> simp [Scalar.min, Scalar.max, Scalar.cMin, Scalar.cMax] at * <;>
+  cases System.Platform.numBits_eq <;>
+  unfold System.Platform.numBits at * <;>
+  simp [*] at * <;>
+  -- TODO: I would have expected terms like `-(1 + 1) ^ 63` to be simplified
+  linarith
+
+structure Scalar (ty : ScalarTy) where
+  val : Int
+  hmin : Scalar.min ty ≤ val
+  hmax : val ≤ Scalar.max ty
+deriving Repr
+
+theorem Scalar.bound_suffices (ty : ScalarTy) (x : Int) :
+  Scalar.cMin ty ≤ x ∧ x ≤ Scalar.cMax ty ->
+  Scalar.min ty ≤ x ∧ x ≤ Scalar.max ty
+  :=
+  λ h => by
+  apply And.intro <;> have hmin := Scalar.cMin_bound ty <;> have hmax := Scalar.cMax_bound ty <;> linarith
+
+def Scalar.ofIntCore {ty : ScalarTy} (x : Int)
+  (hmin : Scalar.min ty ≤ x) (hmax : x ≤ Scalar.max ty) : Scalar ty :=
+  { val := x, hmin := hmin, hmax := hmax }
+
+def Scalar.ofInt {ty : ScalarTy} (x : Int)
+  (h : Scalar.min ty ≤ x ∧ x ≤ Scalar.max ty) : Scalar ty :=
+  -- Remark: we initially wrote:
+  --  let ⟨ hmin, hmax ⟩ := h
+  --  Scalar.ofIntCore x hmin hmax
+  -- We updated to the line below because a similar pattern in `Scalar.tryMk`
+  -- made reduction block. Both versions seem to work for `Scalar.ofInt`, though.
+  -- TODO: investigate
+  Scalar.ofIntCore x h.left h.right
+
+@[simp] def Scalar.check_bounds (ty : ScalarTy) (x : Int) : Bool :=
+  (Scalar.cMin ty ≤ x || Scalar.min ty ≤ x) ∧ (x ≤ Scalar.cMax ty || x ≤ Scalar.max ty)
+
+theorem Scalar.check_bounds_prop {ty : ScalarTy} {x : Int} (h: Scalar.check_bounds ty x) :
+  Scalar.min ty ≤ x ∧ x ≤ Scalar.max ty := by
+  simp at *
+  have ⟨ hmin, hmax ⟩ := h
+  have hbmin := Scalar.cMin_bound ty
+  have hbmax := Scalar.cMax_bound ty
+  cases hmin <;> cases hmax <;> apply And.intro <;> linarith
+
+-- Further thoughts: look at what has been done here:
+-- https://github.com/leanprover-community/mathlib4/blob/master/Mathlib/Data/Fin/Basic.lean
+-- and
+-- https://github.com/leanprover-community/mathlib4/blob/master/Mathlib/Data/UInt.lean
+-- which both contain a fair amount of reasoning already!
+def Scalar.tryMk (ty : ScalarTy) (x : Int) : Result (Scalar ty) :=
+  if h:Scalar.check_bounds ty x then
+    -- If we do:
+    -- ```
+    -- let ⟨ hmin, hmax ⟩ := (Scalar.check_bounds_prop h)
+    -- Scalar.ofIntCore x hmin hmax
+    -- ```
+    -- then normalization blocks (for instance, some proofs which use reflexivity fail).
+    -- However, the version below doesn't block reduction (TODO: investigate):
+    return Scalar.ofInt x (Scalar.check_bounds_prop h)
+  else fail integerOverflow
+
+def Scalar.neg {ty : ScalarTy} (x : Scalar ty) : Result (Scalar ty) := Scalar.tryMk ty (- x.val)
+
+def Scalar.div {ty : ScalarTy} (x : Scalar ty) (y : Scalar ty) : Result (Scalar ty) :=
+  if y.val != 0 then Scalar.tryMk ty (x.val / y.val) else fail divisionByZero
+
+-- Our custom remainder operation, which satisfies the semantics of Rust
+-- TODO: is there a better way?
+def scalar_rem (x y : Int) : Int :=
+  if 0 ≤ x then |x| % |y|
+  else - (|x| % |y|)
+
+-- Our custom division operation, which satisfies the semantics of Rust
+-- TODO: is there a better way?
+def scalar_div (x y : Int) : Int :=
+  if 0 ≤ x && 0 ≤ y then |x| / |y|
+  else if 0 ≤ x && y < 0 then - (|x| / |y|)
+  else if x < 0 && 0 ≤ y then - (|x| / |y|)
+  else |x| / |y|
+
+-- Checking that the remainder operation is correct
+#assert scalar_rem 1 2 = 1
+#assert scalar_rem (-1) 2 = -1
+#assert scalar_rem 1 (-2) = 1
+#assert scalar_rem (-1) (-2) = -1
+#assert scalar_rem 7 3 = (1:Int)
+#assert scalar_rem (-7) 3 = -1
+#assert scalar_rem 7 (-3) = 1
+#assert scalar_rem (-7) (-3) = -1
+
+-- Checking that the division operation is correct
+#assert scalar_div 3 2 = 1
+#assert scalar_div (-3) 2 = -1
+#assert scalar_div 3 (-2) = -1
+#assert scalar_div (-3) (-2) = 1
+#assert scalar_div 7 3 = 2
+#assert scalar_div (-7) 3 = -2
+#assert scalar_div 7 (-3) = -2
+#assert scalar_div (-7) (-3) = 2
+
+def Scalar.rem {ty : ScalarTy} (x : Scalar ty) (y : Scalar ty) : Result (Scalar ty) :=
+  if y.val != 0 then Scalar.tryMk ty (x.val % y.val) else fail divisionByZero
+
+def Scalar.add {ty : ScalarTy} (x : Scalar ty) (y : Scalar ty) : Result (Scalar ty) :=
+  Scalar.tryMk ty (x.val + y.val)
+
+def Scalar.sub {ty : ScalarTy} (x : Scalar ty) (y : Scalar ty) : Result (Scalar ty) :=
+  Scalar.tryMk ty (x.val - y.val)
+
+def Scalar.mul {ty : ScalarTy} (x : Scalar ty) (y : Scalar ty) : Result (Scalar ty) :=
+  Scalar.tryMk ty (x.val * y.val)
+
+-- TODO: instances of +, -, * etc. for scalars
+
+-- Cast an integer from a [src_ty] to a [tgt_ty]
+-- TODO: check the semantics of casts in Rust
+def Scalar.cast {src_ty : ScalarTy} (tgt_ty : ScalarTy) (x : Scalar src_ty) : Result (Scalar tgt_ty) :=
+  Scalar.tryMk tgt_ty x.val
+
+-- The scalar types
+-- We declare the definitions as reducible so that Lean can unfold them (useful
+-- for type class resolution for instance).
+@[reducible] def Isize := Scalar .Isize
+@[reducible] def I8    := Scalar .I8
+@[reducible] def I16   := Scalar .I16
+@[reducible] def I32   := Scalar .I32
+@[reducible] def I64   := Scalar .I64
+@[reducible] def I128  := Scalar .I128
+@[reducible] def Usize := Scalar .Usize
+@[reducible] def U8    := Scalar .U8
+@[reducible] def U16   := Scalar .U16
+@[reducible] def U32   := Scalar .U32
+@[reducible] def U64   := Scalar .U64
+@[reducible] def U128  := Scalar .U128
+
+-- TODO: below: not sure this is the best way.
+-- Should we rather overload operations like +, -, etc.?
+-- Also, it is possible to automate the generation of those definitions
+-- with macros (but would it be a good idea? It would be less easy to
+-- read the file, which is not supposed to change a lot)
+
+-- Negation
+
+/--
+Remark: there is no heterogeneous negation in the Lean prelude: we thus introduce
+one here.
+
+The notation typeclass for heterogeneous addition.
+This enables the notation `- a : β` where `a : α`.
+-/
+class HNeg (α : Type u) (β : outParam (Type v)) where
+  /-- `- a` computes the negation of `a`.
+  The meaning of this notation is type-dependent. -/
+  hNeg : α → β
+
+prefix:75  "-"   => HNeg.hNeg
+
+instance : HNeg Isize (Result Isize) where hNeg x := Scalar.neg x
+instance : HNeg I8 (Result I8) where hNeg x := Scalar.neg x
+instance : HNeg I16 (Result I16) where hNeg x := Scalar.neg x
+instance : HNeg I32 (Result I32) where hNeg x := Scalar.neg x
+instance : HNeg I64 (Result I64) where hNeg x := Scalar.neg x
+instance : HNeg I128 (Result I128) where hNeg x := Scalar.neg x
+
+-- Addition
+instance {ty} : HAdd (Scalar ty) (Scalar ty) (Result (Scalar ty)) where
+  hAdd x y := Scalar.add x y
+
+-- Substraction
+instance {ty} : HSub (Scalar ty) (Scalar ty) (Result (Scalar ty)) where
+  hSub x y := Scalar.sub x y
+
+-- Multiplication
+instance {ty} : HMul (Scalar ty) (Scalar ty) (Result (Scalar ty)) where
+  hMul x y := Scalar.mul x y
+
+-- Division
+instance {ty} : HDiv (Scalar ty) (Scalar ty) (Result (Scalar ty)) where
+  hDiv x y := Scalar.div x y
+
+-- Remainder
+instance {ty} : HMod (Scalar ty) (Scalar ty) (Result (Scalar ty)) where
+  hMod x y := Scalar.rem x y
+
+-- ofIntCore
+-- TODO: typeclass?
+def Isize.ofIntCore := @Scalar.ofIntCore .Isize
+def I8.ofIntCore    := @Scalar.ofIntCore .I8
+def I16.ofIntCore   := @Scalar.ofIntCore .I16
+def I32.ofIntCore   := @Scalar.ofIntCore .I32
+def I64.ofIntCore   := @Scalar.ofIntCore .I64
+def I128.ofIntCore  := @Scalar.ofIntCore .I128
+def Usize.ofIntCore := @Scalar.ofIntCore .Usize
+def U8.ofIntCore    := @Scalar.ofIntCore .U8
+def U16.ofIntCore   := @Scalar.ofIntCore .U16
+def U32.ofIntCore   := @Scalar.ofIntCore .U32
+def U64.ofIntCore   := @Scalar.ofIntCore .U64
+def U128.ofIntCore  := @Scalar.ofIntCore .U128
+
+--  ofInt
+-- TODO: typeclass?
+def Isize.ofInt := @Scalar.ofInt .Isize
+def I8.ofInt    := @Scalar.ofInt .I8
+def I16.ofInt   := @Scalar.ofInt .I16
+def I32.ofInt   := @Scalar.ofInt .I32
+def I64.ofInt   := @Scalar.ofInt .I64
+def I128.ofInt  := @Scalar.ofInt .I128
+def Usize.ofInt := @Scalar.ofInt .Usize
+def U8.ofInt    := @Scalar.ofInt .U8
+def U16.ofInt   := @Scalar.ofInt .U16
+def U32.ofInt   := @Scalar.ofInt .U32
+def U64.ofInt   := @Scalar.ofInt .U64
+def U128.ofInt  := @Scalar.ofInt .U128
+
+-- Comparisons
+instance {ty} : LT (Scalar ty) where
+  lt a b := LT.lt a.val b.val
+
+instance {ty} : LE (Scalar ty) where le a b := LE.le a.val b.val
+
+instance Scalar.decLt {ty} (a b : Scalar ty) : Decidable (LT.lt a b) := Int.decLt ..
+instance Scalar.decLe {ty} (a b : Scalar ty) : Decidable (LE.le a b) := Int.decLe ..
+
+theorem Scalar.eq_of_val_eq {ty} : ∀ {i j : Scalar ty}, Eq i.val j.val → Eq i j
+  | ⟨_, _, _⟩, ⟨_, _, _⟩, rfl => rfl
+
+theorem Scalar.val_eq_of_eq {ty} {i j : Scalar ty} (h : Eq i j) : Eq i.val j.val :=
+  h ▸ rfl
+
+theorem Scalar.ne_of_val_ne {ty} {i j : Scalar ty} (h : Not (Eq i.val j.val)) : Not (Eq i j) :=
+  fun h' => absurd (val_eq_of_eq h') h
+
+instance (ty : ScalarTy) : DecidableEq (Scalar ty) :=
+  fun i j =>
+    match decEq i.val j.val with
+    | isTrue h  => isTrue (Scalar.eq_of_val_eq h)
+    | isFalse h => isFalse (Scalar.ne_of_val_ne h)
+
+def Scalar.toInt {ty} (n : Scalar ty) : Int := n.val
+
+-- Tactic to prove that integers are in bounds
+syntax "intlit" : tactic
+
+macro_rules
+  | `(tactic| intlit) => `(tactic| apply Scalar.bound_suffices ; decide)
+
+-- -- We now define a type class that subsumes the various machine integer types, so
+-- -- as to write a concise definition for scalar_cast, rather than exhaustively
+-- -- enumerating all of the possible pairs. We remark that Rust has sane semantics
+-- -- and fails if a cast operation would involve a truncation or modulo.
+
+-- class MachineInteger (t: Type) where
+--   size: Nat
+--   val: t -> Fin size
+--   ofNatCore: (n:Nat) -> LT.lt n size -> t
+
+-- set_option hygiene false in
+-- run_cmd
+--   for typeName in [`UInt8, `UInt16, `UInt32, `UInt64, `USize].map Lean.mkIdent do
+--   Lean.Elab.Command.elabCommand (← `(
+--     namespace $typeName
+--     instance: MachineInteger $typeName where
+--       size := size
+--       val := val
+--       ofNatCore := ofNatCore
+--     end $typeName
+--   ))
+
+-- -- Aeneas only instantiates the destination type (`src` is implicit). We rely on
+-- -- Lean to infer `src`.
+
+-- def scalar_cast { src: Type } (dst: Type) [ MachineInteger src ] [ MachineInteger dst ] (x: src): Result dst :=
+--   if h: MachineInteger.val x < MachineInteger.size dst then
+--     .ret (MachineInteger.ofNatCore (MachineInteger.val x).val h)
+--   else
+--     .fail integerOverflow
+
+-------------
+-- VECTORS --
+-------------
+
+def Vec (α : Type u) := { l : List α // List.length l ≤ Usize.max }
+
+def vec_new (α : Type u): Vec α := ⟨ [], by apply Scalar.cMax_suffices .Usize; simp ⟩
+
+def vec_len (α : Type u) (v : Vec α) : Usize :=
+  let ⟨ v, l ⟩ := v
+  Usize.ofIntCore (List.length v) (by simp [Scalar.min]) l
+ 
+def vec_push_fwd (α : Type u) (_ : Vec α) (_ : α) : Unit := ()
+
+def vec_push_back (α : Type u) (v : Vec α) (x : α) : Result (Vec α)
+  :=
+  let nlen := List.length v.val + 1
+  if h : nlen ≤ U32.max || nlen ≤ Usize.max then
+    have h : nlen ≤ Usize.max := by
+      simp at *
+      cases System.Platform.numBits_eq <;>
+      unfold System.Platform.numBits at * <;>
+      simp [*] at * <;>
+      try assumption
+      cases h <;>
+      linarith
+    return ⟨ List.concat v.val x, by simp at *; assumption ⟩
+  else
+    fail maximumSizeExceeded
+
+def vec_insert_fwd (α : Type u) (v: Vec α) (i: Usize) (_: α): Result Unit :=
+  if i.val < List.length v.val then
+    .ret ()
+  else
+    .fail arrayOutOfBounds
+
+def vec_insert_back (α : Type u) (v: Vec α) (i: Usize) (x: α): Result (Vec α) :=
+  if i.val < List.length v.val then
+    -- TODO: maybe we should redefine a list library which uses integers
+    -- (instead of natural numbers)
+    let i := i.val.toNat
+    .ret ⟨ List.set v.val i x, by
+      have h: List.length v.val ≤ Usize.max := v.property
+      simp [*] at *
+      assumption
+    ⟩
+  else
+    .fail arrayOutOfBounds
+
+def vec_index_to_fin {α : Type u} {v: Vec α} {i: Usize} (h : i.val < List.length v.val) :
+  Fin (List.length v.val) :=
+  let j := i.val.toNat
+  let h: j < List.length v.val := by
+    have heq := @Int.toNat_lt (List.length v.val) i.val i.hmin
+    apply heq.mpr
+    assumption
+  ⟨j, h⟩
+
+def vec_index_fwd (α : Type u) (v: Vec α) (i: Usize): Result α :=
+  if h: i.val < List.length v.val then
+    let i := vec_index_to_fin h
+    .ret (List.get v.val i)
+  else
+    .fail arrayOutOfBounds
+
+def vec_index_back (α : Type u) (v: Vec α) (i: Usize) (_: α): Result Unit :=
+  if i.val < List.length v.val then
+    .ret ()
+  else
+    .fail arrayOutOfBounds
+
+def vec_index_mut_fwd (α : Type u) (v: Vec α) (i: Usize): Result α :=
+  if h: i.val < List.length v.val then
+    let i := vec_index_to_fin h
+    .ret (List.get v.val i)
+  else
+    .fail arrayOutOfBounds
+
+def vec_index_mut_back (α : Type u) (v: Vec α) (i: Usize) (x: α): Result (Vec α) :=
+  if h: i.val < List.length v.val then
+    let i := vec_index_to_fin h
+    .ret ⟨ List.set v.val i x, by
+      have h: List.length v.val ≤ Usize.max := v.property
+      simp [*] at *
+      assumption
+    ⟩
+  else
+    .fail arrayOutOfBounds
+
+----------
+-- MISC --
+----------
+
+@[simp] def mem_replace_fwd (a : Type) (x : a) (_ : a) : a := x
+@[simp] def mem_replace_back (a : Type) (_ : a) (y : a) : a := y
+
+/-- Aeneas-translated function -- useful to reduce non-recursive definitions.
+ Use with `simp [ aeneas ]` -/
+register_simp_attr aeneas
-- 
cgit v1.3.1


From c034a7ea1335705ca1e1a7461fac257df6757d57 Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Fri, 9 Jun 2023 16:07:39 +0200
Subject: Start working on extrinsic proofs of termination

---
 backends/lean/Base.lean            |   1 +
 backends/lean/Base/Diverge.lean    | 208 +++++++++++++++++++++++++++++++++++++
 backends/lean/Base/Primitives.lean |  29 ++++--
 backends/lean/lean-toolchain       |   1 +
 4 files changed, 232 insertions(+), 7 deletions(-)
 create mode 100644 backends/lean/Base/Diverge.lean
 create mode 100644 backends/lean/lean-toolchain

(limited to 'backends/lean/Base/Primitives.lean')

diff --git a/backends/lean/Base.lean b/backends/lean/Base.lean
index 960b2bb5..92e87e6c 100644
--- a/backends/lean/Base.lean
+++ b/backends/lean/Base.lean
@@ -1 +1,2 @@
 import Base.Primitives
+import Base.Diverge
diff --git a/backends/lean/Base/Diverge.lean b/backends/lean/Base/Diverge.lean
new file mode 100644
index 00000000..bd500c25
--- /dev/null
+++ b/backends/lean/Base/Diverge.lean
@@ -0,0 +1,208 @@
+import Lean
+import Base.Primitives
+
+namespace Diverge
+
+open Primitives
+
+section Fix
+
+open Result
+
+variable {a b : Type}
+
+/-! # The least fixed point definition and its properties -/
+
+def least_p (p : Nat → Prop) (n : Nat) : Prop := p n ∧ (∀ m, m < n → ¬ p m)
+noncomputable def least (p : Nat → Prop) : Nat :=
+  Classical.epsilon (least_p p)
+
+-- Auxiliary theorem for [least_spec]: if there exists an `n` satisfying `p`,
+-- there there exists a least `m` satisfying `p`.
+theorem least_spec_aux (p : Nat → Prop) : ∀ (n : Nat), (hn : p n) → ∃ m, least_p p m := by
+  apply Nat.strongRec'
+  intros n hi hn
+  -- Case disjunction on: is n the smallest n satisfying p?
+  match Classical.em (∀ m, m < n → ¬ p m) with
+  | .inl hlt =>
+    -- Yes: trivial
+    exists n
+  | .inr hlt =>
+    simp at *
+    let ⟨ m, ⟨ hmlt, hm ⟩ ⟩ := hlt
+    have hi := hi m hmlt hm
+    apply hi
+
+-- The specification of [least]: either `p` is never satisfied, or it is satisfied
+-- by `least p` and no `n < least p` satisfies `p`.
+theorem least_spec (p : Nat → Prop) : (∀ n, ¬ p n) ∨ (p (least p) ∧ ∀ n, n < least p → ¬ p n) := by
+  -- Case disjunction on the existence of an `n` which satisfies `p`
+  match Classical.em (∀ n, ¬ p n) with
+  | .inl h =>
+    -- There doesn't exist: trivial
+    apply (Or.inl h)
+  | .inr h =>
+    -- There exists: we simply use `least_spec_aux` in combination with the property
+    -- of the epsilon operator
+    simp at *
+    let ⟨ n, hn ⟩ := h
+    apply Or.inr
+    have hl := least_spec_aux p n hn
+    have he := Classical.epsilon_spec hl
+    apply he
+
+/-! # The fixed point definitions -/
+
+def fix_fuel (n : Nat) (f : (a → Result b) → a → Result b) (x : a) : Result b :=
+  match n with
+  | 0 => .div
+  | n + 1 =>
+    f (fix_fuel n f) x
+
+@[simp] def fix_fuel_pred (f : (a → Result b) → a → Result b) (x : a) (n : Nat) :=
+  not (div? (fix_fuel n f x))
+
+def fix_fuel_P (f : (a → Result b) → a → Result b) (x : a) (n : Nat) : Prop :=
+  fix_fuel_pred f x n
+
+noncomputable def fix (f : (a → Result b) → a → Result b) (x : a) : Result b :=
+  fix_fuel (least (fix_fuel_P f x)) f x
+
+/-! # The proof of the fixed point equation -/
+
+-- Monotonicity relation over results
+-- TODO: generalize
+def result_rel {a : Type u} (x1 x2 : Result a) : Prop :=
+  match x1 with
+  | div => True
+  | fail _ => x2 = x1
+  | ret _ => x2 = x1 -- TODO: generalize
+
+-- Monotonicity relation over monadic arrows
+-- TODO: generalize
+def marrow_rel (f g : a → Result b) : Prop :=
+  ∀ x, result_rel (f x) (g x)
+
+-- Validity property for a body
+def is_valid (f : (a → Result b) → a → Result b) : Prop :=
+  ∀ {{g h}}, marrow_rel g h → marrow_rel (f g) (f h)
+
+/-
+
+ -/  
+
+theorem fix_fuel_mono {f : (a → Result b) → a → Result b} (Hvalid : is_valid f) :
+  ∀ {{n m}}, n ≤ m → marrow_rel (fix_fuel n f) (fix_fuel m f) := by
+  intros n
+  induction n
+  case zero => simp [marrow_rel, fix_fuel, result_rel]
+  case succ n1 Hi =>
+    intros m Hle x
+    simp [result_rel]
+    match m with
+    | 0 =>
+      exfalso
+      -- TODO: annoying to do those conversions by hand - try zify?
+      have : n1 + 1 ≤ (0 : Int) := by simp [*] at *
+      have : 0 ≤ n1 := by simp [*] at *
+      linarith
+    | Nat.succ m1 =>
+      simp_arith at Hle
+      simp [fix_fuel]
+      have Hi := Hi Hle
+      simp [is_valid] at Hvalid
+      have Hvalid := Hvalid Hi x
+      simp [result_rel] at Hvalid
+      apply Hvalid
+
+@[simp] theorem neg_fix_fuel_P {f : (a → Result b) → a → Result b} {x : a} {n : Nat} :
+  ¬ fix_fuel_P f x n ↔ (fix_fuel n f x = div) := by
+  simp [fix_fuel_P, div?]
+  cases fix_fuel n f x <;> simp  
+
+theorem fix_fuel_fix_mono {f : (a → Result b) → a → Result b} (Hvalid : is_valid f) :
+  ∀ n, marrow_rel (fix_fuel n f) (fix f) := by
+  intros n x
+  simp [result_rel]
+  have Hl := least_spec (fix_fuel_P f x)
+  simp at Hl
+  match Hl with
+  | .inl Hl => simp [*]
+  | .inr ⟨ Hl, Hn ⟩ =>
+    match Classical.em (fix_fuel n f x = div) with
+    | .inl Hd =>
+      simp [*]
+    | .inr Hd =>
+      have Hineq : least (fix_fuel_P f x) ≤ n := by
+        -- Proof by contradiction
+        cases Classical.em (least (fix_fuel_P f x) ≤ n) <;> simp [*]
+        simp at *
+        rename_i Hineq
+        have Hn := Hn n Hineq
+        contradiction
+      have Hfix : ¬ (fix f x = div) := by
+        simp [fix]
+        -- By property of the least upper bound
+        revert Hd Hl
+        -- TODO: there is no conversion to select the head of a function!
+        have : fix_fuel_P f x (least (fix_fuel_P f x)) = fix_fuel_pred f x (least (fix_fuel_P f x)) :=
+          by simp[fix_fuel_P]
+        simp [this, div?]
+        clear this
+        cases fix_fuel (least (fix_fuel_P f x)) f x <;> simp
+      have Hmono := fix_fuel_mono Hvalid Hineq x
+      simp [result_rel] at Hmono
+      -- TODO: there is no conversion to select the head of a function!
+      revert Hmono Hfix Hd
+      simp [fix]
+      -- TODO: it would be good if cases actually introduces an equation: this
+      -- way we wouldn't have to do all the book-keeping
+      cases fix_fuel (least (fix_fuel_P f x)) f x <;> cases fix_fuel n f x <;>
+      intros <;> simp [*] at *  
+
+theorem fix_fuel_P_least {f : (a → Result b) → a → Result b} (Hvalid : is_valid f) :
+  ∀ {{x n}}, fix_fuel_P f x n → fix_fuel_P f x (least (fix_fuel_P f x)) := by sorry
+
+theorem fix_fixed_eq (f : (a → Result b) → a → Result b) (Hvalid : is_valid f) :
+  ∀ x, fix f x = f (fix f) x := by
+  intros x
+  -- conv => lhs; simp [fix]
+  -- Case disjunction: is there a fuel such that the execution successfully execute?
+  match Classical.em (∃ n, fix_fuel_P f x n) with
+  | .inr He =>
+    -- No fuel: the fixed point evaluates to `div`
+    --simp [fix] at *
+    simp at *
+    simp [fix]
+    have He := He (Nat.succ (least (fix_fuel_P f x)))
+    simp [*, fix_fuel] at *
+    -- Use the monotonicity of `f`
+    have Hmono := fix_fuel_fix_mono Hvalid (least (fix_fuel_P f x)) x
+    simp [result_rel] at Hmono
+    simp [*] at *
+    -- TODO: we need a stronger validity predicate
+    sorry
+  | .inl ⟨ n, He ⟩ =>
+    have Hl := fix_fuel_P_least Hvalid He
+    -- TODO: better control of simplification
+    have Heq : fix_fuel_P f x (least (fix_fuel_P f x)) = fix_fuel_pred f x (least (fix_fuel_P f x)) :=
+      by simp [fix_fuel_P]
+    simp [Heq] at Hl; clear Heq
+    -- The least upper bound is > 0
+    have ⟨ n, Hsucc ⟩ : ∃ n, least (fix_fuel_P f x) = Nat.succ n := by sorry
+    simp [Hsucc] at Hl
+    revert Hl
+    simp [*, div?, fix, fix_fuel]
+    -- Use the monotonicity
+    have Hineq : n ≤ Nat.succ n := by sorry
+    have Hmono := fix_fuel_fix_mono Hvalid n
+    have Hv := Hvalid Hmono x
+    -- Use functional extensionality
+    simp [result_rel, fix] at Hv
+    revert Hv
+    split <;> simp [*] <;> intros <;> simp [*]
+
+  
+end Fix
+
+end Diverge
diff --git a/backends/lean/Base/Primitives.lean b/backends/lean/Base/Primitives.lean
index d3de1d10..85e088fc 100644
--- a/backends/lean/Base/Primitives.lean
+++ b/backends/lean/Base/Primitives.lean
@@ -4,6 +4,8 @@ import Init.Data.List.Basic
 import Mathlib.Tactic.RunCmd
 import Mathlib.Tactic.Linarith
 
+namespace Primitives
+
 --------------------
 -- ASSERT COMMAND --Std.
 --------------------
@@ -46,6 +48,7 @@ open Error
 inductive Result (α : Type u) where
   | ret (v: α): Result α
   | fail (e: Error): Result α
+  | div
 deriving Repr, BEq
 
 open Result
@@ -53,20 +56,28 @@ open Result
 instance Result_Inhabited (α : Type u) : Inhabited (Result α) :=
   Inhabited.mk (fail panic)
 
+instance Result_Nonempty (α : Type u) : Nonempty (Result α) :=
+  Nonempty.intro div
+
 /- HELPERS -/
 
 def ret? {α: Type} (r: Result α): Bool :=
   match r with
-  | Result.ret _ => true
-  | Result.fail _ => false
+  | ret _ => true
+  | fail _ | div => false
+
+def div? {α: Type} (r: Result α): Bool :=
+  match r with
+  | div => true
+  | ret _ | fail _ => false
 
 def massert (b:Bool) : Result Unit :=
-  if b then .ret () else fail assertionFailure
+  if b then ret () else fail assertionFailure
 
 def eval_global {α: Type} (x: Result α) (_: ret? x): α :=
   match x with
-  | Result.fail _ => by contradiction
-  | Result.ret x => x
+  | fail _ | div => by contradiction
+  | ret x => x
 
 /- DO-DSL SUPPORT -/
 
@@ -74,6 +85,7 @@ def bind (x: Result α) (f: α -> Result β) : Result β :=
   match x with
   | ret v  => f v 
   | fail v => fail v
+  | div => div
 
 -- Allows using Result in do-blocks
 instance : Bind Result where
@@ -92,8 +104,9 @@ instance : Pure Result where
 
 def Result.attach {α: Type} (o : Result α): Result { x : α // o = ret x } :=
   match o with
-  | .ret x => .ret ⟨x, rfl⟩
-  | .fail e => .fail e
+  | ret x => ret ⟨x, rfl⟩
+  | fail e => fail e
+  | div => div
 
 macro "let" e:term " ⟵ " f:term : doElem =>
   `(doElem| let ⟨$e, h⟩ ← Result.attach $f)
@@ -648,3 +661,5 @@ def vec_index_mut_back (α : Type u) (v: Vec α) (i: Usize) (x: α): Result (Vec
 /-- Aeneas-translated function -- useful to reduce non-recursive definitions.
  Use with `simp [ aeneas ]` -/
 register_simp_attr aeneas
+
+end Primitives
diff --git a/backends/lean/lean-toolchain b/backends/lean/lean-toolchain
new file mode 100644
index 00000000..1211e372
--- /dev/null
+++ b/backends/lean/lean-toolchain
@@ -0,0 +1 @@
+leanprover/lean4:nightly-2023-05-31
\ No newline at end of file
-- 
cgit v1.3.1


From ccc97b46c166a45255096d3fec2444c90f7c5aaa Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Wed, 14 Jun 2023 11:24:58 +0200
Subject: Make minor modifications

---
 backends/lean/Base/Diverge.lean    | 31 +++++++++++++++++++++++++------
 backends/lean/Base/Primitives.lean |  1 +
 2 files changed, 26 insertions(+), 6 deletions(-)

(limited to 'backends/lean/Base/Primitives.lean')

diff --git a/backends/lean/Base/Diverge.lean b/backends/lean/Base/Diverge.lean
index b5264d0d..37d8eb27 100644
--- a/backends/lean/Base/Diverge.lean
+++ b/backends/lean/Base/Diverge.lean
@@ -11,6 +11,27 @@ open Result
 
 variable {a b : Type}
 
+/-
+TODO:
+- we want an easier to use cases:
+  - keeps in the goal an equation of the shape: `t = case`
+  - if called on Prop terms, uses Classical.em
+  Actually, the cases from mathlib seems already quite powerful
+  (https://leanprover-community.github.io/mathlib_docs/tactics.html#cases)
+  For instance: cases h : e
+  Also: cases_matching
+- better split tactic
+- we need conversions to operate on the head of applications.
+  Actually, something like this works:
+  ```
+  conv at Hl =>
+    apply congr_fun
+    simp [fix_fuel_P]
+  ```
+  Maybe we need a rpt ... ; focus?
+- simplifier/rewriter have a strange behavior sometimes
+-/
+
 /-! # The least fixed point definition and its properties -/
 
 def least_p (p : Nat → Prop) (n : Nat) : Prop := p n ∧ (∀ m, m < n → ¬ p m)
@@ -115,9 +136,7 @@ theorem fix_fuel_mono {f : (a → Result b) → a → Result b} (Hmono : is_mono
     match m with
     | 0 =>
       exfalso
-      -- TODO: annoying to do those conversions by hand - try zify?
-      have : n1 + 1 ≤ (0 : Int) := by simp [*] at *
-      have : 0 ≤ n1 := by simp [*] at *
+      zify at *
       linarith
     | Nat.succ m1 =>
       simp_arith at Hle
@@ -188,9 +207,9 @@ theorem fix_fixed_eq_terminates (f : (a → Result b) → a → Result b) (Hmono
   fix f x = f (fix f) x := by
   have Hl := fix_fuel_P_least Hmono He
   -- TODO: better control of simplification
-  have Heq : fix_fuel_P f x (least (fix_fuel_P f x)) = fix_fuel_pred f x (least (fix_fuel_P f x)) :=
-    by simp [fix_fuel_P]
-  simp [Heq] at Hl; clear Heq
+  conv at Hl =>
+    apply congr_fun
+    simp [fix_fuel_P]
   -- The least upper bound is > 0
   have ⟨ n, Hsucc ⟩ : ∃ n, least (fix_fuel_P f x) = Nat.succ n := by
     revert Hl
diff --git a/backends/lean/Base/Primitives.lean b/backends/lean/Base/Primitives.lean
index 85e088fc..6b922143 100644
--- a/backends/lean/Base/Primitives.lean
+++ b/backends/lean/Base/Primitives.lean
@@ -526,6 +526,7 @@ instance (ty : ScalarTy) : DecidableEq (Scalar ty) :=
 def Scalar.toInt {ty} (n : Scalar ty) : Int := n.val
 
 -- Tactic to prove that integers are in bounds
+-- TODO: use this: https://leanprover.zulipchat.com/#narrow/stream/270676-lean4/topic/instance.20with.20tactic.20autoparam
 syntax "intlit" : tactic
 
 macro_rules
-- 
cgit v1.3.1


From 04cefd3b4f3d2c11cfc3542a5ad6fae31dae4796 Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Sun, 18 Jun 2023 19:09:19 +0200
Subject: Make minor modifications

---
 backends/lean/Base.lean            | 1 +
 backends/lean/Base/Primitives.lean | 5 ++---
 2 files changed, 3 insertions(+), 3 deletions(-)

(limited to 'backends/lean/Base/Primitives.lean')

diff --git a/backends/lean/Base.lean b/backends/lean/Base.lean
index 92e87e6c..f6a78bba 100644
--- a/backends/lean/Base.lean
+++ b/backends/lean/Base.lean
@@ -1,2 +1,3 @@
 import Base.Primitives
 import Base.Diverge
+import Base.TestTactics
diff --git a/backends/lean/Base/Primitives.lean b/backends/lean/Base/Primitives.lean
index 6b922143..d6cc0bad 100644
--- a/backends/lean/Base/Primitives.lean
+++ b/backends/lean/Base/Primitives.lean
@@ -20,9 +20,8 @@ def assertImpl : CommandElab := fun (_stx: Syntax) => do
   runTermElabM (fun _ => do
     let r ← evalTerm Bool (mkConst ``Bool) _stx[1]
     if not r then
-      logInfo "Assertion failed for: "
-      logInfo _stx[1]
-      logError "Expression reduced to false"
+      logInfo ("Assertion failed for:\n" ++ _stx[1])
+      throwError ("Expression reduced to false:\n"  ++ _stx[1])
     pure ())
 
 #eval 2 == 2
-- 
cgit v1.3.1


From a2670f4d097075c23b9affceb8ed8498b73c4b8c Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Mon, 19 Jun 2023 18:52:29 +0200
Subject: Cleanup Diverge.lean

---
 backends/lean/Base/Diverge.lean    | 657 ++++++++++++++++++-------------------
 backends/lean/Base/Primitives.lean |  13 +
 2 files changed, 333 insertions(+), 337 deletions(-)

(limited to 'backends/lean/Base/Primitives.lean')

diff --git a/backends/lean/Base/Diverge.lean b/backends/lean/Base/Diverge.lean
index 2e77c5e0..65c061bd 100644
--- a/backends/lean/Base/Diverge.lean
+++ b/backends/lean/Base/Diverge.lean
@@ -3,12 +3,32 @@ import Lean.Meta.Tactic.Simp
 import Init.Data.List.Basic
 import Mathlib.Tactic.RunCmd
 import Mathlib.Tactic.Linarith
-import Mathlib.Tactic.Tauto
---import Mathlib.Logic
+
+/-
+TODO:
+- we want an easier to use cases:
+  - keeps in the goal an equation of the shape: `t = case`
+  - if called on Prop terms, uses Classical.em
+  Actually, the cases from mathlib seems already quite powerful
+  (https://leanprover-community.github.io/mathlib_docs/tactics.html#cases)
+  For instance: cases h : e
+  Also: cases_matching
+- better split tactic
+- we need conversions to operate on the head of applications.
+  Actually, something like this works:
+  ```
+  conv at Hl =>
+    apply congr_fun
+    simp [fix_fuel_P]
+  ```
+  Maybe we need a rpt ... ; focus?
+- simplifier/rewriter have a strange behavior sometimes
+-/
 
 namespace Diverge
 
 namespace Primitives
+/-! # Copy-pasting from Primitives to make the file self-contained -/
 
 inductive Error where
    | assertionFailure: Error
@@ -29,12 +49,6 @@ deriving Repr, BEq
 
 open Result
 
--- instance Result_Inhabited (α : Type u) : Inhabited (Result α) :=
---   Inhabited.mk (fail panic)
-
--- instance Result_Nonempty (α : Type u) : Nonempty (Result α) :=
---   Nonempty.intro div
-
 def bind (x: Result α) (f: α -> Result β) : Result β :=
   match x with
   | ret v  => f v 
@@ -71,312 +85,276 @@ end Primitives
 
 namespace Fix
 
-open Primitives
-open Result
-
-variable {a b c d : Type}
-
-/-
-TODO:
-- we want an easier to use cases:
-  - keeps in the goal an equation of the shape: `t = case`
-  - if called on Prop terms, uses Classical.em
-  Actually, the cases from mathlib seems already quite powerful
-  (https://leanprover-community.github.io/mathlib_docs/tactics.html#cases)
-  For instance: cases h : e
-  Also: cases_matching
-- better split tactic
-- we need conversions to operate on the head of applications.
-  Actually, something like this works:
-  ```
-  conv at Hl =>
-    apply congr_fun
-    simp [fix_fuel_P]
-  ```
-  Maybe we need a rpt ... ; focus?
-- simplifier/rewriter have a strange behavior sometimes
--/
-
-/-! # The least fixed point definition and its properties -/
-
-def least_p (p : Nat → Prop) (n : Nat) : Prop := p n ∧ (∀ m, m < n → ¬ p m)
-noncomputable def least (p : Nat → Prop) : Nat :=
-  Classical.epsilon (least_p p)
-
--- Auxiliary theorem for [least_spec]: if there exists an `n` satisfying `p`,
--- there there exists a least `m` satisfying `p`.
-theorem least_spec_aux (p : Nat → Prop) : ∀ (n : Nat), (hn : p n) → ∃ m, least_p p m := by
-  apply Nat.strongRec'
-  intros n hi hn
-  -- Case disjunction on: is n the smallest n satisfying p?
-  match Classical.em (∀ m, m < n → ¬ p m) with
-  | .inl hlt =>
-    -- Yes: trivial
-    exists n
-  | .inr hlt =>
-    simp at *
-    let ⟨ m, ⟨ hmlt, hm ⟩ ⟩ := hlt
-    have hi := hi m hmlt hm
-    apply hi
-
--- The specification of [least]: either `p` is never satisfied, or it is satisfied
--- by `least p` and no `n < least p` satisfies `p`.
-theorem least_spec (p : Nat → Prop) : (∀ n, ¬ p n) ∨ (p (least p) ∧ ∀ n, n < least p → ¬ p n) := by
-  -- Case disjunction on the existence of an `n` which satisfies `p`
-  match Classical.em (∀ n, ¬ p n) with
-  | .inl h =>
-    -- There doesn't exist: trivial
-    apply (Or.inl h)
-  | .inr h =>
-    -- There exists: we simply use `least_spec_aux` in combination with the property
-    -- of the epsilon operator
-    simp at *
-    let ⟨ n, hn ⟩ := h
-    apply Or.inr
-    have hl := least_spec_aux p n hn
-    have he := Classical.epsilon_spec hl
-    apply he
-
-/-! # The fixed point definitions -/
-
-def fix_fuel (n : Nat) (f : (a → Result b) → a → Result b) (x : a) : Result b :=
-  match n with
-  | 0 => .div
-  | n + 1 =>
-    f (fix_fuel n f) x
-
-@[simp] def fix_fuel_pred (f : (a → Result b) → a → Result b) (x : a) (n : Nat) :=
-  not (div? (fix_fuel n f x))
-
-def fix_fuel_P (f : (a → Result b) → a → Result b) (x : a) (n : Nat) : Prop :=
-  fix_fuel_pred f x n
-
-noncomputable def fix (f : (a → Result b) → a → Result b) (x : a) : Result b :=
-  fix_fuel (least (fix_fuel_P f x)) f x
-
-/-! # The proof of the fixed point equation -/
-
--- Monotonicity relation over results
--- TODO: generalize
-def result_rel {a : Type u} (x1 x2 : Result a) : Prop :=
-  match x1 with
-  | div => True
-  | fail _ => x2 = x1
-  | ret _ => x2 = x1 -- TODO: generalize
-
--- Monotonicity relation over monadic arrows
--- TODO: Kleisli arrow
--- TODO: generalize
-def marrow_rel (f g : a → Result b) : Prop :=
-  ∀ x, result_rel (f x) (g x)
-
--- Monotonicity property
-def is_mono (f : (a → Result b) → a → Result b) : Prop :=
-  ∀ {{g h}}, marrow_rel g h → marrow_rel (f g) (f h)
-
--- "Continuity" property.
--- We need this, and this looks a lot like continuity. Also see this paper:
--- https://inria.hal.science/file/index/docid/216187/filename/tarski.pdf
-def is_cont (f : (a → Result b) → a → Result b) : Prop :=
-  ∀ x, (Hdiv : ∀ n, fix_fuel (.succ n) f x = div) → f (fix f) x = div
-
--- Validity property for a body
-structure is_valid (f : (a → Result b) → a → Result b) :=
-  intro::
-  hmono : is_mono f
-  hcont : is_cont f
-
-/-
-
- -/
-
-theorem fix_fuel_mono {f : (a → Result b) → a → Result b} (Hmono : is_mono f) :
-  ∀ {{n m}}, n ≤ m → marrow_rel (fix_fuel n f) (fix_fuel m f) := by
-  intros n
-  induction n
-  case zero => simp [marrow_rel, fix_fuel, result_rel]
-  case succ n1 Hi =>
-    intros m Hle x
+  open Primitives
+  open Result
+
+  variable {a b c d : Type}
+
+  /-! # The least fixed point definition and its properties -/
+
+  def least_p (p : Nat → Prop) (n : Nat) : Prop := p n ∧ (∀ m, m < n → ¬ p m)
+  noncomputable def least (p : Nat → Prop) : Nat :=
+    Classical.epsilon (least_p p)
+
+  -- Auxiliary theorem for [least_spec]: if there exists an `n` satisfying `p`,
+  -- there there exists a least `m` satisfying `p`.
+  theorem least_spec_aux (p : Nat → Prop) : ∀ (n : Nat), (hn : p n) → ∃ m, least_p p m := by
+    apply Nat.strongRec'
+    intros n hi hn
+    -- Case disjunction on: is n the smallest n satisfying p?
+    match Classical.em (∀ m, m < n → ¬ p m) with
+    | .inl hlt =>
+      -- Yes: trivial
+      exists n
+    | .inr hlt =>
+      simp at *
+      let ⟨ m, ⟨ hmlt, hm ⟩ ⟩ := hlt
+      have hi := hi m hmlt hm
+      apply hi
+
+  -- The specification of [least]: either `p` is never satisfied, or it is satisfied
+  -- by `least p` and no `n < least p` satisfies `p`.
+  theorem least_spec (p : Nat → Prop) : (∀ n, ¬ p n) ∨ (p (least p) ∧ ∀ n, n < least p → ¬ p n) := by
+    -- Case disjunction on the existence of an `n` which satisfies `p`
+    match Classical.em (∀ n, ¬ p n) with
+    | .inl h =>
+      -- There doesn't exist: trivial
+      apply (Or.inl h)
+    | .inr h =>
+      -- There exists: we simply use `least_spec_aux` in combination with the property
+      -- of the epsilon operator
+      simp at *
+      let ⟨ n, hn ⟩ := h
+      apply Or.inr
+      have hl := least_spec_aux p n hn
+      have he := Classical.epsilon_spec hl
+      apply he
+
+  /-! # The fixed point definitions -/
+
+  def fix_fuel (n : Nat) (f : (a → Result b) → a → Result b) (x : a) : Result b :=
+    match n with
+    | 0 => .div
+    | n + 1 =>
+      f (fix_fuel n f) x
+
+  @[simp] def fix_fuel_pred (f : (a → Result b) → a → Result b) (x : a) (n : Nat) :=
+    not (div? (fix_fuel n f x))
+
+  def fix_fuel_P (f : (a → Result b) → a → Result b) (x : a) (n : Nat) : Prop :=
+    fix_fuel_pred f x n
+
+  noncomputable def fix (f : (a → Result b) → a → Result b) (x : a) : Result b :=
+    fix_fuel (least (fix_fuel_P f x)) f x
+
+  /-! # The validity property -/
+
+  -- Monotonicity relation over results
+  -- TODO: generalize (we should parameterize the definition by a relation over `a`)
+  def result_rel {a : Type u} (x1 x2 : Result a) : Prop :=
+    match x1 with
+    | div => True
+    | fail _ => x2 = x1
+    | ret _ => x2 = x1 -- TODO: generalize
+
+  -- Monotonicity relation over monadic arrows (i.e., Kleisli arrows)
+  def karrow_rel (k1 k2 : a → Result b) : Prop :=
+    ∀ x, result_rel (k1 x) (k2 x)
+
+  -- Monotonicity property for function bodies
+  def is_mono (f : (a → Result b) → a → Result b) : Prop :=
+    ∀ {{k1 k2}}, karrow_rel k1 k2 → karrow_rel (f k1) (f k2)
+
+  -- "Continuity" property.
+  -- We need this, and this looks a lot like continuity. Also see this paper:
+  -- https://inria.hal.science/file/index/docid/216187/filename/tarski.pdf
+  -- We define our "continuity" criteria so that it gives us what we need to
+  -- prove the fixed-point equation, and we can also easily manipulate it.
+  def is_cont (f : (a → Result b) → a → Result b) : Prop :=
+    ∀ x, (Hdiv : ∀ n, fix_fuel (.succ n) f x = div) → f (fix f) x = div
+
+  /-! # The proof of the fixed-point equation -/
+  theorem fix_fuel_mono {f : (a → Result b) → a → Result b} (Hmono : is_mono f) :
+    ∀ {{n m}}, n ≤ m → karrow_rel (fix_fuel n f) (fix_fuel m f) := by
+    intros n
+    induction n
+    case zero => simp [karrow_rel, fix_fuel, result_rel]
+    case succ n1 Hi =>
+      intros m Hle x
+      simp [result_rel]
+      match m with
+      | 0 =>
+        exfalso
+        zify at *
+        linarith
+      | Nat.succ m1 =>
+        simp_arith at Hle
+        simp [fix_fuel]
+        have Hi := Hi Hle
+        have Hmono := Hmono Hi x
+        simp [result_rel] at Hmono
+        apply Hmono
+
+  @[simp] theorem neg_fix_fuel_P {f : (a → Result b) → a → Result b} {x : a} {n : Nat} :
+    ¬ fix_fuel_P f x n ↔ (fix_fuel n f x = div) := by
+    simp [fix_fuel_P, div?]
+    cases fix_fuel n f x <;> simp  
+
+  theorem fix_fuel_fix_mono {f : (a → Result b) → a → Result b} (Hmono : is_mono f) :
+    ∀ n, karrow_rel (fix_fuel n f) (fix f) := by
+    intros n x
     simp [result_rel]
-    match m with
-    | 0 =>
-      exfalso
-      zify at *
-      linarith
-    | Nat.succ m1 =>
-      simp_arith at Hle
-      simp [fix_fuel]
-      have Hi := Hi Hle
-      have Hmono := Hmono Hi x
-      simp [result_rel] at Hmono
-      apply Hmono
-
-@[simp] theorem neg_fix_fuel_P {f : (a → Result b) → a → Result b} {x : a} {n : Nat} :
-  ¬ fix_fuel_P f x n ↔ (fix_fuel n f x = div) := by
-  simp [fix_fuel_P, div?]
-  cases fix_fuel n f x <;> simp  
-
-theorem fix_fuel_fix_mono {f : (a → Result b) → a → Result b} (Hmono : is_mono f) :
-  ∀ n, marrow_rel (fix_fuel n f) (fix f) := by
-  intros n x
-  simp [result_rel]
-  have Hl := least_spec (fix_fuel_P f x)
-  simp at Hl
-  match Hl with
-  | .inl Hl => simp [*]
-  | .inr ⟨ Hl, Hn ⟩ =>
-    match Classical.em (fix_fuel n f x = div) with
-    | .inl Hd =>
-      simp [*]
-    | .inr Hd =>
-      have Hineq : least (fix_fuel_P f x) ≤ n := by
-        -- Proof by contradiction
-        cases Classical.em (least (fix_fuel_P f x) ≤ n) <;> simp [*]
-        simp at *
-        rename_i Hineq
-        have Hn := Hn n Hineq
-        contradiction
-      have Hfix : ¬ (fix f x = div) := by
-        simp [fix]
-        -- By property of the least upper bound
-        revert Hd Hl
-        -- TODO: there is no conversion to select the head of a function!
-        have : fix_fuel_P f x (least (fix_fuel_P f x)) = fix_fuel_pred f x (least (fix_fuel_P f x)) :=
-          by simp[fix_fuel_P]
-        simp [this, div?]
-        clear this
-        cases fix_fuel (least (fix_fuel_P f x)) f x <;> simp
-      have Hmono := fix_fuel_mono Hmono Hineq x
-      simp [result_rel] at Hmono
-      -- TODO: there is no conversion to select the head of a function!
-      revert Hmono Hfix Hd
-      simp [fix]
-      -- TODO: it would be good if cases actually introduces an equation: this
-      -- way we wouldn't have to do all the book-keeping
-      cases fix_fuel (least (fix_fuel_P f x)) f x <;> cases fix_fuel n f x <;>
-      intros <;> simp [*] at *  
-
-theorem fix_fuel_P_least {f : (a → Result b) → a → Result b} (Hmono : is_mono f) :
-  ∀ {{x n}}, fix_fuel_P f x n → fix_fuel_P f x (least (fix_fuel_P f x)) := by
-  intros x n Hf
-  have Hfmono := fix_fuel_fix_mono Hmono n x
-  revert Hf Hfmono
-  -- TODO: would be good to be able to unfold fix_fuel_P only on the left
-  simp [fix_fuel_P, div?, result_rel, fix]
-  cases fix_fuel n f x <;> simp_all
-
--- Prove the fixed point equation in the case there exists some fuel for which
--- the execution terminates
-theorem fix_fixed_eq_terminates (f : (a → Result b) → a → Result b) (Hmono : is_mono f)
-  (x : a) (n : Nat) (He : fix_fuel_P f x n) :
-  fix f x = f (fix f) x := by
-  have Hl := fix_fuel_P_least Hmono He
-  -- TODO: better control of simplification
-  conv at Hl =>
-    apply congr_fun
-    simp [fix_fuel_P]
-  -- The least upper bound is > 0
-  have ⟨ n, Hsucc ⟩ : ∃ n, least (fix_fuel_P f x) = Nat.succ n := by
+    have Hl := least_spec (fix_fuel_P f x)
+    simp at Hl
+    match Hl with
+    | .inl Hl => simp [*]
+    | .inr ⟨ Hl, Hn ⟩ =>
+      match Classical.em (fix_fuel n f x = div) with
+      | .inl Hd =>
+        simp [*]
+      | .inr Hd =>
+        have Hineq : least (fix_fuel_P f x) ≤ n := by
+          -- Proof by contradiction
+          cases Classical.em (least (fix_fuel_P f x) ≤ n) <;> simp [*]
+          simp at *
+          rename_i Hineq
+          have Hn := Hn n Hineq
+          contradiction
+        have Hfix : ¬ (fix f x = div) := by
+          simp [fix]
+          -- By property of the least upper bound
+          revert Hd Hl
+          -- TODO: there is no conversion to select the head of a function!
+          conv => lhs; apply congr_fun; apply congr_fun; apply congr_fun; simp [fix_fuel_P, div?]
+          cases fix_fuel (least (fix_fuel_P f x)) f x <;> simp
+        have Hmono := fix_fuel_mono Hmono Hineq x
+        simp [result_rel] at Hmono
+        simp [fix] at *
+        cases Heq: fix_fuel (least (fix_fuel_P f x)) f x <;>
+        cases Heq':fix_fuel n f x <;>
+        simp_all
+
+  theorem fix_fuel_P_least {f : (a → Result b) → a → Result b} (Hmono : is_mono f) :
+    ∀ {{x n}}, fix_fuel_P f x n → fix_fuel_P f x (least (fix_fuel_P f x)) := by
+    intros x n Hf
+    have Hfmono := fix_fuel_fix_mono Hmono n x
+    -- TODO: there is no conversion to select the head of a function!
+    conv => apply congr_fun; simp [fix_fuel_P]
+    simp [fix_fuel_P] at Hf
+    revert Hf Hfmono
+    simp [div?, result_rel, fix]
+    cases fix_fuel n f x <;> simp_all
+
+  -- Prove the fixed point equation in the case there exists some fuel for which
+  -- the execution terminates
+  theorem fix_fixed_eq_terminates (f : (a → Result b) → a → Result b) (Hmono : is_mono f)
+    (x : a) (n : Nat) (He : fix_fuel_P f x n) :
+    fix f x = f (fix f) x := by
+    have Hl := fix_fuel_P_least Hmono He
+    -- TODO: better control of simplification
+    conv at Hl =>
+      apply congr_fun
+      simp [fix_fuel_P]
+    -- The least upper bound is > 0
+    have ⟨ n, Hsucc ⟩ : ∃ n, least (fix_fuel_P f x) = Nat.succ n := by
+      revert Hl
+      simp [div?]
+      cases least (fix_fuel_P f x) <;> simp [fix_fuel]
+    simp [Hsucc] at Hl
     revert Hl
-    simp [div?]
-    cases least (fix_fuel_P f x) <;> simp [fix_fuel]
-  simp [Hsucc] at Hl
-  revert Hl
-  simp [*, div?, fix, fix_fuel]
-  -- Use the monotonicity
-  have Hfixmono := fix_fuel_fix_mono Hmono n
-  have Hvm := Hmono Hfixmono x
-  -- Use functional extensionality
-  simp [result_rel, fix] at Hvm
-  revert Hvm
-  split <;> simp [*] <;> intros <;> simp [*]
-
--- The final fixed point equation
--- TODO: remove the `forall x`
-theorem fix_fixed_eq {{f : (a → Result b) → a → Result b}} (Hvalid : is_valid f) :
-  ∀ x, fix f x = f (fix f) x := by
-  intros x
-  -- conv => lhs; simp [fix]
-  -- Case disjunction: is there a fuel such that the execution successfully execute?
-  match Classical.em (∃ n, fix_fuel_P f x n) with
-  | .inr He =>
-    -- No fuel: the fixed point evaluates to `div`
-    --simp [fix] at *
-    simp at *
-    conv => lhs; simp [fix]
-    have Hel := He (Nat.succ (least (fix_fuel_P f x))); simp [*, fix_fuel] at *; clear Hel
-    -- Use the "continuity" of `f`
-    have He : ∀ n, fix_fuel (.succ n) f x = div := by intros; simp [*]
-    have Hcont := Hvalid.hcont x He
-    simp [Hcont]
-  | .inl ⟨ n, He ⟩ => apply fix_fixed_eq_terminates f Hvalid.hmono x n He
-
-  /- Making the proofs more systematic -/
-  
-  -- TODO: rewrite is_mono in terms of is_mono_p
-  def is_mono_p (body : (a → Result b) → Result c) : Prop :=
-    ∀ {{g h}}, marrow_rel g h → result_rel (body g) (body h)
-
-  @[simp] theorem is_mono_p_same (x : Result c) :
+    simp [*, div?, fix, fix_fuel]
+    -- Use the monotonicity
+    have Hfixmono := fix_fuel_fix_mono Hmono n
+    have Hvm := Hmono Hfixmono x
+    -- Use functional extensionality
+    simp [result_rel, fix] at Hvm
+    revert Hvm
+    split <;> simp [*] <;> intros <;> simp [*]
+
+  -- The final fixed point equation
+  -- TODO: remove the `forall x`
+  theorem fix_fixed_eq {{f : (a → Result b) → a → Result b}}
+    (Hmono : is_mono f) (Hcont : is_cont f) :
+    ∀ x, fix f x = f (fix f) x := by
+    intros x
+    -- Case disjunction: is there a fuel such that the execution successfully execute?
+    match Classical.em (∃ n, fix_fuel_P f x n) with
+    | .inr He =>
+      -- No fuel: the fixed point evaluates to `div`
+      --simp [fix] at *
+      simp at *
+      conv => lhs; simp [fix]
+      have Hel := He (Nat.succ (least (fix_fuel_P f x))); simp [*, fix_fuel] at *; clear Hel
+      -- Use the "continuity" of `f`
+      have He : ∀ n, fix_fuel (.succ n) f x = div := by intros; simp [*]
+      have Hcont := Hcont x He
+      simp [Hcont]
+    | .inl ⟨ n, He ⟩ => apply fix_fixed_eq_terminates f Hmono x n He
+
+
+  /-! # Making the proofs of validity manageable (and automatable) -/
+
+  -- Monotonicity property for expressions
+  def is_mono_p (e : (a → Result b) → Result c) : Prop :=
+    ∀ {{k1 k2}}, karrow_rel k1 k2 → result_rel (e k1) (e k2)
+
+  theorem is_mono_p_same (x : Result c) :
     @is_mono_p a b c (λ _ => x) := by
-    simp [is_mono_p, marrow_rel, result_rel]
+    simp [is_mono_p, karrow_rel, result_rel]
     split <;> simp
 
-  -- TODO: remove
-  @[simp] theorem is_mono_p_tail_rec (x : a) :
+  theorem is_mono_p_rec (x : a) :
     @is_mono_p a b b (λ f => f x) := by
-    simp_all [is_mono_p, marrow_rel, result_rel]
+    simp_all [is_mono_p, karrow_rel, result_rel]
 
-  -- TODO: rewrite is_cont in terms of is_cont_p
-  def is_cont_p (f : (a → Result b) → a → Result b)
-    (body : (a → Result b) → Result c) : Prop :=
-    (Hc : ∀ n, body (fix_fuel n f) = .div) →
-    body (fix f) = .div
-
-  @[simp] theorem is_cont_p_same (f : (a → Result b) → a → Result b) (x : Result c) :
-    is_cont_p f (λ _ => x) := by
-    simp [is_cont_p]
-
-  -- TODO: remove
-  @[simp] theorem is_cont_p_tail_rec (f : (a → Result b) → a → Result b) (x : a) :
-    is_cont_p f (λ f => f x) := by
-    simp_all [is_cont_p, fix]
-
-  -- Lean is good at unification: we can write a very general version
+  -- The important lemma about `is_mono_p`
   theorem is_mono_p_bind
     (g : (a → Result b) → Result c)
     (h : c → (a → Result b) → Result d) :
     is_mono_p g →
     (∀ y, is_mono_p (h y)) →
-    is_mono_p (λ f => do let y ← g f; h y f) := by
+    is_mono_p (λ k => do let y ← g k; h y k) := by
     intro hg hh
     simp [is_mono_p]
     intro fg fh Hrgh
-    simp [marrow_rel, result_rel]
+    simp [karrow_rel, result_rel]
     have hg := hg Hrgh; simp [result_rel] at hg
     cases heq0: g fg <;> simp_all
     rename_i y _
     have hh := hh y Hrgh; simp [result_rel] at hh
     simp_all
 
-  -- Lean is good at unification: we can write a very general version
-  -- (in particular, it will manage to figure out `g` and `h` when we
-  -- apply the lemma)
+  -- Continuity property for expressions - note that we take the continuation
+  -- as parameter
+  def is_cont_p (k : (a → Result b) → a → Result b)
+    (e : (a → Result b) → Result c) : Prop :=
+    (Hc : ∀ n, e (fix_fuel n k) = .div) →
+    e (fix k) = .div
+
+  theorem is_cont_p_same (k : (a → Result b) → a → Result b) (x : Result c) :
+    is_cont_p k (λ _ => x) := by
+    simp [is_cont_p]
+
+  theorem is_cont_p_rec (f : (a → Result b) → a → Result b) (x : a) :
+    is_cont_p f (λ f => f x) := by
+    simp_all [is_cont_p, fix]
+
+  -- The important lemma about `is_cont_p`
   theorem is_cont_p_bind
-    (f : (a → Result b) → a → Result b)
-    (Hfmono : is_mono f)
+    (k : (a → Result b) → a → Result b)
+    (Hkmono : is_mono k)
     (g : (a → Result b) → Result c)
     (h : c → (a → Result b) → Result d) :
     is_mono_p g →
-    is_cont_p f g →
+    is_cont_p k g →
     (∀ y, is_mono_p (h y)) →
-    (∀ y, is_cont_p f (h y)) →
-    is_cont_p f (λ f => do let y ← g f; h y f) := by
+    (∀ y, is_cont_p k (h y)) →
+    is_cont_p k (λ k => do let y ← g k; h y k) := by
     intro Hgmono Hgcont Hhmono Hhcont
     simp [is_cont_p]
     intro Hdiv
-    -- Case on `g (fix... f)`: is there an n s.t. it terminates?
-    cases Classical.em (∀ n, g (fix_fuel n f) = .div) <;> rename_i Hn
+    -- Case on `g (fix... k)`: is there an n s.t. it terminates?
+    cases Classical.em (∀ n, g (fix_fuel n k) = .div) <;> rename_i Hn
     . -- Case 1: g diverges
       have Hgcont := Hgcont Hn
       simp_all
@@ -384,20 +362,20 @@ theorem fix_fixed_eq {{f : (a → Result b) → a → Result b}} (Hvalid : is_va
       simp at Hn
       let ⟨ n, Hn ⟩ := Hn
       have Hdivn := Hdiv n
-      have Hffmono := fix_fuel_fix_mono Hfmono n
+      have Hffmono := fix_fuel_fix_mono Hkmono n
       have Hgeq := Hgmono Hffmono
       simp [result_rel] at Hgeq
-      cases Heq: g (fix_fuel n f) <;> rename_i y <;> simp_all
+      cases Heq: g (fix_fuel n k) <;> rename_i y <;> simp_all
       -- Remains the .ret case
       -- Use Hdiv to prove that: ∀ n, h y (fix_fuel n f) = div
       -- We do this in two steps: first we prove it for m ≥ n
-      have Hhdiv: ∀ m, h y (fix_fuel m f) = .div := by
-        have Hhdiv : ∀ m, n ≤ m → h y (fix_fuel m f) = .div := by
+      have Hhdiv: ∀ m, h y (fix_fuel m k) = .div := by
+        have Hhdiv : ∀ m, n ≤ m → h y (fix_fuel m k) = .div := by
           -- We use the fact that `g (fix_fuel n f) = .div`, combined with Hdiv
           intro m Hle
           have Hdivm := Hdiv m
           -- Monotonicity of g
-          have Hffmono := fix_fuel_mono Hfmono Hle
+          have Hffmono := fix_fuel_mono Hkmono Hle
           have Hgmono := Hgmono Hffmono
           -- We need to clear Hdiv because otherwise simp_all rewrites Hdivm with Hdiv
           clear Hdiv
@@ -407,42 +385,41 @@ theorem fix_fixed_eq {{f : (a → Result b) → a → Result b}} (Hvalid : is_va
         cases Classical.em (n ≤ m) <;> rename_i Hl
         . apply Hhdiv; assumption
         . simp at Hl
-          -- Make a case disjunction on `h y (fix_fuel m f)`: if it is not equal
+          -- Make a case disjunction on `h y (fix_fuel m k)`: if it is not equal
           -- to div, use the monotonicity of `h y`
           have Hle : m ≤ n := by linarith
-          have Hffmono := fix_fuel_mono Hfmono Hle
+          have Hffmono := fix_fuel_mono Hkmono Hle
           have Hmono := Hhmono y Hffmono
           simp [result_rel] at Hmono
-          cases Heq: h y (fix_fuel m f) <;> simp_all
+          cases Heq: h y (fix_fuel m k) <;> simp_all
       -- We can now use the continuity hypothesis for h
       apply Hhcont; assumption
 
-  -- TODO: move
+  -- The validity property for an expression
   def is_valid_p (k : (a → Result b) → a → Result b)
-    (body : (a → Result b) → Result c) : Prop :=
-    is_mono_p body ∧
-    (is_mono k → is_cont_p k body)
+    (e : (a → Result b) → Result c) : Prop :=
+    is_mono_p e ∧
+    (is_mono k → is_cont_p k e)
 
-  @[simp] theorem is_valid_p_same (f : (a → Result b) → a → Result b) (x : Result c) :
-    is_valid_p f (λ _ => x) := by
-    simp [is_valid_p]
+  @[simp] theorem is_valid_p_same (k : (a → Result b) → a → Result b) (x : Result c) :
+    is_valid_p k (λ _ => x) := by
+    simp [is_valid_p, is_mono_p_same, is_cont_p_same]
 
-  @[simp] theorem is_valid_p_rec (f : (a → Result b) → a → Result b) (x : a) :
-    is_valid_p f (λ f => f x) := by
-    simp [is_valid_p]
+  @[simp] theorem is_valid_p_rec (k : (a → Result b) → a → Result b) (x : a) :
+    is_valid_p k (λ k => k x) := by
+    simp_all [is_valid_p, is_mono_p_rec, is_cont_p_rec]
 
   -- Lean is good at unification: we can write a very general version
   -- (in particular, it will manage to figure out `g` and `h` when we
   -- apply the lemma)
   theorem is_valid_p_bind
-    {{f : (a → Result b) → a → Result b}}
+    {{k : (a → Result b) → a → Result b}}
     {{g : (a → Result b) → Result c}}
     {{h : c → (a → Result b) → Result d}}
-    (Hgvalid : is_valid_p f g)
-    (Hhvalid : ∀ y, is_valid_p f (h y)) :
-    is_valid_p f (λ f => do let y ← g f; h y f) := by
+    (Hgvalid : is_valid_p k g)
+    (Hhvalid : ∀ y, is_valid_p k (h y)) :
+    is_valid_p k (λ k => do let y ← g k; h y k) := by
     let ⟨ Hgmono, Hgcont ⟩ := Hgvalid
-    -- TODO: conversion to move forall below and conjunction?
     simp [is_valid_p, forall_and] at Hhvalid
     have ⟨ Hhmono, Hhcont ⟩ := Hhvalid
     simp [← imp_forall_iff] at Hhcont
@@ -450,36 +427,37 @@ theorem fix_fixed_eq {{f : (a → Result b) → a → Result b}} (Hvalid : is_va
     . -- Monotonicity
       apply is_mono_p_bind <;> assumption
     . -- Continuity
-      intro Hfmono
-      have Hgcont := Hgcont Hfmono
-      have Hhcont := Hhcont Hfmono
+      intro Hkmono
+      have Hgcont := Hgcont Hkmono
+      have Hhcont := Hhcont Hkmono
       apply is_cont_p_bind <;> assumption
 
-  theorem is_valid_p_imp_is_valid {{body : (a → Result b) → a → Result b}}
-    (Hvalid : ∀ f x, is_valid_p f (λ f => body f x)) :
-    is_valid body := by
-    have Hmono : is_mono body := by
+  theorem is_valid_p_imp_is_valid {{e : (a → Result b) → a → Result b}}
+    (Hvalid : ∀ k x, is_valid_p k (λ k => e k x)) :
+    is_mono e ∧ is_cont e := by
+    have Hmono : is_mono e := by
       intro f h Hr x
       have Hmono := Hvalid (λ _ _ => .div) x
       have Hmono := Hmono.left
       apply Hmono; assumption
-    have Hcont : is_cont body := by
+    have Hcont : is_cont e := by
       intro x Hdiv
-      have Hcont := (Hvalid body x).right Hmono
+      have Hcont := (Hvalid e x).right Hmono
       simp [is_cont_p] at Hcont
       apply Hcont
       intro n
       have Hdiv := Hdiv n
       simp [fix_fuel] at Hdiv
       simp [*]
-    apply is_valid.intro Hmono Hcont
+    simp [*]
 
   -- TODO: functional extensionality
-  theorem is_valid_p_fix_fixed_eq {{body : (a → Result b) → a → Result b}}
-    (Hvalid : ∀ f x, is_valid_p f (λ f => body f x)) :
-    fix body = body (fix body) := by
+  theorem is_valid_p_fix_fixed_eq {{e : (a → Result b) → a → Result b}}
+    (Hvalid : ∀ k x, is_valid_p k (λ k => e k x)) :
+    fix e = e (fix e) := by
     apply funext
-    exact fix_fixed_eq (is_valid_p_imp_is_valid Hvalid)
+    have ⟨ Hmono, Hcont ⟩ := is_valid_p_imp_is_valid Hvalid
+    exact fix_fixed_eq Hmono Hcont
 
 end Fix
 
@@ -487,7 +465,7 @@ namespace Ex1
   /- An example of use of the fixed-point -/
   open Primitives Fix
 
-  variable {a : Type} (f : (List a × Int) → Result a)
+  variable {a : Type} (k : (List a × Int) → Result a)
 
   def list_nth_body (x : (List a × Int)) : Result a :=
     let (ls, i) := x
@@ -495,9 +473,9 @@ namespace Ex1
     | [] => .fail .panic
     | hd :: tl =>
       if i = 0 then .ret hd
-      else f (tl, i - 1)
+      else k (tl, i - 1)
 
-  theorem list_nth_body_valid: ∀ k x, is_valid_p k (λ k => @list_nth_body a k x) := by
+  theorem list_nth_body_is_valid: ∀ k x, is_valid_p k (λ k => @list_nth_body a k x) := by
     intro k x
     simp [list_nth_body]
     split <;> simp
@@ -506,6 +484,7 @@ namespace Ex1
   noncomputable
   def list_nth (ls : List a) (i : Int) : Result a := fix list_nth_body (ls, i)
 
+  -- The unfolding equation
   theorem list_nth_eq (ls : List a) (i : Int) :
     list_nth ls i =
       match ls with
@@ -514,17 +493,18 @@ namespace Ex1
         if i = 0 then .ret hd
         else list_nth tl (i - 1)
     := by
-    have Heq := is_valid_p_fix_fixed_eq (@list_nth_body_valid a)
+    have Heq := is_valid_p_fix_fixed_eq (@list_nth_body_is_valid a)
     simp [list_nth]
     conv => lhs; rw [Heq]
 
 end Ex1
 
 namespace Ex2
-  /- Same as Ex1, but we make the body of nth non tail-rec -/
+  /- Same as Ex1, but we make the body of nth non tail-rec (this is mostly
+     to see what happens when there are let-bindings) -/
   open Primitives Fix
 
-  variable {a : Type} (f : (List a × Int) → Result a)
+  variable {a : Type} (k : (List a × Int) → Result a)
 
   def list_nth_body (x : (List a × Int)) : Result a :=
     let (ls, i) := x
@@ -534,10 +514,10 @@ namespace Ex2
       if i = 0 then .ret hd
       else
         do
-          let y ← f (tl, i - 1)
+          let y ← k (tl, i - 1)
           .ret y
 
-  theorem list_nth_body_valid: ∀ k x, is_valid_p k (λ k => @list_nth_body a k x) := by
+  theorem list_nth_body_is_valid: ∀ k x, is_valid_p k (λ k => @list_nth_body a k x) := by
     intro k x
     simp [list_nth_body]
     split <;> simp
@@ -547,6 +527,7 @@ namespace Ex2
   noncomputable
   def list_nth (ls : List a) (i : Int) : Result a := fix list_nth_body (ls, i)
 
+  -- The unfolding equation
   theorem list_nth_eq (ls : List a) (i : Int) :
     (list_nth ls i =
        match ls with
@@ -558,7 +539,7 @@ namespace Ex2
              let y ← list_nth tl (i - 1)
              .ret y)
     := by
-    have Heq := is_valid_p_fix_fixed_eq (@list_nth_body_valid a)
+    have Heq := is_valid_p_fix_fixed_eq (@list_nth_body_is_valid a)
     simp [list_nth]
     conv => lhs; rw [Heq]
 
@@ -577,7 +558,7 @@ namespace Ex3
        the functions in the mutually recursive group may not have the same
        return type.
    -/
-  variable (f : (Int ⊕ Int) → Result (Bool ⊕ Bool))
+  variable (k : (Int ⊕ Int) → Result (Bool ⊕ Bool))
 
   def is_even_is_odd_body (x : (Int ⊕ Int)) : Result (Bool ⊕ Bool) :=
     match x with
@@ -591,7 +572,7 @@ namespace Ex3
             do
               -- Call `odd`: we need to wrap the input value in `.inr`, then
               -- extract the output value
-              let r ← f (.inr (i- 1))
+              let r ← k (.inr (i- 1))
               match r with
               | .inl _ => .fail .panic -- Invalid output
               | .inr b => .ret b
@@ -607,7 +588,7 @@ namespace Ex3
             do
               -- Call `is_even`: we need to wrap the input value in .inr, then
               -- extract the output value
-              let r ← f (.inl (i- 1))
+              let r ← k (.inl (i- 1))
               match r with
               | .inl b => .ret b
               | .inr _ => .fail .panic -- Invalid output
@@ -642,7 +623,8 @@ namespace Ex3
 
   -- TODO: move
   -- TODO: this is not enough
-  theorem swap_if_bind {a b : Type} (e : Prop) [Decidable e] (x y : Result a) (f : a → Result b) :
+  theorem swap_if_bind {a b : Type} (e : Prop) [Decidable e]
+    (x y : Result a) (f : a → Result b) :
     (do
       let z ← (if e then x else y)
       f z)
@@ -651,6 +633,7 @@ namespace Ex3
      else do let z ← y; f z) := by
     split <;> simp
 
+  -- The unfolding equation for `is_even`
   theorem is_even_eq (i : Int) :
     is_even i = (if i = 0 then .ret true else is_odd (i - 1))
     := by
@@ -668,6 +651,7 @@ namespace Ex3
     rename_i v
     split <;> simp
 
+  -- The unfolding equation for `is_odd`
   theorem is_odd_eq (i : Int) :
       is_odd i = (if i = 0 then .ret false else is_even (i - 1))
     := by
@@ -699,7 +683,6 @@ namespace Ex4
         .ret (hd :: tl)
 
   /- The validity theorem for `map`, generic in `f` -/
-  /- TODO: rename the continuation to k in all the lemma statements -/
   theorem map_is_valid
     {{f : (a → Result b) → a → Result c}}
     (Hfvalid : ∀ k x, is_valid_p k (λ k => f k x))
@@ -724,7 +707,6 @@ namespace Ex4
         let tl ← map f tl
         .ret (.node tl)
 
-  /- TODO: make the naming consistent (suffix with "_is") -/
   theorem id_body_is_valid :
     ∀ k x, is_valid_p k (λ k => @id_body a k x) := by
     intro k x
@@ -736,6 +718,7 @@ namespace Ex4
 
   noncomputable def id (t : Tree a) := fix id_body t
 
+  -- The unfolding equation
   theorem id_eq (t : Tree a) :
     (id t =
        match t with
diff --git a/backends/lean/Base/Primitives.lean b/backends/lean/Base/Primitives.lean
index d6cc0bad..1185a07d 100644
--- a/backends/lean/Base/Primitives.lean
+++ b/backends/lean/Base/Primitives.lean
@@ -94,6 +94,10 @@ instance : Bind Result where
 instance : Pure Result where
   pure := fun x => ret x
 
+@[simp] theorem bind_ret (x : α) (f : α → Result β) : bind (.ret x) f = f x := by simp [bind]
+@[simp] theorem bind_fail (x : Error) (f : α → Result β) : bind (.fail x) f = .fail x := by simp [bind]
+@[simp] theorem bind_div (f : α → Result β) : bind .div f = .div := by simp [bind]
+
 /- CUSTOM-DSL SUPPORT -/
 
 -- Let-binding the Result of a monadic operation is oftentimes not sufficient,
@@ -124,6 +128,15 @@ macro "let" e:term " <-- " f:term : doElem =>
   let r: { x: Nat // x = 0 } := ⟨ y, by assumption ⟩
   .ret r
 
+@[simp] theorem bind_tc_ret (x : α) (f : α → Result β) :
+  (do let y ← .ret x; f y) = f x := by simp [Bind.bind, bind]
+
+@[simp] theorem bind_tc_fail (x : Error) (f : α → Result β) :
+  (do let y ← fail x; f y) = fail x := by simp [Bind.bind, bind]
+
+@[simp] theorem bind_tc_div (f : α → Result β) :
+  (do let y ← div; f y) = div := by simp [Bind.bind, bind]
+
 ----------------------
 -- MACHINE INTEGERS --
 ----------------------
-- 
cgit v1.3.1


From 4fd17e4bb91eb46d4704643dfbfbbf0874837b07 Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Tue, 4 Jul 2023 12:49:37 +0200
Subject: Make Diverge use Primitives

---
 backends/lean/Base/Diverge/Base.lean     | 65 +-------------------------------
 backends/lean/Base/Diverge/Elab.lean     |  2 +-
 backends/lean/Base/Diverge/ElabBase.lean |  8 ++--
 backends/lean/Base/Primitives.lean       | 25 ++----------
 4 files changed, 10 insertions(+), 90 deletions(-)

(limited to 'backends/lean/Base/Primitives.lean')

diff --git a/backends/lean/Base/Diverge/Base.lean b/backends/lean/Base/Diverge/Base.lean
index a8503107..e22eb914 100644
--- a/backends/lean/Base/Diverge/Base.lean
+++ b/backends/lean/Base/Diverge/Base.lean
@@ -4,8 +4,7 @@ import Init.Data.List.Basic
 import Mathlib.Tactic.RunCmd
 import Mathlib.Tactic.Linarith
 
--- For debugging
-import Base.Diverge.ElabBase
+import Base.Primitives
 
 /-
 TODO:
@@ -35,68 +34,6 @@ set_option profiler.threshold 100
 
 namespace Diverge
 
-namespace Primitives
-/-! # Copy-pasting from Primitives to make the file self-contained -/
-
-inductive Error where
-   | assertionFailure: Error
-   | integerOverflow: Error
-   | divisionByZero: Error
-   | arrayOutOfBounds: Error
-   | maximumSizeExceeded: Error
-   | panic: Error
-deriving Repr, BEq
-
-open Error
-
-inductive Result (α : Type u) where
-  | ret (v: α): Result α
-  | fail (e: Error): Result α
-  | div
-deriving Repr, BEq
-
-open Result
-
-instance Result_Inhabited (α : Type u) : Inhabited (Result α) :=
-  Inhabited.mk (fail panic)
-
-instance Result_Nonempty (α : Type u) : Nonempty (Result α) :=
-  Nonempty.intro div
-
-def bind {α : Type u} {β : Type v} (x: Result α) (f: α -> Result β) : Result β :=
-  match x with
-  | ret v  => f v 
-  | fail v => fail v
-  | div => div
-
-@[simp] theorem bind_ret (x : α) (f : α → Result β) : bind (.ret x) f = f x := by simp [bind]
-@[simp] theorem bind_fail (x : Error) (f : α → Result β) : bind (.fail x) f = .fail x := by simp [bind]
-@[simp] theorem bind_div (f : α → Result β) : bind .div f = .div := by simp [bind]
-
--- Allows using Result in do-blocks
-instance : Bind Result where
-  bind := bind
-
--- Allows using return x in do-blocks
-instance : Pure Result where
-  pure := fun x => ret x
-
-@[simp] theorem bind_tc_ret (x : α) (f : α → Result β) :
-  (do let y ← .ret x; f y) = f x := by simp [Bind.bind, bind]
-
-@[simp] theorem bind_tc_fail (x : Error) (f : α → Result β) :
-  (do let y ← fail x; f y) = fail x := by simp [Bind.bind, bind]
-
-@[simp] theorem bind_tc_div (f : α → Result β) :
-  (do let y ← div; f y) = div := by simp [Bind.bind, bind]
-
-def div? {α: Type u} (r: Result α): Bool :=
-  match r with
-  | div => true
-  | ret _ | fail _ => false
-
-end Primitives
-
 namespace Fix
 
   open Primitives
diff --git a/backends/lean/Base/Diverge/Elab.lean b/backends/lean/Base/Diverge/Elab.lean
index cc580265..41209021 100644
--- a/backends/lean/Base/Diverge/Elab.lean
+++ b/backends/lean/Base/Diverge/Elab.lean
@@ -174,7 +174,7 @@ private def list_nth_out_ty_inner (a :Type) (scrut1: @Sigma (List a) (fun (_ls :
                  (fun (_ls : List a) => Int)
                  (fun (_scrut1:@Sigma (List a) (fun (_ls : List a) => Int)) => Type)
                  scrut1
-                 (fun (_ls : List a) (_i : Int) => Diverge.Primitives.Result a)
+                 (fun (_ls : List a) (_i : Int) => Primitives.Result a)
 
 private def list_nth_out_ty_outer (scrut0 : @Sigma (Type) (fun (a:Type) =>
                       @Sigma (List a) (fun (_ls : List a) => Int))) :=
diff --git a/backends/lean/Base/Diverge/ElabBase.lean b/backends/lean/Base/Diverge/ElabBase.lean
index fd95291e..1c1062c0 100644
--- a/backends/lean/Base/Diverge/ElabBase.lean
+++ b/backends/lean/Base/Diverge/ElabBase.lean
@@ -4,6 +4,7 @@ namespace Diverge
 
 open Lean Elab Term Meta
 
+-- We can't define and use trace classes in the same file
 initialize registerTraceClass `Diverge.elab
 initialize registerTraceClass `Diverge.def
 initialize registerTraceClass `Diverge.def.sigmas
@@ -11,8 +12,8 @@ initialize registerTraceClass `Diverge.def.genBody
 initialize registerTraceClass `Diverge.def.valid
 initialize registerTraceClass `Diverge.def.unfold
 
--- TODO: move
--- TODO: small helper
+-- Useful helper to explore definitions and figure out the variant
+-- of their sub-expressions.
 def explore_term (incr : String) (e : Expr) : MetaM Unit :=
   match e with
   | .bvar _ => do logInfo m!"{incr}bvar: {e}"; return ()
@@ -81,8 +82,7 @@ private def test2 (x : Nat) : Nat := x
 print_decl test1
 print_decl test2
 
--- We adapted this from AbstractNestedProofs.visit
--- A map visitor function for expressions
+-- A map visitor function for expressions (adapted from `AbstractNestedProofs.visit`)
 partial def mapVisit (k : Expr → MetaM Expr) (e : Expr) : MetaM Expr := do
   let mapVisitBinders (xs : Array Expr) (k2 : MetaM Expr) : MetaM Expr := do
     let localInstances ← getLocalInstances
diff --git a/backends/lean/Base/Primitives.lean b/backends/lean/Base/Primitives.lean
index 1185a07d..117f76a2 100644
--- a/backends/lean/Base/Primitives.lean
+++ b/backends/lean/Base/Primitives.lean
@@ -60,12 +60,12 @@ instance Result_Nonempty (α : Type u) : Nonempty (Result α) :=
 
 /- HELPERS -/
 
-def ret? {α: Type} (r: Result α): Bool :=
+def ret? {α: Type u} (r: Result α): Bool :=
   match r with
   | ret _ => true
   | fail _ | div => false
 
-def div? {α: Type} (r: Result α): Bool :=
+def div? {α: Type u} (r: Result α): Bool :=
   match r with
   | div => true
   | ret _ | fail _ => false
@@ -73,14 +73,14 @@ def div? {α: Type} (r: Result α): Bool :=
 def massert (b:Bool) : Result Unit :=
   if b then ret () else fail assertionFailure
 
-def eval_global {α: Type} (x: Result α) (_: ret? x): α :=
+def eval_global {α: Type u} (x: Result α) (_: ret? x): α :=
   match x with
   | fail _ | div => by contradiction
   | ret x => x
 
 /- DO-DSL SUPPORT -/
 
-def bind (x: Result α) (f: α -> Result β) : Result β :=
+def bind {α : Type u} {β : Type v} (x: Result α) (f: α -> Result β) : Result β :=
   match x with
   | ret v  => f v 
   | fail v => fail v
@@ -111,23 +111,6 @@ def Result.attach {α: Type} (o : Result α): Result { x : α // o = ret x } :=
   | fail e => fail e
   | div => div
 
-macro "let" e:term " ⟵ " f:term : doElem =>
-  `(doElem| let ⟨$e, h⟩ ← Result.attach $f)
-
--- TODO: any way to factorize both definitions?
-macro "let" e:term " <-- " f:term : doElem =>
-  `(doElem| let ⟨$e, h⟩ ← Result.attach $f)
-
--- We call the hypothesis `h`, in effect making it unavailable to the user
--- (because too much shadowing). But in practice, once can use the French single
--- quote notation (input with f< and f>), where `‹ h ›` finds a suitable
--- hypothesis in the context, this is equivalent to `have x: h := by assumption in x`
-#eval do
-  let y <-- .ret (0: Nat)
-  let _: y = 0 := by cases ‹ ret 0 = ret y › ; decide
-  let r: { x: Nat // x = 0 } := ⟨ y, by assumption ⟩
-  .ret r
-
 @[simp] theorem bind_tc_ret (x : α) (f : α → Result β) :
   (do let y ← .ret x; f y) = f x := by simp [Bind.bind, bind]
 
-- 
cgit v1.3.1


From 5ca36bfc50083a01af2b7ae5f75993a520757ef5 Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Wed, 5 Jul 2023 15:17:58 +0200
Subject: Simplify the names used in Primitives.lean

---
 backends/lean/Base/Primitives.lean | 37 ++++++++++++----------
 compiler/Extract.ml                | 49 +++++++++++++++++++----------
 tests/lean/BetreeMain/Funs.lean    |  6 ++--
 tests/lean/External/Funs.lean      |  4 +--
 tests/lean/Hashmap/Funs.lean       | 62 ++++++++++++++++++------------------
 tests/lean/HashmapMain/Funs.lean   | 64 ++++++++++++++++++--------------------
 tests/lean/Loops/Funs.lean         | 12 +++----
 tests/lean/NoNestedBorrows.lean    |  4 +--
 tests/lean/lake-manifest.json      |  2 +-
 9 files changed, 130 insertions(+), 110 deletions(-)

(limited to 'backends/lean/Base/Primitives.lean')

diff --git a/backends/lean/Base/Primitives.lean b/backends/lean/Base/Primitives.lean
index 117f76a2..808c1461 100644
--- a/backends/lean/Base/Primitives.lean
+++ b/backends/lean/Base/Primitives.lean
@@ -564,15 +564,17 @@ macro_rules
 
 def Vec (α : Type u) := { l : List α // List.length l ≤ Usize.max }
 
-def vec_new (α : Type u): Vec α := ⟨ [], by apply Scalar.cMax_suffices .Usize; simp ⟩
+def Vec.new (α : Type u): Vec α := ⟨ [], by apply Scalar.cMax_suffices .Usize; simp ⟩
 
-def vec_len (α : Type u) (v : Vec α) : Usize :=
+def Vec.len (α : Type u) (v : Vec α) : Usize :=
   let ⟨ v, l ⟩ := v
   Usize.ofIntCore (List.length v) (by simp [Scalar.min]) l
  
-def vec_push_fwd (α : Type u) (_ : Vec α) (_ : α) : Unit := ()
+-- This shouldn't be used
+def Vec.push_fwd (α : Type u) (_ : Vec α) (_ : α) : Unit := ()
 
-def vec_push_back (α : Type u) (v : Vec α) (x : α) : Result (Vec α)
+-- This is actually the backward function
+def Vec.push (α : Type u) (v : Vec α) (x : α) : Result (Vec α)
   :=
   let nlen := List.length v.val + 1
   if h : nlen ≤ U32.max || nlen ≤ Usize.max then
@@ -588,13 +590,15 @@ def vec_push_back (α : Type u) (v : Vec α) (x : α) : Result (Vec α)
   else
     fail maximumSizeExceeded
 
-def vec_insert_fwd (α : Type u) (v: Vec α) (i: Usize) (_: α): Result Unit :=
+-- This shouldn't be used
+def Vec.insert_fwd (α : Type u) (v: Vec α) (i: Usize) (_: α): Result Unit :=
   if i.val < List.length v.val then
     .ret ()
   else
     .fail arrayOutOfBounds
 
-def vec_insert_back (α : Type u) (v: Vec α) (i: Usize) (x: α): Result (Vec α) :=
+-- This is actually the backward function
+def Vec.insert (α : Type u) (v: Vec α) (i: Usize) (x: α): Result (Vec α) :=
   if i.val < List.length v.val then
     -- TODO: maybe we should redefine a list library which uses integers
     -- (instead of natural numbers)
@@ -607,7 +611,7 @@ def vec_insert_back (α : Type u) (v: Vec α) (i: Usize) (x: α): Result (Vec α
   else
     .fail arrayOutOfBounds
 
-def vec_index_to_fin {α : Type u} {v: Vec α} {i: Usize} (h : i.val < List.length v.val) :
+def Vec.index_to_fin {α : Type u} {v: Vec α} {i: Usize} (h : i.val < List.length v.val) :
   Fin (List.length v.val) :=
   let j := i.val.toNat
   let h: j < List.length v.val := by
@@ -616,29 +620,30 @@ def vec_index_to_fin {α : Type u} {v: Vec α} {i: Usize} (h : i.val < List.leng
     assumption
   ⟨j, h⟩
 
-def vec_index_fwd (α : Type u) (v: Vec α) (i: Usize): Result α :=
+def Vec.index (α : Type u) (v: Vec α) (i: Usize): Result α :=
   if h: i.val < List.length v.val then
-    let i := vec_index_to_fin h
+    let i := Vec.index_to_fin h
     .ret (List.get v.val i)
   else
     .fail arrayOutOfBounds
 
-def vec_index_back (α : Type u) (v: Vec α) (i: Usize) (_: α): Result Unit :=
+-- This shouldn't be used
+def Vec.index_back (α : Type u) (v: Vec α) (i: Usize) (_: α): Result Unit :=
   if i.val < List.length v.val then
     .ret ()
   else
     .fail arrayOutOfBounds
 
-def vec_index_mut_fwd (α : Type u) (v: Vec α) (i: Usize): Result α :=
+def Vec.index_mut (α : Type u) (v: Vec α) (i: Usize): Result α :=
   if h: i.val < List.length v.val then
-    let i := vec_index_to_fin h
+    let i := Vec.index_to_fin h
     .ret (List.get v.val i)
   else
     .fail arrayOutOfBounds
 
-def vec_index_mut_back (α : Type u) (v: Vec α) (i: Usize) (x: α): Result (Vec α) :=
+def Vec.index_mut_back (α : Type u) (v: Vec α) (i: Usize) (x: α): Result (Vec α) :=
   if h: i.val < List.length v.val then
-    let i := vec_index_to_fin h
+    let i := Vec.index_to_fin h
     .ret ⟨ List.set v.val i x, by
       have h: List.length v.val ≤ Usize.max := v.property
       simp [*] at *
@@ -651,8 +656,8 @@ def vec_index_mut_back (α : Type u) (v: Vec α) (i: Usize) (x: α): Result (Vec
 -- MISC --
 ----------
 
-@[simp] def mem_replace_fwd (a : Type) (x : a) (_ : a) : a := x
-@[simp] def mem_replace_back (a : Type) (_ : a) (y : a) : a := y
+@[simp] def mem.replace_fwd (a : Type) (x : a) (_ : a) : a := x
+@[simp] def mem.replace_back (a : Type) (_ : a) (y : a) : a := y
 
 /-- Aeneas-translated function -- useful to reduce non-recursive definitions.
  Use with `simp [ aeneas ]` -/
diff --git a/compiler/Extract.ml b/compiler/Extract.ml
index 821bf4f7..180ca7ca 100644
--- a/compiler/Extract.ml
+++ b/compiler/Extract.ml
@@ -300,23 +300,40 @@ let assumed_variants () : (assumed_ty * VariantId.id * string) list =
         (Option, option_none_id, "NONE");
       ]
 
-let assumed_llbc_functions :
+let assumed_llbc_functions () :
     (A.assumed_fun_id * T.RegionGroupId.id option * string) list =
   let rg0 = Some T.RegionGroupId.zero in
-  [
-    (Replace, None, "mem_replace_fwd");
-    (Replace, rg0, "mem_replace_back");
-    (VecNew, None, "vec_new");
-    (VecPush, None, "vec_push_fwd") (* Shouldn't be used *);
-    (VecPush, rg0, "vec_push_back");
-    (VecInsert, None, "vec_insert_fwd") (* Shouldn't be used *);
-    (VecInsert, rg0, "vec_insert_back");
-    (VecLen, None, "vec_len");
-    (VecIndex, None, "vec_index_fwd");
-    (VecIndex, rg0, "vec_index_back") (* shouldn't be used *);
-    (VecIndexMut, None, "vec_index_mut_fwd");
-    (VecIndexMut, rg0, "vec_index_mut_back");
-  ]
+  match !backend with
+  | FStar | Coq | HOL4 ->
+      [
+        (Replace, None, "mem_replace_fwd");
+        (Replace, rg0, "mem_replace_back");
+        (VecNew, None, "vec_new");
+        (VecPush, None, "vec_push_fwd") (* Shouldn't be used *);
+        (VecPush, rg0, "vec_push_back");
+        (VecInsert, None, "vec_insert_fwd") (* Shouldn't be used *);
+        (VecInsert, rg0, "vec_insert_back");
+        (VecLen, None, "vec_len");
+        (VecIndex, None, "vec_index_fwd");
+        (VecIndex, rg0, "vec_index_back") (* shouldn't be used *);
+        (VecIndexMut, None, "vec_index_mut_fwd");
+        (VecIndexMut, rg0, "vec_index_mut_back");
+      ]
+  | Lean ->
+      [
+        (Replace, None, "mem.replace_fwd");
+        (Replace, rg0, "mem.replace_back");
+        (VecNew, None, "Vec.new");
+        (VecPush, None, "Vec.push_fwd") (* Shouldn't be used *);
+        (VecPush, rg0, "Vec.push");
+        (VecInsert, None, "Vec.insert_fwd") (* Shouldn't be used *);
+        (VecInsert, rg0, "Vec.insert");
+        (VecLen, None, "Vec.len");
+        (VecIndex, None, "Vec.index");
+        (VecIndex, rg0, "Vec.index_back") (* shouldn't be used *);
+        (VecIndexMut, None, "Vec.index_mut");
+        (VecIndexMut, rg0, "Vec.index_mut_back");
+      ]
 
 let assumed_pure_functions () : (pure_assumed_fun_id * string) list =
   match !backend with
@@ -344,7 +361,7 @@ let names_map_init () : names_map_init =
     assumed_adts = assumed_adts ();
     assumed_structs;
     assumed_variants = assumed_variants ();
-    assumed_llbc_functions;
+    assumed_llbc_functions = assumed_llbc_functions ();
     assumed_pure_functions = assumed_pure_functions ();
   }
 
diff --git a/tests/lean/BetreeMain/Funs.lean b/tests/lean/BetreeMain/Funs.lean
index 3a678c71..074fff5e 100644
--- a/tests/lean/BetreeMain/Funs.lean
+++ b/tests/lean/BetreeMain/Funs.lean
@@ -124,13 +124,13 @@ divergent def betree.List.split_at_fwd
 /- [betree_main::betree::List::{1}::push_front] -/
 def betree.List.push_front_fwd_back
   (T : Type) (self : betree.List T) (x : T) : Result (betree.List T) :=
-  let tl := mem_replace_fwd (betree.List T) self betree.List.Nil
+  let tl := mem.replace_fwd (betree.List T) self betree.List.Nil
   let l := tl
   Result.ret (betree.List.Cons x l)
 
 /- [betree_main::betree::List::{1}::pop_front] -/
 def betree.List.pop_front_fwd (T : Type) (self : betree.List T) : Result T :=
-  let ls := mem_replace_fwd (betree.List T) self betree.List.Nil
+  let ls := mem.replace_fwd (betree.List T) self betree.List.Nil
   match ls with
   | betree.List.Cons x tl => Result.ret x
   | betree.List.Nil => Result.fail Error.panic
@@ -138,7 +138,7 @@ def betree.List.pop_front_fwd (T : Type) (self : betree.List T) : Result T :=
 /- [betree_main::betree::List::{1}::pop_front] -/
 def betree.List.pop_front_back
   (T : Type) (self : betree.List T) : Result (betree.List T) :=
-  let ls := mem_replace_fwd (betree.List T) self betree.List.Nil
+  let ls := mem.replace_fwd (betree.List T) self betree.List.Nil
   match ls with
   | betree.List.Cons x tl => Result.ret tl
   | betree.List.Nil => Result.fail Error.panic
diff --git a/tests/lean/External/Funs.lean b/tests/lean/External/Funs.lean
index 10efc3db..3fc21d91 100644
--- a/tests/lean/External/Funs.lean
+++ b/tests/lean/External/Funs.lean
@@ -36,8 +36,8 @@ def test_new_non_zero_u32_fwd
 /- [external::test_vec] -/
 def test_vec_fwd : Result Unit :=
   do
-    let v := vec_new U32
-    let _ ← vec_push_back U32 v (U32.ofInt 0 (by intlit))
+    let v := Vec.new U32
+    let _ ← Vec.push U32 v (U32.ofInt 0 (by intlit))
     Result.ret ()
 
 /- Unit test for [external::test_vec] -/
diff --git a/tests/lean/Hashmap/Funs.lean b/tests/lean/Hashmap/Funs.lean
index 4f16688b..48038bfb 100644
--- a/tests/lean/Hashmap/Funs.lean
+++ b/tests/lean/Hashmap/Funs.lean
@@ -15,7 +15,7 @@ divergent def HashMap.allocate_slots_loop_fwd
   if n > (Usize.ofInt 0 (by intlit))
   then
     do
-      let slots0 ← vec_push_back (List T) slots List.Nil
+      let slots0 ← Vec.push (List T) slots List.Nil
       let n0 ← n - (Usize.ofInt 1 (by intlit))
       HashMap.allocate_slots_loop_fwd T slots0 n0
   else Result.ret slots
@@ -32,7 +32,7 @@ def HashMap.new_with_capacity_fwd
   Result (HashMap T)
   :=
   do
-    let v := vec_new (List T)
+    let v := Vec.new (List T)
     let slots ← HashMap.allocate_slots_fwd T v capacity
     let i ← capacity * max_load_dividend
     let i0 ← i / max_load_divisor
@@ -52,12 +52,12 @@ def HashMap.new_fwd (T : Type) : Result (HashMap T) :=
 /- [hashmap::HashMap::{0}::clear] -/
 divergent def HashMap.clear_loop_fwd_back
   (T : Type) (slots : Vec (List T)) (i : Usize) : Result (Vec (List T)) :=
-  let i0 := vec_len (List T) slots
+  let i0 := Vec.len (List T) slots
   if i < i0
   then
     do
       let i1 ← i + (Usize.ofInt 1 (by intlit))
-      let slots0 ← vec_index_mut_back (List T) slots i List.Nil
+      let slots0 ← Vec.index_mut_back (List T) slots i List.Nil
       HashMap.clear_loop_fwd_back T slots0 i1
   else Result.ret slots
 
@@ -121,22 +121,22 @@ def HashMap.insert_no_resize_fwd_back
   :=
   do
     let hash ← hash_key_fwd key
-    let i := vec_len (List T) self.hash_map_slots
+    let i := Vec.len (List T) self.hash_map_slots
     let hash_mod ← hash % i
-    let l ← vec_index_mut_fwd (List T) self.hash_map_slots hash_mod
+    let l ← Vec.index_mut (List T) self.hash_map_slots hash_mod
     let inserted ← HashMap.insert_in_list_fwd T key value l
     if inserted
     then
       do
         let i0 ← self.hash_map_num_entries + (Usize.ofInt 1 (by intlit))
         let l0 ← HashMap.insert_in_list_back T key value l
-        let v ← vec_index_mut_back (List T) self.hash_map_slots hash_mod l0
+        let v ← Vec.index_mut_back (List T) self.hash_map_slots hash_mod l0
         Result.ret
           { self with hash_map_num_entries := i0, hash_map_slots := v }
     else
       do
         let l0 ← HashMap.insert_in_list_back T key value l
-        let v ← vec_index_mut_back (List T) self.hash_map_slots hash_mod l0
+        let v ← Vec.index_mut_back (List T) self.hash_map_slots hash_mod l0
         Result.ret { self with hash_map_slots := v }
 
 /- [core::num::u32::{9}::MAX] -/
@@ -164,16 +164,16 @@ divergent def HashMap.move_elements_loop_fwd_back
   (T : Type) (ntable : HashMap T) (slots : Vec (List T)) (i : Usize) :
   Result ((HashMap T) × (Vec (List T)))
   :=
-  let i0 := vec_len (List T) slots
+  let i0 := Vec.len (List T) slots
   if i < i0
   then
     do
-      let l ← vec_index_mut_fwd (List T) slots i
-      let ls := mem_replace_fwd (List T) l List.Nil
+      let l ← Vec.index_mut (List T) slots i
+      let ls := mem.replace_fwd (List T) l List.Nil
       let ntable0 ← HashMap.move_elements_from_list_fwd_back T ntable ls
       let i1 ← i + (Usize.ofInt 1 (by intlit))
-      let l0 := mem_replace_back (List T) l List.Nil
-      let slots0 ← vec_index_mut_back (List T) slots i l0
+      let l0 := mem.replace_back (List T) l List.Nil
+      let slots0 ← Vec.index_mut_back (List T) slots i l0
       HashMap.move_elements_loop_fwd_back T ntable0 slots0 i1
   else Result.ret (ntable, slots)
 
@@ -189,7 +189,7 @@ def HashMap.try_resize_fwd_back
   (T : Type) (self : HashMap T) : Result (HashMap T) :=
   do
     let max_usize ← Scalar.cast .Usize core_num_u32_max_c
-    let capacity := vec_len (List T) self.hash_map_slots
+    let capacity := Vec.len (List T) self.hash_map_slots
     let n1 ← max_usize / (Usize.ofInt 2 (by intlit))
     let (i, i0) := self.hash_map_max_load_factor
     let i1 ← n1 / i
@@ -242,9 +242,9 @@ def HashMap.contains_key_fwd
   (T : Type) (self : HashMap T) (key : Usize) : Result Bool :=
   do
     let hash ← hash_key_fwd key
-    let i := vec_len (List T) self.hash_map_slots
+    let i := Vec.len (List T) self.hash_map_slots
     let hash_mod ← hash % i
-    let l ← vec_index_fwd (List T) self.hash_map_slots hash_mod
+    let l ← Vec.index (List T) self.hash_map_slots hash_mod
     HashMap.contains_key_in_list_fwd T key l
 
 /- [hashmap::HashMap::{0}::get_in_list] -/
@@ -266,9 +266,9 @@ def HashMap.get_in_list_fwd
 def HashMap.get_fwd (T : Type) (self : HashMap T) (key : Usize) : Result T :=
   do
     let hash ← hash_key_fwd key
-    let i := vec_len (List T) self.hash_map_slots
+    let i := Vec.len (List T) self.hash_map_slots
     let hash_mod ← hash % i
-    let l ← vec_index_fwd (List T) self.hash_map_slots hash_mod
+    let l ← Vec.index (List T) self.hash_map_slots hash_mod
     HashMap.get_in_list_fwd T key l
 
 /- [hashmap::HashMap::{0}::get_mut_in_list] -/
@@ -309,9 +309,9 @@ def HashMap.get_mut_fwd
   (T : Type) (self : HashMap T) (key : Usize) : Result T :=
   do
     let hash ← hash_key_fwd key
-    let i := vec_len (List T) self.hash_map_slots
+    let i := Vec.len (List T) self.hash_map_slots
     let hash_mod ← hash % i
-    let l ← vec_index_mut_fwd (List T) self.hash_map_slots hash_mod
+    let l ← Vec.index_mut (List T) self.hash_map_slots hash_mod
     HashMap.get_mut_in_list_fwd T l key
 
 /- [hashmap::HashMap::{0}::get_mut] -/
@@ -321,11 +321,11 @@ def HashMap.get_mut_back
   :=
   do
     let hash ← hash_key_fwd key
-    let i := vec_len (List T) self.hash_map_slots
+    let i := Vec.len (List T) self.hash_map_slots
     let hash_mod ← hash % i
-    let l ← vec_index_mut_fwd (List T) self.hash_map_slots hash_mod
+    let l ← Vec.index_mut (List T) self.hash_map_slots hash_mod
     let l0 ← HashMap.get_mut_in_list_back T l key ret0
-    let v ← vec_index_mut_back (List T) self.hash_map_slots hash_mod l0
+    let v ← Vec.index_mut_back (List T) self.hash_map_slots hash_mod l0
     Result.ret { self with hash_map_slots := v }
 
 /- [hashmap::HashMap::{0}::remove_from_list] -/
@@ -335,7 +335,7 @@ divergent def HashMap.remove_from_list_loop_fwd
   | List.Cons ckey t tl =>
     if ckey = key
     then
-      let mv_ls := mem_replace_fwd (List T) (List.Cons ckey t tl) List.Nil
+      let mv_ls := mem.replace_fwd (List T) (List.Cons ckey t tl) List.Nil
       match mv_ls with
       | List.Cons i cvalue tl0 => Result.ret (Option.some cvalue)
       | List.Nil => Result.fail Error.panic
@@ -354,7 +354,7 @@ divergent def HashMap.remove_from_list_loop_back
   | List.Cons ckey t tl =>
     if ckey = key
     then
-      let mv_ls := mem_replace_fwd (List T) (List.Cons ckey t tl) List.Nil
+      let mv_ls := mem.replace_fwd (List T) (List.Cons ckey t tl) List.Nil
       match mv_ls with
       | List.Cons i cvalue tl0 => Result.ret tl0
       | List.Nil => Result.fail Error.panic
@@ -374,9 +374,9 @@ def HashMap.remove_fwd
   (T : Type) (self : HashMap T) (key : Usize) : Result (Option T) :=
   do
     let hash ← hash_key_fwd key
-    let i := vec_len (List T) self.hash_map_slots
+    let i := Vec.len (List T) self.hash_map_slots
     let hash_mod ← hash % i
-    let l ← vec_index_mut_fwd (List T) self.hash_map_slots hash_mod
+    let l ← Vec.index_mut (List T) self.hash_map_slots hash_mod
     let x ← HashMap.remove_from_list_fwd T key l
     match x with
     | Option.none => Result.ret Option.none
@@ -390,21 +390,21 @@ def HashMap.remove_back
   (T : Type) (self : HashMap T) (key : Usize) : Result (HashMap T) :=
   do
     let hash ← hash_key_fwd key
-    let i := vec_len (List T) self.hash_map_slots
+    let i := Vec.len (List T) self.hash_map_slots
     let hash_mod ← hash % i
-    let l ← vec_index_mut_fwd (List T) self.hash_map_slots hash_mod
+    let l ← Vec.index_mut (List T) self.hash_map_slots hash_mod
     let x ← HashMap.remove_from_list_fwd T key l
     match x with
     | Option.none =>
       do
         let l0 ← HashMap.remove_from_list_back T key l
-        let v ← vec_index_mut_back (List T) self.hash_map_slots hash_mod l0
+        let v ← Vec.index_mut_back (List T) self.hash_map_slots hash_mod l0
         Result.ret { self with hash_map_slots := v }
     | Option.some x0 =>
       do
         let i0 ← self.hash_map_num_entries - (Usize.ofInt 1 (by intlit))
         let l0 ← HashMap.remove_from_list_back T key l
-        let v ← vec_index_mut_back (List T) self.hash_map_slots hash_mod l0
+        let v ← Vec.index_mut_back (List T) self.hash_map_slots hash_mod l0
         Result.ret
           { self with hash_map_num_entries := i0, hash_map_slots := v }
 
diff --git a/tests/lean/HashmapMain/Funs.lean b/tests/lean/HashmapMain/Funs.lean
index fd556878..1a741a2d 100644
--- a/tests/lean/HashmapMain/Funs.lean
+++ b/tests/lean/HashmapMain/Funs.lean
@@ -18,7 +18,7 @@ divergent def hashmap.HashMap.allocate_slots_loop_fwd
   if n > (Usize.ofInt 0 (by intlit))
   then
     do
-      let slots0 ← vec_push_back (hashmap.List T) slots hashmap.List.Nil
+      let slots0 ← Vec.push (hashmap.List T) slots hashmap.List.Nil
       let n0 ← n - (Usize.ofInt 1 (by intlit))
       hashmap.HashMap.allocate_slots_loop_fwd T slots0 n0
   else Result.ret slots
@@ -37,7 +37,7 @@ def hashmap.HashMap.new_with_capacity_fwd
   Result (hashmap.HashMap T)
   :=
   do
-    let v := vec_new (hashmap.List T)
+    let v := Vec.new (hashmap.List T)
     let slots ← hashmap.HashMap.allocate_slots_fwd T v capacity
     let i ← capacity * max_load_dividend
     let i0 ← i / max_load_divisor
@@ -60,13 +60,13 @@ divergent def hashmap.HashMap.clear_loop_fwd_back
   (T : Type) (slots : Vec (hashmap.List T)) (i : Usize) :
   Result (Vec (hashmap.List T))
   :=
-  let i0 := vec_len (hashmap.List T) slots
+  let i0 := Vec.len (hashmap.List T) slots
   if i < i0
   then
     do
       let i1 ← i + (Usize.ofInt 1 (by intlit))
       let slots0 ←
-        vec_index_mut_back (hashmap.List T) slots i hashmap.List.Nil
+        Vec.index_mut_back (hashmap.List T) slots i hashmap.List.Nil
       hashmap.HashMap.clear_loop_fwd_back T slots0 i1
   else Result.ret slots
 
@@ -136,10 +136,10 @@ def hashmap.HashMap.insert_no_resize_fwd_back
   :=
   do
     let hash ← hashmap.hash_key_fwd key
-    let i := vec_len (hashmap.List T) self.hashmap_hash_map_slots
+    let i := Vec.len (hashmap.List T) self.hashmap_hash_map_slots
     let hash_mod ← hash % i
     let l ←
-      vec_index_mut_fwd (hashmap.List T) self.hashmap_hash_map_slots hash_mod
+      Vec.index_mut (hashmap.List T) self.hashmap_hash_map_slots hash_mod
     let inserted ← hashmap.HashMap.insert_in_list_fwd T key value l
     if inserted
     then
@@ -148,7 +148,7 @@ def hashmap.HashMap.insert_no_resize_fwd_back
           (Usize.ofInt 1 (by intlit))
         let l0 ← hashmap.HashMap.insert_in_list_back T key value l
         let v ←
-          vec_index_mut_back (hashmap.List T) self.hashmap_hash_map_slots
+          Vec.index_mut_back (hashmap.List T) self.hashmap_hash_map_slots
             hash_mod l0
         Result.ret
           {
@@ -160,7 +160,7 @@ def hashmap.HashMap.insert_no_resize_fwd_back
       do
         let l0 ← hashmap.HashMap.insert_in_list_back T key value l
         let v ←
-          vec_index_mut_back (hashmap.List T) self.hashmap_hash_map_slots
+          Vec.index_mut_back (hashmap.List T) self.hashmap_hash_map_slots
             hash_mod l0
         Result.ret { self with hashmap_hash_map_slots := v }
 
@@ -194,17 +194,17 @@ divergent def hashmap.HashMap.move_elements_loop_fwd_back
   (i : Usize) :
   Result ((hashmap.HashMap T) × (Vec (hashmap.List T)))
   :=
-  let i0 := vec_len (hashmap.List T) slots
+  let i0 := Vec.len (hashmap.List T) slots
   if i < i0
   then
     do
-      let l ← vec_index_mut_fwd (hashmap.List T) slots i
-      let ls := mem_replace_fwd (hashmap.List T) l hashmap.List.Nil
+      let l ← Vec.index_mut (hashmap.List T) slots i
+      let ls := mem.replace_fwd (hashmap.List T) l hashmap.List.Nil
       let ntable0 ←
         hashmap.HashMap.move_elements_from_list_fwd_back T ntable ls
       let i1 ← i + (Usize.ofInt 1 (by intlit))
-      let l0 := mem_replace_back (hashmap.List T) l hashmap.List.Nil
-      let slots0 ← vec_index_mut_back (hashmap.List T) slots i l0
+      let l0 := mem.replace_back (hashmap.List T) l hashmap.List.Nil
+      let slots0 ← Vec.index_mut_back (hashmap.List T) slots i l0
       hashmap.HashMap.move_elements_loop_fwd_back T ntable0 slots0 i1
   else Result.ret (ntable, slots)
 
@@ -221,7 +221,7 @@ def hashmap.HashMap.try_resize_fwd_back
   (T : Type) (self : hashmap.HashMap T) : Result (hashmap.HashMap T) :=
   do
     let max_usize ← Scalar.cast .Usize core_num_u32_max_c
-    let capacity := vec_len (hashmap.List T) self.hashmap_hash_map_slots
+    let capacity := Vec.len (hashmap.List T) self.hashmap_hash_map_slots
     let n1 ← max_usize / (Usize.ofInt 2 (by intlit))
     let (i, i0) := self.hashmap_hash_map_max_load_factor
     let i1 ← n1 / i
@@ -274,10 +274,9 @@ def hashmap.HashMap.contains_key_fwd
   (T : Type) (self : hashmap.HashMap T) (key : Usize) : Result Bool :=
   do
     let hash ← hashmap.hash_key_fwd key
-    let i := vec_len (hashmap.List T) self.hashmap_hash_map_slots
+    let i := Vec.len (hashmap.List T) self.hashmap_hash_map_slots
     let hash_mod ← hash % i
-    let l ←
-      vec_index_fwd (hashmap.List T) self.hashmap_hash_map_slots hash_mod
+    let l ← Vec.index (hashmap.List T) self.hashmap_hash_map_slots hash_mod
     hashmap.HashMap.contains_key_in_list_fwd T key l
 
 /- [hashmap_main::hashmap::HashMap::{0}::get_in_list] -/
@@ -300,10 +299,9 @@ def hashmap.HashMap.get_fwd
   (T : Type) (self : hashmap.HashMap T) (key : Usize) : Result T :=
   do
     let hash ← hashmap.hash_key_fwd key
-    let i := vec_len (hashmap.List T) self.hashmap_hash_map_slots
+    let i := Vec.len (hashmap.List T) self.hashmap_hash_map_slots
     let hash_mod ← hash % i
-    let l ←
-      vec_index_fwd (hashmap.List T) self.hashmap_hash_map_slots hash_mod
+    let l ← Vec.index (hashmap.List T) self.hashmap_hash_map_slots hash_mod
     hashmap.HashMap.get_in_list_fwd T key l
 
 /- [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list] -/
@@ -348,10 +346,10 @@ def hashmap.HashMap.get_mut_fwd
   (T : Type) (self : hashmap.HashMap T) (key : Usize) : Result T :=
   do
     let hash ← hashmap.hash_key_fwd key
-    let i := vec_len (hashmap.List T) self.hashmap_hash_map_slots
+    let i := Vec.len (hashmap.List T) self.hashmap_hash_map_slots
     let hash_mod ← hash % i
     let l ←
-      vec_index_mut_fwd (hashmap.List T) self.hashmap_hash_map_slots hash_mod
+      Vec.index_mut (hashmap.List T) self.hashmap_hash_map_slots hash_mod
     hashmap.HashMap.get_mut_in_list_fwd T l key
 
 /- [hashmap_main::hashmap::HashMap::{0}::get_mut] -/
@@ -361,13 +359,13 @@ def hashmap.HashMap.get_mut_back
   :=
   do
     let hash ← hashmap.hash_key_fwd key
-    let i := vec_len (hashmap.List T) self.hashmap_hash_map_slots
+    let i := Vec.len (hashmap.List T) self.hashmap_hash_map_slots
     let hash_mod ← hash % i
     let l ←
-      vec_index_mut_fwd (hashmap.List T) self.hashmap_hash_map_slots hash_mod
+      Vec.index_mut (hashmap.List T) self.hashmap_hash_map_slots hash_mod
     let l0 ← hashmap.HashMap.get_mut_in_list_back T l key ret0
     let v ←
-      vec_index_mut_back (hashmap.List T) self.hashmap_hash_map_slots hash_mod
+      Vec.index_mut_back (hashmap.List T) self.hashmap_hash_map_slots hash_mod
         l0
     Result.ret { self with hashmap_hash_map_slots := v }
 
@@ -379,7 +377,7 @@ divergent def hashmap.HashMap.remove_from_list_loop_fwd
     if ckey = key
     then
       let mv_ls :=
-        mem_replace_fwd (hashmap.List T) (hashmap.List.Cons ckey t tl)
+        mem.replace_fwd (hashmap.List T) (hashmap.List.Cons ckey t tl)
           hashmap.List.Nil
       match mv_ls with
       | hashmap.List.Cons i cvalue tl0 => Result.ret (Option.some cvalue)
@@ -400,7 +398,7 @@ divergent def hashmap.HashMap.remove_from_list_loop_back
     if ckey = key
     then
       let mv_ls :=
-        mem_replace_fwd (hashmap.List T) (hashmap.List.Cons ckey t tl)
+        mem.replace_fwd (hashmap.List T) (hashmap.List.Cons ckey t tl)
           hashmap.List.Nil
       match mv_ls with
       | hashmap.List.Cons i cvalue tl0 => Result.ret tl0
@@ -421,10 +419,10 @@ def hashmap.HashMap.remove_fwd
   (T : Type) (self : hashmap.HashMap T) (key : Usize) : Result (Option T) :=
   do
     let hash ← hashmap.hash_key_fwd key
-    let i := vec_len (hashmap.List T) self.hashmap_hash_map_slots
+    let i := Vec.len (hashmap.List T) self.hashmap_hash_map_slots
     let hash_mod ← hash % i
     let l ←
-      vec_index_mut_fwd (hashmap.List T) self.hashmap_hash_map_slots hash_mod
+      Vec.index_mut (hashmap.List T) self.hashmap_hash_map_slots hash_mod
     let x ← hashmap.HashMap.remove_from_list_fwd T key l
     match x with
     | Option.none => Result.ret Option.none
@@ -441,17 +439,17 @@ def hashmap.HashMap.remove_back
   :=
   do
     let hash ← hashmap.hash_key_fwd key
-    let i := vec_len (hashmap.List T) self.hashmap_hash_map_slots
+    let i := Vec.len (hashmap.List T) self.hashmap_hash_map_slots
     let hash_mod ← hash % i
     let l ←
-      vec_index_mut_fwd (hashmap.List T) self.hashmap_hash_map_slots hash_mod
+      Vec.index_mut (hashmap.List T) self.hashmap_hash_map_slots hash_mod
     let x ← hashmap.HashMap.remove_from_list_fwd T key l
     match x with
     | Option.none =>
       do
         let l0 ← hashmap.HashMap.remove_from_list_back T key l
         let v ←
-          vec_index_mut_back (hashmap.List T) self.hashmap_hash_map_slots
+          Vec.index_mut_back (hashmap.List T) self.hashmap_hash_map_slots
             hash_mod l0
         Result.ret { self with hashmap_hash_map_slots := v }
     | Option.some x0 =>
@@ -460,7 +458,7 @@ def hashmap.HashMap.remove_back
           (Usize.ofInt 1 (by intlit))
         let l0 ← hashmap.HashMap.remove_from_list_back T key l
         let v ←
-          vec_index_mut_back (hashmap.List T) self.hashmap_hash_map_slots
+          Vec.index_mut_back (hashmap.List T) self.hashmap_hash_map_slots
             hash_mod l0
         Result.ret
           {
diff --git a/tests/lean/Loops/Funs.lean b/tests/lean/Loops/Funs.lean
index 383bc819..6e6eef3b 100644
--- a/tests/lean/Loops/Funs.lean
+++ b/tests/lean/Loops/Funs.lean
@@ -54,12 +54,12 @@ def sum_with_shared_borrows_fwd (max : U32) : Result U32 :=
 /- [loops::clear] -/
 divergent def clear_loop_fwd_back
   (v : Vec U32) (i : Usize) : Result (Vec U32) :=
-  let i0 := vec_len U32 v
+  let i0 := Vec.len U32 v
   if i < i0
   then
     do
       let i1 ← i + (Usize.ofInt 1 (by intlit))
-      let v0 ← vec_index_mut_back U32 v i (U32.ofInt 0 (by intlit))
+      let v0 ← Vec.index_mut_back U32 v i (U32.ofInt 0 (by intlit))
       clear_loop_fwd_back v0 i1
   else Result.ret v
 
@@ -145,7 +145,7 @@ divergent def get_elem_mut_loop_fwd
 /- [loops::get_elem_mut] -/
 def get_elem_mut_fwd (slots : Vec (List Usize)) (x : Usize) : Result Usize :=
   do
-    let l ← vec_index_mut_fwd (List Usize) slots (Usize.ofInt 0 (by intlit))
+    let l ← Vec.index_mut (List Usize) slots (Usize.ofInt 0 (by intlit))
     get_elem_mut_loop_fwd x l
 
 /- [loops::get_elem_mut] -/
@@ -167,9 +167,9 @@ def get_elem_mut_back
   Result (Vec (List Usize))
   :=
   do
-    let l ← vec_index_mut_fwd (List Usize) slots (Usize.ofInt 0 (by intlit))
+    let l ← Vec.index_mut (List Usize) slots (Usize.ofInt 0 (by intlit))
     let l0 ← get_elem_mut_loop_back x l ret0
-    vec_index_mut_back (List Usize) slots (Usize.ofInt 0 (by intlit)) l0
+    Vec.index_mut_back (List Usize) slots (Usize.ofInt 0 (by intlit)) l0
 
 /- [loops::get_elem_shared] -/
 divergent def get_elem_shared_loop_fwd
@@ -185,7 +185,7 @@ divergent def get_elem_shared_loop_fwd
 def get_elem_shared_fwd
   (slots : Vec (List Usize)) (x : Usize) : Result Usize :=
   do
-    let l ← vec_index_fwd (List Usize) slots (Usize.ofInt 0 (by intlit))
+    let l ← Vec.index (List Usize) slots (Usize.ofInt 0 (by intlit))
     get_elem_shared_loop_fwd x l
 
 /- [loops::id_mut] -/
diff --git a/tests/lean/NoNestedBorrows.lean b/tests/lean/NoNestedBorrows.lean
index cdbbcd67..e4fa7612 100644
--- a/tests/lean/NoNestedBorrows.lean
+++ b/tests/lean/NoNestedBorrows.lean
@@ -321,7 +321,7 @@ divergent def list_rev_aux_fwd
 
 /- [no_nested_borrows::list_rev] -/
 def list_rev_fwd_back (T : Type) (l : List T) : Result (List T) :=
-  let li := mem_replace_fwd (List T) l List.Nil
+  let li := mem.replace_fwd (List T) l List.Nil
   list_rev_aux_fwd T li List.Nil
 
 /- [no_nested_borrows::test_list_functions] -/
@@ -514,7 +514,7 @@ def test_weird_borrows1_fwd : Result Unit :=
 
 /- [no_nested_borrows::test_mem_replace] -/
 def test_mem_replace_fwd_back (px : U32) : Result U32 :=
-  let y := mem_replace_fwd U32 px (U32.ofInt 1 (by intlit))
+  let y := mem.replace_fwd U32 px (U32.ofInt 1 (by intlit))
   if not (y = (U32.ofInt 0 (by intlit)))
   then Result.fail Error.panic
   else Result.ret (U32.ofInt 2 (by intlit))
diff --git a/tests/lean/lake-manifest.json b/tests/lean/lake-manifest.json
index 637bda23..75f7010a 100644
--- a/tests/lean/lake-manifest.json
+++ b/tests/lean/lake-manifest.json
@@ -11,7 +11,7 @@
   {"git":
    {"url": "https://github.com/leanprover-community/mathlib4.git",
     "subDir?": null,
-    "rev": "cc5d11f24e1b92db65ec3389bb5142f4b2d7670e",
+    "rev": "bb4fb766e41dd3a64197263ec132c7f9c4b50065",
     "name": "mathlib",
     "inputRev?": null}},
   {"git":
-- 
cgit v1.3.1


From 7c95800cefc87fad894f8bf855cfc047e713b3a7 Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Thu, 6 Jul 2023 12:20:28 +0200
Subject: Improve the generated comments

---
 backends/lean/Base/Primitives.lean                 |   2 +-
 compiler/Extract.ml                                |  84 +++-
 compiler/ExtractBase.ml                            |  38 +-
 compiler/Translate.ml                              |   4 +
 tests/coq/betree/BetreeMain_Funs.v                 | 118 +++---
 tests/coq/betree/BetreeMain_Opaque.v               |  10 +-
 tests/coq/betree/_CoqProject                       |   2 +-
 tests/coq/hashmap/Hashmap_Funs.v                   |  85 ++--
 tests/coq/hashmap/_CoqProject                      |   2 +-
 tests/coq/hashmap_on_disk/HashmapMain_Funs.v       |  89 ++--
 tests/coq/hashmap_on_disk/HashmapMain_Opaque.v     |   4 +-
 tests/coq/misc/Constants.v                         |  16 +-
 tests/coq/misc/External_Funs.v                     |  18 +-
 tests/coq/misc/External_Opaque.v                   |  10 +-
 tests/coq/misc/Loops.v                             | 124 +++---
 tests/coq/misc/NoNestedBorrows.v                   | 112 ++---
 tests/coq/misc/Paper.v                             |  21 +-
 tests/coq/misc/PoloniusList.v                      |   4 +-
 tests/coq/misc/_CoqProject                         |   6 +-
 tests/fstar/betree/BetreeMain.Funs.fst             | 118 +++---
 tests/fstar/betree/BetreeMain.Opaque.fsti          |  10 +-
 .../fstar/betree_back_stateful/BetreeMain.Funs.fst | 128 +++---
 .../betree_back_stateful/BetreeMain.Opaque.fsti    |  10 +-
 tests/fstar/hashmap/Hashmap.Funs.fst               |  85 ++--
 tests/fstar/hashmap_on_disk/HashmapMain.Funs.fst   |  89 ++--
 .../fstar/hashmap_on_disk/HashmapMain.Opaque.fsti  |   4 +-
 tests/fstar/misc/Constants.fst                     |  16 +-
 tests/fstar/misc/External.Funs.fst                 |  18 +-
 tests/fstar/misc/External.Opaque.fsti              |  10 +-
 tests/fstar/misc/Loops.Funs.fst                    | 124 +++---
 tests/fstar/misc/NoNestedBorrows.fst               | 112 ++---
 tests/fstar/misc/Paper.fst                         |  21 +-
 tests/fstar/misc/PoloniusList.fst                  |   4 +-
 tests/hol4/betree/betreeMain_FunsScript.sml        | 118 +++---
 tests/hol4/betree/betreeMain_OpaqueScript.sml      |  10 +-
 tests/hol4/hashmap/hashmap_FunsScript.sml          |  85 ++--
 .../hashmap_on_disk/hashmapMain_FunsScript.sml     |  89 ++--
 .../hashmap_on_disk/hashmapMain_OpaqueScript.sml   |   4 +-
 tests/hol4/misc-constants/constantsScript.sml      |  16 +-
 tests/hol4/misc-external/external_FunsScript.sml   |  18 +-
 tests/hol4/misc-external/external_OpaqueScript.sml |  10 +-
 tests/hol4/misc-loops/loops_FunsScript.sml         | 124 +++---
 .../noNestedBorrowsScript.sml                      | 112 ++---
 tests/hol4/misc-paper/paperScript.sml              |  21 +-
 .../hol4/misc-polonius_list/poloniusListScript.sml |   4 +-
 tests/lean/BetreeMain/Funs.lean                    | 472 ++++++++++-----------
 tests/lean/BetreeMain/FunsExternal.lean            |  10 +-
 tests/lean/BetreeMain/FunsExternal_Template.lean   |  20 +-
 tests/lean/Constants.lean                          |  54 +--
 tests/lean/External/Funs.lean                      |  49 ++-
 tests/lean/External/FunsExternal.lean              |   6 +-
 tests/lean/External/FunsExternal_Template.lean     |  17 +-
 tests/lean/Hashmap/Funs.lean                       | 262 ++++++------
 tests/lean/HashmapMain/Funs.lean                   | 276 ++++++------
 tests/lean/HashmapMain/FunsExternal.lean           |   4 +-
 tests/lean/HashmapMain/FunsExternal_Template.lean  |   8 +-
 tests/lean/Loops/Funs.lean                         | 300 +++++++------
 tests/lean/NoNestedBorrows.lean                    | 292 +++++++------
 tests/lean/Paper.lean                              |  57 +--
 tests/lean/PoloniusList.lean                       |   9 +-
 60 files changed, 2056 insertions(+), 1889 deletions(-)

(limited to 'backends/lean/Base/Primitives.lean')

diff --git a/backends/lean/Base/Primitives.lean b/backends/lean/Base/Primitives.lean
index 808c1461..14f5971e 100644
--- a/backends/lean/Base/Primitives.lean
+++ b/backends/lean/Base/Primitives.lean
@@ -656,7 +656,7 @@ def Vec.index_mut_back (α : Type u) (v: Vec α) (i: Usize) (x: α): Result (Vec
 -- MISC --
 ----------
 
-@[simp] def mem.replace_fwd (a : Type) (x : a) (_ : a) : a := x
+@[simp] def mem.replace (a : Type) (x : a) (_ : a) : a := x
 @[simp] def mem.replace_back (a : Type) (_ : a) (y : a) : a := y
 
 /-- Aeneas-translated function -- useful to reduce non-recursive definitions.
diff --git a/compiler/Extract.ml b/compiler/Extract.ml
index 180ca7ca..cacb9b96 100644
--- a/compiler/Extract.ml
+++ b/compiler/Extract.ml
@@ -321,7 +321,7 @@ let assumed_llbc_functions () :
       ]
   | Lean ->
       [
-        (Replace, None, "mem.replace_fwd");
+        (Replace, None, "mem.replace");
         (Replace, rg0, "mem.replace_back");
         (VecNew, None, "Vec.new");
         (VecPush, None, "Vec.push_fwd") (* Shouldn't be used *);
@@ -1426,16 +1426,26 @@ let extract_type_decl_struct_body (ctx : extraction_ctx) (fmt : F.formatter)
   ()
 
 (** Extract a nestable, muti-line comment *)
-let extract_comment (fmt : F.formatter) (s : string) : unit =
-  match !backend with
-  | Coq | FStar | HOL4 ->
-      F.pp_print_string fmt "(** ";
-      F.pp_print_string fmt s;
-      F.pp_print_string fmt " *)"
-  | Lean ->
-      F.pp_print_string fmt "/- ";
+let extract_comment (fmt : F.formatter) (sl : string list) : unit =
+  (* Delimiters, space after we break a line *)
+  let ld, space, rd =
+    match !backend with
+    | Coq | FStar | HOL4 -> ("(** ", 4, " *)")
+    | Lean -> ("/- ", 3, " -/")
+  in
+  F.pp_open_vbox fmt space;
+  F.pp_print_string fmt ld;
+  (match sl with
+  | [] -> ()
+  | s :: sl ->
       F.pp_print_string fmt s;
-      F.pp_print_string fmt " -/"
+      List.iter
+        (fun s ->
+          F.pp_print_space fmt ();
+          F.pp_print_string fmt s)
+        sl);
+  F.pp_print_string fmt rd;
+  F.pp_close_box fmt ()
 
 (** Extract a type declaration.
 
@@ -1475,7 +1485,7 @@ let extract_type_decl_gen (ctx : extraction_ctx) (fmt : F.formatter)
   if !backend <> HOL4 || not (decl_is_first_from_group kind) then
     F.pp_print_break fmt 0 0;
   (* Print a comment to link the extracted type to its original rust definition *)
-  extract_comment fmt ("[" ^ Print.name_to_string def.name ^ "]");
+  extract_comment fmt [ "[" ^ Print.name_to_string def.name ^ "]" ];
   F.pp_print_break fmt 0 0;
   (* Open a box for the definition, so that whenever possible it gets printed on
    * one line. Note however that in the case of Lean line breaks are important
@@ -1872,7 +1882,7 @@ let extract_state_type (fmt : F.formatter) (ctx : extraction_ctx)
   (* Add a break before *)
   F.pp_print_break fmt 0 0;
   (* Print a comment  *)
-  extract_comment fmt "The state type used in the state-error monad";
+  extract_comment fmt [ "The state type used in the state-error monad" ];
   F.pp_print_break fmt 0 0;
   (* Open a box for the definition, so that whenever possible it gets printed on
    * one line *)
@@ -2817,7 +2827,7 @@ let extract_template_fstar_decreases_clause (ctx : extraction_ctx)
   F.pp_print_break fmt 0 0;
   (* Print a comment to link the extracted type to its original rust definition *)
   extract_comment fmt
-    ("[" ^ Print.fun_name_to_string def.basename ^ "]: decreases clause");
+    [ "[" ^ Print.fun_name_to_string def.basename ^ "]: decreases clause" ];
   F.pp_print_space fmt ();
   (* Open a box for the definition, so that whenever possible it gets printed on
    * one line *)
@@ -2879,7 +2889,7 @@ let extract_template_lean_termination_and_decreasing (ctx : extraction_ctx)
   F.pp_print_break fmt 0 0;
   (* Print a comment to link the extracted type to its original rust definition *)
   extract_comment fmt
-    ("[" ^ Print.fun_name_to_string def.basename ^ "]: termination measure");
+    [ "[" ^ Print.fun_name_to_string def.basename ^ "]: termination measure" ];
   F.pp_print_space fmt ();
   (* Open a box for the definition, so that whenever possible it gets printed on
    * one line *)
@@ -2933,7 +2943,7 @@ let extract_template_lean_termination_and_decreasing (ctx : extraction_ctx)
   (* syntax <def_name> term ... term : tactic *)
   F.pp_print_break fmt 0 0;
   extract_comment fmt
-    ("[" ^ Print.fun_name_to_string def.basename ^ "]: decreases_by tactic");
+    [ "[" ^ Print.fun_name_to_string def.basename ^ "]: decreases_by tactic" ];
   F.pp_print_space fmt ();
   F.pp_open_hvbox fmt 0;
   F.pp_print_string fmt "syntax \"";
@@ -2962,6 +2972,40 @@ let extract_template_lean_termination_and_decreasing (ctx : extraction_ctx)
   F.pp_close_box fmt ();
   F.pp_print_break fmt 0 0
 
+let extract_fun_comment (ctx : extraction_ctx) (fmt : F.formatter)
+    (def : fun_decl) : unit =
+  let { keep_fwd; num_backs } =
+    PureUtils.RegularFunIdMap.find
+      (A.Regular def.def_id, def.loop_id, def.back_id)
+      ctx.fun_name_info
+  in
+  let comment_pre = "[" ^ Print.fun_name_to_string def.basename ^ "]: " in
+  let comment =
+    let loop_comment =
+      match def.loop_id with
+      | None -> ""
+      | Some id -> "loop " ^ LoopId.to_string id ^ ": "
+    in
+    let fwd_back_comment =
+      match def.back_id with
+      | None -> [ "forward function" ]
+      | Some id ->
+          (* Check if there is only one backward function, and no forward function *)
+          if (not keep_fwd) && num_backs = 1 then
+            [
+              "merged forward/backward function";
+              "(there is a single backward function, and the forward function \
+               returns ())";
+            ]
+          else [ "backward function " ^ T.RegionGroupId.to_string id ]
+    in
+    match fwd_back_comment with
+    | [] -> raise (Failure "Unreachable")
+    | [ s ] -> [ comment_pre ^ loop_comment ^ s ]
+    | s :: sl -> (comment_pre ^ loop_comment ^ s) :: sl
+  in
+  extract_comment fmt comment
+
 (** Extract a function declaration.
 
     This function is for all function declarations and all backends **at the exception**
@@ -2981,8 +3025,8 @@ let extract_fun_decl_gen (ctx : extraction_ctx) (fmt : F.formatter)
   (* Add a break before *)
   if !backend <> HOL4 || not (decl_is_first_from_group kind) then
     F.pp_print_break fmt 0 0;
-  (* Print a comment to link the extracted type to its original rust definition *)
-  extract_comment fmt ("[" ^ Print.fun_name_to_string def.basename ^ "]");
+  (* Print a comment to link the extracted definition to its original rust definition *)
+  extract_fun_comment ctx fmt def;
   F.pp_print_space fmt ();
   (* Open two boxes for the definition, so that whenever possible it gets printed on
    * one line and indents are correct *)
@@ -3236,6 +3280,8 @@ let extract_fun_decl_hol4_opaque (ctx : extraction_ctx) (fmt : F.formatter)
   F.pp_print_break fmt 0 0;
   (* Open a box for the whole definition *)
   F.pp_open_hvbox fmt ctx.indent_incr;
+  (* Print a comment to link the extracted definition to its original rust definition *)
+  extract_fun_comment ctx fmt def;
   (* Generate: `val _ = new_constant ("...",` *)
   F.pp_print_string fmt ("val _ = new_constant (\"" ^ def_name ^ "\",");
   F.pp_print_space fmt ();
@@ -3411,7 +3457,7 @@ let extract_global_decl (ctx : extraction_ctx) (fmt : F.formatter)
 
   (* Add a break then the name of the corresponding LLBC declaration *)
   F.pp_print_break fmt 0 0;
-  extract_comment fmt ("[" ^ Print.global_name_to_string global.name ^ "]");
+  extract_comment fmt [ "[" ^ Print.global_name_to_string global.name ^ "]" ];
   F.pp_print_space fmt ();
 
   let with_opaque_pre = false in
@@ -3485,7 +3531,7 @@ let extract_unit_test_if_unit_fun (ctx : extraction_ctx) (fmt : F.formatter)
     F.pp_print_break fmt 0 0;
     (* Print a comment *)
     extract_comment fmt
-      ("Unit test for [" ^ Print.fun_name_to_string def.basename ^ "]");
+      [ "Unit test for [" ^ Print.fun_name_to_string def.basename ^ "]" ];
     F.pp_print_space fmt ();
     (* Open a box for the test *)
     F.pp_open_hovbox fmt ctx.indent_incr;
diff --git a/compiler/ExtractBase.ml b/compiler/ExtractBase.ml
index feab7706..ede7af29 100644
--- a/compiler/ExtractBase.ml
+++ b/compiler/ExtractBase.ml
@@ -520,6 +520,8 @@ let basename_to_unique (names_set : StringSet.t)
   in
   if StringSet.mem basename names_set then gen 0 else basename
 
+type fun_name_info = { keep_fwd : bool; num_backs : int }
+
 (** Extraction context.
 
     Note that the extraction context contains information coming from the
@@ -551,6 +553,15 @@ type extraction_ctx = {
             -- makes the if then else dependent
           ]}
         *)
+  fun_name_info : fun_name_info PureUtils.RegularFunIdMap.t;
+      (** Information used to filter and name functions - we use it
+          to print comments in the generated code, to help link
+          the generated code to the original code (information such
+          as: "this function is the backward function of ...", or
+          "this function is the merged forward/backward function of ..."
+          in case a Rust function only has one backward translation
+          and we filter the forward function because it returns unit.
+        *)
 }
 
 (** Debugging function, used when communicating name collisions to the user,
@@ -930,9 +941,15 @@ let ctx_add_fun_decl (trans_group : bool * pure_fun_translation)
     ctx.fmt.fun_name def.basename def.num_loops def.loop_id num_rgs rg_info
       (keep_fwd, num_backs)
   in
-  ctx_add is_opaque
-    (FunId (FromLlbc (A.Regular def_id, def.loop_id, def.back_id)))
-    def_name ctx
+  let fun_id = (A.Regular def_id, def.loop_id, def.back_id) in
+  let ctx = ctx_add is_opaque (FunId (FromLlbc fun_id)) def_name ctx in
+  (* Add the name info *)
+  {
+    ctx with
+    fun_name_info =
+      PureUtils.RegularFunIdMap.add fun_id { keep_fwd; num_backs }
+        ctx.fun_name_info;
+  }
 
 type names_map_init = {
   keywords : string list;
@@ -1053,13 +1070,24 @@ let default_fun_suffix (num_loops : int) (loop_id : LoopId.id option)
      definitions (in particular between type and function definitions).
   *)
   let rg_suff =
+    (* TODO: make all the backends match what is done for Lean *)
     match rg with
-    | None -> "_fwd"
+    | None -> (
+        match !Config.backend with
+        | FStar | Coq | HOL4 -> "_fwd"
+        | Lean ->
+            (* In order to avoid name conflicts:
+             * - if the forward is eliminated, we add the suffix "_fwd" (it won't be used)
+             * - otherwise, no suffix (because the backward functions will have a suffix)
+             *)
+            if num_backs = 1 && not keep_fwd then "_fwd" else "")
     | Some rg ->
         assert (num_region_groups > 0 && num_backs > 0);
         if num_backs = 1 then
           (* Exactly one backward function *)
-          if not keep_fwd then "_fwd_back" else "_back"
+          match !Config.backend with
+          | FStar | Coq | HOL4 -> if not keep_fwd then "_fwd_back" else "_back"
+          | Lean -> if not keep_fwd then "" else "_back"
         else if
           (* Several region groups/backward functions:
              - if all the regions in the group have names, we use those names
diff --git a/compiler/Translate.ml b/compiler/Translate.ml
index 795674b4..444642c0 100644
--- a/compiler/Translate.ml
+++ b/compiler/Translate.ml
@@ -910,11 +910,14 @@ let translate_crate (filename : string) (dest_dir : string) (crate : A.crate) :
        prefixed with the type name to prevent collisions *)
     match !Config.backend with Coq | FStar | HOL4 -> true | Lean -> false
   in
+  (* Initialize the names map (we insert the names of the "primitives"
+     declarations, and insert the names of the local declarations later) *)
   let mk_formatter_and_names_map = Extract.mk_formatter_and_names_map in
   let fmt, names_map =
     mk_formatter_and_names_map trans_ctx crate.name
       variant_concatenate_type_name
   in
+  (* Put everything in the context *)
   let ctx =
     {
       ExtractBase.trans_ctx;
@@ -923,6 +926,7 @@ let translate_crate (filename : string) (dest_dir : string) (crate : A.crate) :
       indent_incr = 2;
       use_opaque_pre = !Config.split_files;
       use_dep_ite = !Config.backend = Lean && !Config.extract_decreases_clauses;
+      fun_name_info = PureUtils.RegularFunIdMap.empty;
     }
   in
 
diff --git a/tests/coq/betree/BetreeMain_Funs.v b/tests/coq/betree/BetreeMain_Funs.v
index 940b8650..86a9d5f2 100644
--- a/tests/coq/betree/BetreeMain_Funs.v
+++ b/tests/coq/betree/BetreeMain_Funs.v
@@ -10,7 +10,7 @@ Require Export BetreeMain_Opaque.
 Import BetreeMain_Opaque.
 Module BetreeMain_Funs.
 
-(** [betree_main::betree::load_internal_node] *)
+(** [betree_main::betree::load_internal_node]: forward function *)
 Definition betree_load_internal_node_fwd
   (id : u64) (st : state) :
   result (state * (Betree_list_t (u64 * Betree_message_t)))
@@ -18,7 +18,7 @@ Definition betree_load_internal_node_fwd
   betree_utils_load_internal_node_fwd id st
 .
 
-(** [betree_main::betree::store_internal_node] *)
+(** [betree_main::betree::store_internal_node]: forward function *)
 Definition betree_store_internal_node_fwd
   (id : u64) (content : Betree_list_t (u64 * Betree_message_t)) (st : state) :
   result (state * unit)
@@ -28,13 +28,13 @@ Definition betree_store_internal_node_fwd
   Return (st0, tt)
 .
 
-(** [betree_main::betree::load_leaf_node] *)
+(** [betree_main::betree::load_leaf_node]: forward function *)
 Definition betree_load_leaf_node_fwd
   (id : u64) (st : state) : result (state * (Betree_list_t (u64 * u64))) :=
   betree_utils_load_leaf_node_fwd id st
 .
 
-(** [betree_main::betree::store_leaf_node] *)
+(** [betree_main::betree::store_leaf_node]: forward function *)
 Definition betree_store_leaf_node_fwd
   (id : u64) (content : Betree_list_t (u64 * u64)) (st : state) :
   result (state * unit)
@@ -44,29 +44,29 @@ Definition betree_store_leaf_node_fwd
   Return (st0, tt)
 .
 
-(** [betree_main::betree::fresh_node_id] *)
+(** [betree_main::betree::fresh_node_id]: forward function *)
 Definition betree_fresh_node_id_fwd (counter : u64) : result u64 :=
   _ <- u64_add counter 1%u64; Return counter
 .
 
-(** [betree_main::betree::fresh_node_id] *)
+(** [betree_main::betree::fresh_node_id]: backward function 0 *)
 Definition betree_fresh_node_id_back (counter : u64) : result u64 :=
   u64_add counter 1%u64
 .
 
-(** [betree_main::betree::NodeIdCounter::{0}::new] *)
+(** [betree_main::betree::NodeIdCounter::{0}::new]: forward function *)
 Definition betree_node_id_counter_new_fwd : result Betree_node_id_counter_t :=
   Return {| Betree_node_id_counter_next_node_id := 0%u64 |}
 .
 
-(** [betree_main::betree::NodeIdCounter::{0}::fresh_id] *)
+(** [betree_main::betree::NodeIdCounter::{0}::fresh_id]: forward function *)
 Definition betree_node_id_counter_fresh_id_fwd
   (self : Betree_node_id_counter_t) : result u64 :=
   _ <- u64_add self.(Betree_node_id_counter_next_node_id) 1%u64;
   Return self.(Betree_node_id_counter_next_node_id)
 .
 
-(** [betree_main::betree::NodeIdCounter::{0}::fresh_id] *)
+(** [betree_main::betree::NodeIdCounter::{0}::fresh_id]: backward function 0 *)
 Definition betree_node_id_counter_fresh_id_back
   (self : Betree_node_id_counter_t) : result Betree_node_id_counter_t :=
   i <- u64_add self.(Betree_node_id_counter_next_node_id) 1%u64;
@@ -79,7 +79,7 @@ Definition core_num_u64_max_body : result u64 :=
 .
 Definition core_num_u64_max_c : u64 := core_num_u64_max_body%global.
 
-(** [betree_main::betree::upsert_update] *)
+(** [betree_main::betree::upsert_update]: forward function *)
 Definition betree_upsert_update_fwd
   (prev : option u64) (st : Betree_upsert_fun_state_t) : result u64 :=
   match prev with
@@ -99,7 +99,7 @@ Definition betree_upsert_update_fwd
   end
 .
 
-(** [betree_main::betree::List::{1}::len] *)
+(** [betree_main::betree::List::{1}::len]: forward function *)
 Fixpoint betree_list_len_fwd
   (T : Type) (n : nat) (self : Betree_list_t T) : result u64 :=
   match n with
@@ -112,7 +112,7 @@ Fixpoint betree_list_len_fwd
   end
 .
 
-(** [betree_main::betree::List::{1}::split_at] *)
+(** [betree_main::betree::List::{1}::split_at]: forward function *)
 Fixpoint betree_list_split_at_fwd
   (T : Type) (n : nat) (self : Betree_list_t T) (n0 : u64) :
   result ((Betree_list_t T) * (Betree_list_t T))
@@ -135,7 +135,8 @@ Fixpoint betree_list_split_at_fwd
   end
 .
 
-(** [betree_main::betree::List::{1}::push_front] *)
+(** [betree_main::betree::List::{1}::push_front]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition betree_list_push_front_fwd_back
   (T : Type) (self : Betree_list_t T) (x : T) : result (Betree_list_t T) :=
   let tl := mem_replace_fwd (Betree_list_t T) self BetreeListNil in
@@ -143,7 +144,7 @@ Definition betree_list_push_front_fwd_back
   Return (BetreeListCons x l)
 .
 
-(** [betree_main::betree::List::{1}::pop_front] *)
+(** [betree_main::betree::List::{1}::pop_front]: forward function *)
 Definition betree_list_pop_front_fwd
   (T : Type) (self : Betree_list_t T) : result T :=
   let ls := mem_replace_fwd (Betree_list_t T) self BetreeListNil in
@@ -153,7 +154,7 @@ Definition betree_list_pop_front_fwd
   end
 .
 
-(** [betree_main::betree::List::{1}::pop_front] *)
+(** [betree_main::betree::List::{1}::pop_front]: backward function 0 *)
 Definition betree_list_pop_front_back
   (T : Type) (self : Betree_list_t T) : result (Betree_list_t T) :=
   let ls := mem_replace_fwd (Betree_list_t T) self BetreeListNil in
@@ -163,7 +164,7 @@ Definition betree_list_pop_front_back
   end
 .
 
-(** [betree_main::betree::List::{1}::hd] *)
+(** [betree_main::betree::List::{1}::hd]: forward function *)
 Definition betree_list_hd_fwd (T : Type) (self : Betree_list_t T) : result T :=
   match self with
   | BetreeListCons hd l => Return hd
@@ -171,7 +172,7 @@ Definition betree_list_hd_fwd (T : Type) (self : Betree_list_t T) : result T :=
   end
 .
 
-(** [betree_main::betree::List::{2}::head_has_key] *)
+(** [betree_main::betree::List::{2}::head_has_key]: forward function *)
 Definition betree_list_head_has_key_fwd
   (T : Type) (self : Betree_list_t (u64 * T)) (key : u64) : result bool :=
   match self with
@@ -180,7 +181,7 @@ Definition betree_list_head_has_key_fwd
   end
 .
 
-(** [betree_main::betree::List::{2}::partition_at_pivot] *)
+(** [betree_main::betree::List::{2}::partition_at_pivot]: forward function *)
 Fixpoint betree_list_partition_at_pivot_fwd
   (T : Type) (n : nat) (self : Betree_list_t (u64 * T)) (pivot : u64) :
   result ((Betree_list_t (u64 * T)) * (Betree_list_t (u64 * T)))
@@ -203,7 +204,7 @@ Fixpoint betree_list_partition_at_pivot_fwd
   end
 .
 
-(** [betree_main::betree::Leaf::{3}::split] *)
+(** [betree_main::betree::Leaf::{3}::split]: forward function *)
 Definition betree_leaf_split_fwd
   (n : nat) (self : Betree_leaf_t) (content : Betree_list_t (u64 * u64))
   (params : Betree_params_t) (node_id_cnt : Betree_node_id_counter_t)
@@ -236,7 +237,7 @@ Definition betree_leaf_split_fwd
   Return (st1, mkBetree_internal_t self.(Betree_leaf_id) pivot n0 n1)
 .
 
-(** [betree_main::betree::Leaf::{3}::split] *)
+(** [betree_main::betree::Leaf::{3}::split]: backward function 2 *)
 Definition betree_leaf_split_back
   (n : nat) (self : Betree_leaf_t) (content : Betree_list_t (u64 * u64))
   (params : Betree_params_t) (node_id_cnt : Betree_node_id_counter_t)
@@ -257,7 +258,7 @@ Definition betree_leaf_split_back
   betree_node_id_counter_fresh_id_back node_id_cnt0
 .
 
-(** [betree_main::betree::Node::{5}::lookup_in_bindings] *)
+(** [betree_main::betree::Node::{5}::lookup_in_bindings]: forward function *)
 Fixpoint betree_node_lookup_in_bindings_fwd
   (n : nat) (key : u64) (bindings : Betree_list_t (u64 * u64)) :
   result (option u64)
@@ -279,7 +280,7 @@ Fixpoint betree_node_lookup_in_bindings_fwd
   end
 .
 
-(** [betree_main::betree::Node::{5}::lookup_first_message_for_key] *)
+(** [betree_main::betree::Node::{5}::lookup_first_message_for_key]: forward function *)
 Fixpoint betree_node_lookup_first_message_for_key_fwd
   (n : nat) (key : u64) (msgs : Betree_list_t (u64 * Betree_message_t)) :
   result (Betree_list_t (u64 * Betree_message_t))
@@ -298,7 +299,7 @@ Fixpoint betree_node_lookup_first_message_for_key_fwd
   end
 .
 
-(** [betree_main::betree::Node::{5}::lookup_first_message_for_key] *)
+(** [betree_main::betree::Node::{5}::lookup_first_message_for_key]: backward function 0 *)
 Fixpoint betree_node_lookup_first_message_for_key_back
   (n : nat) (key : u64) (msgs : Betree_list_t (u64 * Betree_message_t))
   (ret : Betree_list_t (u64 * Betree_message_t)) :
@@ -321,7 +322,7 @@ Fixpoint betree_node_lookup_first_message_for_key_back
   end
 .
 
-(** [betree_main::betree::Node::{5}::apply_upserts] *)
+(** [betree_main::betree::Node::{5}::apply_upserts]: forward function *)
 Fixpoint betree_node_apply_upserts_fwd
   (n : nat) (msgs : Betree_list_t (u64 * Betree_message_t)) (prev : option u64)
   (key : u64) (st : state) :
@@ -353,7 +354,7 @@ Fixpoint betree_node_apply_upserts_fwd
   end
 .
 
-(** [betree_main::betree::Node::{5}::apply_upserts] *)
+(** [betree_main::betree::Node::{5}::apply_upserts]: backward function 0 *)
 Fixpoint betree_node_apply_upserts_back
   (n : nat) (msgs : Betree_list_t (u64 * Betree_message_t)) (prev : option u64)
   (key : u64) (st : state) :
@@ -383,7 +384,7 @@ Fixpoint betree_node_apply_upserts_back
   end
 .
 
-(** [betree_main::betree::Node::{5}::lookup] *)
+(** [betree_main::betree::Node::{5}::lookup]: forward function *)
 Fixpoint betree_node_lookup_fwd
   (n : nat) (self : Betree_node_t) (key : u64) (st : state) :
   result (state * (option u64))
@@ -455,7 +456,7 @@ Fixpoint betree_node_lookup_fwd
     end
   end
 
-(** [betree_main::betree::Node::{5}::lookup] *)
+(** [betree_main::betree::Node::{5}::lookup]: backward function 0 *)
 with betree_node_lookup_back
   (n : nat) (self : Betree_node_t) (key : u64) (st : state) :
   result Betree_node_t
@@ -524,7 +525,7 @@ with betree_node_lookup_back
     end
   end
 
-(** [betree_main::betree::Internal::{4}::lookup_in_children] *)
+(** [betree_main::betree::Internal::{4}::lookup_in_children]: forward function *)
 with betree_internal_lookup_in_children_fwd
   (n : nat) (self : Betree_internal_t) (key : u64) (st : state) :
   result (state * (option u64))
@@ -537,7 +538,7 @@ with betree_internal_lookup_in_children_fwd
     else betree_node_lookup_fwd n0 self.(Betree_internal_right) key st
   end
 
-(** [betree_main::betree::Internal::{4}::lookup_in_children] *)
+(** [betree_main::betree::Internal::{4}::lookup_in_children]: backward function 0 *)
 with betree_internal_lookup_in_children_back
   (n : nat) (self : Betree_internal_t) (key : u64) (st : state) :
   result Betree_internal_t
@@ -557,7 +558,7 @@ with betree_internal_lookup_in_children_back
   end
 .
 
-(** [betree_main::betree::Node::{5}::lookup_mut_in_bindings] *)
+(** [betree_main::betree::Node::{5}::lookup_mut_in_bindings]: forward function *)
 Fixpoint betree_node_lookup_mut_in_bindings_fwd
   (n : nat) (key : u64) (bindings : Betree_list_t (u64 * u64)) :
   result (Betree_list_t (u64 * u64))
@@ -576,7 +577,7 @@ Fixpoint betree_node_lookup_mut_in_bindings_fwd
   end
 .
 
-(** [betree_main::betree::Node::{5}::lookup_mut_in_bindings] *)
+(** [betree_main::betree::Node::{5}::lookup_mut_in_bindings]: backward function 0 *)
 Fixpoint betree_node_lookup_mut_in_bindings_back
   (n : nat) (key : u64) (bindings : Betree_list_t (u64 * u64))
   (ret : Betree_list_t (u64 * u64)) :
@@ -598,7 +599,8 @@ Fixpoint betree_node_lookup_mut_in_bindings_back
   end
 .
 
-(** [betree_main::betree::Node::{5}::apply_to_leaf] *)
+(** [betree_main::betree::Node::{5}::apply_to_leaf]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition betree_node_apply_to_leaf_fwd_back
   (n : nat) (bindings : Betree_list_t (u64 * u64)) (key : u64)
   (new_msg : Betree_message_t) :
@@ -642,7 +644,8 @@ Definition betree_node_apply_to_leaf_fwd_back
     end
 .
 
-(** [betree_main::betree::Node::{5}::apply_messages_to_leaf] *)
+(** [betree_main::betree::Node::{5}::apply_messages_to_leaf]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Fixpoint betree_node_apply_messages_to_leaf_fwd_back
   (n : nat) (bindings : Betree_list_t (u64 * u64))
   (new_msgs : Betree_list_t (u64 * Betree_message_t)) :
@@ -661,7 +664,8 @@ Fixpoint betree_node_apply_messages_to_leaf_fwd_back
   end
 .
 
-(** [betree_main::betree::Node::{5}::filter_messages_for_key] *)
+(** [betree_main::betree::Node::{5}::filter_messages_for_key]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Fixpoint betree_node_filter_messages_for_key_fwd_back
   (n : nat) (key : u64) (msgs : Betree_list_t (u64 * Betree_message_t)) :
   result (Betree_list_t (u64 * Betree_message_t))
@@ -684,7 +688,7 @@ Fixpoint betree_node_filter_messages_for_key_fwd_back
   end
 .
 
-(** [betree_main::betree::Node::{5}::lookup_first_message_after_key] *)
+(** [betree_main::betree::Node::{5}::lookup_first_message_after_key]: forward function *)
 Fixpoint betree_node_lookup_first_message_after_key_fwd
   (n : nat) (key : u64) (msgs : Betree_list_t (u64 * Betree_message_t)) :
   result (Betree_list_t (u64 * Betree_message_t))
@@ -703,7 +707,7 @@ Fixpoint betree_node_lookup_first_message_after_key_fwd
   end
 .
 
-(** [betree_main::betree::Node::{5}::lookup_first_message_after_key] *)
+(** [betree_main::betree::Node::{5}::lookup_first_message_after_key]: backward function 0 *)
 Fixpoint betree_node_lookup_first_message_after_key_back
   (n : nat) (key : u64) (msgs : Betree_list_t (u64 * Betree_message_t))
   (ret : Betree_list_t (u64 * Betree_message_t)) :
@@ -726,7 +730,8 @@ Fixpoint betree_node_lookup_first_message_after_key_back
   end
 .
 
-(** [betree_main::betree::Node::{5}::apply_to_internal] *)
+(** [betree_main::betree::Node::{5}::apply_to_internal]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition betree_node_apply_to_internal_fwd_back
   (n : nat) (msgs : Betree_list_t (u64 * Betree_message_t)) (key : u64)
   (new_msg : Betree_message_t) :
@@ -784,7 +789,8 @@ Definition betree_node_apply_to_internal_fwd_back
     betree_node_lookup_first_message_for_key_back n key msgs msgs1)
 .
 
-(** [betree_main::betree::Node::{5}::apply_messages_to_internal] *)
+(** [betree_main::betree::Node::{5}::apply_messages_to_internal]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Fixpoint betree_node_apply_messages_to_internal_fwd_back
   (n : nat) (msgs : Betree_list_t (u64 * Betree_message_t))
   (new_msgs : Betree_list_t (u64 * Betree_message_t)) :
@@ -803,7 +809,7 @@ Fixpoint betree_node_apply_messages_to_internal_fwd_back
   end
 .
 
-(** [betree_main::betree::Node::{5}::apply_messages] *)
+(** [betree_main::betree::Node::{5}::apply_messages]: forward function *)
 Fixpoint betree_node_apply_messages_fwd
   (n : nat) (self : Betree_node_t) (params : Betree_params_t)
   (node_id_cnt : Betree_node_id_counter_t)
@@ -859,7 +865,7 @@ Fixpoint betree_node_apply_messages_fwd
     end
   end
 
-(** [betree_main::betree::Node::{5}::apply_messages] *)
+(** [betree_main::betree::Node::{5}::apply_messages]: backward function 0 *)
 with betree_node_apply_messages_back
   (n : nat) (self : Betree_node_t) (params : Betree_params_t)
   (node_id_cnt : Betree_node_id_counter_t)
@@ -915,7 +921,7 @@ with betree_node_apply_messages_back
     end
   end
 
-(** [betree_main::betree::Internal::{4}::flush] *)
+(** [betree_main::betree::Internal::{4}::flush]: forward function *)
 with betree_internal_flush_fwd
   (n : nat) (self : Betree_internal_t) (params : Betree_params_t)
   (node_id_cnt : Betree_node_id_counter_t)
@@ -963,7 +969,7 @@ with betree_internal_flush_fwd
       Return (st0, msgs_left))
   end
 
-(** [betree_main::betree::Internal::{4}::flush] *)
+(** [betree_main::betree::Internal::{4}::flush]: backward function 0 *)
 with betree_internal_flush_back
   (n : nat) (self : Betree_internal_t) (params : Betree_params_t)
   (node_id_cnt : Betree_node_id_counter_t)
@@ -1012,7 +1018,7 @@ with betree_internal_flush_back
   end
 .
 
-(** [betree_main::betree::Node::{5}::apply] *)
+(** [betree_main::betree::Node::{5}::apply]: forward function *)
 Definition betree_node_apply_fwd
   (n : nat) (self : Betree_node_t) (params : Betree_params_t)
   (node_id_cnt : Betree_node_id_counter_t) (key : u64)
@@ -1030,7 +1036,7 @@ Definition betree_node_apply_fwd
   Return (st0, tt)
 .
 
-(** [betree_main::betree::Node::{5}::apply] *)
+(** [betree_main::betree::Node::{5}::apply]: backward function 0 *)
 Definition betree_node_apply_back
   (n : nat) (self : Betree_node_t) (params : Betree_params_t)
   (node_id_cnt : Betree_node_id_counter_t) (key : u64)
@@ -1042,7 +1048,7 @@ Definition betree_node_apply_back
     (key, new_msg) l) st
 .
 
-(** [betree_main::betree::BeTree::{6}::new] *)
+(** [betree_main::betree::BeTree::{6}::new]: forward function *)
 Definition betree_be_tree_new_fwd
   (min_flush_size : u64) (split_size : u64) (st : state) :
   result (state * Betree_be_tree_t)
@@ -1065,7 +1071,7 @@ Definition betree_be_tree_new_fwd
     |})
 .
 
-(** [betree_main::betree::BeTree::{6}::apply] *)
+(** [betree_main::betree::BeTree::{6}::apply]: forward function *)
 Definition betree_be_tree_apply_fwd
   (n : nat) (self : Betree_be_tree_t) (key : u64) (msg : Betree_message_t)
   (st : state) :
@@ -1081,7 +1087,7 @@ Definition betree_be_tree_apply_fwd
   Return (st0, tt)
 .
 
-(** [betree_main::betree::BeTree::{6}::apply] *)
+(** [betree_main::betree::BeTree::{6}::apply]: backward function 0 *)
 Definition betree_be_tree_apply_back
   (n : nat) (self : Betree_be_tree_t) (key : u64) (msg : Betree_message_t)
   (st : state) :
@@ -1099,7 +1105,7 @@ Definition betree_be_tree_apply_back
     |}
 .
 
-(** [betree_main::betree::BeTree::{6}::insert] *)
+(** [betree_main::betree::BeTree::{6}::insert]: forward function *)
 Definition betree_be_tree_insert_fwd
   (n : nat) (self : Betree_be_tree_t) (key : u64) (value : u64) (st : state) :
   result (state * unit)
@@ -1110,7 +1116,7 @@ Definition betree_be_tree_insert_fwd
   Return (st0, tt)
 .
 
-(** [betree_main::betree::BeTree::{6}::insert] *)
+(** [betree_main::betree::BeTree::{6}::insert]: backward function 0 *)
 Definition betree_be_tree_insert_back
   (n : nat) (self : Betree_be_tree_t) (key : u64) (value : u64) (st : state) :
   result Betree_be_tree_t
@@ -1118,7 +1124,7 @@ Definition betree_be_tree_insert_back
   betree_be_tree_apply_back n self key (BetreeMessageInsert value) st
 .
 
-(** [betree_main::betree::BeTree::{6}::delete] *)
+(** [betree_main::betree::BeTree::{6}::delete]: forward function *)
 Definition betree_be_tree_delete_fwd
   (n : nat) (self : Betree_be_tree_t) (key : u64) (st : state) :
   result (state * unit)
@@ -1129,7 +1135,7 @@ Definition betree_be_tree_delete_fwd
   Return (st0, tt)
 .
 
-(** [betree_main::betree::BeTree::{6}::delete] *)
+(** [betree_main::betree::BeTree::{6}::delete]: backward function 0 *)
 Definition betree_be_tree_delete_back
   (n : nat) (self : Betree_be_tree_t) (key : u64) (st : state) :
   result Betree_be_tree_t
@@ -1137,7 +1143,7 @@ Definition betree_be_tree_delete_back
   betree_be_tree_apply_back n self key BetreeMessageDelete st
 .
 
-(** [betree_main::betree::BeTree::{6}::upsert] *)
+(** [betree_main::betree::BeTree::{6}::upsert]: forward function *)
 Definition betree_be_tree_upsert_fwd
   (n : nat) (self : Betree_be_tree_t) (key : u64)
   (upd : Betree_upsert_fun_state_t) (st : state) :
@@ -1149,7 +1155,7 @@ Definition betree_be_tree_upsert_fwd
   Return (st0, tt)
 .
 
-(** [betree_main::betree::BeTree::{6}::upsert] *)
+(** [betree_main::betree::BeTree::{6}::upsert]: backward function 0 *)
 Definition betree_be_tree_upsert_back
   (n : nat) (self : Betree_be_tree_t) (key : u64)
   (upd : Betree_upsert_fun_state_t) (st : state) :
@@ -1158,7 +1164,7 @@ Definition betree_be_tree_upsert_back
   betree_be_tree_apply_back n self key (BetreeMessageUpsert upd) st
 .
 
-(** [betree_main::betree::BeTree::{6}::lookup] *)
+(** [betree_main::betree::BeTree::{6}::lookup]: forward function *)
 Definition betree_be_tree_lookup_fwd
   (n : nat) (self : Betree_be_tree_t) (key : u64) (st : state) :
   result (state * (option u64))
@@ -1166,7 +1172,7 @@ Definition betree_be_tree_lookup_fwd
   betree_node_lookup_fwd n self.(Betree_be_tree_root) key st
 .
 
-(** [betree_main::betree::BeTree::{6}::lookup] *)
+(** [betree_main::betree::BeTree::{6}::lookup]: backward function 0 *)
 Definition betree_be_tree_lookup_back
   (n : nat) (self : Betree_be_tree_t) (key : u64) (st : state) :
   result Betree_be_tree_t
@@ -1180,7 +1186,7 @@ Definition betree_be_tree_lookup_back
     |}
 .
 
-(** [betree_main::main] *)
+(** [betree_main::main]: forward function *)
 Definition main_fwd : result unit :=
   Return tt.
 
diff --git a/tests/coq/betree/BetreeMain_Opaque.v b/tests/coq/betree/BetreeMain_Opaque.v
index 51321f56..bd49500b 100644
--- a/tests/coq/betree/BetreeMain_Opaque.v
+++ b/tests/coq/betree/BetreeMain_Opaque.v
@@ -8,29 +8,29 @@ Require Export BetreeMain_Types.
 Import BetreeMain_Types.
 Module BetreeMain_Opaque.
 
-(** [betree_main::betree_utils::load_internal_node] *)
+(** [betree_main::betree_utils::load_internal_node]: forward function *)
 Axiom betree_utils_load_internal_node_fwd
   : u64 -> state -> result (state * (Betree_list_t (u64 * Betree_message_t)))
 .
 
-(** [betree_main::betree_utils::store_internal_node] *)
+(** [betree_main::betree_utils::store_internal_node]: forward function *)
 Axiom betree_utils_store_internal_node_fwd
   :
   u64 -> Betree_list_t (u64 * Betree_message_t) -> state -> result (state *
     unit)
 .
 
-(** [betree_main::betree_utils::load_leaf_node] *)
+(** [betree_main::betree_utils::load_leaf_node]: forward function *)
 Axiom betree_utils_load_leaf_node_fwd
   : u64 -> state -> result (state * (Betree_list_t (u64 * u64)))
 .
 
-(** [betree_main::betree_utils::store_leaf_node] *)
+(** [betree_main::betree_utils::store_leaf_node]: forward function *)
 Axiom betree_utils_store_leaf_node_fwd
   : u64 -> Betree_list_t (u64 * u64) -> state -> result (state * unit)
 .
 
-(** [core::option::Option::{0}::unwrap] *)
+(** [core::option::Option::{0}::unwrap]: forward function *)
 Axiom core_option_option_unwrap_fwd :
   forall(T : Type), option T -> state -> result (state * T)
 .
diff --git a/tests/coq/betree/_CoqProject b/tests/coq/betree/_CoqProject
index e5a3f799..42c62421 100644
--- a/tests/coq/betree/_CoqProject
+++ b/tests/coq/betree/_CoqProject
@@ -3,7 +3,7 @@
 -arg -w
 -arg all
 
-Primitives.v
 BetreeMain_Types.v
+Primitives.v
 BetreeMain_Funs.v
 BetreeMain_Opaque.v
diff --git a/tests/coq/hashmap/Hashmap_Funs.v b/tests/coq/hashmap/Hashmap_Funs.v
index 6bc82677..c8630eb6 100644
--- a/tests/coq/hashmap/Hashmap_Funs.v
+++ b/tests/coq/hashmap/Hashmap_Funs.v
@@ -8,11 +8,11 @@ Require Export Hashmap_Types.
 Import Hashmap_Types.
 Module Hashmap_Funs.
 
-(** [hashmap::hash_key] *)
+(** [hashmap::hash_key]: forward function *)
 Definition hash_key_fwd (k : usize) : result usize :=
   Return k.
 
-(** [hashmap::HashMap::{0}::allocate_slots] *)
+(** [hashmap::HashMap::{0}::allocate_slots]: loop 0: forward function *)
 Fixpoint hash_map_allocate_slots_loop_fwd
   (T : Type) (n : nat) (slots : vec (List_t T)) (n0 : usize) :
   result (vec (List_t T))
@@ -29,7 +29,7 @@ Fixpoint hash_map_allocate_slots_loop_fwd
   end
 .
 
-(** [hashmap::HashMap::{0}::allocate_slots] *)
+(** [hashmap::HashMap::{0}::allocate_slots]: forward function *)
 Definition hash_map_allocate_slots_fwd
   (T : Type) (n : nat) (slots : vec (List_t T)) (n0 : usize) :
   result (vec (List_t T))
@@ -37,7 +37,7 @@ Definition hash_map_allocate_slots_fwd
   hash_map_allocate_slots_loop_fwd T n slots n0
 .
 
-(** [hashmap::HashMap::{0}::new_with_capacity] *)
+(** [hashmap::HashMap::{0}::new_with_capacity]: forward function *)
 Definition hash_map_new_with_capacity_fwd
   (T : Type) (n : nat) (capacity : usize) (max_load_dividend : usize)
   (max_load_divisor : usize) :
@@ -56,12 +56,13 @@ Definition hash_map_new_with_capacity_fwd
     |}
 .
 
-(** [hashmap::HashMap::{0}::new] *)
+(** [hashmap::HashMap::{0}::new]: forward function *)
 Definition hash_map_new_fwd (T : Type) (n : nat) : result (Hash_map_t T) :=
   hash_map_new_with_capacity_fwd T n 32%usize 4%usize 5%usize
 .
 
-(** [hashmap::HashMap::{0}::clear] *)
+(** [hashmap::HashMap::{0}::clear]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Fixpoint hash_map_clear_loop_fwd_back
   (T : Type) (n : nat) (slots : vec (List_t T)) (i : usize) :
   result (vec (List_t T))
@@ -79,7 +80,8 @@ Fixpoint hash_map_clear_loop_fwd_back
   end
 .
 
-(** [hashmap::HashMap::{0}::clear] *)
+(** [hashmap::HashMap::{0}::clear]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition hash_map_clear_fwd_back
   (T : Type) (n : nat) (self : Hash_map_t T) : result (Hash_map_t T) :=
   v <- hash_map_clear_loop_fwd_back T n self.(Hash_map_slots) 0%usize;
@@ -92,12 +94,12 @@ Definition hash_map_clear_fwd_back
     |}
 .
 
-(** [hashmap::HashMap::{0}::len] *)
+(** [hashmap::HashMap::{0}::len]: forward function *)
 Definition hash_map_len_fwd (T : Type) (self : Hash_map_t T) : result usize :=
   Return self.(Hash_map_num_entries)
 .
 
-(** [hashmap::HashMap::{0}::insert_in_list] *)
+(** [hashmap::HashMap::{0}::insert_in_list]: loop 0: forward function *)
 Fixpoint hash_map_insert_in_list_loop_fwd
   (T : Type) (n : nat) (key : usize) (value : T) (ls : List_t T) :
   result bool
@@ -115,7 +117,7 @@ Fixpoint hash_map_insert_in_list_loop_fwd
   end
 .
 
-(** [hashmap::HashMap::{0}::insert_in_list] *)
+(** [hashmap::HashMap::{0}::insert_in_list]: forward function *)
 Definition hash_map_insert_in_list_fwd
   (T : Type) (n : nat) (key : usize) (value : T) (ls : List_t T) :
   result bool
@@ -123,7 +125,7 @@ Definition hash_map_insert_in_list_fwd
   hash_map_insert_in_list_loop_fwd T n key value ls
 .
 
-(** [hashmap::HashMap::{0}::insert_in_list] *)
+(** [hashmap::HashMap::{0}::insert_in_list]: loop 0: backward function 0 *)
 Fixpoint hash_map_insert_in_list_loop_back
   (T : Type) (n : nat) (key : usize) (value : T) (ls : List_t T) :
   result (List_t T)
@@ -143,7 +145,7 @@ Fixpoint hash_map_insert_in_list_loop_back
   end
 .
 
-(** [hashmap::HashMap::{0}::insert_in_list] *)
+(** [hashmap::HashMap::{0}::insert_in_list]: backward function 0 *)
 Definition hash_map_insert_in_list_back
   (T : Type) (n : nat) (key : usize) (value : T) (ls : List_t T) :
   result (List_t T)
@@ -151,7 +153,8 @@ Definition hash_map_insert_in_list_back
   hash_map_insert_in_list_loop_back T n key value ls
 .
 
-(** [hashmap::HashMap::{0}::insert_no_resize] *)
+(** [hashmap::HashMap::{0}::insert_no_resize]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition hash_map_insert_no_resize_fwd_back
   (T : Type) (n : nat) (self : Hash_map_t T) (key : usize) (value : T) :
   result (Hash_map_t T)
@@ -189,7 +192,8 @@ Definition hash_map_insert_no_resize_fwd_back
 Definition core_num_u32_max_body : result u32 := Return 4294967295%u32.
 Definition core_num_u32_max_c : u32 := core_num_u32_max_body%global.
 
-(** [hashmap::HashMap::{0}::move_elements_from_list] *)
+(** [hashmap::HashMap::{0}::move_elements_from_list]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Fixpoint hash_map_move_elements_from_list_loop_fwd_back
   (T : Type) (n : nat) (ntable : Hash_map_t T) (ls : List_t T) :
   result (Hash_map_t T)
@@ -206,7 +210,8 @@ Fixpoint hash_map_move_elements_from_list_loop_fwd_back
   end
 .
 
-(** [hashmap::HashMap::{0}::move_elements_from_list] *)
+(** [hashmap::HashMap::{0}::move_elements_from_list]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition hash_map_move_elements_from_list_fwd_back
   (T : Type) (n : nat) (ntable : Hash_map_t T) (ls : List_t T) :
   result (Hash_map_t T)
@@ -214,7 +219,8 @@ Definition hash_map_move_elements_from_list_fwd_back
   hash_map_move_elements_from_list_loop_fwd_back T n ntable ls
 .
 
-(** [hashmap::HashMap::{0}::move_elements] *)
+(** [hashmap::HashMap::{0}::move_elements]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Fixpoint hash_map_move_elements_loop_fwd_back
   (T : Type) (n : nat) (ntable : Hash_map_t T) (slots : vec (List_t T))
   (i : usize) :
@@ -237,7 +243,8 @@ Fixpoint hash_map_move_elements_loop_fwd_back
   end
 .
 
-(** [hashmap::HashMap::{0}::move_elements] *)
+(** [hashmap::HashMap::{0}::move_elements]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition hash_map_move_elements_fwd_back
   (T : Type) (n : nat) (ntable : Hash_map_t T) (slots : vec (List_t T))
   (i : usize) :
@@ -246,7 +253,8 @@ Definition hash_map_move_elements_fwd_back
   hash_map_move_elements_loop_fwd_back T n ntable slots i
 .
 
-(** [hashmap::HashMap::{0}::try_resize] *)
+(** [hashmap::HashMap::{0}::try_resize]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition hash_map_try_resize_fwd_back
   (T : Type) (n : nat) (self : Hash_map_t T) : result (Hash_map_t T) :=
   max_usize <- scalar_cast U32 Usize core_num_u32_max_c;
@@ -278,7 +286,8 @@ Definition hash_map_try_resize_fwd_back
       |}
 .
 
-(** [hashmap::HashMap::{0}::insert] *)
+(** [hashmap::HashMap::{0}::insert]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition hash_map_insert_fwd_back
   (T : Type) (n : nat) (self : Hash_map_t T) (key : usize) (value : T) :
   result (Hash_map_t T)
@@ -290,7 +299,7 @@ Definition hash_map_insert_fwd_back
   else Return self0
 .
 
-(** [hashmap::HashMap::{0}::contains_key_in_list] *)
+(** [hashmap::HashMap::{0}::contains_key_in_list]: loop 0: forward function *)
 Fixpoint hash_map_contains_key_in_list_loop_fwd
   (T : Type) (n : nat) (key : usize) (ls : List_t T) : result bool :=
   match n with
@@ -306,13 +315,13 @@ Fixpoint hash_map_contains_key_in_list_loop_fwd
   end
 .
 
-(** [hashmap::HashMap::{0}::contains_key_in_list] *)
+(** [hashmap::HashMap::{0}::contains_key_in_list]: forward function *)
 Definition hash_map_contains_key_in_list_fwd
   (T : Type) (n : nat) (key : usize) (ls : List_t T) : result bool :=
   hash_map_contains_key_in_list_loop_fwd T n key ls
 .
 
-(** [hashmap::HashMap::{0}::contains_key] *)
+(** [hashmap::HashMap::{0}::contains_key]: forward function *)
 Definition hash_map_contains_key_fwd
   (T : Type) (n : nat) (self : Hash_map_t T) (key : usize) : result bool :=
   hash <- hash_key_fwd key;
@@ -322,7 +331,7 @@ Definition hash_map_contains_key_fwd
   hash_map_contains_key_in_list_fwd T n key l
 .
 
-(** [hashmap::HashMap::{0}::get_in_list] *)
+(** [hashmap::HashMap::{0}::get_in_list]: loop 0: forward function *)
 Fixpoint hash_map_get_in_list_loop_fwd
   (T : Type) (n : nat) (key : usize) (ls : List_t T) : result T :=
   match n with
@@ -338,13 +347,13 @@ Fixpoint hash_map_get_in_list_loop_fwd
   end
 .
 
-(** [hashmap::HashMap::{0}::get_in_list] *)
+(** [hashmap::HashMap::{0}::get_in_list]: forward function *)
 Definition hash_map_get_in_list_fwd
   (T : Type) (n : nat) (key : usize) (ls : List_t T) : result T :=
   hash_map_get_in_list_loop_fwd T n key ls
 .
 
-(** [hashmap::HashMap::{0}::get] *)
+(** [hashmap::HashMap::{0}::get]: forward function *)
 Definition hash_map_get_fwd
   (T : Type) (n : nat) (self : Hash_map_t T) (key : usize) : result T :=
   hash <- hash_key_fwd key;
@@ -354,7 +363,7 @@ Definition hash_map_get_fwd
   hash_map_get_in_list_fwd T n key l
 .
 
-(** [hashmap::HashMap::{0}::get_mut_in_list] *)
+(** [hashmap::HashMap::{0}::get_mut_in_list]: loop 0: forward function *)
 Fixpoint hash_map_get_mut_in_list_loop_fwd
   (T : Type) (n : nat) (ls : List_t T) (key : usize) : result T :=
   match n with
@@ -370,13 +379,13 @@ Fixpoint hash_map_get_mut_in_list_loop_fwd
   end
 .
 
-(** [hashmap::HashMap::{0}::get_mut_in_list] *)
+(** [hashmap::HashMap::{0}::get_mut_in_list]: forward function *)
 Definition hash_map_get_mut_in_list_fwd
   (T : Type) (n : nat) (ls : List_t T) (key : usize) : result T :=
   hash_map_get_mut_in_list_loop_fwd T n ls key
 .
 
-(** [hashmap::HashMap::{0}::get_mut_in_list] *)
+(** [hashmap::HashMap::{0}::get_mut_in_list]: loop 0: backward function 0 *)
 Fixpoint hash_map_get_mut_in_list_loop_back
   (T : Type) (n : nat) (ls : List_t T) (key : usize) (ret : T) :
   result (List_t T)
@@ -396,7 +405,7 @@ Fixpoint hash_map_get_mut_in_list_loop_back
   end
 .
 
-(** [hashmap::HashMap::{0}::get_mut_in_list] *)
+(** [hashmap::HashMap::{0}::get_mut_in_list]: backward function 0 *)
 Definition hash_map_get_mut_in_list_back
   (T : Type) (n : nat) (ls : List_t T) (key : usize) (ret : T) :
   result (List_t T)
@@ -404,7 +413,7 @@ Definition hash_map_get_mut_in_list_back
   hash_map_get_mut_in_list_loop_back T n ls key ret
 .
 
-(** [hashmap::HashMap::{0}::get_mut] *)
+(** [hashmap::HashMap::{0}::get_mut]: forward function *)
 Definition hash_map_get_mut_fwd
   (T : Type) (n : nat) (self : Hash_map_t T) (key : usize) : result T :=
   hash <- hash_key_fwd key;
@@ -414,7 +423,7 @@ Definition hash_map_get_mut_fwd
   hash_map_get_mut_in_list_fwd T n l key
 .
 
-(** [hashmap::HashMap::{0}::get_mut] *)
+(** [hashmap::HashMap::{0}::get_mut]: backward function 0 *)
 Definition hash_map_get_mut_back
   (T : Type) (n : nat) (self : Hash_map_t T) (key : usize) (ret : T) :
   result (Hash_map_t T)
@@ -434,7 +443,7 @@ Definition hash_map_get_mut_back
     |}
 .
 
-(** [hashmap::HashMap::{0}::remove_from_list] *)
+(** [hashmap::HashMap::{0}::remove_from_list]: loop 0: forward function *)
 Fixpoint hash_map_remove_from_list_loop_fwd
   (T : Type) (n : nat) (key : usize) (ls : List_t T) : result (option T) :=
   match n with
@@ -455,13 +464,13 @@ Fixpoint hash_map_remove_from_list_loop_fwd
   end
 .
 
-(** [hashmap::HashMap::{0}::remove_from_list] *)
+(** [hashmap::HashMap::{0}::remove_from_list]: forward function *)
 Definition hash_map_remove_from_list_fwd
   (T : Type) (n : nat) (key : usize) (ls : List_t T) : result (option T) :=
   hash_map_remove_from_list_loop_fwd T n key ls
 .
 
-(** [hashmap::HashMap::{0}::remove_from_list] *)
+(** [hashmap::HashMap::{0}::remove_from_list]: loop 0: backward function 1 *)
 Fixpoint hash_map_remove_from_list_loop_back
   (T : Type) (n : nat) (key : usize) (ls : List_t T) : result (List_t T) :=
   match n with
@@ -484,13 +493,13 @@ Fixpoint hash_map_remove_from_list_loop_back
   end
 .
 
-(** [hashmap::HashMap::{0}::remove_from_list] *)
+(** [hashmap::HashMap::{0}::remove_from_list]: backward function 1 *)
 Definition hash_map_remove_from_list_back
   (T : Type) (n : nat) (key : usize) (ls : List_t T) : result (List_t T) :=
   hash_map_remove_from_list_loop_back T n key ls
 .
 
-(** [hashmap::HashMap::{0}::remove] *)
+(** [hashmap::HashMap::{0}::remove]: forward function *)
 Definition hash_map_remove_fwd
   (T : Type) (n : nat) (self : Hash_map_t T) (key : usize) :
   result (option T)
@@ -507,7 +516,7 @@ Definition hash_map_remove_fwd
   end
 .
 
-(** [hashmap::HashMap::{0}::remove] *)
+(** [hashmap::HashMap::{0}::remove]: backward function 0 *)
 Definition hash_map_remove_back
   (T : Type) (n : nat) (self : Hash_map_t T) (key : usize) :
   result (Hash_map_t T)
@@ -542,7 +551,7 @@ Definition hash_map_remove_back
   end
 .
 
-(** [hashmap::test1] *)
+(** [hashmap::test1]: forward function *)
 Definition test1_fwd (n : nat) : result unit :=
   hm <- hash_map_new_fwd u64 n;
   hm0 <- hash_map_insert_fwd_back u64 n hm 0%usize 42%u64;
diff --git a/tests/coq/hashmap/_CoqProject b/tests/coq/hashmap/_CoqProject
index daa9b2ba..7f80afbf 100644
--- a/tests/coq/hashmap/_CoqProject
+++ b/tests/coq/hashmap/_CoqProject
@@ -3,6 +3,6 @@
 -arg -w
 -arg all
 
-Primitives.v
 Hashmap_Types.v
+Primitives.v
 Hashmap_Funs.v
diff --git a/tests/coq/hashmap_on_disk/HashmapMain_Funs.v b/tests/coq/hashmap_on_disk/HashmapMain_Funs.v
index 2d1bcda6..1b7304cc 100644
--- a/tests/coq/hashmap_on_disk/HashmapMain_Funs.v
+++ b/tests/coq/hashmap_on_disk/HashmapMain_Funs.v
@@ -10,11 +10,11 @@ Require Export HashmapMain_Opaque.
 Import HashmapMain_Opaque.
 Module HashmapMain_Funs.
 
-(** [hashmap_main::hashmap::hash_key] *)
+(** [hashmap_main::hashmap::hash_key]: forward function *)
 Definition hashmap_hash_key_fwd (k : usize) : result usize :=
   Return k.
 
-(** [hashmap_main::hashmap::HashMap::{0}::allocate_slots] *)
+(** [hashmap_main::hashmap::HashMap::{0}::allocate_slots]: loop 0: forward function *)
 Fixpoint hashmap_hash_map_allocate_slots_loop_fwd
   (T : Type) (n : nat) (slots : vec (Hashmap_list_t T)) (n0 : usize) :
   result (vec (Hashmap_list_t T))
@@ -31,7 +31,7 @@ Fixpoint hashmap_hash_map_allocate_slots_loop_fwd
   end
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::allocate_slots] *)
+(** [hashmap_main::hashmap::HashMap::{0}::allocate_slots]: forward function *)
 Definition hashmap_hash_map_allocate_slots_fwd
   (T : Type) (n : nat) (slots : vec (Hashmap_list_t T)) (n0 : usize) :
   result (vec (Hashmap_list_t T))
@@ -39,7 +39,7 @@ Definition hashmap_hash_map_allocate_slots_fwd
   hashmap_hash_map_allocate_slots_loop_fwd T n slots n0
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::new_with_capacity] *)
+(** [hashmap_main::hashmap::HashMap::{0}::new_with_capacity]: forward function *)
 Definition hashmap_hash_map_new_with_capacity_fwd
   (T : Type) (n : nat) (capacity : usize) (max_load_dividend : usize)
   (max_load_divisor : usize) :
@@ -58,13 +58,14 @@ Definition hashmap_hash_map_new_with_capacity_fwd
     |}
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::new] *)
+(** [hashmap_main::hashmap::HashMap::{0}::new]: forward function *)
 Definition hashmap_hash_map_new_fwd
   (T : Type) (n : nat) : result (Hashmap_hash_map_t T) :=
   hashmap_hash_map_new_with_capacity_fwd T n 32%usize 4%usize 5%usize
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::clear] *)
+(** [hashmap_main::hashmap::HashMap::{0}::clear]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Fixpoint hashmap_hash_map_clear_loop_fwd_back
   (T : Type) (n : nat) (slots : vec (Hashmap_list_t T)) (i : usize) :
   result (vec (Hashmap_list_t T))
@@ -82,7 +83,8 @@ Fixpoint hashmap_hash_map_clear_loop_fwd_back
   end
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::clear] *)
+(** [hashmap_main::hashmap::HashMap::{0}::clear]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition hashmap_hash_map_clear_fwd_back
   (T : Type) (n : nat) (self : Hashmap_hash_map_t T) :
   result (Hashmap_hash_map_t T)
@@ -100,13 +102,13 @@ Definition hashmap_hash_map_clear_fwd_back
     |}
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::len] *)
+(** [hashmap_main::hashmap::HashMap::{0}::len]: forward function *)
 Definition hashmap_hash_map_len_fwd
   (T : Type) (self : Hashmap_hash_map_t T) : result usize :=
   Return self.(Hashmap_hash_map_num_entries)
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::insert_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::insert_in_list]: loop 0: forward function *)
 Fixpoint hashmap_hash_map_insert_in_list_loop_fwd
   (T : Type) (n : nat) (key : usize) (value : T) (ls : Hashmap_list_t T) :
   result bool
@@ -124,7 +126,7 @@ Fixpoint hashmap_hash_map_insert_in_list_loop_fwd
   end
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::insert_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::insert_in_list]: forward function *)
 Definition hashmap_hash_map_insert_in_list_fwd
   (T : Type) (n : nat) (key : usize) (value : T) (ls : Hashmap_list_t T) :
   result bool
@@ -132,7 +134,7 @@ Definition hashmap_hash_map_insert_in_list_fwd
   hashmap_hash_map_insert_in_list_loop_fwd T n key value ls
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::insert_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::insert_in_list]: loop 0: backward function 0 *)
 Fixpoint hashmap_hash_map_insert_in_list_loop_back
   (T : Type) (n : nat) (key : usize) (value : T) (ls : Hashmap_list_t T) :
   result (Hashmap_list_t T)
@@ -153,7 +155,7 @@ Fixpoint hashmap_hash_map_insert_in_list_loop_back
   end
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::insert_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::insert_in_list]: backward function 0 *)
 Definition hashmap_hash_map_insert_in_list_back
   (T : Type) (n : nat) (key : usize) (value : T) (ls : Hashmap_list_t T) :
   result (Hashmap_list_t T)
@@ -161,7 +163,8 @@ Definition hashmap_hash_map_insert_in_list_back
   hashmap_hash_map_insert_in_list_loop_back T n key value ls
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::insert_no_resize] *)
+(** [hashmap_main::hashmap::HashMap::{0}::insert_no_resize]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition hashmap_hash_map_insert_no_resize_fwd_back
   (T : Type) (n : nat) (self : Hashmap_hash_map_t T) (key : usize) (value : T)
   :
@@ -207,7 +210,8 @@ Definition hashmap_hash_map_insert_no_resize_fwd_back
 Definition core_num_u32_max_body : result u32 := Return 4294967295%u32.
 Definition core_num_u32_max_c : u32 := core_num_u32_max_body%global.
 
-(** [hashmap_main::hashmap::HashMap::{0}::move_elements_from_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::move_elements_from_list]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Fixpoint hashmap_hash_map_move_elements_from_list_loop_fwd_back
   (T : Type) (n : nat) (ntable : Hashmap_hash_map_t T) (ls : Hashmap_list_t T)
   :
@@ -225,7 +229,8 @@ Fixpoint hashmap_hash_map_move_elements_from_list_loop_fwd_back
   end
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::move_elements_from_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::move_elements_from_list]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition hashmap_hash_map_move_elements_from_list_fwd_back
   (T : Type) (n : nat) (ntable : Hashmap_hash_map_t T) (ls : Hashmap_list_t T)
   :
@@ -234,7 +239,8 @@ Definition hashmap_hash_map_move_elements_from_list_fwd_back
   hashmap_hash_map_move_elements_from_list_loop_fwd_back T n ntable ls
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::move_elements] *)
+(** [hashmap_main::hashmap::HashMap::{0}::move_elements]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Fixpoint hashmap_hash_map_move_elements_loop_fwd_back
   (T : Type) (n : nat) (ntable : Hashmap_hash_map_t T)
   (slots : vec (Hashmap_list_t T)) (i : usize) :
@@ -258,7 +264,8 @@ Fixpoint hashmap_hash_map_move_elements_loop_fwd_back
   end
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::move_elements] *)
+(** [hashmap_main::hashmap::HashMap::{0}::move_elements]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition hashmap_hash_map_move_elements_fwd_back
   (T : Type) (n : nat) (ntable : Hashmap_hash_map_t T)
   (slots : vec (Hashmap_list_t T)) (i : usize) :
@@ -267,7 +274,8 @@ Definition hashmap_hash_map_move_elements_fwd_back
   hashmap_hash_map_move_elements_loop_fwd_back T n ntable slots i
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::try_resize] *)
+(** [hashmap_main::hashmap::HashMap::{0}::try_resize]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition hashmap_hash_map_try_resize_fwd_back
   (T : Type) (n : nat) (self : Hashmap_hash_map_t T) :
   result (Hashmap_hash_map_t T)
@@ -302,7 +310,8 @@ Definition hashmap_hash_map_try_resize_fwd_back
       |}
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::insert] *)
+(** [hashmap_main::hashmap::HashMap::{0}::insert]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition hashmap_hash_map_insert_fwd_back
   (T : Type) (n : nat) (self : Hashmap_hash_map_t T) (key : usize) (value : T)
   :
@@ -315,7 +324,7 @@ Definition hashmap_hash_map_insert_fwd_back
   else Return self0
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::contains_key_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::contains_key_in_list]: loop 0: forward function *)
 Fixpoint hashmap_hash_map_contains_key_in_list_loop_fwd
   (T : Type) (n : nat) (key : usize) (ls : Hashmap_list_t T) : result bool :=
   match n with
@@ -331,13 +340,13 @@ Fixpoint hashmap_hash_map_contains_key_in_list_loop_fwd
   end
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::contains_key_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::contains_key_in_list]: forward function *)
 Definition hashmap_hash_map_contains_key_in_list_fwd
   (T : Type) (n : nat) (key : usize) (ls : Hashmap_list_t T) : result bool :=
   hashmap_hash_map_contains_key_in_list_loop_fwd T n key ls
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::contains_key] *)
+(** [hashmap_main::hashmap::HashMap::{0}::contains_key]: forward function *)
 Definition hashmap_hash_map_contains_key_fwd
   (T : Type) (n : nat) (self : Hashmap_hash_map_t T) (key : usize) :
   result bool
@@ -349,7 +358,7 @@ Definition hashmap_hash_map_contains_key_fwd
   hashmap_hash_map_contains_key_in_list_fwd T n key l
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::get_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::get_in_list]: loop 0: forward function *)
 Fixpoint hashmap_hash_map_get_in_list_loop_fwd
   (T : Type) (n : nat) (key : usize) (ls : Hashmap_list_t T) : result T :=
   match n with
@@ -365,13 +374,13 @@ Fixpoint hashmap_hash_map_get_in_list_loop_fwd
   end
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::get_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::get_in_list]: forward function *)
 Definition hashmap_hash_map_get_in_list_fwd
   (T : Type) (n : nat) (key : usize) (ls : Hashmap_list_t T) : result T :=
   hashmap_hash_map_get_in_list_loop_fwd T n key ls
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::get] *)
+(** [hashmap_main::hashmap::HashMap::{0}::get]: forward function *)
 Definition hashmap_hash_map_get_fwd
   (T : Type) (n : nat) (self : Hashmap_hash_map_t T) (key : usize) :
   result T
@@ -383,7 +392,7 @@ Definition hashmap_hash_map_get_fwd
   hashmap_hash_map_get_in_list_fwd T n key l
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list]: loop 0: forward function *)
 Fixpoint hashmap_hash_map_get_mut_in_list_loop_fwd
   (T : Type) (n : nat) (ls : Hashmap_list_t T) (key : usize) : result T :=
   match n with
@@ -399,13 +408,13 @@ Fixpoint hashmap_hash_map_get_mut_in_list_loop_fwd
   end
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list]: forward function *)
 Definition hashmap_hash_map_get_mut_in_list_fwd
   (T : Type) (n : nat) (ls : Hashmap_list_t T) (key : usize) : result T :=
   hashmap_hash_map_get_mut_in_list_loop_fwd T n ls key
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list]: loop 0: backward function 0 *)
 Fixpoint hashmap_hash_map_get_mut_in_list_loop_back
   (T : Type) (n : nat) (ls : Hashmap_list_t T) (key : usize) (ret : T) :
   result (Hashmap_list_t T)
@@ -425,7 +434,7 @@ Fixpoint hashmap_hash_map_get_mut_in_list_loop_back
   end
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list]: backward function 0 *)
 Definition hashmap_hash_map_get_mut_in_list_back
   (T : Type) (n : nat) (ls : Hashmap_list_t T) (key : usize) (ret : T) :
   result (Hashmap_list_t T)
@@ -433,7 +442,7 @@ Definition hashmap_hash_map_get_mut_in_list_back
   hashmap_hash_map_get_mut_in_list_loop_back T n ls key ret
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::get_mut] *)
+(** [hashmap_main::hashmap::HashMap::{0}::get_mut]: forward function *)
 Definition hashmap_hash_map_get_mut_fwd
   (T : Type) (n : nat) (self : Hashmap_hash_map_t T) (key : usize) :
   result T
@@ -446,7 +455,7 @@ Definition hashmap_hash_map_get_mut_fwd
   hashmap_hash_map_get_mut_in_list_fwd T n l key
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::get_mut] *)
+(** [hashmap_main::hashmap::HashMap::{0}::get_mut]: backward function 0 *)
 Definition hashmap_hash_map_get_mut_back
   (T : Type) (n : nat) (self : Hashmap_hash_map_t T) (key : usize) (ret : T) :
   result (Hashmap_hash_map_t T)
@@ -470,7 +479,7 @@ Definition hashmap_hash_map_get_mut_back
     |}
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::remove_from_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::remove_from_list]: loop 0: forward function *)
 Fixpoint hashmap_hash_map_remove_from_list_loop_fwd
   (T : Type) (n : nat) (key : usize) (ls : Hashmap_list_t T) :
   result (option T)
@@ -495,7 +504,7 @@ Fixpoint hashmap_hash_map_remove_from_list_loop_fwd
   end
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::remove_from_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::remove_from_list]: forward function *)
 Definition hashmap_hash_map_remove_from_list_fwd
   (T : Type) (n : nat) (key : usize) (ls : Hashmap_list_t T) :
   result (option T)
@@ -503,7 +512,7 @@ Definition hashmap_hash_map_remove_from_list_fwd
   hashmap_hash_map_remove_from_list_loop_fwd T n key ls
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::remove_from_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::remove_from_list]: loop 0: backward function 1 *)
 Fixpoint hashmap_hash_map_remove_from_list_loop_back
   (T : Type) (n : nat) (key : usize) (ls : Hashmap_list_t T) :
   result (Hashmap_list_t T)
@@ -530,7 +539,7 @@ Fixpoint hashmap_hash_map_remove_from_list_loop_back
   end
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::remove_from_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::remove_from_list]: backward function 1 *)
 Definition hashmap_hash_map_remove_from_list_back
   (T : Type) (n : nat) (key : usize) (ls : Hashmap_list_t T) :
   result (Hashmap_list_t T)
@@ -538,7 +547,7 @@ Definition hashmap_hash_map_remove_from_list_back
   hashmap_hash_map_remove_from_list_loop_back T n key ls
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::remove] *)
+(** [hashmap_main::hashmap::HashMap::{0}::remove]: forward function *)
 Definition hashmap_hash_map_remove_fwd
   (T : Type) (n : nat) (self : Hashmap_hash_map_t T) (key : usize) :
   result (option T)
@@ -557,7 +566,7 @@ Definition hashmap_hash_map_remove_fwd
   end
 .
 
-(** [hashmap_main::hashmap::HashMap::{0}::remove] *)
+(** [hashmap_main::hashmap::HashMap::{0}::remove]: backward function 0 *)
 Definition hashmap_hash_map_remove_back
   (T : Type) (n : nat) (self : Hashmap_hash_map_t T) (key : usize) :
   result (Hashmap_hash_map_t T)
@@ -599,7 +608,7 @@ Definition hashmap_hash_map_remove_back
   end
 .
 
-(** [hashmap_main::hashmap::test1] *)
+(** [hashmap_main::hashmap::test1]: forward function *)
 Definition hashmap_test1_fwd (n : nat) : result unit :=
   hm <- hashmap_hash_map_new_fwd u64 n;
   hm0 <- hashmap_hash_map_insert_fwd_back u64 n hm 0%usize 42%u64;
@@ -636,7 +645,7 @@ Definition hashmap_test1_fwd (n : nat) : result unit :=
       end))
 .
 
-(** [hashmap_main::insert_on_disk] *)
+(** [hashmap_main::insert_on_disk]: forward function *)
 Definition insert_on_disk_fwd
   (n : nat) (key : usize) (value : u64) (st : state) : result (state * unit) :=
   p <- hashmap_utils_deserialize_fwd st;
@@ -647,7 +656,7 @@ Definition insert_on_disk_fwd
   Return (st1, tt)
 .
 
-(** [hashmap_main::main] *)
+(** [hashmap_main::main]: forward function *)
 Definition main_fwd : result unit :=
   Return tt.
 
diff --git a/tests/coq/hashmap_on_disk/HashmapMain_Opaque.v b/tests/coq/hashmap_on_disk/HashmapMain_Opaque.v
index e1e7fe2b..1ad9c697 100644
--- a/tests/coq/hashmap_on_disk/HashmapMain_Opaque.v
+++ b/tests/coq/hashmap_on_disk/HashmapMain_Opaque.v
@@ -8,12 +8,12 @@ Require Export HashmapMain_Types.
 Import HashmapMain_Types.
 Module HashmapMain_Opaque.
 
-(** [hashmap_main::hashmap_utils::deserialize] *)
+(** [hashmap_main::hashmap_utils::deserialize]: forward function *)
 Axiom hashmap_utils_deserialize_fwd
   : state -> result (state * (Hashmap_hash_map_t u64))
 .
 
-(** [hashmap_main::hashmap_utils::serialize] *)
+(** [hashmap_main::hashmap_utils::serialize]: forward function *)
 Axiom hashmap_utils_serialize_fwd
   : Hashmap_hash_map_t u64 -> state -> result (state * unit)
 .
diff --git a/tests/coq/misc/Constants.v b/tests/coq/misc/Constants.v
index 6a5f2696..14c05c61 100644
--- a/tests/coq/misc/Constants.v
+++ b/tests/coq/misc/Constants.v
@@ -22,7 +22,7 @@ Definition x1_c : u32 := x1_body%global.
 Definition x2_body : result u32 := Return 3%u32.
 Definition x2_c : u32 := x2_body%global.
 
-(** [constants::incr] *)
+(** [constants::incr]: forward function *)
 Definition incr_fwd (n : u32) : result u32 :=
   u32_add n 1%u32.
 
@@ -30,7 +30,7 @@ Definition incr_fwd (n : u32) : result u32 :=
 Definition x3_body : result u32 := incr_fwd 32%u32.
 Definition x3_c : u32 := x3_body%global.
 
-(** [constants::mk_pair0] *)
+(** [constants::mk_pair0]: forward function *)
 Definition mk_pair0_fwd (x : u32) (y : u32) : result (u32 * u32) :=
   Return (x, y)
 .
@@ -42,7 +42,7 @@ Arguments mkPair_t {T1} {T2} _ _.
 Arguments Pair_x {T1} {T2}.
 Arguments Pair_y {T1} {T2}.
 
-(** [constants::mk_pair1] *)
+(** [constants::mk_pair1]: forward function *)
 Definition mk_pair1_fwd (x : u32) (y : u32) : result (Pair_t u32 u32) :=
   Return {| Pair_x := x; Pair_y := y |}
 .
@@ -71,7 +71,7 @@ Record Wrap_t (T : Type) := mkWrap_t { Wrap_val : T; }.
 Arguments mkWrap_t {T} _.
 Arguments Wrap_val {T}.
 
-(** [constants::Wrap::{0}::new] *)
+(** [constants::Wrap::{0}::new]: forward function *)
 Definition wrap_new_fwd (T : Type) (val : T) : result (Wrap_t T) :=
   Return {| Wrap_val := val |}
 .
@@ -80,7 +80,7 @@ Definition wrap_new_fwd (T : Type) (val : T) : result (Wrap_t T) :=
 Definition y_body : result (Wrap_t i32) := wrap_new_fwd i32 2%i32.
 Definition y_c : Wrap_t i32 := y_body%global.
 
-(** [constants::unwrap_y] *)
+(** [constants::unwrap_y]: forward function *)
 Definition unwrap_y_fwd : result i32 :=
   Return y_c.(Wrap_val).
 
@@ -92,11 +92,11 @@ Definition yval_c : i32 := yval_body%global.
 Definition get_z1_z1_body : result i32 := Return 3%i32.
 Definition get_z1_z1_c : i32 := get_z1_z1_body%global.
 
-(** [constants::get_z1] *)
+(** [constants::get_z1]: forward function *)
 Definition get_z1_fwd : result i32 :=
   Return get_z1_z1_c.
 
-(** [constants::add] *)
+(** [constants::add]: forward function *)
 Definition add_fwd (a : i32) (b : i32) : result i32 :=
   i32_add a b.
 
@@ -112,7 +112,7 @@ Definition q2_c : i32 := q2_body%global.
 Definition q3_body : result i32 := add_fwd q2_c 3%i32.
 Definition q3_c : i32 := q3_body%global.
 
-(** [constants::get_z2] *)
+(** [constants::get_z2]: forward function *)
 Definition get_z2_fwd : result i32 :=
   i <- get_z1_fwd; i0 <- add_fwd i q3_c; add_fwd q1_c i0
 .
diff --git a/tests/coq/misc/External_Funs.v b/tests/coq/misc/External_Funs.v
index 05dd8f2e..f18bbd1f 100644
--- a/tests/coq/misc/External_Funs.v
+++ b/tests/coq/misc/External_Funs.v
@@ -10,7 +10,7 @@ Require Export External_Opaque.
 Import External_Opaque.
 Module External_Funs.
 
-(** [external::swap] *)
+(** [external::swap]: forward function *)
 Definition swap_fwd
   (T : Type) (x : T) (y : T) (st : state) : result (state * unit) :=
   p <- core_mem_swap_fwd T x y st;
@@ -22,7 +22,7 @@ Definition swap_fwd
   Return (st2, tt)
 .
 
-(** [external::swap] *)
+(** [external::swap]: backward function 0 *)
 Definition swap_back
   (T : Type) (x : T) (y : T) (st : state) (st0 : state) :
   result (state * (T * T))
@@ -36,7 +36,7 @@ Definition swap_back
   Return (st0, (x0, y0))
 .
 
-(** [external::test_new_non_zero_u32] *)
+(** [external::test_new_non_zero_u32]: forward function *)
 Definition test_new_non_zero_u32_fwd
   (x : u32) (st : state) : result (state * Core_num_nonzero_non_zero_u32_t) :=
   p <- core_num_nonzero_non_zero_u32_new_fwd x st;
@@ -44,7 +44,7 @@ Definition test_new_non_zero_u32_fwd
   core_option_option_unwrap_fwd Core_num_nonzero_non_zero_u32_t opt st0
 .
 
-(** [external::test_vec] *)
+(** [external::test_vec]: forward function *)
 Definition test_vec_fwd : result unit :=
   let v := vec_new u32 in _ <- vec_push_back u32 v 0%u32; Return tt
 .
@@ -52,7 +52,7 @@ Definition test_vec_fwd : result unit :=
 (** Unit test for [external::test_vec] *)
 Check (test_vec_fwd )%return.
 
-(** [external::custom_swap] *)
+(** [external::custom_swap]: forward function *)
 Definition custom_swap_fwd
   (T : Type) (x : T) (y : T) (st : state) : result (state * T) :=
   p <- core_mem_swap_fwd T x y st;
@@ -64,7 +64,7 @@ Definition custom_swap_fwd
   Return (st2, x0)
 .
 
-(** [external::custom_swap] *)
+(** [external::custom_swap]: backward function 0 *)
 Definition custom_swap_back
   (T : Type) (x : T) (y : T) (st : state) (ret : T) (st0 : state) :
   result (state * (T * T))
@@ -78,13 +78,13 @@ Definition custom_swap_back
   Return (st0, (ret, y0))
 .
 
-(** [external::test_custom_swap] *)
+(** [external::test_custom_swap]: forward function *)
 Definition test_custom_swap_fwd
   (x : u32) (y : u32) (st : state) : result (state * unit) :=
   p <- custom_swap_fwd u32 x y st; let (st0, _) := p in Return (st0, tt)
 .
 
-(** [external::test_custom_swap] *)
+(** [external::test_custom_swap]: backward function 0 *)
 Definition test_custom_swap_back
   (x : u32) (y : u32) (st : state) (st0 : state) :
   result (state * (u32 * u32))
@@ -92,7 +92,7 @@ Definition test_custom_swap_back
   custom_swap_back u32 x y st 1%u32 st0
 .
 
-(** [external::test_swap_non_zero] *)
+(** [external::test_swap_non_zero]: forward function *)
 Definition test_swap_non_zero_fwd
   (x : u32) (st : state) : result (state * u32) :=
   p <- swap_fwd u32 x 0%u32 st;
diff --git a/tests/coq/misc/External_Opaque.v b/tests/coq/misc/External_Opaque.v
index 5ee65277..1224f426 100644
--- a/tests/coq/misc/External_Opaque.v
+++ b/tests/coq/misc/External_Opaque.v
@@ -8,27 +8,27 @@ Require Export External_Types.
 Import External_Types.
 Module External_Opaque.
 
-(** [core::mem::swap] *)
+(** [core::mem::swap]: forward function *)
 Axiom core_mem_swap_fwd :
   forall(T : Type), T -> T -> state -> result (state * unit)
 .
 
-(** [core::mem::swap] *)
+(** [core::mem::swap]: backward function 0 *)
 Axiom core_mem_swap_back0 :
   forall(T : Type), T -> T -> state -> state -> result (state * T)
 .
 
-(** [core::mem::swap] *)
+(** [core::mem::swap]: backward function 1 *)
 Axiom core_mem_swap_back1 :
   forall(T : Type), T -> T -> state -> state -> result (state * T)
 .
 
-(** [core::num::nonzero::NonZeroU32::{14}::new] *)
+(** [core::num::nonzero::NonZeroU32::{14}::new]: forward function *)
 Axiom core_num_nonzero_non_zero_u32_new_fwd
   : u32 -> state -> result (state * (option Core_num_nonzero_non_zero_u32_t))
 .
 
-(** [core::option::Option::{0}::unwrap] *)
+(** [core::option::Option::{0}::unwrap]: forward function *)
 Axiom core_option_option_unwrap_fwd :
   forall(T : Type), option T -> state -> result (state * T)
 .
diff --git a/tests/coq/misc/Loops.v b/tests/coq/misc/Loops.v
index a5cb3688..f17eb986 100644
--- a/tests/coq/misc/Loops.v
+++ b/tests/coq/misc/Loops.v
@@ -6,7 +6,7 @@ Require Import Coq.ZArith.ZArith.
 Local Open Scope Primitives_scope.
 Module Loops.
 
-(** [loops::sum] *)
+(** [loops::sum]: loop 0: forward function *)
 Fixpoint sum_loop_fwd (n : nat) (max : u32) (i : u32) (s : u32) : result u32 :=
   match n with
   | O => Fail_ OutOfFuel
@@ -17,12 +17,12 @@ Fixpoint sum_loop_fwd (n : nat) (max : u32) (i : u32) (s : u32) : result u32 :=
   end
 .
 
-(** [loops::sum] *)
+(** [loops::sum]: forward function *)
 Definition sum_fwd (n : nat) (max : u32) : result u32 :=
   sum_loop_fwd n max 0%u32 0%u32
 .
 
-(** [loops::sum_with_mut_borrows] *)
+(** [loops::sum_with_mut_borrows]: loop 0: forward function *)
 Fixpoint sum_with_mut_borrows_loop_fwd
   (n : nat) (max : u32) (mi : u32) (ms : u32) : result u32 :=
   match n with
@@ -37,12 +37,12 @@ Fixpoint sum_with_mut_borrows_loop_fwd
   end
 .
 
-(** [loops::sum_with_mut_borrows] *)
+(** [loops::sum_with_mut_borrows]: forward function *)
 Definition sum_with_mut_borrows_fwd (n : nat) (max : u32) : result u32 :=
   sum_with_mut_borrows_loop_fwd n max 0%u32 0%u32
 .
 
-(** [loops::sum_with_shared_borrows] *)
+(** [loops::sum_with_shared_borrows]: loop 0: forward function *)
 Fixpoint sum_with_shared_borrows_loop_fwd
   (n : nat) (max : u32) (i : u32) (s : u32) : result u32 :=
   match n with
@@ -57,12 +57,13 @@ Fixpoint sum_with_shared_borrows_loop_fwd
   end
 .
 
-(** [loops::sum_with_shared_borrows] *)
+(** [loops::sum_with_shared_borrows]: forward function *)
 Definition sum_with_shared_borrows_fwd (n : nat) (max : u32) : result u32 :=
   sum_with_shared_borrows_loop_fwd n max 0%u32 0%u32
 .
 
-(** [loops::clear] *)
+(** [loops::clear]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Fixpoint clear_loop_fwd_back
   (n : nat) (v : vec u32) (i : usize) : result (vec u32) :=
   match n with
@@ -78,7 +79,8 @@ Fixpoint clear_loop_fwd_back
   end
 .
 
-(** [loops::clear] *)
+(** [loops::clear]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition clear_fwd_back (n : nat) (v : vec u32) : result (vec u32) :=
   clear_loop_fwd_back n v 0%usize
 .
@@ -92,7 +94,7 @@ Inductive List_t (T : Type) :=
 Arguments ListCons {T} _ _.
 Arguments ListNil {T}.
 
-(** [loops::list_mem] *)
+(** [loops::list_mem]: loop 0: forward function *)
 Fixpoint list_mem_loop_fwd
   (n : nat) (x : u32) (ls : List_t u32) : result bool :=
   match n with
@@ -106,12 +108,12 @@ Fixpoint list_mem_loop_fwd
   end
 .
 
-(** [loops::list_mem] *)
+(** [loops::list_mem]: forward function *)
 Definition list_mem_fwd (n : nat) (x : u32) (ls : List_t u32) : result bool :=
   list_mem_loop_fwd n x ls
 .
 
-(** [loops::list_nth_mut_loop] *)
+(** [loops::list_nth_mut_loop]: loop 0: forward function *)
 Fixpoint list_nth_mut_loop_loop_fwd
   (T : Type) (n : nat) (ls : List_t T) (i : u32) : result T :=
   match n with
@@ -127,13 +129,13 @@ Fixpoint list_nth_mut_loop_loop_fwd
   end
 .
 
-(** [loops::list_nth_mut_loop] *)
+(** [loops::list_nth_mut_loop]: forward function *)
 Definition list_nth_mut_loop_fwd
   (T : Type) (n : nat) (ls : List_t T) (i : u32) : result T :=
   list_nth_mut_loop_loop_fwd T n ls i
 .
 
-(** [loops::list_nth_mut_loop] *)
+(** [loops::list_nth_mut_loop]: loop 0: backward function 0 *)
 Fixpoint list_nth_mut_loop_loop_back
   (T : Type) (n : nat) (ls : List_t T) (i : u32) (ret : T) :
   result (List_t T)
@@ -154,7 +156,7 @@ Fixpoint list_nth_mut_loop_loop_back
   end
 .
 
-(** [loops::list_nth_mut_loop] *)
+(** [loops::list_nth_mut_loop]: backward function 0 *)
 Definition list_nth_mut_loop_back
   (T : Type) (n : nat) (ls : List_t T) (i : u32) (ret : T) :
   result (List_t T)
@@ -162,7 +164,7 @@ Definition list_nth_mut_loop_back
   list_nth_mut_loop_loop_back T n ls i ret
 .
 
-(** [loops::list_nth_shared_loop] *)
+(** [loops::list_nth_shared_loop]: loop 0: forward function *)
 Fixpoint list_nth_shared_loop_loop_fwd
   (T : Type) (n : nat) (ls : List_t T) (i : u32) : result T :=
   match n with
@@ -178,13 +180,13 @@ Fixpoint list_nth_shared_loop_loop_fwd
   end
 .
 
-(** [loops::list_nth_shared_loop] *)
+(** [loops::list_nth_shared_loop]: forward function *)
 Definition list_nth_shared_loop_fwd
   (T : Type) (n : nat) (ls : List_t T) (i : u32) : result T :=
   list_nth_shared_loop_loop_fwd T n ls i
 .
 
-(** [loops::get_elem_mut] *)
+(** [loops::get_elem_mut]: loop 0: forward function *)
 Fixpoint get_elem_mut_loop_fwd
   (n : nat) (x : usize) (ls : List_t usize) : result usize :=
   match n with
@@ -198,14 +200,14 @@ Fixpoint get_elem_mut_loop_fwd
   end
 .
 
-(** [loops::get_elem_mut] *)
+(** [loops::get_elem_mut]: forward function *)
 Definition get_elem_mut_fwd
   (n : nat) (slots : vec (List_t usize)) (x : usize) : result usize :=
   l <- vec_index_mut_fwd (List_t usize) slots 0%usize;
   get_elem_mut_loop_fwd n x l
 .
 
-(** [loops::get_elem_mut] *)
+(** [loops::get_elem_mut]: loop 0: backward function 0 *)
 Fixpoint get_elem_mut_loop_back
   (n : nat) (x : usize) (ls : List_t usize) (ret : usize) :
   result (List_t usize)
@@ -223,7 +225,7 @@ Fixpoint get_elem_mut_loop_back
   end
 .
 
-(** [loops::get_elem_mut] *)
+(** [loops::get_elem_mut]: backward function 0 *)
 Definition get_elem_mut_back
   (n : nat) (slots : vec (List_t usize)) (x : usize) (ret : usize) :
   result (vec (List_t usize))
@@ -233,7 +235,7 @@ Definition get_elem_mut_back
   vec_index_mut_back (List_t usize) slots 0%usize l0
 .
 
-(** [loops::get_elem_shared] *)
+(** [loops::get_elem_shared]: loop 0: forward function *)
 Fixpoint get_elem_shared_loop_fwd
   (n : nat) (x : usize) (ls : List_t usize) : result usize :=
   match n with
@@ -247,30 +249,30 @@ Fixpoint get_elem_shared_loop_fwd
   end
 .
 
-(** [loops::get_elem_shared] *)
+(** [loops::get_elem_shared]: forward function *)
 Definition get_elem_shared_fwd
   (n : nat) (slots : vec (List_t usize)) (x : usize) : result usize :=
   l <- vec_index_fwd (List_t usize) slots 0%usize;
   get_elem_shared_loop_fwd n x l
 .
 
-(** [loops::id_mut] *)
+(** [loops::id_mut]: forward function *)
 Definition id_mut_fwd (T : Type) (ls : List_t T) : result (List_t T) :=
   Return ls
 .
 
-(** [loops::id_mut] *)
+(** [loops::id_mut]: backward function 0 *)
 Definition id_mut_back
   (T : Type) (ls : List_t T) (ret : List_t T) : result (List_t T) :=
   Return ret
 .
 
-(** [loops::id_shared] *)
+(** [loops::id_shared]: forward function *)
 Definition id_shared_fwd (T : Type) (ls : List_t T) : result (List_t T) :=
   Return ls
 .
 
-(** [loops::list_nth_mut_loop_with_id] *)
+(** [loops::list_nth_mut_loop_with_id]: loop 0: forward function *)
 Fixpoint list_nth_mut_loop_with_id_loop_fwd
   (T : Type) (n : nat) (i : u32) (ls : List_t T) : result T :=
   match n with
@@ -287,13 +289,13 @@ Fixpoint list_nth_mut_loop_with_id_loop_fwd
   end
 .
 
-(** [loops::list_nth_mut_loop_with_id] *)
+(** [loops::list_nth_mut_loop_with_id]: forward function *)
 Definition list_nth_mut_loop_with_id_fwd
   (T : Type) (n : nat) (ls : List_t T) (i : u32) : result T :=
   ls0 <- id_mut_fwd T ls; list_nth_mut_loop_with_id_loop_fwd T n i ls0
 .
 
-(** [loops::list_nth_mut_loop_with_id] *)
+(** [loops::list_nth_mut_loop_with_id]: loop 0: backward function 0 *)
 Fixpoint list_nth_mut_loop_with_id_loop_back
   (T : Type) (n : nat) (i : u32) (ls : List_t T) (ret : T) :
   result (List_t T)
@@ -314,7 +316,7 @@ Fixpoint list_nth_mut_loop_with_id_loop_back
   end
 .
 
-(** [loops::list_nth_mut_loop_with_id] *)
+(** [loops::list_nth_mut_loop_with_id]: backward function 0 *)
 Definition list_nth_mut_loop_with_id_back
   (T : Type) (n : nat) (ls : List_t T) (i : u32) (ret : T) :
   result (List_t T)
@@ -324,7 +326,7 @@ Definition list_nth_mut_loop_with_id_back
   id_mut_back T ls l
 .
 
-(** [loops::list_nth_shared_loop_with_id] *)
+(** [loops::list_nth_shared_loop_with_id]: loop 0: forward function *)
 Fixpoint list_nth_shared_loop_with_id_loop_fwd
   (T : Type) (n : nat) (i : u32) (ls : List_t T) : result T :=
   match n with
@@ -341,13 +343,13 @@ Fixpoint list_nth_shared_loop_with_id_loop_fwd
   end
 .
 
-(** [loops::list_nth_shared_loop_with_id] *)
+(** [loops::list_nth_shared_loop_with_id]: forward function *)
 Definition list_nth_shared_loop_with_id_fwd
   (T : Type) (n : nat) (ls : List_t T) (i : u32) : result T :=
   ls0 <- id_shared_fwd T ls; list_nth_shared_loop_with_id_loop_fwd T n i ls0
 .
 
-(** [loops::list_nth_mut_loop_pair] *)
+(** [loops::list_nth_mut_loop_pair]: loop 0: forward function *)
 Fixpoint list_nth_mut_loop_pair_loop_fwd
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
   result (T * T)
@@ -371,7 +373,7 @@ Fixpoint list_nth_mut_loop_pair_loop_fwd
   end
 .
 
-(** [loops::list_nth_mut_loop_pair] *)
+(** [loops::list_nth_mut_loop_pair]: forward function *)
 Definition list_nth_mut_loop_pair_fwd
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
   result (T * T)
@@ -379,7 +381,7 @@ Definition list_nth_mut_loop_pair_fwd
   list_nth_mut_loop_pair_loop_fwd T n ls0 ls1 i
 .
 
-(** [loops::list_nth_mut_loop_pair] *)
+(** [loops::list_nth_mut_loop_pair]: loop 0: backward function 0 *)
 Fixpoint list_nth_mut_loop_pair_loop_back'a
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
   result (List_t T)
@@ -404,7 +406,7 @@ Fixpoint list_nth_mut_loop_pair_loop_back'a
   end
 .
 
-(** [loops::list_nth_mut_loop_pair] *)
+(** [loops::list_nth_mut_loop_pair]: backward function 0 *)
 Definition list_nth_mut_loop_pair_back'a
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
   result (List_t T)
@@ -412,7 +414,7 @@ Definition list_nth_mut_loop_pair_back'a
   list_nth_mut_loop_pair_loop_back'a T n ls0 ls1 i ret
 .
 
-(** [loops::list_nth_mut_loop_pair] *)
+(** [loops::list_nth_mut_loop_pair]: loop 0: backward function 1 *)
 Fixpoint list_nth_mut_loop_pair_loop_back'b
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
   result (List_t T)
@@ -437,7 +439,7 @@ Fixpoint list_nth_mut_loop_pair_loop_back'b
   end
 .
 
-(** [loops::list_nth_mut_loop_pair] *)
+(** [loops::list_nth_mut_loop_pair]: backward function 1 *)
 Definition list_nth_mut_loop_pair_back'b
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
   result (List_t T)
@@ -445,7 +447,7 @@ Definition list_nth_mut_loop_pair_back'b
   list_nth_mut_loop_pair_loop_back'b T n ls0 ls1 i ret
 .
 
-(** [loops::list_nth_shared_loop_pair] *)
+(** [loops::list_nth_shared_loop_pair]: loop 0: forward function *)
 Fixpoint list_nth_shared_loop_pair_loop_fwd
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
   result (T * T)
@@ -469,7 +471,7 @@ Fixpoint list_nth_shared_loop_pair_loop_fwd
   end
 .
 
-(** [loops::list_nth_shared_loop_pair] *)
+(** [loops::list_nth_shared_loop_pair]: forward function *)
 Definition list_nth_shared_loop_pair_fwd
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
   result (T * T)
@@ -477,7 +479,7 @@ Definition list_nth_shared_loop_pair_fwd
   list_nth_shared_loop_pair_loop_fwd T n ls0 ls1 i
 .
 
-(** [loops::list_nth_mut_loop_pair_merge] *)
+(** [loops::list_nth_mut_loop_pair_merge]: loop 0: forward function *)
 Fixpoint list_nth_mut_loop_pair_merge_loop_fwd
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
   result (T * T)
@@ -501,7 +503,7 @@ Fixpoint list_nth_mut_loop_pair_merge_loop_fwd
   end
 .
 
-(** [loops::list_nth_mut_loop_pair_merge] *)
+(** [loops::list_nth_mut_loop_pair_merge]: forward function *)
 Definition list_nth_mut_loop_pair_merge_fwd
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
   result (T * T)
@@ -509,7 +511,7 @@ Definition list_nth_mut_loop_pair_merge_fwd
   list_nth_mut_loop_pair_merge_loop_fwd T n ls0 ls1 i
 .
 
-(** [loops::list_nth_mut_loop_pair_merge] *)
+(** [loops::list_nth_mut_loop_pair_merge]: loop 0: backward function 0 *)
 Fixpoint list_nth_mut_loop_pair_merge_loop_back
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32)
   (ret : (T * T)) :
@@ -536,7 +538,7 @@ Fixpoint list_nth_mut_loop_pair_merge_loop_back
   end
 .
 
-(** [loops::list_nth_mut_loop_pair_merge] *)
+(** [loops::list_nth_mut_loop_pair_merge]: backward function 0 *)
 Definition list_nth_mut_loop_pair_merge_back
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32)
   (ret : (T * T)) :
@@ -545,7 +547,7 @@ Definition list_nth_mut_loop_pair_merge_back
   list_nth_mut_loop_pair_merge_loop_back T n ls0 ls1 i ret
 .
 
-(** [loops::list_nth_shared_loop_pair_merge] *)
+(** [loops::list_nth_shared_loop_pair_merge]: loop 0: forward function *)
 Fixpoint list_nth_shared_loop_pair_merge_loop_fwd
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
   result (T * T)
@@ -569,7 +571,7 @@ Fixpoint list_nth_shared_loop_pair_merge_loop_fwd
   end
 .
 
-(** [loops::list_nth_shared_loop_pair_merge] *)
+(** [loops::list_nth_shared_loop_pair_merge]: forward function *)
 Definition list_nth_shared_loop_pair_merge_fwd
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
   result (T * T)
@@ -577,7 +579,7 @@ Definition list_nth_shared_loop_pair_merge_fwd
   list_nth_shared_loop_pair_merge_loop_fwd T n ls0 ls1 i
 .
 
-(** [loops::list_nth_mut_shared_loop_pair] *)
+(** [loops::list_nth_mut_shared_loop_pair]: loop 0: forward function *)
 Fixpoint list_nth_mut_shared_loop_pair_loop_fwd
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
   result (T * T)
@@ -601,7 +603,7 @@ Fixpoint list_nth_mut_shared_loop_pair_loop_fwd
   end
 .
 
-(** [loops::list_nth_mut_shared_loop_pair] *)
+(** [loops::list_nth_mut_shared_loop_pair]: forward function *)
 Definition list_nth_mut_shared_loop_pair_fwd
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
   result (T * T)
@@ -609,7 +611,7 @@ Definition list_nth_mut_shared_loop_pair_fwd
   list_nth_mut_shared_loop_pair_loop_fwd T n ls0 ls1 i
 .
 
-(** [loops::list_nth_mut_shared_loop_pair] *)
+(** [loops::list_nth_mut_shared_loop_pair]: loop 0: backward function 0 *)
 Fixpoint list_nth_mut_shared_loop_pair_loop_back
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
   result (List_t T)
@@ -634,7 +636,7 @@ Fixpoint list_nth_mut_shared_loop_pair_loop_back
   end
 .
 
-(** [loops::list_nth_mut_shared_loop_pair] *)
+(** [loops::list_nth_mut_shared_loop_pair]: backward function 0 *)
 Definition list_nth_mut_shared_loop_pair_back
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
   result (List_t T)
@@ -642,7 +644,7 @@ Definition list_nth_mut_shared_loop_pair_back
   list_nth_mut_shared_loop_pair_loop_back T n ls0 ls1 i ret
 .
 
-(** [loops::list_nth_mut_shared_loop_pair_merge] *)
+(** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0: forward function *)
 Fixpoint list_nth_mut_shared_loop_pair_merge_loop_fwd
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
   result (T * T)
@@ -666,7 +668,7 @@ Fixpoint list_nth_mut_shared_loop_pair_merge_loop_fwd
   end
 .
 
-(** [loops::list_nth_mut_shared_loop_pair_merge] *)
+(** [loops::list_nth_mut_shared_loop_pair_merge]: forward function *)
 Definition list_nth_mut_shared_loop_pair_merge_fwd
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
   result (T * T)
@@ -674,7 +676,7 @@ Definition list_nth_mut_shared_loop_pair_merge_fwd
   list_nth_mut_shared_loop_pair_merge_loop_fwd T n ls0 ls1 i
 .
 
-(** [loops::list_nth_mut_shared_loop_pair_merge] *)
+(** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0: backward function 0 *)
 Fixpoint list_nth_mut_shared_loop_pair_merge_loop_back
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
   result (List_t T)
@@ -700,7 +702,7 @@ Fixpoint list_nth_mut_shared_loop_pair_merge_loop_back
   end
 .
 
-(** [loops::list_nth_mut_shared_loop_pair_merge] *)
+(** [loops::list_nth_mut_shared_loop_pair_merge]: backward function 0 *)
 Definition list_nth_mut_shared_loop_pair_merge_back
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
   result (List_t T)
@@ -708,7 +710,7 @@ Definition list_nth_mut_shared_loop_pair_merge_back
   list_nth_mut_shared_loop_pair_merge_loop_back T n ls0 ls1 i ret
 .
 
-(** [loops::list_nth_shared_mut_loop_pair] *)
+(** [loops::list_nth_shared_mut_loop_pair]: loop 0: forward function *)
 Fixpoint list_nth_shared_mut_loop_pair_loop_fwd
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
   result (T * T)
@@ -732,7 +734,7 @@ Fixpoint list_nth_shared_mut_loop_pair_loop_fwd
   end
 .
 
-(** [loops::list_nth_shared_mut_loop_pair] *)
+(** [loops::list_nth_shared_mut_loop_pair]: forward function *)
 Definition list_nth_shared_mut_loop_pair_fwd
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
   result (T * T)
@@ -740,7 +742,7 @@ Definition list_nth_shared_mut_loop_pair_fwd
   list_nth_shared_mut_loop_pair_loop_fwd T n ls0 ls1 i
 .
 
-(** [loops::list_nth_shared_mut_loop_pair] *)
+(** [loops::list_nth_shared_mut_loop_pair]: loop 0: backward function 1 *)
 Fixpoint list_nth_shared_mut_loop_pair_loop_back
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
   result (List_t T)
@@ -765,7 +767,7 @@ Fixpoint list_nth_shared_mut_loop_pair_loop_back
   end
 .
 
-(** [loops::list_nth_shared_mut_loop_pair] *)
+(** [loops::list_nth_shared_mut_loop_pair]: backward function 1 *)
 Definition list_nth_shared_mut_loop_pair_back
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
   result (List_t T)
@@ -773,7 +775,7 @@ Definition list_nth_shared_mut_loop_pair_back
   list_nth_shared_mut_loop_pair_loop_back T n ls0 ls1 i ret
 .
 
-(** [loops::list_nth_shared_mut_loop_pair_merge] *)
+(** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0: forward function *)
 Fixpoint list_nth_shared_mut_loop_pair_merge_loop_fwd
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
   result (T * T)
@@ -797,7 +799,7 @@ Fixpoint list_nth_shared_mut_loop_pair_merge_loop_fwd
   end
 .
 
-(** [loops::list_nth_shared_mut_loop_pair_merge] *)
+(** [loops::list_nth_shared_mut_loop_pair_merge]: forward function *)
 Definition list_nth_shared_mut_loop_pair_merge_fwd
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) :
   result (T * T)
@@ -805,7 +807,7 @@ Definition list_nth_shared_mut_loop_pair_merge_fwd
   list_nth_shared_mut_loop_pair_merge_loop_fwd T n ls0 ls1 i
 .
 
-(** [loops::list_nth_shared_mut_loop_pair_merge] *)
+(** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0: backward function 0 *)
 Fixpoint list_nth_shared_mut_loop_pair_merge_loop_back
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
   result (List_t T)
@@ -831,7 +833,7 @@ Fixpoint list_nth_shared_mut_loop_pair_merge_loop_back
   end
 .
 
-(** [loops::list_nth_shared_mut_loop_pair_merge] *)
+(** [loops::list_nth_shared_mut_loop_pair_merge]: backward function 0 *)
 Definition list_nth_shared_mut_loop_pair_merge_back
   (T : Type) (n : nat) (ls0 : List_t T) (ls1 : List_t T) (i : u32) (ret : T) :
   result (List_t T)
diff --git a/tests/coq/misc/NoNestedBorrows.v b/tests/coq/misc/NoNestedBorrows.v
index 96d62711..470a2cde 100644
--- a/tests/coq/misc/NoNestedBorrows.v
+++ b/tests/coq/misc/NoNestedBorrows.v
@@ -45,47 +45,47 @@ Inductive Sum_t (T1 T2 : Type) :=
 Arguments SumLeft {T1} {T2} _.
 Arguments SumRight {T1} {T2} _.
 
-(** [no_nested_borrows::neg_test] *)
+(** [no_nested_borrows::neg_test]: forward function *)
 Definition neg_test_fwd (x : i32) : result i32 :=
   i32_neg x.
 
-(** [no_nested_borrows::add_test] *)
+(** [no_nested_borrows::add_test]: forward function *)
 Definition add_test_fwd (x : u32) (y : u32) : result u32 :=
   u32_add x y.
 
-(** [no_nested_borrows::subs_test] *)
+(** [no_nested_borrows::subs_test]: forward function *)
 Definition subs_test_fwd (x : u32) (y : u32) : result u32 :=
   u32_sub x y.
 
-(** [no_nested_borrows::div_test] *)
+(** [no_nested_borrows::div_test]: forward function *)
 Definition div_test_fwd (x : u32) (y : u32) : result u32 :=
   u32_div x y.
 
-(** [no_nested_borrows::div_test1] *)
+(** [no_nested_borrows::div_test1]: forward function *)
 Definition div_test1_fwd (x : u32) : result u32 :=
   u32_div x 2%u32.
 
-(** [no_nested_borrows::rem_test] *)
+(** [no_nested_borrows::rem_test]: forward function *)
 Definition rem_test_fwd (x : u32) (y : u32) : result u32 :=
   u32_rem x y.
 
-(** [no_nested_borrows::cast_test] *)
+(** [no_nested_borrows::cast_test]: forward function *)
 Definition cast_test_fwd (x : u32) : result i32 :=
   scalar_cast U32 I32 x.
 
-(** [no_nested_borrows::test2] *)
+(** [no_nested_borrows::test2]: forward function *)
 Definition test2_fwd : result unit :=
   _ <- u32_add 23%u32 44%u32; Return tt.
 
 (** Unit test for [no_nested_borrows::test2] *)
 Check (test2_fwd )%return.
 
-(** [no_nested_borrows::get_max] *)
+(** [no_nested_borrows::get_max]: forward function *)
 Definition get_max_fwd (x : u32) (y : u32) : result u32 :=
   if x s>= y then Return x else Return y
 .
 
-(** [no_nested_borrows::test3] *)
+(** [no_nested_borrows::test3]: forward function *)
 Definition test3_fwd : result unit :=
   x <- get_max_fwd 4%u32 3%u32;
   y <- get_max_fwd 10%u32 11%u32;
@@ -96,7 +96,7 @@ Definition test3_fwd : result unit :=
 (** Unit test for [no_nested_borrows::test3] *)
 Check (test3_fwd )%return.
 
-(** [no_nested_borrows::test_neg1] *)
+(** [no_nested_borrows::test_neg1]: forward function *)
 Definition test_neg1_fwd : result unit :=
   y <- i32_neg 3%i32; if negb (y s= (-3)%i32) then Fail_ Failure else Return tt
 .
@@ -104,7 +104,7 @@ Definition test_neg1_fwd : result unit :=
 (** Unit test for [no_nested_borrows::test_neg1] *)
 Check (test_neg1_fwd )%return.
 
-(** [no_nested_borrows::refs_test1] *)
+(** [no_nested_borrows::refs_test1]: forward function *)
 Definition refs_test1_fwd : result unit :=
   if negb (1%i32 s= 1%i32) then Fail_ Failure else Return tt
 .
@@ -112,7 +112,7 @@ Definition refs_test1_fwd : result unit :=
 (** Unit test for [no_nested_borrows::refs_test1] *)
 Check (refs_test1_fwd )%return.
 
-(** [no_nested_borrows::refs_test2] *)
+(** [no_nested_borrows::refs_test2]: forward function *)
 Definition refs_test2_fwd : result unit :=
   if negb (2%i32 s= 2%i32)
   then Fail_ Failure
@@ -128,14 +128,14 @@ Definition refs_test2_fwd : result unit :=
 (** Unit test for [no_nested_borrows::refs_test2] *)
 Check (refs_test2_fwd )%return.
 
-(** [no_nested_borrows::test_list1] *)
+(** [no_nested_borrows::test_list1]: forward function *)
 Definition test_list1_fwd : result unit :=
   Return tt.
 
 (** Unit test for [no_nested_borrows::test_list1] *)
 Check (test_list1_fwd )%return.
 
-(** [no_nested_borrows::test_box1] *)
+(** [no_nested_borrows::test_box1]: forward function *)
 Definition test_box1_fwd : result unit :=
   let b := 1%i32 in
   let x := b in
@@ -145,21 +145,21 @@ Definition test_box1_fwd : result unit :=
 (** Unit test for [no_nested_borrows::test_box1] *)
 Check (test_box1_fwd )%return.
 
-(** [no_nested_borrows::copy_int] *)
+(** [no_nested_borrows::copy_int]: forward function *)
 Definition copy_int_fwd (x : i32) : result i32 :=
   Return x.
 
-(** [no_nested_borrows::test_unreachable] *)
+(** [no_nested_borrows::test_unreachable]: forward function *)
 Definition test_unreachable_fwd (b : bool) : result unit :=
   if b then Fail_ Failure else Return tt
 .
 
-(** [no_nested_borrows::test_panic] *)
+(** [no_nested_borrows::test_panic]: forward function *)
 Definition test_panic_fwd (b : bool) : result unit :=
   if b then Fail_ Failure else Return tt
 .
 
-(** [no_nested_borrows::test_copy_int] *)
+(** [no_nested_borrows::test_copy_int]: forward function *)
 Definition test_copy_int_fwd : result unit :=
   y <- copy_int_fwd 0%i32;
   if negb (0%i32 s= y) then Fail_ Failure else Return tt
@@ -168,12 +168,12 @@ Definition test_copy_int_fwd : result unit :=
 (** Unit test for [no_nested_borrows::test_copy_int] *)
 Check (test_copy_int_fwd )%return.
 
-(** [no_nested_borrows::is_cons] *)
+(** [no_nested_borrows::is_cons]: forward function *)
 Definition is_cons_fwd (T : Type) (l : List_t T) : result bool :=
   match l with | ListCons t l0 => Return true | ListNil => Return false end
 .
 
-(** [no_nested_borrows::test_is_cons] *)
+(** [no_nested_borrows::test_is_cons]: forward function *)
 Definition test_is_cons_fwd : result unit :=
   let l := ListNil in
   b <- is_cons_fwd i32 (ListCons 0%i32 l);
@@ -183,7 +183,7 @@ Definition test_is_cons_fwd : result unit :=
 (** Unit test for [no_nested_borrows::test_is_cons] *)
 Check (test_is_cons_fwd )%return.
 
-(** [no_nested_borrows::split_list] *)
+(** [no_nested_borrows::split_list]: forward function *)
 Definition split_list_fwd
   (T : Type) (l : List_t T) : result (T * (List_t T)) :=
   match l with
@@ -192,7 +192,7 @@ Definition split_list_fwd
   end
 .
 
-(** [no_nested_borrows::test_split_list] *)
+(** [no_nested_borrows::test_split_list]: forward function *)
 Definition test_split_list_fwd : result unit :=
   let l := ListNil in
   p <- split_list_fwd i32 (ListCons 0%i32 l);
@@ -203,18 +203,18 @@ Definition test_split_list_fwd : result unit :=
 (** Unit test for [no_nested_borrows::test_split_list] *)
 Check (test_split_list_fwd )%return.
 
-(** [no_nested_borrows::choose] *)
+(** [no_nested_borrows::choose]: forward function *)
 Definition choose_fwd (T : Type) (b : bool) (x : T) (y : T) : result T :=
   if b then Return x else Return y
 .
 
-(** [no_nested_borrows::choose] *)
+(** [no_nested_borrows::choose]: backward function 0 *)
 Definition choose_back
   (T : Type) (b : bool) (x : T) (y : T) (ret : T) : result (T * T) :=
   if b then Return (ret, y) else Return (x, ret)
 .
 
-(** [no_nested_borrows::choose_test] *)
+(** [no_nested_borrows::choose_test]: forward function *)
 Definition choose_test_fwd : result unit :=
   z <- choose_fwd i32 true 0%i32 0%i32;
   z0 <- i32_add z 1%i32;
@@ -231,7 +231,7 @@ Definition choose_test_fwd : result unit :=
 (** Unit test for [no_nested_borrows::choose_test] *)
 Check (choose_test_fwd )%return.
 
-(** [no_nested_borrows::test_char] *)
+(** [no_nested_borrows::test_char]: forward function *)
 Definition test_char_fwd : result char :=
   Return (char_of_byte Coq.Init.Byte.x61)
 .
@@ -253,7 +253,7 @@ Arguments NodeElemNil {T}.
 Arguments TreeLeaf {T} _.
 Arguments TreeNode {T} _ _ _.
 
-(** [no_nested_borrows::list_length] *)
+(** [no_nested_borrows::list_length]: forward function *)
 Fixpoint list_length_fwd (T : Type) (l : List_t T) : result u32 :=
   match l with
   | ListCons t l1 => i <- list_length_fwd T l1; u32_add 1%u32 i
@@ -261,7 +261,7 @@ Fixpoint list_length_fwd (T : Type) (l : List_t T) : result u32 :=
   end
 .
 
-(** [no_nested_borrows::list_nth_shared] *)
+(** [no_nested_borrows::list_nth_shared]: forward function *)
 Fixpoint list_nth_shared_fwd (T : Type) (l : List_t T) (i : u32) : result T :=
   match l with
   | ListCons x tl =>
@@ -272,7 +272,7 @@ Fixpoint list_nth_shared_fwd (T : Type) (l : List_t T) (i : u32) : result T :=
   end
 .
 
-(** [no_nested_borrows::list_nth_mut] *)
+(** [no_nested_borrows::list_nth_mut]: forward function *)
 Fixpoint list_nth_mut_fwd (T : Type) (l : List_t T) (i : u32) : result T :=
   match l with
   | ListCons x tl =>
@@ -283,7 +283,7 @@ Fixpoint list_nth_mut_fwd (T : Type) (l : List_t T) (i : u32) : result T :=
   end
 .
 
-(** [no_nested_borrows::list_nth_mut] *)
+(** [no_nested_borrows::list_nth_mut]: backward function 0 *)
 Fixpoint list_nth_mut_back
   (T : Type) (l : List_t T) (i : u32) (ret : T) : result (List_t T) :=
   match l with
@@ -298,7 +298,7 @@ Fixpoint list_nth_mut_back
   end
 .
 
-(** [no_nested_borrows::list_rev_aux] *)
+(** [no_nested_borrows::list_rev_aux]: forward function *)
 Fixpoint list_rev_aux_fwd
   (T : Type) (li : List_t T) (lo : List_t T) : result (List_t T) :=
   match li with
@@ -307,13 +307,14 @@ Fixpoint list_rev_aux_fwd
   end
 .
 
-(** [no_nested_borrows::list_rev] *)
+(** [no_nested_borrows::list_rev]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition list_rev_fwd_back (T : Type) (l : List_t T) : result (List_t T) :=
   let li := mem_replace_fwd (List_t T) l ListNil in
   list_rev_aux_fwd T li ListNil
 .
 
-(** [no_nested_borrows::test_list_functions] *)
+(** [no_nested_borrows::test_list_functions]: forward function *)
 Definition test_list_functions_fwd : result unit :=
   let l := ListNil in
   let l0 := ListCons 2%i32 l in
@@ -350,61 +351,61 @@ Definition test_list_functions_fwd : result unit :=
 (** Unit test for [no_nested_borrows::test_list_functions] *)
 Check (test_list_functions_fwd )%return.
 
-(** [no_nested_borrows::id_mut_pair1] *)
+(** [no_nested_borrows::id_mut_pair1]: forward function *)
 Definition id_mut_pair1_fwd
   (T1 T2 : Type) (x : T1) (y : T2) : result (T1 * T2) :=
   Return (x, y)
 .
 
-(** [no_nested_borrows::id_mut_pair1] *)
+(** [no_nested_borrows::id_mut_pair1]: backward function 0 *)
 Definition id_mut_pair1_back
   (T1 T2 : Type) (x : T1) (y : T2) (ret : (T1 * T2)) : result (T1 * T2) :=
   let (t, t0) := ret in Return (t, t0)
 .
 
-(** [no_nested_borrows::id_mut_pair2] *)
+(** [no_nested_borrows::id_mut_pair2]: forward function *)
 Definition id_mut_pair2_fwd
   (T1 T2 : Type) (p : (T1 * T2)) : result (T1 * T2) :=
   let (t, t0) := p in Return (t, t0)
 .
 
-(** [no_nested_borrows::id_mut_pair2] *)
+(** [no_nested_borrows::id_mut_pair2]: backward function 0 *)
 Definition id_mut_pair2_back
   (T1 T2 : Type) (p : (T1 * T2)) (ret : (T1 * T2)) : result (T1 * T2) :=
   let (t, t0) := ret in Return (t, t0)
 .
 
-(** [no_nested_borrows::id_mut_pair3] *)
+(** [no_nested_borrows::id_mut_pair3]: forward function *)
 Definition id_mut_pair3_fwd
   (T1 T2 : Type) (x : T1) (y : T2) : result (T1 * T2) :=
   Return (x, y)
 .
 
-(** [no_nested_borrows::id_mut_pair3] *)
+(** [no_nested_borrows::id_mut_pair3]: backward function 0 *)
 Definition id_mut_pair3_back'a
   (T1 T2 : Type) (x : T1) (y : T2) (ret : T1) : result T1 :=
   Return ret
 .
 
-(** [no_nested_borrows::id_mut_pair3] *)
+(** [no_nested_borrows::id_mut_pair3]: backward function 1 *)
 Definition id_mut_pair3_back'b
   (T1 T2 : Type) (x : T1) (y : T2) (ret : T2) : result T2 :=
   Return ret
 .
 
-(** [no_nested_borrows::id_mut_pair4] *)
+(** [no_nested_borrows::id_mut_pair4]: forward function *)
 Definition id_mut_pair4_fwd
   (T1 T2 : Type) (p : (T1 * T2)) : result (T1 * T2) :=
   let (t, t0) := p in Return (t, t0)
 .
 
-(** [no_nested_borrows::id_mut_pair4] *)
+(** [no_nested_borrows::id_mut_pair4]: backward function 0 *)
 Definition id_mut_pair4_back'a
   (T1 T2 : Type) (p : (T1 * T2)) (ret : T1) : result T1 :=
   Return ret
 .
 
-(** [no_nested_borrows::id_mut_pair4] *)
+(** [no_nested_borrows::id_mut_pair4]: backward function 1 *)
 Definition id_mut_pair4_back'b
   (T1 T2 : Type) (p : (T1 * T2)) (ret : T2) : result T2 :=
   Return ret
@@ -420,17 +421,17 @@ mkStruct_with_tuple_t {
 Arguments mkStruct_with_tuple_t {T1} {T2} _.
 Arguments Struct_with_tuple_p {T1} {T2}.
 
-(** [no_nested_borrows::new_tuple1] *)
+(** [no_nested_borrows::new_tuple1]: forward function *)
 Definition new_tuple1_fwd : result (Struct_with_tuple_t u32 u32) :=
   Return {| Struct_with_tuple_p := (1%u32, 2%u32) |}
 .
 
-(** [no_nested_borrows::new_tuple2] *)
+(** [no_nested_borrows::new_tuple2]: forward function *)
 Definition new_tuple2_fwd : result (Struct_with_tuple_t i16 i16) :=
   Return {| Struct_with_tuple_p := (1%i16, 2%i16) |}
 .
 
-(** [no_nested_borrows::new_tuple3] *)
+(** [no_nested_borrows::new_tuple3]: forward function *)
 Definition new_tuple3_fwd : result (Struct_with_tuple_t u64 i64) :=
   Return {| Struct_with_tuple_p := (1%u64, 2%i64) |}
 .
@@ -445,12 +446,12 @@ mkStruct_with_pair_t {
 Arguments mkStruct_with_pair_t {T1} {T2} _.
 Arguments Struct_with_pair_p {T1} {T2}.
 
-(** [no_nested_borrows::new_pair1] *)
+(** [no_nested_borrows::new_pair1]: forward function *)
 Definition new_pair1_fwd : result (Struct_with_pair_t u32 u32) :=
   Return {| Struct_with_pair_p := {| Pair_x := 1%u32; Pair_y := 2%u32 |} |}
 .
 
-(** [no_nested_borrows::test_constants] *)
+(** [no_nested_borrows::test_constants]: forward function *)
 Definition test_constants_fwd : result unit :=
   swt <- new_tuple1_fwd;
   let (i, _) := swt.(Struct_with_tuple_p) in
@@ -476,34 +477,35 @@ Definition test_constants_fwd : result unit :=
 (** Unit test for [no_nested_borrows::test_constants] *)
 Check (test_constants_fwd )%return.
 
-(** [no_nested_borrows::test_weird_borrows1] *)
+(** [no_nested_borrows::test_weird_borrows1]: forward function *)
 Definition test_weird_borrows1_fwd : result unit :=
   Return tt.
 
 (** Unit test for [no_nested_borrows::test_weird_borrows1] *)
 Check (test_weird_borrows1_fwd )%return.
 
-(** [no_nested_borrows::test_mem_replace] *)
+(** [no_nested_borrows::test_mem_replace]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition test_mem_replace_fwd_back (px : u32) : result u32 :=
   let y := mem_replace_fwd u32 px 1%u32 in
   if negb (y s= 0%u32) then Fail_ Failure else Return 2%u32
 .
 
-(** [no_nested_borrows::test_shared_borrow_bool1] *)
+(** [no_nested_borrows::test_shared_borrow_bool1]: forward function *)
 Definition test_shared_borrow_bool1_fwd (b : bool) : result u32 :=
   if b then Return 0%u32 else Return 1%u32
 .
 
-(** [no_nested_borrows::test_shared_borrow_bool2] *)
+(** [no_nested_borrows::test_shared_borrow_bool2]: forward function *)
 Definition test_shared_borrow_bool2_fwd : result u32 :=
   Return 0%u32.
 
-(** [no_nested_borrows::test_shared_borrow_enum1] *)
+(** [no_nested_borrows::test_shared_borrow_enum1]: forward function *)
 Definition test_shared_borrow_enum1_fwd (l : List_t u32) : result u32 :=
   match l with | ListCons i l0 => Return 1%u32 | ListNil => Return 0%u32 end
 .
 
-(** [no_nested_borrows::test_shared_borrow_enum2] *)
+(** [no_nested_borrows::test_shared_borrow_enum2]: forward function *)
 Definition test_shared_borrow_enum2_fwd : result u32 :=
   Return 0%u32.
 
diff --git a/tests/coq/misc/Paper.v b/tests/coq/misc/Paper.v
index 513bc749..0f854f31 100644
--- a/tests/coq/misc/Paper.v
+++ b/tests/coq/misc/Paper.v
@@ -6,11 +6,12 @@ Require Import Coq.ZArith.ZArith.
 Local Open Scope Primitives_scope.
 Module Paper.
 
-(** [paper::ref_incr] *)
+(** [paper::ref_incr]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 Definition ref_incr_fwd_back (x : i32) : result i32 :=
   i32_add x 1%i32.
 
-(** [paper::test_incr] *)
+(** [paper::test_incr]: forward function *)
 Definition test_incr_fwd : result unit :=
   x <- ref_incr_fwd_back 0%i32;
   if negb (x s= 1%i32) then Fail_ Failure else Return tt
@@ -19,18 +20,18 @@ Definition test_incr_fwd : result unit :=
 (** Unit test for [paper::test_incr] *)
 Check (test_incr_fwd )%return.
 
-(** [paper::choose] *)
+(** [paper::choose]: forward function *)
 Definition choose_fwd (T : Type) (b : bool) (x : T) (y : T) : result T :=
   if b then Return x else Return y
 .
 
-(** [paper::choose] *)
+(** [paper::choose]: backward function 0 *)
 Definition choose_back
   (T : Type) (b : bool) (x : T) (y : T) (ret : T) : result (T * T) :=
   if b then Return (ret, y) else Return (x, ret)
 .
 
-(** [paper::test_choose] *)
+(** [paper::test_choose]: forward function *)
 Definition test_choose_fwd : result unit :=
   z <- choose_fwd i32 true 0%i32 0%i32;
   z0 <- i32_add z 1%i32;
@@ -56,7 +57,7 @@ Inductive List_t (T : Type) :=
 Arguments ListCons {T} _ _.
 Arguments ListNil {T}.
 
-(** [paper::list_nth_mut] *)
+(** [paper::list_nth_mut]: forward function *)
 Fixpoint list_nth_mut_fwd (T : Type) (l : List_t T) (i : u32) : result T :=
   match l with
   | ListCons x tl =>
@@ -67,7 +68,7 @@ Fixpoint list_nth_mut_fwd (T : Type) (l : List_t T) (i : u32) : result T :=
   end
 .
 
-(** [paper::list_nth_mut] *)
+(** [paper::list_nth_mut]: backward function 0 *)
 Fixpoint list_nth_mut_back
   (T : Type) (l : List_t T) (i : u32) (ret : T) : result (List_t T) :=
   match l with
@@ -82,7 +83,7 @@ Fixpoint list_nth_mut_back
   end
 .
 
-(** [paper::sum] *)
+(** [paper::sum]: forward function *)
 Fixpoint sum_fwd (l : List_t i32) : result i32 :=
   match l with
   | ListCons x tl => i <- sum_fwd tl; i32_add x i
@@ -90,7 +91,7 @@ Fixpoint sum_fwd (l : List_t i32) : result i32 :=
   end
 .
 
-(** [paper::test_nth] *)
+(** [paper::test_nth]: forward function *)
 Definition test_nth_fwd : result unit :=
   let l := ListNil in
   let l0 := ListCons 3%i32 l in
@@ -105,7 +106,7 @@ Definition test_nth_fwd : result unit :=
 (** Unit test for [paper::test_nth] *)
 Check (test_nth_fwd )%return.
 
-(** [paper::call_choose] *)
+(** [paper::call_choose]: forward function *)
 Definition call_choose_fwd (p : (u32 * u32)) : result u32 :=
   let (px, py) := p in
   pz <- choose_fwd u32 true px py;
diff --git a/tests/coq/misc/PoloniusList.v b/tests/coq/misc/PoloniusList.v
index bd6df02e..e94b6dcb 100644
--- a/tests/coq/misc/PoloniusList.v
+++ b/tests/coq/misc/PoloniusList.v
@@ -15,7 +15,7 @@ Inductive List_t (T : Type) :=
 Arguments ListCons {T} _ _.
 Arguments ListNil {T}.
 
-(** [polonius_list::get_list_at_x] *)
+(** [polonius_list::get_list_at_x]: forward function *)
 Fixpoint get_list_at_x_fwd (ls : List_t u32) (x : u32) : result (List_t u32) :=
   match ls with
   | ListCons hd tl =>
@@ -24,7 +24,7 @@ Fixpoint get_list_at_x_fwd (ls : List_t u32) (x : u32) : result (List_t u32) :=
   end
 .
 
-(** [polonius_list::get_list_at_x] *)
+(** [polonius_list::get_list_at_x]: backward function 0 *)
 Fixpoint get_list_at_x_back
   (ls : List_t u32) (x : u32) (ret : List_t u32) : result (List_t u32) :=
   match ls with
diff --git a/tests/coq/misc/_CoqProject b/tests/coq/misc/_CoqProject
index 87dea3e6..db6c2742 100644
--- a/tests/coq/misc/_CoqProject
+++ b/tests/coq/misc/_CoqProject
@@ -3,12 +3,12 @@
 -arg -w
 -arg all
 
-Constants.v
-External_Types.v
-Primitives.v
 Loops.v
+Primitives.v
 External_Funs.v
+Constants.v
 PoloniusList.v
+External_Types.v
 NoNestedBorrows.v
 External_Opaque.v
 Paper.v
diff --git a/tests/fstar/betree/BetreeMain.Funs.fst b/tests/fstar/betree/BetreeMain.Funs.fst
index 0c868f47..f1bc1191 100644
--- a/tests/fstar/betree/BetreeMain.Funs.fst
+++ b/tests/fstar/betree/BetreeMain.Funs.fst
@@ -8,14 +8,14 @@ include BetreeMain.Clauses
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [betree_main::betree::load_internal_node] *)
+(** [betree_main::betree::load_internal_node]: forward function *)
 let betree_load_internal_node_fwd
   (id : u64) (st : state) :
   result (state & (betree_list_t (u64 & betree_message_t)))
   =
   betree_utils_load_internal_node_fwd id st
 
-(** [betree_main::betree::store_internal_node] *)
+(** [betree_main::betree::store_internal_node]: forward function *)
 let betree_store_internal_node_fwd
   (id : u64) (content : betree_list_t (u64 & betree_message_t)) (st : state) :
   result (state & unit)
@@ -23,12 +23,12 @@ let betree_store_internal_node_fwd
   let* (st0, _) = betree_utils_store_internal_node_fwd id content st in
   Return (st0, ())
 
-(** [betree_main::betree::load_leaf_node] *)
+(** [betree_main::betree::load_leaf_node]: forward function *)
 let betree_load_leaf_node_fwd
   (id : u64) (st : state) : result (state & (betree_list_t (u64 & u64))) =
   betree_utils_load_leaf_node_fwd id st
 
-(** [betree_main::betree::store_leaf_node] *)
+(** [betree_main::betree::store_leaf_node]: forward function *)
 let betree_store_leaf_node_fwd
   (id : u64) (content : betree_list_t (u64 & u64)) (st : state) :
   result (state & unit)
@@ -36,25 +36,25 @@ let betree_store_leaf_node_fwd
   let* (st0, _) = betree_utils_store_leaf_node_fwd id content st in
   Return (st0, ())
 
-(** [betree_main::betree::fresh_node_id] *)
+(** [betree_main::betree::fresh_node_id]: forward function *)
 let betree_fresh_node_id_fwd (counter : u64) : result u64 =
   let* _ = u64_add counter 1 in Return counter
 
-(** [betree_main::betree::fresh_node_id] *)
+(** [betree_main::betree::fresh_node_id]: backward function 0 *)
 let betree_fresh_node_id_back (counter : u64) : result u64 =
   u64_add counter 1
 
-(** [betree_main::betree::NodeIdCounter::{0}::new] *)
+(** [betree_main::betree::NodeIdCounter::{0}::new]: forward function *)
 let betree_node_id_counter_new_fwd : result betree_node_id_counter_t =
   Return { betree_node_id_counter_next_node_id = 0 }
 
-(** [betree_main::betree::NodeIdCounter::{0}::fresh_id] *)
+(** [betree_main::betree::NodeIdCounter::{0}::fresh_id]: forward function *)
 let betree_node_id_counter_fresh_id_fwd
   (self : betree_node_id_counter_t) : result u64 =
   let* _ = u64_add self.betree_node_id_counter_next_node_id 1 in
   Return self.betree_node_id_counter_next_node_id
 
-(** [betree_main::betree::NodeIdCounter::{0}::fresh_id] *)
+(** [betree_main::betree::NodeIdCounter::{0}::fresh_id]: backward function 0 *)
 let betree_node_id_counter_fresh_id_back
   (self : betree_node_id_counter_t) : result betree_node_id_counter_t =
   let* i = u64_add self.betree_node_id_counter_next_node_id 1 in
@@ -64,7 +64,7 @@ let betree_node_id_counter_fresh_id_back
 let core_num_u64_max_body : result u64 = Return 18446744073709551615
 let core_num_u64_max_c : u64 = eval_global core_num_u64_max_body
 
-(** [betree_main::betree::upsert_update] *)
+(** [betree_main::betree::upsert_update]: forward function *)
 let betree_upsert_update_fwd
   (prev : option u64) (st : betree_upsert_fun_state_t) : result u64 =
   begin match prev with
@@ -83,7 +83,7 @@ let betree_upsert_update_fwd
     end
   end
 
-(** [betree_main::betree::List::{1}::len] *)
+(** [betree_main::betree::List::{1}::len]: forward function *)
 let rec betree_list_len_fwd
   (t : Type0) (self : betree_list_t t) :
   Tot (result u64) (decreases (betree_list_len_decreases t self))
@@ -93,7 +93,7 @@ let rec betree_list_len_fwd
   | BetreeListNil -> Return 0
   end
 
-(** [betree_main::betree::List::{1}::split_at] *)
+(** [betree_main::betree::List::{1}::split_at]: forward function *)
 let rec betree_list_split_at_fwd
   (t : Type0) (self : betree_list_t t) (n : u64) :
   Tot (result ((betree_list_t t) & (betree_list_t t)))
@@ -112,14 +112,15 @@ let rec betree_list_split_at_fwd
     | BetreeListNil -> Fail Failure
     end
 
-(** [betree_main::betree::List::{1}::push_front] *)
+(** [betree_main::betree::List::{1}::push_front]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let betree_list_push_front_fwd_back
   (t : Type0) (self : betree_list_t t) (x : t) : result (betree_list_t t) =
   let tl = mem_replace_fwd (betree_list_t t) self BetreeListNil in
   let l = tl in
   Return (BetreeListCons x l)
 
-(** [betree_main::betree::List::{1}::pop_front] *)
+(** [betree_main::betree::List::{1}::pop_front]: forward function *)
 let betree_list_pop_front_fwd (t : Type0) (self : betree_list_t t) : result t =
   let ls = mem_replace_fwd (betree_list_t t) self BetreeListNil in
   begin match ls with
@@ -127,7 +128,7 @@ let betree_list_pop_front_fwd (t : Type0) (self : betree_list_t t) : result t =
   | BetreeListNil -> Fail Failure
   end
 
-(** [betree_main::betree::List::{1}::pop_front] *)
+(** [betree_main::betree::List::{1}::pop_front]: backward function 0 *)
 let betree_list_pop_front_back
   (t : Type0) (self : betree_list_t t) : result (betree_list_t t) =
   let ls = mem_replace_fwd (betree_list_t t) self BetreeListNil in
@@ -136,14 +137,14 @@ let betree_list_pop_front_back
   | BetreeListNil -> Fail Failure
   end
 
-(** [betree_main::betree::List::{1}::hd] *)
+(** [betree_main::betree::List::{1}::hd]: forward function *)
 let betree_list_hd_fwd (t : Type0) (self : betree_list_t t) : result t =
   begin match self with
   | BetreeListCons hd l -> Return hd
   | BetreeListNil -> Fail Failure
   end
 
-(** [betree_main::betree::List::{2}::head_has_key] *)
+(** [betree_main::betree::List::{2}::head_has_key]: forward function *)
 let betree_list_head_has_key_fwd
   (t : Type0) (self : betree_list_t (u64 & t)) (key : u64) : result bool =
   begin match self with
@@ -151,7 +152,7 @@ let betree_list_head_has_key_fwd
   | BetreeListNil -> Return false
   end
 
-(** [betree_main::betree::List::{2}::partition_at_pivot] *)
+(** [betree_main::betree::List::{2}::partition_at_pivot]: forward function *)
 let rec betree_list_partition_at_pivot_fwd
   (t : Type0) (self : betree_list_t (u64 & t)) (pivot : u64) :
   Tot (result ((betree_list_t (u64 & t)) & (betree_list_t (u64 & t))))
@@ -170,7 +171,7 @@ let rec betree_list_partition_at_pivot_fwd
   | BetreeListNil -> Return (BetreeListNil, BetreeListNil)
   end
 
-(** [betree_main::betree::Leaf::{3}::split] *)
+(** [betree_main::betree::Leaf::{3}::split]: forward function *)
 let betree_leaf_split_fwd
   (self : betree_leaf_t) (content : betree_list_t (u64 & u64))
   (params : betree_params_t) (node_id_cnt : betree_node_id_counter_t)
@@ -202,7 +203,7 @@ let betree_leaf_split_fwd
       betree_internal_right = n0
     })
 
-(** [betree_main::betree::Leaf::{3}::split] *)
+(** [betree_main::betree::Leaf::{3}::split]: backward function 2 *)
 let betree_leaf_split_back
   (self : betree_leaf_t) (content : betree_list_t (u64 & u64))
   (params : betree_params_t) (node_id_cnt : betree_node_id_counter_t)
@@ -221,7 +222,7 @@ let betree_leaf_split_back
   let* _ = betree_store_leaf_node_fwd id1 content1 st0 in
   betree_node_id_counter_fresh_id_back node_id_cnt0
 
-(** [betree_main::betree::Node::{5}::lookup_in_bindings] *)
+(** [betree_main::betree::Node::{5}::lookup_in_bindings]: forward function *)
 let rec betree_node_lookup_in_bindings_fwd
   (key : u64) (bindings : betree_list_t (u64 & u64)) :
   Tot (result (option u64))
@@ -239,7 +240,7 @@ let rec betree_node_lookup_in_bindings_fwd
   | BetreeListNil -> Return None
   end
 
-(** [betree_main::betree::Node::{5}::lookup_first_message_for_key] *)
+(** [betree_main::betree::Node::{5}::lookup_first_message_for_key]: forward function *)
 let rec betree_node_lookup_first_message_for_key_fwd
   (key : u64) (msgs : betree_list_t (u64 & betree_message_t)) :
   Tot (result (betree_list_t (u64 & betree_message_t)))
@@ -254,7 +255,7 @@ let rec betree_node_lookup_first_message_for_key_fwd
   | BetreeListNil -> Return BetreeListNil
   end
 
-(** [betree_main::betree::Node::{5}::lookup_first_message_for_key] *)
+(** [betree_main::betree::Node::{5}::lookup_first_message_for_key]: backward function 0 *)
 let rec betree_node_lookup_first_message_for_key_back
   (key : u64) (msgs : betree_list_t (u64 & betree_message_t))
   (ret : betree_list_t (u64 & betree_message_t)) :
@@ -273,7 +274,7 @@ let rec betree_node_lookup_first_message_for_key_back
   | BetreeListNil -> Return ret
   end
 
-(** [betree_main::betree::Node::{5}::apply_upserts] *)
+(** [betree_main::betree::Node::{5}::apply_upserts]: forward function *)
 let rec betree_node_apply_upserts_fwd
   (msgs : betree_list_t (u64 & betree_message_t)) (prev : option u64)
   (key : u64) (st : state) :
@@ -300,7 +301,7 @@ let rec betree_node_apply_upserts_fwd
         BetreeMessageInsert v) in
     Return (st0, v)
 
-(** [betree_main::betree::Node::{5}::apply_upserts] *)
+(** [betree_main::betree::Node::{5}::apply_upserts]: backward function 0 *)
 let rec betree_node_apply_upserts_back
   (msgs : betree_list_t (u64 & betree_message_t)) (prev : option u64)
   (key : u64) (st : state) :
@@ -325,7 +326,7 @@ let rec betree_node_apply_upserts_back
     betree_list_push_front_fwd_back (u64 & betree_message_t) msgs (key,
       BetreeMessageInsert v)
 
-(** [betree_main::betree::Node::{5}::lookup] *)
+(** [betree_main::betree::Node::{5}::lookup]: forward function *)
 let rec betree_node_lookup_fwd
   (self : betree_node_t) (key : u64) (st : state) :
   Tot (result (state & (option u64)))
@@ -388,7 +389,7 @@ let rec betree_node_lookup_fwd
     Return (st0, opt)
   end
 
-(** [betree_main::betree::Node::{5}::lookup] *)
+(** [betree_main::betree::Node::{5}::lookup]: backward function 0 *)
 and betree_node_lookup_back
   (self : betree_node_t) (key : u64) (st : state) :
   Tot (result betree_node_t)
@@ -450,7 +451,7 @@ and betree_node_lookup_back
     Return (BetreeNodeLeaf node)
   end
 
-(** [betree_main::betree::Internal::{4}::lookup_in_children] *)
+(** [betree_main::betree::Internal::{4}::lookup_in_children]: forward function *)
 and betree_internal_lookup_in_children_fwd
   (self : betree_internal_t) (key : u64) (st : state) :
   Tot (result (state & (option u64)))
@@ -460,7 +461,7 @@ and betree_internal_lookup_in_children_fwd
   then betree_node_lookup_fwd self.betree_internal_left key st
   else betree_node_lookup_fwd self.betree_internal_right key st
 
-(** [betree_main::betree::Internal::{4}::lookup_in_children] *)
+(** [betree_main::betree::Internal::{4}::lookup_in_children]: backward function 0 *)
 and betree_internal_lookup_in_children_back
   (self : betree_internal_t) (key : u64) (st : state) :
   Tot (result betree_internal_t)
@@ -474,7 +475,7 @@ and betree_internal_lookup_in_children_back
     let* n = betree_node_lookup_back self.betree_internal_right key st in
     Return { self with betree_internal_right = n }
 
-(** [betree_main::betree::Node::{5}::lookup_mut_in_bindings] *)
+(** [betree_main::betree::Node::{5}::lookup_mut_in_bindings]: forward function *)
 let rec betree_node_lookup_mut_in_bindings_fwd
   (key : u64) (bindings : betree_list_t (u64 & u64)) :
   Tot (result (betree_list_t (u64 & u64)))
@@ -489,7 +490,7 @@ let rec betree_node_lookup_mut_in_bindings_fwd
   | BetreeListNil -> Return BetreeListNil
   end
 
-(** [betree_main::betree::Node::{5}::lookup_mut_in_bindings] *)
+(** [betree_main::betree::Node::{5}::lookup_mut_in_bindings]: backward function 0 *)
 let rec betree_node_lookup_mut_in_bindings_back
   (key : u64) (bindings : betree_list_t (u64 & u64))
   (ret : betree_list_t (u64 & u64)) :
@@ -507,7 +508,8 @@ let rec betree_node_lookup_mut_in_bindings_back
   | BetreeListNil -> Return ret
   end
 
-(** [betree_main::betree::Node::{5}::apply_to_leaf] *)
+(** [betree_main::betree::Node::{5}::apply_to_leaf]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let betree_node_apply_to_leaf_fwd_back
   (bindings : betree_list_t (u64 & u64)) (key : u64)
   (new_msg : betree_message_t) :
@@ -550,7 +552,8 @@ let betree_node_apply_to_leaf_fwd_back
       betree_node_lookup_mut_in_bindings_back key bindings bindings1
     end
 
-(** [betree_main::betree::Node::{5}::apply_messages_to_leaf] *)
+(** [betree_main::betree::Node::{5}::apply_messages_to_leaf]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let rec betree_node_apply_messages_to_leaf_fwd_back
   (bindings : betree_list_t (u64 & u64))
   (new_msgs : betree_list_t (u64 & betree_message_t)) :
@@ -565,7 +568,8 @@ let rec betree_node_apply_messages_to_leaf_fwd_back
   | BetreeListNil -> Return bindings
   end
 
-(** [betree_main::betree::Node::{5}::filter_messages_for_key] *)
+(** [betree_main::betree::Node::{5}::filter_messages_for_key]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let rec betree_node_filter_messages_for_key_fwd_back
   (key : u64) (msgs : betree_list_t (u64 & betree_message_t)) :
   Tot (result (betree_list_t (u64 & betree_message_t)))
@@ -584,7 +588,7 @@ let rec betree_node_filter_messages_for_key_fwd_back
   | BetreeListNil -> Return BetreeListNil
   end
 
-(** [betree_main::betree::Node::{5}::lookup_first_message_after_key] *)
+(** [betree_main::betree::Node::{5}::lookup_first_message_after_key]: forward function *)
 let rec betree_node_lookup_first_message_after_key_fwd
   (key : u64) (msgs : betree_list_t (u64 & betree_message_t)) :
   Tot (result (betree_list_t (u64 & betree_message_t)))
@@ -599,7 +603,7 @@ let rec betree_node_lookup_first_message_after_key_fwd
   | BetreeListNil -> Return BetreeListNil
   end
 
-(** [betree_main::betree::Node::{5}::lookup_first_message_after_key] *)
+(** [betree_main::betree::Node::{5}::lookup_first_message_after_key]: backward function 0 *)
 let rec betree_node_lookup_first_message_after_key_back
   (key : u64) (msgs : betree_list_t (u64 & betree_message_t))
   (ret : betree_list_t (u64 & betree_message_t)) :
@@ -618,7 +622,8 @@ let rec betree_node_lookup_first_message_after_key_back
   | BetreeListNil -> Return ret
   end
 
-(** [betree_main::betree::Node::{5}::apply_to_internal] *)
+(** [betree_main::betree::Node::{5}::apply_to_internal]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let betree_node_apply_to_internal_fwd_back
   (msgs : betree_list_t (u64 & betree_message_t)) (key : u64)
   (new_msg : betree_message_t) :
@@ -678,7 +683,8 @@ let betree_node_apply_to_internal_fwd_back
         new_msg) in
     betree_node_lookup_first_message_for_key_back key msgs msgs1
 
-(** [betree_main::betree::Node::{5}::apply_messages_to_internal] *)
+(** [betree_main::betree::Node::{5}::apply_messages_to_internal]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let rec betree_node_apply_messages_to_internal_fwd_back
   (msgs : betree_list_t (u64 & betree_message_t))
   (new_msgs : betree_list_t (u64 & betree_message_t)) :
@@ -693,7 +699,7 @@ let rec betree_node_apply_messages_to_internal_fwd_back
   | BetreeListNil -> Return msgs
   end
 
-(** [betree_main::betree::Node::{5}::apply_messages] *)
+(** [betree_main::betree::Node::{5}::apply_messages]: forward function *)
 let rec betree_node_apply_messages_fwd
   (self : betree_node_t) (params : betree_params_t)
   (node_id_cnt : betree_node_id_counter_t)
@@ -740,7 +746,7 @@ let rec betree_node_apply_messages_fwd
       Return (st1, ())
   end
 
-(** [betree_main::betree::Node::{5}::apply_messages] *)
+(** [betree_main::betree::Node::{5}::apply_messages]: backward function 0 *)
 and betree_node_apply_messages_back
   (self : betree_node_t) (params : betree_params_t)
   (node_id_cnt : betree_node_id_counter_t)
@@ -788,7 +794,7 @@ and betree_node_apply_messages_back
       Return (BetreeNodeLeaf { node with betree_leaf_size = len }, node_id_cnt)
   end
 
-(** [betree_main::betree::Internal::{4}::flush] *)
+(** [betree_main::betree::Internal::{4}::flush]: forward function *)
 and betree_internal_flush_fwd
   (self : betree_internal_t) (params : betree_params_t)
   (node_id_cnt : betree_node_id_counter_t)
@@ -830,7 +836,7 @@ and betree_internal_flush_fwd
         node_id_cnt msgs_right st in
     Return (st0, msgs_left)
 
-(** [betree_main::betree::Internal::{4}::flush] *)
+(** [betree_main::betree::Internal::{4}::flush]: backward function 0 *)
 and betree_internal_flush_back
   (self : betree_internal_t) (params : betree_params_t)
   (node_id_cnt : betree_node_id_counter_t)
@@ -868,7 +874,7 @@ and betree_internal_flush_back
         node_id_cnt msgs_right st in
     Return ({ self with betree_internal_right = n }, node_id_cnt0)
 
-(** [betree_main::betree::Node::{5}::apply] *)
+(** [betree_main::betree::Node::{5}::apply]: forward function *)
 let betree_node_apply_fwd
   (self : betree_node_t) (params : betree_params_t)
   (node_id_cnt : betree_node_id_counter_t) (key : u64)
@@ -884,7 +890,7 @@ let betree_node_apply_fwd
       (key, new_msg) l) st in
   Return (st0, ())
 
-(** [betree_main::betree::Node::{5}::apply] *)
+(** [betree_main::betree::Node::{5}::apply]: backward function 0 *)
 let betree_node_apply_back
   (self : betree_node_t) (params : betree_params_t)
   (node_id_cnt : betree_node_id_counter_t) (key : u64)
@@ -895,7 +901,7 @@ let betree_node_apply_back
   betree_node_apply_messages_back self params node_id_cnt (BetreeListCons (key,
     new_msg) l) st
 
-(** [betree_main::betree::BeTree::{6}::new] *)
+(** [betree_main::betree::BeTree::{6}::new]: forward function *)
 let betree_be_tree_new_fwd
   (min_flush_size : u64) (split_size : u64) (st : state) :
   result (state & betree_be_tree_t)
@@ -916,7 +922,7 @@ let betree_be_tree_new_fwd
         (BetreeNodeLeaf { betree_leaf_id = id; betree_leaf_size = 0 })
     })
 
-(** [betree_main::betree::BeTree::{6}::apply] *)
+(** [betree_main::betree::BeTree::{6}::apply]: forward function *)
 let betree_be_tree_apply_fwd
   (self : betree_be_tree_t) (key : u64) (msg : betree_message_t) (st : state) :
   result (state & unit)
@@ -929,7 +935,7 @@ let betree_be_tree_apply_fwd
       self.betree_be_tree_node_id_cnt key msg st in
   Return (st0, ())
 
-(** [betree_main::betree::BeTree::{6}::apply] *)
+(** [betree_main::betree::BeTree::{6}::apply]: backward function 0 *)
 let betree_be_tree_apply_back
   (self : betree_be_tree_t) (key : u64) (msg : betree_message_t) (st : state) :
   result betree_be_tree_t
@@ -940,7 +946,7 @@ let betree_be_tree_apply_back
   Return
     { self with betree_be_tree_node_id_cnt = nic; betree_be_tree_root = n }
 
-(** [betree_main::betree::BeTree::{6}::insert] *)
+(** [betree_main::betree::BeTree::{6}::insert]: forward function *)
 let betree_be_tree_insert_fwd
   (self : betree_be_tree_t) (key : u64) (value : u64) (st : state) :
   result (state & unit)
@@ -950,28 +956,28 @@ let betree_be_tree_insert_fwd
   let* _ = betree_be_tree_apply_back self key (BetreeMessageInsert value) st in
   Return (st0, ())
 
-(** [betree_main::betree::BeTree::{6}::insert] *)
+(** [betree_main::betree::BeTree::{6}::insert]: backward function 0 *)
 let betree_be_tree_insert_back
   (self : betree_be_tree_t) (key : u64) (value : u64) (st : state) :
   result betree_be_tree_t
   =
   betree_be_tree_apply_back self key (BetreeMessageInsert value) st
 
-(** [betree_main::betree::BeTree::{6}::delete] *)
+(** [betree_main::betree::BeTree::{6}::delete]: forward function *)
 let betree_be_tree_delete_fwd
   (self : betree_be_tree_t) (key : u64) (st : state) : result (state & unit) =
   let* (st0, _) = betree_be_tree_apply_fwd self key BetreeMessageDelete st in
   let* _ = betree_be_tree_apply_back self key BetreeMessageDelete st in
   Return (st0, ())
 
-(** [betree_main::betree::BeTree::{6}::delete] *)
+(** [betree_main::betree::BeTree::{6}::delete]: backward function 0 *)
 let betree_be_tree_delete_back
   (self : betree_be_tree_t) (key : u64) (st : state) :
   result betree_be_tree_t
   =
   betree_be_tree_apply_back self key BetreeMessageDelete st
 
-(** [betree_main::betree::BeTree::{6}::upsert] *)
+(** [betree_main::betree::BeTree::{6}::upsert]: forward function *)
 let betree_be_tree_upsert_fwd
   (self : betree_be_tree_t) (key : u64) (upd : betree_upsert_fun_state_t)
   (st : state) :
@@ -982,7 +988,7 @@ let betree_be_tree_upsert_fwd
   let* _ = betree_be_tree_apply_back self key (BetreeMessageUpsert upd) st in
   Return (st0, ())
 
-(** [betree_main::betree::BeTree::{6}::upsert] *)
+(** [betree_main::betree::BeTree::{6}::upsert]: backward function 0 *)
 let betree_be_tree_upsert_back
   (self : betree_be_tree_t) (key : u64) (upd : betree_upsert_fun_state_t)
   (st : state) :
@@ -990,14 +996,14 @@ let betree_be_tree_upsert_back
   =
   betree_be_tree_apply_back self key (BetreeMessageUpsert upd) st
 
-(** [betree_main::betree::BeTree::{6}::lookup] *)
+(** [betree_main::betree::BeTree::{6}::lookup]: forward function *)
 let betree_be_tree_lookup_fwd
   (self : betree_be_tree_t) (key : u64) (st : state) :
   result (state & (option u64))
   =
   betree_node_lookup_fwd self.betree_be_tree_root key st
 
-(** [betree_main::betree::BeTree::{6}::lookup] *)
+(** [betree_main::betree::BeTree::{6}::lookup]: backward function 0 *)
 let betree_be_tree_lookup_back
   (self : betree_be_tree_t) (key : u64) (st : state) :
   result betree_be_tree_t
@@ -1005,7 +1011,7 @@ let betree_be_tree_lookup_back
   let* n = betree_node_lookup_back self.betree_be_tree_root key st in
   Return { self with betree_be_tree_root = n }
 
-(** [betree_main::main] *)
+(** [betree_main::main]: forward function *)
 let main_fwd : result unit =
   Return ()
 
diff --git a/tests/fstar/betree/BetreeMain.Opaque.fsti b/tests/fstar/betree/BetreeMain.Opaque.fsti
index dfbd73d6..c33cf225 100644
--- a/tests/fstar/betree/BetreeMain.Opaque.fsti
+++ b/tests/fstar/betree/BetreeMain.Opaque.fsti
@@ -6,25 +6,25 @@ include BetreeMain.Types
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [betree_main::betree_utils::load_internal_node] *)
+(** [betree_main::betree_utils::load_internal_node]: forward function *)
 val betree_utils_load_internal_node_fwd
   : u64 -> state -> result (state & (betree_list_t (u64 & betree_message_t)))
 
-(** [betree_main::betree_utils::store_internal_node] *)
+(** [betree_main::betree_utils::store_internal_node]: forward function *)
 val betree_utils_store_internal_node_fwd
   :
   u64 -> betree_list_t (u64 & betree_message_t) -> state -> result (state &
     unit)
 
-(** [betree_main::betree_utils::load_leaf_node] *)
+(** [betree_main::betree_utils::load_leaf_node]: forward function *)
 val betree_utils_load_leaf_node_fwd
   : u64 -> state -> result (state & (betree_list_t (u64 & u64)))
 
-(** [betree_main::betree_utils::store_leaf_node] *)
+(** [betree_main::betree_utils::store_leaf_node]: forward function *)
 val betree_utils_store_leaf_node_fwd
   : u64 -> betree_list_t (u64 & u64) -> state -> result (state & unit)
 
-(** [core::option::Option::{0}::unwrap] *)
+(** [core::option::Option::{0}::unwrap]: forward function *)
 val core_option_option_unwrap_fwd
   (t : Type0) : option t -> state -> result (state & t)
 
diff --git a/tests/fstar/betree_back_stateful/BetreeMain.Funs.fst b/tests/fstar/betree_back_stateful/BetreeMain.Funs.fst
index c70bef08..12402fb4 100644
--- a/tests/fstar/betree_back_stateful/BetreeMain.Funs.fst
+++ b/tests/fstar/betree_back_stateful/BetreeMain.Funs.fst
@@ -8,14 +8,14 @@ include BetreeMain.Clauses
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [betree_main::betree::load_internal_node] *)
+(** [betree_main::betree::load_internal_node]: forward function *)
 let betree_load_internal_node_fwd
   (id : u64) (st : state) :
   result (state & (betree_list_t (u64 & betree_message_t)))
   =
   betree_utils_load_internal_node_fwd id st
 
-(** [betree_main::betree::store_internal_node] *)
+(** [betree_main::betree::store_internal_node]: forward function *)
 let betree_store_internal_node_fwd
   (id : u64) (content : betree_list_t (u64 & betree_message_t)) (st : state) :
   result (state & unit)
@@ -23,12 +23,12 @@ let betree_store_internal_node_fwd
   let* (st0, _) = betree_utils_store_internal_node_fwd id content st in
   Return (st0, ())
 
-(** [betree_main::betree::load_leaf_node] *)
+(** [betree_main::betree::load_leaf_node]: forward function *)
 let betree_load_leaf_node_fwd
   (id : u64) (st : state) : result (state & (betree_list_t (u64 & u64))) =
   betree_utils_load_leaf_node_fwd id st
 
-(** [betree_main::betree::store_leaf_node] *)
+(** [betree_main::betree::store_leaf_node]: forward function *)
 let betree_store_leaf_node_fwd
   (id : u64) (content : betree_list_t (u64 & u64)) (st : state) :
   result (state & unit)
@@ -36,25 +36,25 @@ let betree_store_leaf_node_fwd
   let* (st0, _) = betree_utils_store_leaf_node_fwd id content st in
   Return (st0, ())
 
-(** [betree_main::betree::fresh_node_id] *)
+(** [betree_main::betree::fresh_node_id]: forward function *)
 let betree_fresh_node_id_fwd (counter : u64) : result u64 =
   let* _ = u64_add counter 1 in Return counter
 
-(** [betree_main::betree::fresh_node_id] *)
+(** [betree_main::betree::fresh_node_id]: backward function 0 *)
 let betree_fresh_node_id_back (counter : u64) : result u64 =
   u64_add counter 1
 
-(** [betree_main::betree::NodeIdCounter::{0}::new] *)
+(** [betree_main::betree::NodeIdCounter::{0}::new]: forward function *)
 let betree_node_id_counter_new_fwd : result betree_node_id_counter_t =
   Return { betree_node_id_counter_next_node_id = 0 }
 
-(** [betree_main::betree::NodeIdCounter::{0}::fresh_id] *)
+(** [betree_main::betree::NodeIdCounter::{0}::fresh_id]: forward function *)
 let betree_node_id_counter_fresh_id_fwd
   (self : betree_node_id_counter_t) : result u64 =
   let* _ = u64_add self.betree_node_id_counter_next_node_id 1 in
   Return self.betree_node_id_counter_next_node_id
 
-(** [betree_main::betree::NodeIdCounter::{0}::fresh_id] *)
+(** [betree_main::betree::NodeIdCounter::{0}::fresh_id]: backward function 0 *)
 let betree_node_id_counter_fresh_id_back
   (self : betree_node_id_counter_t) : result betree_node_id_counter_t =
   let* i = u64_add self.betree_node_id_counter_next_node_id 1 in
@@ -64,7 +64,7 @@ let betree_node_id_counter_fresh_id_back
 let core_num_u64_max_body : result u64 = Return 18446744073709551615
 let core_num_u64_max_c : u64 = eval_global core_num_u64_max_body
 
-(** [betree_main::betree::upsert_update] *)
+(** [betree_main::betree::upsert_update]: forward function *)
 let betree_upsert_update_fwd
   (prev : option u64) (st : betree_upsert_fun_state_t) : result u64 =
   begin match prev with
@@ -83,7 +83,7 @@ let betree_upsert_update_fwd
     end
   end
 
-(** [betree_main::betree::List::{1}::len] *)
+(** [betree_main::betree::List::{1}::len]: forward function *)
 let rec betree_list_len_fwd
   (t : Type0) (self : betree_list_t t) :
   Tot (result u64) (decreases (betree_list_len_decreases t self))
@@ -93,7 +93,7 @@ let rec betree_list_len_fwd
   | BetreeListNil -> Return 0
   end
 
-(** [betree_main::betree::List::{1}::split_at] *)
+(** [betree_main::betree::List::{1}::split_at]: forward function *)
 let rec betree_list_split_at_fwd
   (t : Type0) (self : betree_list_t t) (n : u64) :
   Tot (result ((betree_list_t t) & (betree_list_t t)))
@@ -112,14 +112,15 @@ let rec betree_list_split_at_fwd
     | BetreeListNil -> Fail Failure
     end
 
-(** [betree_main::betree::List::{1}::push_front] *)
+(** [betree_main::betree::List::{1}::push_front]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let betree_list_push_front_fwd_back
   (t : Type0) (self : betree_list_t t) (x : t) : result (betree_list_t t) =
   let tl = mem_replace_fwd (betree_list_t t) self BetreeListNil in
   let l = tl in
   Return (BetreeListCons x l)
 
-(** [betree_main::betree::List::{1}::pop_front] *)
+(** [betree_main::betree::List::{1}::pop_front]: forward function *)
 let betree_list_pop_front_fwd (t : Type0) (self : betree_list_t t) : result t =
   let ls = mem_replace_fwd (betree_list_t t) self BetreeListNil in
   begin match ls with
@@ -127,7 +128,7 @@ let betree_list_pop_front_fwd (t : Type0) (self : betree_list_t t) : result t =
   | BetreeListNil -> Fail Failure
   end
 
-(** [betree_main::betree::List::{1}::pop_front] *)
+(** [betree_main::betree::List::{1}::pop_front]: backward function 0 *)
 let betree_list_pop_front_back
   (t : Type0) (self : betree_list_t t) : result (betree_list_t t) =
   let ls = mem_replace_fwd (betree_list_t t) self BetreeListNil in
@@ -136,14 +137,14 @@ let betree_list_pop_front_back
   | BetreeListNil -> Fail Failure
   end
 
-(** [betree_main::betree::List::{1}::hd] *)
+(** [betree_main::betree::List::{1}::hd]: forward function *)
 let betree_list_hd_fwd (t : Type0) (self : betree_list_t t) : result t =
   begin match self with
   | BetreeListCons hd l -> Return hd
   | BetreeListNil -> Fail Failure
   end
 
-(** [betree_main::betree::List::{2}::head_has_key] *)
+(** [betree_main::betree::List::{2}::head_has_key]: forward function *)
 let betree_list_head_has_key_fwd
   (t : Type0) (self : betree_list_t (u64 & t)) (key : u64) : result bool =
   begin match self with
@@ -151,7 +152,7 @@ let betree_list_head_has_key_fwd
   | BetreeListNil -> Return false
   end
 
-(** [betree_main::betree::List::{2}::partition_at_pivot] *)
+(** [betree_main::betree::List::{2}::partition_at_pivot]: forward function *)
 let rec betree_list_partition_at_pivot_fwd
   (t : Type0) (self : betree_list_t (u64 & t)) (pivot : u64) :
   Tot (result ((betree_list_t (u64 & t)) & (betree_list_t (u64 & t))))
@@ -170,7 +171,7 @@ let rec betree_list_partition_at_pivot_fwd
   | BetreeListNil -> Return (BetreeListNil, BetreeListNil)
   end
 
-(** [betree_main::betree::Leaf::{3}::split] *)
+(** [betree_main::betree::Leaf::{3}::split]: forward function *)
 let betree_leaf_split_fwd
   (self : betree_leaf_t) (content : betree_list_t (u64 & u64))
   (params : betree_params_t) (node_id_cnt : betree_node_id_counter_t)
@@ -202,7 +203,7 @@ let betree_leaf_split_fwd
       betree_internal_right = n0
     })
 
-(** [betree_main::betree::Leaf::{3}::split] *)
+(** [betree_main::betree::Leaf::{3}::split]: backward function 0 *)
 let betree_leaf_split_back0
   (self : betree_leaf_t) (content : betree_list_t (u64 & u64))
   (params : betree_params_t) (node_id_cnt : betree_node_id_counter_t)
@@ -221,7 +222,7 @@ let betree_leaf_split_back0
   let* _ = betree_store_leaf_node_fwd id1 content1 st1 in
   Return (st0, ())
 
-(** [betree_main::betree::Leaf::{3}::split] *)
+(** [betree_main::betree::Leaf::{3}::split]: backward function 1 *)
 let betree_leaf_split_back1
   (self : betree_leaf_t) (content : betree_list_t (u64 & u64))
   (params : betree_params_t) (node_id_cnt : betree_node_id_counter_t)
@@ -240,7 +241,7 @@ let betree_leaf_split_back1
   let* _ = betree_store_leaf_node_fwd id1 content1 st1 in
   Return (st0, ())
 
-(** [betree_main::betree::Leaf::{3}::split] *)
+(** [betree_main::betree::Leaf::{3}::split]: backward function 2 *)
 let betree_leaf_split_back2
   (self : betree_leaf_t) (content : betree_list_t (u64 & u64))
   (params : betree_params_t) (node_id_cnt : betree_node_id_counter_t)
@@ -260,7 +261,7 @@ let betree_leaf_split_back2
   let* node_id_cnt1 = betree_node_id_counter_fresh_id_back node_id_cnt0 in
   Return (st0, node_id_cnt1)
 
-(** [betree_main::betree::Node::{5}::lookup_in_bindings] *)
+(** [betree_main::betree::Node::{5}::lookup_in_bindings]: forward function *)
 let rec betree_node_lookup_in_bindings_fwd
   (key : u64) (bindings : betree_list_t (u64 & u64)) :
   Tot (result (option u64))
@@ -278,7 +279,7 @@ let rec betree_node_lookup_in_bindings_fwd
   | BetreeListNil -> Return None
   end
 
-(** [betree_main::betree::Node::{5}::lookup_first_message_for_key] *)
+(** [betree_main::betree::Node::{5}::lookup_first_message_for_key]: forward function *)
 let rec betree_node_lookup_first_message_for_key_fwd
   (key : u64) (msgs : betree_list_t (u64 & betree_message_t)) :
   Tot (result (betree_list_t (u64 & betree_message_t)))
@@ -293,7 +294,7 @@ let rec betree_node_lookup_first_message_for_key_fwd
   | BetreeListNil -> Return BetreeListNil
   end
 
-(** [betree_main::betree::Node::{5}::lookup_first_message_for_key] *)
+(** [betree_main::betree::Node::{5}::lookup_first_message_for_key]: backward function 0 *)
 let rec betree_node_lookup_first_message_for_key_back
   (key : u64) (msgs : betree_list_t (u64 & betree_message_t))
   (ret : betree_list_t (u64 & betree_message_t)) :
@@ -312,7 +313,7 @@ let rec betree_node_lookup_first_message_for_key_back
   | BetreeListNil -> Return ret
   end
 
-(** [betree_main::betree::Node::{5}::apply_upserts] *)
+(** [betree_main::betree::Node::{5}::apply_upserts]: forward function *)
 let rec betree_node_apply_upserts_fwd
   (msgs : betree_list_t (u64 & betree_message_t)) (prev : option u64)
   (key : u64) (st : state) :
@@ -339,7 +340,7 @@ let rec betree_node_apply_upserts_fwd
         BetreeMessageInsert v) in
     Return (st0, v)
 
-(** [betree_main::betree::Node::{5}::apply_upserts] *)
+(** [betree_main::betree::Node::{5}::apply_upserts]: backward function 0 *)
 let rec betree_node_apply_upserts_back
   (msgs : betree_list_t (u64 & betree_message_t)) (prev : option u64)
   (key : u64) (st : state) (st0 : state) :
@@ -366,7 +367,7 @@ let rec betree_node_apply_upserts_back
         BetreeMessageInsert v) in
     Return (st0, msgs0)
 
-(** [betree_main::betree::Node::{5}::lookup] *)
+(** [betree_main::betree::Node::{5}::lookup]: forward function *)
 let rec betree_node_lookup_fwd
   (self : betree_node_t) (key : u64) (st : state) :
   Tot (result (state & (option u64)))
@@ -430,7 +431,7 @@ let rec betree_node_lookup_fwd
     Return (st0, opt)
   end
 
-(** [betree_main::betree::Node::{5}::lookup] *)
+(** [betree_main::betree::Node::{5}::lookup]: backward function 0 *)
 and betree_node_lookup_back
   (self : betree_node_t) (key : u64) (st : state) (st0 : state) :
   Tot (result (state & betree_node_t))
@@ -495,7 +496,7 @@ and betree_node_lookup_back
     Return (st0, BetreeNodeLeaf node)
   end
 
-(** [betree_main::betree::Internal::{4}::lookup_in_children] *)
+(** [betree_main::betree::Internal::{4}::lookup_in_children]: forward function *)
 and betree_internal_lookup_in_children_fwd
   (self : betree_internal_t) (key : u64) (st : state) :
   Tot (result (state & (option u64)))
@@ -505,7 +506,7 @@ and betree_internal_lookup_in_children_fwd
   then betree_node_lookup_fwd self.betree_internal_left key st
   else betree_node_lookup_fwd self.betree_internal_right key st
 
-(** [betree_main::betree::Internal::{4}::lookup_in_children] *)
+(** [betree_main::betree::Internal::{4}::lookup_in_children]: backward function 0 *)
 and betree_internal_lookup_in_children_back
   (self : betree_internal_t) (key : u64) (st : state) (st0 : state) :
   Tot (result (state & betree_internal_t))
@@ -521,7 +522,7 @@ and betree_internal_lookup_in_children_back
       betree_node_lookup_back self.betree_internal_right key st st0 in
     Return (st1, { self with betree_internal_right = n })
 
-(** [betree_main::betree::Node::{5}::lookup_mut_in_bindings] *)
+(** [betree_main::betree::Node::{5}::lookup_mut_in_bindings]: forward function *)
 let rec betree_node_lookup_mut_in_bindings_fwd
   (key : u64) (bindings : betree_list_t (u64 & u64)) :
   Tot (result (betree_list_t (u64 & u64)))
@@ -536,7 +537,7 @@ let rec betree_node_lookup_mut_in_bindings_fwd
   | BetreeListNil -> Return BetreeListNil
   end
 
-(** [betree_main::betree::Node::{5}::lookup_mut_in_bindings] *)
+(** [betree_main::betree::Node::{5}::lookup_mut_in_bindings]: backward function 0 *)
 let rec betree_node_lookup_mut_in_bindings_back
   (key : u64) (bindings : betree_list_t (u64 & u64))
   (ret : betree_list_t (u64 & u64)) :
@@ -554,7 +555,8 @@ let rec betree_node_lookup_mut_in_bindings_back
   | BetreeListNil -> Return ret
   end
 
-(** [betree_main::betree::Node::{5}::apply_to_leaf] *)
+(** [betree_main::betree::Node::{5}::apply_to_leaf]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let betree_node_apply_to_leaf_fwd_back
   (bindings : betree_list_t (u64 & u64)) (key : u64)
   (new_msg : betree_message_t) :
@@ -597,7 +599,8 @@ let betree_node_apply_to_leaf_fwd_back
       betree_node_lookup_mut_in_bindings_back key bindings bindings1
     end
 
-(** [betree_main::betree::Node::{5}::apply_messages_to_leaf] *)
+(** [betree_main::betree::Node::{5}::apply_messages_to_leaf]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let rec betree_node_apply_messages_to_leaf_fwd_back
   (bindings : betree_list_t (u64 & u64))
   (new_msgs : betree_list_t (u64 & betree_message_t)) :
@@ -612,7 +615,8 @@ let rec betree_node_apply_messages_to_leaf_fwd_back
   | BetreeListNil -> Return bindings
   end
 
-(** [betree_main::betree::Node::{5}::filter_messages_for_key] *)
+(** [betree_main::betree::Node::{5}::filter_messages_for_key]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let rec betree_node_filter_messages_for_key_fwd_back
   (key : u64) (msgs : betree_list_t (u64 & betree_message_t)) :
   Tot (result (betree_list_t (u64 & betree_message_t)))
@@ -631,7 +635,7 @@ let rec betree_node_filter_messages_for_key_fwd_back
   | BetreeListNil -> Return BetreeListNil
   end
 
-(** [betree_main::betree::Node::{5}::lookup_first_message_after_key] *)
+(** [betree_main::betree::Node::{5}::lookup_first_message_after_key]: forward function *)
 let rec betree_node_lookup_first_message_after_key_fwd
   (key : u64) (msgs : betree_list_t (u64 & betree_message_t)) :
   Tot (result (betree_list_t (u64 & betree_message_t)))
@@ -646,7 +650,7 @@ let rec betree_node_lookup_first_message_after_key_fwd
   | BetreeListNil -> Return BetreeListNil
   end
 
-(** [betree_main::betree::Node::{5}::lookup_first_message_after_key] *)
+(** [betree_main::betree::Node::{5}::lookup_first_message_after_key]: backward function 0 *)
 let rec betree_node_lookup_first_message_after_key_back
   (key : u64) (msgs : betree_list_t (u64 & betree_message_t))
   (ret : betree_list_t (u64 & betree_message_t)) :
@@ -665,7 +669,8 @@ let rec betree_node_lookup_first_message_after_key_back
   | BetreeListNil -> Return ret
   end
 
-(** [betree_main::betree::Node::{5}::apply_to_internal] *)
+(** [betree_main::betree::Node::{5}::apply_to_internal]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let betree_node_apply_to_internal_fwd_back
   (msgs : betree_list_t (u64 & betree_message_t)) (key : u64)
   (new_msg : betree_message_t) :
@@ -725,7 +730,8 @@ let betree_node_apply_to_internal_fwd_back
         new_msg) in
     betree_node_lookup_first_message_for_key_back key msgs msgs1
 
-(** [betree_main::betree::Node::{5}::apply_messages_to_internal] *)
+(** [betree_main::betree::Node::{5}::apply_messages_to_internal]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let rec betree_node_apply_messages_to_internal_fwd_back
   (msgs : betree_list_t (u64 & betree_message_t))
   (new_msgs : betree_list_t (u64 & betree_message_t)) :
@@ -740,7 +746,7 @@ let rec betree_node_apply_messages_to_internal_fwd_back
   | BetreeListNil -> Return msgs
   end
 
-(** [betree_main::betree::Node::{5}::apply_messages] *)
+(** [betree_main::betree::Node::{5}::apply_messages]: forward function *)
 let rec betree_node_apply_messages_fwd
   (self : betree_node_t) (params : betree_params_t)
   (node_id_cnt : betree_node_id_counter_t)
@@ -788,7 +794,7 @@ let rec betree_node_apply_messages_fwd
       Return (st1, ())
   end
 
-(** [betree_main::betree::Node::{5}::apply_messages] *)
+(** [betree_main::betree::Node::{5}::apply_messages]: backward function 0 *)
 and betree_node_apply_messages_back'a
   (self : betree_node_t) (params : betree_params_t)
   (node_id_cnt : betree_node_id_counter_t)
@@ -840,7 +846,7 @@ and betree_node_apply_messages_back'a
         node_id_cnt))
   end
 
-(** [betree_main::betree::Node::{5}::apply_messages] *)
+(** [betree_main::betree::Node::{5}::apply_messages]: backward function 1 *)
 and betree_node_apply_messages_back1
   (self : betree_node_t) (params : betree_params_t)
   (node_id_cnt : betree_node_id_counter_t)
@@ -889,7 +895,7 @@ and betree_node_apply_messages_back1
       Return (st0, ())
   end
 
-(** [betree_main::betree::Internal::{4}::flush] *)
+(** [betree_main::betree::Internal::{4}::flush]: forward function *)
 and betree_internal_flush_fwd
   (self : betree_internal_t) (params : betree_params_t)
   (node_id_cnt : betree_node_id_counter_t)
@@ -940,7 +946,7 @@ and betree_internal_flush_fwd
         node_id_cnt msgs_right st st1 in
     Return (st2, msgs_left)
 
-(** [betree_main::betree::Internal::{4}::flush] *)
+(** [betree_main::betree::Internal::{4}::flush]: backward function 0 *)
 and betree_internal_flush_back'a
   (self : betree_internal_t) (params : betree_params_t)
   (node_id_cnt : betree_node_id_counter_t)
@@ -994,7 +1000,7 @@ and betree_internal_flush_back'a
         node_id_cnt msgs_right st st2 in
     Return (st0, ({ self with betree_internal_right = n }, node_id_cnt0))
 
-(** [betree_main::betree::Internal::{4}::flush] *)
+(** [betree_main::betree::Internal::{4}::flush]: backward function 1 *)
 and betree_internal_flush_back1
   (self : betree_internal_t) (params : betree_params_t)
   (node_id_cnt : betree_node_id_counter_t)
@@ -1046,7 +1052,7 @@ and betree_internal_flush_back1
         node_id_cnt msgs_right st st2 in
     Return (st0, ())
 
-(** [betree_main::betree::Node::{5}::apply] *)
+(** [betree_main::betree::Node::{5}::apply]: forward function *)
 let betree_node_apply_fwd
   (self : betree_node_t) (params : betree_params_t)
   (node_id_cnt : betree_node_id_counter_t) (key : u64)
@@ -1063,7 +1069,7 @@ let betree_node_apply_fwd
   betree_node_apply_messages_back1 self params node_id_cnt (BetreeListCons
     (key, new_msg) l) st st1
 
-(** [betree_main::betree::Node::{5}::apply] *)
+(** [betree_main::betree::Node::{5}::apply]: backward function 0 *)
 let betree_node_apply_back'a
   (self : betree_node_t) (params : betree_params_t)
   (node_id_cnt : betree_node_id_counter_t) (key : u64)
@@ -1082,7 +1088,7 @@ let betree_node_apply_back'a
       (key, new_msg) l) st st2 in
   Return (st0, (self0, node_id_cnt0))
 
-(** [betree_main::betree::Node::{5}::apply] *)
+(** [betree_main::betree::Node::{5}::apply]: backward function 1 *)
 let betree_node_apply_back1
   (self : betree_node_t) (params : betree_params_t)
   (node_id_cnt : betree_node_id_counter_t) (key : u64)
@@ -1101,7 +1107,7 @@ let betree_node_apply_back1
       (key, new_msg) l) st st2 in
   Return (st0, ())
 
-(** [betree_main::betree::BeTree::{6}::new] *)
+(** [betree_main::betree::BeTree::{6}::new]: forward function *)
 let betree_be_tree_new_fwd
   (min_flush_size : u64) (split_size : u64) (st : state) :
   result (state & betree_be_tree_t)
@@ -1122,7 +1128,7 @@ let betree_be_tree_new_fwd
         (BetreeNodeLeaf { betree_leaf_id = id; betree_leaf_size = 0 })
     })
 
-(** [betree_main::betree::BeTree::{6}::apply] *)
+(** [betree_main::betree::BeTree::{6}::apply]: forward function *)
 let betree_be_tree_apply_fwd
   (self : betree_be_tree_t) (key : u64) (msg : betree_message_t) (st : state) :
   result (state & unit)
@@ -1137,7 +1143,7 @@ let betree_be_tree_apply_fwd
   betree_node_apply_back1 self.betree_be_tree_root self.betree_be_tree_params
     self.betree_be_tree_node_id_cnt key msg st st1
 
-(** [betree_main::betree::BeTree::{6}::apply] *)
+(** [betree_main::betree::BeTree::{6}::apply]: backward function 0 *)
 let betree_be_tree_apply_back
   (self : betree_be_tree_t) (key : u64) (msg : betree_message_t) (st : state)
   (st0 : state) :
@@ -1156,7 +1162,7 @@ let betree_be_tree_apply_back
   Return (st0,
     { self with betree_be_tree_node_id_cnt = nic; betree_be_tree_root = n })
 
-(** [betree_main::betree::BeTree::{6}::insert] *)
+(** [betree_main::betree::BeTree::{6}::insert]: forward function *)
 let betree_be_tree_insert_fwd
   (self : betree_be_tree_t) (key : u64) (value : u64) (st : state) :
   result (state & unit)
@@ -1167,7 +1173,7 @@ let betree_be_tree_insert_fwd
     betree_be_tree_apply_back self key (BetreeMessageInsert value) st st0 in
   Return (st1, ())
 
-(** [betree_main::betree::BeTree::{6}::insert] *)
+(** [betree_main::betree::BeTree::{6}::insert]: backward function 0 *)
 let betree_be_tree_insert_back
   (self : betree_be_tree_t) (key : u64) (value : u64) (st : state)
   (st0 : state) :
@@ -1179,7 +1185,7 @@ let betree_be_tree_insert_back
     betree_be_tree_apply_back self key (BetreeMessageInsert value) st st1 in
   Return (st0, self0)
 
-(** [betree_main::betree::BeTree::{6}::delete] *)
+(** [betree_main::betree::BeTree::{6}::delete]: forward function *)
 let betree_be_tree_delete_fwd
   (self : betree_be_tree_t) (key : u64) (st : state) : result (state & unit) =
   let* (st0, _) = betree_be_tree_apply_fwd self key BetreeMessageDelete st in
@@ -1187,7 +1193,7 @@ let betree_be_tree_delete_fwd
     in
   Return (st1, ())
 
-(** [betree_main::betree::BeTree::{6}::delete] *)
+(** [betree_main::betree::BeTree::{6}::delete]: backward function 0 *)
 let betree_be_tree_delete_back
   (self : betree_be_tree_t) (key : u64) (st : state) (st0 : state) :
   result (state & betree_be_tree_t)
@@ -1197,7 +1203,7 @@ let betree_be_tree_delete_back
     betree_be_tree_apply_back self key BetreeMessageDelete st st1 in
   Return (st0, self0)
 
-(** [betree_main::betree::BeTree::{6}::upsert] *)
+(** [betree_main::betree::BeTree::{6}::upsert]: forward function *)
 let betree_be_tree_upsert_fwd
   (self : betree_be_tree_t) (key : u64) (upd : betree_upsert_fun_state_t)
   (st : state) :
@@ -1209,7 +1215,7 @@ let betree_be_tree_upsert_fwd
     betree_be_tree_apply_back self key (BetreeMessageUpsert upd) st st0 in
   Return (st1, ())
 
-(** [betree_main::betree::BeTree::{6}::upsert] *)
+(** [betree_main::betree::BeTree::{6}::upsert]: backward function 0 *)
 let betree_be_tree_upsert_back
   (self : betree_be_tree_t) (key : u64) (upd : betree_upsert_fun_state_t)
   (st : state) (st0 : state) :
@@ -1221,14 +1227,14 @@ let betree_be_tree_upsert_back
     betree_be_tree_apply_back self key (BetreeMessageUpsert upd) st st1 in
   Return (st0, self0)
 
-(** [betree_main::betree::BeTree::{6}::lookup] *)
+(** [betree_main::betree::BeTree::{6}::lookup]: forward function *)
 let betree_be_tree_lookup_fwd
   (self : betree_be_tree_t) (key : u64) (st : state) :
   result (state & (option u64))
   =
   betree_node_lookup_fwd self.betree_be_tree_root key st
 
-(** [betree_main::betree::BeTree::{6}::lookup] *)
+(** [betree_main::betree::BeTree::{6}::lookup]: backward function 0 *)
 let betree_be_tree_lookup_back
   (self : betree_be_tree_t) (key : u64) (st : state) (st0 : state) :
   result (state & betree_be_tree_t)
@@ -1237,7 +1243,7 @@ let betree_be_tree_lookup_back
     in
   Return (st1, { self with betree_be_tree_root = n })
 
-(** [betree_main::main] *)
+(** [betree_main::main]: forward function *)
 let main_fwd : result unit =
   Return ()
 
diff --git a/tests/fstar/betree_back_stateful/BetreeMain.Opaque.fsti b/tests/fstar/betree_back_stateful/BetreeMain.Opaque.fsti
index dfbd73d6..c33cf225 100644
--- a/tests/fstar/betree_back_stateful/BetreeMain.Opaque.fsti
+++ b/tests/fstar/betree_back_stateful/BetreeMain.Opaque.fsti
@@ -6,25 +6,25 @@ include BetreeMain.Types
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [betree_main::betree_utils::load_internal_node] *)
+(** [betree_main::betree_utils::load_internal_node]: forward function *)
 val betree_utils_load_internal_node_fwd
   : u64 -> state -> result (state & (betree_list_t (u64 & betree_message_t)))
 
-(** [betree_main::betree_utils::store_internal_node] *)
+(** [betree_main::betree_utils::store_internal_node]: forward function *)
 val betree_utils_store_internal_node_fwd
   :
   u64 -> betree_list_t (u64 & betree_message_t) -> state -> result (state &
     unit)
 
-(** [betree_main::betree_utils::load_leaf_node] *)
+(** [betree_main::betree_utils::load_leaf_node]: forward function *)
 val betree_utils_load_leaf_node_fwd
   : u64 -> state -> result (state & (betree_list_t (u64 & u64)))
 
-(** [betree_main::betree_utils::store_leaf_node] *)
+(** [betree_main::betree_utils::store_leaf_node]: forward function *)
 val betree_utils_store_leaf_node_fwd
   : u64 -> betree_list_t (u64 & u64) -> state -> result (state & unit)
 
-(** [core::option::Option::{0}::unwrap] *)
+(** [core::option::Option::{0}::unwrap]: forward function *)
 val core_option_option_unwrap_fwd
   (t : Type0) : option t -> state -> result (state & t)
 
diff --git a/tests/fstar/hashmap/Hashmap.Funs.fst b/tests/fstar/hashmap/Hashmap.Funs.fst
index 44ad7463..950f1490 100644
--- a/tests/fstar/hashmap/Hashmap.Funs.fst
+++ b/tests/fstar/hashmap/Hashmap.Funs.fst
@@ -7,11 +7,11 @@ include Hashmap.Clauses
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [hashmap::hash_key] *)
+(** [hashmap::hash_key]: forward function *)
 let hash_key_fwd (k : usize) : result usize =
   Return k
 
-(** [hashmap::HashMap::{0}::allocate_slots] *)
+(** [hashmap::HashMap::{0}::allocate_slots]: loop 0: forward function *)
 let rec hash_map_allocate_slots_loop_fwd
   (t : Type0) (slots : vec (list_t t)) (n : usize) :
   Tot (result (vec (list_t t)))
@@ -24,12 +24,12 @@ let rec hash_map_allocate_slots_loop_fwd
     hash_map_allocate_slots_loop_fwd t slots0 n0
   else Return slots
 
-(** [hashmap::HashMap::{0}::allocate_slots] *)
+(** [hashmap::HashMap::{0}::allocate_slots]: forward function *)
 let hash_map_allocate_slots_fwd
   (t : Type0) (slots : vec (list_t t)) (n : usize) : result (vec (list_t t)) =
   hash_map_allocate_slots_loop_fwd t slots n
 
-(** [hashmap::HashMap::{0}::new_with_capacity] *)
+(** [hashmap::HashMap::{0}::new_with_capacity]: forward function *)
 let hash_map_new_with_capacity_fwd
   (t : Type0) (capacity : usize) (max_load_dividend : usize)
   (max_load_divisor : usize) :
@@ -47,11 +47,12 @@ let hash_map_new_with_capacity_fwd
       hash_map_slots = slots
     }
 
-(** [hashmap::HashMap::{0}::new] *)
+(** [hashmap::HashMap::{0}::new]: forward function *)
 let hash_map_new_fwd (t : Type0) : result (hash_map_t t) =
   hash_map_new_with_capacity_fwd t 32 4 5
 
-(** [hashmap::HashMap::{0}::clear] *)
+(** [hashmap::HashMap::{0}::clear]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let rec hash_map_clear_loop_fwd_back
   (t : Type0) (slots : vec (list_t t)) (i : usize) :
   Tot (result (vec (list_t t)))
@@ -65,17 +66,18 @@ let rec hash_map_clear_loop_fwd_back
     hash_map_clear_loop_fwd_back t slots0 i1
   else Return slots
 
-(** [hashmap::HashMap::{0}::clear] *)
+(** [hashmap::HashMap::{0}::clear]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let hash_map_clear_fwd_back
   (t : Type0) (self : hash_map_t t) : result (hash_map_t t) =
   let* v = hash_map_clear_loop_fwd_back t self.hash_map_slots 0 in
   Return { self with hash_map_num_entries = 0; hash_map_slots = v }
 
-(** [hashmap::HashMap::{0}::len] *)
+(** [hashmap::HashMap::{0}::len]: forward function *)
 let hash_map_len_fwd (t : Type0) (self : hash_map_t t) : result usize =
   Return self.hash_map_num_entries
 
-(** [hashmap::HashMap::{0}::insert_in_list] *)
+(** [hashmap::HashMap::{0}::insert_in_list]: loop 0: forward function *)
 let rec hash_map_insert_in_list_loop_fwd
   (t : Type0) (key : usize) (value : t) (ls : list_t t) :
   Tot (result bool)
@@ -89,12 +91,12 @@ let rec hash_map_insert_in_list_loop_fwd
   | ListNil -> Return true
   end
 
-(** [hashmap::HashMap::{0}::insert_in_list] *)
+(** [hashmap::HashMap::{0}::insert_in_list]: forward function *)
 let hash_map_insert_in_list_fwd
   (t : Type0) (key : usize) (value : t) (ls : list_t t) : result bool =
   hash_map_insert_in_list_loop_fwd t key value ls
 
-(** [hashmap::HashMap::{0}::insert_in_list] *)
+(** [hashmap::HashMap::{0}::insert_in_list]: loop 0: backward function 0 *)
 let rec hash_map_insert_in_list_loop_back
   (t : Type0) (key : usize) (value : t) (ls : list_t t) :
   Tot (result (list_t t))
@@ -110,12 +112,13 @@ let rec hash_map_insert_in_list_loop_back
   | ListNil -> let l = ListNil in Return (ListCons key value l)
   end
 
-(** [hashmap::HashMap::{0}::insert_in_list] *)
+(** [hashmap::HashMap::{0}::insert_in_list]: backward function 0 *)
 let hash_map_insert_in_list_back
   (t : Type0) (key : usize) (value : t) (ls : list_t t) : result (list_t t) =
   hash_map_insert_in_list_loop_back t key value ls
 
-(** [hashmap::HashMap::{0}::insert_no_resize] *)
+(** [hashmap::HashMap::{0}::insert_no_resize]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let hash_map_insert_no_resize_fwd_back
   (t : Type0) (self : hash_map_t t) (key : usize) (value : t) :
   result (hash_map_t t)
@@ -140,7 +143,8 @@ let hash_map_insert_no_resize_fwd_back
 let core_num_u32_max_body : result u32 = Return 4294967295
 let core_num_u32_max_c : u32 = eval_global core_num_u32_max_body
 
-(** [hashmap::HashMap::{0}::move_elements_from_list] *)
+(** [hashmap::HashMap::{0}::move_elements_from_list]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let rec hash_map_move_elements_from_list_loop_fwd_back
   (t : Type0) (ntable : hash_map_t t) (ls : list_t t) :
   Tot (result (hash_map_t t))
@@ -153,12 +157,14 @@ let rec hash_map_move_elements_from_list_loop_fwd_back
   | ListNil -> Return ntable
   end
 
-(** [hashmap::HashMap::{0}::move_elements_from_list] *)
+(** [hashmap::HashMap::{0}::move_elements_from_list]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let hash_map_move_elements_from_list_fwd_back
   (t : Type0) (ntable : hash_map_t t) (ls : list_t t) : result (hash_map_t t) =
   hash_map_move_elements_from_list_loop_fwd_back t ntable ls
 
-(** [hashmap::HashMap::{0}::move_elements] *)
+(** [hashmap::HashMap::{0}::move_elements]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let rec hash_map_move_elements_loop_fwd_back
   (t : Type0) (ntable : hash_map_t t) (slots : vec (list_t t)) (i : usize) :
   Tot (result ((hash_map_t t) & (vec (list_t t))))
@@ -176,14 +182,16 @@ let rec hash_map_move_elements_loop_fwd_back
     hash_map_move_elements_loop_fwd_back t ntable0 slots0 i1
   else Return (ntable, slots)
 
-(** [hashmap::HashMap::{0}::move_elements] *)
+(** [hashmap::HashMap::{0}::move_elements]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let hash_map_move_elements_fwd_back
   (t : Type0) (ntable : hash_map_t t) (slots : vec (list_t t)) (i : usize) :
   result ((hash_map_t t) & (vec (list_t t)))
   =
   hash_map_move_elements_loop_fwd_back t ntable slots i
 
-(** [hashmap::HashMap::{0}::try_resize] *)
+(** [hashmap::HashMap::{0}::try_resize]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let hash_map_try_resize_fwd_back
   (t : Type0) (self : hash_map_t t) : result (hash_map_t t) =
   let* max_usize = scalar_cast U32 Usize core_num_u32_max_c in
@@ -206,7 +214,8 @@ let hash_map_try_resize_fwd_back
       }
   else Return { self with hash_map_max_load_factor = (i, i0) }
 
-(** [hashmap::HashMap::{0}::insert] *)
+(** [hashmap::HashMap::{0}::insert]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let hash_map_insert_fwd_back
   (t : Type0) (self : hash_map_t t) (key : usize) (value : t) :
   result (hash_map_t t)
@@ -217,7 +226,7 @@ let hash_map_insert_fwd_back
   then hash_map_try_resize_fwd_back t self0
   else Return self0
 
-(** [hashmap::HashMap::{0}::contains_key_in_list] *)
+(** [hashmap::HashMap::{0}::contains_key_in_list]: loop 0: forward function *)
 let rec hash_map_contains_key_in_list_loop_fwd
   (t : Type0) (key : usize) (ls : list_t t) :
   Tot (result bool)
@@ -231,12 +240,12 @@ let rec hash_map_contains_key_in_list_loop_fwd
   | ListNil -> Return false
   end
 
-(** [hashmap::HashMap::{0}::contains_key_in_list] *)
+(** [hashmap::HashMap::{0}::contains_key_in_list]: forward function *)
 let hash_map_contains_key_in_list_fwd
   (t : Type0) (key : usize) (ls : list_t t) : result bool =
   hash_map_contains_key_in_list_loop_fwd t key ls
 
-(** [hashmap::HashMap::{0}::contains_key] *)
+(** [hashmap::HashMap::{0}::contains_key]: forward function *)
 let hash_map_contains_key_fwd
   (t : Type0) (self : hash_map_t t) (key : usize) : result bool =
   let* hash = hash_key_fwd key in
@@ -245,7 +254,7 @@ let hash_map_contains_key_fwd
   let* l = vec_index_fwd (list_t t) self.hash_map_slots hash_mod in
   hash_map_contains_key_in_list_fwd t key l
 
-(** [hashmap::HashMap::{0}::get_in_list] *)
+(** [hashmap::HashMap::{0}::get_in_list]: loop 0: forward function *)
 let rec hash_map_get_in_list_loop_fwd
   (t : Type0) (key : usize) (ls : list_t t) :
   Tot (result t) (decreases (hash_map_get_in_list_loop_decreases t key ls))
@@ -258,12 +267,12 @@ let rec hash_map_get_in_list_loop_fwd
   | ListNil -> Fail Failure
   end
 
-(** [hashmap::HashMap::{0}::get_in_list] *)
+(** [hashmap::HashMap::{0}::get_in_list]: forward function *)
 let hash_map_get_in_list_fwd
   (t : Type0) (key : usize) (ls : list_t t) : result t =
   hash_map_get_in_list_loop_fwd t key ls
 
-(** [hashmap::HashMap::{0}::get] *)
+(** [hashmap::HashMap::{0}::get]: forward function *)
 let hash_map_get_fwd
   (t : Type0) (self : hash_map_t t) (key : usize) : result t =
   let* hash = hash_key_fwd key in
@@ -272,7 +281,7 @@ let hash_map_get_fwd
   let* l = vec_index_fwd (list_t t) self.hash_map_slots hash_mod in
   hash_map_get_in_list_fwd t key l
 
-(** [hashmap::HashMap::{0}::get_mut_in_list] *)
+(** [hashmap::HashMap::{0}::get_mut_in_list]: loop 0: forward function *)
 let rec hash_map_get_mut_in_list_loop_fwd
   (t : Type0) (ls : list_t t) (key : usize) :
   Tot (result t) (decreases (hash_map_get_mut_in_list_loop_decreases t ls key))
@@ -285,12 +294,12 @@ let rec hash_map_get_mut_in_list_loop_fwd
   | ListNil -> Fail Failure
   end
 
-(** [hashmap::HashMap::{0}::get_mut_in_list] *)
+(** [hashmap::HashMap::{0}::get_mut_in_list]: forward function *)
 let hash_map_get_mut_in_list_fwd
   (t : Type0) (ls : list_t t) (key : usize) : result t =
   hash_map_get_mut_in_list_loop_fwd t ls key
 
-(** [hashmap::HashMap::{0}::get_mut_in_list] *)
+(** [hashmap::HashMap::{0}::get_mut_in_list]: loop 0: backward function 0 *)
 let rec hash_map_get_mut_in_list_loop_back
   (t : Type0) (ls : list_t t) (key : usize) (ret : t) :
   Tot (result (list_t t))
@@ -306,12 +315,12 @@ let rec hash_map_get_mut_in_list_loop_back
   | ListNil -> Fail Failure
   end
 
-(** [hashmap::HashMap::{0}::get_mut_in_list] *)
+(** [hashmap::HashMap::{0}::get_mut_in_list]: backward function 0 *)
 let hash_map_get_mut_in_list_back
   (t : Type0) (ls : list_t t) (key : usize) (ret : t) : result (list_t t) =
   hash_map_get_mut_in_list_loop_back t ls key ret
 
-(** [hashmap::HashMap::{0}::get_mut] *)
+(** [hashmap::HashMap::{0}::get_mut]: forward function *)
 let hash_map_get_mut_fwd
   (t : Type0) (self : hash_map_t t) (key : usize) : result t =
   let* hash = hash_key_fwd key in
@@ -320,7 +329,7 @@ let hash_map_get_mut_fwd
   let* l = vec_index_mut_fwd (list_t t) self.hash_map_slots hash_mod in
   hash_map_get_mut_in_list_fwd t l key
 
-(** [hashmap::HashMap::{0}::get_mut] *)
+(** [hashmap::HashMap::{0}::get_mut]: backward function 0 *)
 let hash_map_get_mut_back
   (t : Type0) (self : hash_map_t t) (key : usize) (ret : t) :
   result (hash_map_t t)
@@ -333,7 +342,7 @@ let hash_map_get_mut_back
   let* v = vec_index_mut_back (list_t t) self.hash_map_slots hash_mod l0 in
   Return { self with hash_map_slots = v }
 
-(** [hashmap::HashMap::{0}::remove_from_list] *)
+(** [hashmap::HashMap::{0}::remove_from_list]: loop 0: forward function *)
 let rec hash_map_remove_from_list_loop_fwd
   (t : Type0) (key : usize) (ls : list_t t) :
   Tot (result (option t))
@@ -352,12 +361,12 @@ let rec hash_map_remove_from_list_loop_fwd
   | ListNil -> Return None
   end
 
-(** [hashmap::HashMap::{0}::remove_from_list] *)
+(** [hashmap::HashMap::{0}::remove_from_list]: forward function *)
 let hash_map_remove_from_list_fwd
   (t : Type0) (key : usize) (ls : list_t t) : result (option t) =
   hash_map_remove_from_list_loop_fwd t key ls
 
-(** [hashmap::HashMap::{0}::remove_from_list] *)
+(** [hashmap::HashMap::{0}::remove_from_list]: loop 0: backward function 1 *)
 let rec hash_map_remove_from_list_loop_back
   (t : Type0) (key : usize) (ls : list_t t) :
   Tot (result (list_t t))
@@ -378,12 +387,12 @@ let rec hash_map_remove_from_list_loop_back
   | ListNil -> Return ListNil
   end
 
-(** [hashmap::HashMap::{0}::remove_from_list] *)
+(** [hashmap::HashMap::{0}::remove_from_list]: backward function 1 *)
 let hash_map_remove_from_list_back
   (t : Type0) (key : usize) (ls : list_t t) : result (list_t t) =
   hash_map_remove_from_list_loop_back t key ls
 
-(** [hashmap::HashMap::{0}::remove] *)
+(** [hashmap::HashMap::{0}::remove]: forward function *)
 let hash_map_remove_fwd
   (t : Type0) (self : hash_map_t t) (key : usize) : result (option t) =
   let* hash = hash_key_fwd key in
@@ -397,7 +406,7 @@ let hash_map_remove_fwd
     let* _ = usize_sub self.hash_map_num_entries 1 in Return (Some x0)
   end
 
-(** [hashmap::HashMap::{0}::remove] *)
+(** [hashmap::HashMap::{0}::remove]: backward function 0 *)
 let hash_map_remove_back
   (t : Type0) (self : hash_map_t t) (key : usize) : result (hash_map_t t) =
   let* hash = hash_key_fwd key in
@@ -417,7 +426,7 @@ let hash_map_remove_back
     Return { self with hash_map_num_entries = i0; hash_map_slots = v }
   end
 
-(** [hashmap::test1] *)
+(** [hashmap::test1]: forward function *)
 let test1_fwd : result unit =
   let* hm = hash_map_new_fwd u64 in
   let* hm0 = hash_map_insert_fwd_back u64 hm 0 42 in
diff --git a/tests/fstar/hashmap_on_disk/HashmapMain.Funs.fst b/tests/fstar/hashmap_on_disk/HashmapMain.Funs.fst
index e8cd54c1..f6d9c8cf 100644
--- a/tests/fstar/hashmap_on_disk/HashmapMain.Funs.fst
+++ b/tests/fstar/hashmap_on_disk/HashmapMain.Funs.fst
@@ -8,11 +8,11 @@ include HashmapMain.Clauses
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [hashmap_main::hashmap::hash_key] *)
+(** [hashmap_main::hashmap::hash_key]: forward function *)
 let hashmap_hash_key_fwd (k : usize) : result usize =
   Return k
 
-(** [hashmap_main::hashmap::HashMap::{0}::allocate_slots] *)
+(** [hashmap_main::hashmap::HashMap::{0}::allocate_slots]: loop 0: forward function *)
 let rec hashmap_hash_map_allocate_slots_loop_fwd
   (t : Type0) (slots : vec (hashmap_list_t t)) (n : usize) :
   Tot (result (vec (hashmap_list_t t)))
@@ -25,14 +25,14 @@ let rec hashmap_hash_map_allocate_slots_loop_fwd
     hashmap_hash_map_allocate_slots_loop_fwd t slots0 n0
   else Return slots
 
-(** [hashmap_main::hashmap::HashMap::{0}::allocate_slots] *)
+(** [hashmap_main::hashmap::HashMap::{0}::allocate_slots]: forward function *)
 let hashmap_hash_map_allocate_slots_fwd
   (t : Type0) (slots : vec (hashmap_list_t t)) (n : usize) :
   result (vec (hashmap_list_t t))
   =
   hashmap_hash_map_allocate_slots_loop_fwd t slots n
 
-(** [hashmap_main::hashmap::HashMap::{0}::new_with_capacity] *)
+(** [hashmap_main::hashmap::HashMap::{0}::new_with_capacity]: forward function *)
 let hashmap_hash_map_new_with_capacity_fwd
   (t : Type0) (capacity : usize) (max_load_dividend : usize)
   (max_load_divisor : usize) :
@@ -50,11 +50,12 @@ let hashmap_hash_map_new_with_capacity_fwd
       hashmap_hash_map_slots = slots
     }
 
-(** [hashmap_main::hashmap::HashMap::{0}::new] *)
+(** [hashmap_main::hashmap::HashMap::{0}::new]: forward function *)
 let hashmap_hash_map_new_fwd (t : Type0) : result (hashmap_hash_map_t t) =
   hashmap_hash_map_new_with_capacity_fwd t 32 4 5
 
-(** [hashmap_main::hashmap::HashMap::{0}::clear] *)
+(** [hashmap_main::hashmap::HashMap::{0}::clear]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let rec hashmap_hash_map_clear_loop_fwd_back
   (t : Type0) (slots : vec (hashmap_list_t t)) (i : usize) :
   Tot (result (vec (hashmap_list_t t)))
@@ -69,7 +70,8 @@ let rec hashmap_hash_map_clear_loop_fwd_back
     hashmap_hash_map_clear_loop_fwd_back t slots0 i1
   else Return slots
 
-(** [hashmap_main::hashmap::HashMap::{0}::clear] *)
+(** [hashmap_main::hashmap::HashMap::{0}::clear]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let hashmap_hash_map_clear_fwd_back
   (t : Type0) (self : hashmap_hash_map_t t) : result (hashmap_hash_map_t t) =
   let* v = hashmap_hash_map_clear_loop_fwd_back t self.hashmap_hash_map_slots 0
@@ -77,12 +79,12 @@ let hashmap_hash_map_clear_fwd_back
   Return
     { self with hashmap_hash_map_num_entries = 0; hashmap_hash_map_slots = v }
 
-(** [hashmap_main::hashmap::HashMap::{0}::len] *)
+(** [hashmap_main::hashmap::HashMap::{0}::len]: forward function *)
 let hashmap_hash_map_len_fwd
   (t : Type0) (self : hashmap_hash_map_t t) : result usize =
   Return self.hashmap_hash_map_num_entries
 
-(** [hashmap_main::hashmap::HashMap::{0}::insert_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::insert_in_list]: loop 0: forward function *)
 let rec hashmap_hash_map_insert_in_list_loop_fwd
   (t : Type0) (key : usize) (value : t) (ls : hashmap_list_t t) :
   Tot (result bool)
@@ -96,12 +98,12 @@ let rec hashmap_hash_map_insert_in_list_loop_fwd
   | HashmapListNil -> Return true
   end
 
-(** [hashmap_main::hashmap::HashMap::{0}::insert_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::insert_in_list]: forward function *)
 let hashmap_hash_map_insert_in_list_fwd
   (t : Type0) (key : usize) (value : t) (ls : hashmap_list_t t) : result bool =
   hashmap_hash_map_insert_in_list_loop_fwd t key value ls
 
-(** [hashmap_main::hashmap::HashMap::{0}::insert_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::insert_in_list]: loop 0: backward function 0 *)
 let rec hashmap_hash_map_insert_in_list_loop_back
   (t : Type0) (key : usize) (value : t) (ls : hashmap_list_t t) :
   Tot (result (hashmap_list_t t))
@@ -118,14 +120,15 @@ let rec hashmap_hash_map_insert_in_list_loop_back
     let l = HashmapListNil in Return (HashmapListCons key value l)
   end
 
-(** [hashmap_main::hashmap::HashMap::{0}::insert_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::insert_in_list]: backward function 0 *)
 let hashmap_hash_map_insert_in_list_back
   (t : Type0) (key : usize) (value : t) (ls : hashmap_list_t t) :
   result (hashmap_list_t t)
   =
   hashmap_hash_map_insert_in_list_loop_back t key value ls
 
-(** [hashmap_main::hashmap::HashMap::{0}::insert_no_resize] *)
+(** [hashmap_main::hashmap::HashMap::{0}::insert_no_resize]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let hashmap_hash_map_insert_no_resize_fwd_back
   (t : Type0) (self : hashmap_hash_map_t t) (key : usize) (value : t) :
   result (hashmap_hash_map_t t)
@@ -158,7 +161,8 @@ let hashmap_hash_map_insert_no_resize_fwd_back
 let core_num_u32_max_body : result u32 = Return 4294967295
 let core_num_u32_max_c : u32 = eval_global core_num_u32_max_body
 
-(** [hashmap_main::hashmap::HashMap::{0}::move_elements_from_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::move_elements_from_list]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let rec hashmap_hash_map_move_elements_from_list_loop_fwd_back
   (t : Type0) (ntable : hashmap_hash_map_t t) (ls : hashmap_list_t t) :
   Tot (result (hashmap_hash_map_t t))
@@ -172,14 +176,16 @@ let rec hashmap_hash_map_move_elements_from_list_loop_fwd_back
   | HashmapListNil -> Return ntable
   end
 
-(** [hashmap_main::hashmap::HashMap::{0}::move_elements_from_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::move_elements_from_list]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let hashmap_hash_map_move_elements_from_list_fwd_back
   (t : Type0) (ntable : hashmap_hash_map_t t) (ls : hashmap_list_t t) :
   result (hashmap_hash_map_t t)
   =
   hashmap_hash_map_move_elements_from_list_loop_fwd_back t ntable ls
 
-(** [hashmap_main::hashmap::HashMap::{0}::move_elements] *)
+(** [hashmap_main::hashmap::HashMap::{0}::move_elements]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let rec hashmap_hash_map_move_elements_loop_fwd_back
   (t : Type0) (ntable : hashmap_hash_map_t t) (slots : vec (hashmap_list_t t))
   (i : usize) :
@@ -199,7 +205,8 @@ let rec hashmap_hash_map_move_elements_loop_fwd_back
     hashmap_hash_map_move_elements_loop_fwd_back t ntable0 slots0 i1
   else Return (ntable, slots)
 
-(** [hashmap_main::hashmap::HashMap::{0}::move_elements] *)
+(** [hashmap_main::hashmap::HashMap::{0}::move_elements]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let hashmap_hash_map_move_elements_fwd_back
   (t : Type0) (ntable : hashmap_hash_map_t t) (slots : vec (hashmap_list_t t))
   (i : usize) :
@@ -207,7 +214,8 @@ let hashmap_hash_map_move_elements_fwd_back
   =
   hashmap_hash_map_move_elements_loop_fwd_back t ntable slots i
 
-(** [hashmap_main::hashmap::HashMap::{0}::try_resize] *)
+(** [hashmap_main::hashmap::HashMap::{0}::try_resize]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let hashmap_hash_map_try_resize_fwd_back
   (t : Type0) (self : hashmap_hash_map_t t) : result (hashmap_hash_map_t t) =
   let* max_usize = scalar_cast U32 Usize core_num_u32_max_c in
@@ -231,7 +239,8 @@ let hashmap_hash_map_try_resize_fwd_back
       }
   else Return { self with hashmap_hash_map_max_load_factor = (i, i0) }
 
-(** [hashmap_main::hashmap::HashMap::{0}::insert] *)
+(** [hashmap_main::hashmap::HashMap::{0}::insert]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let hashmap_hash_map_insert_fwd_back
   (t : Type0) (self : hashmap_hash_map_t t) (key : usize) (value : t) :
   result (hashmap_hash_map_t t)
@@ -242,7 +251,7 @@ let hashmap_hash_map_insert_fwd_back
   then hashmap_hash_map_try_resize_fwd_back t self0
   else Return self0
 
-(** [hashmap_main::hashmap::HashMap::{0}::contains_key_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::contains_key_in_list]: loop 0: forward function *)
 let rec hashmap_hash_map_contains_key_in_list_loop_fwd
   (t : Type0) (key : usize) (ls : hashmap_list_t t) :
   Tot (result bool)
@@ -256,12 +265,12 @@ let rec hashmap_hash_map_contains_key_in_list_loop_fwd
   | HashmapListNil -> Return false
   end
 
-(** [hashmap_main::hashmap::HashMap::{0}::contains_key_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::contains_key_in_list]: forward function *)
 let hashmap_hash_map_contains_key_in_list_fwd
   (t : Type0) (key : usize) (ls : hashmap_list_t t) : result bool =
   hashmap_hash_map_contains_key_in_list_loop_fwd t key ls
 
-(** [hashmap_main::hashmap::HashMap::{0}::contains_key] *)
+(** [hashmap_main::hashmap::HashMap::{0}::contains_key]: forward function *)
 let hashmap_hash_map_contains_key_fwd
   (t : Type0) (self : hashmap_hash_map_t t) (key : usize) : result bool =
   let* hash = hashmap_hash_key_fwd key in
@@ -271,7 +280,7 @@ let hashmap_hash_map_contains_key_fwd
     vec_index_fwd (hashmap_list_t t) self.hashmap_hash_map_slots hash_mod in
   hashmap_hash_map_contains_key_in_list_fwd t key l
 
-(** [hashmap_main::hashmap::HashMap::{0}::get_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::get_in_list]: loop 0: forward function *)
 let rec hashmap_hash_map_get_in_list_loop_fwd
   (t : Type0) (key : usize) (ls : hashmap_list_t t) :
   Tot (result t)
@@ -285,12 +294,12 @@ let rec hashmap_hash_map_get_in_list_loop_fwd
   | HashmapListNil -> Fail Failure
   end
 
-(** [hashmap_main::hashmap::HashMap::{0}::get_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::get_in_list]: forward function *)
 let hashmap_hash_map_get_in_list_fwd
   (t : Type0) (key : usize) (ls : hashmap_list_t t) : result t =
   hashmap_hash_map_get_in_list_loop_fwd t key ls
 
-(** [hashmap_main::hashmap::HashMap::{0}::get] *)
+(** [hashmap_main::hashmap::HashMap::{0}::get]: forward function *)
 let hashmap_hash_map_get_fwd
   (t : Type0) (self : hashmap_hash_map_t t) (key : usize) : result t =
   let* hash = hashmap_hash_key_fwd key in
@@ -300,7 +309,7 @@ let hashmap_hash_map_get_fwd
     vec_index_fwd (hashmap_list_t t) self.hashmap_hash_map_slots hash_mod in
   hashmap_hash_map_get_in_list_fwd t key l
 
-(** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list]: loop 0: forward function *)
 let rec hashmap_hash_map_get_mut_in_list_loop_fwd
   (t : Type0) (ls : hashmap_list_t t) (key : usize) :
   Tot (result t)
@@ -314,12 +323,12 @@ let rec hashmap_hash_map_get_mut_in_list_loop_fwd
   | HashmapListNil -> Fail Failure
   end
 
-(** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list]: forward function *)
 let hashmap_hash_map_get_mut_in_list_fwd
   (t : Type0) (ls : hashmap_list_t t) (key : usize) : result t =
   hashmap_hash_map_get_mut_in_list_loop_fwd t ls key
 
-(** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list]: loop 0: backward function 0 *)
 let rec hashmap_hash_map_get_mut_in_list_loop_back
   (t : Type0) (ls : hashmap_list_t t) (key : usize) (ret : t) :
   Tot (result (hashmap_list_t t))
@@ -335,14 +344,14 @@ let rec hashmap_hash_map_get_mut_in_list_loop_back
   | HashmapListNil -> Fail Failure
   end
 
-(** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list]: backward function 0 *)
 let hashmap_hash_map_get_mut_in_list_back
   (t : Type0) (ls : hashmap_list_t t) (key : usize) (ret : t) :
   result (hashmap_list_t t)
   =
   hashmap_hash_map_get_mut_in_list_loop_back t ls key ret
 
-(** [hashmap_main::hashmap::HashMap::{0}::get_mut] *)
+(** [hashmap_main::hashmap::HashMap::{0}::get_mut]: forward function *)
 let hashmap_hash_map_get_mut_fwd
   (t : Type0) (self : hashmap_hash_map_t t) (key : usize) : result t =
   let* hash = hashmap_hash_key_fwd key in
@@ -353,7 +362,7 @@ let hashmap_hash_map_get_mut_fwd
     in
   hashmap_hash_map_get_mut_in_list_fwd t l key
 
-(** [hashmap_main::hashmap::HashMap::{0}::get_mut] *)
+(** [hashmap_main::hashmap::HashMap::{0}::get_mut]: backward function 0 *)
 let hashmap_hash_map_get_mut_back
   (t : Type0) (self : hashmap_hash_map_t t) (key : usize) (ret : t) :
   result (hashmap_hash_map_t t)
@@ -370,7 +379,7 @@ let hashmap_hash_map_get_mut_back
       l0 in
   Return { self with hashmap_hash_map_slots = v }
 
-(** [hashmap_main::hashmap::HashMap::{0}::remove_from_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::remove_from_list]: loop 0: forward function *)
 let rec hashmap_hash_map_remove_from_list_loop_fwd
   (t : Type0) (key : usize) (ls : hashmap_list_t t) :
   Tot (result (option t))
@@ -391,12 +400,12 @@ let rec hashmap_hash_map_remove_from_list_loop_fwd
   | HashmapListNil -> Return None
   end
 
-(** [hashmap_main::hashmap::HashMap::{0}::remove_from_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::remove_from_list]: forward function *)
 let hashmap_hash_map_remove_from_list_fwd
   (t : Type0) (key : usize) (ls : hashmap_list_t t) : result (option t) =
   hashmap_hash_map_remove_from_list_loop_fwd t key ls
 
-(** [hashmap_main::hashmap::HashMap::{0}::remove_from_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::remove_from_list]: loop 0: backward function 1 *)
 let rec hashmap_hash_map_remove_from_list_loop_back
   (t : Type0) (key : usize) (ls : hashmap_list_t t) :
   Tot (result (hashmap_list_t t))
@@ -419,14 +428,14 @@ let rec hashmap_hash_map_remove_from_list_loop_back
   | HashmapListNil -> Return HashmapListNil
   end
 
-(** [hashmap_main::hashmap::HashMap::{0}::remove_from_list] *)
+(** [hashmap_main::hashmap::HashMap::{0}::remove_from_list]: backward function 1 *)
 let hashmap_hash_map_remove_from_list_back
   (t : Type0) (key : usize) (ls : hashmap_list_t t) :
   result (hashmap_list_t t)
   =
   hashmap_hash_map_remove_from_list_loop_back t key ls
 
-(** [hashmap_main::hashmap::HashMap::{0}::remove] *)
+(** [hashmap_main::hashmap::HashMap::{0}::remove]: forward function *)
 let hashmap_hash_map_remove_fwd
   (t : Type0) (self : hashmap_hash_map_t t) (key : usize) : result (option t) =
   let* hash = hashmap_hash_key_fwd key in
@@ -442,7 +451,7 @@ let hashmap_hash_map_remove_fwd
     let* _ = usize_sub self.hashmap_hash_map_num_entries 1 in Return (Some x0)
   end
 
-(** [hashmap_main::hashmap::HashMap::{0}::remove] *)
+(** [hashmap_main::hashmap::HashMap::{0}::remove]: backward function 0 *)
 let hashmap_hash_map_remove_back
   (t : Type0) (self : hashmap_hash_map_t t) (key : usize) :
   result (hashmap_hash_map_t t)
@@ -472,7 +481,7 @@ let hashmap_hash_map_remove_back
       }
   end
 
-(** [hashmap_main::hashmap::test1] *)
+(** [hashmap_main::hashmap::test1]: forward function *)
 let hashmap_test1_fwd : result unit =
   let* hm = hashmap_hash_map_new_fwd u64 in
   let* hm0 = hashmap_hash_map_insert_fwd_back u64 hm 0 42 in
@@ -511,7 +520,7 @@ let hashmap_test1_fwd : result unit =
 (** Unit test for [hashmap_main::hashmap::test1] *)
 let _ = assert_norm (hashmap_test1_fwd = Return ())
 
-(** [hashmap_main::insert_on_disk] *)
+(** [hashmap_main::insert_on_disk]: forward function *)
 let insert_on_disk_fwd
   (key : usize) (value : u64) (st : state) : result (state & unit) =
   let* (st0, hm) = hashmap_utils_deserialize_fwd st in
@@ -519,7 +528,7 @@ let insert_on_disk_fwd
   let* (st1, _) = hashmap_utils_serialize_fwd hm0 st0 in
   Return (st1, ())
 
-(** [hashmap_main::main] *)
+(** [hashmap_main::main]: forward function *)
 let main_fwd : result unit =
   Return ()
 
diff --git a/tests/fstar/hashmap_on_disk/HashmapMain.Opaque.fsti b/tests/fstar/hashmap_on_disk/HashmapMain.Opaque.fsti
index 6e6a0e2b..78a6c3ba 100644
--- a/tests/fstar/hashmap_on_disk/HashmapMain.Opaque.fsti
+++ b/tests/fstar/hashmap_on_disk/HashmapMain.Opaque.fsti
@@ -6,11 +6,11 @@ include HashmapMain.Types
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [hashmap_main::hashmap_utils::deserialize] *)
+(** [hashmap_main::hashmap_utils::deserialize]: forward function *)
 val hashmap_utils_deserialize_fwd
   : state -> result (state & (hashmap_hash_map_t u64))
 
-(** [hashmap_main::hashmap_utils::serialize] *)
+(** [hashmap_main::hashmap_utils::serialize]: forward function *)
 val hashmap_utils_serialize_fwd
   : hashmap_hash_map_t u64 -> state -> result (state & unit)
 
diff --git a/tests/fstar/misc/Constants.fst b/tests/fstar/misc/Constants.fst
index bf2f0b1b..aae997fa 100644
--- a/tests/fstar/misc/Constants.fst
+++ b/tests/fstar/misc/Constants.fst
@@ -21,7 +21,7 @@ let x1_c : u32 = eval_global x1_body
 let x2_body : result u32 = Return 3
 let x2_c : u32 = eval_global x2_body
 
-(** [constants::incr] *)
+(** [constants::incr]: forward function *)
 let incr_fwd (n : u32) : result u32 =
   u32_add n 1
 
@@ -29,14 +29,14 @@ let incr_fwd (n : u32) : result u32 =
 let x3_body : result u32 = incr_fwd 32
 let x3_c : u32 = eval_global x3_body
 
-(** [constants::mk_pair0] *)
+(** [constants::mk_pair0]: forward function *)
 let mk_pair0_fwd (x : u32) (y : u32) : result (u32 & u32) =
   Return (x, y)
 
 (** [constants::Pair] *)
 type pair_t (t1 t2 : Type0) = { pair_x : t1; pair_y : t2; }
 
-(** [constants::mk_pair1] *)
+(** [constants::mk_pair1]: forward function *)
 let mk_pair1_fwd (x : u32) (y : u32) : result (pair_t u32 u32) =
   Return { pair_x = x; pair_y = y }
 
@@ -59,7 +59,7 @@ let p3_c : pair_t u32 u32 = eval_global p3_body
 (** [constants::Wrap] *)
 type wrap_t (t : Type0) = { wrap_val : t; }
 
-(** [constants::Wrap::{0}::new] *)
+(** [constants::Wrap::{0}::new]: forward function *)
 let wrap_new_fwd (t : Type0) (val0 : t) : result (wrap_t t) =
   Return { wrap_val = val0 }
 
@@ -67,7 +67,7 @@ let wrap_new_fwd (t : Type0) (val0 : t) : result (wrap_t t) =
 let y_body : result (wrap_t i32) = wrap_new_fwd i32 2
 let y_c : wrap_t i32 = eval_global y_body
 
-(** [constants::unwrap_y] *)
+(** [constants::unwrap_y]: forward function *)
 let unwrap_y_fwd : result i32 =
   Return y_c.wrap_val
 
@@ -79,11 +79,11 @@ let yval_c : i32 = eval_global yval_body
 let get_z1_z1_body : result i32 = Return 3
 let get_z1_z1_c : i32 = eval_global get_z1_z1_body
 
-(** [constants::get_z1] *)
+(** [constants::get_z1]: forward function *)
 let get_z1_fwd : result i32 =
   Return get_z1_z1_c
 
-(** [constants::add] *)
+(** [constants::add]: forward function *)
 let add_fwd (a : i32) (b : i32) : result i32 =
   i32_add a b
 
@@ -99,7 +99,7 @@ let q2_c : i32 = eval_global q2_body
 let q3_body : result i32 = add_fwd q2_c 3
 let q3_c : i32 = eval_global q3_body
 
-(** [constants::get_z2] *)
+(** [constants::get_z2]: forward function *)
 let get_z2_fwd : result i32 =
   let* i = get_z1_fwd in let* i0 = add_fwd i q3_c in add_fwd q1_c i0
 
diff --git a/tests/fstar/misc/External.Funs.fst b/tests/fstar/misc/External.Funs.fst
index f70a9fc6..f118a2cf 100644
--- a/tests/fstar/misc/External.Funs.fst
+++ b/tests/fstar/misc/External.Funs.fst
@@ -7,14 +7,14 @@ include External.Opaque
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [external::swap] *)
+(** [external::swap]: forward function *)
 let swap_fwd (t : Type0) (x : t) (y : t) (st : state) : result (state & unit) =
   let* (st0, _) = core_mem_swap_fwd t x y st in
   let* (st1, _) = core_mem_swap_back0 t x y st st0 in
   let* (st2, _) = core_mem_swap_back1 t x y st st1 in
   Return (st2, ())
 
-(** [external::swap] *)
+(** [external::swap]: backward function 0 *)
 let swap_back
   (t : Type0) (x : t) (y : t) (st : state) (st0 : state) :
   result (state & (t & t))
@@ -24,20 +24,20 @@ let swap_back
   let* (_, y0) = core_mem_swap_back1 t x y st st2 in
   Return (st0, (x0, y0))
 
-(** [external::test_new_non_zero_u32] *)
+(** [external::test_new_non_zero_u32]: forward function *)
 let test_new_non_zero_u32_fwd
   (x : u32) (st : state) : result (state & core_num_nonzero_non_zero_u32_t) =
   let* (st0, opt) = core_num_nonzero_non_zero_u32_new_fwd x st in
   core_option_option_unwrap_fwd core_num_nonzero_non_zero_u32_t opt st0
 
-(** [external::test_vec] *)
+(** [external::test_vec]: forward function *)
 let test_vec_fwd : result unit =
   let v = vec_new u32 in let* _ = vec_push_back u32 v 0 in Return ()
 
 (** Unit test for [external::test_vec] *)
 let _ = assert_norm (test_vec_fwd = Return ())
 
-(** [external::custom_swap] *)
+(** [external::custom_swap]: forward function *)
 let custom_swap_fwd
   (t : Type0) (x : t) (y : t) (st : state) : result (state & t) =
   let* (st0, _) = core_mem_swap_fwd t x y st in
@@ -45,7 +45,7 @@ let custom_swap_fwd
   let* (st2, _) = core_mem_swap_back1 t x y st st1 in
   Return (st2, x0)
 
-(** [external::custom_swap] *)
+(** [external::custom_swap]: backward function 0 *)
 let custom_swap_back
   (t : Type0) (x : t) (y : t) (st : state) (ret : t) (st0 : state) :
   result (state & (t & t))
@@ -55,19 +55,19 @@ let custom_swap_back
   let* (_, y0) = core_mem_swap_back1 t x y st st2 in
   Return (st0, (ret, y0))
 
-(** [external::test_custom_swap] *)
+(** [external::test_custom_swap]: forward function *)
 let test_custom_swap_fwd
   (x : u32) (y : u32) (st : state) : result (state & unit) =
   let* (st0, _) = custom_swap_fwd u32 x y st in Return (st0, ())
 
-(** [external::test_custom_swap] *)
+(** [external::test_custom_swap]: backward function 0 *)
 let test_custom_swap_back
   (x : u32) (y : u32) (st : state) (st0 : state) :
   result (state & (u32 & u32))
   =
   custom_swap_back u32 x y st 1 st0
 
-(** [external::test_swap_non_zero] *)
+(** [external::test_swap_non_zero]: forward function *)
 let test_swap_non_zero_fwd (x : u32) (st : state) : result (state & u32) =
   let* (st0, _) = swap_fwd u32 x 0 st in
   let* (st1, (x0, _)) = swap_back u32 x 0 st st0 in
diff --git a/tests/fstar/misc/External.Opaque.fsti b/tests/fstar/misc/External.Opaque.fsti
index 356d5fc4..2e19f767 100644
--- a/tests/fstar/misc/External.Opaque.fsti
+++ b/tests/fstar/misc/External.Opaque.fsti
@@ -6,22 +6,22 @@ include External.Types
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [core::mem::swap] *)
+(** [core::mem::swap]: forward function *)
 val core_mem_swap_fwd (t : Type0) : t -> t -> state -> result (state & unit)
 
-(** [core::mem::swap] *)
+(** [core::mem::swap]: backward function 0 *)
 val core_mem_swap_back0
   (t : Type0) : t -> t -> state -> state -> result (state & t)
 
-(** [core::mem::swap] *)
+(** [core::mem::swap]: backward function 1 *)
 val core_mem_swap_back1
   (t : Type0) : t -> t -> state -> state -> result (state & t)
 
-(** [core::num::nonzero::NonZeroU32::{14}::new] *)
+(** [core::num::nonzero::NonZeroU32::{14}::new]: forward function *)
 val core_num_nonzero_non_zero_u32_new_fwd
   : u32 -> state -> result (state & (option core_num_nonzero_non_zero_u32_t))
 
-(** [core::option::Option::{0}::unwrap] *)
+(** [core::option::Option::{0}::unwrap]: forward function *)
 val core_option_option_unwrap_fwd
   (t : Type0) : option t -> state -> result (state & t)
 
diff --git a/tests/fstar/misc/Loops.Funs.fst b/tests/fstar/misc/Loops.Funs.fst
index 7fe175e5..9a80f415 100644
--- a/tests/fstar/misc/Loops.Funs.fst
+++ b/tests/fstar/misc/Loops.Funs.fst
@@ -7,7 +7,7 @@ include Loops.Clauses
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [loops::sum] *)
+(** [loops::sum]: loop 0: forward function *)
 let rec sum_loop_fwd
   (max : u32) (i : u32) (s : u32) :
   Tot (result u32) (decreases (sum_loop_decreases max i s))
@@ -16,11 +16,11 @@ let rec sum_loop_fwd
   then let* s0 = u32_add s i in let* i0 = u32_add i 1 in sum_loop_fwd max i0 s0
   else u32_mul s 2
 
-(** [loops::sum] *)
+(** [loops::sum]: forward function *)
 let sum_fwd (max : u32) : result u32 =
   sum_loop_fwd max 0 0
 
-(** [loops::sum_with_mut_borrows] *)
+(** [loops::sum_with_mut_borrows]: loop 0: forward function *)
 let rec sum_with_mut_borrows_loop_fwd
   (max : u32) (mi : u32) (ms : u32) :
   Tot (result u32) (decreases (sum_with_mut_borrows_loop_decreases max mi ms))
@@ -32,11 +32,11 @@ let rec sum_with_mut_borrows_loop_fwd
     sum_with_mut_borrows_loop_fwd max mi0 ms0
   else u32_mul ms 2
 
-(** [loops::sum_with_mut_borrows] *)
+(** [loops::sum_with_mut_borrows]: forward function *)
 let sum_with_mut_borrows_fwd (max : u32) : result u32 =
   sum_with_mut_borrows_loop_fwd max 0 0
 
-(** [loops::sum_with_shared_borrows] *)
+(** [loops::sum_with_shared_borrows]: loop 0: forward function *)
 let rec sum_with_shared_borrows_loop_fwd
   (max : u32) (i : u32) (s : u32) :
   Tot (result u32) (decreases (sum_with_shared_borrows_loop_decreases max i s))
@@ -48,11 +48,12 @@ let rec sum_with_shared_borrows_loop_fwd
     sum_with_shared_borrows_loop_fwd max i0 s0
   else u32_mul s 2
 
-(** [loops::sum_with_shared_borrows] *)
+(** [loops::sum_with_shared_borrows]: forward function *)
 let sum_with_shared_borrows_fwd (max : u32) : result u32 =
   sum_with_shared_borrows_loop_fwd max 0 0
 
-(** [loops::clear] *)
+(** [loops::clear]: loop 0: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let rec clear_loop_fwd_back
   (v : vec u32) (i : usize) :
   Tot (result (vec u32)) (decreases (clear_loop_decreases v i))
@@ -65,11 +66,12 @@ let rec clear_loop_fwd_back
     clear_loop_fwd_back v0 i1
   else Return v
 
-(** [loops::clear] *)
+(** [loops::clear]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let clear_fwd_back (v : vec u32) : result (vec u32) =
   clear_loop_fwd_back v 0
 
-(** [loops::list_mem] *)
+(** [loops::list_mem]: loop 0: forward function *)
 let rec list_mem_loop_fwd
   (x : u32) (ls : list_t u32) :
   Tot (result bool) (decreases (list_mem_loop_decreases x ls))
@@ -79,11 +81,11 @@ let rec list_mem_loop_fwd
   | ListNil -> Return false
   end
 
-(** [loops::list_mem] *)
+(** [loops::list_mem]: forward function *)
 let list_mem_fwd (x : u32) (ls : list_t u32) : result bool =
   list_mem_loop_fwd x ls
 
-(** [loops::list_nth_mut_loop] *)
+(** [loops::list_nth_mut_loop]: loop 0: forward function *)
 let rec list_nth_mut_loop_loop_fwd
   (t : Type0) (ls : list_t t) (i : u32) :
   Tot (result t) (decreases (list_nth_mut_loop_loop_decreases t ls i))
@@ -96,11 +98,11 @@ let rec list_nth_mut_loop_loop_fwd
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_loop] *)
+(** [loops::list_nth_mut_loop]: forward function *)
 let list_nth_mut_loop_fwd (t : Type0) (ls : list_t t) (i : u32) : result t =
   list_nth_mut_loop_loop_fwd t ls i
 
-(** [loops::list_nth_mut_loop] *)
+(** [loops::list_nth_mut_loop]: loop 0: backward function 0 *)
 let rec list_nth_mut_loop_loop_back
   (t : Type0) (ls : list_t t) (i : u32) (ret : t) :
   Tot (result (list_t t)) (decreases (list_nth_mut_loop_loop_decreases t ls i))
@@ -116,12 +118,12 @@ let rec list_nth_mut_loop_loop_back
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_loop] *)
+(** [loops::list_nth_mut_loop]: backward function 0 *)
 let list_nth_mut_loop_back
   (t : Type0) (ls : list_t t) (i : u32) (ret : t) : result (list_t t) =
   list_nth_mut_loop_loop_back t ls i ret
 
-(** [loops::list_nth_shared_loop] *)
+(** [loops::list_nth_shared_loop]: loop 0: forward function *)
 let rec list_nth_shared_loop_loop_fwd
   (t : Type0) (ls : list_t t) (i : u32) :
   Tot (result t) (decreases (list_nth_shared_loop_loop_decreases t ls i))
@@ -134,11 +136,11 @@ let rec list_nth_shared_loop_loop_fwd
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_shared_loop] *)
+(** [loops::list_nth_shared_loop]: forward function *)
 let list_nth_shared_loop_fwd (t : Type0) (ls : list_t t) (i : u32) : result t =
   list_nth_shared_loop_loop_fwd t ls i
 
-(** [loops::get_elem_mut] *)
+(** [loops::get_elem_mut]: loop 0: forward function *)
 let rec get_elem_mut_loop_fwd
   (x : usize) (ls : list_t usize) :
   Tot (result usize) (decreases (get_elem_mut_loop_decreases x ls))
@@ -148,12 +150,12 @@ let rec get_elem_mut_loop_fwd
   | ListNil -> Fail Failure
   end
 
-(** [loops::get_elem_mut] *)
+(** [loops::get_elem_mut]: forward function *)
 let get_elem_mut_fwd (slots : vec (list_t usize)) (x : usize) : result usize =
   let* l = vec_index_mut_fwd (list_t usize) slots 0 in
   get_elem_mut_loop_fwd x l
 
-(** [loops::get_elem_mut] *)
+(** [loops::get_elem_mut]: loop 0: backward function 0 *)
 let rec get_elem_mut_loop_back
   (x : usize) (ls : list_t usize) (ret : usize) :
   Tot (result (list_t usize)) (decreases (get_elem_mut_loop_decreases x ls))
@@ -166,7 +168,7 @@ let rec get_elem_mut_loop_back
   | ListNil -> Fail Failure
   end
 
-(** [loops::get_elem_mut] *)
+(** [loops::get_elem_mut]: backward function 0 *)
 let get_elem_mut_back
   (slots : vec (list_t usize)) (x : usize) (ret : usize) :
   result (vec (list_t usize))
@@ -175,7 +177,7 @@ let get_elem_mut_back
   let* l0 = get_elem_mut_loop_back x l ret in
   vec_index_mut_back (list_t usize) slots 0 l0
 
-(** [loops::get_elem_shared] *)
+(** [loops::get_elem_shared]: loop 0: forward function *)
 let rec get_elem_shared_loop_fwd
   (x : usize) (ls : list_t usize) :
   Tot (result usize) (decreases (get_elem_shared_loop_decreases x ls))
@@ -185,25 +187,25 @@ let rec get_elem_shared_loop_fwd
   | ListNil -> Fail Failure
   end
 
-(** [loops::get_elem_shared] *)
+(** [loops::get_elem_shared]: forward function *)
 let get_elem_shared_fwd
   (slots : vec (list_t usize)) (x : usize) : result usize =
   let* l = vec_index_fwd (list_t usize) slots 0 in get_elem_shared_loop_fwd x l
 
-(** [loops::id_mut] *)
+(** [loops::id_mut]: forward function *)
 let id_mut_fwd (t : Type0) (ls : list_t t) : result (list_t t) =
   Return ls
 
-(** [loops::id_mut] *)
+(** [loops::id_mut]: backward function 0 *)
 let id_mut_back
   (t : Type0) (ls : list_t t) (ret : list_t t) : result (list_t t) =
   Return ret
 
-(** [loops::id_shared] *)
+(** [loops::id_shared]: forward function *)
 let id_shared_fwd (t : Type0) (ls : list_t t) : result (list_t t) =
   Return ls
 
-(** [loops::list_nth_mut_loop_with_id] *)
+(** [loops::list_nth_mut_loop_with_id]: loop 0: forward function *)
 let rec list_nth_mut_loop_with_id_loop_fwd
   (t : Type0) (i : u32) (ls : list_t t) :
   Tot (result t) (decreases (list_nth_mut_loop_with_id_loop_decreases t i ls))
@@ -216,12 +218,12 @@ let rec list_nth_mut_loop_with_id_loop_fwd
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_loop_with_id] *)
+(** [loops::list_nth_mut_loop_with_id]: forward function *)
 let list_nth_mut_loop_with_id_fwd
   (t : Type0) (ls : list_t t) (i : u32) : result t =
   let* ls0 = id_mut_fwd t ls in list_nth_mut_loop_with_id_loop_fwd t i ls0
 
-(** [loops::list_nth_mut_loop_with_id] *)
+(** [loops::list_nth_mut_loop_with_id]: loop 0: backward function 0 *)
 let rec list_nth_mut_loop_with_id_loop_back
   (t : Type0) (i : u32) (ls : list_t t) (ret : t) :
   Tot (result (list_t t))
@@ -238,14 +240,14 @@ let rec list_nth_mut_loop_with_id_loop_back
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_loop_with_id] *)
+(** [loops::list_nth_mut_loop_with_id]: backward function 0 *)
 let list_nth_mut_loop_with_id_back
   (t : Type0) (ls : list_t t) (i : u32) (ret : t) : result (list_t t) =
   let* ls0 = id_mut_fwd t ls in
   let* l = list_nth_mut_loop_with_id_loop_back t i ls0 ret in
   id_mut_back t ls l
 
-(** [loops::list_nth_shared_loop_with_id] *)
+(** [loops::list_nth_shared_loop_with_id]: loop 0: forward function *)
 let rec list_nth_shared_loop_with_id_loop_fwd
   (t : Type0) (i : u32) (ls : list_t t) :
   Tot (result t)
@@ -259,13 +261,13 @@ let rec list_nth_shared_loop_with_id_loop_fwd
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_shared_loop_with_id] *)
+(** [loops::list_nth_shared_loop_with_id]: forward function *)
 let list_nth_shared_loop_with_id_fwd
   (t : Type0) (ls : list_t t) (i : u32) : result t =
   let* ls0 = id_shared_fwd t ls in
   list_nth_shared_loop_with_id_loop_fwd t i ls0
 
-(** [loops::list_nth_mut_loop_pair] *)
+(** [loops::list_nth_mut_loop_pair]: loop 0: forward function *)
 let rec list_nth_mut_loop_pair_loop_fwd
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
   Tot (result (t & t))
@@ -284,12 +286,12 @@ let rec list_nth_mut_loop_pair_loop_fwd
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_loop_pair] *)
+(** [loops::list_nth_mut_loop_pair]: forward function *)
 let list_nth_mut_loop_pair_fwd
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
   list_nth_mut_loop_pair_loop_fwd t ls0 ls1 i
 
-(** [loops::list_nth_mut_loop_pair] *)
+(** [loops::list_nth_mut_loop_pair]: loop 0: backward function 0 *)
 let rec list_nth_mut_loop_pair_loop_back'a
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
   Tot (result (list_t t))
@@ -310,14 +312,14 @@ let rec list_nth_mut_loop_pair_loop_back'a
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_loop_pair] *)
+(** [loops::list_nth_mut_loop_pair]: backward function 0 *)
 let list_nth_mut_loop_pair_back'a
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
   result (list_t t)
   =
   list_nth_mut_loop_pair_loop_back'a t ls0 ls1 i ret
 
-(** [loops::list_nth_mut_loop_pair] *)
+(** [loops::list_nth_mut_loop_pair]: loop 0: backward function 1 *)
 let rec list_nth_mut_loop_pair_loop_back'b
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
   Tot (result (list_t t))
@@ -338,14 +340,14 @@ let rec list_nth_mut_loop_pair_loop_back'b
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_loop_pair] *)
+(** [loops::list_nth_mut_loop_pair]: backward function 1 *)
 let list_nth_mut_loop_pair_back'b
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
   result (list_t t)
   =
   list_nth_mut_loop_pair_loop_back'b t ls0 ls1 i ret
 
-(** [loops::list_nth_shared_loop_pair] *)
+(** [loops::list_nth_shared_loop_pair]: loop 0: forward function *)
 let rec list_nth_shared_loop_pair_loop_fwd
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
   Tot (result (t & t))
@@ -365,12 +367,12 @@ let rec list_nth_shared_loop_pair_loop_fwd
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_shared_loop_pair] *)
+(** [loops::list_nth_shared_loop_pair]: forward function *)
 let list_nth_shared_loop_pair_fwd
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
   list_nth_shared_loop_pair_loop_fwd t ls0 ls1 i
 
-(** [loops::list_nth_mut_loop_pair_merge] *)
+(** [loops::list_nth_mut_loop_pair_merge]: loop 0: forward function *)
 let rec list_nth_mut_loop_pair_merge_loop_fwd
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
   Tot (result (t & t))
@@ -390,12 +392,12 @@ let rec list_nth_mut_loop_pair_merge_loop_fwd
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_loop_pair_merge] *)
+(** [loops::list_nth_mut_loop_pair_merge]: forward function *)
 let list_nth_mut_loop_pair_merge_fwd
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
   list_nth_mut_loop_pair_merge_loop_fwd t ls0 ls1 i
 
-(** [loops::list_nth_mut_loop_pair_merge] *)
+(** [loops::list_nth_mut_loop_pair_merge]: loop 0: backward function 0 *)
 let rec list_nth_mut_loop_pair_merge_loop_back
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : (t & t)) :
   Tot (result ((list_t t) & (list_t t)))
@@ -417,14 +419,14 @@ let rec list_nth_mut_loop_pair_merge_loop_back
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_loop_pair_merge] *)
+(** [loops::list_nth_mut_loop_pair_merge]: backward function 0 *)
 let list_nth_mut_loop_pair_merge_back
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : (t & t)) :
   result ((list_t t) & (list_t t))
   =
   list_nth_mut_loop_pair_merge_loop_back t ls0 ls1 i ret
 
-(** [loops::list_nth_shared_loop_pair_merge] *)
+(** [loops::list_nth_shared_loop_pair_merge]: loop 0: forward function *)
 let rec list_nth_shared_loop_pair_merge_loop_fwd
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
   Tot (result (t & t))
@@ -444,12 +446,12 @@ let rec list_nth_shared_loop_pair_merge_loop_fwd
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_shared_loop_pair_merge] *)
+(** [loops::list_nth_shared_loop_pair_merge]: forward function *)
 let list_nth_shared_loop_pair_merge_fwd
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
   list_nth_shared_loop_pair_merge_loop_fwd t ls0 ls1 i
 
-(** [loops::list_nth_mut_shared_loop_pair] *)
+(** [loops::list_nth_mut_shared_loop_pair]: loop 0: forward function *)
 let rec list_nth_mut_shared_loop_pair_loop_fwd
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
   Tot (result (t & t))
@@ -469,12 +471,12 @@ let rec list_nth_mut_shared_loop_pair_loop_fwd
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_shared_loop_pair] *)
+(** [loops::list_nth_mut_shared_loop_pair]: forward function *)
 let list_nth_mut_shared_loop_pair_fwd
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
   list_nth_mut_shared_loop_pair_loop_fwd t ls0 ls1 i
 
-(** [loops::list_nth_mut_shared_loop_pair] *)
+(** [loops::list_nth_mut_shared_loop_pair]: loop 0: backward function 0 *)
 let rec list_nth_mut_shared_loop_pair_loop_back
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
   Tot (result (list_t t))
@@ -495,14 +497,14 @@ let rec list_nth_mut_shared_loop_pair_loop_back
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_shared_loop_pair] *)
+(** [loops::list_nth_mut_shared_loop_pair]: backward function 0 *)
 let list_nth_mut_shared_loop_pair_back
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
   result (list_t t)
   =
   list_nth_mut_shared_loop_pair_loop_back t ls0 ls1 i ret
 
-(** [loops::list_nth_mut_shared_loop_pair_merge] *)
+(** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0: forward function *)
 let rec list_nth_mut_shared_loop_pair_merge_loop_fwd
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
   Tot (result (t & t))
@@ -522,12 +524,12 @@ let rec list_nth_mut_shared_loop_pair_merge_loop_fwd
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_shared_loop_pair_merge] *)
+(** [loops::list_nth_mut_shared_loop_pair_merge]: forward function *)
 let list_nth_mut_shared_loop_pair_merge_fwd
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
   list_nth_mut_shared_loop_pair_merge_loop_fwd t ls0 ls1 i
 
-(** [loops::list_nth_mut_shared_loop_pair_merge] *)
+(** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0: backward function 0 *)
 let rec list_nth_mut_shared_loop_pair_merge_loop_back
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
   Tot (result (list_t t))
@@ -549,14 +551,14 @@ let rec list_nth_mut_shared_loop_pair_merge_loop_back
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_mut_shared_loop_pair_merge] *)
+(** [loops::list_nth_mut_shared_loop_pair_merge]: backward function 0 *)
 let list_nth_mut_shared_loop_pair_merge_back
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
   result (list_t t)
   =
   list_nth_mut_shared_loop_pair_merge_loop_back t ls0 ls1 i ret
 
-(** [loops::list_nth_shared_mut_loop_pair] *)
+(** [loops::list_nth_shared_mut_loop_pair]: loop 0: forward function *)
 let rec list_nth_shared_mut_loop_pair_loop_fwd
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
   Tot (result (t & t))
@@ -576,12 +578,12 @@ let rec list_nth_shared_mut_loop_pair_loop_fwd
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_shared_mut_loop_pair] *)
+(** [loops::list_nth_shared_mut_loop_pair]: forward function *)
 let list_nth_shared_mut_loop_pair_fwd
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
   list_nth_shared_mut_loop_pair_loop_fwd t ls0 ls1 i
 
-(** [loops::list_nth_shared_mut_loop_pair] *)
+(** [loops::list_nth_shared_mut_loop_pair]: loop 0: backward function 1 *)
 let rec list_nth_shared_mut_loop_pair_loop_back
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
   Tot (result (list_t t))
@@ -602,14 +604,14 @@ let rec list_nth_shared_mut_loop_pair_loop_back
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_shared_mut_loop_pair] *)
+(** [loops::list_nth_shared_mut_loop_pair]: backward function 1 *)
 let list_nth_shared_mut_loop_pair_back
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
   result (list_t t)
   =
   list_nth_shared_mut_loop_pair_loop_back t ls0 ls1 i ret
 
-(** [loops::list_nth_shared_mut_loop_pair_merge] *)
+(** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0: forward function *)
 let rec list_nth_shared_mut_loop_pair_merge_loop_fwd
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) :
   Tot (result (t & t))
@@ -629,12 +631,12 @@ let rec list_nth_shared_mut_loop_pair_merge_loop_fwd
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_shared_mut_loop_pair_merge] *)
+(** [loops::list_nth_shared_mut_loop_pair_merge]: forward function *)
 let list_nth_shared_mut_loop_pair_merge_fwd
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) : result (t & t) =
   list_nth_shared_mut_loop_pair_merge_loop_fwd t ls0 ls1 i
 
-(** [loops::list_nth_shared_mut_loop_pair_merge] *)
+(** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0: backward function 0 *)
 let rec list_nth_shared_mut_loop_pair_merge_loop_back
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
   Tot (result (list_t t))
@@ -656,7 +658,7 @@ let rec list_nth_shared_mut_loop_pair_merge_loop_back
   | ListNil -> Fail Failure
   end
 
-(** [loops::list_nth_shared_mut_loop_pair_merge] *)
+(** [loops::list_nth_shared_mut_loop_pair_merge]: backward function 0 *)
 let list_nth_shared_mut_loop_pair_merge_back
   (t : Type0) (ls0 : list_t t) (ls1 : list_t t) (i : u32) (ret : t) :
   result (list_t t)
diff --git a/tests/fstar/misc/NoNestedBorrows.fst b/tests/fstar/misc/NoNestedBorrows.fst
index 3770ab5d..d790bfa9 100644
--- a/tests/fstar/misc/NoNestedBorrows.fst
+++ b/tests/fstar/misc/NoNestedBorrows.fst
@@ -30,46 +30,46 @@ type sum_t (t1 t2 : Type0) =
 | SumLeft : t1 -> sum_t t1 t2
 | SumRight : t2 -> sum_t t1 t2
 
-(** [no_nested_borrows::neg_test] *)
+(** [no_nested_borrows::neg_test]: forward function *)
 let neg_test_fwd (x : i32) : result i32 =
   i32_neg x
 
-(** [no_nested_borrows::add_test] *)
+(** [no_nested_borrows::add_test]: forward function *)
 let add_test_fwd (x : u32) (y : u32) : result u32 =
   u32_add x y
 
-(** [no_nested_borrows::subs_test] *)
+(** [no_nested_borrows::subs_test]: forward function *)
 let subs_test_fwd (x : u32) (y : u32) : result u32 =
   u32_sub x y
 
-(** [no_nested_borrows::div_test] *)
+(** [no_nested_borrows::div_test]: forward function *)
 let div_test_fwd (x : u32) (y : u32) : result u32 =
   u32_div x y
 
-(** [no_nested_borrows::div_test1] *)
+(** [no_nested_borrows::div_test1]: forward function *)
 let div_test1_fwd (x : u32) : result u32 =
   u32_div x 2
 
-(** [no_nested_borrows::rem_test] *)
+(** [no_nested_borrows::rem_test]: forward function *)
 let rem_test_fwd (x : u32) (y : u32) : result u32 =
   u32_rem x y
 
-(** [no_nested_borrows::cast_test] *)
+(** [no_nested_borrows::cast_test]: forward function *)
 let cast_test_fwd (x : u32) : result i32 =
   scalar_cast U32 I32 x
 
-(** [no_nested_borrows::test2] *)
+(** [no_nested_borrows::test2]: forward function *)
 let test2_fwd : result unit =
   let* _ = u32_add 23 44 in Return ()
 
 (** Unit test for [no_nested_borrows::test2] *)
 let _ = assert_norm (test2_fwd = Return ())
 
-(** [no_nested_borrows::get_max] *)
+(** [no_nested_borrows::get_max]: forward function *)
 let get_max_fwd (x : u32) (y : u32) : result u32 =
   if x >= y then Return x else Return y
 
-(** [no_nested_borrows::test3] *)
+(** [no_nested_borrows::test3]: forward function *)
 let test3_fwd : result unit =
   let* x = get_max_fwd 4 3 in
   let* y = get_max_fwd 10 11 in
@@ -79,21 +79,21 @@ let test3_fwd : result unit =
 (** Unit test for [no_nested_borrows::test3] *)
 let _ = assert_norm (test3_fwd = Return ())
 
-(** [no_nested_borrows::test_neg1] *)
+(** [no_nested_borrows::test_neg1]: forward function *)
 let test_neg1_fwd : result unit =
   let* y = i32_neg 3 in if not (y = -3) then Fail Failure else Return ()
 
 (** Unit test for [no_nested_borrows::test_neg1] *)
 let _ = assert_norm (test_neg1_fwd = Return ())
 
-(** [no_nested_borrows::refs_test1] *)
+(** [no_nested_borrows::refs_test1]: forward function *)
 let refs_test1_fwd : result unit =
   if not (1 = 1) then Fail Failure else Return ()
 
 (** Unit test for [no_nested_borrows::refs_test1] *)
 let _ = assert_norm (refs_test1_fwd = Return ())
 
-(** [no_nested_borrows::refs_test2] *)
+(** [no_nested_borrows::refs_test2]: forward function *)
 let refs_test2_fwd : result unit =
   if not (2 = 2)
   then Fail Failure
@@ -108,47 +108,47 @@ let refs_test2_fwd : result unit =
 (** Unit test for [no_nested_borrows::refs_test2] *)
 let _ = assert_norm (refs_test2_fwd = Return ())
 
-(** [no_nested_borrows::test_list1] *)
+(** [no_nested_borrows::test_list1]: forward function *)
 let test_list1_fwd : result unit =
   Return ()
 
 (** Unit test for [no_nested_borrows::test_list1] *)
 let _ = assert_norm (test_list1_fwd = Return ())
 
-(** [no_nested_borrows::test_box1] *)
+(** [no_nested_borrows::test_box1]: forward function *)
 let test_box1_fwd : result unit =
   let b = 1 in let x = b in if not (x = 1) then Fail Failure else Return ()
 
 (** Unit test for [no_nested_borrows::test_box1] *)
 let _ = assert_norm (test_box1_fwd = Return ())
 
-(** [no_nested_borrows::copy_int] *)
+(** [no_nested_borrows::copy_int]: forward function *)
 let copy_int_fwd (x : i32) : result i32 =
   Return x
 
-(** [no_nested_borrows::test_unreachable] *)
+(** [no_nested_borrows::test_unreachable]: forward function *)
 let test_unreachable_fwd (b : bool) : result unit =
   if b then Fail Failure else Return ()
 
-(** [no_nested_borrows::test_panic] *)
+(** [no_nested_borrows::test_panic]: forward function *)
 let test_panic_fwd (b : bool) : result unit =
   if b then Fail Failure else Return ()
 
-(** [no_nested_borrows::test_copy_int] *)
+(** [no_nested_borrows::test_copy_int]: forward function *)
 let test_copy_int_fwd : result unit =
   let* y = copy_int_fwd 0 in if not (0 = y) then Fail Failure else Return ()
 
 (** Unit test for [no_nested_borrows::test_copy_int] *)
 let _ = assert_norm (test_copy_int_fwd = Return ())
 
-(** [no_nested_borrows::is_cons] *)
+(** [no_nested_borrows::is_cons]: forward function *)
 let is_cons_fwd (t : Type0) (l : list_t t) : result bool =
   begin match l with
   | ListCons x l0 -> Return true
   | ListNil -> Return false
   end
 
-(** [no_nested_borrows::test_is_cons] *)
+(** [no_nested_borrows::test_is_cons]: forward function *)
 let test_is_cons_fwd : result unit =
   let l = ListNil in
   let* b = is_cons_fwd i32 (ListCons 0 l) in
@@ -157,14 +157,14 @@ let test_is_cons_fwd : result unit =
 (** Unit test for [no_nested_borrows::test_is_cons] *)
 let _ = assert_norm (test_is_cons_fwd = Return ())
 
-(** [no_nested_borrows::split_list] *)
+(** [no_nested_borrows::split_list]: forward function *)
 let split_list_fwd (t : Type0) (l : list_t t) : result (t & (list_t t)) =
   begin match l with
   | ListCons hd tl -> Return (hd, tl)
   | ListNil -> Fail Failure
   end
 
-(** [no_nested_borrows::test_split_list] *)
+(** [no_nested_borrows::test_split_list]: forward function *)
 let test_split_list_fwd : result unit =
   let l = ListNil in
   let* p = split_list_fwd i32 (ListCons 0 l) in
@@ -174,16 +174,16 @@ let test_split_list_fwd : result unit =
 (** Unit test for [no_nested_borrows::test_split_list] *)
 let _ = assert_norm (test_split_list_fwd = Return ())
 
-(** [no_nested_borrows::choose] *)
+(** [no_nested_borrows::choose]: forward function *)
 let choose_fwd (t : Type0) (b : bool) (x : t) (y : t) : result t =
   if b then Return x else Return y
 
-(** [no_nested_borrows::choose] *)
+(** [no_nested_borrows::choose]: backward function 0 *)
 let choose_back
   (t : Type0) (b : bool) (x : t) (y : t) (ret : t) : result (t & t) =
   if b then Return (ret, y) else Return (x, ret)
 
-(** [no_nested_borrows::choose_test] *)
+(** [no_nested_borrows::choose_test]: forward function *)
 let choose_test_fwd : result unit =
   let* z = choose_fwd i32 true 0 0 in
   let* z0 = i32_add z 1 in
@@ -198,7 +198,7 @@ let choose_test_fwd : result unit =
 (** Unit test for [no_nested_borrows::choose_test] *)
 let _ = assert_norm (choose_test_fwd = Return ())
 
-(** [no_nested_borrows::test_char] *)
+(** [no_nested_borrows::test_char]: forward function *)
 let test_char_fwd : result char =
   Return 'a'
 
@@ -212,14 +212,14 @@ and tree_t (t : Type0) =
 | TreeLeaf : t -> tree_t t
 | TreeNode : t -> node_elem_t t -> tree_t t -> tree_t t
 
-(** [no_nested_borrows::list_length] *)
+(** [no_nested_borrows::list_length]: forward function *)
 let rec list_length_fwd (t : Type0) (l : list_t t) : result u32 =
   begin match l with
   | ListCons x l1 -> let* i = list_length_fwd t l1 in u32_add 1 i
   | ListNil -> Return 0
   end
 
-(** [no_nested_borrows::list_nth_shared] *)
+(** [no_nested_borrows::list_nth_shared]: forward function *)
 let rec list_nth_shared_fwd (t : Type0) (l : list_t t) (i : u32) : result t =
   begin match l with
   | ListCons x tl ->
@@ -229,7 +229,7 @@ let rec list_nth_shared_fwd (t : Type0) (l : list_t t) (i : u32) : result t =
   | ListNil -> Fail Failure
   end
 
-(** [no_nested_borrows::list_nth_mut] *)
+(** [no_nested_borrows::list_nth_mut]: forward function *)
 let rec list_nth_mut_fwd (t : Type0) (l : list_t t) (i : u32) : result t =
   begin match l with
   | ListCons x tl ->
@@ -239,7 +239,7 @@ let rec list_nth_mut_fwd (t : Type0) (l : list_t t) (i : u32) : result t =
   | ListNil -> Fail Failure
   end
 
-(** [no_nested_borrows::list_nth_mut] *)
+(** [no_nested_borrows::list_nth_mut]: backward function 0 *)
 let rec list_nth_mut_back
   (t : Type0) (l : list_t t) (i : u32) (ret : t) : result (list_t t) =
   begin match l with
@@ -253,7 +253,7 @@ let rec list_nth_mut_back
   | ListNil -> Fail Failure
   end
 
-(** [no_nested_borrows::list_rev_aux] *)
+(** [no_nested_borrows::list_rev_aux]: forward function *)
 let rec list_rev_aux_fwd
   (t : Type0) (li : list_t t) (lo : list_t t) : result (list_t t) =
   begin match li with
@@ -261,12 +261,13 @@ let rec list_rev_aux_fwd
   | ListNil -> Return lo
   end
 
-(** [no_nested_borrows::list_rev] *)
+(** [no_nested_borrows::list_rev]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let list_rev_fwd_back (t : Type0) (l : list_t t) : result (list_t t) =
   let li = mem_replace_fwd (list_t t) l ListNil in
   list_rev_aux_fwd t li ListNil
 
-(** [no_nested_borrows::test_list_functions] *)
+(** [no_nested_borrows::test_list_functions]: forward function *)
 let test_list_functions_fwd : result unit =
   let l = ListNil in
   let l0 = ListCons 2 l in
@@ -302,48 +303,48 @@ let test_list_functions_fwd : result unit =
 (** Unit test for [no_nested_borrows::test_list_functions] *)
 let _ = assert_norm (test_list_functions_fwd = Return ())
 
-(** [no_nested_borrows::id_mut_pair1] *)
+(** [no_nested_borrows::id_mut_pair1]: forward function *)
 let id_mut_pair1_fwd (t1 t2 : Type0) (x : t1) (y : t2) : result (t1 & t2) =
   Return (x, y)
 
-(** [no_nested_borrows::id_mut_pair1] *)
+(** [no_nested_borrows::id_mut_pair1]: backward function 0 *)
 let id_mut_pair1_back
   (t1 t2 : Type0) (x : t1) (y : t2) (ret : (t1 & t2)) : result (t1 & t2) =
   let (x0, x1) = ret in Return (x0, x1)
 
-(** [no_nested_borrows::id_mut_pair2] *)
+(** [no_nested_borrows::id_mut_pair2]: forward function *)
 let id_mut_pair2_fwd (t1 t2 : Type0) (p : (t1 & t2)) : result (t1 & t2) =
   let (x, x0) = p in Return (x, x0)
 
-(** [no_nested_borrows::id_mut_pair2] *)
+(** [no_nested_borrows::id_mut_pair2]: backward function 0 *)
 let id_mut_pair2_back
   (t1 t2 : Type0) (p : (t1 & t2)) (ret : (t1 & t2)) : result (t1 & t2) =
   let (x, x0) = ret in Return (x, x0)
 
-(** [no_nested_borrows::id_mut_pair3] *)
+(** [no_nested_borrows::id_mut_pair3]: forward function *)
 let id_mut_pair3_fwd (t1 t2 : Type0) (x : t1) (y : t2) : result (t1 & t2) =
   Return (x, y)
 
-(** [no_nested_borrows::id_mut_pair3] *)
+(** [no_nested_borrows::id_mut_pair3]: backward function 0 *)
 let id_mut_pair3_back'a
   (t1 t2 : Type0) (x : t1) (y : t2) (ret : t1) : result t1 =
   Return ret
 
-(** [no_nested_borrows::id_mut_pair3] *)
+(** [no_nested_borrows::id_mut_pair3]: backward function 1 *)
 let id_mut_pair3_back'b
   (t1 t2 : Type0) (x : t1) (y : t2) (ret : t2) : result t2 =
   Return ret
 
-(** [no_nested_borrows::id_mut_pair4] *)
+(** [no_nested_borrows::id_mut_pair4]: forward function *)
 let id_mut_pair4_fwd (t1 t2 : Type0) (p : (t1 & t2)) : result (t1 & t2) =
   let (x, x0) = p in Return (x, x0)
 
-(** [no_nested_borrows::id_mut_pair4] *)
+(** [no_nested_borrows::id_mut_pair4]: backward function 0 *)
 let id_mut_pair4_back'a
   (t1 t2 : Type0) (p : (t1 & t2)) (ret : t1) : result t1 =
   Return ret
 
-(** [no_nested_borrows::id_mut_pair4] *)
+(** [no_nested_borrows::id_mut_pair4]: backward function 1 *)
 let id_mut_pair4_back'b
   (t1 t2 : Type0) (p : (t1 & t2)) (ret : t2) : result t2 =
   Return ret
@@ -351,15 +352,15 @@ let id_mut_pair4_back'b
 (** [no_nested_borrows::StructWithTuple] *)
 type struct_with_tuple_t (t1 t2 : Type0) = { struct_with_tuple_p : (t1 & t2); }
 
-(** [no_nested_borrows::new_tuple1] *)
+(** [no_nested_borrows::new_tuple1]: forward function *)
 let new_tuple1_fwd : result (struct_with_tuple_t u32 u32) =
   Return { struct_with_tuple_p = (1, 2) }
 
-(** [no_nested_borrows::new_tuple2] *)
+(** [no_nested_borrows::new_tuple2]: forward function *)
 let new_tuple2_fwd : result (struct_with_tuple_t i16 i16) =
   Return { struct_with_tuple_p = (1, 2) }
 
-(** [no_nested_borrows::new_tuple3] *)
+(** [no_nested_borrows::new_tuple3]: forward function *)
 let new_tuple3_fwd : result (struct_with_tuple_t u64 i64) =
   Return { struct_with_tuple_p = (1, 2) }
 
@@ -369,11 +370,11 @@ type struct_with_pair_t (t1 t2 : Type0) =
   struct_with_pair_p : pair_t t1 t2;
 }
 
-(** [no_nested_borrows::new_pair1] *)
+(** [no_nested_borrows::new_pair1]: forward function *)
 let new_pair1_fwd : result (struct_with_pair_t u32 u32) =
   Return { struct_with_pair_p = { pair_x = 1; pair_y = 2 } }
 
-(** [no_nested_borrows::test_constants] *)
+(** [no_nested_borrows::test_constants]: forward function *)
 let test_constants_fwd : result unit =
   let* swt = new_tuple1_fwd in
   let (i, _) = swt.struct_with_tuple_p in
@@ -398,31 +399,32 @@ let test_constants_fwd : result unit =
 (** Unit test for [no_nested_borrows::test_constants] *)
 let _ = assert_norm (test_constants_fwd = Return ())
 
-(** [no_nested_borrows::test_weird_borrows1] *)
+(** [no_nested_borrows::test_weird_borrows1]: forward function *)
 let test_weird_borrows1_fwd : result unit =
   Return ()
 
 (** Unit test for [no_nested_borrows::test_weird_borrows1] *)
 let _ = assert_norm (test_weird_borrows1_fwd = Return ())
 
-(** [no_nested_borrows::test_mem_replace] *)
+(** [no_nested_borrows::test_mem_replace]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let test_mem_replace_fwd_back (px : u32) : result u32 =
   let y = mem_replace_fwd u32 px 1 in
   if not (y = 0) then Fail Failure else Return 2
 
-(** [no_nested_borrows::test_shared_borrow_bool1] *)
+(** [no_nested_borrows::test_shared_borrow_bool1]: forward function *)
 let test_shared_borrow_bool1_fwd (b : bool) : result u32 =
   if b then Return 0 else Return 1
 
-(** [no_nested_borrows::test_shared_borrow_bool2] *)
+(** [no_nested_borrows::test_shared_borrow_bool2]: forward function *)
 let test_shared_borrow_bool2_fwd : result u32 =
   Return 0
 
-(** [no_nested_borrows::test_shared_borrow_enum1] *)
+(** [no_nested_borrows::test_shared_borrow_enum1]: forward function *)
 let test_shared_borrow_enum1_fwd (l : list_t u32) : result u32 =
   begin match l with | ListCons i l0 -> Return 1 | ListNil -> Return 0 end
 
-(** [no_nested_borrows::test_shared_borrow_enum2] *)
+(** [no_nested_borrows::test_shared_borrow_enum2]: forward function *)
 let test_shared_borrow_enum2_fwd : result u32 =
   Return 0
 
diff --git a/tests/fstar/misc/Paper.fst b/tests/fstar/misc/Paper.fst
index 4ab31de3..e2d692c2 100644
--- a/tests/fstar/misc/Paper.fst
+++ b/tests/fstar/misc/Paper.fst
@@ -5,11 +5,12 @@ open Primitives
 
 #set-options "--z3rlimit 50 --fuel 1 --ifuel 1"
 
-(** [paper::ref_incr] *)
+(** [paper::ref_incr]: merged forward/backward function
+    (there is a single backward function, and the forward function returns ()) *)
 let ref_incr_fwd_back (x : i32) : result i32 =
   i32_add x 1
 
-(** [paper::test_incr] *)
+(** [paper::test_incr]: forward function *)
 let test_incr_fwd : result unit =
   let* x = ref_incr_fwd_back 0 in
   if not (x = 1) then Fail Failure else Return ()
@@ -17,16 +18,16 @@ let test_incr_fwd : result unit =
 (** Unit test for [paper::test_incr] *)
 let _ = assert_norm (test_incr_fwd = Return ())
 
-(** [paper::choose] *)
+(** [paper::choose]: forward function *)
 let choose_fwd (t : Type0) (b : bool) (x : t) (y : t) : result t =
   if b then Return x else Return y
 
-(** [paper::choose] *)
+(** [paper::choose]: backward function 0 *)
 let choose_back
   (t : Type0) (b : bool) (x : t) (y : t) (ret : t) : result (t & t) =
   if b then Return (ret, y) else Return (x, ret)
 
-(** [paper::test_choose] *)
+(** [paper::test_choose]: forward function *)
 let test_choose_fwd : result unit =
   let* z = choose_fwd i32 true 0 0 in
   let* z0 = i32_add z 1 in
@@ -46,7 +47,7 @@ type list_t (t : Type0) =
 | ListCons : t -> list_t t -> list_t t
 | ListNil : list_t t
 
-(** [paper::list_nth_mut] *)
+(** [paper::list_nth_mut]: forward function *)
 let rec list_nth_mut_fwd (t : Type0) (l : list_t t) (i : u32) : result t =
   begin match l with
   | ListCons x tl ->
@@ -56,7 +57,7 @@ let rec list_nth_mut_fwd (t : Type0) (l : list_t t) (i : u32) : result t =
   | ListNil -> Fail Failure
   end
 
-(** [paper::list_nth_mut] *)
+(** [paper::list_nth_mut]: backward function 0 *)
 let rec list_nth_mut_back
   (t : Type0) (l : list_t t) (i : u32) (ret : t) : result (list_t t) =
   begin match l with
@@ -70,14 +71,14 @@ let rec list_nth_mut_back
   | ListNil -> Fail Failure
   end
 
-(** [paper::sum] *)
+(** [paper::sum]: forward function *)
 let rec sum_fwd (l : list_t i32) : result i32 =
   begin match l with
   | ListCons x tl -> let* i = sum_fwd tl in i32_add x i
   | ListNil -> Return 0
   end
 
-(** [paper::test_nth] *)
+(** [paper::test_nth]: forward function *)
 let test_nth_fwd : result unit =
   let l = ListNil in
   let l0 = ListCons 3 l in
@@ -91,7 +92,7 @@ let test_nth_fwd : result unit =
 (** Unit test for [paper::test_nth] *)
 let _ = assert_norm (test_nth_fwd = Return ())
 
-(** [paper::call_choose] *)
+(** [paper::call_choose]: forward function *)
 let call_choose_fwd (p : (u32 & u32)) : result u32 =
   let (px, py) = p in
   let* pz = choose_fwd u32 true px py in
diff --git a/tests/fstar/misc/PoloniusList.fst b/tests/fstar/misc/PoloniusList.fst
index e2144487..79c86606 100644
--- a/tests/fstar/misc/PoloniusList.fst
+++ b/tests/fstar/misc/PoloniusList.fst
@@ -10,7 +10,7 @@ type list_t (t : Type0) =
 | ListCons : t -> list_t t -> list_t t
 | ListNil : list_t t
 
-(** [polonius_list::get_list_at_x] *)
+(** [polonius_list::get_list_at_x]: forward function *)
 let rec get_list_at_x_fwd (ls : list_t u32) (x : u32) : result (list_t u32) =
   begin match ls with
   | ListCons hd tl ->
@@ -18,7 +18,7 @@ let rec get_list_at_x_fwd (ls : list_t u32) (x : u32) : result (list_t u32) =
   | ListNil -> Return ListNil
   end
 
-(** [polonius_list::get_list_at_x] *)
+(** [polonius_list::get_list_at_x]: backward function 0 *)
 let rec get_list_at_x_back
   (ls : list_t u32) (x : u32) (ret : list_t u32) : result (list_t u32) =
   begin match ls with
diff --git a/tests/hol4/betree/betreeMain_FunsScript.sml b/tests/hol4/betree/betreeMain_FunsScript.sml
index df0c6a24..03ff2671 100644
--- a/tests/hol4/betree/betreeMain_FunsScript.sml
+++ b/tests/hol4/betree/betreeMain_FunsScript.sml
@@ -7,7 +7,7 @@ val _ = new_theory "betreeMain_Funs"
 
 
 val betree_load_internal_node_fwd_def = Define ‘
-  (** [betree_main::betree::load_internal_node] *)
+  (** [betree_main::betree::load_internal_node]: forward function *)
   betree_load_internal_node_fwd
     (id : u64) (st : state) :
     (state # (u64 # betree_message_t) betree_list_t) result
@@ -16,7 +16,7 @@ val betree_load_internal_node_fwd_def = Define ‘
 ’
 
 val betree_store_internal_node_fwd_def = Define ‘
-  (** [betree_main::betree::store_internal_node] *)
+  (** [betree_main::betree::store_internal_node]: forward function *)
   betree_store_internal_node_fwd
     (id : u64) (content : (u64 # betree_message_t) betree_list_t) (st : state)
     :
@@ -29,14 +29,14 @@ val betree_store_internal_node_fwd_def = Define ‘
 ’
 
 val betree_load_leaf_node_fwd_def = Define ‘
-  (** [betree_main::betree::load_leaf_node] *)
+  (** [betree_main::betree::load_leaf_node]: forward function *)
   betree_load_leaf_node_fwd
     (id : u64) (st : state) : (state # (u64 # u64) betree_list_t) result =
     betree_utils_load_leaf_node_fwd id st
 ’
 
 val betree_store_leaf_node_fwd_def = Define ‘
-  (** [betree_main::betree::store_leaf_node] *)
+  (** [betree_main::betree::store_leaf_node]: forward function *)
   betree_store_leaf_node_fwd
     (id : u64) (content : (u64 # u64) betree_list_t) (st : state) :
     (state # unit) result
@@ -48,7 +48,7 @@ val betree_store_leaf_node_fwd_def = Define ‘
 ’
 
 val betree_fresh_node_id_fwd_def = Define ‘
-  (** [betree_main::betree::fresh_node_id] *)
+  (** [betree_main::betree::fresh_node_id]: forward function *)
   betree_fresh_node_id_fwd (counter : u64) : u64 result =
     do
     _ <- u64_add counter (int_to_u64 1);
@@ -57,19 +57,19 @@ val betree_fresh_node_id_fwd_def = Define ‘
 ’
 
 val betree_fresh_node_id_back_def = Define ‘
-  (** [betree_main::betree::fresh_node_id] *)
+  (** [betree_main::betree::fresh_node_id]: backward function 0 *)
   betree_fresh_node_id_back (counter : u64) : u64 result =
     u64_add counter (int_to_u64 1)
 ’
 
 val betree_node_id_counter_new_fwd_def = Define ‘
-  (** [betree_main::betree::NodeIdCounter::{0}::new] *)
+  (** [betree_main::betree::NodeIdCounter::{0}::new]: forward function *)
   betree_node_id_counter_new_fwd : betree_node_id_counter_t result =
     Return (<| betree_node_id_counter_next_node_id := (int_to_u64 0) |>)
 ’
 
 val betree_node_id_counter_fresh_id_fwd_def = Define ‘
-  (** [betree_main::betree::NodeIdCounter::{0}::fresh_id] *)
+  (** [betree_main::betree::NodeIdCounter::{0}::fresh_id]: forward function *)
   betree_node_id_counter_fresh_id_fwd
     (self : betree_node_id_counter_t) : u64 result =
     do
@@ -79,7 +79,7 @@ val betree_node_id_counter_fresh_id_fwd_def = Define ‘
 ’
 
 val betree_node_id_counter_fresh_id_back_def = Define ‘
-  (** [betree_main::betree::NodeIdCounter::{0}::fresh_id] *)
+  (** [betree_main::betree::NodeIdCounter::{0}::fresh_id]: backward function 0 *)
   betree_node_id_counter_fresh_id_back
     (self : betree_node_id_counter_t) : betree_node_id_counter_t result =
     do
@@ -97,7 +97,7 @@ Definition core_num_u64_max_c_def:
 End
 
 val betree_upsert_update_fwd_def = Define ‘
-  (** [betree_main::betree::upsert_update] *)
+  (** [betree_main::betree::upsert_update]: forward function *)
   betree_upsert_update_fwd
     (prev : u64 option) (st : betree_upsert_fun_state_t) : u64 result =
     (case prev of
@@ -117,7 +117,7 @@ val betree_upsert_update_fwd_def = Define ‘
 ’
 
 val [betree_list_len_fwd_def] = DefineDiv ‘
-  (** [betree_main::betree::List::{1}::len] *)
+  (** [betree_main::betree::List::{1}::len]: forward function *)
   betree_list_len_fwd (self : 't betree_list_t) : u64 result =
     (case self of
     | BetreeListCons t tl =>
@@ -129,7 +129,7 @@ val [betree_list_len_fwd_def] = DefineDiv ‘
 ’
 
 val [betree_list_split_at_fwd_def] = DefineDiv ‘
-  (** [betree_main::betree::List::{1}::split_at] *)
+  (** [betree_main::betree::List::{1}::split_at]: forward function *)
   betree_list_split_at_fwd
     (self : 't betree_list_t) (n : u64) :
     ('t betree_list_t # 't betree_list_t) result
@@ -148,7 +148,8 @@ val [betree_list_split_at_fwd_def] = DefineDiv ‘
 ’
 
 val betree_list_push_front_fwd_back_def = Define ‘
-  (** [betree_main::betree::List::{1}::push_front] *)
+  (** [betree_main::betree::List::{1}::push_front]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   betree_list_push_front_fwd_back
     (self : 't betree_list_t) (x : 't) : 't betree_list_t result =
     let tl = mem_replace_fwd self BetreeListNil in
@@ -157,7 +158,7 @@ val betree_list_push_front_fwd_back_def = Define ‘
 ’
 
 val betree_list_pop_front_fwd_def = Define ‘
-  (** [betree_main::betree::List::{1}::pop_front] *)
+  (** [betree_main::betree::List::{1}::pop_front]: forward function *)
   betree_list_pop_front_fwd (self : 't betree_list_t) : 't result =
     let ls = mem_replace_fwd self BetreeListNil in
     (case ls of
@@ -166,7 +167,7 @@ val betree_list_pop_front_fwd_def = Define ‘
 ’
 
 val betree_list_pop_front_back_def = Define ‘
-  (** [betree_main::betree::List::{1}::pop_front] *)
+  (** [betree_main::betree::List::{1}::pop_front]: backward function 0 *)
   betree_list_pop_front_back
     (self : 't betree_list_t) : 't betree_list_t result =
     let ls = mem_replace_fwd self BetreeListNil in
@@ -176,7 +177,7 @@ val betree_list_pop_front_back_def = Define ‘
 ’
 
 val betree_list_hd_fwd_def = Define ‘
-  (** [betree_main::betree::List::{1}::hd] *)
+  (** [betree_main::betree::List::{1}::hd]: forward function *)
   betree_list_hd_fwd (self : 't betree_list_t) : 't result =
     (case self of
     | BetreeListCons hd l => Return hd
@@ -184,7 +185,7 @@ val betree_list_hd_fwd_def = Define ‘
 ’
 
 val betree_list_head_has_key_fwd_def = Define ‘
-  (** [betree_main::betree::List::{2}::head_has_key] *)
+  (** [betree_main::betree::List::{2}::head_has_key]: forward function *)
   betree_list_head_has_key_fwd
     (self : (u64 # 't) betree_list_t) (key : u64) : bool result =
     (case self of
@@ -193,7 +194,7 @@ val betree_list_head_has_key_fwd_def = Define ‘
 ’
 
 val [betree_list_partition_at_pivot_fwd_def] = DefineDiv ‘
-  (** [betree_main::betree::List::{2}::partition_at_pivot] *)
+  (** [betree_main::betree::List::{2}::partition_at_pivot]: forward function *)
   betree_list_partition_at_pivot_fwd
     (self : (u64 # 't) betree_list_t) (pivot : u64) :
     ((u64 # 't) betree_list_t # (u64 # 't) betree_list_t) result
@@ -214,7 +215,7 @@ val [betree_list_partition_at_pivot_fwd_def] = DefineDiv ‘
 ’
 
 val betree_leaf_split_fwd_def = Define ‘
-  (** [betree_main::betree::Leaf::{3}::split] *)
+  (** [betree_main::betree::Leaf::{3}::split]: forward function *)
   betree_leaf_split_fwd
     (self : betree_leaf_t) (content : (u64 # u64) betree_list_t)
     (params : betree_params_t) (node_id_cnt : betree_node_id_counter_t)
@@ -256,7 +257,7 @@ val betree_leaf_split_fwd_def = Define ‘
 ’
 
 val betree_leaf_split_back_def = Define ‘
-  (** [betree_main::betree::Leaf::{3}::split] *)
+  (** [betree_main::betree::Leaf::{3}::split]: backward function 2 *)
   betree_leaf_split_back
     (self : betree_leaf_t) (content : (u64 # u64) betree_list_t)
     (params : betree_params_t) (node_id_cnt : betree_node_id_counter_t)
@@ -279,7 +280,7 @@ val betree_leaf_split_back_def = Define ‘
 ’
 
 val [betree_node_lookup_in_bindings_fwd_def] = DefineDiv ‘
-  (** [betree_main::betree::Node::{5}::lookup_in_bindings] *)
+  (** [betree_main::betree::Node::{5}::lookup_in_bindings]: forward function *)
   betree_node_lookup_in_bindings_fwd
     (key : u64) (bindings : (u64 # u64) betree_list_t) : u64 option result =
     (case bindings of
@@ -295,7 +296,7 @@ val [betree_node_lookup_in_bindings_fwd_def] = DefineDiv ‘
 ’
 
 val [betree_node_lookup_first_message_for_key_fwd_def] = DefineDiv ‘
-  (** [betree_main::betree::Node::{5}::lookup_first_message_for_key] *)
+  (** [betree_main::betree::Node::{5}::lookup_first_message_for_key]: forward function *)
   betree_node_lookup_first_message_for_key_fwd
     (key : u64) (msgs : (u64 # betree_message_t) betree_list_t) :
     (u64 # betree_message_t) betree_list_t result
@@ -310,7 +311,7 @@ val [betree_node_lookup_first_message_for_key_fwd_def] = DefineDiv ‘
 ’
 
 val [betree_node_lookup_first_message_for_key_back_def] = DefineDiv ‘
-  (** [betree_main::betree::Node::{5}::lookup_first_message_for_key] *)
+  (** [betree_main::betree::Node::{5}::lookup_first_message_for_key]: backward function 0 *)
   betree_node_lookup_first_message_for_key_back
     (key : u64) (msgs : (u64 # betree_message_t) betree_list_t)
     (ret : (u64 # betree_message_t) betree_list_t) :
@@ -331,7 +332,7 @@ val [betree_node_lookup_first_message_for_key_back_def] = DefineDiv ‘
 ’
 
 val [betree_node_apply_upserts_fwd_def] = DefineDiv ‘
-  (** [betree_main::betree::Node::{5}::apply_upserts] *)
+  (** [betree_main::betree::Node::{5}::apply_upserts]: forward function *)
   betree_node_apply_upserts_fwd
     (msgs : (u64 # betree_message_t) betree_list_t) (prev : u64 option)
     (key : u64) (st : state) :
@@ -364,7 +365,7 @@ val [betree_node_apply_upserts_fwd_def] = DefineDiv ‘
 ’
 
 val [betree_node_apply_upserts_back_def] = DefineDiv ‘
-  (** [betree_main::betree::Node::{5}::apply_upserts] *)
+  (** [betree_main::betree::Node::{5}::apply_upserts]: backward function 0 *)
   betree_node_apply_upserts_back
     (msgs : (u64 # betree_message_t) betree_list_t) (prev : u64 option)
     (key : u64) (st : state) :
@@ -396,7 +397,7 @@ val [betree_node_apply_upserts_back_def] = DefineDiv ‘
 ’
 
 val [betree_node_lookup_fwd_def, betree_node_lookup_back_def, betree_internal_lookup_in_children_fwd_def, betree_internal_lookup_in_children_back_def] = DefineDiv ‘
-  (** [betree_main::betree::Node::{5}::lookup] *)
+  (** [betree_main::betree::Node::{5}::lookup]: forward function *)
   (betree_node_lookup_fwd
      (self : betree_node_t) (key : u64) (st : state) :
      (state # u64 option) result
@@ -466,7 +467,7 @@ val [betree_node_lookup_fwd_def, betree_node_lookup_back_def, betree_internal_lo
       od))
   /\
   
-  (** [betree_main::betree::Node::{5}::lookup] *)
+  (** [betree_main::betree::Node::{5}::lookup]: backward function 0 *)
   (betree_node_lookup_back
      (self : betree_node_t) (key : u64) (st : state) : betree_node_t result =
     (case self of
@@ -534,7 +535,7 @@ val [betree_node_lookup_fwd_def, betree_node_lookup_back_def, betree_internal_lo
       od))
   /\
   
-  (** [betree_main::betree::Internal::{4}::lookup_in_children] *)
+  (** [betree_main::betree::Internal::{4}::lookup_in_children]: forward function *)
   (betree_internal_lookup_in_children_fwd
      (self : betree_internal_t) (key : u64) (st : state) :
      (state # u64 option) result
@@ -544,7 +545,7 @@ val [betree_node_lookup_fwd_def, betree_node_lookup_back_def, betree_internal_lo
     else betree_node_lookup_fwd self.betree_internal_right key st)
   /\
   
-  (** [betree_main::betree::Internal::{4}::lookup_in_children] *)
+  (** [betree_main::betree::Internal::{4}::lookup_in_children]: backward function 0 *)
   betree_internal_lookup_in_children_back
     (self : betree_internal_t) (key : u64) (st : state) :
     betree_internal_t result
@@ -563,7 +564,7 @@ val [betree_node_lookup_fwd_def, betree_node_lookup_back_def, betree_internal_lo
 ’
 
 val [betree_node_lookup_mut_in_bindings_fwd_def] = DefineDiv ‘
-  (** [betree_main::betree::Node::{5}::lookup_mut_in_bindings] *)
+  (** [betree_main::betree::Node::{5}::lookup_mut_in_bindings]: forward function *)
   betree_node_lookup_mut_in_bindings_fwd
     (key : u64) (bindings : (u64 # u64) betree_list_t) :
     (u64 # u64) betree_list_t result
@@ -578,7 +579,7 @@ val [betree_node_lookup_mut_in_bindings_fwd_def] = DefineDiv ‘
 ’
 
 val [betree_node_lookup_mut_in_bindings_back_def] = DefineDiv ‘
-  (** [betree_main::betree::Node::{5}::lookup_mut_in_bindings] *)
+  (** [betree_main::betree::Node::{5}::lookup_mut_in_bindings]: backward function 0 *)
   betree_node_lookup_mut_in_bindings_back
     (key : u64) (bindings : (u64 # u64) betree_list_t)
     (ret : (u64 # u64) betree_list_t) :
@@ -598,7 +599,8 @@ val [betree_node_lookup_mut_in_bindings_back_def] = DefineDiv ‘
 ’
 
 val betree_node_apply_to_leaf_fwd_back_def = Define ‘
-  (** [betree_main::betree::Node::{5}::apply_to_leaf] *)
+  (** [betree_main::betree::Node::{5}::apply_to_leaf]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   betree_node_apply_to_leaf_fwd_back
     (bindings : (u64 # u64) betree_list_t) (key : u64)
     (new_msg : betree_message_t) :
@@ -651,7 +653,8 @@ val betree_node_apply_to_leaf_fwd_back_def = Define ‘
 ’
 
 val [betree_node_apply_messages_to_leaf_fwd_back_def] = DefineDiv ‘
-  (** [betree_main::betree::Node::{5}::apply_messages_to_leaf] *)
+  (** [betree_main::betree::Node::{5}::apply_messages_to_leaf]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   betree_node_apply_messages_to_leaf_fwd_back
     (bindings : (u64 # u64) betree_list_t)
     (new_msgs : (u64 # betree_message_t) betree_list_t) :
@@ -668,7 +671,8 @@ val [betree_node_apply_messages_to_leaf_fwd_back_def] = DefineDiv ‘
 ’
 
 val [betree_node_filter_messages_for_key_fwd_back_def] = DefineDiv ‘
-  (** [betree_main::betree::Node::{5}::filter_messages_for_key] *)
+  (** [betree_main::betree::Node::{5}::filter_messages_for_key]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   betree_node_filter_messages_for_key_fwd_back
     (key : u64) (msgs : (u64 # betree_message_t) betree_list_t) :
     (u64 # betree_message_t) betree_list_t result
@@ -687,7 +691,7 @@ val [betree_node_filter_messages_for_key_fwd_back_def] = DefineDiv ‘
 ’
 
 val [betree_node_lookup_first_message_after_key_fwd_def] = DefineDiv ‘
-  (** [betree_main::betree::Node::{5}::lookup_first_message_after_key] *)
+  (** [betree_main::betree::Node::{5}::lookup_first_message_after_key]: forward function *)
   betree_node_lookup_first_message_after_key_fwd
     (key : u64) (msgs : (u64 # betree_message_t) betree_list_t) :
     (u64 # betree_message_t) betree_list_t result
@@ -702,7 +706,7 @@ val [betree_node_lookup_first_message_after_key_fwd_def] = DefineDiv ‘
 ’
 
 val [betree_node_lookup_first_message_after_key_back_def] = DefineDiv ‘
-  (** [betree_main::betree::Node::{5}::lookup_first_message_after_key] *)
+  (** [betree_main::betree::Node::{5}::lookup_first_message_after_key]: backward function 0 *)
   betree_node_lookup_first_message_after_key_back
     (key : u64) (msgs : (u64 # betree_message_t) betree_list_t)
     (ret : (u64 # betree_message_t) betree_list_t) :
@@ -723,7 +727,8 @@ val [betree_node_lookup_first_message_after_key_back_def] = DefineDiv ‘
 ’
 
 val betree_node_apply_to_internal_fwd_back_def = Define ‘
-  (** [betree_main::betree::Node::{5}::apply_to_internal] *)
+  (** [betree_main::betree::Node::{5}::apply_to_internal]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   betree_node_apply_to_internal_fwd_back
     (msgs : (u64 # betree_message_t) betree_list_t) (key : u64)
     (new_msg : betree_message_t) :
@@ -789,7 +794,8 @@ val betree_node_apply_to_internal_fwd_back_def = Define ‘
 ’
 
 val [betree_node_apply_messages_to_internal_fwd_back_def] = DefineDiv ‘
-  (** [betree_main::betree::Node::{5}::apply_messages_to_internal] *)
+  (** [betree_main::betree::Node::{5}::apply_messages_to_internal]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   betree_node_apply_messages_to_internal_fwd_back
     (msgs : (u64 # betree_message_t) betree_list_t)
     (new_msgs : (u64 # betree_message_t) betree_list_t) :
@@ -806,7 +812,7 @@ val [betree_node_apply_messages_to_internal_fwd_back_def] = DefineDiv ‘
 ’
 
 val [betree_node_apply_messages_fwd_def, betree_node_apply_messages_back_def, betree_internal_flush_fwd_def, betree_internal_flush_back_def] = DefineDiv ‘
-  (** [betree_main::betree::Node::{5}::apply_messages] *)
+  (** [betree_main::betree::Node::{5}::apply_messages]: forward function *)
   (betree_node_apply_messages_fwd
      (self : betree_node_t) (params : betree_params_t)
      (node_id_cnt : betree_node_id_counter_t)
@@ -861,7 +867,7 @@ val [betree_node_apply_messages_fwd_def, betree_node_apply_messages_back_def, be
       od))
   /\
   
-  (** [betree_main::betree::Node::{5}::apply_messages] *)
+  (** [betree_main::betree::Node::{5}::apply_messages]: backward function 0 *)
   (betree_node_apply_messages_back
      (self : betree_node_t) (params : betree_params_t)
      (node_id_cnt : betree_node_id_counter_t)
@@ -918,7 +924,7 @@ val [betree_node_apply_messages_fwd_def, betree_node_apply_messages_back_def, be
       od))
   /\
   
-  (** [betree_main::betree::Internal::{4}::flush] *)
+  (** [betree_main::betree::Internal::{4}::flush]: forward function *)
   (betree_internal_flush_fwd
      (self : betree_internal_t) (params : betree_params_t)
      (node_id_cnt : betree_node_id_counter_t)
@@ -967,7 +973,7 @@ val [betree_node_apply_messages_fwd_def, betree_node_apply_messages_back_def, be
     od)
   /\
   
-  (** [betree_main::betree::Internal::{4}::flush] *)
+  (** [betree_main::betree::Internal::{4}::flush]: backward function 0 *)
   betree_internal_flush_back
     (self : betree_internal_t) (params : betree_params_t)
     (node_id_cnt : betree_node_id_counter_t)
@@ -1016,7 +1022,7 @@ val [betree_node_apply_messages_fwd_def, betree_node_apply_messages_back_def, be
 ’
 
 val betree_node_apply_fwd_def = Define ‘
-  (** [betree_main::betree::Node::{5}::apply] *)
+  (** [betree_main::betree::Node::{5}::apply]: forward function *)
   betree_node_apply_fwd
     (self : betree_node_t) (params : betree_params_t)
     (node_id_cnt : betree_node_id_counter_t) (key : u64)
@@ -1036,7 +1042,7 @@ val betree_node_apply_fwd_def = Define ‘
 ’
 
 val betree_node_apply_back_def = Define ‘
-  (** [betree_main::betree::Node::{5}::apply] *)
+  (** [betree_main::betree::Node::{5}::apply]: backward function 0 *)
   betree_node_apply_back
     (self : betree_node_t) (params : betree_params_t)
     (node_id_cnt : betree_node_id_counter_t) (key : u64)
@@ -1049,7 +1055,7 @@ val betree_node_apply_back_def = Define ‘
 ’
 
 val betree_be_tree_new_fwd_def = Define ‘
-  (** [betree_main::betree::BeTree::{6}::new] *)
+  (** [betree_main::betree::BeTree::{6}::new]: forward function *)
   betree_be_tree_new_fwd
     (min_flush_size : u64) (split_size : u64) (st : state) :
     (state # betree_be_tree_t) result
@@ -1075,7 +1081,7 @@ val betree_be_tree_new_fwd_def = Define ‘
 ’
 
 val betree_be_tree_apply_fwd_def = Define ‘
-  (** [betree_main::betree::BeTree::{6}::apply] *)
+  (** [betree_main::betree::BeTree::{6}::apply]: forward function *)
   betree_be_tree_apply_fwd
     (self : betree_be_tree_t) (key : u64) (msg : betree_message_t) (st : state)
     :
@@ -1093,7 +1099,7 @@ val betree_be_tree_apply_fwd_def = Define ‘
 ’
 
 val betree_be_tree_apply_back_def = Define ‘
-  (** [betree_main::betree::BeTree::{6}::apply] *)
+  (** [betree_main::betree::BeTree::{6}::apply]: backward function 0 *)
   betree_be_tree_apply_back
     (self : betree_be_tree_t) (key : u64) (msg : betree_message_t) (st : state)
     :
@@ -1113,7 +1119,7 @@ val betree_be_tree_apply_back_def = Define ‘
 ’
 
 val betree_be_tree_insert_fwd_def = Define ‘
-  (** [betree_main::betree::BeTree::{6}::insert] *)
+  (** [betree_main::betree::BeTree::{6}::insert]: forward function *)
   betree_be_tree_insert_fwd
     (self : betree_be_tree_t) (key : u64) (value : u64) (st : state) :
     (state # unit) result
@@ -1127,7 +1133,7 @@ val betree_be_tree_insert_fwd_def = Define ‘
 ’
 
 val betree_be_tree_insert_back_def = Define ‘
-  (** [betree_main::betree::BeTree::{6}::insert] *)
+  (** [betree_main::betree::BeTree::{6}::insert]: backward function 0 *)
   betree_be_tree_insert_back
     (self : betree_be_tree_t) (key : u64) (value : u64) (st : state) :
     betree_be_tree_t result
@@ -1136,7 +1142,7 @@ val betree_be_tree_insert_back_def = Define ‘
 ’
 
 val betree_be_tree_delete_fwd_def = Define ‘
-  (** [betree_main::betree::BeTree::{6}::delete] *)
+  (** [betree_main::betree::BeTree::{6}::delete]: forward function *)
   betree_be_tree_delete_fwd
     (self : betree_be_tree_t) (key : u64) (st : state) :
     (state # unit) result
@@ -1149,7 +1155,7 @@ val betree_be_tree_delete_fwd_def = Define ‘
 ’
 
 val betree_be_tree_delete_back_def = Define ‘
-  (** [betree_main::betree::BeTree::{6}::delete] *)
+  (** [betree_main::betree::BeTree::{6}::delete]: backward function 0 *)
   betree_be_tree_delete_back
     (self : betree_be_tree_t) (key : u64) (st : state) :
     betree_be_tree_t result
@@ -1158,7 +1164,7 @@ val betree_be_tree_delete_back_def = Define ‘
 ’
 
 val betree_be_tree_upsert_fwd_def = Define ‘
-  (** [betree_main::betree::BeTree::{6}::upsert] *)
+  (** [betree_main::betree::BeTree::{6}::upsert]: forward function *)
   betree_be_tree_upsert_fwd
     (self : betree_be_tree_t) (key : u64) (upd : betree_upsert_fun_state_t)
     (st : state) :
@@ -1172,7 +1178,7 @@ val betree_be_tree_upsert_fwd_def = Define ‘
 ’
 
 val betree_be_tree_upsert_back_def = Define ‘
-  (** [betree_main::betree::BeTree::{6}::upsert] *)
+  (** [betree_main::betree::BeTree::{6}::upsert]: backward function 0 *)
   betree_be_tree_upsert_back
     (self : betree_be_tree_t) (key : u64) (upd : betree_upsert_fun_state_t)
     (st : state) :
@@ -1182,7 +1188,7 @@ val betree_be_tree_upsert_back_def = Define ‘
 ’
 
 val betree_be_tree_lookup_fwd_def = Define ‘
-  (** [betree_main::betree::BeTree::{6}::lookup] *)
+  (** [betree_main::betree::BeTree::{6}::lookup]: forward function *)
   betree_be_tree_lookup_fwd
     (self : betree_be_tree_t) (key : u64) (st : state) :
     (state # u64 option) result
@@ -1191,7 +1197,7 @@ val betree_be_tree_lookup_fwd_def = Define ‘
 ’
 
 val betree_be_tree_lookup_back_def = Define ‘
-  (** [betree_main::betree::BeTree::{6}::lookup] *)
+  (** [betree_main::betree::BeTree::{6}::lookup]: backward function 0 *)
   betree_be_tree_lookup_back
     (self : betree_be_tree_t) (key : u64) (st : state) :
     betree_be_tree_t result
@@ -1203,7 +1209,7 @@ val betree_be_tree_lookup_back_def = Define ‘
 ’
 
 val main_fwd_def = Define ‘
-  (** [betree_main::main] *)
+  (** [betree_main::main]: forward function *)
   main_fwd : unit result =
     Return ()
 ’
diff --git a/tests/hol4/betree/betreeMain_OpaqueScript.sml b/tests/hol4/betree/betreeMain_OpaqueScript.sml
index 10d67cca..1d16db4c 100644
--- a/tests/hol4/betree/betreeMain_OpaqueScript.sml
+++ b/tests/hol4/betree/betreeMain_OpaqueScript.sml
@@ -6,21 +6,21 @@ open betreeMain_TypesTheory
 val _ = new_theory "betreeMain_Opaque"
 
 
-val _ = new_constant ("betree_utils_load_internal_node_fwd",
+(** [betree_main::betree_utils::load_internal_node]: forward function *)val _ = new_constant ("betree_utils_load_internal_node_fwd",
   “:u64 -> state -> (state # (u64 # betree_message_t) betree_list_t)
   result”)
 
-val _ = new_constant ("betree_utils_store_internal_node_fwd",
+(** [betree_main::betree_utils::store_internal_node]: forward function *)val _ = new_constant ("betree_utils_store_internal_node_fwd",
   “:u64 -> (u64 # betree_message_t) betree_list_t -> state -> (state # unit)
   result”)
 
-val _ = new_constant ("betree_utils_load_leaf_node_fwd",
+(** [betree_main::betree_utils::load_leaf_node]: forward function *)val _ = new_constant ("betree_utils_load_leaf_node_fwd",
   “:u64 -> state -> (state # (u64 # u64) betree_list_t) result”)
 
-val _ = new_constant ("betree_utils_store_leaf_node_fwd",
+(** [betree_main::betree_utils::store_leaf_node]: forward function *)val _ = new_constant ("betree_utils_store_leaf_node_fwd",
   “:u64 -> (u64 # u64) betree_list_t -> state -> (state # unit) result”)
 
-val _ = new_constant ("core_option_option_unwrap_fwd",
+(** [core::option::Option::{0}::unwrap]: forward function *)val _ = new_constant ("core_option_option_unwrap_fwd",
   “:'t option -> state -> (state # 't) result”)
 
 val _ = export_theory ()
diff --git a/tests/hol4/hashmap/hashmap_FunsScript.sml b/tests/hol4/hashmap/hashmap_FunsScript.sml
index 9ad497f5..1ed57080 100644
--- a/tests/hol4/hashmap/hashmap_FunsScript.sml
+++ b/tests/hol4/hashmap/hashmap_FunsScript.sml
@@ -7,13 +7,13 @@ val _ = new_theory "hashmap_Funs"
 
 
 val hash_key_fwd_def = Define ‘
-  (** [hashmap::hash_key] *)
+  (** [hashmap::hash_key]: forward function *)
   hash_key_fwd (k : usize) : usize result =
     Return k
 ’
 
 val [hash_map_allocate_slots_loop_fwd_def] = DefineDiv ‘
-  (** [hashmap::HashMap::{0}::allocate_slots] *)
+  (** [hashmap::HashMap::{0}::allocate_slots]: loop 0: forward function *)
   hash_map_allocate_slots_loop_fwd
     (slots : 't list_t vec) (n : usize) : 't list_t vec result =
     if usize_gt n (int_to_usize 0)
@@ -27,14 +27,14 @@ val [hash_map_allocate_slots_loop_fwd_def] = DefineDiv ‘
 ’
 
 val hash_map_allocate_slots_fwd_def = Define ‘
-  (** [hashmap::HashMap::{0}::allocate_slots] *)
+  (** [hashmap::HashMap::{0}::allocate_slots]: forward function *)
   hash_map_allocate_slots_fwd
     (slots : 't list_t vec) (n : usize) : 't list_t vec result =
     hash_map_allocate_slots_loop_fwd slots n
 ’
 
 val hash_map_new_with_capacity_fwd_def = Define ‘
-  (** [hashmap::HashMap::{0}::new_with_capacity] *)
+  (** [hashmap::HashMap::{0}::new_with_capacity]: forward function *)
   hash_map_new_with_capacity_fwd
     (capacity : usize) (max_load_dividend : usize) (max_load_divisor : usize) :
     't hash_map_t result
@@ -55,14 +55,15 @@ val hash_map_new_with_capacity_fwd_def = Define ‘
 ’
 
 val hash_map_new_fwd_def = Define ‘
-  (** [hashmap::HashMap::{0}::new] *)
+  (** [hashmap::HashMap::{0}::new]: forward function *)
   hash_map_new_fwd : 't hash_map_t result =
     hash_map_new_with_capacity_fwd (int_to_usize 32) (int_to_usize 4)
       (int_to_usize 5)
 ’
 
 val [hash_map_clear_loop_fwd_back_def] = DefineDiv ‘
-  (** [hashmap::HashMap::{0}::clear] *)
+  (** [hashmap::HashMap::{0}::clear]: loop 0: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   hash_map_clear_loop_fwd_back
     (slots : 't list_t vec) (i : usize) : 't list_t vec result =
     let i0 = vec_len slots in
@@ -77,7 +78,8 @@ val [hash_map_clear_loop_fwd_back_def] = DefineDiv ‘
 ’
 
 val hash_map_clear_fwd_back_def = Define ‘
-  (** [hashmap::HashMap::{0}::clear] *)
+  (** [hashmap::HashMap::{0}::clear]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   hash_map_clear_fwd_back (self : 't hash_map_t) : 't hash_map_t result =
     do
     v <- hash_map_clear_loop_fwd_back self.hash_map_slots (int_to_usize 0);
@@ -91,13 +93,13 @@ val hash_map_clear_fwd_back_def = Define ‘
 ’
 
 val hash_map_len_fwd_def = Define ‘
-  (** [hashmap::HashMap::{0}::len] *)
+  (** [hashmap::HashMap::{0}::len]: forward function *)
   hash_map_len_fwd (self : 't hash_map_t) : usize result =
     Return self.hash_map_num_entries
 ’
 
 val [hash_map_insert_in_list_loop_fwd_def] = DefineDiv ‘
-  (** [hashmap::HashMap::{0}::insert_in_list] *)
+  (** [hashmap::HashMap::{0}::insert_in_list]: loop 0: forward function *)
   hash_map_insert_in_list_loop_fwd
     (key : usize) (value : 't) (ls : 't list_t) : bool result =
     (case ls of
@@ -109,14 +111,14 @@ val [hash_map_insert_in_list_loop_fwd_def] = DefineDiv ‘
 ’
 
 val hash_map_insert_in_list_fwd_def = Define ‘
-  (** [hashmap::HashMap::{0}::insert_in_list] *)
+  (** [hashmap::HashMap::{0}::insert_in_list]: forward function *)
   hash_map_insert_in_list_fwd
     (key : usize) (value : 't) (ls : 't list_t) : bool result =
     hash_map_insert_in_list_loop_fwd key value ls
 ’
 
 val [hash_map_insert_in_list_loop_back_def] = DefineDiv ‘
-  (** [hashmap::HashMap::{0}::insert_in_list] *)
+  (** [hashmap::HashMap::{0}::insert_in_list]: loop 0: backward function 0 *)
   hash_map_insert_in_list_loop_back
     (key : usize) (value : 't) (ls : 't list_t) : 't list_t result =
     (case ls of
@@ -132,14 +134,15 @@ val [hash_map_insert_in_list_loop_back_def] = DefineDiv ‘
 ’
 
 val hash_map_insert_in_list_back_def = Define ‘
-  (** [hashmap::HashMap::{0}::insert_in_list] *)
+  (** [hashmap::HashMap::{0}::insert_in_list]: backward function 0 *)
   hash_map_insert_in_list_back
     (key : usize) (value : 't) (ls : 't list_t) : 't list_t result =
     hash_map_insert_in_list_loop_back key value ls
 ’
 
 val hash_map_insert_no_resize_fwd_back_def = Define ‘
-  (** [hashmap::HashMap::{0}::insert_no_resize] *)
+  (** [hashmap::HashMap::{0}::insert_no_resize]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   hash_map_insert_no_resize_fwd_back
     (self : 't hash_map_t) (key : usize) (value : 't) : 't hash_map_t result =
     do
@@ -176,7 +179,8 @@ Definition core_num_u32_max_c_def:
 End
 
 val [hash_map_move_elements_from_list_loop_fwd_back_def] = DefineDiv ‘
-  (** [hashmap::HashMap::{0}::move_elements_from_list] *)
+  (** [hashmap::HashMap::{0}::move_elements_from_list]: loop 0: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   hash_map_move_elements_from_list_loop_fwd_back
     (ntable : 't hash_map_t) (ls : 't list_t) : 't hash_map_t result =
     (case ls of
@@ -189,14 +193,16 @@ val [hash_map_move_elements_from_list_loop_fwd_back_def] = DefineDiv ‘
 ’
 
 val hash_map_move_elements_from_list_fwd_back_def = Define ‘
-  (** [hashmap::HashMap::{0}::move_elements_from_list] *)
+  (** [hashmap::HashMap::{0}::move_elements_from_list]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   hash_map_move_elements_from_list_fwd_back
     (ntable : 't hash_map_t) (ls : 't list_t) : 't hash_map_t result =
     hash_map_move_elements_from_list_loop_fwd_back ntable ls
 ’
 
 val [hash_map_move_elements_loop_fwd_back_def] = DefineDiv ‘
-  (** [hashmap::HashMap::{0}::move_elements] *)
+  (** [hashmap::HashMap::{0}::move_elements]: loop 0: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   hash_map_move_elements_loop_fwd_back
     (ntable : 't hash_map_t) (slots : 't list_t vec) (i : usize) :
     ('t hash_map_t # 't list_t vec) result
@@ -221,7 +227,8 @@ val [hash_map_move_elements_loop_fwd_back_def] = DefineDiv ‘
 ’
 
 val hash_map_move_elements_fwd_back_def = Define ‘
-  (** [hashmap::HashMap::{0}::move_elements] *)
+  (** [hashmap::HashMap::{0}::move_elements]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   hash_map_move_elements_fwd_back
     (ntable : 't hash_map_t) (slots : 't list_t vec) (i : usize) :
     ('t hash_map_t # 't list_t vec) result
@@ -230,7 +237,8 @@ val hash_map_move_elements_fwd_back_def = Define ‘
 ’
 
 val hash_map_try_resize_fwd_back_def = Define ‘
-  (** [hashmap::HashMap::{0}::try_resize] *)
+  (** [hashmap::HashMap::{0}::try_resize]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   hash_map_try_resize_fwd_back (self : 't hash_map_t) : 't hash_map_t result =
     do
     max_usize <- mk_usize (u32_to_int core_num_u32_max_c);
@@ -263,7 +271,8 @@ val hash_map_try_resize_fwd_back_def = Define ‘
 ’
 
 val hash_map_insert_fwd_back_def = Define ‘
-  (** [hashmap::HashMap::{0}::insert] *)
+  (** [hashmap::HashMap::{0}::insert]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   hash_map_insert_fwd_back
     (self : 't hash_map_t) (key : usize) (value : 't) : 't hash_map_t result =
     do
@@ -276,7 +285,7 @@ val hash_map_insert_fwd_back_def = Define ‘
 ’
 
 val [hash_map_contains_key_in_list_loop_fwd_def] = DefineDiv ‘
-  (** [hashmap::HashMap::{0}::contains_key_in_list] *)
+  (** [hashmap::HashMap::{0}::contains_key_in_list]: loop 0: forward function *)
   hash_map_contains_key_in_list_loop_fwd
     (key : usize) (ls : 't list_t) : bool result =
     (case ls of
@@ -288,14 +297,14 @@ val [hash_map_contains_key_in_list_loop_fwd_def] = DefineDiv ‘
 ’
 
 val hash_map_contains_key_in_list_fwd_def = Define ‘
-  (** [hashmap::HashMap::{0}::contains_key_in_list] *)
+  (** [hashmap::HashMap::{0}::contains_key_in_list]: forward function *)
   hash_map_contains_key_in_list_fwd
     (key : usize) (ls : 't list_t) : bool result =
     hash_map_contains_key_in_list_loop_fwd key ls
 ’
 
 val hash_map_contains_key_fwd_def = Define ‘
-  (** [hashmap::HashMap::{0}::contains_key] *)
+  (** [hashmap::HashMap::{0}::contains_key]: forward function *)
   hash_map_contains_key_fwd
     (self : 't hash_map_t) (key : usize) : bool result =
     do
@@ -310,7 +319,7 @@ val hash_map_contains_key_fwd_def = Define ‘
 ’
 
 val [hash_map_get_in_list_loop_fwd_def] = DefineDiv ‘
-  (** [hashmap::HashMap::{0}::get_in_list] *)
+  (** [hashmap::HashMap::{0}::get_in_list]: loop 0: forward function *)
   hash_map_get_in_list_loop_fwd (key : usize) (ls : 't list_t) : 't result =
     (case ls of
     | ListCons ckey cvalue tl =>
@@ -321,13 +330,13 @@ val [hash_map_get_in_list_loop_fwd_def] = DefineDiv ‘
 ’
 
 val hash_map_get_in_list_fwd_def = Define ‘
-  (** [hashmap::HashMap::{0}::get_in_list] *)
+  (** [hashmap::HashMap::{0}::get_in_list]: forward function *)
   hash_map_get_in_list_fwd (key : usize) (ls : 't list_t) : 't result =
     hash_map_get_in_list_loop_fwd key ls
 ’
 
 val hash_map_get_fwd_def = Define ‘
-  (** [hashmap::HashMap::{0}::get] *)
+  (** [hashmap::HashMap::{0}::get]: forward function *)
   hash_map_get_fwd (self : 't hash_map_t) (key : usize) : 't result =
     do
     hash <- hash_key_fwd key;
@@ -341,7 +350,7 @@ val hash_map_get_fwd_def = Define ‘
 ’
 
 val [hash_map_get_mut_in_list_loop_fwd_def] = DefineDiv ‘
-  (** [hashmap::HashMap::{0}::get_mut_in_list] *)
+  (** [hashmap::HashMap::{0}::get_mut_in_list]: loop 0: forward function *)
   hash_map_get_mut_in_list_loop_fwd
     (ls : 't list_t) (key : usize) : 't result =
     (case ls of
@@ -353,13 +362,13 @@ val [hash_map_get_mut_in_list_loop_fwd_def] = DefineDiv ‘
 ’
 
 val hash_map_get_mut_in_list_fwd_def = Define ‘
-  (** [hashmap::HashMap::{0}::get_mut_in_list] *)
+  (** [hashmap::HashMap::{0}::get_mut_in_list]: forward function *)
   hash_map_get_mut_in_list_fwd (ls : 't list_t) (key : usize) : 't result =
     hash_map_get_mut_in_list_loop_fwd ls key
 ’
 
 val [hash_map_get_mut_in_list_loop_back_def] = DefineDiv ‘
-  (** [hashmap::HashMap::{0}::get_mut_in_list] *)
+  (** [hashmap::HashMap::{0}::get_mut_in_list]: loop 0: backward function 0 *)
   hash_map_get_mut_in_list_loop_back
     (ls : 't list_t) (key : usize) (ret : 't) : 't list_t result =
     (case ls of
@@ -375,14 +384,14 @@ val [hash_map_get_mut_in_list_loop_back_def] = DefineDiv ‘
 ’
 
 val hash_map_get_mut_in_list_back_def = Define ‘
-  (** [hashmap::HashMap::{0}::get_mut_in_list] *)
+  (** [hashmap::HashMap::{0}::get_mut_in_list]: backward function 0 *)
   hash_map_get_mut_in_list_back
     (ls : 't list_t) (key : usize) (ret : 't) : 't list_t result =
     hash_map_get_mut_in_list_loop_back ls key ret
 ’
 
 val hash_map_get_mut_fwd_def = Define ‘
-  (** [hashmap::HashMap::{0}::get_mut] *)
+  (** [hashmap::HashMap::{0}::get_mut]: forward function *)
   hash_map_get_mut_fwd (self : 't hash_map_t) (key : usize) : 't result =
     do
     hash <- hash_key_fwd key;
@@ -396,7 +405,7 @@ val hash_map_get_mut_fwd_def = Define ‘
 ’
 
 val hash_map_get_mut_back_def = Define ‘
-  (** [hashmap::HashMap::{0}::get_mut] *)
+  (** [hashmap::HashMap::{0}::get_mut]: backward function 0 *)
   hash_map_get_mut_back
     (self : 't hash_map_t) (key : usize) (ret : 't) : 't hash_map_t result =
     do
@@ -413,7 +422,7 @@ val hash_map_get_mut_back_def = Define ‘
 ’
 
 val [hash_map_remove_from_list_loop_fwd_def] = DefineDiv ‘
-  (** [hashmap::HashMap::{0}::remove_from_list] *)
+  (** [hashmap::HashMap::{0}::remove_from_list]: loop 0: forward function *)
   hash_map_remove_from_list_loop_fwd
     (key : usize) (ls : 't list_t) : 't option result =
     (case ls of
@@ -429,14 +438,14 @@ val [hash_map_remove_from_list_loop_fwd_def] = DefineDiv ‘
 ’
 
 val hash_map_remove_from_list_fwd_def = Define ‘
-  (** [hashmap::HashMap::{0}::remove_from_list] *)
+  (** [hashmap::HashMap::{0}::remove_from_list]: forward function *)
   hash_map_remove_from_list_fwd
     (key : usize) (ls : 't list_t) : 't option result =
     hash_map_remove_from_list_loop_fwd key ls
 ’
 
 val [hash_map_remove_from_list_loop_back_def] = DefineDiv ‘
-  (** [hashmap::HashMap::{0}::remove_from_list] *)
+  (** [hashmap::HashMap::{0}::remove_from_list]: loop 0: backward function 1 *)
   hash_map_remove_from_list_loop_back
     (key : usize) (ls : 't list_t) : 't list_t result =
     (case ls of
@@ -456,14 +465,14 @@ val [hash_map_remove_from_list_loop_back_def] = DefineDiv ‘
 ’
 
 val hash_map_remove_from_list_back_def = Define ‘
-  (** [hashmap::HashMap::{0}::remove_from_list] *)
+  (** [hashmap::HashMap::{0}::remove_from_list]: backward function 1 *)
   hash_map_remove_from_list_back
     (key : usize) (ls : 't list_t) : 't list_t result =
     hash_map_remove_from_list_loop_back key ls
 ’
 
 val hash_map_remove_fwd_def = Define ‘
-  (** [hashmap::HashMap::{0}::remove] *)
+  (** [hashmap::HashMap::{0}::remove]: forward function *)
   hash_map_remove_fwd (self : 't hash_map_t) (key : usize) : 't option result =
     do
     hash <- hash_key_fwd key;
@@ -484,7 +493,7 @@ val hash_map_remove_fwd_def = Define ‘
 ’
 
 val hash_map_remove_back_def = Define ‘
-  (** [hashmap::HashMap::{0}::remove] *)
+  (** [hashmap::HashMap::{0}::remove]: backward function 0 *)
   hash_map_remove_back
     (self : 't hash_map_t) (key : usize) : 't hash_map_t result =
     do
@@ -513,7 +522,7 @@ val hash_map_remove_back_def = Define ‘
 ’
 
 val test1_fwd_def = Define ‘
-  (** [hashmap::test1] *)
+  (** [hashmap::test1]: forward function *)
   test1_fwd : unit result =
     do
     hm <- hash_map_new_fwd;
diff --git a/tests/hol4/hashmap_on_disk/hashmapMain_FunsScript.sml b/tests/hol4/hashmap_on_disk/hashmapMain_FunsScript.sml
index 5a8f7ff8..6ec6223d 100644
--- a/tests/hol4/hashmap_on_disk/hashmapMain_FunsScript.sml
+++ b/tests/hol4/hashmap_on_disk/hashmapMain_FunsScript.sml
@@ -7,13 +7,13 @@ val _ = new_theory "hashmapMain_Funs"
 
 
 val hashmap_hash_key_fwd_def = Define ‘
-  (** [hashmap_main::hashmap::hash_key] *)
+  (** [hashmap_main::hashmap::hash_key]: forward function *)
   hashmap_hash_key_fwd (k : usize) : usize result =
     Return k
 ’
 
 val [hashmap_hash_map_allocate_slots_loop_fwd_def] = DefineDiv ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::allocate_slots] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::allocate_slots]: loop 0: forward function *)
   hashmap_hash_map_allocate_slots_loop_fwd
     (slots : 't hashmap_list_t vec) (n : usize) :
     't hashmap_list_t vec result
@@ -29,7 +29,7 @@ val [hashmap_hash_map_allocate_slots_loop_fwd_def] = DefineDiv ‘
 ’
 
 val hashmap_hash_map_allocate_slots_fwd_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::allocate_slots] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::allocate_slots]: forward function *)
   hashmap_hash_map_allocate_slots_fwd
     (slots : 't hashmap_list_t vec) (n : usize) :
     't hashmap_list_t vec result
@@ -38,7 +38,7 @@ val hashmap_hash_map_allocate_slots_fwd_def = Define ‘
 ’
 
 val hashmap_hash_map_new_with_capacity_fwd_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::new_with_capacity] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::new_with_capacity]: forward function *)
   hashmap_hash_map_new_with_capacity_fwd
     (capacity : usize) (max_load_dividend : usize) (max_load_divisor : usize) :
     't hashmap_hash_map_t result
@@ -60,14 +60,15 @@ val hashmap_hash_map_new_with_capacity_fwd_def = Define ‘
 ’
 
 val hashmap_hash_map_new_fwd_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::new] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::new]: forward function *)
   hashmap_hash_map_new_fwd : 't hashmap_hash_map_t result =
     hashmap_hash_map_new_with_capacity_fwd (int_to_usize 32) (int_to_usize 4)
       (int_to_usize 5)
 ’
 
 val [hashmap_hash_map_clear_loop_fwd_back_def] = DefineDiv ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::clear] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::clear]: loop 0: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   hashmap_hash_map_clear_loop_fwd_back
     (slots : 't hashmap_list_t vec) (i : usize) :
     't hashmap_list_t vec result
@@ -84,7 +85,8 @@ val [hashmap_hash_map_clear_loop_fwd_back_def] = DefineDiv ‘
 ’
 
 val hashmap_hash_map_clear_fwd_back_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::clear] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::clear]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   hashmap_hash_map_clear_fwd_back
     (self : 't hashmap_hash_map_t) : 't hashmap_hash_map_t result =
     do
@@ -102,13 +104,13 @@ val hashmap_hash_map_clear_fwd_back_def = Define ‘
 ’
 
 val hashmap_hash_map_len_fwd_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::len] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::len]: forward function *)
   hashmap_hash_map_len_fwd (self : 't hashmap_hash_map_t) : usize result =
     Return self.hashmap_hash_map_num_entries
 ’
 
 val [hashmap_hash_map_insert_in_list_loop_fwd_def] = DefineDiv ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::insert_in_list] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::insert_in_list]: loop 0: forward function *)
   hashmap_hash_map_insert_in_list_loop_fwd
     (key : usize) (value : 't) (ls : 't hashmap_list_t) : bool result =
     (case ls of
@@ -120,14 +122,14 @@ val [hashmap_hash_map_insert_in_list_loop_fwd_def] = DefineDiv ‘
 ’
 
 val hashmap_hash_map_insert_in_list_fwd_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::insert_in_list] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::insert_in_list]: forward function *)
   hashmap_hash_map_insert_in_list_fwd
     (key : usize) (value : 't) (ls : 't hashmap_list_t) : bool result =
     hashmap_hash_map_insert_in_list_loop_fwd key value ls
 ’
 
 val [hashmap_hash_map_insert_in_list_loop_back_def] = DefineDiv ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::insert_in_list] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::insert_in_list]: loop 0: backward function 0 *)
   hashmap_hash_map_insert_in_list_loop_back
     (key : usize) (value : 't) (ls : 't hashmap_list_t) :
     't hashmap_list_t result
@@ -146,7 +148,7 @@ val [hashmap_hash_map_insert_in_list_loop_back_def] = DefineDiv ‘
 ’
 
 val hashmap_hash_map_insert_in_list_back_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::insert_in_list] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::insert_in_list]: backward function 0 *)
   hashmap_hash_map_insert_in_list_back
     (key : usize) (value : 't) (ls : 't hashmap_list_t) :
     't hashmap_list_t result
@@ -155,7 +157,8 @@ val hashmap_hash_map_insert_in_list_back_def = Define ‘
 ’
 
 val hashmap_hash_map_insert_no_resize_fwd_back_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::insert_no_resize] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::insert_no_resize]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   hashmap_hash_map_insert_no_resize_fwd_back
     (self : 't hashmap_hash_map_t) (key : usize) (value : 't) :
     't hashmap_hash_map_t result
@@ -199,7 +202,8 @@ Definition core_num_u32_max_c_def:
 End
 
 val [hashmap_hash_map_move_elements_from_list_loop_fwd_back_def] = DefineDiv ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::move_elements_from_list] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::move_elements_from_list]: loop 0: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   hashmap_hash_map_move_elements_from_list_loop_fwd_back
     (ntable : 't hashmap_hash_map_t) (ls : 't hashmap_list_t) :
     't hashmap_hash_map_t result
@@ -214,7 +218,8 @@ val [hashmap_hash_map_move_elements_from_list_loop_fwd_back_def] = DefineDiv ‘
 ’
 
 val hashmap_hash_map_move_elements_from_list_fwd_back_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::move_elements_from_list] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::move_elements_from_list]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   hashmap_hash_map_move_elements_from_list_fwd_back
     (ntable : 't hashmap_hash_map_t) (ls : 't hashmap_list_t) :
     't hashmap_hash_map_t result
@@ -223,7 +228,8 @@ val hashmap_hash_map_move_elements_from_list_fwd_back_def = Define ‘
 ’
 
 val [hashmap_hash_map_move_elements_loop_fwd_back_def] = DefineDiv ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::move_elements] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::move_elements]: loop 0: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   hashmap_hash_map_move_elements_loop_fwd_back
     (ntable : 't hashmap_hash_map_t) (slots : 't hashmap_list_t vec)
     (i : usize) :
@@ -249,7 +255,8 @@ val [hashmap_hash_map_move_elements_loop_fwd_back_def] = DefineDiv ‘
 ’
 
 val hashmap_hash_map_move_elements_fwd_back_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::move_elements] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::move_elements]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   hashmap_hash_map_move_elements_fwd_back
     (ntable : 't hashmap_hash_map_t) (slots : 't hashmap_list_t vec)
     (i : usize) :
@@ -259,7 +266,8 @@ val hashmap_hash_map_move_elements_fwd_back_def = Define ‘
 ’
 
 val hashmap_hash_map_try_resize_fwd_back_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::try_resize] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::try_resize]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   hashmap_hash_map_try_resize_fwd_back
     (self : 't hashmap_hash_map_t) : 't hashmap_hash_map_t result =
     do
@@ -293,7 +301,8 @@ val hashmap_hash_map_try_resize_fwd_back_def = Define ‘
 ’
 
 val hashmap_hash_map_insert_fwd_back_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::insert] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::insert]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   hashmap_hash_map_insert_fwd_back
     (self : 't hashmap_hash_map_t) (key : usize) (value : 't) :
     't hashmap_hash_map_t result
@@ -308,7 +317,7 @@ val hashmap_hash_map_insert_fwd_back_def = Define ‘
 ’
 
 val [hashmap_hash_map_contains_key_in_list_loop_fwd_def] = DefineDiv ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::contains_key_in_list] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::contains_key_in_list]: loop 0: forward function *)
   hashmap_hash_map_contains_key_in_list_loop_fwd
     (key : usize) (ls : 't hashmap_list_t) : bool result =
     (case ls of
@@ -320,14 +329,14 @@ val [hashmap_hash_map_contains_key_in_list_loop_fwd_def] = DefineDiv ‘
 ’
 
 val hashmap_hash_map_contains_key_in_list_fwd_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::contains_key_in_list] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::contains_key_in_list]: forward function *)
   hashmap_hash_map_contains_key_in_list_fwd
     (key : usize) (ls : 't hashmap_list_t) : bool result =
     hashmap_hash_map_contains_key_in_list_loop_fwd key ls
 ’
 
 val hashmap_hash_map_contains_key_fwd_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::contains_key] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::contains_key]: forward function *)
   hashmap_hash_map_contains_key_fwd
     (self : 't hashmap_hash_map_t) (key : usize) : bool result =
     do
@@ -342,7 +351,7 @@ val hashmap_hash_map_contains_key_fwd_def = Define ‘
 ’
 
 val [hashmap_hash_map_get_in_list_loop_fwd_def] = DefineDiv ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::get_in_list] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::get_in_list]: loop 0: forward function *)
   hashmap_hash_map_get_in_list_loop_fwd
     (key : usize) (ls : 't hashmap_list_t) : 't result =
     (case ls of
@@ -354,14 +363,14 @@ val [hashmap_hash_map_get_in_list_loop_fwd_def] = DefineDiv ‘
 ’
 
 val hashmap_hash_map_get_in_list_fwd_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::get_in_list] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::get_in_list]: forward function *)
   hashmap_hash_map_get_in_list_fwd
     (key : usize) (ls : 't hashmap_list_t) : 't result =
     hashmap_hash_map_get_in_list_loop_fwd key ls
 ’
 
 val hashmap_hash_map_get_fwd_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::get] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::get]: forward function *)
   hashmap_hash_map_get_fwd
     (self : 't hashmap_hash_map_t) (key : usize) : 't result =
     do
@@ -376,7 +385,7 @@ val hashmap_hash_map_get_fwd_def = Define ‘
 ’
 
 val [hashmap_hash_map_get_mut_in_list_loop_fwd_def] = DefineDiv ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list]: loop 0: forward function *)
   hashmap_hash_map_get_mut_in_list_loop_fwd
     (ls : 't hashmap_list_t) (key : usize) : 't result =
     (case ls of
@@ -388,14 +397,14 @@ val [hashmap_hash_map_get_mut_in_list_loop_fwd_def] = DefineDiv ‘
 ’
 
 val hashmap_hash_map_get_mut_in_list_fwd_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list]: forward function *)
   hashmap_hash_map_get_mut_in_list_fwd
     (ls : 't hashmap_list_t) (key : usize) : 't result =
     hashmap_hash_map_get_mut_in_list_loop_fwd ls key
 ’
 
 val [hashmap_hash_map_get_mut_in_list_loop_back_def] = DefineDiv ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list]: loop 0: backward function 0 *)
   hashmap_hash_map_get_mut_in_list_loop_back
     (ls : 't hashmap_list_t) (key : usize) (ret : 't) :
     't hashmap_list_t result
@@ -413,7 +422,7 @@ val [hashmap_hash_map_get_mut_in_list_loop_back_def] = DefineDiv ‘
 ’
 
 val hashmap_hash_map_get_mut_in_list_back_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list]: backward function 0 *)
   hashmap_hash_map_get_mut_in_list_back
     (ls : 't hashmap_list_t) (key : usize) (ret : 't) :
     't hashmap_list_t result
@@ -422,7 +431,7 @@ val hashmap_hash_map_get_mut_in_list_back_def = Define ‘
 ’
 
 val hashmap_hash_map_get_mut_fwd_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::get_mut] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::get_mut]: forward function *)
   hashmap_hash_map_get_mut_fwd
     (self : 't hashmap_hash_map_t) (key : usize) : 't result =
     do
@@ -437,7 +446,7 @@ val hashmap_hash_map_get_mut_fwd_def = Define ‘
 ’
 
 val hashmap_hash_map_get_mut_back_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::get_mut] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::get_mut]: backward function 0 *)
   hashmap_hash_map_get_mut_back
     (self : 't hashmap_hash_map_t) (key : usize) (ret : 't) :
     't hashmap_hash_map_t result
@@ -456,7 +465,7 @@ val hashmap_hash_map_get_mut_back_def = Define ‘
 ’
 
 val [hashmap_hash_map_remove_from_list_loop_fwd_def] = DefineDiv ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::remove_from_list] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::remove_from_list]: loop 0: forward function *)
   hashmap_hash_map_remove_from_list_loop_fwd
     (key : usize) (ls : 't hashmap_list_t) : 't option result =
     (case ls of
@@ -473,14 +482,14 @@ val [hashmap_hash_map_remove_from_list_loop_fwd_def] = DefineDiv ‘
 ’
 
 val hashmap_hash_map_remove_from_list_fwd_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::remove_from_list] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::remove_from_list]: forward function *)
   hashmap_hash_map_remove_from_list_fwd
     (key : usize) (ls : 't hashmap_list_t) : 't option result =
     hashmap_hash_map_remove_from_list_loop_fwd key ls
 ’
 
 val [hashmap_hash_map_remove_from_list_loop_back_def] = DefineDiv ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::remove_from_list] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::remove_from_list]: loop 0: backward function 1 *)
   hashmap_hash_map_remove_from_list_loop_back
     (key : usize) (ls : 't hashmap_list_t) : 't hashmap_list_t result =
     (case ls of
@@ -501,14 +510,14 @@ val [hashmap_hash_map_remove_from_list_loop_back_def] = DefineDiv ‘
 ’
 
 val hashmap_hash_map_remove_from_list_back_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::remove_from_list] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::remove_from_list]: backward function 1 *)
   hashmap_hash_map_remove_from_list_back
     (key : usize) (ls : 't hashmap_list_t) : 't hashmap_list_t result =
     hashmap_hash_map_remove_from_list_loop_back key ls
 ’
 
 val hashmap_hash_map_remove_fwd_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::remove] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::remove]: forward function *)
   hashmap_hash_map_remove_fwd
     (self : 't hashmap_hash_map_t) (key : usize) : 't option result =
     do
@@ -530,7 +539,7 @@ val hashmap_hash_map_remove_fwd_def = Define ‘
 ’
 
 val hashmap_hash_map_remove_back_def = Define ‘
-  (** [hashmap_main::hashmap::HashMap::{0}::remove] *)
+  (** [hashmap_main::hashmap::HashMap::{0}::remove]: backward function 0 *)
   hashmap_hash_map_remove_back
     (self : 't hashmap_hash_map_t) (key : usize) :
     't hashmap_hash_map_t result
@@ -566,7 +575,7 @@ val hashmap_hash_map_remove_back_def = Define ‘
 ’
 
 val hashmap_test1_fwd_def = Define ‘
-  (** [hashmap_main::hashmap::test1] *)
+  (** [hashmap_main::hashmap::test1]: forward function *)
   hashmap_test1_fwd : unit result =
     do
     hm <- hashmap_hash_map_new_fwd;
@@ -623,7 +632,7 @@ val hashmap_test1_fwd_def = Define ‘
 val _ = assert_return (“hashmap_test1_fwd”)
 
 val insert_on_disk_fwd_def = Define ‘
-  (** [hashmap_main::insert_on_disk] *)
+  (** [hashmap_main::insert_on_disk]: forward function *)
   insert_on_disk_fwd
     (key : usize) (value : u64) (st : state) : (state # unit) result =
     do
@@ -635,7 +644,7 @@ val insert_on_disk_fwd_def = Define ‘
 ’
 
 val main_fwd_def = Define ‘
-  (** [hashmap_main::main] *)
+  (** [hashmap_main::main]: forward function *)
   main_fwd : unit result =
     Return ()
 ’
diff --git a/tests/hol4/hashmap_on_disk/hashmapMain_OpaqueScript.sml b/tests/hol4/hashmap_on_disk/hashmapMain_OpaqueScript.sml
index c38eca01..f7221d92 100644
--- a/tests/hol4/hashmap_on_disk/hashmapMain_OpaqueScript.sml
+++ b/tests/hol4/hashmap_on_disk/hashmapMain_OpaqueScript.sml
@@ -6,10 +6,10 @@ open hashmapMain_TypesTheory
 val _ = new_theory "hashmapMain_Opaque"
 
 
-val _ = new_constant ("hashmap_utils_deserialize_fwd",
+(** [hashmap_main::hashmap_utils::deserialize]: forward function *)val _ = new_constant ("hashmap_utils_deserialize_fwd",
   “:state -> (state # u64 hashmap_hash_map_t) result”)
 
-val _ = new_constant ("hashmap_utils_serialize_fwd",
+(** [hashmap_main::hashmap_utils::serialize]: forward function *)val _ = new_constant ("hashmap_utils_serialize_fwd",
   “:u64 hashmap_hash_map_t -> state -> (state # unit) result”)
 
 val _ = export_theory ()
diff --git a/tests/hol4/misc-constants/constantsScript.sml b/tests/hol4/misc-constants/constantsScript.sml
index 324d553d..145c3e0f 100644
--- a/tests/hol4/misc-constants/constantsScript.sml
+++ b/tests/hol4/misc-constants/constantsScript.sml
@@ -38,7 +38,7 @@ Definition x2_c_def:
 End
 
 val incr_fwd_def = Define ‘
-  (** [constants::incr] *)
+  (** [constants::incr]: forward function *)
   incr_fwd (n : u32) : u32 result =
     u32_add n (int_to_u32 1)
 ’
@@ -52,7 +52,7 @@ Definition x3_c_def:
 End
 
 val mk_pair0_fwd_def = Define ‘
-  (** [constants::mk_pair0] *)
+  (** [constants::mk_pair0]: forward function *)
   mk_pair0_fwd (x : u32) (y : u32) : (u32 # u32) result =
     Return (x, y)
 ’
@@ -63,7 +63,7 @@ Datatype:
 End
 
 val mk_pair1_fwd_def = Define ‘
-  (** [constants::mk_pair1] *)
+  (** [constants::mk_pair1]: forward function *)
   mk_pair1_fwd (x : u32) (y : u32) : (u32, u32) pair_t result =
     Return (<| pair_x := x; pair_y := y |>)
 ’
@@ -108,7 +108,7 @@ Datatype:
 End
 
 val wrap_new_fwd_def = Define ‘
-  (** [constants::Wrap::{0}::new] *)
+  (** [constants::Wrap::{0}::new]: forward function *)
   wrap_new_fwd (val : 't) : 't wrap_t result =
     Return (<| wrap_val := val |>)
 ’
@@ -122,7 +122,7 @@ Definition y_c_def:
 End
 
 val unwrap_y_fwd_def = Define ‘
-  (** [constants::unwrap_y] *)
+  (** [constants::unwrap_y]: forward function *)
   unwrap_y_fwd : i32 result =
     Return y_c.wrap_val
 ’
@@ -144,13 +144,13 @@ Definition get_z1_z1_c_def:
 End
 
 val get_z1_fwd_def = Define ‘
-  (** [constants::get_z1] *)
+  (** [constants::get_z1]: forward function *)
   get_z1_fwd : i32 result =
     Return get_z1_z1_c
 ’
 
 val add_fwd_def = Define ‘
-  (** [constants::add] *)
+  (** [constants::add]: forward function *)
   add_fwd (a : i32) (b : i32) : i32 result =
     i32_add a b
 ’
@@ -180,7 +180,7 @@ Definition q3_c_def:
 End
 
 val get_z2_fwd_def = Define ‘
-  (** [constants::get_z2] *)
+  (** [constants::get_z2]: forward function *)
   get_z2_fwd : i32 result =
     do
     i <- get_z1_fwd;
diff --git a/tests/hol4/misc-external/external_FunsScript.sml b/tests/hol4/misc-external/external_FunsScript.sml
index 8172bc1c..f3692ee2 100644
--- a/tests/hol4/misc-external/external_FunsScript.sml
+++ b/tests/hol4/misc-external/external_FunsScript.sml
@@ -7,7 +7,7 @@ val _ = new_theory "external_Funs"
 
 
 val swap_fwd_def = Define ‘
-  (** [external::swap] *)
+  (** [external::swap]: forward function *)
   swap_fwd (x : 't) (y : 't) (st : state) : (state # unit) result =
     do
     (st0, _) <- core_mem_swap_fwd x y st;
@@ -18,7 +18,7 @@ val swap_fwd_def = Define ‘
 ’
 
 val swap_back_def = Define ‘
-  (** [external::swap] *)
+  (** [external::swap]: backward function 0 *)
   swap_back
     (x : 't) (y : 't) (st : state) (st0 : state) : (state # ('t # 't)) result =
     do
@@ -30,7 +30,7 @@ val swap_back_def = Define ‘
 ’
 
 val test_new_non_zero_u32_fwd_def = Define ‘
-  (** [external::test_new_non_zero_u32] *)
+  (** [external::test_new_non_zero_u32]: forward function *)
   test_new_non_zero_u32_fwd
     (x : u32) (st : state) : (state # core_num_nonzero_non_zero_u32_t) result =
     do
@@ -40,7 +40,7 @@ val test_new_non_zero_u32_fwd_def = Define ‘
 ’
 
 val test_vec_fwd_def = Define ‘
-  (** [external::test_vec] *)
+  (** [external::test_vec]: forward function *)
   test_vec_fwd : unit result =
     let v = vec_new in do
                        _ <- vec_push_back v (int_to_u32 0);
@@ -52,7 +52,7 @@ val test_vec_fwd_def = Define ‘
 val _ = assert_return (“test_vec_fwd”)
 
 val custom_swap_fwd_def = Define ‘
-  (** [external::custom_swap] *)
+  (** [external::custom_swap]: forward function *)
   custom_swap_fwd (x : 't) (y : 't) (st : state) : (state # 't) result =
     do
     (st0, _) <- core_mem_swap_fwd x y st;
@@ -63,7 +63,7 @@ val custom_swap_fwd_def = Define ‘
 ’
 
 val custom_swap_back_def = Define ‘
-  (** [external::custom_swap] *)
+  (** [external::custom_swap]: backward function 0 *)
   custom_swap_back
     (x : 't) (y : 't) (st : state) (ret : 't) (st0 : state) :
     (state # ('t # 't)) result
@@ -77,7 +77,7 @@ val custom_swap_back_def = Define ‘
 ’
 
 val test_custom_swap_fwd_def = Define ‘
-  (** [external::test_custom_swap] *)
+  (** [external::test_custom_swap]: forward function *)
   test_custom_swap_fwd
     (x : u32) (y : u32) (st : state) : (state # unit) result =
     do
@@ -87,7 +87,7 @@ val test_custom_swap_fwd_def = Define ‘
 ’
 
 val test_custom_swap_back_def = Define ‘
-  (** [external::test_custom_swap] *)
+  (** [external::test_custom_swap]: backward function 0 *)
   test_custom_swap_back
     (x : u32) (y : u32) (st : state) (st0 : state) :
     (state # (u32 # u32)) result
@@ -96,7 +96,7 @@ val test_custom_swap_back_def = Define ‘
 ’
 
 val test_swap_non_zero_fwd_def = Define ‘
-  (** [external::test_swap_non_zero] *)
+  (** [external::test_swap_non_zero]: forward function *)
   test_swap_non_zero_fwd (x : u32) (st : state) : (state # u32) result =
     do
     (st0, _) <- swap_fwd x (int_to_u32 0) st;
diff --git a/tests/hol4/misc-external/external_OpaqueScript.sml b/tests/hol4/misc-external/external_OpaqueScript.sml
index 02efc2be..b5a6d91d 100644
--- a/tests/hol4/misc-external/external_OpaqueScript.sml
+++ b/tests/hol4/misc-external/external_OpaqueScript.sml
@@ -6,20 +6,20 @@ open external_TypesTheory
 val _ = new_theory "external_Opaque"
 
 
-val _ = new_constant ("core_mem_swap_fwd",
+(** [core::mem::swap]: forward function *)val _ = new_constant ("core_mem_swap_fwd",
   “:'t -> 't -> state -> (state # unit) result”)
 
-val _ = new_constant ("core_mem_swap_back0",
+(** [core::mem::swap]: backward function 0 *)val _ = new_constant ("core_mem_swap_back0",
   “:'t -> 't -> state -> state -> (state # 't) result”)
 
-val _ = new_constant ("core_mem_swap_back1",
+(** [core::mem::swap]: backward function 1 *)val _ = new_constant ("core_mem_swap_back1",
   “:'t -> 't -> state -> state -> (state # 't) result”)
 
-val _ = new_constant ("core_num_nonzero_non_zero_u32_new_fwd",
+(** [core::num::nonzero::NonZeroU32::{14}::new]: forward function *)val _ = new_constant ("core_num_nonzero_non_zero_u32_new_fwd",
   “:u32 -> state -> (state # core_num_nonzero_non_zero_u32_t option)
   result”)
 
-val _ = new_constant ("core_option_option_unwrap_fwd",
+(** [core::option::Option::{0}::unwrap]: forward function *)val _ = new_constant ("core_option_option_unwrap_fwd",
   “:'t option -> state -> (state # 't) result”)
 
 val _ = export_theory ()
diff --git a/tests/hol4/misc-loops/loops_FunsScript.sml b/tests/hol4/misc-loops/loops_FunsScript.sml
index f0ef036b..65cf77d4 100644
--- a/tests/hol4/misc-loops/loops_FunsScript.sml
+++ b/tests/hol4/misc-loops/loops_FunsScript.sml
@@ -7,7 +7,7 @@ val _ = new_theory "loops_Funs"
 
 
 val [sum_loop_fwd_def] = DefineDiv ‘
-  (** [loops::sum] *)
+  (** [loops::sum]: loop 0: forward function *)
   sum_loop_fwd (max : u32) (i : u32) (s : u32) : u32 result =
     if u32_lt i max
     then (
@@ -20,13 +20,13 @@ val [sum_loop_fwd_def] = DefineDiv ‘
 ’
 
 val sum_fwd_def = Define ‘
-  (** [loops::sum] *)
+  (** [loops::sum]: forward function *)
   sum_fwd (max : u32) : u32 result =
     sum_loop_fwd max (int_to_u32 0) (int_to_u32 0)
 ’
 
 val [sum_with_mut_borrows_loop_fwd_def] = DefineDiv ‘
-  (** [loops::sum_with_mut_borrows] *)
+  (** [loops::sum_with_mut_borrows]: loop 0: forward function *)
   sum_with_mut_borrows_loop_fwd
     (max : u32) (mi : u32) (ms : u32) : u32 result =
     if u32_lt mi max
@@ -40,13 +40,13 @@ val [sum_with_mut_borrows_loop_fwd_def] = DefineDiv ‘
 ’
 
 val sum_with_mut_borrows_fwd_def = Define ‘
-  (** [loops::sum_with_mut_borrows] *)
+  (** [loops::sum_with_mut_borrows]: forward function *)
   sum_with_mut_borrows_fwd (max : u32) : u32 result =
     sum_with_mut_borrows_loop_fwd max (int_to_u32 0) (int_to_u32 0)
 ’
 
 val [sum_with_shared_borrows_loop_fwd_def] = DefineDiv ‘
-  (** [loops::sum_with_shared_borrows] *)
+  (** [loops::sum_with_shared_borrows]: loop 0: forward function *)
   sum_with_shared_borrows_loop_fwd
     (max : u32) (i : u32) (s : u32) : u32 result =
     if u32_lt i max
@@ -60,13 +60,14 @@ val [sum_with_shared_borrows_loop_fwd_def] = DefineDiv ‘
 ’
 
 val sum_with_shared_borrows_fwd_def = Define ‘
-  (** [loops::sum_with_shared_borrows] *)
+  (** [loops::sum_with_shared_borrows]: forward function *)
   sum_with_shared_borrows_fwd (max : u32) : u32 result =
     sum_with_shared_borrows_loop_fwd max (int_to_u32 0) (int_to_u32 0)
 ’
 
 val [clear_loop_fwd_back_def] = DefineDiv ‘
-  (** [loops::clear] *)
+  (** [loops::clear]: loop 0: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   clear_loop_fwd_back (v : u32 vec) (i : usize) : u32 vec result =
     let i0 = vec_len v in
     if usize_lt i i0
@@ -80,13 +81,14 @@ val [clear_loop_fwd_back_def] = DefineDiv ‘
 ’
 
 val clear_fwd_back_def = Define ‘
-  (** [loops::clear] *)
+  (** [loops::clear]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   clear_fwd_back (v : u32 vec) : u32 vec result =
     clear_loop_fwd_back v (int_to_usize 0)
 ’
 
 val [list_mem_loop_fwd_def] = DefineDiv ‘
-  (** [loops::list_mem] *)
+  (** [loops::list_mem]: loop 0: forward function *)
   list_mem_loop_fwd (x : u32) (ls : u32 list_t) : bool result =
     (case ls of
     | ListCons y tl => if y = x then Return T else list_mem_loop_fwd x tl
@@ -94,13 +96,13 @@ val [list_mem_loop_fwd_def] = DefineDiv ‘
 ’
 
 val list_mem_fwd_def = Define ‘
-  (** [loops::list_mem] *)
+  (** [loops::list_mem]: forward function *)
   list_mem_fwd (x : u32) (ls : u32 list_t) : bool result =
     list_mem_loop_fwd x ls
 ’
 
 val [list_nth_mut_loop_loop_fwd_def] = DefineDiv ‘
-  (** [loops::list_nth_mut_loop] *)
+  (** [loops::list_nth_mut_loop]: loop 0: forward function *)
   list_nth_mut_loop_loop_fwd (ls : 't list_t) (i : u32) : 't result =
     (case ls of
     | ListCons x tl =>
@@ -115,13 +117,13 @@ val [list_nth_mut_loop_loop_fwd_def] = DefineDiv ‘
 ’
 
 val list_nth_mut_loop_fwd_def = Define ‘
-  (** [loops::list_nth_mut_loop] *)
+  (** [loops::list_nth_mut_loop]: forward function *)
   list_nth_mut_loop_fwd (ls : 't list_t) (i : u32) : 't result =
     list_nth_mut_loop_loop_fwd ls i
 ’
 
 val [list_nth_mut_loop_loop_back_def] = DefineDiv ‘
-  (** [loops::list_nth_mut_loop] *)
+  (** [loops::list_nth_mut_loop]: loop 0: backward function 0 *)
   list_nth_mut_loop_loop_back
     (ls : 't list_t) (i : u32) (ret : 't) : 't list_t result =
     (case ls of
@@ -138,14 +140,14 @@ val [list_nth_mut_loop_loop_back_def] = DefineDiv ‘
 ’
 
 val list_nth_mut_loop_back_def = Define ‘
-  (** [loops::list_nth_mut_loop] *)
+  (** [loops::list_nth_mut_loop]: backward function 0 *)
   list_nth_mut_loop_back
     (ls : 't list_t) (i : u32) (ret : 't) : 't list_t result =
     list_nth_mut_loop_loop_back ls i ret
 ’
 
 val [list_nth_shared_loop_loop_fwd_def] = DefineDiv ‘
-  (** [loops::list_nth_shared_loop] *)
+  (** [loops::list_nth_shared_loop]: loop 0: forward function *)
   list_nth_shared_loop_loop_fwd (ls : 't list_t) (i : u32) : 't result =
     (case ls of
     | ListCons x tl =>
@@ -160,13 +162,13 @@ val [list_nth_shared_loop_loop_fwd_def] = DefineDiv ‘
 ’
 
 val list_nth_shared_loop_fwd_def = Define ‘
-  (** [loops::list_nth_shared_loop] *)
+  (** [loops::list_nth_shared_loop]: forward function *)
   list_nth_shared_loop_fwd (ls : 't list_t) (i : u32) : 't result =
     list_nth_shared_loop_loop_fwd ls i
 ’
 
 val [get_elem_mut_loop_fwd_def] = DefineDiv ‘
-  (** [loops::get_elem_mut] *)
+  (** [loops::get_elem_mut]: loop 0: forward function *)
   get_elem_mut_loop_fwd (x : usize) (ls : usize list_t) : usize result =
     (case ls of
     | ListCons y tl => if y = x then Return y else get_elem_mut_loop_fwd x tl
@@ -174,7 +176,7 @@ val [get_elem_mut_loop_fwd_def] = DefineDiv ‘
 ’
 
 val get_elem_mut_fwd_def = Define ‘
-  (** [loops::get_elem_mut] *)
+  (** [loops::get_elem_mut]: forward function *)
   get_elem_mut_fwd (slots : usize list_t vec) (x : usize) : usize result =
     do
     l <- vec_index_mut_fwd slots (int_to_usize 0);
@@ -183,7 +185,7 @@ val get_elem_mut_fwd_def = Define ‘
 ’
 
 val [get_elem_mut_loop_back_def] = DefineDiv ‘
-  (** [loops::get_elem_mut] *)
+  (** [loops::get_elem_mut]: loop 0: backward function 0 *)
   get_elem_mut_loop_back
     (x : usize) (ls : usize list_t) (ret : usize) : usize list_t result =
     (case ls of
@@ -199,7 +201,7 @@ val [get_elem_mut_loop_back_def] = DefineDiv ‘
 ’
 
 val get_elem_mut_back_def = Define ‘
-  (** [loops::get_elem_mut] *)
+  (** [loops::get_elem_mut]: backward function 0 *)
   get_elem_mut_back
     (slots : usize list_t vec) (x : usize) (ret : usize) :
     usize list_t vec result
@@ -212,7 +214,7 @@ val get_elem_mut_back_def = Define ‘
 ’
 
 val [get_elem_shared_loop_fwd_def] = DefineDiv ‘
-  (** [loops::get_elem_shared] *)
+  (** [loops::get_elem_shared]: loop 0: forward function *)
   get_elem_shared_loop_fwd (x : usize) (ls : usize list_t) : usize result =
     (case ls of
     | ListCons y tl =>
@@ -221,7 +223,7 @@ val [get_elem_shared_loop_fwd_def] = DefineDiv ‘
 ’
 
 val get_elem_shared_fwd_def = Define ‘
-  (** [loops::get_elem_shared] *)
+  (** [loops::get_elem_shared]: forward function *)
   get_elem_shared_fwd (slots : usize list_t vec) (x : usize) : usize result =
     do
     l <- vec_index_fwd slots (int_to_usize 0);
@@ -230,25 +232,25 @@ val get_elem_shared_fwd_def = Define ‘
 ’
 
 val id_mut_fwd_def = Define ‘
-  (** [loops::id_mut] *)
+  (** [loops::id_mut]: forward function *)
   id_mut_fwd (ls : 't list_t) : 't list_t result =
     Return ls
 ’
 
 val id_mut_back_def = Define ‘
-  (** [loops::id_mut] *)
+  (** [loops::id_mut]: backward function 0 *)
   id_mut_back (ls : 't list_t) (ret : 't list_t) : 't list_t result =
     Return ret
 ’
 
 val id_shared_fwd_def = Define ‘
-  (** [loops::id_shared] *)
+  (** [loops::id_shared]: forward function *)
   id_shared_fwd (ls : 't list_t) : 't list_t result =
     Return ls
 ’
 
 val [list_nth_mut_loop_with_id_loop_fwd_def] = DefineDiv ‘
-  (** [loops::list_nth_mut_loop_with_id] *)
+  (** [loops::list_nth_mut_loop_with_id]: loop 0: forward function *)
   list_nth_mut_loop_with_id_loop_fwd (i : u32) (ls : 't list_t) : 't result =
     (case ls of
     | ListCons x tl =>
@@ -263,7 +265,7 @@ val [list_nth_mut_loop_with_id_loop_fwd_def] = DefineDiv ‘
 ’
 
 val list_nth_mut_loop_with_id_fwd_def = Define ‘
-  (** [loops::list_nth_mut_loop_with_id] *)
+  (** [loops::list_nth_mut_loop_with_id]: forward function *)
   list_nth_mut_loop_with_id_fwd (ls : 't list_t) (i : u32) : 't result =
     do
     ls0 <- id_mut_fwd ls;
@@ -272,7 +274,7 @@ val list_nth_mut_loop_with_id_fwd_def = Define ‘
 ’
 
 val [list_nth_mut_loop_with_id_loop_back_def] = DefineDiv ‘
-  (** [loops::list_nth_mut_loop_with_id] *)
+  (** [loops::list_nth_mut_loop_with_id]: loop 0: backward function 0 *)
   list_nth_mut_loop_with_id_loop_back
     (i : u32) (ls : 't list_t) (ret : 't) : 't list_t result =
     (case ls of
@@ -289,7 +291,7 @@ val [list_nth_mut_loop_with_id_loop_back_def] = DefineDiv ‘
 ’
 
 val list_nth_mut_loop_with_id_back_def = Define ‘
-  (** [loops::list_nth_mut_loop_with_id] *)
+  (** [loops::list_nth_mut_loop_with_id]: backward function 0 *)
   list_nth_mut_loop_with_id_back
     (ls : 't list_t) (i : u32) (ret : 't) : 't list_t result =
     do
@@ -300,7 +302,7 @@ val list_nth_mut_loop_with_id_back_def = Define ‘
 ’
 
 val [list_nth_shared_loop_with_id_loop_fwd_def] = DefineDiv ‘
-  (** [loops::list_nth_shared_loop_with_id] *)
+  (** [loops::list_nth_shared_loop_with_id]: loop 0: forward function *)
   list_nth_shared_loop_with_id_loop_fwd
     (i : u32) (ls : 't list_t) : 't result =
     (case ls of
@@ -316,7 +318,7 @@ val [list_nth_shared_loop_with_id_loop_fwd_def] = DefineDiv ‘
 ’
 
 val list_nth_shared_loop_with_id_fwd_def = Define ‘
-  (** [loops::list_nth_shared_loop_with_id] *)
+  (** [loops::list_nth_shared_loop_with_id]: forward function *)
   list_nth_shared_loop_with_id_fwd (ls : 't list_t) (i : u32) : 't result =
     do
     ls0 <- id_shared_fwd ls;
@@ -325,7 +327,7 @@ val list_nth_shared_loop_with_id_fwd_def = Define ‘
 ’
 
 val [list_nth_mut_loop_pair_loop_fwd_def] = DefineDiv ‘
-  (** [loops::list_nth_mut_loop_pair] *)
+  (** [loops::list_nth_mut_loop_pair]: loop 0: forward function *)
   list_nth_mut_loop_pair_loop_fwd
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) : ('t # 't) result =
     (case ls0 of
@@ -344,14 +346,14 @@ val [list_nth_mut_loop_pair_loop_fwd_def] = DefineDiv ‘
 ’
 
 val list_nth_mut_loop_pair_fwd_def = Define ‘
-  (** [loops::list_nth_mut_loop_pair] *)
+  (** [loops::list_nth_mut_loop_pair]: forward function *)
   list_nth_mut_loop_pair_fwd
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) : ('t # 't) result =
     list_nth_mut_loop_pair_loop_fwd ls0 ls1 i
 ’
 
 val [list_nth_mut_loop_pair_loop_back'a_def] = DefineDiv ‘
-  (** [loops::list_nth_mut_loop_pair] *)
+  (** [loops::list_nth_mut_loop_pair]: loop 0: backward function 0 *)
   list_nth_mut_loop_pair_loop_back'a
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) (ret : 't) :
     't list_t result
@@ -373,7 +375,7 @@ val [list_nth_mut_loop_pair_loop_back'a_def] = DefineDiv ‘
 ’
 
 val list_nth_mut_loop_pair_back'a_def = Define ‘
-  (** [loops::list_nth_mut_loop_pair] *)
+  (** [loops::list_nth_mut_loop_pair]: backward function 0 *)
   list_nth_mut_loop_pair_back'a
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) (ret : 't) :
     't list_t result
@@ -382,7 +384,7 @@ val list_nth_mut_loop_pair_back'a_def = Define ‘
 ’
 
 val [list_nth_mut_loop_pair_loop_back'b_def] = DefineDiv ‘
-  (** [loops::list_nth_mut_loop_pair] *)
+  (** [loops::list_nth_mut_loop_pair]: loop 0: backward function 1 *)
   list_nth_mut_loop_pair_loop_back'b
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) (ret : 't) :
     't list_t result
@@ -404,7 +406,7 @@ val [list_nth_mut_loop_pair_loop_back'b_def] = DefineDiv ‘
 ’
 
 val list_nth_mut_loop_pair_back'b_def = Define ‘
-  (** [loops::list_nth_mut_loop_pair] *)
+  (** [loops::list_nth_mut_loop_pair]: backward function 1 *)
   list_nth_mut_loop_pair_back'b
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) (ret : 't) :
     't list_t result
@@ -413,7 +415,7 @@ val list_nth_mut_loop_pair_back'b_def = Define ‘
 ’
 
 val [list_nth_shared_loop_pair_loop_fwd_def] = DefineDiv ‘
-  (** [loops::list_nth_shared_loop_pair] *)
+  (** [loops::list_nth_shared_loop_pair]: loop 0: forward function *)
   list_nth_shared_loop_pair_loop_fwd
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) : ('t # 't) result =
     (case ls0 of
@@ -432,14 +434,14 @@ val [list_nth_shared_loop_pair_loop_fwd_def] = DefineDiv ‘
 ’
 
 val list_nth_shared_loop_pair_fwd_def = Define ‘
-  (** [loops::list_nth_shared_loop_pair] *)
+  (** [loops::list_nth_shared_loop_pair]: forward function *)
   list_nth_shared_loop_pair_fwd
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) : ('t # 't) result =
     list_nth_shared_loop_pair_loop_fwd ls0 ls1 i
 ’
 
 val [list_nth_mut_loop_pair_merge_loop_fwd_def] = DefineDiv ‘
-  (** [loops::list_nth_mut_loop_pair_merge] *)
+  (** [loops::list_nth_mut_loop_pair_merge]: loop 0: forward function *)
   list_nth_mut_loop_pair_merge_loop_fwd
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) : ('t # 't) result =
     (case ls0 of
@@ -458,14 +460,14 @@ val [list_nth_mut_loop_pair_merge_loop_fwd_def] = DefineDiv ‘
 ’
 
 val list_nth_mut_loop_pair_merge_fwd_def = Define ‘
-  (** [loops::list_nth_mut_loop_pair_merge] *)
+  (** [loops::list_nth_mut_loop_pair_merge]: forward function *)
   list_nth_mut_loop_pair_merge_fwd
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) : ('t # 't) result =
     list_nth_mut_loop_pair_merge_loop_fwd ls0 ls1 i
 ’
 
 val [list_nth_mut_loop_pair_merge_loop_back_def] = DefineDiv ‘
-  (** [loops::list_nth_mut_loop_pair_merge] *)
+  (** [loops::list_nth_mut_loop_pair_merge]: loop 0: backward function 0 *)
   list_nth_mut_loop_pair_merge_loop_back
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) (ret : ('t # 't)) :
     ('t list_t # 't list_t) result
@@ -488,7 +490,7 @@ val [list_nth_mut_loop_pair_merge_loop_back_def] = DefineDiv ‘
 ’
 
 val list_nth_mut_loop_pair_merge_back_def = Define ‘
-  (** [loops::list_nth_mut_loop_pair_merge] *)
+  (** [loops::list_nth_mut_loop_pair_merge]: backward function 0 *)
   list_nth_mut_loop_pair_merge_back
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) (ret : ('t # 't)) :
     ('t list_t # 't list_t) result
@@ -497,7 +499,7 @@ val list_nth_mut_loop_pair_merge_back_def = Define ‘
 ’
 
 val [list_nth_shared_loop_pair_merge_loop_fwd_def] = DefineDiv ‘
-  (** [loops::list_nth_shared_loop_pair_merge] *)
+  (** [loops::list_nth_shared_loop_pair_merge]: loop 0: forward function *)
   list_nth_shared_loop_pair_merge_loop_fwd
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) : ('t # 't) result =
     (case ls0 of
@@ -516,14 +518,14 @@ val [list_nth_shared_loop_pair_merge_loop_fwd_def] = DefineDiv ‘
 ’
 
 val list_nth_shared_loop_pair_merge_fwd_def = Define ‘
-  (** [loops::list_nth_shared_loop_pair_merge] *)
+  (** [loops::list_nth_shared_loop_pair_merge]: forward function *)
   list_nth_shared_loop_pair_merge_fwd
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) : ('t # 't) result =
     list_nth_shared_loop_pair_merge_loop_fwd ls0 ls1 i
 ’
 
 val [list_nth_mut_shared_loop_pair_loop_fwd_def] = DefineDiv ‘
-  (** [loops::list_nth_mut_shared_loop_pair] *)
+  (** [loops::list_nth_mut_shared_loop_pair]: loop 0: forward function *)
   list_nth_mut_shared_loop_pair_loop_fwd
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) : ('t # 't) result =
     (case ls0 of
@@ -542,14 +544,14 @@ val [list_nth_mut_shared_loop_pair_loop_fwd_def] = DefineDiv ‘
 ’
 
 val list_nth_mut_shared_loop_pair_fwd_def = Define ‘
-  (** [loops::list_nth_mut_shared_loop_pair] *)
+  (** [loops::list_nth_mut_shared_loop_pair]: forward function *)
   list_nth_mut_shared_loop_pair_fwd
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) : ('t # 't) result =
     list_nth_mut_shared_loop_pair_loop_fwd ls0 ls1 i
 ’
 
 val [list_nth_mut_shared_loop_pair_loop_back_def] = DefineDiv ‘
-  (** [loops::list_nth_mut_shared_loop_pair] *)
+  (** [loops::list_nth_mut_shared_loop_pair]: loop 0: backward function 0 *)
   list_nth_mut_shared_loop_pair_loop_back
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) (ret : 't) :
     't list_t result
@@ -571,7 +573,7 @@ val [list_nth_mut_shared_loop_pair_loop_back_def] = DefineDiv ‘
 ’
 
 val list_nth_mut_shared_loop_pair_back_def = Define ‘
-  (** [loops::list_nth_mut_shared_loop_pair] *)
+  (** [loops::list_nth_mut_shared_loop_pair]: backward function 0 *)
   list_nth_mut_shared_loop_pair_back
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) (ret : 't) :
     't list_t result
@@ -580,7 +582,7 @@ val list_nth_mut_shared_loop_pair_back_def = Define ‘
 ’
 
 val [list_nth_mut_shared_loop_pair_merge_loop_fwd_def] = DefineDiv ‘
-  (** [loops::list_nth_mut_shared_loop_pair_merge] *)
+  (** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0: forward function *)
   list_nth_mut_shared_loop_pair_merge_loop_fwd
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) : ('t # 't) result =
     (case ls0 of
@@ -599,14 +601,14 @@ val [list_nth_mut_shared_loop_pair_merge_loop_fwd_def] = DefineDiv ‘
 ’
 
 val list_nth_mut_shared_loop_pair_merge_fwd_def = Define ‘
-  (** [loops::list_nth_mut_shared_loop_pair_merge] *)
+  (** [loops::list_nth_mut_shared_loop_pair_merge]: forward function *)
   list_nth_mut_shared_loop_pair_merge_fwd
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) : ('t # 't) result =
     list_nth_mut_shared_loop_pair_merge_loop_fwd ls0 ls1 i
 ’
 
 val [list_nth_mut_shared_loop_pair_merge_loop_back_def] = DefineDiv ‘
-  (** [loops::list_nth_mut_shared_loop_pair_merge] *)
+  (** [loops::list_nth_mut_shared_loop_pair_merge]: loop 0: backward function 0 *)
   list_nth_mut_shared_loop_pair_merge_loop_back
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) (ret : 't) :
     't list_t result
@@ -628,7 +630,7 @@ val [list_nth_mut_shared_loop_pair_merge_loop_back_def] = DefineDiv ‘
 ’
 
 val list_nth_mut_shared_loop_pair_merge_back_def = Define ‘
-  (** [loops::list_nth_mut_shared_loop_pair_merge] *)
+  (** [loops::list_nth_mut_shared_loop_pair_merge]: backward function 0 *)
   list_nth_mut_shared_loop_pair_merge_back
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) (ret : 't) :
     't list_t result
@@ -637,7 +639,7 @@ val list_nth_mut_shared_loop_pair_merge_back_def = Define ‘
 ’
 
 val [list_nth_shared_mut_loop_pair_loop_fwd_def] = DefineDiv ‘
-  (** [loops::list_nth_shared_mut_loop_pair] *)
+  (** [loops::list_nth_shared_mut_loop_pair]: loop 0: forward function *)
   list_nth_shared_mut_loop_pair_loop_fwd
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) : ('t # 't) result =
     (case ls0 of
@@ -656,14 +658,14 @@ val [list_nth_shared_mut_loop_pair_loop_fwd_def] = DefineDiv ‘
 ’
 
 val list_nth_shared_mut_loop_pair_fwd_def = Define ‘
-  (** [loops::list_nth_shared_mut_loop_pair] *)
+  (** [loops::list_nth_shared_mut_loop_pair]: forward function *)
   list_nth_shared_mut_loop_pair_fwd
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) : ('t # 't) result =
     list_nth_shared_mut_loop_pair_loop_fwd ls0 ls1 i
 ’
 
 val [list_nth_shared_mut_loop_pair_loop_back_def] = DefineDiv ‘
-  (** [loops::list_nth_shared_mut_loop_pair] *)
+  (** [loops::list_nth_shared_mut_loop_pair]: loop 0: backward function 1 *)
   list_nth_shared_mut_loop_pair_loop_back
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) (ret : 't) :
     't list_t result
@@ -685,7 +687,7 @@ val [list_nth_shared_mut_loop_pair_loop_back_def] = DefineDiv ‘
 ’
 
 val list_nth_shared_mut_loop_pair_back_def = Define ‘
-  (** [loops::list_nth_shared_mut_loop_pair] *)
+  (** [loops::list_nth_shared_mut_loop_pair]: backward function 1 *)
   list_nth_shared_mut_loop_pair_back
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) (ret : 't) :
     't list_t result
@@ -694,7 +696,7 @@ val list_nth_shared_mut_loop_pair_back_def = Define ‘
 ’
 
 val [list_nth_shared_mut_loop_pair_merge_loop_fwd_def] = DefineDiv ‘
-  (** [loops::list_nth_shared_mut_loop_pair_merge] *)
+  (** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0: forward function *)
   list_nth_shared_mut_loop_pair_merge_loop_fwd
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) : ('t # 't) result =
     (case ls0 of
@@ -713,14 +715,14 @@ val [list_nth_shared_mut_loop_pair_merge_loop_fwd_def] = DefineDiv ‘
 ’
 
 val list_nth_shared_mut_loop_pair_merge_fwd_def = Define ‘
-  (** [loops::list_nth_shared_mut_loop_pair_merge] *)
+  (** [loops::list_nth_shared_mut_loop_pair_merge]: forward function *)
   list_nth_shared_mut_loop_pair_merge_fwd
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) : ('t # 't) result =
     list_nth_shared_mut_loop_pair_merge_loop_fwd ls0 ls1 i
 ’
 
 val [list_nth_shared_mut_loop_pair_merge_loop_back_def] = DefineDiv ‘
-  (** [loops::list_nth_shared_mut_loop_pair_merge] *)
+  (** [loops::list_nth_shared_mut_loop_pair_merge]: loop 0: backward function 0 *)
   list_nth_shared_mut_loop_pair_merge_loop_back
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) (ret : 't) :
     't list_t result
@@ -742,7 +744,7 @@ val [list_nth_shared_mut_loop_pair_merge_loop_back_def] = DefineDiv ‘
 ’
 
 val list_nth_shared_mut_loop_pair_merge_back_def = Define ‘
-  (** [loops::list_nth_shared_mut_loop_pair_merge] *)
+  (** [loops::list_nth_shared_mut_loop_pair_merge]: backward function 0 *)
   list_nth_shared_mut_loop_pair_merge_back
     (ls0 : 't list_t) (ls1 : 't list_t) (i : u32) (ret : 't) :
     't list_t result
diff --git a/tests/hol4/misc-no_nested_borrows/noNestedBorrowsScript.sml b/tests/hol4/misc-no_nested_borrows/noNestedBorrowsScript.sml
index c8b106cd..66614c3f 100644
--- a/tests/hol4/misc-no_nested_borrows/noNestedBorrowsScript.sml
+++ b/tests/hol4/misc-no_nested_borrows/noNestedBorrowsScript.sml
@@ -38,49 +38,49 @@ Datatype:
 End
 
 val neg_test_fwd_def = Define ‘
-  (** [no_nested_borrows::neg_test] *)
+  (** [no_nested_borrows::neg_test]: forward function *)
   neg_test_fwd (x : i32) : i32 result =
     i32_neg x
 ’
 
 val add_test_fwd_def = Define ‘
-  (** [no_nested_borrows::add_test] *)
+  (** [no_nested_borrows::add_test]: forward function *)
   add_test_fwd (x : u32) (y : u32) : u32 result =
     u32_add x y
 ’
 
 val subs_test_fwd_def = Define ‘
-  (** [no_nested_borrows::subs_test] *)
+  (** [no_nested_borrows::subs_test]: forward function *)
   subs_test_fwd (x : u32) (y : u32) : u32 result =
     u32_sub x y
 ’
 
 val div_test_fwd_def = Define ‘
-  (** [no_nested_borrows::div_test] *)
+  (** [no_nested_borrows::div_test]: forward function *)
   div_test_fwd (x : u32) (y : u32) : u32 result =
     u32_div x y
 ’
 
 val div_test1_fwd_def = Define ‘
-  (** [no_nested_borrows::div_test1] *)
+  (** [no_nested_borrows::div_test1]: forward function *)
   div_test1_fwd (x : u32) : u32 result =
     u32_div x (int_to_u32 2)
 ’
 
 val rem_test_fwd_def = Define ‘
-  (** [no_nested_borrows::rem_test] *)
+  (** [no_nested_borrows::rem_test]: forward function *)
   rem_test_fwd (x : u32) (y : u32) : u32 result =
     u32_rem x y
 ’
 
 val cast_test_fwd_def = Define ‘
-  (** [no_nested_borrows::cast_test] *)
+  (** [no_nested_borrows::cast_test]: forward function *)
   cast_test_fwd (x : u32) : i32 result =
     mk_i32 (u32_to_int x)
 ’
 
 val test2_fwd_def = Define ‘
-  (** [no_nested_borrows::test2] *)
+  (** [no_nested_borrows::test2]: forward function *)
   test2_fwd : unit result =
     do
     _ <- u32_add (int_to_u32 23) (int_to_u32 44);
@@ -92,13 +92,13 @@ val test2_fwd_def = Define ‘
 val _ = assert_return (“test2_fwd”)
 
 val get_max_fwd_def = Define ‘
-  (** [no_nested_borrows::get_max] *)
+  (** [no_nested_borrows::get_max]: forward function *)
   get_max_fwd (x : u32) (y : u32) : u32 result =
     if u32_ge x y then Return x else Return y
 ’
 
 val test3_fwd_def = Define ‘
-  (** [no_nested_borrows::test3] *)
+  (** [no_nested_borrows::test3]: forward function *)
   test3_fwd : unit result =
     do
     x <- get_max_fwd (int_to_u32 4) (int_to_u32 3);
@@ -112,7 +112,7 @@ val test3_fwd_def = Define ‘
 val _ = assert_return (“test3_fwd”)
 
 val test_neg1_fwd_def = Define ‘
-  (** [no_nested_borrows::test_neg1] *)
+  (** [no_nested_borrows::test_neg1]: forward function *)
   test_neg1_fwd : unit result =
     do
     y <- i32_neg (int_to_i32 3);
@@ -124,7 +124,7 @@ val test_neg1_fwd_def = Define ‘
 val _ = assert_return (“test_neg1_fwd”)
 
 val refs_test1_fwd_def = Define ‘
-  (** [no_nested_borrows::refs_test1] *)
+  (** [no_nested_borrows::refs_test1]: forward function *)
   refs_test1_fwd : unit result =
     if ~ (int_to_i32 1 = int_to_i32 1) then Fail Failure else Return ()
 ’
@@ -133,7 +133,7 @@ val refs_test1_fwd_def = Define ‘
 val _ = assert_return (“refs_test1_fwd”)
 
 val refs_test2_fwd_def = Define ‘
-  (** [no_nested_borrows::refs_test2] *)
+  (** [no_nested_borrows::refs_test2]: forward function *)
   refs_test2_fwd : unit result =
     if ~ (int_to_i32 2 = int_to_i32 2)
     then Fail Failure
@@ -151,7 +151,7 @@ val refs_test2_fwd_def = Define ‘
 val _ = assert_return (“refs_test2_fwd”)
 
 val test_list1_fwd_def = Define ‘
-  (** [no_nested_borrows::test_list1] *)
+  (** [no_nested_borrows::test_list1]: forward function *)
   test_list1_fwd : unit result =
     Return ()
 ’
@@ -160,7 +160,7 @@ val test_list1_fwd_def = Define ‘
 val _ = assert_return (“test_list1_fwd”)
 
 val test_box1_fwd_def = Define ‘
-  (** [no_nested_borrows::test_box1] *)
+  (** [no_nested_borrows::test_box1]: forward function *)
   test_box1_fwd : unit result =
     let b = int_to_i32 1 in
     let x = b in
@@ -171,25 +171,25 @@ val test_box1_fwd_def = Define ‘
 val _ = assert_return (“test_box1_fwd”)
 
 val copy_int_fwd_def = Define ‘
-  (** [no_nested_borrows::copy_int] *)
+  (** [no_nested_borrows::copy_int]: forward function *)
   copy_int_fwd (x : i32) : i32 result =
     Return x
 ’
 
 val test_unreachable_fwd_def = Define ‘
-  (** [no_nested_borrows::test_unreachable] *)
+  (** [no_nested_borrows::test_unreachable]: forward function *)
   test_unreachable_fwd (b : bool) : unit result =
     if b then Fail Failure else Return ()
 ’
 
 val test_panic_fwd_def = Define ‘
-  (** [no_nested_borrows::test_panic] *)
+  (** [no_nested_borrows::test_panic]: forward function *)
   test_panic_fwd (b : bool) : unit result =
     if b then Fail Failure else Return ()
 ’
 
 val test_copy_int_fwd_def = Define ‘
-  (** [no_nested_borrows::test_copy_int] *)
+  (** [no_nested_borrows::test_copy_int]: forward function *)
   test_copy_int_fwd : unit result =
     do
     y <- copy_int_fwd (int_to_i32 0);
@@ -201,13 +201,13 @@ val test_copy_int_fwd_def = Define ‘
 val _ = assert_return (“test_copy_int_fwd”)
 
 val is_cons_fwd_def = Define ‘
-  (** [no_nested_borrows::is_cons] *)
+  (** [no_nested_borrows::is_cons]: forward function *)
   is_cons_fwd (l : 't list_t) : bool result =
     (case l of | ListCons t l0 => Return T | ListNil => Return F)
 ’
 
 val test_is_cons_fwd_def = Define ‘
-  (** [no_nested_borrows::test_is_cons] *)
+  (** [no_nested_borrows::test_is_cons]: forward function *)
   test_is_cons_fwd : unit result =
     let l = ListNil in
     do
@@ -220,13 +220,13 @@ val test_is_cons_fwd_def = Define ‘
 val _ = assert_return (“test_is_cons_fwd”)
 
 val split_list_fwd_def = Define ‘
-  (** [no_nested_borrows::split_list] *)
+  (** [no_nested_borrows::split_list]: forward function *)
   split_list_fwd (l : 't list_t) : ('t # 't list_t) result =
     (case l of | ListCons hd tl => Return (hd, tl) | ListNil => Fail Failure)
 ’
 
 val test_split_list_fwd_def = Define ‘
-  (** [no_nested_borrows::test_split_list] *)
+  (** [no_nested_borrows::test_split_list]: forward function *)
   test_split_list_fwd : unit result =
     let l = ListNil in
     do
@@ -240,19 +240,19 @@ val test_split_list_fwd_def = Define ‘
 val _ = assert_return (“test_split_list_fwd”)
 
 val choose_fwd_def = Define ‘
-  (** [no_nested_borrows::choose] *)
+  (** [no_nested_borrows::choose]: forward function *)
   choose_fwd (b : bool) (x : 't) (y : 't) : 't result =
     if b then Return x else Return y
 ’
 
 val choose_back_def = Define ‘
-  (** [no_nested_borrows::choose] *)
+  (** [no_nested_borrows::choose]: backward function 0 *)
   choose_back (b : bool) (x : 't) (y : 't) (ret : 't) : ('t # 't) result =
     if b then Return (ret, y) else Return (x, ret)
 ’
 
 val choose_test_fwd_def = Define ‘
-  (** [no_nested_borrows::choose_test] *)
+  (** [no_nested_borrows::choose_test]: forward function *)
   choose_test_fwd : unit result =
     do
     z <- choose_fwd T (int_to_i32 0) (int_to_i32 0);
@@ -273,7 +273,7 @@ val choose_test_fwd_def = Define ‘
 val _ = assert_return (“choose_test_fwd”)
 
 val test_char_fwd_def = Define ‘
-  (** [no_nested_borrows::test_char] *)
+  (** [no_nested_borrows::test_char]: forward function *)
   test_char_fwd : char result =
     Return #"a"
 ’
@@ -287,7 +287,7 @@ Datatype:
 End
 
 val [list_length_fwd_def] = DefineDiv ‘
-  (** [no_nested_borrows::list_length] *)
+  (** [no_nested_borrows::list_length]: forward function *)
   list_length_fwd (l : 't list_t) : u32 result =
     (case l of
     | ListCons t l1 => do
@@ -298,7 +298,7 @@ val [list_length_fwd_def] = DefineDiv ‘
 ’
 
 val [list_nth_shared_fwd_def] = DefineDiv ‘
-  (** [no_nested_borrows::list_nth_shared] *)
+  (** [no_nested_borrows::list_nth_shared]: forward function *)
   list_nth_shared_fwd (l : 't list_t) (i : u32) : 't result =
     (case l of
     | ListCons x tl =>
@@ -312,7 +312,7 @@ val [list_nth_shared_fwd_def] = DefineDiv ‘
 ’
 
 val [list_nth_mut_fwd_def] = DefineDiv ‘
-  (** [no_nested_borrows::list_nth_mut] *)
+  (** [no_nested_borrows::list_nth_mut]: forward function *)
   list_nth_mut_fwd (l : 't list_t) (i : u32) : 't result =
     (case l of
     | ListCons x tl =>
@@ -326,7 +326,7 @@ val [list_nth_mut_fwd_def] = DefineDiv ‘
 ’
 
 val [list_nth_mut_back_def] = DefineDiv ‘
-  (** [no_nested_borrows::list_nth_mut] *)
+  (** [no_nested_borrows::list_nth_mut]: backward function 0 *)
   list_nth_mut_back (l : 't list_t) (i : u32) (ret : 't) : 't list_t result =
     (case l of
     | ListCons x tl =>
@@ -342,7 +342,7 @@ val [list_nth_mut_back_def] = DefineDiv ‘
 ’
 
 val [list_rev_aux_fwd_def] = DefineDiv ‘
-  (** [no_nested_borrows::list_rev_aux] *)
+  (** [no_nested_borrows::list_rev_aux]: forward function *)
   list_rev_aux_fwd (li : 't list_t) (lo : 't list_t) : 't list_t result =
     (case li of
     | ListCons hd tl => list_rev_aux_fwd tl (ListCons hd lo)
@@ -350,13 +350,14 @@ val [list_rev_aux_fwd_def] = DefineDiv ‘
 ’
 
 val list_rev_fwd_back_def = Define ‘
-  (** [no_nested_borrows::list_rev] *)
+  (** [no_nested_borrows::list_rev]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   list_rev_fwd_back (l : 't list_t) : 't list_t result =
     let li = mem_replace_fwd l ListNil in list_rev_aux_fwd li ListNil
 ’
 
 val test_list_functions_fwd_def = Define ‘
-  (** [no_nested_borrows::test_list_functions] *)
+  (** [no_nested_borrows::test_list_functions]: forward function *)
   test_list_functions_fwd : unit result =
     let l = ListNil in
     let l0 = ListCons (int_to_i32 2) l in
@@ -411,63 +412,63 @@ val test_list_functions_fwd_def = Define ‘
 val _ = assert_return (“test_list_functions_fwd”)
 
 val id_mut_pair1_fwd_def = Define ‘
-  (** [no_nested_borrows::id_mut_pair1] *)
+  (** [no_nested_borrows::id_mut_pair1]: forward function *)
   id_mut_pair1_fwd (x : 't1) (y : 't2) : ('t1 # 't2) result =
     Return (x, y)
 ’
 
 val id_mut_pair1_back_def = Define ‘
-  (** [no_nested_borrows::id_mut_pair1] *)
+  (** [no_nested_borrows::id_mut_pair1]: backward function 0 *)
   id_mut_pair1_back
     (x : 't1) (y : 't2) (ret : ('t1 # 't2)) : ('t1 # 't2) result =
     let (t, t0) = ret in Return (t, t0)
 ’
 
 val id_mut_pair2_fwd_def = Define ‘
-  (** [no_nested_borrows::id_mut_pair2] *)
+  (** [no_nested_borrows::id_mut_pair2]: forward function *)
   id_mut_pair2_fwd (p : ('t1 # 't2)) : ('t1 # 't2) result =
     let (t, t0) = p in Return (t, t0)
 ’
 
 val id_mut_pair2_back_def = Define ‘
-  (** [no_nested_borrows::id_mut_pair2] *)
+  (** [no_nested_borrows::id_mut_pair2]: backward function 0 *)
   id_mut_pair2_back
     (p : ('t1 # 't2)) (ret : ('t1 # 't2)) : ('t1 # 't2) result =
     let (t, t0) = ret in Return (t, t0)
 ’
 
 val id_mut_pair3_fwd_def = Define ‘
-  (** [no_nested_borrows::id_mut_pair3] *)
+  (** [no_nested_borrows::id_mut_pair3]: forward function *)
   id_mut_pair3_fwd (x : 't1) (y : 't2) : ('t1 # 't2) result =
     Return (x, y)
 ’
 
 val id_mut_pair3_back'a_def = Define ‘
-  (** [no_nested_borrows::id_mut_pair3] *)
+  (** [no_nested_borrows::id_mut_pair3]: backward function 0 *)
   id_mut_pair3_back'a (x : 't1) (y : 't2) (ret : 't1) : 't1 result =
     Return ret
 ’
 
 val id_mut_pair3_back'b_def = Define ‘
-  (** [no_nested_borrows::id_mut_pair3] *)
+  (** [no_nested_borrows::id_mut_pair3]: backward function 1 *)
   id_mut_pair3_back'b (x : 't1) (y : 't2) (ret : 't2) : 't2 result =
     Return ret
 ’
 
 val id_mut_pair4_fwd_def = Define ‘
-  (** [no_nested_borrows::id_mut_pair4] *)
+  (** [no_nested_borrows::id_mut_pair4]: forward function *)
   id_mut_pair4_fwd (p : ('t1 # 't2)) : ('t1 # 't2) result =
     let (t, t0) = p in Return (t, t0)
 ’
 
 val id_mut_pair4_back'a_def = Define ‘
-  (** [no_nested_borrows::id_mut_pair4] *)
+  (** [no_nested_borrows::id_mut_pair4]: backward function 0 *)
   id_mut_pair4_back'a (p : ('t1 # 't2)) (ret : 't1) : 't1 result =
     Return ret
 ’
 
 val id_mut_pair4_back'b_def = Define ‘
-  (** [no_nested_borrows::id_mut_pair4] *)
+  (** [no_nested_borrows::id_mut_pair4]: backward function 1 *)
   id_mut_pair4_back'b (p : ('t1 # 't2)) (ret : 't2) : 't2 result =
     Return ret
 ’
@@ -478,19 +479,19 @@ Datatype:
 End
 
 val new_tuple1_fwd_def = Define ‘
-  (** [no_nested_borrows::new_tuple1] *)
+  (** [no_nested_borrows::new_tuple1]: forward function *)
   new_tuple1_fwd : (u32, u32) struct_with_tuple_t result =
     Return (<| struct_with_tuple_p := (int_to_u32 1, int_to_u32 2) |>)
 ’
 
 val new_tuple2_fwd_def = Define ‘
-  (** [no_nested_borrows::new_tuple2] *)
+  (** [no_nested_borrows::new_tuple2]: forward function *)
   new_tuple2_fwd : (i16, i16) struct_with_tuple_t result =
     Return (<| struct_with_tuple_p := (int_to_i16 1, int_to_i16 2) |>)
 ’
 
 val new_tuple3_fwd_def = Define ‘
-  (** [no_nested_borrows::new_tuple3] *)
+  (** [no_nested_borrows::new_tuple3]: forward function *)
   new_tuple3_fwd : (u64, i64) struct_with_tuple_t result =
     Return (<| struct_with_tuple_p := (int_to_u64 1, int_to_i64 2) |>)
 ’
@@ -501,7 +502,7 @@ Datatype:
 End
 
 val new_pair1_fwd_def = Define ‘
-  (** [no_nested_borrows::new_pair1] *)
+  (** [no_nested_borrows::new_pair1]: forward function *)
   new_pair1_fwd : (u32, u32) struct_with_pair_t result =
     Return
     (<|
@@ -511,7 +512,7 @@ val new_pair1_fwd_def = Define ‘
 ’
 
 val test_constants_fwd_def = Define ‘
-  (** [no_nested_borrows::test_constants] *)
+  (** [no_nested_borrows::test_constants]: forward function *)
   test_constants_fwd : unit result =
     do
     swt <- new_tuple1_fwd;
@@ -546,7 +547,7 @@ val test_constants_fwd_def = Define ‘
 val _ = assert_return (“test_constants_fwd”)
 
 val test_weird_borrows1_fwd_def = Define ‘
-  (** [no_nested_borrows::test_weird_borrows1] *)
+  (** [no_nested_borrows::test_weird_borrows1]: forward function *)
   test_weird_borrows1_fwd : unit result =
     Return ()
 ’
@@ -555,26 +556,27 @@ val test_weird_borrows1_fwd_def = Define ‘
 val _ = assert_return (“test_weird_borrows1_fwd”)
 
 val test_mem_replace_fwd_back_def = Define ‘
-  (** [no_nested_borrows::test_mem_replace] *)
+  (** [no_nested_borrows::test_mem_replace]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   test_mem_replace_fwd_back (px : u32) : u32 result =
     let y = mem_replace_fwd px (int_to_u32 1) in
     if ~ (y = int_to_u32 0) then Fail Failure else Return (int_to_u32 2)
 ’
 
 val test_shared_borrow_bool1_fwd_def = Define ‘
-  (** [no_nested_borrows::test_shared_borrow_bool1] *)
+  (** [no_nested_borrows::test_shared_borrow_bool1]: forward function *)
   test_shared_borrow_bool1_fwd (b : bool) : u32 result =
     if b then Return (int_to_u32 0) else Return (int_to_u32 1)
 ’
 
 val test_shared_borrow_bool2_fwd_def = Define ‘
-  (** [no_nested_borrows::test_shared_borrow_bool2] *)
+  (** [no_nested_borrows::test_shared_borrow_bool2]: forward function *)
   test_shared_borrow_bool2_fwd : u32 result =
     Return (int_to_u32 0)
 ’
 
 val test_shared_borrow_enum1_fwd_def = Define ‘
-  (** [no_nested_borrows::test_shared_borrow_enum1] *)
+  (** [no_nested_borrows::test_shared_borrow_enum1]: forward function *)
   test_shared_borrow_enum1_fwd (l : u32 list_t) : u32 result =
     (case l of
     | ListCons i l0 => Return (int_to_u32 1)
@@ -582,7 +584,7 @@ val test_shared_borrow_enum1_fwd_def = Define ‘
 ’
 
 val test_shared_borrow_enum2_fwd_def = Define ‘
-  (** [no_nested_borrows::test_shared_borrow_enum2] *)
+  (** [no_nested_borrows::test_shared_borrow_enum2]: forward function *)
   test_shared_borrow_enum2_fwd : u32 result =
     Return (int_to_u32 0)
 ’
diff --git a/tests/hol4/misc-paper/paperScript.sml b/tests/hol4/misc-paper/paperScript.sml
index 4d6e99ba..3ac5b6ca 100644
--- a/tests/hol4/misc-paper/paperScript.sml
+++ b/tests/hol4/misc-paper/paperScript.sml
@@ -6,13 +6,14 @@ val _ = new_theory "paper"
 
 
 val ref_incr_fwd_back_def = Define ‘
-  (** [paper::ref_incr] *)
+  (** [paper::ref_incr]: merged forward/backward function
+      (there is a single backward function, and the forward function returns ()) *)
   ref_incr_fwd_back (x : i32) : i32 result =
     i32_add x (int_to_i32 1)
 ’
 
 val test_incr_fwd_def = Define ‘
-  (** [paper::test_incr] *)
+  (** [paper::test_incr]: forward function *)
   test_incr_fwd : unit result =
     do
     x <- ref_incr_fwd_back (int_to_i32 0);
@@ -24,19 +25,19 @@ val test_incr_fwd_def = Define ‘
 val _ = assert_return (“test_incr_fwd”)
 
 val choose_fwd_def = Define ‘
-  (** [paper::choose] *)
+  (** [paper::choose]: forward function *)
   choose_fwd (b : bool) (x : 't) (y : 't) : 't result =
     if b then Return x else Return y
 ’
 
 val choose_back_def = Define ‘
-  (** [paper::choose] *)
+  (** [paper::choose]: backward function 0 *)
   choose_back (b : bool) (x : 't) (y : 't) (ret : 't) : ('t # 't) result =
     if b then Return (ret, y) else Return (x, ret)
 ’
 
 val test_choose_fwd_def = Define ‘
-  (** [paper::test_choose] *)
+  (** [paper::test_choose]: forward function *)
   test_choose_fwd : unit result =
     do
     z <- choose_fwd T (int_to_i32 0) (int_to_i32 0);
@@ -62,7 +63,7 @@ Datatype:
 End
 
 val [list_nth_mut_fwd_def] = DefineDiv ‘
-  (** [paper::list_nth_mut] *)
+  (** [paper::list_nth_mut]: forward function *)
   list_nth_mut_fwd (l : 't list_t) (i : u32) : 't result =
     (case l of
     | ListCons x tl =>
@@ -76,7 +77,7 @@ val [list_nth_mut_fwd_def] = DefineDiv ‘
 ’
 
 val [list_nth_mut_back_def] = DefineDiv ‘
-  (** [paper::list_nth_mut] *)
+  (** [paper::list_nth_mut]: backward function 0 *)
   list_nth_mut_back (l : 't list_t) (i : u32) (ret : 't) : 't list_t result =
     (case l of
     | ListCons x tl =>
@@ -92,7 +93,7 @@ val [list_nth_mut_back_def] = DefineDiv ‘
 ’
 
 val [sum_fwd_def] = DefineDiv ‘
-  (** [paper::sum] *)
+  (** [paper::sum]: forward function *)
   sum_fwd (l : i32 list_t) : i32 result =
     (case l of
     | ListCons x tl => do
@@ -103,7 +104,7 @@ val [sum_fwd_def] = DefineDiv ‘
 ’
 
 val test_nth_fwd_def = Define ‘
-  (** [paper::test_nth] *)
+  (** [paper::test_nth]: forward function *)
   test_nth_fwd : unit result =
     let l = ListNil in
     let l0 = ListCons (int_to_i32 3) l in
@@ -121,7 +122,7 @@ val test_nth_fwd_def = Define ‘
 val _ = assert_return (“test_nth_fwd”)
 
 val call_choose_fwd_def = Define ‘
-  (** [paper::call_choose] *)
+  (** [paper::call_choose]: forward function *)
   call_choose_fwd (p : (u32 # u32)) : u32 result =
     let (px, py) = p in
     do
diff --git a/tests/hol4/misc-polonius_list/poloniusListScript.sml b/tests/hol4/misc-polonius_list/poloniusListScript.sml
index dd631169..06876ed4 100644
--- a/tests/hol4/misc-polonius_list/poloniusListScript.sml
+++ b/tests/hol4/misc-polonius_list/poloniusListScript.sml
@@ -11,7 +11,7 @@ Datatype:
 End
 
 val [get_list_at_x_fwd_def] = DefineDiv ‘
-  (** [polonius_list::get_list_at_x] *)
+  (** [polonius_list::get_list_at_x]: forward function *)
   get_list_at_x_fwd (ls : u32 list_t) (x : u32) : u32 list_t result =
     (case ls of
     | ListCons hd tl =>
@@ -20,7 +20,7 @@ val [get_list_at_x_fwd_def] = DefineDiv ‘
 ’
 
 val [get_list_at_x_back_def] = DefineDiv ‘
-  (** [polonius_list::get_list_at_x] *)
+  (** [polonius_list::get_list_at_x]: backward function 0 *)
   get_list_at_x_back
     (ls : u32 list_t) (x : u32) (ret : u32 list_t) : u32 list_t result =
     (case ls of
diff --git a/tests/lean/BetreeMain/Funs.lean b/tests/lean/BetreeMain/Funs.lean
index 074fff5e..41e4349e 100644
--- a/tests/lean/BetreeMain/Funs.lean
+++ b/tests/lean/BetreeMain/Funs.lean
@@ -6,60 +6,59 @@ import BetreeMain.FunsExternal
 open Primitives
 namespace betree_main
 
-/- [betree_main::betree::load_internal_node] -/
-def betree.load_internal_node_fwd
+/- [betree_main::betree::load_internal_node]: forward function -/
+def betree.load_internal_node
   (id : U64) (st : State) :
   Result (State × (betree.List (U64 × betree.Message)))
   :=
-  betree_utils.load_internal_node_fwd id st
+  betree_utils.load_internal_node id st
 
-/- [betree_main::betree::store_internal_node] -/
-def betree.store_internal_node_fwd
+/- [betree_main::betree::store_internal_node]: forward function -/
+def betree.store_internal_node
   (id : U64) (content : betree.List (U64 × betree.Message)) (st : State) :
   Result (State × Unit)
   :=
   do
-    let (st0, _) ← betree_utils.store_internal_node_fwd id content st
+    let (st0, _) ← betree_utils.store_internal_node id content st
     Result.ret (st0, ())
 
-/- [betree_main::betree::load_leaf_node] -/
-def betree.load_leaf_node_fwd
+/- [betree_main::betree::load_leaf_node]: forward function -/
+def betree.load_leaf_node
   (id : U64) (st : State) : Result (State × (betree.List (U64 × U64))) :=
-  betree_utils.load_leaf_node_fwd id st
+  betree_utils.load_leaf_node id st
 
-/- [betree_main::betree::store_leaf_node] -/
-def betree.store_leaf_node_fwd
+/- [betree_main::betree::store_leaf_node]: forward function -/
+def betree.store_leaf_node
   (id : U64) (content : betree.List (U64 × U64)) (st : State) :
   Result (State × Unit)
   :=
   do
-    let (st0, _) ← betree_utils.store_leaf_node_fwd id content st
+    let (st0, _) ← betree_utils.store_leaf_node id content st
     Result.ret (st0, ())
 
-/- [betree_main::betree::fresh_node_id] -/
-def betree.fresh_node_id_fwd (counter : U64) : Result U64 :=
+/- [betree_main::betree::fresh_node_id]: forward function -/
+def betree.fresh_node_id (counter : U64) : Result U64 :=
   do
     let _ ← counter + (U64.ofInt 1 (by intlit))
     Result.ret counter
 
-/- [betree_main::betree::fresh_node_id] -/
+/- [betree_main::betree::fresh_node_id]: backward function 0 -/
 def betree.fresh_node_id_back (counter : U64) : Result U64 :=
   counter + (U64.ofInt 1 (by intlit))
 
-/- [betree_main::betree::NodeIdCounter::{0}::new] -/
-def betree.NodeIdCounter.new_fwd : Result betree.NodeIdCounter :=
+/- [betree_main::betree::NodeIdCounter::{0}::new]: forward function -/
+def betree.NodeIdCounter.new : Result betree.NodeIdCounter :=
   Result.ret
   { betree_node_id_counter_next_node_id := (U64.ofInt 0 (by intlit)) }
 
-/- [betree_main::betree::NodeIdCounter::{0}::fresh_id] -/
-def betree.NodeIdCounter.fresh_id_fwd
-  (self : betree.NodeIdCounter) : Result U64 :=
+/- [betree_main::betree::NodeIdCounter::{0}::fresh_id]: forward function -/
+def betree.NodeIdCounter.fresh_id (self : betree.NodeIdCounter) : Result U64 :=
   do
     let _ ← self.betree_node_id_counter_next_node_id +
       (U64.ofInt 1 (by intlit))
     Result.ret self.betree_node_id_counter_next_node_id
 
-/- [betree_main::betree::NodeIdCounter::{0}::fresh_id] -/
+/- [betree_main::betree::NodeIdCounter::{0}::fresh_id]: backward function 0 -/
 def betree.NodeIdCounter.fresh_id_back
   (self : betree.NodeIdCounter) : Result betree.NodeIdCounter :=
   do
@@ -72,8 +71,8 @@ def core_num_u64_max_body : Result U64 :=
   Result.ret (U64.ofInt 18446744073709551615 (by intlit))
 def core_num_u64_max_c : U64 := eval_global core_num_u64_max_body (by simp)
 
-/- [betree_main::betree::upsert_update] -/
-def betree.upsert_update_fwd
+/- [betree_main::betree::upsert_update]: forward function -/
+def betree.upsert_update
   (prev : Option U64) (st : betree.UpsertFunState) : Result U64 :=
   match prev with
   | Option.none =>
@@ -93,18 +92,17 @@ def betree.upsert_update_fwd
       then prev0 - v
       else Result.ret (U64.ofInt 0 (by intlit))
 
-/- [betree_main::betree::List::{1}::len] -/
-divergent def betree.List.len_fwd
-  (T : Type) (self : betree.List T) : Result U64 :=
+/- [betree_main::betree::List::{1}::len]: forward function -/
+divergent def betree.List.len (T : Type) (self : betree.List T) : Result U64 :=
   match self with
   | betree.List.Cons t tl =>
     do
-      let i ← betree.List.len_fwd T tl
+      let i ← betree.List.len T tl
       (U64.ofInt 1 (by intlit)) + i
   | betree.List.Nil => Result.ret (U64.ofInt 0 (by intlit))
 
-/- [betree_main::betree::List::{1}::split_at] -/
-divergent def betree.List.split_at_fwd
+/- [betree_main::betree::List::{1}::split_at]: forward function -/
+divergent def betree.List.split_at
   (T : Type) (self : betree.List T) (n : U64) :
   Result ((betree.List T) × (betree.List T))
   :=
@@ -115,50 +113,51 @@ divergent def betree.List.split_at_fwd
     | betree.List.Cons hd tl =>
       do
         let i ← n - (U64.ofInt 1 (by intlit))
-        let p ← betree.List.split_at_fwd T tl i
+        let p ← betree.List.split_at T tl i
         let (ls0, ls1) := p
         let l := ls0
         Result.ret (betree.List.Cons hd l, ls1)
     | betree.List.Nil => Result.fail Error.panic
 
-/- [betree_main::betree::List::{1}::push_front] -/
-def betree.List.push_front_fwd_back
+/- [betree_main::betree::List::{1}::push_front]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def betree.List.push_front
   (T : Type) (self : betree.List T) (x : T) : Result (betree.List T) :=
-  let tl := mem.replace_fwd (betree.List T) self betree.List.Nil
+  let tl := mem.replace (betree.List T) self betree.List.Nil
   let l := tl
   Result.ret (betree.List.Cons x l)
 
-/- [betree_main::betree::List::{1}::pop_front] -/
-def betree.List.pop_front_fwd (T : Type) (self : betree.List T) : Result T :=
-  let ls := mem.replace_fwd (betree.List T) self betree.List.Nil
+/- [betree_main::betree::List::{1}::pop_front]: forward function -/
+def betree.List.pop_front (T : Type) (self : betree.List T) : Result T :=
+  let ls := mem.replace (betree.List T) self betree.List.Nil
   match ls with
   | betree.List.Cons x tl => Result.ret x
   | betree.List.Nil => Result.fail Error.panic
 
-/- [betree_main::betree::List::{1}::pop_front] -/
+/- [betree_main::betree::List::{1}::pop_front]: backward function 0 -/
 def betree.List.pop_front_back
   (T : Type) (self : betree.List T) : Result (betree.List T) :=
-  let ls := mem.replace_fwd (betree.List T) self betree.List.Nil
+  let ls := mem.replace (betree.List T) self betree.List.Nil
   match ls with
   | betree.List.Cons x tl => Result.ret tl
   | betree.List.Nil => Result.fail Error.panic
 
-/- [betree_main::betree::List::{1}::hd] -/
-def betree.List.hd_fwd (T : Type) (self : betree.List T) : Result T :=
+/- [betree_main::betree::List::{1}::hd]: forward function -/
+def betree.List.hd (T : Type) (self : betree.List T) : Result T :=
   match self with
   | betree.List.Cons hd l => Result.ret hd
   | betree.List.Nil => Result.fail Error.panic
 
-/- [betree_main::betree::List::{2}::head_has_key] -/
-def betree.List.head_has_key_fwd
+/- [betree_main::betree::List::{2}::head_has_key]: forward function -/
+def betree.List.head_has_key
   (T : Type) (self : betree.List (U64 × T)) (key : U64) : Result Bool :=
   match self with
   | betree.List.Cons hd l => let (i, _) := hd
                              Result.ret (i = key)
   | betree.List.Nil => Result.ret false
 
-/- [betree_main::betree::List::{2}::partition_at_pivot] -/
-divergent def betree.List.partition_at_pivot_fwd
+/- [betree_main::betree::List::{2}::partition_at_pivot]: forward function -/
+divergent def betree.List.partition_at_pivot
   (T : Type) (self : betree.List (U64 × T)) (pivot : U64) :
   Result ((betree.List (U64 × T)) × (betree.List (U64 × T)))
   :=
@@ -169,30 +168,29 @@ divergent def betree.List.partition_at_pivot_fwd
     then Result.ret (betree.List.Nil, betree.List.Cons (i, t) tl)
     else
       do
-        let p ← betree.List.partition_at_pivot_fwd T tl pivot
+        let p ← betree.List.partition_at_pivot T tl pivot
         let (ls0, ls1) := p
         let l := ls0
         Result.ret (betree.List.Cons (i, t) l, ls1)
   | betree.List.Nil => Result.ret (betree.List.Nil, betree.List.Nil)
 
-/- [betree_main::betree::Leaf::{3}::split] -/
-def betree.Leaf.split_fwd
+/- [betree_main::betree::Leaf::{3}::split]: forward function -/
+def betree.Leaf.split
   (self : betree.Leaf) (content : betree.List (U64 × U64))
   (params : betree.Params) (node_id_cnt : betree.NodeIdCounter) (st : State) :
   Result (State × betree.Internal)
   :=
   do
     let p ←
-      betree.List.split_at_fwd (U64 × U64) content
-        params.betree_params_split_size
+      betree.List.split_at (U64 × U64) content params.betree_params_split_size
     let (content0, content1) := p
-    let p0 ← betree.List.hd_fwd (U64 × U64) content1
+    let p0 ← betree.List.hd (U64 × U64) content1
     let (pivot, _) := p0
-    let id0 ← betree.NodeIdCounter.fresh_id_fwd node_id_cnt
+    let id0 ← betree.NodeIdCounter.fresh_id node_id_cnt
     let node_id_cnt0 ← betree.NodeIdCounter.fresh_id_back node_id_cnt
-    let id1 ← betree.NodeIdCounter.fresh_id_fwd node_id_cnt0
-    let (st0, _) ← betree.store_leaf_node_fwd id0 content0 st
-    let (st1, _) ← betree.store_leaf_node_fwd id1 content1 st0
+    let id1 ← betree.NodeIdCounter.fresh_id node_id_cnt0
+    let (st0, _) ← betree.store_leaf_node id0 content0 st
+    let (st1, _) ← betree.store_leaf_node id1 content1 st0
     let n := betree.Node.Leaf
       {
         betree_leaf_id := id0,
@@ -205,7 +203,7 @@ def betree.Leaf.split_fwd
       }
     Result.ret (st1, betree.Internal.mk self.betree_leaf_id pivot n n0)
 
-/- [betree_main::betree::Leaf::{3}::split] -/
+/- [betree_main::betree::Leaf::{3}::split]: backward function 2 -/
 def betree.Leaf.split_back
   (self : betree.Leaf) (content : betree.List (U64 × U64))
   (params : betree.Params) (node_id_cnt : betree.NodeIdCounter) (st : State) :
@@ -213,19 +211,18 @@ def betree.Leaf.split_back
   :=
   do
     let p ←
-      betree.List.split_at_fwd (U64 × U64) content
-        params.betree_params_split_size
+      betree.List.split_at (U64 × U64) content params.betree_params_split_size
     let (content0, content1) := p
-    let _ ← betree.List.hd_fwd (U64 × U64) content1
-    let id0 ← betree.NodeIdCounter.fresh_id_fwd node_id_cnt
+    let _ ← betree.List.hd (U64 × U64) content1
+    let id0 ← betree.NodeIdCounter.fresh_id node_id_cnt
     let node_id_cnt0 ← betree.NodeIdCounter.fresh_id_back node_id_cnt
-    let id1 ← betree.NodeIdCounter.fresh_id_fwd node_id_cnt0
-    let (st0, _) ← betree.store_leaf_node_fwd id0 content0 st
-    let _ ← betree.store_leaf_node_fwd id1 content1 st0
+    let id1 ← betree.NodeIdCounter.fresh_id node_id_cnt0
+    let (st0, _) ← betree.store_leaf_node id0 content0 st
+    let _ ← betree.store_leaf_node id1 content1 st0
     betree.NodeIdCounter.fresh_id_back node_id_cnt0
 
-/- [betree_main::betree::Node::{5}::lookup_in_bindings] -/
-divergent def betree.Node.lookup_in_bindings_fwd
+/- [betree_main::betree::Node::{5}::lookup_in_bindings]: forward function -/
+divergent def betree.Node.lookup_in_bindings
   (key : U64) (bindings : betree.List (U64 × U64)) : Result (Option U64) :=
   match bindings with
   | betree.List.Cons hd tl =>
@@ -235,11 +232,11 @@ divergent def betree.Node.lookup_in_bindings_fwd
     else
       if i > key
       then Result.ret Option.none
-      else betree.Node.lookup_in_bindings_fwd key tl
+      else betree.Node.lookup_in_bindings key tl
   | betree.List.Nil => Result.ret Option.none
 
-/- [betree_main::betree::Node::{5}::lookup_first_message_for_key] -/
-divergent def betree.Node.lookup_first_message_for_key_fwd
+/- [betree_main::betree::Node::{5}::lookup_first_message_for_key]: forward function -/
+divergent def betree.Node.lookup_first_message_for_key
   (key : U64) (msgs : betree.List (U64 × betree.Message)) :
   Result (betree.List (U64 × betree.Message))
   :=
@@ -248,10 +245,10 @@ divergent def betree.Node.lookup_first_message_for_key_fwd
     let (i, m) := x
     if i >= key
     then Result.ret (betree.List.Cons (i, m) next_msgs)
-    else betree.Node.lookup_first_message_for_key_fwd key next_msgs
+    else betree.Node.lookup_first_message_for_key key next_msgs
   | betree.List.Nil => Result.ret betree.List.Nil
 
-/- [betree_main::betree::Node::{5}::lookup_first_message_for_key] -/
+/- [betree_main::betree::Node::{5}::lookup_first_message_for_key]: backward function 0 -/
 divergent def betree.Node.lookup_first_message_for_key_back
   (key : U64) (msgs : betree.List (U64 × betree.Message))
   (ret0 : betree.List (U64 × betree.Message)) :
@@ -269,66 +266,66 @@ divergent def betree.Node.lookup_first_message_for_key_back
         Result.ret (betree.List.Cons (i, m) next_msgs0)
   | betree.List.Nil => Result.ret ret0
 
-/- [betree_main::betree::Node::{5}::apply_upserts] -/
-divergent def betree.Node.apply_upserts_fwd
+/- [betree_main::betree::Node::{5}::apply_upserts]: forward function -/
+divergent def betree.Node.apply_upserts
   (msgs : betree.List (U64 × betree.Message)) (prev : Option U64) (key : U64)
   (st : State) :
   Result (State × U64)
   :=
   do
-    let b ← betree.List.head_has_key_fwd betree.Message msgs key
+    let b ← betree.List.head_has_key betree.Message msgs key
     if b
     then
       do
-        let msg ← betree.List.pop_front_fwd (U64 × betree.Message) msgs
+        let msg ← betree.List.pop_front (U64 × betree.Message) msgs
         let (_, m) := msg
         match m with
         | betree.Message.Insert i => Result.fail Error.panic
         | betree.Message.Delete => Result.fail Error.panic
         | betree.Message.Upsert s =>
           do
-            let v ← betree.upsert_update_fwd prev s
+            let v ← betree.upsert_update prev s
             let msgs0 ←
               betree.List.pop_front_back (U64 × betree.Message) msgs
-            betree.Node.apply_upserts_fwd msgs0 (Option.some v) key st
+            betree.Node.apply_upserts msgs0 (Option.some v) key st
     else
       do
-        let (st0, v) ← core.option.Option.unwrap_fwd U64 prev st
+        let (st0, v) ← core.option.Option.unwrap U64 prev st
         let _ ←
-          betree.List.push_front_fwd_back (U64 × betree.Message) msgs (key,
+          betree.List.push_front (U64 × betree.Message) msgs (key,
             betree.Message.Insert v)
         Result.ret (st0, v)
 
-/- [betree_main::betree::Node::{5}::apply_upserts] -/
+/- [betree_main::betree::Node::{5}::apply_upserts]: backward function 0 -/
 divergent def betree.Node.apply_upserts_back
   (msgs : betree.List (U64 × betree.Message)) (prev : Option U64) (key : U64)
   (st : State) :
   Result (betree.List (U64 × betree.Message))
   :=
   do
-    let b ← betree.List.head_has_key_fwd betree.Message msgs key
+    let b ← betree.List.head_has_key betree.Message msgs key
     if b
     then
       do
-        let msg ← betree.List.pop_front_fwd (U64 × betree.Message) msgs
+        let msg ← betree.List.pop_front (U64 × betree.Message) msgs
         let (_, m) := msg
         match m with
         | betree.Message.Insert i => Result.fail Error.panic
         | betree.Message.Delete => Result.fail Error.panic
         | betree.Message.Upsert s =>
           do
-            let v ← betree.upsert_update_fwd prev s
+            let v ← betree.upsert_update prev s
             let msgs0 ←
               betree.List.pop_front_back (U64 × betree.Message) msgs
             betree.Node.apply_upserts_back msgs0 (Option.some v) key st
     else
       do
-        let (_, v) ← core.option.Option.unwrap_fwd U64 prev st
-        betree.List.push_front_fwd_back (U64 × betree.Message) msgs (key,
+        let (_, v) ← core.option.Option.unwrap U64 prev st
+        betree.List.push_front (U64 × betree.Message) msgs (key,
           betree.Message.Insert v)
 
-/- [betree_main::betree::Node::{5}::lookup] -/
-mutual divergent def betree.Node.lookup_fwd
+/- [betree_main::betree::Node::{5}::lookup]: forward function -/
+mutual divergent def betree.Node.lookup
   (self : betree.Node) (key : U64) (st : State) :
   Result (State × (Option U64))
   :=
@@ -336,8 +333,8 @@ mutual divergent def betree.Node.lookup_fwd
   | betree.Node.Internal node =>
     do
       let ⟨ i, i0, n, n0 ⟩ := node
-      let (st0, msgs) ← betree.load_internal_node_fwd i st
-      let pending ← betree.Node.lookup_first_message_for_key_fwd key msgs
+      let (st0, msgs) ← betree.load_internal_node i st
+      let pending ← betree.Node.lookup_first_message_for_key key msgs
       match pending with
       | betree.List.Cons p l =>
         let (k, msg) := p
@@ -345,8 +342,8 @@ mutual divergent def betree.Node.lookup_fwd
         then
           do
             let (st1, opt) ←
-              betree.Internal.lookup_in_children_fwd (betree.Internal.mk i i0 n
-                n0) key st0
+              betree.Internal.lookup_in_children (betree.Internal.mk i i0 n n0)
+                key st0
             let _ ←
               betree.Node.lookup_first_message_for_key_back key msgs
                 (betree.List.Cons (k, msg) l)
@@ -368,10 +365,10 @@ mutual divergent def betree.Node.lookup_fwd
           | betree.Message.Upsert ufs =>
             do
               let (st1, v) ←
-                betree.Internal.lookup_in_children_fwd (betree.Internal.mk i i0
-                  n n0) key st0
+                betree.Internal.lookup_in_children (betree.Internal.mk i i0 n
+                  n0) key st0
               let (st2, v0) ←
-                betree.Node.apply_upserts_fwd (betree.List.Cons (k,
+                betree.Node.apply_upserts (betree.List.Cons (k,
                   betree.Message.Upsert ufs) l) v key st1
               let node0 ←
                 betree.Internal.lookup_in_children_back (betree.Internal.mk i
@@ -382,32 +379,32 @@ mutual divergent def betree.Node.lookup_fwd
                   betree.Message.Upsert ufs) l) v key st1
               let msgs0 ←
                 betree.Node.lookup_first_message_for_key_back key msgs pending0
-              let (st3, _) ← betree.store_internal_node_fwd i1 msgs0 st2
+              let (st3, _) ← betree.store_internal_node i1 msgs0 st2
               Result.ret (st3, Option.some v0)
       | betree.List.Nil =>
         do
           let (st1, opt) ←
-            betree.Internal.lookup_in_children_fwd (betree.Internal.mk i i0 n
-              n0) key st0
+            betree.Internal.lookup_in_children (betree.Internal.mk i i0 n n0)
+              key st0
           let _ ←
             betree.Node.lookup_first_message_for_key_back key msgs
               betree.List.Nil
           Result.ret (st1, opt)
   | betree.Node.Leaf node =>
     do
-      let (st0, bindings) ← betree.load_leaf_node_fwd node.betree_leaf_id st
-      let opt ← betree.Node.lookup_in_bindings_fwd key bindings
+      let (st0, bindings) ← betree.load_leaf_node node.betree_leaf_id st
+      let opt ← betree.Node.lookup_in_bindings key bindings
       Result.ret (st0, opt)
 
-/- [betree_main::betree::Node::{5}::lookup] -/
+/- [betree_main::betree::Node::{5}::lookup]: backward function 0 -/
 divergent def betree.Node.lookup_back
   (self : betree.Node) (key : U64) (st : State) : Result betree.Node :=
   match self with
   | betree.Node.Internal node =>
     do
       let ⟨ i, i0, n, n0 ⟩ := node
-      let (st0, msgs) ← betree.load_internal_node_fwd i st
-      let pending ← betree.Node.lookup_first_message_for_key_fwd key msgs
+      let (st0, msgs) ← betree.load_internal_node i st
+      let pending ← betree.Node.lookup_first_message_for_key key msgs
       match pending with
       | betree.List.Cons p l =>
         let (k, msg) := p
@@ -438,10 +435,10 @@ divergent def betree.Node.lookup_back
           | betree.Message.Upsert ufs =>
             do
               let (st1, v) ←
-                betree.Internal.lookup_in_children_fwd (betree.Internal.mk i i0
-                  n n0) key st0
+                betree.Internal.lookup_in_children (betree.Internal.mk i i0 n
+                  n0) key st0
               let (st2, _) ←
-                betree.Node.apply_upserts_fwd (betree.List.Cons (k,
+                betree.Node.apply_upserts (betree.List.Cons (k,
                   betree.Message.Upsert ufs) l) v key st1
               let node0 ←
                 betree.Internal.lookup_in_children_back (betree.Internal.mk i
@@ -452,7 +449,7 @@ divergent def betree.Node.lookup_back
                   betree.Message.Upsert ufs) l) v key st1
               let msgs0 ←
                 betree.Node.lookup_first_message_for_key_back key msgs pending0
-              let _ ← betree.store_internal_node_fwd i1 msgs0 st2
+              let _ ← betree.store_internal_node i1 msgs0 st2
               Result.ret (betree.Node.Internal (betree.Internal.mk i1 i2 n1
                 n2))
       | betree.List.Nil =>
@@ -466,21 +463,21 @@ divergent def betree.Node.lookup_back
           Result.ret (betree.Node.Internal node0)
   | betree.Node.Leaf node =>
     do
-      let (_, bindings) ← betree.load_leaf_node_fwd node.betree_leaf_id st
-      let _ ← betree.Node.lookup_in_bindings_fwd key bindings
+      let (_, bindings) ← betree.load_leaf_node node.betree_leaf_id st
+      let _ ← betree.Node.lookup_in_bindings key bindings
       Result.ret (betree.Node.Leaf node)
 
-/- [betree_main::betree::Internal::{4}::lookup_in_children] -/
-divergent def betree.Internal.lookup_in_children_fwd
+/- [betree_main::betree::Internal::{4}::lookup_in_children]: forward function -/
+divergent def betree.Internal.lookup_in_children
   (self : betree.Internal) (key : U64) (st : State) :
   Result (State × (Option U64))
   :=
   let ⟨ _, i, n, n0 ⟩ := self
   if key < i
-  then betree.Node.lookup_fwd n key st
-  else betree.Node.lookup_fwd n0 key st
+  then betree.Node.lookup n key st
+  else betree.Node.lookup n0 key st
 
-/- [betree_main::betree::Internal::{4}::lookup_in_children] -/
+/- [betree_main::betree::Internal::{4}::lookup_in_children]: backward function 0 -/
 divergent def betree.Internal.lookup_in_children_back
   (self : betree.Internal) (key : U64) (st : State) : Result betree.Internal :=
   let ⟨ i, i0, n, n0 ⟩ := self
@@ -496,8 +493,8 @@ divergent def betree.Internal.lookup_in_children_back
 
 end
 
-/- [betree_main::betree::Node::{5}::lookup_mut_in_bindings] -/
-divergent def betree.Node.lookup_mut_in_bindings_fwd
+/- [betree_main::betree::Node::{5}::lookup_mut_in_bindings]: forward function -/
+divergent def betree.Node.lookup_mut_in_bindings
   (key : U64) (bindings : betree.List (U64 × U64)) :
   Result (betree.List (U64 × U64))
   :=
@@ -506,10 +503,10 @@ divergent def betree.Node.lookup_mut_in_bindings_fwd
     let (i, i0) := hd
     if i >= key
     then Result.ret (betree.List.Cons (i, i0) tl)
-    else betree.Node.lookup_mut_in_bindings_fwd key tl
+    else betree.Node.lookup_mut_in_bindings key tl
   | betree.List.Nil => Result.ret betree.List.Nil
 
-/- [betree_main::betree::Node::{5}::lookup_mut_in_bindings] -/
+/- [betree_main::betree::Node::{5}::lookup_mut_in_bindings]: backward function 0 -/
 divergent def betree.Node.lookup_mut_in_bindings_back
   (key : U64) (bindings : betree.List (U64 × U64))
   (ret0 : betree.List (U64 × U64)) :
@@ -526,25 +523,26 @@ divergent def betree.Node.lookup_mut_in_bindings_back
         Result.ret (betree.List.Cons (i, i0) tl0)
   | betree.List.Nil => Result.ret ret0
 
-/- [betree_main::betree::Node::{5}::apply_to_leaf] -/
-def betree.Node.apply_to_leaf_fwd_back
+/- [betree_main::betree::Node::{5}::apply_to_leaf]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def betree.Node.apply_to_leaf
   (bindings : betree.List (U64 × U64)) (key : U64) (new_msg : betree.Message)
   :
   Result (betree.List (U64 × U64))
   :=
   do
-    let bindings0 ← betree.Node.lookup_mut_in_bindings_fwd key bindings
-    let b ← betree.List.head_has_key_fwd U64 bindings0 key
+    let bindings0 ← betree.Node.lookup_mut_in_bindings key bindings
+    let b ← betree.List.head_has_key U64 bindings0 key
     if b
     then
       do
-        let hd ← betree.List.pop_front_fwd (U64 × U64) bindings0
+        let hd ← betree.List.pop_front (U64 × U64) bindings0
         match new_msg with
         | betree.Message.Insert v =>
           do
             let bindings1 ← betree.List.pop_front_back (U64 × U64) bindings0
             let bindings2 ←
-              betree.List.push_front_fwd_back (U64 × U64) bindings1 (key, v)
+              betree.List.push_front (U64 × U64) bindings1 (key, v)
             betree.Node.lookup_mut_in_bindings_back key bindings bindings2
         | betree.Message.Delete =>
           do
@@ -553,29 +551,30 @@ def betree.Node.apply_to_leaf_fwd_back
         | betree.Message.Upsert s =>
           do
             let (_, i) := hd
-            let v ← betree.upsert_update_fwd (Option.some i) s
+            let v ← betree.upsert_update (Option.some i) s
             let bindings1 ← betree.List.pop_front_back (U64 × U64) bindings0
             let bindings2 ←
-              betree.List.push_front_fwd_back (U64 × U64) bindings1 (key, v)
+              betree.List.push_front (U64 × U64) bindings1 (key, v)
             betree.Node.lookup_mut_in_bindings_back key bindings bindings2
     else
       match new_msg with
       | betree.Message.Insert v =>
         do
           let bindings1 ←
-            betree.List.push_front_fwd_back (U64 × U64) bindings0 (key, v)
+            betree.List.push_front (U64 × U64) bindings0 (key, v)
           betree.Node.lookup_mut_in_bindings_back key bindings bindings1
       | betree.Message.Delete =>
         betree.Node.lookup_mut_in_bindings_back key bindings bindings0
       | betree.Message.Upsert s =>
         do
-          let v ← betree.upsert_update_fwd Option.none s
+          let v ← betree.upsert_update Option.none s
           let bindings1 ←
-            betree.List.push_front_fwd_back (U64 × U64) bindings0 (key, v)
+            betree.List.push_front (U64 × U64) bindings0 (key, v)
           betree.Node.lookup_mut_in_bindings_back key bindings bindings1
 
-/- [betree_main::betree::Node::{5}::apply_messages_to_leaf] -/
-divergent def betree.Node.apply_messages_to_leaf_fwd_back
+/- [betree_main::betree::Node::{5}::apply_messages_to_leaf]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+divergent def betree.Node.apply_messages_to_leaf
   (bindings : betree.List (U64 × U64))
   (new_msgs : betree.List (U64 × betree.Message)) :
   Result (betree.List (U64 × U64))
@@ -584,12 +583,13 @@ divergent def betree.Node.apply_messages_to_leaf_fwd_back
   | betree.List.Cons new_msg new_msgs_tl =>
     do
       let (i, m) := new_msg
-      let bindings0 ← betree.Node.apply_to_leaf_fwd_back bindings i m
-      betree.Node.apply_messages_to_leaf_fwd_back bindings0 new_msgs_tl
+      let bindings0 ← betree.Node.apply_to_leaf bindings i m
+      betree.Node.apply_messages_to_leaf bindings0 new_msgs_tl
   | betree.List.Nil => Result.ret bindings
 
-/- [betree_main::betree::Node::{5}::filter_messages_for_key] -/
-divergent def betree.Node.filter_messages_for_key_fwd_back
+/- [betree_main::betree::Node::{5}::filter_messages_for_key]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+divergent def betree.Node.filter_messages_for_key
   (key : U64) (msgs : betree.List (U64 × betree.Message)) :
   Result (betree.List (U64 × betree.Message))
   :=
@@ -602,12 +602,12 @@ divergent def betree.Node.filter_messages_for_key_fwd_back
         let msgs0 ←
           betree.List.pop_front_back (U64 × betree.Message) (betree.List.Cons
             (k, m) l)
-        betree.Node.filter_messages_for_key_fwd_back key msgs0
+        betree.Node.filter_messages_for_key key msgs0
     else Result.ret (betree.List.Cons (k, m) l)
   | betree.List.Nil => Result.ret betree.List.Nil
 
-/- [betree_main::betree::Node::{5}::lookup_first_message_after_key] -/
-divergent def betree.Node.lookup_first_message_after_key_fwd
+/- [betree_main::betree::Node::{5}::lookup_first_message_after_key]: forward function -/
+divergent def betree.Node.lookup_first_message_after_key
   (key : U64) (msgs : betree.List (U64 × betree.Message)) :
   Result (betree.List (U64 × betree.Message))
   :=
@@ -615,11 +615,11 @@ divergent def betree.Node.lookup_first_message_after_key_fwd
   | betree.List.Cons p next_msgs =>
     let (k, m) := p
     if k = key
-    then betree.Node.lookup_first_message_after_key_fwd key next_msgs
+    then betree.Node.lookup_first_message_after_key key next_msgs
     else Result.ret (betree.List.Cons (k, m) next_msgs)
   | betree.List.Nil => Result.ret betree.List.Nil
 
-/- [betree_main::betree::Node::{5}::lookup_first_message_after_key] -/
+/- [betree_main::betree::Node::{5}::lookup_first_message_after_key]: backward function 0 -/
 divergent def betree.Node.lookup_first_message_after_key_back
   (key : U64) (msgs : betree.List (U64 × betree.Message))
   (ret0 : betree.List (U64 × betree.Message)) :
@@ -637,74 +637,75 @@ divergent def betree.Node.lookup_first_message_after_key_back
     else Result.ret ret0
   | betree.List.Nil => Result.ret ret0
 
-/- [betree_main::betree::Node::{5}::apply_to_internal] -/
-def betree.Node.apply_to_internal_fwd_back
+/- [betree_main::betree::Node::{5}::apply_to_internal]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def betree.Node.apply_to_internal
   (msgs : betree.List (U64 × betree.Message)) (key : U64)
   (new_msg : betree.Message) :
   Result (betree.List (U64 × betree.Message))
   :=
   do
-    let msgs0 ← betree.Node.lookup_first_message_for_key_fwd key msgs
-    let b ← betree.List.head_has_key_fwd betree.Message msgs0 key
+    let msgs0 ← betree.Node.lookup_first_message_for_key key msgs
+    let b ← betree.List.head_has_key betree.Message msgs0 key
     if b
     then
       match new_msg with
       | betree.Message.Insert i =>
         do
-          let msgs1 ← betree.Node.filter_messages_for_key_fwd_back key msgs0
+          let msgs1 ← betree.Node.filter_messages_for_key key msgs0
           let msgs2 ←
-            betree.List.push_front_fwd_back (U64 × betree.Message) msgs1 (key,
+            betree.List.push_front (U64 × betree.Message) msgs1 (key,
               betree.Message.Insert i)
           betree.Node.lookup_first_message_for_key_back key msgs msgs2
       | betree.Message.Delete =>
         do
-          let msgs1 ← betree.Node.filter_messages_for_key_fwd_back key msgs0
+          let msgs1 ← betree.Node.filter_messages_for_key key msgs0
           let msgs2 ←
-            betree.List.push_front_fwd_back (U64 × betree.Message) msgs1 (key,
+            betree.List.push_front (U64 × betree.Message) msgs1 (key,
               betree.Message.Delete)
           betree.Node.lookup_first_message_for_key_back key msgs msgs2
       | betree.Message.Upsert s =>
         do
-          let p ← betree.List.hd_fwd (U64 × betree.Message) msgs0
+          let p ← betree.List.hd (U64 × betree.Message) msgs0
           let (_, m) := p
           match m with
           | betree.Message.Insert prev =>
             do
-              let v ← betree.upsert_update_fwd (Option.some prev) s
+              let v ← betree.upsert_update (Option.some prev) s
               let msgs1 ←
                 betree.List.pop_front_back (U64 × betree.Message) msgs0
               let msgs2 ←
-                betree.List.push_front_fwd_back (U64 × betree.Message) msgs1
-                  (key, betree.Message.Insert v)
+                betree.List.push_front (U64 × betree.Message) msgs1 (key,
+                  betree.Message.Insert v)
               betree.Node.lookup_first_message_for_key_back key msgs msgs2
           | betree.Message.Delete =>
             do
-              let v ← betree.upsert_update_fwd Option.none s
+              let v ← betree.upsert_update Option.none s
               let msgs1 ←
                 betree.List.pop_front_back (U64 × betree.Message) msgs0
               let msgs2 ←
-                betree.List.push_front_fwd_back (U64 × betree.Message) msgs1
-                  (key, betree.Message.Insert v)
+                betree.List.push_front (U64 × betree.Message) msgs1 (key,
+                  betree.Message.Insert v)
               betree.Node.lookup_first_message_for_key_back key msgs msgs2
           | betree.Message.Upsert ufs =>
             do
               let msgs1 ←
-                betree.Node.lookup_first_message_after_key_fwd key msgs0
+                betree.Node.lookup_first_message_after_key key msgs0
               let msgs2 ←
-                betree.List.push_front_fwd_back (U64 × betree.Message) msgs1
-                  (key, betree.Message.Upsert s)
+                betree.List.push_front (U64 × betree.Message) msgs1 (key,
+                  betree.Message.Upsert s)
               let msgs3 ←
                 betree.Node.lookup_first_message_after_key_back key msgs0 msgs2
               betree.Node.lookup_first_message_for_key_back key msgs msgs3
     else
       do
         let msgs1 ←
-          betree.List.push_front_fwd_back (U64 × betree.Message) msgs0 (key,
-            new_msg)
+          betree.List.push_front (U64 × betree.Message) msgs0 (key, new_msg)
         betree.Node.lookup_first_message_for_key_back key msgs msgs1
 
-/- [betree_main::betree::Node::{5}::apply_messages_to_internal] -/
-divergent def betree.Node.apply_messages_to_internal_fwd_back
+/- [betree_main::betree::Node::{5}::apply_messages_to_internal]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+divergent def betree.Node.apply_messages_to_internal
   (msgs : betree.List (U64 × betree.Message))
   (new_msgs : betree.List (U64 × betree.Message)) :
   Result (betree.List (U64 × betree.Message))
@@ -713,12 +714,12 @@ divergent def betree.Node.apply_messages_to_internal_fwd_back
   | betree.List.Cons new_msg new_msgs_tl =>
     do
       let (i, m) := new_msg
-      let msgs0 ← betree.Node.apply_to_internal_fwd_back msgs i m
-      betree.Node.apply_messages_to_internal_fwd_back msgs0 new_msgs_tl
+      let msgs0 ← betree.Node.apply_to_internal msgs i m
+      betree.Node.apply_messages_to_internal msgs0 new_msgs_tl
   | betree.List.Nil => Result.ret msgs
 
-/- [betree_main::betree::Node::{5}::apply_messages] -/
-mutual divergent def betree.Node.apply_messages_fwd
+/- [betree_main::betree::Node::{5}::apply_messages]: forward function -/
+mutual divergent def betree.Node.apply_messages
   (self : betree.Node) (params : betree.Params)
   (node_id_cnt : betree.NodeIdCounter)
   (msgs : betree.List (U64 × betree.Message)) (st : State) :
@@ -728,47 +729,46 @@ mutual divergent def betree.Node.apply_messages_fwd
   | betree.Node.Internal node =>
     do
       let ⟨ i, i0, n, n0 ⟩ := node
-      let (st0, content) ← betree.load_internal_node_fwd i st
-      let content0 ←
-        betree.Node.apply_messages_to_internal_fwd_back content msgs
-      let num_msgs ← betree.List.len_fwd (U64 × betree.Message) content0
+      let (st0, content) ← betree.load_internal_node i st
+      let content0 ← betree.Node.apply_messages_to_internal content msgs
+      let num_msgs ← betree.List.len (U64 × betree.Message) content0
       if num_msgs >= params.betree_params_min_flush_size
       then
         do
           let (st1, content1) ←
-            betree.Internal.flush_fwd (betree.Internal.mk i i0 n n0) params
+            betree.Internal.flush (betree.Internal.mk i i0 n n0) params
               node_id_cnt content0 st0
           let (node0, _) ←
             betree.Internal.flush_back (betree.Internal.mk i i0 n n0) params
               node_id_cnt content0 st0
           let ⟨ i1, _, _, _ ⟩ := node0
-          let (st2, _) ← betree.store_internal_node_fwd i1 content1 st1
+          let (st2, _) ← betree.store_internal_node i1 content1 st1
           Result.ret (st2, ())
       else
         do
-          let (st1, _) ← betree.store_internal_node_fwd i content0 st0
+          let (st1, _) ← betree.store_internal_node i content0 st0
           Result.ret (st1, ())
   | betree.Node.Leaf node =>
     do
-      let (st0, content) ← betree.load_leaf_node_fwd node.betree_leaf_id st
-      let content0 ← betree.Node.apply_messages_to_leaf_fwd_back content msgs
-      let len ← betree.List.len_fwd (U64 × U64) content0
+      let (st0, content) ← betree.load_leaf_node node.betree_leaf_id st
+      let content0 ← betree.Node.apply_messages_to_leaf content msgs
+      let len ← betree.List.len (U64 × U64) content0
       let i ← (U64.ofInt 2 (by intlit)) * params.betree_params_split_size
       if len >= i
       then
         do
           let (st1, _) ←
-            betree.Leaf.split_fwd node content0 params node_id_cnt st0
+            betree.Leaf.split node content0 params node_id_cnt st0
           let (st2, _) ←
-            betree.store_leaf_node_fwd node.betree_leaf_id betree.List.Nil st1
+            betree.store_leaf_node node.betree_leaf_id betree.List.Nil st1
           Result.ret (st2, ())
       else
         do
           let (st1, _) ←
-            betree.store_leaf_node_fwd node.betree_leaf_id content0 st0
+            betree.store_leaf_node node.betree_leaf_id content0 st0
           Result.ret (st1, ())
 
-/- [betree_main::betree::Node::{5}::apply_messages] -/
+/- [betree_main::betree::Node::{5}::apply_messages]: backward function 0 -/
 divergent def betree.Node.apply_messages_back
   (self : betree.Node) (params : betree.Params)
   (node_id_cnt : betree.NodeIdCounter)
@@ -779,52 +779,51 @@ divergent def betree.Node.apply_messages_back
   | betree.Node.Internal node =>
     do
       let ⟨ i, i0, n, n0 ⟩ := node
-      let (st0, content) ← betree.load_internal_node_fwd i st
-      let content0 ←
-        betree.Node.apply_messages_to_internal_fwd_back content msgs
-      let num_msgs ← betree.List.len_fwd (U64 × betree.Message) content0
+      let (st0, content) ← betree.load_internal_node i st
+      let content0 ← betree.Node.apply_messages_to_internal content msgs
+      let num_msgs ← betree.List.len (U64 × betree.Message) content0
       if num_msgs >= params.betree_params_min_flush_size
       then
         do
           let (st1, content1) ←
-            betree.Internal.flush_fwd (betree.Internal.mk i i0 n n0) params
+            betree.Internal.flush (betree.Internal.mk i i0 n n0) params
               node_id_cnt content0 st0
           let (node0, node_id_cnt0) ←
             betree.Internal.flush_back (betree.Internal.mk i i0 n n0) params
               node_id_cnt content0 st0
           let ⟨ i1, i2, n1, n2 ⟩ := node0
-          let _ ← betree.store_internal_node_fwd i1 content1 st1
+          let _ ← betree.store_internal_node i1 content1 st1
           Result.ret (betree.Node.Internal (betree.Internal.mk i1 i2 n1 n2),
             node_id_cnt0)
       else
         do
-          let _ ← betree.store_internal_node_fwd i content0 st0
+          let _ ← betree.store_internal_node i content0 st0
           Result.ret (betree.Node.Internal (betree.Internal.mk i i0 n n0),
             node_id_cnt)
   | betree.Node.Leaf node =>
     do
-      let (st0, content) ← betree.load_leaf_node_fwd node.betree_leaf_id st
-      let content0 ← betree.Node.apply_messages_to_leaf_fwd_back content msgs
-      let len ← betree.List.len_fwd (U64 × U64) content0
+      let (st0, content) ← betree.load_leaf_node node.betree_leaf_id st
+      let content0 ← betree.Node.apply_messages_to_leaf content msgs
+      let len ← betree.List.len (U64 × U64) content0
       let i ← (U64.ofInt 2 (by intlit)) * params.betree_params_split_size
       if len >= i
       then
         do
           let (st1, new_node) ←
-            betree.Leaf.split_fwd node content0 params node_id_cnt st0
+            betree.Leaf.split node content0 params node_id_cnt st0
           let _ ←
-            betree.store_leaf_node_fwd node.betree_leaf_id betree.List.Nil st1
+            betree.store_leaf_node node.betree_leaf_id betree.List.Nil st1
           let node_id_cnt0 ←
             betree.Leaf.split_back node content0 params node_id_cnt st0
           Result.ret (betree.Node.Internal new_node, node_id_cnt0)
       else
         do
-          let _ ← betree.store_leaf_node_fwd node.betree_leaf_id content0 st0
+          let _ ← betree.store_leaf_node node.betree_leaf_id content0 st0
           Result.ret (betree.Node.Leaf { node with betree_leaf_size := len },
             node_id_cnt)
 
-/- [betree_main::betree::Internal::{4}::flush] -/
-divergent def betree.Internal.flush_fwd
+/- [betree_main::betree::Internal::{4}::flush]: forward function -/
+divergent def betree.Internal.flush
   (self : betree.Internal) (params : betree.Params)
   (node_id_cnt : betree.NodeIdCounter)
   (content : betree.List (U64 × betree.Message)) (st : State) :
@@ -832,24 +831,22 @@ divergent def betree.Internal.flush_fwd
   :=
   do
     let ⟨ _, i, n, n0 ⟩ := self
-    let p ← betree.List.partition_at_pivot_fwd betree.Message content i
+    let p ← betree.List.partition_at_pivot betree.Message content i
     let (msgs_left, msgs_right) := p
-    let len_left ← betree.List.len_fwd (U64 × betree.Message) msgs_left
+    let len_left ← betree.List.len (U64 × betree.Message) msgs_left
     if len_left >= params.betree_params_min_flush_size
     then
       do
         let (st0, _) ←
-          betree.Node.apply_messages_fwd n params node_id_cnt msgs_left st
+          betree.Node.apply_messages n params node_id_cnt msgs_left st
         let (_, node_id_cnt0) ←
           betree.Node.apply_messages_back n params node_id_cnt msgs_left st
-        let len_right ←
-          betree.List.len_fwd (U64 × betree.Message) msgs_right
+        let len_right ← betree.List.len (U64 × betree.Message) msgs_right
         if len_right >= params.betree_params_min_flush_size
         then
           do
             let (st1, _) ←
-              betree.Node.apply_messages_fwd n0 params node_id_cnt0 msgs_right
-                st0
+              betree.Node.apply_messages n0 params node_id_cnt0 msgs_right st0
             let _ ←
               betree.Node.apply_messages_back n0 params node_id_cnt0 msgs_right
                 st0
@@ -858,12 +855,12 @@ divergent def betree.Internal.flush_fwd
     else
       do
         let (st0, _) ←
-          betree.Node.apply_messages_fwd n0 params node_id_cnt msgs_right st
+          betree.Node.apply_messages n0 params node_id_cnt msgs_right st
         let _ ←
           betree.Node.apply_messages_back n0 params node_id_cnt msgs_right st
         Result.ret (st0, msgs_left)
 
-/- [betree_main::betree::Internal::{4}::flush] -/
+/- [betree_main::betree::Internal::{4}::flush]: backward function 0 -/
 divergent def betree.Internal.flush_back
   (self : betree.Internal) (params : betree.Params)
   (node_id_cnt : betree.NodeIdCounter)
@@ -872,18 +869,17 @@ divergent def betree.Internal.flush_back
   :=
   do
     let ⟨ i, i0, n, n0 ⟩ := self
-    let p ← betree.List.partition_at_pivot_fwd betree.Message content i0
+    let p ← betree.List.partition_at_pivot betree.Message content i0
     let (msgs_left, msgs_right) := p
-    let len_left ← betree.List.len_fwd (U64 × betree.Message) msgs_left
+    let len_left ← betree.List.len (U64 × betree.Message) msgs_left
     if len_left >= params.betree_params_min_flush_size
     then
       do
         let (st0, _) ←
-          betree.Node.apply_messages_fwd n params node_id_cnt msgs_left st
+          betree.Node.apply_messages n params node_id_cnt msgs_left st
         let (n1, node_id_cnt0) ←
           betree.Node.apply_messages_back n params node_id_cnt msgs_left st
-        let len_right ←
-          betree.List.len_fwd (U64 × betree.Message) msgs_right
+        let len_right ← betree.List.len (U64 × betree.Message) msgs_right
         if len_right >= params.betree_params_min_flush_size
         then
           do
@@ -900,8 +896,8 @@ divergent def betree.Internal.flush_back
 
 end
 
-/- [betree_main::betree::Node::{5}::apply] -/
-def betree.Node.apply_fwd
+/- [betree_main::betree::Node::{5}::apply]: forward function -/
+def betree.Node.apply
   (self : betree.Node) (params : betree.Params)
   (node_id_cnt : betree.NodeIdCounter) (key : U64) (new_msg : betree.Message)
   (st : State) :
@@ -910,14 +906,14 @@ def betree.Node.apply_fwd
   do
     let l := betree.List.Nil
     let (st0, _) ←
-      betree.Node.apply_messages_fwd self params node_id_cnt (betree.List.Cons
+      betree.Node.apply_messages self params node_id_cnt (betree.List.Cons
         (key, new_msg) l) st
     let _ ←
       betree.Node.apply_messages_back self params node_id_cnt (betree.List.Cons
         (key, new_msg) l) st
     Result.ret (st0, ())
 
-/- [betree_main::betree::Node::{5}::apply] -/
+/- [betree_main::betree::Node::{5}::apply]: backward function 0 -/
 def betree.Node.apply_back
   (self : betree.Node) (params : betree.Params)
   (node_id_cnt : betree.NodeIdCounter) (key : U64) (new_msg : betree.Message)
@@ -928,15 +924,15 @@ def betree.Node.apply_back
   betree.Node.apply_messages_back self params node_id_cnt (betree.List.Cons
     (key, new_msg) l) st
 
-/- [betree_main::betree::BeTree::{6}::new] -/
-def betree.BeTree.new_fwd
+/- [betree_main::betree::BeTree::{6}::new]: forward function -/
+def betree.BeTree.new
   (min_flush_size : U64) (split_size : U64) (st : State) :
   Result (State × betree.BeTree)
   :=
   do
-    let node_id_cnt ← betree.NodeIdCounter.new_fwd
-    let id ← betree.NodeIdCounter.fresh_id_fwd node_id_cnt
-    let (st0, _) ← betree.store_leaf_node_fwd id betree.List.Nil st
+    let node_id_cnt ← betree.NodeIdCounter.new
+    let id ← betree.NodeIdCounter.fresh_id node_id_cnt
+    let (st0, _) ← betree.store_leaf_node id betree.List.Nil st
     let node_id_cnt0 ← betree.NodeIdCounter.fresh_id_back node_id_cnt
     Result.ret (st0,
       {
@@ -954,21 +950,21 @@ def betree.BeTree.new_fwd
             })
       })
 
-/- [betree_main::betree::BeTree::{6}::apply] -/
-def betree.BeTree.apply_fwd
+/- [betree_main::betree::BeTree::{6}::apply]: forward function -/
+def betree.BeTree.apply
   (self : betree.BeTree) (key : U64) (msg : betree.Message) (st : State) :
   Result (State × Unit)
   :=
   do
     let (st0, _) ←
-      betree.Node.apply_fwd self.betree_be_tree_root self.betree_be_tree_params
+      betree.Node.apply self.betree_be_tree_root self.betree_be_tree_params
         self.betree_be_tree_node_id_cnt key msg st
     let _ ←
       betree.Node.apply_back self.betree_be_tree_root
         self.betree_be_tree_params self.betree_be_tree_node_id_cnt key msg st
     Result.ret (st0, ())
 
-/- [betree_main::betree::BeTree::{6}::apply] -/
+/- [betree_main::betree::BeTree::{6}::apply]: backward function 0 -/
 def betree.BeTree.apply_back
   (self : betree.BeTree) (key : U64) (msg : betree.Message) (st : State) :
   Result betree.BeTree
@@ -980,51 +976,51 @@ def betree.BeTree.apply_back
     Result.ret
       { self with betree_be_tree_node_id_cnt := nic, betree_be_tree_root := n }
 
-/- [betree_main::betree::BeTree::{6}::insert] -/
-def betree.BeTree.insert_fwd
+/- [betree_main::betree::BeTree::{6}::insert]: forward function -/
+def betree.BeTree.insert
   (self : betree.BeTree) (key : U64) (value : U64) (st : State) :
   Result (State × Unit)
   :=
   do
     let (st0, _) ←
-      betree.BeTree.apply_fwd self key (betree.Message.Insert value) st
+      betree.BeTree.apply self key (betree.Message.Insert value) st
     let _ ←
       betree.BeTree.apply_back self key (betree.Message.Insert value) st
     Result.ret (st0, ())
 
-/- [betree_main::betree::BeTree::{6}::insert] -/
+/- [betree_main::betree::BeTree::{6}::insert]: backward function 0 -/
 def betree.BeTree.insert_back
   (self : betree.BeTree) (key : U64) (value : U64) (st : State) :
   Result betree.BeTree
   :=
   betree.BeTree.apply_back self key (betree.Message.Insert value) st
 
-/- [betree_main::betree::BeTree::{6}::delete] -/
-def betree.BeTree.delete_fwd
+/- [betree_main::betree::BeTree::{6}::delete]: forward function -/
+def betree.BeTree.delete
   (self : betree.BeTree) (key : U64) (st : State) : Result (State × Unit) :=
   do
-    let (st0, _) ← betree.BeTree.apply_fwd self key betree.Message.Delete st
+    let (st0, _) ← betree.BeTree.apply self key betree.Message.Delete st
     let _ ← betree.BeTree.apply_back self key betree.Message.Delete st
     Result.ret (st0, ())
 
-/- [betree_main::betree::BeTree::{6}::delete] -/
+/- [betree_main::betree::BeTree::{6}::delete]: backward function 0 -/
 def betree.BeTree.delete_back
   (self : betree.BeTree) (key : U64) (st : State) : Result betree.BeTree :=
   betree.BeTree.apply_back self key betree.Message.Delete st
 
-/- [betree_main::betree::BeTree::{6}::upsert] -/
-def betree.BeTree.upsert_fwd
+/- [betree_main::betree::BeTree::{6}::upsert]: forward function -/
+def betree.BeTree.upsert
   (self : betree.BeTree) (key : U64) (upd : betree.UpsertFunState) (st : State)
   :
   Result (State × Unit)
   :=
   do
     let (st0, _) ←
-      betree.BeTree.apply_fwd self key (betree.Message.Upsert upd) st
+      betree.BeTree.apply self key (betree.Message.Upsert upd) st
     let _ ← betree.BeTree.apply_back self key (betree.Message.Upsert upd) st
     Result.ret (st0, ())
 
-/- [betree_main::betree::BeTree::{6}::upsert] -/
+/- [betree_main::betree::BeTree::{6}::upsert]: backward function 0 -/
 def betree.BeTree.upsert_back
   (self : betree.BeTree) (key : U64) (upd : betree.UpsertFunState) (st : State)
   :
@@ -1032,25 +1028,25 @@ def betree.BeTree.upsert_back
   :=
   betree.BeTree.apply_back self key (betree.Message.Upsert upd) st
 
-/- [betree_main::betree::BeTree::{6}::lookup] -/
-def betree.BeTree.lookup_fwd
+/- [betree_main::betree::BeTree::{6}::lookup]: forward function -/
+def betree.BeTree.lookup
   (self : betree.BeTree) (key : U64) (st : State) :
   Result (State × (Option U64))
   :=
-  betree.Node.lookup_fwd self.betree_be_tree_root key st
+  betree.Node.lookup self.betree_be_tree_root key st
 
-/- [betree_main::betree::BeTree::{6}::lookup] -/
+/- [betree_main::betree::BeTree::{6}::lookup]: backward function 0 -/
 def betree.BeTree.lookup_back
   (self : betree.BeTree) (key : U64) (st : State) : Result betree.BeTree :=
   do
     let n ← betree.Node.lookup_back self.betree_be_tree_root key st
     Result.ret { self with betree_be_tree_root := n }
 
-/- [betree_main::main] -/
-def main_fwd : Result Unit :=
+/- [betree_main::main]: forward function -/
+def main : Result Unit :=
   Result.ret ()
 
 /- Unit test for [betree_main::main] -/
-#assert (main_fwd == .ret ())
+#assert (main == .ret ())
 
 end betree_main
diff --git a/tests/lean/BetreeMain/FunsExternal.lean b/tests/lean/BetreeMain/FunsExternal.lean
index 7bcba380..71d26da4 100644
--- a/tests/lean/BetreeMain/FunsExternal.lean
+++ b/tests/lean/BetreeMain/FunsExternal.lean
@@ -7,29 +7,29 @@ open betree_main
 -- TODO: fill those bodies
 
 /- [betree_main::betree_utils::load_internal_node] -/
-def betree_utils.load_internal_node_fwd
+def betree_utils.load_internal_node
   :
   U64 → State → Result (State × (betree.List (U64 × betree.Message))) :=
   fun _ _ => .fail .panic
 
 /- [betree_main::betree_utils::store_internal_node] -/
-def betree_utils.store_internal_node_fwd
+def betree_utils.store_internal_node
   :
   U64 → betree.List (U64 × betree.Message) → State → Result (State
     × Unit) :=
   fun _ _ _ => .fail .panic
 
 /- [betree_main::betree_utils::load_leaf_node] -/
-def betree_utils.load_leaf_node_fwd
+def betree_utils.load_leaf_node
   : U64 → State → Result (State × (betree.List (U64 × U64))) :=
   fun _ _ => .fail .panic
 
 /- [betree_main::betree_utils::store_leaf_node] -/
-def betree_utils.store_leaf_node_fwd
+def betree_utils.store_leaf_node
   : U64 → betree.List (U64 × U64) → State → Result (State × Unit) :=
   fun _ _ _ => .fail .panic
 
 /- [core::option::Option::{0}::unwrap] -/
-def core.option.Option.unwrap_fwd
+def core.option.Option.unwrap
   (T : Type) : Option T → State → Result (State × T) :=
   fun _ _ => .fail .panic
diff --git a/tests/lean/BetreeMain/FunsExternal_Template.lean b/tests/lean/BetreeMain/FunsExternal_Template.lean
index d768bb20..430d2dda 100644
--- a/tests/lean/BetreeMain/FunsExternal_Template.lean
+++ b/tests/lean/BetreeMain/FunsExternal_Template.lean
@@ -6,25 +6,25 @@ import BetreeMain.Types
 open Primitives
 open betree_main
 
-/- [betree_main::betree_utils::load_internal_node] -/
-axiom betree_utils.load_internal_node_fwd
+/- [betree_main::betree_utils::load_internal_node]: forward function -/
+axiom betree_utils.load_internal_node
   : U64 → State → Result (State × (betree.List (U64 × betree.Message)))
 
-/- [betree_main::betree_utils::store_internal_node] -/
-axiom betree_utils.store_internal_node_fwd
+/- [betree_main::betree_utils::store_internal_node]: forward function -/
+axiom betree_utils.store_internal_node
   :
   U64 → betree.List (U64 × betree.Message) → State → Result (State ×
     Unit)
 
-/- [betree_main::betree_utils::load_leaf_node] -/
-axiom betree_utils.load_leaf_node_fwd
+/- [betree_main::betree_utils::load_leaf_node]: forward function -/
+axiom betree_utils.load_leaf_node
   : U64 → State → Result (State × (betree.List (U64 × U64)))
 
-/- [betree_main::betree_utils::store_leaf_node] -/
-axiom betree_utils.store_leaf_node_fwd
+/- [betree_main::betree_utils::store_leaf_node]: forward function -/
+axiom betree_utils.store_leaf_node
   : U64 → betree.List (U64 × U64) → State → Result (State × Unit)
 
-/- [core::option::Option::{0}::unwrap] -/
-axiom core.option.Option.unwrap_fwd
+/- [core::option::Option::{0}::unwrap]: forward function -/
+axiom core.option.Option.unwrap
   (T : Type) : Option T → State → Result (State × T)
 
diff --git a/tests/lean/Constants.lean b/tests/lean/Constants.lean
index 7014b0d8..f37c9204 100644
--- a/tests/lean/Constants.lean
+++ b/tests/lean/Constants.lean
@@ -21,16 +21,16 @@ def x1_c : U32 := eval_global x1_body (by simp)
 def x2_body : Result U32 := Result.ret (U32.ofInt 3 (by intlit))
 def x2_c : U32 := eval_global x2_body (by simp)
 
-/- [constants::incr] -/
-def incr_fwd (n : U32) : Result U32 :=
+/- [constants::incr]: forward function -/
+def incr (n : U32) : Result U32 :=
   n + (U32.ofInt 1 (by intlit))
 
 /- [constants::X3] -/
-def x3_body : Result U32 := incr_fwd (U32.ofInt 32 (by intlit))
+def x3_body : Result U32 := incr (U32.ofInt 32 (by intlit))
 def x3_c : U32 := eval_global x3_body (by simp)
 
-/- [constants::mk_pair0] -/
-def mk_pair0_fwd (x : U32) (y : U32) : Result (U32 × U32) :=
+/- [constants::mk_pair0]: forward function -/
+def mk_pair0 (x : U32) (y : U32) : Result (U32 × U32) :=
   Result.ret (x, y)
 
 /- [constants::Pair] -/
@@ -38,18 +38,18 @@ structure Pair (T1 T2 : Type) where
   pair_x : T1
   pair_y : T2
 
-/- [constants::mk_pair1] -/
-def mk_pair1_fwd (x : U32) (y : U32) : Result (Pair U32 U32) :=
+/- [constants::mk_pair1]: forward function -/
+def mk_pair1 (x : U32) (y : U32) : Result (Pair U32 U32) :=
   Result.ret { pair_x := x, pair_y := y }
 
 /- [constants::P0] -/
 def p0_body : Result (U32 × U32) :=
-  mk_pair0_fwd (U32.ofInt 0 (by intlit)) (U32.ofInt 1 (by intlit))
+  mk_pair0 (U32.ofInt 0 (by intlit)) (U32.ofInt 1 (by intlit))
 def p0_c : (U32 × U32) := eval_global p0_body (by simp)
 
 /- [constants::P1] -/
 def p1_body : Result (Pair U32 U32) :=
-  mk_pair1_fwd (U32.ofInt 0 (by intlit)) (U32.ofInt 1 (by intlit))
+  mk_pair1 (U32.ofInt 0 (by intlit)) (U32.ofInt 1 (by intlit))
 def p1_c : Pair U32 U32 := eval_global p1_body (by simp)
 
 /- [constants::P2] -/
@@ -67,32 +67,32 @@ def p3_c : Pair U32 U32 := eval_global p3_body (by simp)
 structure Wrap (T : Type) where
   wrap_val : T
 
-/- [constants::Wrap::{0}::new] -/
-def Wrap.new_fwd (T : Type) (val : T) : Result (Wrap T) :=
+/- [constants::Wrap::{0}::new]: forward function -/
+def Wrap.new (T : Type) (val : T) : Result (Wrap T) :=
   Result.ret { wrap_val := val }
 
 /- [constants::Y] -/
-def y_body : Result (Wrap I32) := Wrap.new_fwd I32 (I32.ofInt 2 (by intlit))
+def y_body : Result (Wrap I32) := Wrap.new I32 (I32.ofInt 2 (by intlit))
 def y_c : Wrap I32 := eval_global y_body (by simp)
 
-/- [constants::unwrap_y] -/
-def unwrap_y_fwd : Result I32 :=
+/- [constants::unwrap_y]: forward function -/
+def unwrap_y : Result I32 :=
   Result.ret y_c.wrap_val
 
 /- [constants::YVAL] -/
-def yval_body : Result I32 := unwrap_y_fwd
+def yval_body : Result I32 := unwrap_y
 def yval_c : I32 := eval_global yval_body (by simp)
 
 /- [constants::get_z1::Z1] -/
 def get_z1_z1_body : Result I32 := Result.ret (I32.ofInt 3 (by intlit))
 def get_z1_z1_c : I32 := eval_global get_z1_z1_body (by simp)
 
-/- [constants::get_z1] -/
-def get_z1_fwd : Result I32 :=
+/- [constants::get_z1]: forward function -/
+def get_z1 : Result I32 :=
   Result.ret get_z1_z1_c
 
-/- [constants::add] -/
-def add_fwd (a : I32) (b : I32) : Result I32 :=
+/- [constants::add]: forward function -/
+def add (a : I32) (b : I32) : Result I32 :=
   a + b
 
 /- [constants::Q1] -/
@@ -104,22 +104,22 @@ def q2_body : Result I32 := Result.ret q1_c
 def q2_c : I32 := eval_global q2_body (by simp)
 
 /- [constants::Q3] -/
-def q3_body : Result I32 := add_fwd q2_c (I32.ofInt 3 (by intlit))
+def q3_body : Result I32 := add q2_c (I32.ofInt 3 (by intlit))
 def q3_c : I32 := eval_global q3_body (by simp)
 
-/- [constants::get_z2] -/
-def get_z2_fwd : Result I32 :=
+/- [constants::get_z2]: forward function -/
+def get_z2 : Result I32 :=
   do
-    let i ← get_z1_fwd
-    let i0 ← add_fwd i q3_c
-    add_fwd q1_c i0
+    let i ← get_z1
+    let i0 ← add i q3_c
+    add q1_c i0
 
 /- [constants::S1] -/
 def s1_body : Result U32 := Result.ret (U32.ofInt 6 (by intlit))
 def s1_c : U32 := eval_global s1_body (by simp)
 
 /- [constants::S2] -/
-def s2_body : Result U32 := incr_fwd s1_c
+def s2_body : Result U32 := incr s1_c
 def s2_c : U32 := eval_global s2_body (by simp)
 
 /- [constants::S3] -/
@@ -128,7 +128,7 @@ def s3_c : Pair U32 U32 := eval_global s3_body (by simp)
 
 /- [constants::S4] -/
 def s4_body : Result (Pair U32 U32) :=
-  mk_pair1_fwd (U32.ofInt 7 (by intlit)) (U32.ofInt 8 (by intlit))
+  mk_pair1 (U32.ofInt 7 (by intlit)) (U32.ofInt 8 (by intlit))
 def s4_c : Pair U32 U32 := eval_global s4_body (by simp)
 
 end constants
diff --git a/tests/lean/External/Funs.lean b/tests/lean/External/Funs.lean
index 3fc21d91..122f94da 100644
--- a/tests/lean/External/Funs.lean
+++ b/tests/lean/External/Funs.lean
@@ -6,81 +6,80 @@ import External.FunsExternal
 open Primitives
 namespace external
 
-/- [external::swap] -/
-def swap_fwd
-  (T : Type) (x : T) (y : T) (st : State) : Result (State × Unit) :=
+/- [external::swap]: forward function -/
+def swap (T : Type) (x : T) (y : T) (st : State) : Result (State × Unit) :=
   do
-    let (st0, _) ← core.mem.swap_fwd T x y st
+    let (st0, _) ← core.mem.swap T x y st
     let (st1, _) ← core.mem.swap_back0 T x y st st0
     let (st2, _) ← core.mem.swap_back1 T x y st st1
     Result.ret (st2, ())
 
-/- [external::swap] -/
+/- [external::swap]: backward function 0 -/
 def swap_back
   (T : Type) (x : T) (y : T) (st : State) (st0 : State) :
   Result (State × (T × T))
   :=
   do
-    let (st1, _) ← core.mem.swap_fwd T x y st
+    let (st1, _) ← core.mem.swap T x y st
     let (st2, x0) ← core.mem.swap_back0 T x y st st1
     let (_, y0) ← core.mem.swap_back1 T x y st st2
     Result.ret (st0, (x0, y0))
 
-/- [external::test_new_non_zero_u32] -/
-def test_new_non_zero_u32_fwd
+/- [external::test_new_non_zero_u32]: forward function -/
+def test_new_non_zero_u32
   (x : U32) (st : State) : Result (State × core.num.nonzero.NonZeroU32) :=
   do
-    let (st0, opt) ← core.num.nonzero.NonZeroU32.new_fwd x st
-    core.option.Option.unwrap_fwd core.num.nonzero.NonZeroU32 opt st0
+    let (st0, opt) ← core.num.nonzero.NonZeroU32.new x st
+    core.option.Option.unwrap core.num.nonzero.NonZeroU32 opt st0
 
-/- [external::test_vec] -/
-def test_vec_fwd : Result Unit :=
+/- [external::test_vec]: forward function -/
+def test_vec : Result Unit :=
   do
     let v := Vec.new U32
     let _ ← Vec.push U32 v (U32.ofInt 0 (by intlit))
     Result.ret ()
 
 /- Unit test for [external::test_vec] -/
-#assert (test_vec_fwd == .ret ())
+#assert (test_vec == .ret ())
 
-/- [external::custom_swap] -/
-def custom_swap_fwd
+/- [external::custom_swap]: forward function -/
+def custom_swap
   (T : Type) (x : T) (y : T) (st : State) : Result (State × T) :=
   do
-    let (st0, _) ← core.mem.swap_fwd T x y st
+    let (st0, _) ← core.mem.swap T x y st
     let (st1, x0) ← core.mem.swap_back0 T x y st st0
     let (st2, _) ← core.mem.swap_back1 T x y st st1
     Result.ret (st2, x0)
 
-/- [external::custom_swap] -/
+/- [external::custom_swap]: backward function 0 -/
 def custom_swap_back
   (T : Type) (x : T) (y : T) (st : State) (ret0 : T) (st0 : State) :
   Result (State × (T × T))
   :=
   do
-    let (st1, _) ← core.mem.swap_fwd T x y st
+    let (st1, _) ← core.mem.swap T x y st
     let (st2, _) ← core.mem.swap_back0 T x y st st1
     let (_, y0) ← core.mem.swap_back1 T x y st st2
     Result.ret (st0, (ret0, y0))
 
-/- [external::test_custom_swap] -/
-def test_custom_swap_fwd
+/- [external::test_custom_swap]: forward function -/
+def test_custom_swap
   (x : U32) (y : U32) (st : State) : Result (State × Unit) :=
   do
-    let (st0, _) ← custom_swap_fwd U32 x y st
+    let (st0, _) ← custom_swap U32 x y st
     Result.ret (st0, ())
 
-/- [external::test_custom_swap] -/
+/- [external::test_custom_swap]: backward function 0 -/
 def test_custom_swap_back
   (x : U32) (y : U32) (st : State) (st0 : State) :
   Result (State × (U32 × U32))
   :=
   custom_swap_back U32 x y st (U32.ofInt 1 (by intlit)) st0
 
-/- [external::test_swap_non_zero] -/
-def test_swap_non_zero_fwd (x : U32) (st : State) : Result (State × U32) :=
+/- [external::test_swap_non_zero]: forward function -/
+def test_swap_non_zero (x : U32) (st : State) : Result (State × U32) :=
   do
-    let (st0, _) ← swap_fwd U32 x (U32.ofInt 0 (by intlit)) st
+    let (st0, _) ← swap U32 x (U32.ofInt 0 (by intlit)) st
     let (st1, (x0, _)) ← swap_back U32 x (U32.ofInt 0 (by intlit)) st st0
     if x0 = (U32.ofInt 0 (by intlit))
     then Result.fail Error.panic
diff --git a/tests/lean/External/FunsExternal.lean b/tests/lean/External/FunsExternal.lean
index 5326dd77..aae11ba1 100644
--- a/tests/lean/External/FunsExternal.lean
+++ b/tests/lean/External/FunsExternal.lean
@@ -7,7 +7,7 @@ open external
 -- TODO: fill those bodies
 
 /- [core::mem::swap] -/
-def core.mem.swap_fwd
+def core.mem.swap
   (T : Type) : T → T → State → Result (State × Unit) :=
   fun _x _y s => .ret (s, ())
 
@@ -22,12 +22,12 @@ def core.mem.swap_back1
   fun x _y _s0 s1 => .ret (s1, x)
 
 /- [core::num::nonzero::NonZeroU32::{14}::new] -/
-def core.num.nonzero.NonZeroU32.new_fwd
+def core.num.nonzero.NonZeroU32.new
   :
   U32 → State → Result (State × (Option core_num_nonzero_non_zero_u32_t)) :=
   fun _ _ => .fail .panic
 
 /- [core::option::Option::{0}::unwrap] -/
-def core.option.Option.unwrap_fwd
+def core.option.Option.unwrap
   (T : Type) : Option T → State → Result (State × T) :=
   fun _ _ => .fail .panic
diff --git a/tests/lean/External/FunsExternal_Template.lean b/tests/lean/External/FunsExternal_Template.lean
index 669fe91b..c8bc397f 100644
--- a/tests/lean/External/FunsExternal_Template.lean
+++ b/tests/lean/External/FunsExternal_Template.lean
@@ -6,23 +6,22 @@ import External.Types
 open Primitives
 open external
 
-/- [core::mem::swap] -/
-axiom core.mem.swap_fwd
-  (T : Type) : T → T → State → Result (State × Unit)
+/- [core::mem::swap]: forward function -/
+axiom core.mem.swap (T : Type) : T → T → State → Result (State × Unit)
 
-/- [core::mem::swap] -/
+/- [core::mem::swap]: backward function 0 -/
 axiom core.mem.swap_back0
   (T : Type) : T → T → State → State → Result (State × T)
 
-/- [core::mem::swap] -/
+/- [core::mem::swap]: backward function 1 -/
 axiom core.mem.swap_back1
   (T : Type) : T → T → State → State → Result (State × T)
 
-/- [core::num::nonzero::NonZeroU32::{14}::new] -/
-axiom core.num.nonzero.NonZeroU32.new_fwd
+/- [core::num::nonzero::NonZeroU32::{14}::new]: forward function -/
+axiom core.num.nonzero.NonZeroU32.new
   : U32 → State → Result (State × (Option core.num.nonzero.NonZeroU32))
 
-/- [core::option::Option::{0}::unwrap] -/
-axiom core.option.Option.unwrap_fwd
+/- [core::option::Option::{0}::unwrap]: forward function -/
+axiom core.option.Option.unwrap
   (T : Type) : Option T → State → Result (State × T)
 
diff --git a/tests/lean/Hashmap/Funs.lean b/tests/lean/Hashmap/Funs.lean
index 48038bfb..34ff1379 100644
--- a/tests/lean/Hashmap/Funs.lean
+++ b/tests/lean/Hashmap/Funs.lean
@@ -5,35 +5,35 @@ import Hashmap.Types
 open Primitives
 namespace hashmap
 
-/- [hashmap::hash_key] -/
-def hash_key_fwd (k : Usize) : Result Usize :=
+/- [hashmap::hash_key]: forward function -/
+def hash_key (k : Usize) : Result Usize :=
   Result.ret k
 
-/- [hashmap::HashMap::{0}::allocate_slots] -/
-divergent def HashMap.allocate_slots_loop_fwd
+/- [hashmap::HashMap::{0}::allocate_slots]: loop 0: forward function -/
+divergent def HashMap.allocate_slots_loop
   (T : Type) (slots : Vec (List T)) (n : Usize) : Result (Vec (List T)) :=
   if n > (Usize.ofInt 0 (by intlit))
   then
     do
       let slots0 ← Vec.push (List T) slots List.Nil
       let n0 ← n - (Usize.ofInt 1 (by intlit))
-      HashMap.allocate_slots_loop_fwd T slots0 n0
+      HashMap.allocate_slots_loop T slots0 n0
   else Result.ret slots
 
-/- [hashmap::HashMap::{0}::allocate_slots] -/
-def HashMap.allocate_slots_fwd
+/- [hashmap::HashMap::{0}::allocate_slots]: forward function -/
+def HashMap.allocate_slots
   (T : Type) (slots : Vec (List T)) (n : Usize) : Result (Vec (List T)) :=
-  HashMap.allocate_slots_loop_fwd T slots n
+  HashMap.allocate_slots_loop T slots n
 
-/- [hashmap::HashMap::{0}::new_with_capacity] -/
-def HashMap.new_with_capacity_fwd
+/- [hashmap::HashMap::{0}::new_with_capacity]: forward function -/
+def HashMap.new_with_capacity
   (T : Type) (capacity : Usize) (max_load_dividend : Usize)
   (max_load_divisor : Usize) :
   Result (HashMap T)
   :=
   do
     let v := Vec.new (List T)
-    let slots ← HashMap.allocate_slots_fwd T v capacity
+    let slots ← HashMap.allocate_slots T v capacity
     let i ← capacity * max_load_dividend
     let i0 ← i / max_load_divisor
     Result.ret
@@ -44,13 +44,14 @@ def HashMap.new_with_capacity_fwd
         hash_map_slots := slots
       }
 
-/- [hashmap::HashMap::{0}::new] -/
-def HashMap.new_fwd (T : Type) : Result (HashMap T) :=
-  HashMap.new_with_capacity_fwd T (Usize.ofInt 32 (by intlit))
+/- [hashmap::HashMap::{0}::new]: forward function -/
+def HashMap.new (T : Type) : Result (HashMap T) :=
+  HashMap.new_with_capacity T (Usize.ofInt 32 (by intlit))
     (Usize.ofInt 4 (by intlit)) (Usize.ofInt 5 (by intlit))
 
-/- [hashmap::HashMap::{0}::clear] -/
-divergent def HashMap.clear_loop_fwd_back
+/- [hashmap::HashMap::{0}::clear]: loop 0: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+divergent def HashMap.clear_loop
   (T : Type) (slots : Vec (List T)) (i : Usize) : Result (Vec (List T)) :=
   let i0 := Vec.len (List T) slots
   if i < i0
@@ -58,16 +59,15 @@ divergent def HashMap.clear_loop_fwd_back
     do
       let i1 ← i + (Usize.ofInt 1 (by intlit))
       let slots0 ← Vec.index_mut_back (List T) slots i List.Nil
-      HashMap.clear_loop_fwd_back T slots0 i1
+      HashMap.clear_loop T slots0 i1
   else Result.ret slots
 
-/- [hashmap::HashMap::{0}::clear] -/
-def HashMap.clear_fwd_back
-  (T : Type) (self : HashMap T) : Result (HashMap T) :=
+/- [hashmap::HashMap::{0}::clear]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def HashMap.clear (T : Type) (self : HashMap T) : Result (HashMap T) :=
   do
     let v ←
-      HashMap.clear_loop_fwd_back T self.hash_map_slots
-        (Usize.ofInt 0 (by intlit))
+      HashMap.clear_loop T self.hash_map_slots (Usize.ofInt 0 (by intlit))
     Result.ret
       {
         self
@@ -76,26 +76,26 @@ def HashMap.clear_fwd_back
           hash_map_slots := v
       }
 
-/- [hashmap::HashMap::{0}::len] -/
-def HashMap.len_fwd (T : Type) (self : HashMap T) : Result Usize :=
+/- [hashmap::HashMap::{0}::len]: forward function -/
+def HashMap.len (T : Type) (self : HashMap T) : Result Usize :=
   Result.ret self.hash_map_num_entries
 
-/- [hashmap::HashMap::{0}::insert_in_list] -/
-divergent def HashMap.insert_in_list_loop_fwd
+/- [hashmap::HashMap::{0}::insert_in_list]: loop 0: forward function -/
+divergent def HashMap.insert_in_list_loop
   (T : Type) (key : Usize) (value : T) (ls : List T) : Result Bool :=
   match ls with
   | List.Cons ckey cvalue tl =>
     if ckey = key
     then Result.ret false
-    else HashMap.insert_in_list_loop_fwd T key value tl
+    else HashMap.insert_in_list_loop T key value tl
   | List.Nil => Result.ret true
 
-/- [hashmap::HashMap::{0}::insert_in_list] -/
-def HashMap.insert_in_list_fwd
+/- [hashmap::HashMap::{0}::insert_in_list]: forward function -/
+def HashMap.insert_in_list
   (T : Type) (key : Usize) (value : T) (ls : List T) : Result Bool :=
-  HashMap.insert_in_list_loop_fwd T key value ls
+  HashMap.insert_in_list_loop T key value ls
 
-/- [hashmap::HashMap::{0}::insert_in_list] -/
+/- [hashmap::HashMap::{0}::insert_in_list]: loop 0: backward function 0 -/
 divergent def HashMap.insert_in_list_loop_back
   (T : Type) (key : Usize) (value : T) (ls : List T) : Result (List T) :=
   match ls with
@@ -109,22 +109,23 @@ divergent def HashMap.insert_in_list_loop_back
   | List.Nil => let l := List.Nil
                 Result.ret (List.Cons key value l)
 
-/- [hashmap::HashMap::{0}::insert_in_list] -/
+/- [hashmap::HashMap::{0}::insert_in_list]: backward function 0 -/
 def HashMap.insert_in_list_back
   (T : Type) (key : Usize) (value : T) (ls : List T) : Result (List T) :=
   HashMap.insert_in_list_loop_back T key value ls
 
-/- [hashmap::HashMap::{0}::insert_no_resize] -/
-def HashMap.insert_no_resize_fwd_back
+/- [hashmap::HashMap::{0}::insert_no_resize]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def HashMap.insert_no_resize
   (T : Type) (self : HashMap T) (key : Usize) (value : T) :
   Result (HashMap T)
   :=
   do
-    let hash ← hash_key_fwd key
+    let hash ← hash_key key
     let i := Vec.len (List T) self.hash_map_slots
     let hash_mod ← hash % i
     let l ← Vec.index_mut (List T) self.hash_map_slots hash_mod
-    let inserted ← HashMap.insert_in_list_fwd T key value l
+    let inserted ← HashMap.insert_in_list T key value l
     if inserted
     then
       do
@@ -144,23 +145,26 @@ def core_num_u32_max_body : Result U32 :=
   Result.ret (U32.ofInt 4294967295 (by intlit))
 def core_num_u32_max_c : U32 := eval_global core_num_u32_max_body (by simp)
 
-/- [hashmap::HashMap::{0}::move_elements_from_list] -/
-divergent def HashMap.move_elements_from_list_loop_fwd_back
+/- [hashmap::HashMap::{0}::move_elements_from_list]: loop 0: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+divergent def HashMap.move_elements_from_list_loop
   (T : Type) (ntable : HashMap T) (ls : List T) : Result (HashMap T) :=
   match ls with
   | List.Cons k v tl =>
     do
-      let ntable0 ← HashMap.insert_no_resize_fwd_back T ntable k v
-      HashMap.move_elements_from_list_loop_fwd_back T ntable0 tl
+      let ntable0 ← HashMap.insert_no_resize T ntable k v
+      HashMap.move_elements_from_list_loop T ntable0 tl
   | List.Nil => Result.ret ntable
 
-/- [hashmap::HashMap::{0}::move_elements_from_list] -/
-def HashMap.move_elements_from_list_fwd_back
+/- [hashmap::HashMap::{0}::move_elements_from_list]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def HashMap.move_elements_from_list
   (T : Type) (ntable : HashMap T) (ls : List T) : Result (HashMap T) :=
-  HashMap.move_elements_from_list_loop_fwd_back T ntable ls
+  HashMap.move_elements_from_list_loop T ntable ls
 
-/- [hashmap::HashMap::{0}::move_elements] -/
-divergent def HashMap.move_elements_loop_fwd_back
+/- [hashmap::HashMap::{0}::move_elements]: loop 0: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+divergent def HashMap.move_elements_loop
   (T : Type) (ntable : HashMap T) (slots : Vec (List T)) (i : Usize) :
   Result ((HashMap T) × (Vec (List T)))
   :=
@@ -169,24 +173,25 @@ divergent def HashMap.move_elements_loop_fwd_back
   then
     do
       let l ← Vec.index_mut (List T) slots i
-      let ls := mem.replace_fwd (List T) l List.Nil
-      let ntable0 ← HashMap.move_elements_from_list_fwd_back T ntable ls
+      let ls := mem.replace (List T) l List.Nil
+      let ntable0 ← HashMap.move_elements_from_list T ntable ls
       let i1 ← i + (Usize.ofInt 1 (by intlit))
       let l0 := mem.replace_back (List T) l List.Nil
       let slots0 ← Vec.index_mut_back (List T) slots i l0
-      HashMap.move_elements_loop_fwd_back T ntable0 slots0 i1
+      HashMap.move_elements_loop T ntable0 slots0 i1
   else Result.ret (ntable, slots)
 
-/- [hashmap::HashMap::{0}::move_elements] -/
-def HashMap.move_elements_fwd_back
+/- [hashmap::HashMap::{0}::move_elements]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def HashMap.move_elements
   (T : Type) (ntable : HashMap T) (slots : Vec (List T)) (i : Usize) :
   Result ((HashMap T) × (Vec (List T)))
   :=
-  HashMap.move_elements_loop_fwd_back T ntable slots i
+  HashMap.move_elements_loop T ntable slots i
 
-/- [hashmap::HashMap::{0}::try_resize] -/
-def HashMap.try_resize_fwd_back
-  (T : Type) (self : HashMap T) : Result (HashMap T) :=
+/- [hashmap::HashMap::{0}::try_resize]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def HashMap.try_resize (T : Type) (self : HashMap T) : Result (HashMap T) :=
   do
     let max_usize ← Scalar.cast .Usize core_num_u32_max_c
     let capacity := Vec.len (List T) self.hash_map_slots
@@ -197,9 +202,9 @@ def HashMap.try_resize_fwd_back
     then
       do
         let i2 ← capacity * (Usize.ofInt 2 (by intlit))
-        let ntable ← HashMap.new_with_capacity_fwd T i2 i i0
+        let ntable ← HashMap.new_with_capacity T i2 i i0
         let (ntable0, _) ←
-          HashMap.move_elements_fwd_back T ntable self.hash_map_slots
+          HashMap.move_elements T ntable self.hash_map_slots
             (Usize.ofInt 0 (by intlit))
         Result.ret
           {
@@ -210,83 +215,83 @@ def HashMap.try_resize_fwd_back
           }
     else Result.ret { self with hash_map_max_load_factor := (i, i0) }
 
-/- [hashmap::HashMap::{0}::insert] -/
-def HashMap.insert_fwd_back
+/- [hashmap::HashMap::{0}::insert]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def HashMap.insert
   (T : Type) (self : HashMap T) (key : Usize) (value : T) :
   Result (HashMap T)
   :=
   do
-    let self0 ← HashMap.insert_no_resize_fwd_back T self key value
-    let i ← HashMap.len_fwd T self0
+    let self0 ← HashMap.insert_no_resize T self key value
+    let i ← HashMap.len T self0
     if i > self0.hash_map_max_load
-    then HashMap.try_resize_fwd_back T self0
+    then HashMap.try_resize T self0
     else Result.ret self0
 
-/- [hashmap::HashMap::{0}::contains_key_in_list] -/
-divergent def HashMap.contains_key_in_list_loop_fwd
+/- [hashmap::HashMap::{0}::contains_key_in_list]: loop 0: forward function -/
+divergent def HashMap.contains_key_in_list_loop
   (T : Type) (key : Usize) (ls : List T) : Result Bool :=
   match ls with
   | List.Cons ckey t tl =>
     if ckey = key
     then Result.ret true
-    else HashMap.contains_key_in_list_loop_fwd T key tl
+    else HashMap.contains_key_in_list_loop T key tl
   | List.Nil => Result.ret false
 
-/- [hashmap::HashMap::{0}::contains_key_in_list] -/
-def HashMap.contains_key_in_list_fwd
+/- [hashmap::HashMap::{0}::contains_key_in_list]: forward function -/
+def HashMap.contains_key_in_list
   (T : Type) (key : Usize) (ls : List T) : Result Bool :=
-  HashMap.contains_key_in_list_loop_fwd T key ls
+  HashMap.contains_key_in_list_loop T key ls
 
-/- [hashmap::HashMap::{0}::contains_key] -/
-def HashMap.contains_key_fwd
+/- [hashmap::HashMap::{0}::contains_key]: forward function -/
+def HashMap.contains_key
   (T : Type) (self : HashMap T) (key : Usize) : Result Bool :=
   do
-    let hash ← hash_key_fwd key
+    let hash ← hash_key key
     let i := Vec.len (List T) self.hash_map_slots
     let hash_mod ← hash % i
     let l ← Vec.index (List T) self.hash_map_slots hash_mod
-    HashMap.contains_key_in_list_fwd T key l
+    HashMap.contains_key_in_list T key l
 
-/- [hashmap::HashMap::{0}::get_in_list] -/
-divergent def HashMap.get_in_list_loop_fwd
+/- [hashmap::HashMap::{0}::get_in_list]: loop 0: forward function -/
+divergent def HashMap.get_in_list_loop
   (T : Type) (key : Usize) (ls : List T) : Result T :=
   match ls with
   | List.Cons ckey cvalue tl =>
     if ckey = key
     then Result.ret cvalue
-    else HashMap.get_in_list_loop_fwd T key tl
+    else HashMap.get_in_list_loop T key tl
   | List.Nil => Result.fail Error.panic
 
-/- [hashmap::HashMap::{0}::get_in_list] -/
-def HashMap.get_in_list_fwd
-  (T : Type) (key : Usize) (ls : List T) : Result T :=
-  HashMap.get_in_list_loop_fwd T key ls
+/- [hashmap::HashMap::{0}::get_in_list]: forward function -/
+def HashMap.get_in_list (T : Type) (key : Usize) (ls : List T) : Result T :=
+  HashMap.get_in_list_loop T key ls
 
-/- [hashmap::HashMap::{0}::get] -/
-def HashMap.get_fwd (T : Type) (self : HashMap T) (key : Usize) : Result T :=
+/- [hashmap::HashMap::{0}::get]: forward function -/
+def HashMap.get (T : Type) (self : HashMap T) (key : Usize) : Result T :=
   do
-    let hash ← hash_key_fwd key
+    let hash ← hash_key key
     let i := Vec.len (List T) self.hash_map_slots
     let hash_mod ← hash % i
     let l ← Vec.index (List T) self.hash_map_slots hash_mod
-    HashMap.get_in_list_fwd T key l
+    HashMap.get_in_list T key l
 
-/- [hashmap::HashMap::{0}::get_mut_in_list] -/
-divergent def HashMap.get_mut_in_list_loop_fwd
+/- [hashmap::HashMap::{0}::get_mut_in_list]: loop 0: forward function -/
+divergent def HashMap.get_mut_in_list_loop
   (T : Type) (ls : List T) (key : Usize) : Result T :=
   match ls with
   | List.Cons ckey cvalue tl =>
     if ckey = key
     then Result.ret cvalue
-    else HashMap.get_mut_in_list_loop_fwd T tl key
+    else HashMap.get_mut_in_list_loop T tl key
   | List.Nil => Result.fail Error.panic
 
-/- [hashmap::HashMap::{0}::get_mut_in_list] -/
-def HashMap.get_mut_in_list_fwd
+/- [hashmap::HashMap::{0}::get_mut_in_list]: forward function -/
+def HashMap.get_mut_in_list
   (T : Type) (ls : List T) (key : Usize) : Result T :=
-  HashMap.get_mut_in_list_loop_fwd T ls key
+  HashMap.get_mut_in_list_loop T ls key
 
-/- [hashmap::HashMap::{0}::get_mut_in_list] -/
+/- [hashmap::HashMap::{0}::get_mut_in_list]: loop 0: backward function 0 -/
 divergent def HashMap.get_mut_in_list_loop_back
   (T : Type) (ls : List T) (key : Usize) (ret0 : T) : Result (List T) :=
   match ls with
@@ -299,28 +304,27 @@ divergent def HashMap.get_mut_in_list_loop_back
         Result.ret (List.Cons ckey cvalue tl0)
   | List.Nil => Result.fail Error.panic
 
-/- [hashmap::HashMap::{0}::get_mut_in_list] -/
+/- [hashmap::HashMap::{0}::get_mut_in_list]: backward function 0 -/
 def HashMap.get_mut_in_list_back
   (T : Type) (ls : List T) (key : Usize) (ret0 : T) : Result (List T) :=
   HashMap.get_mut_in_list_loop_back T ls key ret0
 
-/- [hashmap::HashMap::{0}::get_mut] -/
-def HashMap.get_mut_fwd
-  (T : Type) (self : HashMap T) (key : Usize) : Result T :=
+/- [hashmap::HashMap::{0}::get_mut]: forward function -/
+def HashMap.get_mut (T : Type) (self : HashMap T) (key : Usize) : Result T :=
   do
-    let hash ← hash_key_fwd key
+    let hash ← hash_key key
     let i := Vec.len (List T) self.hash_map_slots
     let hash_mod ← hash % i
     let l ← Vec.index_mut (List T) self.hash_map_slots hash_mod
-    HashMap.get_mut_in_list_fwd T l key
+    HashMap.get_mut_in_list T l key
 
-/- [hashmap::HashMap::{0}::get_mut] -/
+/- [hashmap::HashMap::{0}::get_mut]: backward function 0 -/
 def HashMap.get_mut_back
   (T : Type) (self : HashMap T) (key : Usize) (ret0 : T) :
   Result (HashMap T)
   :=
   do
-    let hash ← hash_key_fwd key
+    let hash ← hash_key key
     let i := Vec.len (List T) self.hash_map_slots
     let hash_mod ← hash % i
     let l ← Vec.index_mut (List T) self.hash_map_slots hash_mod
@@ -328,33 +332,33 @@ def HashMap.get_mut_back
     let v ← Vec.index_mut_back (List T) self.hash_map_slots hash_mod l0
     Result.ret { self with hash_map_slots := v }
 
-/- [hashmap::HashMap::{0}::remove_from_list] -/
-divergent def HashMap.remove_from_list_loop_fwd
+/- [hashmap::HashMap::{0}::remove_from_list]: loop 0: forward function -/
+divergent def HashMap.remove_from_list_loop
   (T : Type) (key : Usize) (ls : List T) : Result (Option T) :=
   match ls with
   | List.Cons ckey t tl =>
     if ckey = key
     then
-      let mv_ls := mem.replace_fwd (List T) (List.Cons ckey t tl) List.Nil
+      let mv_ls := mem.replace (List T) (List.Cons ckey t tl) List.Nil
       match mv_ls with
       | List.Cons i cvalue tl0 => Result.ret (Option.some cvalue)
       | List.Nil => Result.fail Error.panic
-    else HashMap.remove_from_list_loop_fwd T key tl
+    else HashMap.remove_from_list_loop T key tl
   | List.Nil => Result.ret Option.none
 
-/- [hashmap::HashMap::{0}::remove_from_list] -/
-def HashMap.remove_from_list_fwd
+/- [hashmap::HashMap::{0}::remove_from_list]: forward function -/
+def HashMap.remove_from_list
   (T : Type) (key : Usize) (ls : List T) : Result (Option T) :=
-  HashMap.remove_from_list_loop_fwd T key ls
+  HashMap.remove_from_list_loop T key ls
 
-/- [hashmap::HashMap::{0}::remove_from_list] -/
+/- [hashmap::HashMap::{0}::remove_from_list]: loop 0: backward function 1 -/
 divergent def HashMap.remove_from_list_loop_back
   (T : Type) (key : Usize) (ls : List T) : Result (List T) :=
   match ls with
   | List.Cons ckey t tl =>
     if ckey = key
     then
-      let mv_ls := mem.replace_fwd (List T) (List.Cons ckey t tl) List.Nil
+      let mv_ls := mem.replace (List T) (List.Cons ckey t tl) List.Nil
       match mv_ls with
       | List.Cons i cvalue tl0 => Result.ret tl0
       | List.Nil => Result.fail Error.panic
@@ -364,20 +368,20 @@ divergent def HashMap.remove_from_list_loop_back
         Result.ret (List.Cons ckey t tl0)
   | List.Nil => Result.ret List.Nil
 
-/- [hashmap::HashMap::{0}::remove_from_list] -/
+/- [hashmap::HashMap::{0}::remove_from_list]: backward function 1 -/
 def HashMap.remove_from_list_back
   (T : Type) (key : Usize) (ls : List T) : Result (List T) :=
   HashMap.remove_from_list_loop_back T key ls
 
-/- [hashmap::HashMap::{0}::remove] -/
-def HashMap.remove_fwd
+/- [hashmap::HashMap::{0}::remove]: forward function -/
+def HashMap.remove
   (T : Type) (self : HashMap T) (key : Usize) : Result (Option T) :=
   do
-    let hash ← hash_key_fwd key
+    let hash ← hash_key key
     let i := Vec.len (List T) self.hash_map_slots
     let hash_mod ← hash % i
     let l ← Vec.index_mut (List T) self.hash_map_slots hash_mod
-    let x ← HashMap.remove_from_list_fwd T key l
+    let x ← HashMap.remove_from_list T key l
     match x with
     | Option.none => Result.ret Option.none
     | Option.some x0 =>
@@ -385,15 +389,15 @@ def HashMap.remove_fwd
         let _ ← self.hash_map_num_entries - (Usize.ofInt 1 (by intlit))
         Result.ret (Option.some x0)
 
-/- [hashmap::HashMap::{0}::remove] -/
+/- [hashmap::HashMap::{0}::remove]: backward function 0 -/
 def HashMap.remove_back
   (T : Type) (self : HashMap T) (key : Usize) : Result (HashMap T) :=
   do
-    let hash ← hash_key_fwd key
+    let hash ← hash_key key
     let i := Vec.len (List T) self.hash_map_slots
     let hash_mod ← hash % i
     let l ← Vec.index_mut (List T) self.hash_map_slots hash_mod
-    let x ← HashMap.remove_from_list_fwd T key l
+    let x ← HashMap.remove_from_list T key l
     match x with
     | Option.none =>
       do
@@ -408,23 +412,23 @@ def HashMap.remove_back
         Result.ret
           { self with hash_map_num_entries := i0, hash_map_slots := v }
 
-/- [hashmap::test1] -/
-def test1_fwd : Result Unit :=
+/- [hashmap::test1]: forward function -/
+def test1 : Result Unit :=
   do
-    let hm ← HashMap.new_fwd U64
+    let hm ← HashMap.new U64
     let hm0 ←
-      HashMap.insert_fwd_back U64 hm (Usize.ofInt 0 (by intlit))
+      HashMap.insert U64 hm (Usize.ofInt 0 (by intlit))
         (U64.ofInt 42 (by intlit))
     let hm1 ←
-      HashMap.insert_fwd_back U64 hm0 (Usize.ofInt 128 (by intlit))
+      HashMap.insert U64 hm0 (Usize.ofInt 128 (by intlit))
         (U64.ofInt 18 (by intlit))
     let hm2 ←
-      HashMap.insert_fwd_back U64 hm1 (Usize.ofInt 1024 (by intlit))
+      HashMap.insert U64 hm1 (Usize.ofInt 1024 (by intlit))
         (U64.ofInt 138 (by intlit))
     let hm3 ←
-      HashMap.insert_fwd_back U64 hm2 (Usize.ofInt 1056 (by intlit))
+      HashMap.insert U64 hm2 (Usize.ofInt 1056 (by intlit))
         (U64.ofInt 256 (by intlit))
-    let i ← HashMap.get_fwd U64 hm3 (Usize.ofInt 128 (by intlit))
+    let i ← HashMap.get U64 hm3 (Usize.ofInt 128 (by intlit))
     if not (i = (U64.ofInt 18 (by intlit)))
     then Result.fail Error.panic
     else
@@ -432,12 +436,12 @@ def test1_fwd : Result Unit :=
         let hm4 ←
           HashMap.get_mut_back U64 hm3 (Usize.ofInt 1024 (by intlit))
             (U64.ofInt 56 (by intlit))
-        let i0 ← HashMap.get_fwd U64 hm4 (Usize.ofInt 1024 (by intlit))
+        let i0 ← HashMap.get U64 hm4 (Usize.ofInt 1024 (by intlit))
         if not (i0 = (U64.ofInt 56 (by intlit)))
         then Result.fail Error.panic
         else
           do
-            let x ← HashMap.remove_fwd U64 hm4 (Usize.ofInt 1024 (by intlit))
+            let x ← HashMap.remove U64 hm4 (Usize.ofInt 1024 (by intlit))
             match x with
             | Option.none => Result.fail Error.panic
             | Option.some x0 =>
@@ -447,26 +451,24 @@ def test1_fwd : Result Unit :=
                 do
                   let hm5 ←
                     HashMap.remove_back U64 hm4 (Usize.ofInt 1024 (by intlit))
-                  let i1 ←
-                    HashMap.get_fwd U64 hm5 (Usize.ofInt 0 (by intlit))
+                  let i1 ← HashMap.get U64 hm5 (Usize.ofInt 0 (by intlit))
                   if not (i1 = (U64.ofInt 42 (by intlit)))
                   then Result.fail Error.panic
                   else
                     do
                       let i2 ←
-                        HashMap.get_fwd U64 hm5 (Usize.ofInt 128 (by intlit))
+                        HashMap.get U64 hm5 (Usize.ofInt 128 (by intlit))
                       if not (i2 = (U64.ofInt 18 (by intlit)))
                       then Result.fail Error.panic
                       else
                         do
                           let i3 ←
-                            HashMap.get_fwd U64 hm5
-                              (Usize.ofInt 1056 (by intlit))
+                            HashMap.get U64 hm5 (Usize.ofInt 1056 (by intlit))
                           if not (i3 = (U64.ofInt 256 (by intlit)))
                           then Result.fail Error.panic
                           else Result.ret ()
 
 /- Unit test for [hashmap::test1] -/
-#assert (test1_fwd == .ret ())
+#assert (test1 == .ret ())
 
 end hashmap
diff --git a/tests/lean/HashmapMain/Funs.lean b/tests/lean/HashmapMain/Funs.lean
index 1a741a2d..b1afcd44 100644
--- a/tests/lean/HashmapMain/Funs.lean
+++ b/tests/lean/HashmapMain/Funs.lean
@@ -6,12 +6,12 @@ import HashmapMain.FunsExternal
 open Primitives
 namespace hashmap_main
 
-/- [hashmap_main::hashmap::hash_key] -/
-def hashmap.hash_key_fwd (k : Usize) : Result Usize :=
+/- [hashmap_main::hashmap::hash_key]: forward function -/
+def hashmap.hash_key (k : Usize) : Result Usize :=
   Result.ret k
 
-/- [hashmap_main::hashmap::HashMap::{0}::allocate_slots] -/
-divergent def hashmap.HashMap.allocate_slots_loop_fwd
+/- [hashmap_main::hashmap::HashMap::{0}::allocate_slots]: loop 0: forward function -/
+divergent def hashmap.HashMap.allocate_slots_loop
   (T : Type) (slots : Vec (hashmap.List T)) (n : Usize) :
   Result (Vec (hashmap.List T))
   :=
@@ -20,25 +20,25 @@ divergent def hashmap.HashMap.allocate_slots_loop_fwd
     do
       let slots0 ← Vec.push (hashmap.List T) slots hashmap.List.Nil
       let n0 ← n - (Usize.ofInt 1 (by intlit))
-      hashmap.HashMap.allocate_slots_loop_fwd T slots0 n0
+      hashmap.HashMap.allocate_slots_loop T slots0 n0
   else Result.ret slots
 
-/- [hashmap_main::hashmap::HashMap::{0}::allocate_slots] -/
-def hashmap.HashMap.allocate_slots_fwd
+/- [hashmap_main::hashmap::HashMap::{0}::allocate_slots]: forward function -/
+def hashmap.HashMap.allocate_slots
   (T : Type) (slots : Vec (hashmap.List T)) (n : Usize) :
   Result (Vec (hashmap.List T))
   :=
-  hashmap.HashMap.allocate_slots_loop_fwd T slots n
+  hashmap.HashMap.allocate_slots_loop T slots n
 
-/- [hashmap_main::hashmap::HashMap::{0}::new_with_capacity] -/
-def hashmap.HashMap.new_with_capacity_fwd
+/- [hashmap_main::hashmap::HashMap::{0}::new_with_capacity]: forward function -/
+def hashmap.HashMap.new_with_capacity
   (T : Type) (capacity : Usize) (max_load_dividend : Usize)
   (max_load_divisor : Usize) :
   Result (hashmap.HashMap T)
   :=
   do
     let v := Vec.new (hashmap.List T)
-    let slots ← hashmap.HashMap.allocate_slots_fwd T v capacity
+    let slots ← hashmap.HashMap.allocate_slots T v capacity
     let i ← capacity * max_load_dividend
     let i0 ← i / max_load_divisor
     Result.ret
@@ -50,13 +50,14 @@ def hashmap.HashMap.new_with_capacity_fwd
         hashmap_hash_map_slots := slots
       }
 
-/- [hashmap_main::hashmap::HashMap::{0}::new] -/
-def hashmap.HashMap.new_fwd (T : Type) : Result (hashmap.HashMap T) :=
-  hashmap.HashMap.new_with_capacity_fwd T (Usize.ofInt 32 (by intlit))
+/- [hashmap_main::hashmap::HashMap::{0}::new]: forward function -/
+def hashmap.HashMap.new (T : Type) : Result (hashmap.HashMap T) :=
+  hashmap.HashMap.new_with_capacity T (Usize.ofInt 32 (by intlit))
     (Usize.ofInt 4 (by intlit)) (Usize.ofInt 5 (by intlit))
 
-/- [hashmap_main::hashmap::HashMap::{0}::clear] -/
-divergent def hashmap.HashMap.clear_loop_fwd_back
+/- [hashmap_main::hashmap::HashMap::{0}::clear]: loop 0: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+divergent def hashmap.HashMap.clear_loop
   (T : Type) (slots : Vec (hashmap.List T)) (i : Usize) :
   Result (Vec (hashmap.List T))
   :=
@@ -67,15 +68,16 @@ divergent def hashmap.HashMap.clear_loop_fwd_back
       let i1 ← i + (Usize.ofInt 1 (by intlit))
       let slots0 ←
         Vec.index_mut_back (hashmap.List T) slots i hashmap.List.Nil
-      hashmap.HashMap.clear_loop_fwd_back T slots0 i1
+      hashmap.HashMap.clear_loop T slots0 i1
   else Result.ret slots
 
-/- [hashmap_main::hashmap::HashMap::{0}::clear] -/
-def hashmap.HashMap.clear_fwd_back
+/- [hashmap_main::hashmap::HashMap::{0}::clear]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def hashmap.HashMap.clear
   (T : Type) (self : hashmap.HashMap T) : Result (hashmap.HashMap T) :=
   do
     let v ←
-      hashmap.HashMap.clear_loop_fwd_back T self.hashmap_hash_map_slots
+      hashmap.HashMap.clear_loop T self.hashmap_hash_map_slots
         (Usize.ofInt 0 (by intlit))
     Result.ret
       {
@@ -85,27 +87,26 @@ def hashmap.HashMap.clear_fwd_back
           hashmap_hash_map_slots := v
       }
 
-/- [hashmap_main::hashmap::HashMap::{0}::len] -/
-def hashmap.HashMap.len_fwd
-  (T : Type) (self : hashmap.HashMap T) : Result Usize :=
+/- [hashmap_main::hashmap::HashMap::{0}::len]: forward function -/
+def hashmap.HashMap.len (T : Type) (self : hashmap.HashMap T) : Result Usize :=
   Result.ret self.hashmap_hash_map_num_entries
 
-/- [hashmap_main::hashmap::HashMap::{0}::insert_in_list] -/
-divergent def hashmap.HashMap.insert_in_list_loop_fwd
+/- [hashmap_main::hashmap::HashMap::{0}::insert_in_list]: loop 0: forward function -/
+divergent def hashmap.HashMap.insert_in_list_loop
   (T : Type) (key : Usize) (value : T) (ls : hashmap.List T) : Result Bool :=
   match ls with
   | hashmap.List.Cons ckey cvalue tl =>
     if ckey = key
     then Result.ret false
-    else hashmap.HashMap.insert_in_list_loop_fwd T key value tl
+    else hashmap.HashMap.insert_in_list_loop T key value tl
   | hashmap.List.Nil => Result.ret true
 
-/- [hashmap_main::hashmap::HashMap::{0}::insert_in_list] -/
-def hashmap.HashMap.insert_in_list_fwd
+/- [hashmap_main::hashmap::HashMap::{0}::insert_in_list]: forward function -/
+def hashmap.HashMap.insert_in_list
   (T : Type) (key : Usize) (value : T) (ls : hashmap.List T) : Result Bool :=
-  hashmap.HashMap.insert_in_list_loop_fwd T key value ls
+  hashmap.HashMap.insert_in_list_loop T key value ls
 
-/- [hashmap_main::hashmap::HashMap::{0}::insert_in_list] -/
+/- [hashmap_main::hashmap::HashMap::{0}::insert_in_list]: loop 0: backward function 0 -/
 divergent def hashmap.HashMap.insert_in_list_loop_back
   (T : Type) (key : Usize) (value : T) (ls : hashmap.List T) :
   Result (hashmap.List T)
@@ -122,25 +123,26 @@ divergent def hashmap.HashMap.insert_in_list_loop_back
     let l := hashmap.List.Nil
     Result.ret (hashmap.List.Cons key value l)
 
-/- [hashmap_main::hashmap::HashMap::{0}::insert_in_list] -/
+/- [hashmap_main::hashmap::HashMap::{0}::insert_in_list]: backward function 0 -/
 def hashmap.HashMap.insert_in_list_back
   (T : Type) (key : Usize) (value : T) (ls : hashmap.List T) :
   Result (hashmap.List T)
   :=
   hashmap.HashMap.insert_in_list_loop_back T key value ls
 
-/- [hashmap_main::hashmap::HashMap::{0}::insert_no_resize] -/
-def hashmap.HashMap.insert_no_resize_fwd_back
+/- [hashmap_main::hashmap::HashMap::{0}::insert_no_resize]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def hashmap.HashMap.insert_no_resize
   (T : Type) (self : hashmap.HashMap T) (key : Usize) (value : T) :
   Result (hashmap.HashMap T)
   :=
   do
-    let hash ← hashmap.hash_key_fwd key
+    let hash ← hashmap.hash_key key
     let i := Vec.len (hashmap.List T) self.hashmap_hash_map_slots
     let hash_mod ← hash % i
     let l ←
       Vec.index_mut (hashmap.List T) self.hashmap_hash_map_slots hash_mod
-    let inserted ← hashmap.HashMap.insert_in_list_fwd T key value l
+    let inserted ← hashmap.HashMap.insert_in_list T key value l
     if inserted
     then
       do
@@ -169,27 +171,30 @@ def core_num_u32_max_body : Result U32 :=
   Result.ret (U32.ofInt 4294967295 (by intlit))
 def core_num_u32_max_c : U32 := eval_global core_num_u32_max_body (by simp)
 
-/- [hashmap_main::hashmap::HashMap::{0}::move_elements_from_list] -/
-divergent def hashmap.HashMap.move_elements_from_list_loop_fwd_back
+/- [hashmap_main::hashmap::HashMap::{0}::move_elements_from_list]: loop 0: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+divergent def hashmap.HashMap.move_elements_from_list_loop
   (T : Type) (ntable : hashmap.HashMap T) (ls : hashmap.List T) :
   Result (hashmap.HashMap T)
   :=
   match ls with
   | hashmap.List.Cons k v tl =>
     do
-      let ntable0 ← hashmap.HashMap.insert_no_resize_fwd_back T ntable k v
-      hashmap.HashMap.move_elements_from_list_loop_fwd_back T ntable0 tl
+      let ntable0 ← hashmap.HashMap.insert_no_resize T ntable k v
+      hashmap.HashMap.move_elements_from_list_loop T ntable0 tl
   | hashmap.List.Nil => Result.ret ntable
 
-/- [hashmap_main::hashmap::HashMap::{0}::move_elements_from_list] -/
-def hashmap.HashMap.move_elements_from_list_fwd_back
+/- [hashmap_main::hashmap::HashMap::{0}::move_elements_from_list]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def hashmap.HashMap.move_elements_from_list
   (T : Type) (ntable : hashmap.HashMap T) (ls : hashmap.List T) :
   Result (hashmap.HashMap T)
   :=
-  hashmap.HashMap.move_elements_from_list_loop_fwd_back T ntable ls
+  hashmap.HashMap.move_elements_from_list_loop T ntable ls
 
-/- [hashmap_main::hashmap::HashMap::{0}::move_elements] -/
-divergent def hashmap.HashMap.move_elements_loop_fwd_back
+/- [hashmap_main::hashmap::HashMap::{0}::move_elements]: loop 0: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+divergent def hashmap.HashMap.move_elements_loop
   (T : Type) (ntable : hashmap.HashMap T) (slots : Vec (hashmap.List T))
   (i : Usize) :
   Result ((hashmap.HashMap T) × (Vec (hashmap.List T)))
@@ -199,25 +204,26 @@ divergent def hashmap.HashMap.move_elements_loop_fwd_back
   then
     do
       let l ← Vec.index_mut (hashmap.List T) slots i
-      let ls := mem.replace_fwd (hashmap.List T) l hashmap.List.Nil
-      let ntable0 ←
-        hashmap.HashMap.move_elements_from_list_fwd_back T ntable ls
+      let ls := mem.replace (hashmap.List T) l hashmap.List.Nil
+      let ntable0 ← hashmap.HashMap.move_elements_from_list T ntable ls
       let i1 ← i + (Usize.ofInt 1 (by intlit))
       let l0 := mem.replace_back (hashmap.List T) l hashmap.List.Nil
       let slots0 ← Vec.index_mut_back (hashmap.List T) slots i l0
-      hashmap.HashMap.move_elements_loop_fwd_back T ntable0 slots0 i1
+      hashmap.HashMap.move_elements_loop T ntable0 slots0 i1
   else Result.ret (ntable, slots)
 
-/- [hashmap_main::hashmap::HashMap::{0}::move_elements] -/
-def hashmap.HashMap.move_elements_fwd_back
+/- [hashmap_main::hashmap::HashMap::{0}::move_elements]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def hashmap.HashMap.move_elements
   (T : Type) (ntable : hashmap.HashMap T) (slots : Vec (hashmap.List T))
   (i : Usize) :
   Result ((hashmap.HashMap T) × (Vec (hashmap.List T)))
   :=
-  hashmap.HashMap.move_elements_loop_fwd_back T ntable slots i
+  hashmap.HashMap.move_elements_loop T ntable slots i
 
-/- [hashmap_main::hashmap::HashMap::{0}::try_resize] -/
-def hashmap.HashMap.try_resize_fwd_back
+/- [hashmap_main::hashmap::HashMap::{0}::try_resize]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def hashmap.HashMap.try_resize
   (T : Type) (self : hashmap.HashMap T) : Result (hashmap.HashMap T) :=
   do
     let max_usize ← Scalar.cast .Usize core_num_u32_max_c
@@ -229,10 +235,10 @@ def hashmap.HashMap.try_resize_fwd_back
     then
       do
         let i2 ← capacity * (Usize.ofInt 2 (by intlit))
-        let ntable ← hashmap.HashMap.new_with_capacity_fwd T i2 i i0
+        let ntable ← hashmap.HashMap.new_with_capacity T i2 i i0
         let (ntable0, _) ←
-          hashmap.HashMap.move_elements_fwd_back T ntable
-            self.hashmap_hash_map_slots (Usize.ofInt 0 (by intlit))
+          hashmap.HashMap.move_elements T ntable self.hashmap_hash_map_slots
+            (Usize.ofInt 0 (by intlit))
         Result.ret
           {
             ntable0
@@ -242,84 +248,85 @@ def hashmap.HashMap.try_resize_fwd_back
           }
     else Result.ret { self with hashmap_hash_map_max_load_factor := (i, i0) }
 
-/- [hashmap_main::hashmap::HashMap::{0}::insert] -/
-def hashmap.HashMap.insert_fwd_back
+/- [hashmap_main::hashmap::HashMap::{0}::insert]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def hashmap.HashMap.insert
   (T : Type) (self : hashmap.HashMap T) (key : Usize) (value : T) :
   Result (hashmap.HashMap T)
   :=
   do
-    let self0 ← hashmap.HashMap.insert_no_resize_fwd_back T self key value
-    let i ← hashmap.HashMap.len_fwd T self0
+    let self0 ← hashmap.HashMap.insert_no_resize T self key value
+    let i ← hashmap.HashMap.len T self0
     if i > self0.hashmap_hash_map_max_load
-    then hashmap.HashMap.try_resize_fwd_back T self0
+    then hashmap.HashMap.try_resize T self0
     else Result.ret self0
 
-/- [hashmap_main::hashmap::HashMap::{0}::contains_key_in_list] -/
-divergent def hashmap.HashMap.contains_key_in_list_loop_fwd
+/- [hashmap_main::hashmap::HashMap::{0}::contains_key_in_list]: loop 0: forward function -/
+divergent def hashmap.HashMap.contains_key_in_list_loop
   (T : Type) (key : Usize) (ls : hashmap.List T) : Result Bool :=
   match ls with
   | hashmap.List.Cons ckey t tl =>
     if ckey = key
     then Result.ret true
-    else hashmap.HashMap.contains_key_in_list_loop_fwd T key tl
+    else hashmap.HashMap.contains_key_in_list_loop T key tl
   | hashmap.List.Nil => Result.ret false
 
-/- [hashmap_main::hashmap::HashMap::{0}::contains_key_in_list] -/
-def hashmap.HashMap.contains_key_in_list_fwd
+/- [hashmap_main::hashmap::HashMap::{0}::contains_key_in_list]: forward function -/
+def hashmap.HashMap.contains_key_in_list
   (T : Type) (key : Usize) (ls : hashmap.List T) : Result Bool :=
-  hashmap.HashMap.contains_key_in_list_loop_fwd T key ls
+  hashmap.HashMap.contains_key_in_list_loop T key ls
 
-/- [hashmap_main::hashmap::HashMap::{0}::contains_key] -/
-def hashmap.HashMap.contains_key_fwd
+/- [hashmap_main::hashmap::HashMap::{0}::contains_key]: forward function -/
+def hashmap.HashMap.contains_key
   (T : Type) (self : hashmap.HashMap T) (key : Usize) : Result Bool :=
   do
-    let hash ← hashmap.hash_key_fwd key
+    let hash ← hashmap.hash_key key
     let i := Vec.len (hashmap.List T) self.hashmap_hash_map_slots
     let hash_mod ← hash % i
     let l ← Vec.index (hashmap.List T) self.hashmap_hash_map_slots hash_mod
-    hashmap.HashMap.contains_key_in_list_fwd T key l
+    hashmap.HashMap.contains_key_in_list T key l
 
-/- [hashmap_main::hashmap::HashMap::{0}::get_in_list] -/
-divergent def hashmap.HashMap.get_in_list_loop_fwd
+/- [hashmap_main::hashmap::HashMap::{0}::get_in_list]: loop 0: forward function -/
+divergent def hashmap.HashMap.get_in_list_loop
   (T : Type) (key : Usize) (ls : hashmap.List T) : Result T :=
   match ls with
   | hashmap.List.Cons ckey cvalue tl =>
     if ckey = key
     then Result.ret cvalue
-    else hashmap.HashMap.get_in_list_loop_fwd T key tl
+    else hashmap.HashMap.get_in_list_loop T key tl
   | hashmap.List.Nil => Result.fail Error.panic
 
-/- [hashmap_main::hashmap::HashMap::{0}::get_in_list] -/
-def hashmap.HashMap.get_in_list_fwd
+/- [hashmap_main::hashmap::HashMap::{0}::get_in_list]: forward function -/
+def hashmap.HashMap.get_in_list
   (T : Type) (key : Usize) (ls : hashmap.List T) : Result T :=
-  hashmap.HashMap.get_in_list_loop_fwd T key ls
+  hashmap.HashMap.get_in_list_loop T key ls
 
-/- [hashmap_main::hashmap::HashMap::{0}::get] -/
-def hashmap.HashMap.get_fwd
+/- [hashmap_main::hashmap::HashMap::{0}::get]: forward function -/
+def hashmap.HashMap.get
   (T : Type) (self : hashmap.HashMap T) (key : Usize) : Result T :=
   do
-    let hash ← hashmap.hash_key_fwd key
+    let hash ← hashmap.hash_key key
     let i := Vec.len (hashmap.List T) self.hashmap_hash_map_slots
     let hash_mod ← hash % i
     let l ← Vec.index (hashmap.List T) self.hashmap_hash_map_slots hash_mod
-    hashmap.HashMap.get_in_list_fwd T key l
+    hashmap.HashMap.get_in_list T key l
 
-/- [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list] -/
-divergent def hashmap.HashMap.get_mut_in_list_loop_fwd
+/- [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list]: loop 0: forward function -/
+divergent def hashmap.HashMap.get_mut_in_list_loop
   (T : Type) (ls : hashmap.List T) (key : Usize) : Result T :=
   match ls with
   | hashmap.List.Cons ckey cvalue tl =>
     if ckey = key
     then Result.ret cvalue
-    else hashmap.HashMap.get_mut_in_list_loop_fwd T tl key
+    else hashmap.HashMap.get_mut_in_list_loop T tl key
   | hashmap.List.Nil => Result.fail Error.panic
 
-/- [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list] -/
-def hashmap.HashMap.get_mut_in_list_fwd
+/- [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list]: forward function -/
+def hashmap.HashMap.get_mut_in_list
   (T : Type) (ls : hashmap.List T) (key : Usize) : Result T :=
-  hashmap.HashMap.get_mut_in_list_loop_fwd T ls key
+  hashmap.HashMap.get_mut_in_list_loop T ls key
 
-/- [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list] -/
+/- [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list]: loop 0: backward function 0 -/
 divergent def hashmap.HashMap.get_mut_in_list_loop_back
   (T : Type) (ls : hashmap.List T) (key : Usize) (ret0 : T) :
   Result (hashmap.List T)
@@ -334,31 +341,31 @@ divergent def hashmap.HashMap.get_mut_in_list_loop_back
         Result.ret (hashmap.List.Cons ckey cvalue tl0)
   | hashmap.List.Nil => Result.fail Error.panic
 
-/- [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list] -/
+/- [hashmap_main::hashmap::HashMap::{0}::get_mut_in_list]: backward function 0 -/
 def hashmap.HashMap.get_mut_in_list_back
   (T : Type) (ls : hashmap.List T) (key : Usize) (ret0 : T) :
   Result (hashmap.List T)
   :=
   hashmap.HashMap.get_mut_in_list_loop_back T ls key ret0
 
-/- [hashmap_main::hashmap::HashMap::{0}::get_mut] -/
-def hashmap.HashMap.get_mut_fwd
+/- [hashmap_main::hashmap::HashMap::{0}::get_mut]: forward function -/
+def hashmap.HashMap.get_mut
   (T : Type) (self : hashmap.HashMap T) (key : Usize) : Result T :=
   do
-    let hash ← hashmap.hash_key_fwd key
+    let hash ← hashmap.hash_key key
     let i := Vec.len (hashmap.List T) self.hashmap_hash_map_slots
     let hash_mod ← hash % i
     let l ←
       Vec.index_mut (hashmap.List T) self.hashmap_hash_map_slots hash_mod
-    hashmap.HashMap.get_mut_in_list_fwd T l key
+    hashmap.HashMap.get_mut_in_list T l key
 
-/- [hashmap_main::hashmap::HashMap::{0}::get_mut] -/
+/- [hashmap_main::hashmap::HashMap::{0}::get_mut]: backward function 0 -/
 def hashmap.HashMap.get_mut_back
   (T : Type) (self : hashmap.HashMap T) (key : Usize) (ret0 : T) :
   Result (hashmap.HashMap T)
   :=
   do
-    let hash ← hashmap.hash_key_fwd key
+    let hash ← hashmap.hash_key key
     let i := Vec.len (hashmap.List T) self.hashmap_hash_map_slots
     let hash_mod ← hash % i
     let l ←
@@ -369,28 +376,28 @@ def hashmap.HashMap.get_mut_back
         l0
     Result.ret { self with hashmap_hash_map_slots := v }
 
-/- [hashmap_main::hashmap::HashMap::{0}::remove_from_list] -/
-divergent def hashmap.HashMap.remove_from_list_loop_fwd
+/- [hashmap_main::hashmap::HashMap::{0}::remove_from_list]: loop 0: forward function -/
+divergent def hashmap.HashMap.remove_from_list_loop
   (T : Type) (key : Usize) (ls : hashmap.List T) : Result (Option T) :=
   match ls with
   | hashmap.List.Cons ckey t tl =>
     if ckey = key
     then
       let mv_ls :=
-        mem.replace_fwd (hashmap.List T) (hashmap.List.Cons ckey t tl)
+        mem.replace (hashmap.List T) (hashmap.List.Cons ckey t tl)
           hashmap.List.Nil
       match mv_ls with
       | hashmap.List.Cons i cvalue tl0 => Result.ret (Option.some cvalue)
       | hashmap.List.Nil => Result.fail Error.panic
-    else hashmap.HashMap.remove_from_list_loop_fwd T key tl
+    else hashmap.HashMap.remove_from_list_loop T key tl
   | hashmap.List.Nil => Result.ret Option.none
 
-/- [hashmap_main::hashmap::HashMap::{0}::remove_from_list] -/
-def hashmap.HashMap.remove_from_list_fwd
+/- [hashmap_main::hashmap::HashMap::{0}::remove_from_list]: forward function -/
+def hashmap.HashMap.remove_from_list
   (T : Type) (key : Usize) (ls : hashmap.List T) : Result (Option T) :=
-  hashmap.HashMap.remove_from_list_loop_fwd T key ls
+  hashmap.HashMap.remove_from_list_loop T key ls
 
-/- [hashmap_main::hashmap::HashMap::{0}::remove_from_list] -/
+/- [hashmap_main::hashmap::HashMap::{0}::remove_from_list]: loop 0: backward function 1 -/
 divergent def hashmap.HashMap.remove_from_list_loop_back
   (T : Type) (key : Usize) (ls : hashmap.List T) : Result (hashmap.List T) :=
   match ls with
@@ -398,7 +405,7 @@ divergent def hashmap.HashMap.remove_from_list_loop_back
     if ckey = key
     then
       let mv_ls :=
-        mem.replace_fwd (hashmap.List T) (hashmap.List.Cons ckey t tl)
+        mem.replace (hashmap.List T) (hashmap.List.Cons ckey t tl)
           hashmap.List.Nil
       match mv_ls with
       | hashmap.List.Cons i cvalue tl0 => Result.ret tl0
@@ -409,21 +416,21 @@ divergent def hashmap.HashMap.remove_from_list_loop_back
         Result.ret (hashmap.List.Cons ckey t tl0)
   | hashmap.List.Nil => Result.ret hashmap.List.Nil
 
-/- [hashmap_main::hashmap::HashMap::{0}::remove_from_list] -/
+/- [hashmap_main::hashmap::HashMap::{0}::remove_from_list]: backward function 1 -/
 def hashmap.HashMap.remove_from_list_back
   (T : Type) (key : Usize) (ls : hashmap.List T) : Result (hashmap.List T) :=
   hashmap.HashMap.remove_from_list_loop_back T key ls
 
-/- [hashmap_main::hashmap::HashMap::{0}::remove] -/
-def hashmap.HashMap.remove_fwd
+/- [hashmap_main::hashmap::HashMap::{0}::remove]: forward function -/
+def hashmap.HashMap.remove
   (T : Type) (self : hashmap.HashMap T) (key : Usize) : Result (Option T) :=
   do
-    let hash ← hashmap.hash_key_fwd key
+    let hash ← hashmap.hash_key key
     let i := Vec.len (hashmap.List T) self.hashmap_hash_map_slots
     let hash_mod ← hash % i
     let l ←
       Vec.index_mut (hashmap.List T) self.hashmap_hash_map_slots hash_mod
-    let x ← hashmap.HashMap.remove_from_list_fwd T key l
+    let x ← hashmap.HashMap.remove_from_list T key l
     match x with
     | Option.none => Result.ret Option.none
     | Option.some x0 =>
@@ -432,18 +439,18 @@ def hashmap.HashMap.remove_fwd
           (Usize.ofInt 1 (by intlit))
         Result.ret (Option.some x0)
 
-/- [hashmap_main::hashmap::HashMap::{0}::remove] -/
+/- [hashmap_main::hashmap::HashMap::{0}::remove]: backward function 0 -/
 def hashmap.HashMap.remove_back
   (T : Type) (self : hashmap.HashMap T) (key : Usize) :
   Result (hashmap.HashMap T)
   :=
   do
-    let hash ← hashmap.hash_key_fwd key
+    let hash ← hashmap.hash_key key
     let i := Vec.len (hashmap.List T) self.hashmap_hash_map_slots
     let hash_mod ← hash % i
     let l ←
       Vec.index_mut (hashmap.List T) self.hashmap_hash_map_slots hash_mod
-    let x ← hashmap.HashMap.remove_from_list_fwd T key l
+    let x ← hashmap.HashMap.remove_from_list T key l
     match x with
     | Option.none =>
       do
@@ -467,23 +474,23 @@ def hashmap.HashMap.remove_back
               hashmap_hash_map_num_entries := i0, hashmap_hash_map_slots := v
           }
 
-/- [hashmap_main::hashmap::test1] -/
-def hashmap.test1_fwd : Result Unit :=
+/- [hashmap_main::hashmap::test1]: forward function -/
+def hashmap.test1 : Result Unit :=
   do
-    let hm ← hashmap.HashMap.new_fwd U64
+    let hm ← hashmap.HashMap.new U64
     let hm0 ←
-      hashmap.HashMap.insert_fwd_back U64 hm (Usize.ofInt 0 (by intlit))
+      hashmap.HashMap.insert U64 hm (Usize.ofInt 0 (by intlit))
         (U64.ofInt 42 (by intlit))
     let hm1 ←
-      hashmap.HashMap.insert_fwd_back U64 hm0 (Usize.ofInt 128 (by intlit))
+      hashmap.HashMap.insert U64 hm0 (Usize.ofInt 128 (by intlit))
         (U64.ofInt 18 (by intlit))
     let hm2 ←
-      hashmap.HashMap.insert_fwd_back U64 hm1 (Usize.ofInt 1024 (by intlit))
+      hashmap.HashMap.insert U64 hm1 (Usize.ofInt 1024 (by intlit))
         (U64.ofInt 138 (by intlit))
     let hm3 ←
-      hashmap.HashMap.insert_fwd_back U64 hm2 (Usize.ofInt 1056 (by intlit))
+      hashmap.HashMap.insert U64 hm2 (Usize.ofInt 1056 (by intlit))
         (U64.ofInt 256 (by intlit))
-    let i ← hashmap.HashMap.get_fwd U64 hm3 (Usize.ofInt 128 (by intlit))
+    let i ← hashmap.HashMap.get U64 hm3 (Usize.ofInt 128 (by intlit))
     if not (i = (U64.ofInt 18 (by intlit)))
     then Result.fail Error.panic
     else
@@ -491,14 +498,13 @@ def hashmap.test1_fwd : Result Unit :=
         let hm4 ←
           hashmap.HashMap.get_mut_back U64 hm3 (Usize.ofInt 1024 (by intlit))
             (U64.ofInt 56 (by intlit))
-        let i0 ←
-          hashmap.HashMap.get_fwd U64 hm4 (Usize.ofInt 1024 (by intlit))
+        let i0 ← hashmap.HashMap.get U64 hm4 (Usize.ofInt 1024 (by intlit))
         if not (i0 = (U64.ofInt 56 (by intlit)))
         then Result.fail Error.panic
         else
           do
             let x ←
-              hashmap.HashMap.remove_fwd U64 hm4 (Usize.ofInt 1024 (by intlit))
+              hashmap.HashMap.remove U64 hm4 (Usize.ofInt 1024 (by intlit))
             match x with
             | Option.none => Result.fail Error.panic
             | Option.some x0 =>
@@ -510,42 +516,42 @@ def hashmap.test1_fwd : Result Unit :=
                     hashmap.HashMap.remove_back U64 hm4
                       (Usize.ofInt 1024 (by intlit))
                   let i1 ←
-                    hashmap.HashMap.get_fwd U64 hm5 (Usize.ofInt 0 (by intlit))
+                    hashmap.HashMap.get U64 hm5 (Usize.ofInt 0 (by intlit))
                   if not (i1 = (U64.ofInt 42 (by intlit)))
                   then Result.fail Error.panic
                   else
                     do
                       let i2 ←
-                        hashmap.HashMap.get_fwd U64 hm5
+                        hashmap.HashMap.get U64 hm5
                           (Usize.ofInt 128 (by intlit))
                       if not (i2 = (U64.ofInt 18 (by intlit)))
                       then Result.fail Error.panic
                       else
                         do
                           let i3 ←
-                            hashmap.HashMap.get_fwd U64 hm5
+                            hashmap.HashMap.get U64 hm5
                               (Usize.ofInt 1056 (by intlit))
                           if not (i3 = (U64.ofInt 256 (by intlit)))
                           then Result.fail Error.panic
                           else Result.ret ()
 
 /- Unit test for [hashmap_main::hashmap::test1] -/
-#assert (hashmap.test1_fwd == .ret ())
+#assert (hashmap.test1 == .ret ())
 
-/- [hashmap_main::insert_on_disk] -/
-def insert_on_disk_fwd
+/- [hashmap_main::insert_on_disk]: forward function -/
+def insert_on_disk
   (key : Usize) (value : U64) (st : State) : Result (State × Unit) :=
   do
-    let (st0, hm) ← hashmap_utils.deserialize_fwd st
-    let hm0 ← hashmap.HashMap.insert_fwd_back U64 hm key value
-    let (st1, _) ← hashmap_utils.serialize_fwd hm0 st0
+    let (st0, hm) ← hashmap_utils.deserialize st
+    let hm0 ← hashmap.HashMap.insert U64 hm key value
+    let (st1, _) ← hashmap_utils.serialize hm0 st0
     Result.ret (st1, ())
 
-/- [hashmap_main::main] -/
-def main_fwd : Result Unit :=
+/- [hashmap_main::main]: forward function -/
+def main : Result Unit :=
   Result.ret ()
 
 /- Unit test for [hashmap_main::main] -/
-#assert (main_fwd == .ret ())
+#assert (main == .ret ())
 
 end hashmap_main
diff --git a/tests/lean/HashmapMain/FunsExternal.lean b/tests/lean/HashmapMain/FunsExternal.lean
index 3689dd45..b394b32b 100644
--- a/tests/lean/HashmapMain/FunsExternal.lean
+++ b/tests/lean/HashmapMain/FunsExternal.lean
@@ -7,11 +7,11 @@ open hashmap_main
 -- TODO: fill those bodies
 
 /- [hashmap_main::hashmap_utils::deserialize] -/
-def hashmap_utils.deserialize_fwd
+def hashmap_utils.deserialize
   : State → Result (State × (hashmap.HashMap U64)) :=
   fun _ => .fail .panic
 
 /- [hashmap_main::hashmap_utils::serialize] -/
-def hashmap_utils.serialize_fwd
+def hashmap_utils.serialize
   : hashmap.HashMap U64 → State → Result (State × Unit) :=
   fun _ _ => .fail .panic
diff --git a/tests/lean/HashmapMain/FunsExternal_Template.lean b/tests/lean/HashmapMain/FunsExternal_Template.lean
index 8853b7fc..f537fc8f 100644
--- a/tests/lean/HashmapMain/FunsExternal_Template.lean
+++ b/tests/lean/HashmapMain/FunsExternal_Template.lean
@@ -6,11 +6,11 @@ import HashmapMain.Types
 open Primitives
 open hashmap_main
 
-/- [hashmap_main::hashmap_utils::deserialize] -/
-axiom hashmap_utils.deserialize_fwd
+/- [hashmap_main::hashmap_utils::deserialize]: forward function -/
+axiom hashmap_utils.deserialize
   : State → Result (State × (hashmap.HashMap U64))
 
-/- [hashmap_main::hashmap_utils::serialize] -/
-axiom hashmap_utils.serialize_fwd
+/- [hashmap_main::hashmap_utils::serialize]: forward function -/
+axiom hashmap_utils.serialize
   : hashmap.HashMap U64 → State → Result (State × Unit)
 
diff --git a/tests/lean/Loops/Funs.lean b/tests/lean/Loops/Funs.lean
index 6e6eef3b..8cac7ac0 100644
--- a/tests/lean/Loops/Funs.lean
+++ b/tests/lean/Loops/Funs.lean
@@ -5,82 +5,83 @@ import Loops.Types
 open Primitives
 namespace loops
 
-/- [loops::sum] -/
-divergent def sum_loop_fwd (max : U32) (i : U32) (s : U32) : Result U32 :=
+/- [loops::sum]: loop 0: forward function -/
+divergent def sum_loop (max : U32) (i : U32) (s : U32) : Result U32 :=
   if i < max
   then
     do
       let s0 ← s + i
       let i0 ← i + (U32.ofInt 1 (by intlit))
-      sum_loop_fwd max i0 s0
+      sum_loop max i0 s0
   else s * (U32.ofInt 2 (by intlit))
 
-/- [loops::sum] -/
-def sum_fwd (max : U32) : Result U32 :=
-  sum_loop_fwd max (U32.ofInt 0 (by intlit)) (U32.ofInt 0 (by intlit))
+/- [loops::sum]: forward function -/
+def sum (max : U32) : Result U32 :=
+  sum_loop max (U32.ofInt 0 (by intlit)) (U32.ofInt 0 (by intlit))
 
-/- [loops::sum_with_mut_borrows] -/
-divergent def sum_with_mut_borrows_loop_fwd
+/- [loops::sum_with_mut_borrows]: loop 0: forward function -/
+divergent def sum_with_mut_borrows_loop
   (max : U32) (mi : U32) (ms : U32) : Result U32 :=
   if mi < max
   then
     do
       let ms0 ← ms + mi
       let mi0 ← mi + (U32.ofInt 1 (by intlit))
-      sum_with_mut_borrows_loop_fwd max mi0 ms0
+      sum_with_mut_borrows_loop max mi0 ms0
   else ms * (U32.ofInt 2 (by intlit))
 
-/- [loops::sum_with_mut_borrows] -/
-def sum_with_mut_borrows_fwd (max : U32) : Result U32 :=
-  sum_with_mut_borrows_loop_fwd max (U32.ofInt 0 (by intlit))
+/- [loops::sum_with_mut_borrows]: forward function -/
+def sum_with_mut_borrows (max : U32) : Result U32 :=
+  sum_with_mut_borrows_loop max (U32.ofInt 0 (by intlit))
     (U32.ofInt 0 (by intlit))
 
-/- [loops::sum_with_shared_borrows] -/
-divergent def sum_with_shared_borrows_loop_fwd
+/- [loops::sum_with_shared_borrows]: loop 0: forward function -/
+divergent def sum_with_shared_borrows_loop
   (max : U32) (i : U32) (s : U32) : Result U32 :=
   if i < max
   then
     do
       let i0 ← i + (U32.ofInt 1 (by intlit))
       let s0 ← s + i0
-      sum_with_shared_borrows_loop_fwd max i0 s0
+      sum_with_shared_borrows_loop max i0 s0
   else s * (U32.ofInt 2 (by intlit))
 
-/- [loops::sum_with_shared_borrows] -/
-def sum_with_shared_borrows_fwd (max : U32) : Result U32 :=
-  sum_with_shared_borrows_loop_fwd max (U32.ofInt 0 (by intlit))
+/- [loops::sum_with_shared_borrows]: forward function -/
+def sum_with_shared_borrows (max : U32) : Result U32 :=
+  sum_with_shared_borrows_loop max (U32.ofInt 0 (by intlit))
     (U32.ofInt 0 (by intlit))
 
-/- [loops::clear] -/
-divergent def clear_loop_fwd_back
-  (v : Vec U32) (i : Usize) : Result (Vec U32) :=
+/- [loops::clear]: loop 0: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+divergent def clear_loop (v : Vec U32) (i : Usize) : Result (Vec U32) :=
   let i0 := Vec.len U32 v
   if i < i0
   then
     do
       let i1 ← i + (Usize.ofInt 1 (by intlit))
       let v0 ← Vec.index_mut_back U32 v i (U32.ofInt 0 (by intlit))
-      clear_loop_fwd_back v0 i1
+      clear_loop v0 i1
   else Result.ret v
 
-/- [loops::clear] -/
-def clear_fwd_back (v : Vec U32) : Result (Vec U32) :=
-  clear_loop_fwd_back v (Usize.ofInt 0 (by intlit))
+/- [loops::clear]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def clear (v : Vec U32) : Result (Vec U32) :=
+  clear_loop v (Usize.ofInt 0 (by intlit))
 
-/- [loops::list_mem] -/
-divergent def list_mem_loop_fwd (x : U32) (ls : List U32) : Result Bool :=
+/- [loops::list_mem]: loop 0: forward function -/
+divergent def list_mem_loop (x : U32) (ls : List U32) : Result Bool :=
   match ls with
   | List.Cons y tl => if y = x
                       then Result.ret true
-                      else list_mem_loop_fwd x tl
+                      else list_mem_loop x tl
   | List.Nil => Result.ret false
 
-/- [loops::list_mem] -/
-def list_mem_fwd (x : U32) (ls : List U32) : Result Bool :=
-  list_mem_loop_fwd x ls
+/- [loops::list_mem]: forward function -/
+def list_mem (x : U32) (ls : List U32) : Result Bool :=
+  list_mem_loop x ls
 
-/- [loops::list_nth_mut_loop] -/
-divergent def list_nth_mut_loop_loop_fwd
+/- [loops::list_nth_mut_loop]: loop 0: forward function -/
+divergent def list_nth_mut_loop_loop
   (T : Type) (ls : List T) (i : U32) : Result T :=
   match ls with
   | List.Cons x tl =>
@@ -89,14 +90,14 @@ divergent def list_nth_mut_loop_loop_fwd
     else
       do
         let i0 ← i - (U32.ofInt 1 (by intlit))
-        list_nth_mut_loop_loop_fwd T tl i0
+        list_nth_mut_loop_loop T tl i0
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_mut_loop] -/
-def list_nth_mut_loop_fwd (T : Type) (ls : List T) (i : U32) : Result T :=
-  list_nth_mut_loop_loop_fwd T ls i
+/- [loops::list_nth_mut_loop]: forward function -/
+def list_nth_mut_loop (T : Type) (ls : List T) (i : U32) : Result T :=
+  list_nth_mut_loop_loop T ls i
 
-/- [loops::list_nth_mut_loop] -/
+/- [loops::list_nth_mut_loop]: loop 0: backward function 0 -/
 divergent def list_nth_mut_loop_loop_back
   (T : Type) (ls : List T) (i : U32) (ret0 : T) : Result (List T) :=
   match ls with
@@ -110,13 +111,13 @@ divergent def list_nth_mut_loop_loop_back
         Result.ret (List.Cons x tl0)
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_mut_loop] -/
+/- [loops::list_nth_mut_loop]: backward function 0 -/
 def list_nth_mut_loop_back
   (T : Type) (ls : List T) (i : U32) (ret0 : T) : Result (List T) :=
   list_nth_mut_loop_loop_back T ls i ret0
 
-/- [loops::list_nth_shared_loop] -/
-divergent def list_nth_shared_loop_loop_fwd
+/- [loops::list_nth_shared_loop]: loop 0: forward function -/
+divergent def list_nth_shared_loop_loop
   (T : Type) (ls : List T) (i : U32) : Result T :=
   match ls with
   | List.Cons x tl =>
@@ -125,30 +126,28 @@ divergent def list_nth_shared_loop_loop_fwd
     else
       do
         let i0 ← i - (U32.ofInt 1 (by intlit))
-        list_nth_shared_loop_loop_fwd T tl i0
+        list_nth_shared_loop_loop T tl i0
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_shared_loop] -/
-def list_nth_shared_loop_fwd (T : Type) (ls : List T) (i : U32) : Result T :=
-  list_nth_shared_loop_loop_fwd T ls i
+/- [loops::list_nth_shared_loop]: forward function -/
+def list_nth_shared_loop (T : Type) (ls : List T) (i : U32) : Result T :=
+  list_nth_shared_loop_loop T ls i
 
-/- [loops::get_elem_mut] -/
-divergent def get_elem_mut_loop_fwd
-  (x : Usize) (ls : List Usize) : Result Usize :=
+/- [loops::get_elem_mut]: loop 0: forward function -/
+divergent def get_elem_mut_loop (x : Usize) (ls : List Usize) : Result Usize :=
   match ls with
-  | List.Cons y tl =>
-    if y = x
-    then Result.ret y
-    else get_elem_mut_loop_fwd x tl
+  | List.Cons y tl => if y = x
+                      then Result.ret y
+                      else get_elem_mut_loop x tl
   | List.Nil => Result.fail Error.panic
 
-/- [loops::get_elem_mut] -/
-def get_elem_mut_fwd (slots : Vec (List Usize)) (x : Usize) : Result Usize :=
+/- [loops::get_elem_mut]: forward function -/
+def get_elem_mut (slots : Vec (List Usize)) (x : Usize) : Result Usize :=
   do
     let l ← Vec.index_mut (List Usize) slots (Usize.ofInt 0 (by intlit))
-    get_elem_mut_loop_fwd x l
+    get_elem_mut_loop x l
 
-/- [loops::get_elem_mut] -/
+/- [loops::get_elem_mut]: loop 0: backward function 0 -/
 divergent def get_elem_mut_loop_back
   (x : Usize) (ls : List Usize) (ret0 : Usize) : Result (List Usize) :=
   match ls with
@@ -161,7 +160,7 @@ divergent def get_elem_mut_loop_back
         Result.ret (List.Cons y tl0)
   | List.Nil => Result.fail Error.panic
 
-/- [loops::get_elem_mut] -/
+/- [loops::get_elem_mut]: backward function 0 -/
 def get_elem_mut_back
   (slots : Vec (List Usize)) (x : Usize) (ret0 : Usize) :
   Result (Vec (List Usize))
@@ -171,37 +170,35 @@ def get_elem_mut_back
     let l0 ← get_elem_mut_loop_back x l ret0
     Vec.index_mut_back (List Usize) slots (Usize.ofInt 0 (by intlit)) l0
 
-/- [loops::get_elem_shared] -/
-divergent def get_elem_shared_loop_fwd
+/- [loops::get_elem_shared]: loop 0: forward function -/
+divergent def get_elem_shared_loop
   (x : Usize) (ls : List Usize) : Result Usize :=
   match ls with
-  | List.Cons y tl =>
-    if y = x
-    then Result.ret y
-    else get_elem_shared_loop_fwd x tl
+  | List.Cons y tl => if y = x
+                      then Result.ret y
+                      else get_elem_shared_loop x tl
   | List.Nil => Result.fail Error.panic
 
-/- [loops::get_elem_shared] -/
-def get_elem_shared_fwd
-  (slots : Vec (List Usize)) (x : Usize) : Result Usize :=
+/- [loops::get_elem_shared]: forward function -/
+def get_elem_shared (slots : Vec (List Usize)) (x : Usize) : Result Usize :=
   do
     let l ← Vec.index (List Usize) slots (Usize.ofInt 0 (by intlit))
-    get_elem_shared_loop_fwd x l
+    get_elem_shared_loop x l
 
-/- [loops::id_mut] -/
-def id_mut_fwd (T : Type) (ls : List T) : Result (List T) :=
+/- [loops::id_mut]: forward function -/
+def id_mut (T : Type) (ls : List T) : Result (List T) :=
   Result.ret ls
 
-/- [loops::id_mut] -/
+/- [loops::id_mut]: backward function 0 -/
 def id_mut_back (T : Type) (ls : List T) (ret0 : List T) : Result (List T) :=
   Result.ret ret0
 
-/- [loops::id_shared] -/
-def id_shared_fwd (T : Type) (ls : List T) : Result (List T) :=
+/- [loops::id_shared]: forward function -/
+def id_shared (T : Type) (ls : List T) : Result (List T) :=
   Result.ret ls
 
-/- [loops::list_nth_mut_loop_with_id] -/
-divergent def list_nth_mut_loop_with_id_loop_fwd
+/- [loops::list_nth_mut_loop_with_id]: loop 0: forward function -/
+divergent def list_nth_mut_loop_with_id_loop
   (T : Type) (i : U32) (ls : List T) : Result T :=
   match ls with
   | List.Cons x tl =>
@@ -210,17 +207,16 @@ divergent def list_nth_mut_loop_with_id_loop_fwd
     else
       do
         let i0 ← i - (U32.ofInt 1 (by intlit))
-        list_nth_mut_loop_with_id_loop_fwd T i0 tl
+        list_nth_mut_loop_with_id_loop T i0 tl
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_mut_loop_with_id] -/
-def list_nth_mut_loop_with_id_fwd
-  (T : Type) (ls : List T) (i : U32) : Result T :=
+/- [loops::list_nth_mut_loop_with_id]: forward function -/
+def list_nth_mut_loop_with_id (T : Type) (ls : List T) (i : U32) : Result T :=
   do
-    let ls0 ← id_mut_fwd T ls
-    list_nth_mut_loop_with_id_loop_fwd T i ls0
+    let ls0 ← id_mut T ls
+    list_nth_mut_loop_with_id_loop T i ls0
 
-/- [loops::list_nth_mut_loop_with_id] -/
+/- [loops::list_nth_mut_loop_with_id]: loop 0: backward function 0 -/
 divergent def list_nth_mut_loop_with_id_loop_back
   (T : Type) (i : U32) (ls : List T) (ret0 : T) : Result (List T) :=
   match ls with
@@ -234,16 +230,16 @@ divergent def list_nth_mut_loop_with_id_loop_back
         Result.ret (List.Cons x tl0)
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_mut_loop_with_id] -/
+/- [loops::list_nth_mut_loop_with_id]: backward function 0 -/
 def list_nth_mut_loop_with_id_back
   (T : Type) (ls : List T) (i : U32) (ret0 : T) : Result (List T) :=
   do
-    let ls0 ← id_mut_fwd T ls
+    let ls0 ← id_mut T ls
     let l ← list_nth_mut_loop_with_id_loop_back T i ls0 ret0
     id_mut_back T ls l
 
-/- [loops::list_nth_shared_loop_with_id] -/
-divergent def list_nth_shared_loop_with_id_loop_fwd
+/- [loops::list_nth_shared_loop_with_id]: loop 0: forward function -/
+divergent def list_nth_shared_loop_with_id_loop
   (T : Type) (i : U32) (ls : List T) : Result T :=
   match ls with
   | List.Cons x tl =>
@@ -252,18 +248,18 @@ divergent def list_nth_shared_loop_with_id_loop_fwd
     else
       do
         let i0 ← i - (U32.ofInt 1 (by intlit))
-        list_nth_shared_loop_with_id_loop_fwd T i0 tl
+        list_nth_shared_loop_with_id_loop T i0 tl
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_shared_loop_with_id] -/
-def list_nth_shared_loop_with_id_fwd
+/- [loops::list_nth_shared_loop_with_id]: forward function -/
+def list_nth_shared_loop_with_id
   (T : Type) (ls : List T) (i : U32) : Result T :=
   do
-    let ls0 ← id_shared_fwd T ls
-    list_nth_shared_loop_with_id_loop_fwd T i ls0
+    let ls0 ← id_shared T ls
+    list_nth_shared_loop_with_id_loop T i ls0
 
-/- [loops::list_nth_mut_loop_pair] -/
-divergent def list_nth_mut_loop_pair_loop_fwd
+/- [loops::list_nth_mut_loop_pair]: loop 0: forward function -/
+divergent def list_nth_mut_loop_pair_loop
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
   match ls0 with
   | List.Cons x0 tl0 =>
@@ -274,16 +270,16 @@ divergent def list_nth_mut_loop_pair_loop_fwd
       else
         do
           let i0 ← i - (U32.ofInt 1 (by intlit))
-          list_nth_mut_loop_pair_loop_fwd T tl0 tl1 i0
+          list_nth_mut_loop_pair_loop T tl0 tl1 i0
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_mut_loop_pair] -/
-def list_nth_mut_loop_pair_fwd
+/- [loops::list_nth_mut_loop_pair]: forward function -/
+def list_nth_mut_loop_pair
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  list_nth_mut_loop_pair_loop_fwd T ls0 ls1 i
+  list_nth_mut_loop_pair_loop T ls0 ls1 i
 
-/- [loops::list_nth_mut_loop_pair] -/
+/- [loops::list_nth_mut_loop_pair]: loop 0: backward function 0 -/
 divergent def list_nth_mut_loop_pair_loop_back'a
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret0 : T) :
   Result (List T)
@@ -302,14 +298,14 @@ divergent def list_nth_mut_loop_pair_loop_back'a
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_mut_loop_pair] -/
+/- [loops::list_nth_mut_loop_pair]: backward function 0 -/
 def list_nth_mut_loop_pair_back'a
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret0 : T) :
   Result (List T)
   :=
   list_nth_mut_loop_pair_loop_back'a T ls0 ls1 i ret0
 
-/- [loops::list_nth_mut_loop_pair] -/
+/- [loops::list_nth_mut_loop_pair]: loop 0: backward function 1 -/
 divergent def list_nth_mut_loop_pair_loop_back'b
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret0 : T) :
   Result (List T)
@@ -328,15 +324,15 @@ divergent def list_nth_mut_loop_pair_loop_back'b
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_mut_loop_pair] -/
+/- [loops::list_nth_mut_loop_pair]: backward function 1 -/
 def list_nth_mut_loop_pair_back'b
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret0 : T) :
   Result (List T)
   :=
   list_nth_mut_loop_pair_loop_back'b T ls0 ls1 i ret0
 
-/- [loops::list_nth_shared_loop_pair] -/
-divergent def list_nth_shared_loop_pair_loop_fwd
+/- [loops::list_nth_shared_loop_pair]: loop 0: forward function -/
+divergent def list_nth_shared_loop_pair_loop
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
   match ls0 with
   | List.Cons x0 tl0 =>
@@ -347,17 +343,17 @@ divergent def list_nth_shared_loop_pair_loop_fwd
       else
         do
           let i0 ← i - (U32.ofInt 1 (by intlit))
-          list_nth_shared_loop_pair_loop_fwd T tl0 tl1 i0
+          list_nth_shared_loop_pair_loop T tl0 tl1 i0
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_shared_loop_pair] -/
-def list_nth_shared_loop_pair_fwd
+/- [loops::list_nth_shared_loop_pair]: forward function -/
+def list_nth_shared_loop_pair
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  list_nth_shared_loop_pair_loop_fwd T ls0 ls1 i
+  list_nth_shared_loop_pair_loop T ls0 ls1 i
 
-/- [loops::list_nth_mut_loop_pair_merge] -/
-divergent def list_nth_mut_loop_pair_merge_loop_fwd
+/- [loops::list_nth_mut_loop_pair_merge]: loop 0: forward function -/
+divergent def list_nth_mut_loop_pair_merge_loop
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
   match ls0 with
   | List.Cons x0 tl0 =>
@@ -368,16 +364,16 @@ divergent def list_nth_mut_loop_pair_merge_loop_fwd
       else
         do
           let i0 ← i - (U32.ofInt 1 (by intlit))
-          list_nth_mut_loop_pair_merge_loop_fwd T tl0 tl1 i0
+          list_nth_mut_loop_pair_merge_loop T tl0 tl1 i0
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_mut_loop_pair_merge] -/
-def list_nth_mut_loop_pair_merge_fwd
+/- [loops::list_nth_mut_loop_pair_merge]: forward function -/
+def list_nth_mut_loop_pair_merge
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  list_nth_mut_loop_pair_merge_loop_fwd T ls0 ls1 i
+  list_nth_mut_loop_pair_merge_loop T ls0 ls1 i
 
-/- [loops::list_nth_mut_loop_pair_merge] -/
+/- [loops::list_nth_mut_loop_pair_merge]: loop 0: backward function 0 -/
 divergent def list_nth_mut_loop_pair_merge_loop_back
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret0 : (T × T)) :
   Result ((List T) × (List T))
@@ -398,15 +394,15 @@ divergent def list_nth_mut_loop_pair_merge_loop_back
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_mut_loop_pair_merge] -/
+/- [loops::list_nth_mut_loop_pair_merge]: backward function 0 -/
 def list_nth_mut_loop_pair_merge_back
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret0 : (T × T)) :
   Result ((List T) × (List T))
   :=
   list_nth_mut_loop_pair_merge_loop_back T ls0 ls1 i ret0
 
-/- [loops::list_nth_shared_loop_pair_merge] -/
-divergent def list_nth_shared_loop_pair_merge_loop_fwd
+/- [loops::list_nth_shared_loop_pair_merge]: loop 0: forward function -/
+divergent def list_nth_shared_loop_pair_merge_loop
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
   match ls0 with
   | List.Cons x0 tl0 =>
@@ -417,17 +413,17 @@ divergent def list_nth_shared_loop_pair_merge_loop_fwd
       else
         do
           let i0 ← i - (U32.ofInt 1 (by intlit))
-          list_nth_shared_loop_pair_merge_loop_fwd T tl0 tl1 i0
+          list_nth_shared_loop_pair_merge_loop T tl0 tl1 i0
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_shared_loop_pair_merge] -/
-def list_nth_shared_loop_pair_merge_fwd
+/- [loops::list_nth_shared_loop_pair_merge]: forward function -/
+def list_nth_shared_loop_pair_merge
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  list_nth_shared_loop_pair_merge_loop_fwd T ls0 ls1 i
+  list_nth_shared_loop_pair_merge_loop T ls0 ls1 i
 
-/- [loops::list_nth_mut_shared_loop_pair] -/
-divergent def list_nth_mut_shared_loop_pair_loop_fwd
+/- [loops::list_nth_mut_shared_loop_pair]: loop 0: forward function -/
+divergent def list_nth_mut_shared_loop_pair_loop
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
   match ls0 with
   | List.Cons x0 tl0 =>
@@ -438,16 +434,16 @@ divergent def list_nth_mut_shared_loop_pair_loop_fwd
       else
         do
           let i0 ← i - (U32.ofInt 1 (by intlit))
-          list_nth_mut_shared_loop_pair_loop_fwd T tl0 tl1 i0
+          list_nth_mut_shared_loop_pair_loop T tl0 tl1 i0
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_mut_shared_loop_pair] -/
-def list_nth_mut_shared_loop_pair_fwd
+/- [loops::list_nth_mut_shared_loop_pair]: forward function -/
+def list_nth_mut_shared_loop_pair
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  list_nth_mut_shared_loop_pair_loop_fwd T ls0 ls1 i
+  list_nth_mut_shared_loop_pair_loop T ls0 ls1 i
 
-/- [loops::list_nth_mut_shared_loop_pair] -/
+/- [loops::list_nth_mut_shared_loop_pair]: loop 0: backward function 0 -/
 divergent def list_nth_mut_shared_loop_pair_loop_back
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret0 : T) :
   Result (List T)
@@ -467,15 +463,15 @@ divergent def list_nth_mut_shared_loop_pair_loop_back
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_mut_shared_loop_pair] -/
+/- [loops::list_nth_mut_shared_loop_pair]: backward function 0 -/
 def list_nth_mut_shared_loop_pair_back
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret0 : T) :
   Result (List T)
   :=
   list_nth_mut_shared_loop_pair_loop_back T ls0 ls1 i ret0
 
-/- [loops::list_nth_mut_shared_loop_pair_merge] -/
-divergent def list_nth_mut_shared_loop_pair_merge_loop_fwd
+/- [loops::list_nth_mut_shared_loop_pair_merge]: loop 0: forward function -/
+divergent def list_nth_mut_shared_loop_pair_merge_loop
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
   match ls0 with
   | List.Cons x0 tl0 =>
@@ -486,16 +482,16 @@ divergent def list_nth_mut_shared_loop_pair_merge_loop_fwd
       else
         do
           let i0 ← i - (U32.ofInt 1 (by intlit))
-          list_nth_mut_shared_loop_pair_merge_loop_fwd T tl0 tl1 i0
+          list_nth_mut_shared_loop_pair_merge_loop T tl0 tl1 i0
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_mut_shared_loop_pair_merge] -/
-def list_nth_mut_shared_loop_pair_merge_fwd
+/- [loops::list_nth_mut_shared_loop_pair_merge]: forward function -/
+def list_nth_mut_shared_loop_pair_merge
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  list_nth_mut_shared_loop_pair_merge_loop_fwd T ls0 ls1 i
+  list_nth_mut_shared_loop_pair_merge_loop T ls0 ls1 i
 
-/- [loops::list_nth_mut_shared_loop_pair_merge] -/
+/- [loops::list_nth_mut_shared_loop_pair_merge]: loop 0: backward function 0 -/
 divergent def list_nth_mut_shared_loop_pair_merge_loop_back
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret0 : T) :
   Result (List T)
@@ -515,15 +511,15 @@ divergent def list_nth_mut_shared_loop_pair_merge_loop_back
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_mut_shared_loop_pair_merge] -/
+/- [loops::list_nth_mut_shared_loop_pair_merge]: backward function 0 -/
 def list_nth_mut_shared_loop_pair_merge_back
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret0 : T) :
   Result (List T)
   :=
   list_nth_mut_shared_loop_pair_merge_loop_back T ls0 ls1 i ret0
 
-/- [loops::list_nth_shared_mut_loop_pair] -/
-divergent def list_nth_shared_mut_loop_pair_loop_fwd
+/- [loops::list_nth_shared_mut_loop_pair]: loop 0: forward function -/
+divergent def list_nth_shared_mut_loop_pair_loop
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
   match ls0 with
   | List.Cons x0 tl0 =>
@@ -534,16 +530,16 @@ divergent def list_nth_shared_mut_loop_pair_loop_fwd
       else
         do
           let i0 ← i - (U32.ofInt 1 (by intlit))
-          list_nth_shared_mut_loop_pair_loop_fwd T tl0 tl1 i0
+          list_nth_shared_mut_loop_pair_loop T tl0 tl1 i0
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_shared_mut_loop_pair] -/
-def list_nth_shared_mut_loop_pair_fwd
+/- [loops::list_nth_shared_mut_loop_pair]: forward function -/
+def list_nth_shared_mut_loop_pair
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  list_nth_shared_mut_loop_pair_loop_fwd T ls0 ls1 i
+  list_nth_shared_mut_loop_pair_loop T ls0 ls1 i
 
-/- [loops::list_nth_shared_mut_loop_pair] -/
+/- [loops::list_nth_shared_mut_loop_pair]: loop 0: backward function 1 -/
 divergent def list_nth_shared_mut_loop_pair_loop_back
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret0 : T) :
   Result (List T)
@@ -563,15 +559,15 @@ divergent def list_nth_shared_mut_loop_pair_loop_back
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_shared_mut_loop_pair] -/
+/- [loops::list_nth_shared_mut_loop_pair]: backward function 1 -/
 def list_nth_shared_mut_loop_pair_back
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret0 : T) :
   Result (List T)
   :=
   list_nth_shared_mut_loop_pair_loop_back T ls0 ls1 i ret0
 
-/- [loops::list_nth_shared_mut_loop_pair_merge] -/
-divergent def list_nth_shared_mut_loop_pair_merge_loop_fwd
+/- [loops::list_nth_shared_mut_loop_pair_merge]: loop 0: forward function -/
+divergent def list_nth_shared_mut_loop_pair_merge_loop
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
   match ls0 with
   | List.Cons x0 tl0 =>
@@ -582,16 +578,16 @@ divergent def list_nth_shared_mut_loop_pair_merge_loop_fwd
       else
         do
           let i0 ← i - (U32.ofInt 1 (by intlit))
-          list_nth_shared_mut_loop_pair_merge_loop_fwd T tl0 tl1 i0
+          list_nth_shared_mut_loop_pair_merge_loop T tl0 tl1 i0
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_shared_mut_loop_pair_merge] -/
-def list_nth_shared_mut_loop_pair_merge_fwd
+/- [loops::list_nth_shared_mut_loop_pair_merge]: forward function -/
+def list_nth_shared_mut_loop_pair_merge
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) : Result (T × T) :=
-  list_nth_shared_mut_loop_pair_merge_loop_fwd T ls0 ls1 i
+  list_nth_shared_mut_loop_pair_merge_loop T ls0 ls1 i
 
-/- [loops::list_nth_shared_mut_loop_pair_merge] -/
+/- [loops::list_nth_shared_mut_loop_pair_merge]: loop 0: backward function 0 -/
 divergent def list_nth_shared_mut_loop_pair_merge_loop_back
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret0 : T) :
   Result (List T)
@@ -611,7 +607,7 @@ divergent def list_nth_shared_mut_loop_pair_merge_loop_back
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
 
-/- [loops::list_nth_shared_mut_loop_pair_merge] -/
+/- [loops::list_nth_shared_mut_loop_pair_merge]: backward function 0 -/
 def list_nth_shared_mut_loop_pair_merge_back
   (T : Type) (ls0 : List T) (ls1 : List T) (i : U32) (ret0 : T) :
   Result (List T)
diff --git a/tests/lean/NoNestedBorrows.lean b/tests/lean/NoNestedBorrows.lean
index e4fa7612..dc744a29 100644
--- a/tests/lean/NoNestedBorrows.lean
+++ b/tests/lean/NoNestedBorrows.lean
@@ -35,64 +35,64 @@ inductive Sum (T1 T2 : Type) :=
 | Left : T1 → Sum T1 T2
 | Right : T2 → Sum T1 T2
 
-/- [no_nested_borrows::neg_test] -/
-def neg_test_fwd (x : I32) : Result I32 :=
+/- [no_nested_borrows::neg_test]: forward function -/
+def neg_test (x : I32) : Result I32 :=
   - x
 
-/- [no_nested_borrows::add_test] -/
-def add_test_fwd (x : U32) (y : U32) : Result U32 :=
+/- [no_nested_borrows::add_test]: forward function -/
+def add_test (x : U32) (y : U32) : Result U32 :=
   x + y
 
-/- [no_nested_borrows::subs_test] -/
-def subs_test_fwd (x : U32) (y : U32) : Result U32 :=
+/- [no_nested_borrows::subs_test]: forward function -/
+def subs_test (x : U32) (y : U32) : Result U32 :=
   x - y
 
-/- [no_nested_borrows::div_test] -/
-def div_test_fwd (x : U32) (y : U32) : Result U32 :=
+/- [no_nested_borrows::div_test]: forward function -/
+def div_test (x : U32) (y : U32) : Result U32 :=
   x / y
 
-/- [no_nested_borrows::div_test1] -/
-def div_test1_fwd (x : U32) : Result U32 :=
+/- [no_nested_borrows::div_test1]: forward function -/
+def div_test1 (x : U32) : Result U32 :=
   x / (U32.ofInt 2 (by intlit))
 
-/- [no_nested_borrows::rem_test] -/
-def rem_test_fwd (x : U32) (y : U32) : Result U32 :=
+/- [no_nested_borrows::rem_test]: forward function -/
+def rem_test (x : U32) (y : U32) : Result U32 :=
   x % y
 
-/- [no_nested_borrows::cast_test] -/
-def cast_test_fwd (x : U32) : Result I32 :=
+/- [no_nested_borrows::cast_test]: forward function -/
+def cast_test (x : U32) : Result I32 :=
   Scalar.cast .I32 x
 
-/- [no_nested_borrows::test2] -/
-def test2_fwd : Result Unit :=
+/- [no_nested_borrows::test2]: forward function -/
+def test2 : Result Unit :=
   do
     let _ ← (U32.ofInt 23 (by intlit)) + (U32.ofInt 44 (by intlit))
     Result.ret ()
 
 /- Unit test for [no_nested_borrows::test2] -/
-#assert (test2_fwd == .ret ())
+#assert (test2 == .ret ())
 
-/- [no_nested_borrows::get_max] -/
-def get_max_fwd (x : U32) (y : U32) : Result U32 :=
+/- [no_nested_borrows::get_max]: forward function -/
+def get_max (x : U32) (y : U32) : Result U32 :=
   if x >= y
   then Result.ret x
   else Result.ret y
 
-/- [no_nested_borrows::test3] -/
-def test3_fwd : Result Unit :=
+/- [no_nested_borrows::test3]: forward function -/
+def test3 : Result Unit :=
   do
-    let x ← get_max_fwd (U32.ofInt 4 (by intlit)) (U32.ofInt 3 (by intlit))
-    let y ← get_max_fwd (U32.ofInt 10 (by intlit)) (U32.ofInt 11 (by intlit))
+    let x ← get_max (U32.ofInt 4 (by intlit)) (U32.ofInt 3 (by intlit))
+    let y ← get_max (U32.ofInt 10 (by intlit)) (U32.ofInt 11 (by intlit))
     let z ← x + y
     if not (z = (U32.ofInt 15 (by intlit)))
     then Result.fail Error.panic
     else Result.ret ()
 
 /- Unit test for [no_nested_borrows::test3] -/
-#assert (test3_fwd == .ret ())
+#assert (test3 == .ret ())
 
-/- [no_nested_borrows::test_neg1] -/
-def test_neg1_fwd : Result Unit :=
+/- [no_nested_borrows::test_neg1]: forward function -/
+def test_neg1 : Result Unit :=
   do
     let y ← - (I32.ofInt 3 (by intlit))
     if not (y = (I32.ofInt (-(3:Int)) (by intlit)))
@@ -100,19 +100,19 @@ def test_neg1_fwd : Result Unit :=
     else Result.ret ()
 
 /- Unit test for [no_nested_borrows::test_neg1] -/
-#assert (test_neg1_fwd == .ret ())
+#assert (test_neg1 == .ret ())
 
-/- [no_nested_borrows::refs_test1] -/
-def refs_test1_fwd : Result Unit :=
+/- [no_nested_borrows::refs_test1]: forward function -/
+def refs_test1 : Result Unit :=
   if not ((I32.ofInt 1 (by intlit)) = (I32.ofInt 1 (by intlit)))
   then Result.fail Error.panic
   else Result.ret ()
 
 /- Unit test for [no_nested_borrows::refs_test1] -/
-#assert (refs_test1_fwd == .ret ())
+#assert (refs_test1 == .ret ())
 
-/- [no_nested_borrows::refs_test2] -/
-def refs_test2_fwd : Result Unit :=
+/- [no_nested_borrows::refs_test2]: forward function -/
+def refs_test2 : Result Unit :=
   if not ((I32.ofInt 2 (by intlit)) = (I32.ofInt 2 (by intlit)))
   then Result.fail Error.panic
   else
@@ -127,17 +127,17 @@ def refs_test2_fwd : Result Unit :=
         else Result.ret ()
 
 /- Unit test for [no_nested_borrows::refs_test2] -/
-#assert (refs_test2_fwd == .ret ())
+#assert (refs_test2 == .ret ())
 
-/- [no_nested_borrows::test_list1] -/
-def test_list1_fwd : Result Unit :=
+/- [no_nested_borrows::test_list1]: forward function -/
+def test_list1 : Result Unit :=
   Result.ret ()
 
 /- Unit test for [no_nested_borrows::test_list1] -/
-#assert (test_list1_fwd == .ret ())
+#assert (test_list1 == .ret ())
 
-/- [no_nested_borrows::test_box1] -/
-def test_box1_fwd : Result Unit :=
+/- [no_nested_borrows::test_box1]: forward function -/
+def test_box1 : Result Unit :=
   let b := (I32.ofInt 1 (by intlit))
   let x := b
   if not (x = (I32.ofInt 1 (by intlit)))
@@ -145,90 +145,90 @@ def test_box1_fwd : Result Unit :=
   else Result.ret ()
 
 /- Unit test for [no_nested_borrows::test_box1] -/
-#assert (test_box1_fwd == .ret ())
+#assert (test_box1 == .ret ())
 
-/- [no_nested_borrows::copy_int] -/
-def copy_int_fwd (x : I32) : Result I32 :=
+/- [no_nested_borrows::copy_int]: forward function -/
+def copy_int (x : I32) : Result I32 :=
   Result.ret x
 
-/- [no_nested_borrows::test_unreachable] -/
-def test_unreachable_fwd (b : Bool) : Result Unit :=
+/- [no_nested_borrows::test_unreachable]: forward function -/
+def test_unreachable (b : Bool) : Result Unit :=
   if b
   then Result.fail Error.panic
   else Result.ret ()
 
-/- [no_nested_borrows::test_panic] -/
-def test_panic_fwd (b : Bool) : Result Unit :=
+/- [no_nested_borrows::test_panic]: forward function -/
+def test_panic (b : Bool) : Result Unit :=
   if b
   then Result.fail Error.panic
   else Result.ret ()
 
-/- [no_nested_borrows::test_copy_int] -/
-def test_copy_int_fwd : Result Unit :=
+/- [no_nested_borrows::test_copy_int]: forward function -/
+def test_copy_int : Result Unit :=
   do
-    let y ← copy_int_fwd (I32.ofInt 0 (by intlit))
+    let y ← copy_int (I32.ofInt 0 (by intlit))
     if not ((I32.ofInt 0 (by intlit)) = y)
     then Result.fail Error.panic
     else Result.ret ()
 
 /- Unit test for [no_nested_borrows::test_copy_int] -/
-#assert (test_copy_int_fwd == .ret ())
+#assert (test_copy_int == .ret ())
 
-/- [no_nested_borrows::is_cons] -/
-def is_cons_fwd (T : Type) (l : List T) : Result Bool :=
+/- [no_nested_borrows::is_cons]: forward function -/
+def is_cons (T : Type) (l : List T) : Result Bool :=
   match l with
   | List.Cons t l0 => Result.ret true
   | List.Nil => Result.ret false
 
-/- [no_nested_borrows::test_is_cons] -/
-def test_is_cons_fwd : Result Unit :=
+/- [no_nested_borrows::test_is_cons]: forward function -/
+def test_is_cons : Result Unit :=
   do
     let l := List.Nil
-    let b ← is_cons_fwd I32 (List.Cons (I32.ofInt 0 (by intlit)) l)
+    let b ← is_cons I32 (List.Cons (I32.ofInt 0 (by intlit)) l)
     if not b
     then Result.fail Error.panic
     else Result.ret ()
 
 /- Unit test for [no_nested_borrows::test_is_cons] -/
-#assert (test_is_cons_fwd == .ret ())
+#assert (test_is_cons == .ret ())
 
-/- [no_nested_borrows::split_list] -/
-def split_list_fwd (T : Type) (l : List T) : Result (T × (List T)) :=
+/- [no_nested_borrows::split_list]: forward function -/
+def split_list (T : Type) (l : List T) : Result (T × (List T)) :=
   match l with
   | List.Cons hd tl => Result.ret (hd, tl)
   | List.Nil => Result.fail Error.panic
 
-/- [no_nested_borrows::test_split_list] -/
-def test_split_list_fwd : Result Unit :=
+/- [no_nested_borrows::test_split_list]: forward function -/
+def test_split_list : Result Unit :=
   do
     let l := List.Nil
-    let p ← split_list_fwd I32 (List.Cons (I32.ofInt 0 (by intlit)) l)
+    let p ← split_list I32 (List.Cons (I32.ofInt 0 (by intlit)) l)
     let (hd, _) := p
     if not (hd = (I32.ofInt 0 (by intlit)))
     then Result.fail Error.panic
     else Result.ret ()
 
 /- Unit test for [no_nested_borrows::test_split_list] -/
-#assert (test_split_list_fwd == .ret ())
+#assert (test_split_list == .ret ())
 
-/- [no_nested_borrows::choose] -/
-def choose_fwd (T : Type) (b : Bool) (x : T) (y : T) : Result T :=
+/- [no_nested_borrows::choose]: forward function -/
+def choose (T : Type) (b : Bool) (x : T) (y : T) : Result T :=
   if b
   then Result.ret x
   else Result.ret y
 
-/- [no_nested_borrows::choose] -/
+/- [no_nested_borrows::choose]: backward function 0 -/
 def choose_back
   (T : Type) (b : Bool) (x : T) (y : T) (ret0 : T) : Result (T × T) :=
   if b
   then Result.ret (ret0, y)
   else Result.ret (x, ret0)
 
-/- [no_nested_borrows::choose_test] -/
-def choose_test_fwd : Result Unit :=
+/- [no_nested_borrows::choose_test]: forward function -/
+def choose_test : Result Unit :=
   do
     let z ←
-      choose_fwd I32 true (I32.ofInt 0 (by intlit)) (I32.ofInt 0 (by intlit))
+      choose I32 true (I32.ofInt 0 (by intlit)) (I32.ofInt 0 (by intlit))
     let z0 ← z + (I32.ofInt 1 (by intlit))
     if not (z0 = (I32.ofInt 1 (by intlit)))
     then Result.fail Error.panic
@@ -245,10 +245,10 @@ def choose_test_fwd : Result Unit :=
           else Result.ret ()
 
 /- Unit test for [no_nested_borrows::choose_test] -/
-#assert (choose_test_fwd == .ret ())
+#assert (choose_test == .ret ())
 
-/- [no_nested_borrows::test_char] -/
-def test_char_fwd : Result Char :=
+/- [no_nested_borrows::test_char]: forward function -/
+def test_char : Result Char :=
   Result.ret 'a'
 
 mutual
@@ -265,40 +265,38 @@ inductive Tree (T : Type) :=
 
 end
 
-/- [no_nested_borrows::list_length] -/
-divergent def list_length_fwd (T : Type) (l : List T) : Result U32 :=
+/- [no_nested_borrows::list_length]: forward function -/
+divergent def list_length (T : Type) (l : List T) : Result U32 :=
   match l with
   | List.Cons t l1 =>
     do
-      let i ← list_length_fwd T l1
+      let i ← list_length T l1
       (U32.ofInt 1 (by intlit)) + i
   | List.Nil => Result.ret (U32.ofInt 0 (by intlit))
 
-/- [no_nested_borrows::list_nth_shared] -/
-divergent def list_nth_shared_fwd
-  (T : Type) (l : List T) (i : U32) : Result T :=
+/- [no_nested_borrows::list_nth_shared]: forward function -/
+divergent def list_nth_shared (T : Type) (l : List T) (i : U32) : Result T :=
   match l with
   | List.Cons x tl =>
     if i = (U32.ofInt 0 (by intlit))
     then Result.ret x
-    else
-      do
-        let i0 ← i - (U32.ofInt 1 (by intlit))
-        list_nth_shared_fwd T tl i0
+    else do
+           let i0 ← i - (U32.ofInt 1 (by intlit))
+           list_nth_shared T tl i0
   | List.Nil => Result.fail Error.panic
 
-/- [no_nested_borrows::list_nth_mut] -/
-divergent def list_nth_mut_fwd (T : Type) (l : List T) (i : U32) : Result T :=
+/- [no_nested_borrows::list_nth_mut]: forward function -/
+divergent def list_nth_mut (T : Type) (l : List T) (i : U32) : Result T :=
   match l with
   | List.Cons x tl =>
     if i = (U32.ofInt 0 (by intlit))
     then Result.ret x
     else do
            let i0 ← i - (U32.ofInt 1 (by intlit))
-           list_nth_mut_fwd T tl i0
+           list_nth_mut T tl i0
   | List.Nil => Result.fail Error.panic
 
-/- [no_nested_borrows::list_nth_mut] -/
+/- [no_nested_borrows::list_nth_mut]: backward function 0 -/
 divergent def list_nth_mut_back
   (T : Type) (l : List T) (i : U32) (ret0 : T) : Result (List T) :=
   match l with
@@ -312,46 +310,47 @@ divergent def list_nth_mut_back
         Result.ret (List.Cons x tl0)
   | List.Nil => Result.fail Error.panic
 
-/- [no_nested_borrows::list_rev_aux] -/
-divergent def list_rev_aux_fwd
+/- [no_nested_borrows::list_rev_aux]: forward function -/
+divergent def list_rev_aux
   (T : Type) (li : List T) (lo : List T) : Result (List T) :=
   match li with
-  | List.Cons hd tl => list_rev_aux_fwd T tl (List.Cons hd lo)
+  | List.Cons hd tl => list_rev_aux T tl (List.Cons hd lo)
   | List.Nil => Result.ret lo
 
-/- [no_nested_borrows::list_rev] -/
-def list_rev_fwd_back (T : Type) (l : List T) : Result (List T) :=
-  let li := mem.replace_fwd (List T) l List.Nil
-  list_rev_aux_fwd T li List.Nil
+/- [no_nested_borrows::list_rev]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def list_rev (T : Type) (l : List T) : Result (List T) :=
+  let li := mem.replace (List T) l List.Nil
+  list_rev_aux T li List.Nil
 
-/- [no_nested_borrows::test_list_functions] -/
-def test_list_functions_fwd : Result Unit :=
+/- [no_nested_borrows::test_list_functions]: forward function -/
+def test_list_functions : Result Unit :=
   do
     let l := List.Nil
     let l0 := List.Cons (I32.ofInt 2 (by intlit)) l
     let l1 := List.Cons (I32.ofInt 1 (by intlit)) l0
-    let i ← list_length_fwd I32 (List.Cons (I32.ofInt 0 (by intlit)) l1)
+    let i ← list_length I32 (List.Cons (I32.ofInt 0 (by intlit)) l1)
     if not (i = (U32.ofInt 3 (by intlit)))
     then Result.fail Error.panic
     else
       do
         let i0 ←
-          list_nth_shared_fwd I32 (List.Cons (I32.ofInt 0 (by intlit)) l1)
+          list_nth_shared I32 (List.Cons (I32.ofInt 0 (by intlit)) l1)
             (U32.ofInt 0 (by intlit))
         if not (i0 = (I32.ofInt 0 (by intlit)))
         then Result.fail Error.panic
         else
           do
             let i1 ←
-              list_nth_shared_fwd I32 (List.Cons (I32.ofInt 0 (by intlit)) l1)
+              list_nth_shared I32 (List.Cons (I32.ofInt 0 (by intlit)) l1)
                 (U32.ofInt 1 (by intlit))
             if not (i1 = (I32.ofInt 1 (by intlit)))
             then Result.fail Error.panic
             else
               do
                 let i2 ←
-                  list_nth_shared_fwd I32 (List.Cons (I32.ofInt 0 (by intlit))
-                    l1) (U32.ofInt 2 (by intlit))
+                  list_nth_shared I32 (List.Cons (I32.ofInt 0 (by intlit)) l1)
+                    (U32.ofInt 2 (by intlit))
                 if not (i2 = (I32.ofInt 2 (by intlit)))
                 then Result.fail Error.panic
                 else
@@ -360,74 +359,72 @@ def test_list_functions_fwd : Result Unit :=
                       list_nth_mut_back I32 (List.Cons
                         (I32.ofInt 0 (by intlit)) l1) (U32.ofInt 1 (by intlit))
                         (I32.ofInt 3 (by intlit))
-                    let i3 ←
-                      list_nth_shared_fwd I32 ls (U32.ofInt 0 (by intlit))
+                    let i3 ← list_nth_shared I32 ls (U32.ofInt 0 (by intlit))
                     if not (i3 = (I32.ofInt 0 (by intlit)))
                     then Result.fail Error.panic
                     else
                       do
                         let i4 ←
-                          list_nth_shared_fwd I32 ls (U32.ofInt 1 (by intlit))
+                          list_nth_shared I32 ls (U32.ofInt 1 (by intlit))
                         if not (i4 = (I32.ofInt 3 (by intlit)))
                         then Result.fail Error.panic
                         else
                           do
                             let i5 ←
-                              list_nth_shared_fwd I32 ls
-                                (U32.ofInt 2 (by intlit))
+                              list_nth_shared I32 ls (U32.ofInt 2 (by intlit))
                             if not (i5 = (I32.ofInt 2 (by intlit)))
                             then Result.fail Error.panic
                             else Result.ret ()
 
 /- Unit test for [no_nested_borrows::test_list_functions] -/
-#assert (test_list_functions_fwd == .ret ())
+#assert (test_list_functions == .ret ())
 
-/- [no_nested_borrows::id_mut_pair1] -/
-def id_mut_pair1_fwd (T1 T2 : Type) (x : T1) (y : T2) : Result (T1 × T2) :=
+/- [no_nested_borrows::id_mut_pair1]: forward function -/
+def id_mut_pair1 (T1 T2 : Type) (x : T1) (y : T2) : Result (T1 × T2) :=
   Result.ret (x, y)
 
-/- [no_nested_borrows::id_mut_pair1] -/
+/- [no_nested_borrows::id_mut_pair1]: backward function 0 -/
 def id_mut_pair1_back
   (T1 T2 : Type) (x : T1) (y : T2) (ret0 : (T1 × T2)) : Result (T1 × T2) :=
   let (t, t0) := ret0
   Result.ret (t, t0)
 
-/- [no_nested_borrows::id_mut_pair2] -/
-def id_mut_pair2_fwd (T1 T2 : Type) (p : (T1 × T2)) : Result (T1 × T2) :=
+/- [no_nested_borrows::id_mut_pair2]: forward function -/
+def id_mut_pair2 (T1 T2 : Type) (p : (T1 × T2)) : Result (T1 × T2) :=
   let (t, t0) := p
   Result.ret (t, t0)
 
-/- [no_nested_borrows::id_mut_pair2] -/
+/- [no_nested_borrows::id_mut_pair2]: backward function 0 -/
 def id_mut_pair2_back
   (T1 T2 : Type) (p : (T1 × T2)) (ret0 : (T1 × T2)) : Result (T1 × T2) :=
   let (t, t0) := ret0
   Result.ret (t, t0)
 
-/- [no_nested_borrows::id_mut_pair3] -/
-def id_mut_pair3_fwd (T1 T2 : Type) (x : T1) (y : T2) : Result (T1 × T2) :=
+/- [no_nested_borrows::id_mut_pair3]: forward function -/
+def id_mut_pair3 (T1 T2 : Type) (x : T1) (y : T2) : Result (T1 × T2) :=
   Result.ret (x, y)
 
-/- [no_nested_borrows::id_mut_pair3] -/
+/- [no_nested_borrows::id_mut_pair3]: backward function 0 -/
 def id_mut_pair3_back'a
   (T1 T2 : Type) (x : T1) (y : T2) (ret0 : T1) : Result T1 :=
   Result.ret ret0
 
-/- [no_nested_borrows::id_mut_pair3] -/
+/- [no_nested_borrows::id_mut_pair3]: backward function 1 -/
 def id_mut_pair3_back'b
   (T1 T2 : Type) (x : T1) (y : T2) (ret0 : T2) : Result T2 :=
   Result.ret ret0
 
-/- [no_nested_borrows::id_mut_pair4] -/
-def id_mut_pair4_fwd (T1 T2 : Type) (p : (T1 × T2)) : Result (T1 × T2) :=
+/- [no_nested_borrows::id_mut_pair4]: forward function -/
+def id_mut_pair4 (T1 T2 : Type) (p : (T1 × T2)) : Result (T1 × T2) :=
   let (t, t0) := p
   Result.ret (t, t0)
 
-/- [no_nested_borrows::id_mut_pair4] -/
+/- [no_nested_borrows::id_mut_pair4]: backward function 0 -/
 def id_mut_pair4_back'a
   (T1 T2 : Type) (p : (T1 × T2)) (ret0 : T1) : Result T1 :=
   Result.ret ret0
 
-/- [no_nested_borrows::id_mut_pair4] -/
+/- [no_nested_borrows::id_mut_pair4]: backward function 1 -/
 def id_mut_pair4_back'b
   (T1 T2 : Type) (p : (T1 × T2)) (ret0 : T2) : Result T2 :=
   Result.ret ret0
@@ -436,24 +433,24 @@ def id_mut_pair4_back'b
 structure StructWithTuple (T1 T2 : Type) where
   struct_with_tuple_p : (T1 × T2)
 
-/- [no_nested_borrows::new_tuple1] -/
-def new_tuple1_fwd : Result (StructWithTuple U32 U32) :=
+/- [no_nested_borrows::new_tuple1]: forward function -/
+def new_tuple1 : Result (StructWithTuple U32 U32) :=
   Result.ret
   {
     struct_with_tuple_p :=
       ((U32.ofInt 1 (by intlit)), (U32.ofInt 2 (by intlit)))
   }
 
-/- [no_nested_borrows::new_tuple2] -/
-def new_tuple2_fwd : Result (StructWithTuple I16 I16) :=
+/- [no_nested_borrows::new_tuple2]: forward function -/
+def new_tuple2 : Result (StructWithTuple I16 I16) :=
   Result.ret
   {
     struct_with_tuple_p :=
       ((I16.ofInt 1 (by intlit)), (I16.ofInt 2 (by intlit)))
   }
 
-/- [no_nested_borrows::new_tuple3] -/
-def new_tuple3_fwd : Result (StructWithTuple U64 I64) :=
+/- [no_nested_borrows::new_tuple3]: forward function -/
+def new_tuple3 : Result (StructWithTuple U64 I64) :=
   Result.ret
   {
     struct_with_tuple_p :=
@@ -464,8 +461,8 @@ def new_tuple3_fwd : Result (StructWithTuple U64 I64) :=
 structure StructWithPair (T1 T2 : Type) where
   struct_with_pair_p : Pair T1 T2
 
-/- [no_nested_borrows::new_pair1] -/
-def new_pair1_fwd : Result (StructWithPair U32 U32) :=
+/- [no_nested_borrows::new_pair1]: forward function -/
+def new_pair1 : Result (StructWithPair U32 U32) :=
   Result.ret
   {
     struct_with_pair_p :=
@@ -475,68 +472,69 @@ def new_pair1_fwd : Result (StructWithPair U32 U32) :=
       }
   }
 
-/- [no_nested_borrows::test_constants] -/
-def test_constants_fwd : Result Unit :=
+/- [no_nested_borrows::test_constants]: forward function -/
+def test_constants : Result Unit :=
   do
-    let swt ← new_tuple1_fwd
+    let swt ← new_tuple1
     let (i, _) := swt.struct_with_tuple_p
     if not (i = (U32.ofInt 1 (by intlit)))
     then Result.fail Error.panic
     else
       do
-        let swt0 ← new_tuple2_fwd
+        let swt0 ← new_tuple2
         let (i0, _) := swt0.struct_with_tuple_p
         if not (i0 = (I16.ofInt 1 (by intlit)))
         then Result.fail Error.panic
         else
           do
-            let swt1 ← new_tuple3_fwd
+            let swt1 ← new_tuple3
             let (i1, _) := swt1.struct_with_tuple_p
             if not (i1 = (U64.ofInt 1 (by intlit)))
             then Result.fail Error.panic
             else
               do
-                let swp ← new_pair1_fwd
+                let swp ← new_pair1
                 if not (swp.struct_with_pair_p.pair_x =
                   (U32.ofInt 1 (by intlit)))
                 then Result.fail Error.panic
                 else Result.ret ()
 
 /- Unit test for [no_nested_borrows::test_constants] -/
-#assert (test_constants_fwd == .ret ())
+#assert (test_constants == .ret ())
 
-/- [no_nested_borrows::test_weird_borrows1] -/
-def test_weird_borrows1_fwd : Result Unit :=
+/- [no_nested_borrows::test_weird_borrows1]: forward function -/
+def test_weird_borrows1 : Result Unit :=
   Result.ret ()
 
 /- Unit test for [no_nested_borrows::test_weird_borrows1] -/
-#assert (test_weird_borrows1_fwd == .ret ())
+#assert (test_weird_borrows1 == .ret ())
 
-/- [no_nested_borrows::test_mem_replace] -/
-def test_mem_replace_fwd_back (px : U32) : Result U32 :=
-  let y := mem.replace_fwd U32 px (U32.ofInt 1 (by intlit))
+/- [no_nested_borrows::test_mem_replace]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def test_mem_replace (px : U32) : Result U32 :=
+  let y := mem.replace U32 px (U32.ofInt 1 (by intlit))
   if not (y = (U32.ofInt 0 (by intlit)))
   then Result.fail Error.panic
   else Result.ret (U32.ofInt 2 (by intlit))
 
-/- [no_nested_borrows::test_shared_borrow_bool1] -/
-def test_shared_borrow_bool1_fwd (b : Bool) : Result U32 :=
+/- [no_nested_borrows::test_shared_borrow_bool1]: forward function -/
+def test_shared_borrow_bool1 (b : Bool) : Result U32 :=
   if b
   then Result.ret (U32.ofInt 0 (by intlit))
   else Result.ret (U32.ofInt 1 (by intlit))
 
-/- [no_nested_borrows::test_shared_borrow_bool2] -/
-def test_shared_borrow_bool2_fwd : Result U32 :=
+/- [no_nested_borrows::test_shared_borrow_bool2]: forward function -/
+def test_shared_borrow_bool2 : Result U32 :=
   Result.ret (U32.ofInt 0 (by intlit))
 
-/- [no_nested_borrows::test_shared_borrow_enum1] -/
-def test_shared_borrow_enum1_fwd (l : List U32) : Result U32 :=
+/- [no_nested_borrows::test_shared_borrow_enum1]: forward function -/
+def test_shared_borrow_enum1 (l : List U32) : Result U32 :=
   match l with
   | List.Cons i l0 => Result.ret (U32.ofInt 1 (by intlit))
   | List.Nil => Result.ret (U32.ofInt 0 (by intlit))
 
-/- [no_nested_borrows::test_shared_borrow_enum2] -/
-def test_shared_borrow_enum2_fwd : Result U32 :=
+/- [no_nested_borrows::test_shared_borrow_enum2]: forward function -/
+def test_shared_borrow_enum2 : Result U32 :=
   Result.ret (U32.ofInt 0 (by intlit))
 
 end no_nested_borrows
diff --git a/tests/lean/Paper.lean b/tests/lean/Paper.lean
index 9f63b460..ade65656 100644
--- a/tests/lean/Paper.lean
+++ b/tests/lean/Paper.lean
@@ -4,39 +4,40 @@ import Base
 open Primitives
 namespace paper
 
-/- [paper::ref_incr] -/
-def ref_incr_fwd_back (x : I32) : Result I32 :=
+/- [paper::ref_incr]: merged forward/backward function
+   (there is a single backward function, and the forward function returns ()) -/
+def ref_incr (x : I32) : Result I32 :=
   x + (I32.ofInt 1 (by intlit))
 
-/- [paper::test_incr] -/
-def test_incr_fwd : Result Unit :=
+/- [paper::test_incr]: forward function -/
+def test_incr : Result Unit :=
   do
-    let x ← ref_incr_fwd_back (I32.ofInt 0 (by intlit))
+    let x ← ref_incr (I32.ofInt 0 (by intlit))
     if not (x = (I32.ofInt 1 (by intlit)))
     then Result.fail Error.panic
     else Result.ret ()
 
 /- Unit test for [paper::test_incr] -/
-#assert (test_incr_fwd == .ret ())
+#assert (test_incr == .ret ())
 
-/- [paper::choose] -/
-def choose_fwd (T : Type) (b : Bool) (x : T) (y : T) : Result T :=
+/- [paper::choose]: forward function -/
+def choose (T : Type) (b : Bool) (x : T) (y : T) : Result T :=
   if b
   then Result.ret x
   else Result.ret y
 
-/- [paper::choose] -/
+/- [paper::choose]: backward function 0 -/
 def choose_back
   (T : Type) (b : Bool) (x : T) (y : T) (ret0 : T) : Result (T × T) :=
   if b
   then Result.ret (ret0, y)
   else Result.ret (x, ret0)
 
-/- [paper::test_choose] -/
-def test_choose_fwd : Result Unit :=
+/- [paper::test_choose]: forward function -/
+def test_choose : Result Unit :=
   do
     let z ←
-      choose_fwd I32 true (I32.ofInt 0 (by intlit)) (I32.ofInt 0 (by intlit))
+      choose I32 true (I32.ofInt 0 (by intlit)) (I32.ofInt 0 (by intlit))
     let z0 ← z + (I32.ofInt 1 (by intlit))
     if not (z0 = (I32.ofInt 1 (by intlit)))
     then Result.fail Error.panic
@@ -53,25 +54,25 @@ def test_choose_fwd : Result Unit :=
           else Result.ret ()
 
 /- Unit test for [paper::test_choose] -/
-#assert (test_choose_fwd == .ret ())
+#assert (test_choose == .ret ())
 
 /- [paper::List] -/
 inductive List (T : Type) :=
 | Cons : T → List T → List T
 | Nil : List T
 
-/- [paper::list_nth_mut] -/
-divergent def list_nth_mut_fwd (T : Type) (l : List T) (i : U32) : Result T :=
+/- [paper::list_nth_mut]: forward function -/
+divergent def list_nth_mut (T : Type) (l : List T) (i : U32) : Result T :=
   match l with
   | List.Cons x tl =>
     if i = (U32.ofInt 0 (by intlit))
     then Result.ret x
     else do
            let i0 ← i - (U32.ofInt 1 (by intlit))
-           list_nth_mut_fwd T tl i0
+           list_nth_mut T tl i0
   | List.Nil => Result.fail Error.panic
 
-/- [paper::list_nth_mut] -/
+/- [paper::list_nth_mut]: backward function 0 -/
 divergent def list_nth_mut_back
   (T : Type) (l : List T) (i : U32) (ret0 : T) : Result (List T) :=
   match l with
@@ -85,40 +86,40 @@ divergent def list_nth_mut_back
         Result.ret (List.Cons x tl0)
   | List.Nil => Result.fail Error.panic
 
-/- [paper::sum] -/
-divergent def sum_fwd (l : List I32) : Result I32 :=
+/- [paper::sum]: forward function -/
+divergent def sum (l : List I32) : Result I32 :=
   match l with
   | List.Cons x tl => do
-                        let i ← sum_fwd tl
+                        let i ← sum tl
                         x + i
   | List.Nil => Result.ret (I32.ofInt 0 (by intlit))
 
-/- [paper::test_nth] -/
-def test_nth_fwd : Result Unit :=
+/- [paper::test_nth]: forward function -/
+def test_nth : Result Unit :=
   do
     let l := List.Nil
     let l0 := List.Cons (I32.ofInt 3 (by intlit)) l
     let l1 := List.Cons (I32.ofInt 2 (by intlit)) l0
     let x ←
-      list_nth_mut_fwd I32 (List.Cons (I32.ofInt 1 (by intlit)) l1)
+      list_nth_mut I32 (List.Cons (I32.ofInt 1 (by intlit)) l1)
         (U32.ofInt 2 (by intlit))
     let x0 ← x + (I32.ofInt 1 (by intlit))
     let l2 ←
       list_nth_mut_back I32 (List.Cons (I32.ofInt 1 (by intlit)) l1)
         (U32.ofInt 2 (by intlit)) x0
-    let i ← sum_fwd l2
+    let i ← sum l2
     if not (i = (I32.ofInt 7 (by intlit)))
     then Result.fail Error.panic
     else Result.ret ()
 
 /- Unit test for [paper::test_nth] -/
-#assert (test_nth_fwd == .ret ())
+#assert (test_nth == .ret ())
 
-/- [paper::call_choose] -/
-def call_choose_fwd (p : (U32 × U32)) : Result U32 :=
+/- [paper::call_choose]: forward function -/
+def call_choose (p : (U32 × U32)) : Result U32 :=
   do
     let (px, py) := p
-    let pz ← choose_fwd U32 true px py
+    let pz ← choose U32 true px py
     let pz0 ← pz + (U32.ofInt 1 (by intlit))
     let (px0, _) ← choose_back U32 true px py pz0
     Result.ret px0
diff --git a/tests/lean/PoloniusList.lean b/tests/lean/PoloniusList.lean
index 1d7ec99b..1453c275 100644
--- a/tests/lean/PoloniusList.lean
+++ b/tests/lean/PoloniusList.lean
@@ -9,17 +9,16 @@ inductive List (T : Type) :=
 | Cons : T → List T → List T
 | Nil : List T
 
-/- [polonius_list::get_list_at_x] -/
-divergent def get_list_at_x_fwd
-  (ls : List U32) (x : U32) : Result (List U32) :=
+/- [polonius_list::get_list_at_x]: forward function -/
+divergent def get_list_at_x (ls : List U32) (x : U32) : Result (List U32) :=
   match ls with
   | List.Cons hd tl =>
     if hd = x
     then Result.ret (List.Cons hd tl)
-    else get_list_at_x_fwd tl x
+    else get_list_at_x tl x
   | List.Nil => Result.ret List.Nil
 
-/- [polonius_list::get_list_at_x] -/
+/- [polonius_list::get_list_at_x]: backward function 0 -/
 divergent def get_list_at_x_back
   (ls : List U32) (x : U32) (ret0 : List U32) : Result (List U32) :=
   match ls with
-- 
cgit v1.3.1


From a18d899a2c2b9bdd36f4a5a4b70472c12a835a96 Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Wed, 12 Jul 2023 14:34:55 +0200
Subject: Finish a first version of the progress tactic

---
 backends/lean/Base/Arith/Arith.lean       | 122 ++++-----------
 backends/lean/Base/Diverge/Base.lean      |   2 +-
 backends/lean/Base/Primitives.lean        |  89 ++++++++---
 backends/lean/Base/Progress/Base.lean     |  24 +--
 backends/lean/Base/Progress/Progress.lean |  36 ++++-
 backends/lean/Base/Utils.lean             | 247 +++++++++++++++++++++++++++---
 6 files changed, 349 insertions(+), 171 deletions(-)

(limited to 'backends/lean/Base/Primitives.lean')

diff --git a/backends/lean/Base/Arith/Arith.lean b/backends/lean/Base/Arith/Arith.lean
index ff628cf3..3557d350 100644
--- a/backends/lean/Base/Arith/Arith.lean
+++ b/backends/lean/Base/Arith/Arith.lean
@@ -230,25 +230,20 @@ def introInstances (declToUnfold : Name) (lookup : Expr → MetaM (Option Expr))
     let type ← inferType e
     let name ← mkFreshUserName `h
     -- Add a declaration
-    let nval ← Utils.addDecl name e type (asLet := false)
+    let nval ← Utils.addDeclTac name e type (asLet := false)
     -- Simplify to unfold the declaration to unfold (i.e., the projector)
-    let simpTheorems ← Tactic.simpOnlyBuiltins.foldlM (·.addConst ·) ({} : SimpTheorems)
-    -- Add the equational theorem for the decl to unfold
-    let simpTheorems ← simpTheorems.addDeclToUnfold declToUnfold
-    let congrTheorems ← getSimpCongrTheorems
-    let ctx : Simp.Context := { simpTheorems := #[simpTheorems], congrTheorems }
-    -- Where to apply the simplifier
-    let loc := Tactic.Location.targets #[mkIdent name] false
-    -- Apply the simplifier
-    let _ ← Tactic.simpLocation ctx (discharge? := .none) loc
+    Utils.simpAt [declToUnfold] [] [] (Tactic.Location.targets #[mkIdent name] false)
     -- Return the new value
     pure nval
 
+def introHasPropInstances : Tactic.TacticM (Array Expr) := do
+  trace[Arith] "Introducing the HasProp instances"
+  introInstances ``HasProp.prop_ty lookupHasProp
+
 -- Lookup the instances of `HasProp for all the sub-expressions in the context,
 -- and introduce the corresponding assumptions
 elab "intro_has_prop_instances" : tactic => do
-  trace[Arith] "Introducing the HasProp instances"
-  let _ ← introInstances ``HasProp.prop_ty lookupHasProp
+  let _ ← introHasPropInstances
 
 example (x y : U32) : x.val ≤ Scalar.max ScalarTy.U32 := by
   intro_has_prop_instances
@@ -258,74 +253,6 @@ example {a: Type} (v : Vec a) : v.val.length ≤ Scalar.max ScalarTy.Usize := by
   intro_has_prop_instances
   simp_all [Scalar.max, Scalar.min]
 
--- Tactic to split on a disjunction.
--- The expression `h` should be an fvar.
-def splitDisj (h : Expr) (kleft kright : Tactic.TacticM Unit) : Tactic.TacticM Unit := do
-  trace[Arith] "assumption on which to split: {h}"
-  -- Retrieve the main goal
-  Tactic.withMainContext do
-  let goalType ← Tactic.getMainTarget
-  let hDecl := (← getLCtx).get! h.fvarId!
-  let hName := hDecl.userName
-  -- Case disjunction
-  let hTy ← inferType h
-  hTy.withApp fun f xs => do
-  trace[Arith] "as app: {f} {xs}"
-  -- Sanity check
-  if ¬ (f.isConstOf ``Or ∧ xs.size = 2) then throwError "Invalid argument to splitDisj"
-  let a := xs.get! 0
-  let b := xs.get! 1
-  -- Introduce the new goals
-  -- Returns:
-  -- - the match branch
-  -- - a fresh new mvar id
-  let mkGoal (hTy : Expr) (nGoalName : String) : MetaM (Expr × MVarId) := do
-    -- Introduce a variable for the assumption (`a` or `b`). Note that we reuse
-    -- the name of the assumption we split.
-    withLocalDeclD hName hTy fun var => do
-    -- The new goal
-    let mgoal ← mkFreshExprSyntheticOpaqueMVar goalType (tag := Name.mkSimple nGoalName)
-    -- Clear the assumption that we split
-    let mgoal ← mgoal.mvarId!.tryClearMany #[h.fvarId!]
-    -- The branch expression
-    let branch ← mkLambdaFVars #[var] (mkMVar mgoal)
-    pure (branch, mgoal)
-  let (inl, mleft) ← mkGoal a "left"
-  let (inr, mright) ← mkGoal b "right"
-  trace[Arith] "left: {inl}: {mleft}"
-  trace[Arith] "right: {inr}: {mright}"
-  -- Create the match expression
-  withLocalDeclD (← mkFreshUserName `h) hTy fun hVar => do
-  let motive ← mkLambdaFVars #[hVar] goalType
-  let casesExpr ← mkAppOptM ``Or.casesOn #[a, b, motive, h, inl, inr]
-  let mgoal ← Tactic.getMainGoal
-  trace[Arith] "goals: {← Tactic.getUnsolvedGoals}"
-  trace[Arith] "main goal: {mgoal}"
-  mgoal.assign casesExpr
-  let goals ← Tactic.getUnsolvedGoals
-  -- Focus on the left
-  Tactic.setGoals [mleft]
-  kleft
-  let leftGoals ← Tactic.getUnsolvedGoals
-  -- Focus on the right
-  Tactic.setGoals [mright]
-  kright
-  let rightGoals ← Tactic.getUnsolvedGoals
-  -- Put all the goals back
-  Tactic.setGoals (leftGoals ++ rightGoals ++ goals)
-  trace[Arith] "new goals: {← Tactic.getUnsolvedGoals}"
-
-elab "split_disj " n:ident : tactic => do
-  Tactic.withMainContext do
-  let decl ← Lean.Meta.getLocalDeclFromUserName n.getId
-  let fvar := mkFVar decl.fvarId
-  splitDisj fvar (fun _ => pure ()) (fun _ => pure ())
-
-example (x y : Int) (h0 : x ≤ y ∨ x ≥ y) : x ≤ y ∨ x ≥ y := by
-  split_disj h0
-  . left; assumption
-  . right; assumption
-
 -- Lookup the instances of `PropHasImp for all the sub-expressions in the context,
 -- and introduce the corresponding assumptions
 elab "intro_prop_has_imp_instances" : tactic => do
@@ -357,7 +284,7 @@ def intTacPreprocess : Tactic.TacticM Unit := do
     | [] => pure ()
     | asm :: asms =>
       let k := splitOnAsms asms
-      splitDisj asm k k
+      Utils.splitDisjTac asm k k
   -- Introduce
   let asms ← introInstances ``PropHasImp.concl lookupPropHasImp
   -- Split
@@ -403,18 +330,27 @@ example (x y : Int) (h0: 0 ≤ x) (h1: x ≠ 0) (h2 : 0 ≤ y) (h3 : y ≠ 0) :
   int_tac
 
 -- A tactic to solve linear arithmetic goals in the presence of scalars
-syntax "scalar_tac" : tactic
-macro_rules
-  | `(tactic| scalar_tac) =>
-    `(tactic|
-      intro_has_prop_instances;
-      have := Scalar.cMin_bound ScalarTy.Usize;
-      have := Scalar.cMin_bound ScalarTy.Isize;
-      have := Scalar.cMax_bound ScalarTy.Usize;
-      have := Scalar.cMax_bound ScalarTy.Isize;
-      -- TODO: not too sure about that
-      simp only [*, Scalar.max, Scalar.min, Scalar.cMin, Scalar.cMax] at *;
-      int_tac)
+def scalarTac : Tactic.TacticM Unit := do
+  Tactic.withMainContext do
+  -- Introduce the scalar bounds
+  let _ ← introHasPropInstances
+  Tactic.allGoals do
+  -- Inroduce the bounds for the isize/usize types
+  let add (e : Expr) : Tactic.TacticM Unit := do
+    let ty ← inferType e
+    let _ ← Utils.addDeclTac (← mkFreshUserName `h) e ty (asLet := false)
+  add (← mkAppM ``Scalar.cMin_bound #[.const ``ScalarTy.Usize []])
+  add (← mkAppM ``Scalar.cMin_bound #[.const ``ScalarTy.Isize []])
+  add (← mkAppM ``Scalar.cMax_bound #[.const ``ScalarTy.Usize []])
+  add (← mkAppM ``Scalar.cMax_bound #[.const ``ScalarTy.Isize []])
+  -- Reveal the concrete bounds - TODO: not too sure about that.
+  -- Maybe we should reveal the "concrete" bounds (after normalization)
+  Utils.simpAt [``Scalar.max, ``Scalar.min, ``Scalar.cMin, ``Scalar.cMax] [] [] .wildcard
+  -- Apply the integer tactic
+  intTac
+
+elab "scalar_tac" : tactic =>
+  scalarTac
 
 example (x y : U32) : x.val ≤ Scalar.max ScalarTy.U32 := by
   scalar_tac
diff --git a/backends/lean/Base/Diverge/Base.lean b/backends/lean/Base/Diverge/Base.lean
index e22eb914..d2c91ff8 100644
--- a/backends/lean/Base/Diverge/Base.lean
+++ b/backends/lean/Base/Diverge/Base.lean
@@ -14,7 +14,7 @@ TODO:
   Actually, the cases from mathlib seems already quite powerful
   (https://leanprover-community.github.io/mathlib_docs/tactics.html#cases)
   For instance: cases h : e
-  Also: cases_matching
+  Also: **casesm**
 - better split tactic
 - we need conversions to operate on the head of applications.
   Actually, something like this works:
diff --git a/backends/lean/Base/Primitives.lean b/backends/lean/Base/Primitives.lean
index 14f5971e..6210688d 100644
--- a/backends/lean/Base/Primitives.lean
+++ b/backends/lean/Base/Primitives.lean
@@ -175,27 +175,28 @@ open System.Platform.getNumBits
 @[simp] def U128.min  : Int := 0
 @[simp] def U128.max  : Int := HPow.hPow 2 128 - 1
 
-#assert (I8.min   == -128)
-#assert (I8.max   == 127)
-#assert (I16.min  == -32768)
-#assert (I16.max  == 32767)
-#assert (I32.min  == -2147483648)
-#assert (I32.max  == 2147483647)
-#assert (I64.min  == -9223372036854775808)
-#assert (I64.max  == 9223372036854775807)
-#assert (I128.min == -170141183460469231731687303715884105728)
-#assert (I128.max == 170141183460469231731687303715884105727)
-#assert (U8.min   == 0)
-#assert (U8.max   == 255)
-#assert (U16.min  == 0)
-#assert (U16.max  == 65535)
-#assert (U32.min  == 0)
-#assert (U32.max  == 4294967295)
-#assert (U64.min  == 0)
-#assert (U64.max  == 18446744073709551615)
-#assert (U128.min == 0)
-#assert (U128.max == 340282366920938463463374607431768211455)
-
+-- The normalized bounds
+@[simp] def I8.norm_min   := -128
+@[simp] def I8.norm_max   := 127
+@[simp] def I16.norm_min  := -32768
+@[simp] def I16.norm_max  := 32767
+@[simp] def I32.norm_min  := -2147483648
+@[simp] def I32.norm_max  := 2147483647
+@[simp] def I64.norm_min  := -9223372036854775808
+@[simp] def I64.norm_max  := 9223372036854775807
+@[simp] def I128.norm_min := -170141183460469231731687303715884105728
+@[simp] def I128.norm_max := 170141183460469231731687303715884105727
+@[simp] def U8.norm_min   := 0
+@[simp] def U8.norm_max   := 255
+@[simp] def U16.norm_min  := 0
+@[simp] def U16.norm_max  := 65535
+@[simp] def U32.norm_min  := 0
+@[simp] def U32.norm_max  := 4294967295
+@[simp] def U64.norm_min  := 0
+@[simp] def U64.norm_max  := 18446744073709551615
+@[simp] def U128.norm_min := 0
+@[simp] def U128.norm_max := 340282366920938463463374607431768211455
+    
 inductive ScalarTy :=
 | Isize
 | I8
@@ -240,6 +241,46 @@ def Scalar.max (ty : ScalarTy) : Int :=
   | .U64   => U64.max
   | .U128  => U128.max
 
+@[simp] def Scalar.norm_min (ty : ScalarTy) : Int :=
+  match ty with
+  -- We can't normalize the bounds for isize/usize
+  | .Isize => Isize.min
+  | .Usize => Usize.min
+  --
+  | .I8    => I8.norm_min
+  | .I16   => I16.norm_min
+  | .I32   => I32.norm_min
+  | .I64   => I64.norm_min
+  | .I128  => I128.norm_min
+  | .U8    => U8.norm_min
+  | .U16   => U16.norm_min
+  | .U32   => U32.norm_min
+  | .U64   => U64.norm_min
+  | .U128  => U128.norm_min
+
+@[simp] def Scalar.norm_max (ty : ScalarTy) : Int :=
+  match ty with
+  -- We can't normalize the bounds for isize/usize
+  | .Isize => Isize.max
+  | .Usize => Usize.max
+  --
+  | .I8    => I8.norm_max
+  | .I16   => I16.norm_max
+  | .I32   => I32.norm_max
+  | .I64   => I64.norm_max
+  | .I128  => I128.norm_max
+  | .U8    => U8.norm_max
+  | .U16   => U16.norm_max
+  | .U32   => U32.norm_max
+  | .U64   => U64.norm_max
+  | .U128  => U128.norm_max
+
+def Scalar.norm_min_eq (ty : ScalarTy) : Scalar.min ty = Scalar.norm_min ty := by
+  cases ty <;> rfl
+
+def Scalar.norm_max_eq (ty : ScalarTy) : Scalar.max ty = Scalar.norm_max ty := by
+  cases ty <;> rfl
+
 -- "Conservative" bounds
 -- We use those because we can't compare to the isize bounds (which can't
 -- reduce at compile-time). Whenever we perform an arithmetic operation like
@@ -249,13 +290,13 @@ def Scalar.max (ty : ScalarTy) : Int :=
 -- type-checking time.
 def Scalar.cMin (ty : ScalarTy) : Int :=
   match ty with
-  | .Isize => I32.min
+  | .Isize => Scalar.min .I32
   | _ => Scalar.min ty
 
 def Scalar.cMax (ty : ScalarTy) : Int :=
   match ty with
-  | .Isize => I32.max
-  | .Usize => U32.max
+  | .Isize => Scalar.max .I32
+  | .Usize => Scalar.max .U32
   | _ => Scalar.max ty
 
 theorem Scalar.cMin_bound ty : Scalar.min ty ≤ Scalar.cMin ty := by
diff --git a/backends/lean/Base/Progress/Base.lean b/backends/lean/Base/Progress/Base.lean
index 3f44f46c..613f38f8 100644
--- a/backends/lean/Base/Progress/Base.lean
+++ b/backends/lean/Base/Progress/Base.lean
@@ -10,26 +10,6 @@ open Utils
 -- We can't define and use trace classes in the same file
 initialize registerTraceClass `Progress
 
--- Return the first conjunct if the expression is a conjunction, or the
--- expression itself otherwise. Also return the second conjunct if it is a
--- conjunction.
-def getFirstConj (e : Expr) : MetaM (Expr × Option Expr) := do
-  e.withApp fun f args =>
-  if f.isConstOf ``And ∧ args.size = 2 then pure (args.get! 0, some (args.get! 1))
-  else pure (e, none)
-
--- Destruct an equaliy and return the two sides
-def destEq (e : Expr) : MetaM (Expr × Expr) := do
-  e.withApp fun f args =>
-  if f.isConstOf ``Eq ∧ args.size = 3 then pure (args.get! 1, args.get! 2)
-  else throwError "Not an equality: {e}"
-
--- Return the set of FVarIds in the expression
-partial def getFVarIds (e : Expr) (hs : HashSet FVarId := HashSet.empty) : MetaM (HashSet FVarId) := do
-  e.withApp fun body args => do
-  let hs := if body.isFVar then hs.insert body.fvarId! else hs
-  args.foldlM (fun hs arg => getFVarIds arg hs) hs
-
 /- # Progress tactic -/
 
 structure PSpecDesc where
@@ -103,7 +83,7 @@ section Methods
     existsTelescope th fun evars th => do
     trace[Progress] "Existentials: {evars}"
     -- Take the first conjunct
-    let (th, post) ← getFirstConj th
+    let (th, post) ← optSplitConj th
     -- Destruct the equality
     let (th, ret) ← destEq th
     -- Destruct the application to get the name
@@ -169,7 +149,5 @@ initialize pspecAttr : PSpecAttr ← do
 
 def PSpecAttr.find? (s : PSpecAttr) (name : Name) : MetaM (Option Name) := do
   return (s.ext.getState (← getEnv)).find? name
-  --return s.ext.find? (← getEnv) name
-
 
 end Progress
diff --git a/backends/lean/Base/Progress/Progress.lean b/backends/lean/Base/Progress/Progress.lean
index 1b9ee55c..4c68b3bd 100644
--- a/backends/lean/Base/Progress/Progress.lean
+++ b/backends/lean/Base/Progress/Progress.lean
@@ -21,9 +21,6 @@ namespace Test
   #eval pspecAttr.find? ``Primitives.Vec.index
 end Test
 
-#check isDefEq
-#check allGoals
-
 def progressLookupTheorem (asmTac : TacticM Unit) : TacticM Unit := do
   withMainContext do
   -- Retrieve the goal
@@ -80,7 +77,28 @@ def progressLookupTheorem (asmTac : TacticM Unit) : TacticM Unit := do
   let th ← mkAppOptM thName (mvars.map some)
   let asmName ← mkFreshUserName `h
   let thTy ← inferType th
-  let thAsm ← Utils.addDecl asmName th thTy (asLet := false)
+  let thAsm ← Utils.addDeclTac asmName th thTy (asLet := false)
+  withMainContext do -- The context changed - TODO: remove once addDeclTac is updated
+  let ngoal ← getMainGoal
+  trace[Progress] "current goal: {ngoal}"
+  trace[Progress] "current goal: {← ngoal.isAssigned}"
+  -- The assumption should be of the shape:
+  -- `∃ x1 ... xn, f args = ... ∧ ...`
+  -- We introduce the existentially quantified variables and split the top-most
+  -- conjunction if there is one
+  splitAllExistsTac thAsm fun h => do
+    -- Split the conjunction
+    let splitConj (k : Expr → TacticM Unit) : TacticM Unit := do
+      if ← isConj (← inferType h) then
+        splitConjTac h (fun h _ => k h)
+      else k h
+    -- Simplify the target by using the equality
+    splitConj fun h => do
+    simpAt [] [] [h.fvarId!] (.targets #[] true)
+    -- Clear the equality
+    let mgoal ← getMainGoal
+    let mgoal ← mgoal.tryClearMany #[h.fvarId!]
+    setGoals (mgoal :: (← getUnsolvedGoals))
   -- Update the set of goals
   let curGoals ← getUnsolvedGoals
   let newGoals := mvars.map Expr.mvarId!
@@ -94,7 +112,7 @@ def progressLookupTheorem (asmTac : TacticM Unit) : TacticM Unit := do
   pure ()
 
 elab "progress" : tactic => do
-  progressLookupTheorem (firstTac [assumptionTac, Arith.intTac])
+  progressLookupTheorem (firstTac [assumptionTac, Arith.scalarTac])
 
 namespace Test
   open Primitives
@@ -103,10 +121,12 @@ namespace Test
 
   @[pspec]
   theorem vec_index_test2 (α : Type u) (v: Vec α) (i: Usize) (h: i.val < v.val.length) :
-    ∃ x, v.index α i = .ret x := by
+    ∃ (x: α), v.index α i = .ret x := by
       progress
-      tauto
-      
+      simp
+
+  set_option trace.Progress false
+
 end Test
 
 end Progress
diff --git a/backends/lean/Base/Utils.lean b/backends/lean/Base/Utils.lean
index 1351f3d4..14feb567 100644
--- a/backends/lean/Base/Utils.lean
+++ b/backends/lean/Base/Utils.lean
@@ -1,9 +1,10 @@
 import Lean
 import Mathlib.Tactic.Core
+import Mathlib.Tactic.LeftRight
 
 namespace Utils
 
-open Lean Elab Term Meta
+open Lean Elab Term Meta Tactic
 
 -- Useful helper to explore definitions and figure out the variant
 -- of their sub-expressions.
@@ -156,9 +157,10 @@ section Methods
 
 end Methods
 
-def addDecl (name : Name) (val : Expr) (type : Expr) (asLet : Bool) : Tactic.TacticM Expr :=
+-- TODO: this should take a continuation
+def addDeclTac (name : Name) (val : Expr) (type : Expr) (asLet : Bool) : TacticM Expr :=
   -- I don't think we need that
-  Lean.Elab.Tactic.withMainContext do
+  withMainContext do
   -- Insert the new declaration
   let withDecl := if asLet then withLetDecl name type val else withLocalDeclD name type
   withDecl fun nval => do
@@ -169,7 +171,7 @@ def addDecl (name : Name) (val : Expr) (type : Expr) (asLet : Bool) : Tactic.Tac
     trace[Arith] "  new decl: \"{decl.userName}\" ({nval}) : {decl.type} := {decl.value}"
     --
     -- Tranform the main goal `?m0` to `let x = nval in ?m1`
-    let mvarId ← Tactic.getMainGoal
+    let mvarId ← getMainGoal
     let newMVar ← mkFreshExprSyntheticOpaqueMVar (← mvarId.getType)
     let newVal ← mkLetFVars #[nval] newMVar
     -- There are two cases:
@@ -179,30 +181,30 @@ def addDecl (name : Name) (val : Expr) (type : Expr) (asLet : Bool) : Tactic.Tac
     let newVal := if asLet then newVal else mkAppN newVal #[val]
     -- Assign the main goal and update the current goal
     mvarId.assign newVal
-    let goals ← Tactic.getUnsolvedGoals
-    Lean.Elab.Tactic.setGoals (newMVar.mvarId! :: goals)
+    let goals ← getUnsolvedGoals
+    setGoals (newMVar.mvarId! :: goals)
     -- Return the new value - note: we are in the *new* context, created
     -- after the declaration was added, so it will persist
     pure nval
 
-def addDeclSyntax (name : Name) (val : Syntax) (asLet : Bool) : Tactic.TacticM Unit :=
+def addDeclTacSyntax (name : Name) (val : Syntax) (asLet : Bool) : TacticM Unit :=
   -- I don't think we need that
-  Lean.Elab.Tactic.withMainContext do
+  withMainContext do
   --
-  let val ← elabTerm val .none
+  let val ← Term.elabTerm val .none
   let type ← inferType val
   -- In some situations, the type will be left as a metavariable (for instance,
   -- if the term is `3`, Lean has the choice between `Nat` and `Int` and will
   -- not choose): we force the instantiation of the meta-variable
   synthesizeSyntheticMVarsUsingDefault
   --
-  let _ ← addDecl name val type asLet
+  let _ ← addDeclTac name val type asLet
 
 elab "custom_let " n:ident " := " v:term : tactic => do
-  addDeclSyntax n.getId v (asLet := true)
+  addDeclTacSyntax n.getId v (asLet := true)
 
 elab "custom_have " n:ident " := " v:term : tactic =>
-  addDeclSyntax n.getId v (asLet := false)
+  addDeclTacSyntax n.getId v (asLet := false)
 
 example : Nat := by
   custom_let x := 4
@@ -213,14 +215,14 @@ example (x : Bool) : Nat := by
   cases x <;> custom_let x := 3 <;> apply x
 
 -- Repeatedly apply a tactic
-partial def repeatTac (tac : Tactic.TacticM Unit) : Tactic.TacticM Unit := do
+partial def repeatTac (tac : TacticM Unit) : TacticM Unit := do
   try
     tac
-    Tactic.allGoals (Tactic.focus (repeatTac tac))
+    allGoals (focus (repeatTac tac))
   -- TODO: does this restore the state?
   catch _ => pure ()
 
-def firstTac (tacl : List (Tactic.TacticM Unit)) : Tactic.TacticM Unit := do
+def firstTac (tacl : List (TacticM Unit)) : TacticM Unit := do
   match tacl with
   | [] => pure ()
   | tac :: tacl =>
@@ -228,15 +230,216 @@ def firstTac (tacl : List (Tactic.TacticM Unit)) : Tactic.TacticM Unit := do
     catch _ => firstTac tacl
 
 -- Split the goal if it is a conjunction
-def splitConjTarget : Tactic.TacticM Unit := do
-  Tactic.withMainContext do
+def splitConjTarget : TacticM Unit := do
+  withMainContext do
   let and_intro := Expr.const ``And.intro []
-  let mvarIds' ← _root_.Lean.MVarId.apply (← Tactic.getMainGoal) and_intro
+  let mvarIds' ← _root_.Lean.MVarId.apply (← getMainGoal) and_intro
   Term.synthesizeSyntheticMVarsNoPostponing
-  Tactic.replaceMainGoal mvarIds'
+  replaceMainGoal mvarIds'
 
--- Taken from Lean.Elab.Tactic.evalAssumption
-def assumptionTac : Tactic.TacticM Unit :=
-  Tactic.liftMetaTactic fun mvarId => do mvarId.assumption; pure []
+-- Taken from Lean.Elab.evalAssumption
+def assumptionTac : TacticM Unit :=
+  liftMetaTactic fun mvarId => do mvarId.assumption; pure []
+
+def isConj (e : Expr) : MetaM Bool :=
+  e.withApp fun f args => pure (f.isConstOf ``And ∧ args.size = 2)
+
+-- Return the first conjunct if the expression is a conjunction, or the
+-- expression itself otherwise. Also return the second conjunct if it is a
+-- conjunction.
+def optSplitConj (e : Expr) : MetaM (Expr × Option Expr) := do
+  e.withApp fun f args =>
+  if f.isConstOf ``And ∧ args.size = 2 then pure (args.get! 0, some (args.get! 1))
+  else pure (e, none)
+
+-- Destruct an equaliy and return the two sides
+def destEq (e : Expr) : MetaM (Expr × Expr) := do
+  e.withApp fun f args =>
+  if f.isConstOf ``Eq ∧ args.size = 3 then pure (args.get! 1, args.get! 2)
+  else throwError "Not an equality: {e}"
+
+-- Return the set of FVarIds in the expression
+partial def getFVarIds (e : Expr) (hs : HashSet FVarId := HashSet.empty) : MetaM (HashSet FVarId) := do
+  e.withApp fun body args => do
+  let hs := if body.isFVar then hs.insert body.fvarId! else hs
+  args.foldlM (fun hs arg => getFVarIds arg hs) hs
+
+-- Tactic to split on a disjunction.
+-- The expression `h` should be an fvar.
+-- TODO: there must be simpler. Use use _root_.Lean.MVarId.cases for instance
+def splitDisjTac (h : Expr) (kleft kright : TacticM Unit) : TacticM Unit := do
+  trace[Arith] "assumption on which to split: {h}"
+  -- Retrieve the main goal
+  withMainContext do
+  let goalType ← getMainTarget
+  let hDecl := (← getLCtx).get! h.fvarId!
+  let hName := hDecl.userName
+  -- Case disjunction
+  let hTy ← inferType h
+  hTy.withApp fun f xs => do
+  trace[Arith] "as app: {f} {xs}"
+  -- Sanity check
+  if ¬ (f.isConstOf ``Or ∧ xs.size = 2) then throwError "Invalid argument to splitDisjTac"
+  let a := xs.get! 0
+  let b := xs.get! 1
+  -- Introduce the new goals
+  -- Returns:
+  -- - the match branch
+  -- - a fresh new mvar id
+  let mkGoal (hTy : Expr) (nGoalName : String) : MetaM (Expr × MVarId) := do
+    -- Introduce a variable for the assumption (`a` or `b`). Note that we reuse
+    -- the name of the assumption we split.
+    withLocalDeclD hName hTy fun var => do
+    -- The new goal
+    let mgoal ← mkFreshExprSyntheticOpaqueMVar goalType (tag := Name.mkSimple nGoalName)
+    -- Clear the assumption that we split
+    let mgoal ← mgoal.mvarId!.tryClearMany #[h.fvarId!]
+    -- The branch expression
+    let branch ← mkLambdaFVars #[var] (mkMVar mgoal)
+    pure (branch, mgoal)
+  let (inl, mleft) ← mkGoal a "left"
+  let (inr, mright) ← mkGoal b "right"
+  trace[Arith] "left: {inl}: {mleft}"
+  trace[Arith] "right: {inr}: {mright}"
+  -- Create the match expression
+  withLocalDeclD (← mkFreshUserName `h) hTy fun hVar => do
+  let motive ← mkLambdaFVars #[hVar] goalType
+  let casesExpr ← mkAppOptM ``Or.casesOn #[a, b, motive, h, inl, inr]
+  let mgoal ← getMainGoal
+  trace[Arith] "goals: {← getUnsolvedGoals}"
+  trace[Arith] "main goal: {mgoal}"
+  mgoal.assign casesExpr
+  let goals ← getUnsolvedGoals
+  -- Focus on the left
+  setGoals [mleft]
+  withMainContext kleft
+  let leftGoals ← getUnsolvedGoals
+  -- Focus on the right
+  setGoals [mright]
+  withMainContext kright
+  let rightGoals ← getUnsolvedGoals
+  -- Put all the goals back
+  setGoals (leftGoals ++ rightGoals ++ goals)
+  trace[Arith] "new goals: {← getUnsolvedGoals}"
+
+elab "split_disj " n:ident : tactic => do
+  withMainContext do
+  let decl ← Lean.Meta.getLocalDeclFromUserName n.getId
+  let fvar := mkFVar decl.fvarId
+  splitDisjTac fvar (fun _ => pure ()) (fun _ => pure ())
+
+example (x y : Int) (h0 : x ≤ y ∨ x ≥ y) : x ≤ y ∨ x ≥ y := by
+  split_disj h0
+  . left; assumption
+  . right; assumption
+
+
+-- Tactic to split on an exists
+def splitExistsTac (h : Expr) (k : Expr → Expr → TacticM α) : TacticM α := do
+  withMainContext do
+  let goal ←  getMainGoal
+  let hTy ← inferType h
+  if isExists hTy then do
+    let newGoals ← goal.cases h.fvarId! #[]
+    -- There should be exactly one goal
+    match newGoals.toList with
+    | [ newGoal ] =>
+      -- Set the new goal
+      let goals ← getUnsolvedGoals
+      setGoals (newGoal.mvarId :: goals)
+      -- There should be exactly two fields
+      let fields := newGoal.fields
+      withMainContext do
+      k (fields.get! 0) (fields.get! 1)
+    | _ =>
+      throwError "Unreachable"
+  else
+    throwError "Not a conjunction"
+
+partial def splitAllExistsTac [Inhabited α] (h : Expr) (k : Expr → TacticM α) : TacticM α := do
+  try
+    splitExistsTac h (fun _ body => splitAllExistsTac body k)
+  catch _ => k h
+
+-- Tactic to split on a conjunction.
+def splitConjTac (h : Expr) (k : Expr → Expr → TacticM α)  : TacticM α := do
+  withMainContext do
+  let goal ←  getMainGoal
+  let hTy ← inferType h
+  if ← isConj hTy then do
+    let newGoals ← goal.cases h.fvarId! #[]
+    -- There should be exactly one goal
+    match newGoals.toList with
+    | [ newGoal ] =>
+      -- Set the new goal
+      let goals ← getUnsolvedGoals
+      setGoals (newGoal.mvarId :: goals)
+      -- There should be exactly two fields
+      let fields := newGoal.fields
+      withMainContext do
+      k (fields.get! 0) (fields.get! 1)
+    | _ =>
+      throwError "Unreachable"
+  else
+    throwError "Not a conjunction"
+
+elab "split_conj " n:ident : tactic => do
+  withMainContext do
+  let decl ← Lean.Meta.getLocalDeclFromUserName n.getId
+  let fvar := mkFVar decl.fvarId
+  splitConjTac fvar (fun _ _ =>  pure ())
+
+elab "split_all_exists " n:ident : tactic => do
+  withMainContext do
+  let decl ← Lean.Meta.getLocalDeclFromUserName n.getId
+  let fvar := mkFVar decl.fvarId
+  splitAllExistsTac fvar (fun _ =>  pure ())
+
+example (h : a ∧ b) : a := by
+  split_all_exists h
+  split_conj h
+  assumption
+
+example (h : ∃ x y z, x + y + z ≥ 0) : ∃ x, x ≥ 0 := by
+  split_all_exists h
+  rename_i x y z h
+  exists x + y + z
+
+/- Call the simp tactic.
+   The initialization of the context is adapted from Tactic.elabSimpArgs.
+   Something very annoying is that there is no function which allows to
+   initialize a simp context without doing an elaboration - as a consequence
+   we write our own here. -/
+def simpAt (declsToUnfold : List Name) (thms : List Name) (hypsToUse : List FVarId)
+  (loc : Tactic.Location) :
+  Tactic.TacticM Unit := do
+  -- Initialize with the builtin simp theorems
+  let simpThms ← Tactic.simpOnlyBuiltins.foldlM (·.addConst ·) ({} : SimpTheorems)
+  -- Add the equational theorem for the declarations to unfold
+  let simpThms ←
+    declsToUnfold.foldlM (fun thms decl => thms.addDeclToUnfold decl) simpThms
+  -- Add the hypotheses and the rewriting theorems
+  let simpThms ←
+    hypsToUse.foldlM (fun thms fvarId =>
+      -- post: TODO: don't know what that is
+      -- inv: invert the equality
+      thms.add (.fvar fvarId) #[] (mkFVar fvarId) (post := false) (inv := false)
+      -- thms.eraseCore (.fvar fvar)
+      ) simpThms
+  -- Add the rewriting theorems to use
+  let simpThms ←
+    thms.foldlM (fun thms thmName => do
+      let info ← getConstInfo thmName
+      if (← isProp info.type) then
+        -- post: TODO: don't know what that is
+        -- inv: invert the equality
+        thms.addConst thmName (post := false) (inv := false)
+      else
+        throwError "Not a proposition: {thmName}"
+      ) simpThms
+  let congrTheorems ← getSimpCongrTheorems
+  let ctx : Simp.Context := { simpTheorems := #[simpThms], congrTheorems }
+  -- Apply the simplifier
+  let _ ← Tactic.simpLocation ctx (discharge? := .none) loc
 
 end Utils
-- 
cgit v1.3.1


From 59e4a06480b5365f48dc68de80f44841f94094ed Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Wed, 12 Jul 2023 15:41:29 +0200
Subject: Improve the handling of arithmetic bounds

---
 backends/lean/Base/Arith/Arith.lean       |   8 +-
 backends/lean/Base/Primitives.lean        | 228 +++++++++++++++---------------
 backends/lean/Base/Progress/Progress.lean |   5 +-
 3 files changed, 126 insertions(+), 115 deletions(-)

(limited to 'backends/lean/Base/Primitives.lean')

diff --git a/backends/lean/Base/Arith/Arith.lean b/backends/lean/Base/Arith/Arith.lean
index 3557d350..20420f36 100644
--- a/backends/lean/Base/Arith/Arith.lean
+++ b/backends/lean/Base/Arith/Arith.lean
@@ -339,13 +339,17 @@ def scalarTac : Tactic.TacticM Unit := do
   let add (e : Expr) : Tactic.TacticM Unit := do
     let ty ← inferType e
     let _ ← Utils.addDeclTac (← mkFreshUserName `h) e ty (asLet := false)
-  add (← mkAppM ``Scalar.cMin_bound #[.const ``ScalarTy.Usize []])
   add (← mkAppM ``Scalar.cMin_bound #[.const ``ScalarTy.Isize []])
   add (← mkAppM ``Scalar.cMax_bound #[.const ``ScalarTy.Usize []])
   add (← mkAppM ``Scalar.cMax_bound #[.const ``ScalarTy.Isize []])
   -- Reveal the concrete bounds - TODO: not too sure about that.
   -- Maybe we should reveal the "concrete" bounds (after normalization)
-  Utils.simpAt [``Scalar.max, ``Scalar.min, ``Scalar.cMin, ``Scalar.cMax] [] [] .wildcard
+  Utils.simpAt [``Scalar.min, ``Scalar.max, ``Scalar.cMin, ``Scalar.cMax,
+                ``I8.min, ``I16.min, ``I32.min, ``I64.min, ``I128.min,
+                ``I8.max, ``I16.max, ``I32.max, ``I64.max, ``I128.max,
+                ``U8.min, ``U16.min, ``U32.min, ``U64.min, ``U128.min,
+                ``U8.max, ``U16.max, ``U32.max, ``U64.max, ``U128.max
+                ] [] [] .wildcard
   -- Apply the integer tactic
   intTac
 
diff --git a/backends/lean/Base/Primitives.lean b/backends/lean/Base/Primitives.lean
index 6210688d..37abdede 100644
--- a/backends/lean/Base/Primitives.lean
+++ b/backends/lean/Base/Primitives.lean
@@ -149,54 +149,78 @@ open System.Platform.getNumBits
 @[simp] def size_num_bits : Nat := (System.Platform.getNumBits ()).val
 
 -- Remark: Lean seems to use < for the comparisons with the upper bounds by convention.
--- We keep the F* convention for now.
-@[simp] def Isize.min : Int := - (HPow.hPow 2 (size_num_bits - 1))
-@[simp] def Isize.max : Int := (HPow.hPow 2 (size_num_bits - 1)) - 1
-@[simp] def I8.min    : Int := - (HPow.hPow 2 7)
-@[simp] def I8.max    : Int := HPow.hPow 2 7 - 1
-@[simp] def I16.min   : Int := - (HPow.hPow 2 15)
-@[simp] def I16.max   : Int := HPow.hPow 2 15 - 1
-@[simp] def I32.min   : Int := -(HPow.hPow 2 31)
-@[simp] def I32.max   : Int := HPow.hPow 2 31 - 1
-@[simp] def I64.min   : Int := -(HPow.hPow 2 63)
-@[simp] def I64.max   : Int := HPow.hPow 2 63 - 1
-@[simp] def I128.min  : Int := -(HPow.hPow 2 127)
-@[simp] def I128.max  : Int := HPow.hPow 2 127 - 1
-@[simp] def Usize.min : Int := 0
-@[simp] def Usize.max : Int := HPow.hPow 2 size_num_bits - 1
-@[simp] def U8.min    : Int := 0
-@[simp] def U8.max    : Int := HPow.hPow 2 8 - 1
-@[simp] def U16.min   : Int := 0
-@[simp] def U16.max   : Int := HPow.hPow 2 16 - 1
-@[simp] def U32.min   : Int := 0
-@[simp] def U32.max   : Int := HPow.hPow 2 32 - 1
-@[simp] def U64.min   : Int := 0
-@[simp] def U64.max   : Int := HPow.hPow 2 64 - 1
-@[simp] def U128.min  : Int := 0
-@[simp] def U128.max  : Int := HPow.hPow 2 128 - 1
-
--- The normalized bounds
-@[simp] def I8.norm_min   := -128
-@[simp] def I8.norm_max   := 127
-@[simp] def I16.norm_min  := -32768
-@[simp] def I16.norm_max  := 32767
-@[simp] def I32.norm_min  := -2147483648
-@[simp] def I32.norm_max  := 2147483647
-@[simp] def I64.norm_min  := -9223372036854775808
-@[simp] def I64.norm_max  := 9223372036854775807
-@[simp] def I128.norm_min := -170141183460469231731687303715884105728
-@[simp] def I128.norm_max := 170141183460469231731687303715884105727
-@[simp] def U8.norm_min   := 0
-@[simp] def U8.norm_max   := 255
-@[simp] def U16.norm_min  := 0
-@[simp] def U16.norm_max  := 65535
-@[simp] def U32.norm_min  := 0
-@[simp] def U32.norm_max  := 4294967295
-@[simp] def U64.norm_min  := 0
-@[simp] def U64.norm_max  := 18446744073709551615
-@[simp] def U128.norm_min := 0
-@[simp] def U128.norm_max := 340282366920938463463374607431768211455
-    
+
+-- The "structured" bounds
+def Isize.smin : Int := - (HPow.hPow 2 (size_num_bits - 1))
+def Isize.smax : Int := (HPow.hPow 2 (size_num_bits - 1)) - 1
+def I8.smin    : Int := - (HPow.hPow 2 7)
+def I8.smax    : Int := HPow.hPow 2 7 - 1
+def I16.smin   : Int := - (HPow.hPow 2 15)
+def I16.smax   : Int := HPow.hPow 2 15 - 1
+def I32.smin   : Int := -(HPow.hPow 2 31)
+def I32.smax   : Int := HPow.hPow 2 31 - 1
+def I64.smin   : Int := -(HPow.hPow 2 63)
+def I64.smax   : Int := HPow.hPow 2 63 - 1
+def I128.smin  : Int := -(HPow.hPow 2 127)
+def I128.smax  : Int := HPow.hPow 2 127 - 1
+def Usize.smin : Int := 0
+def Usize.smax : Int := HPow.hPow 2 size_num_bits - 1
+def U8.smin    : Int := 0
+def U8.smax    : Int := HPow.hPow 2 8 - 1
+def U16.smin   : Int := 0
+def U16.smax   : Int := HPow.hPow 2 16 - 1
+def U32.smin   : Int := 0
+def U32.smax   : Int := HPow.hPow 2 32 - 1
+def U64.smin   : Int := 0
+def U64.smax   : Int := HPow.hPow 2 64 - 1
+def U128.smin  : Int := 0
+def U128.smax  : Int := HPow.hPow 2 128 - 1
+
+-- The "normalized" bounds, that we use in practice
+def I8.min    := -128
+def I8.max   := 127
+def I16.min  := -32768
+def I16.max  := 32767
+def I32.min  := -2147483648
+def I32.max  := 2147483647
+def I64.min  := -9223372036854775808
+def I64.max  := 9223372036854775807
+def I128.min := -170141183460469231731687303715884105728
+def I128.max := 170141183460469231731687303715884105727
+@[simp] def U8.min   := 0
+def U8.max   := 255
+@[simp] def U16.min  := 0
+def U16.max  := 65535
+@[simp] def U32.min  := 0
+def U32.max  := 4294967295
+@[simp] def U64.min  := 0
+def U64.max  := 18446744073709551615
+@[simp] def U128.min := 0
+def U128.max := 340282366920938463463374607431768211455
+@[simp] def Usize.min := 0
+
+def Isize.refined_min : { n:Int // n = I32.min ∨ n = I64.min } :=
+  ⟨ Isize.smin, by
+    simp [Isize.smin]
+    cases System.Platform.numBits_eq <;>
+    unfold System.Platform.numBits at * <;> simp [*] ⟩
+
+def Isize.refined_max : { n:Int // n = I32.max ∨ n = I64.max } :=
+  ⟨ Isize.smax, by
+    simp [Isize.smax]
+    cases System.Platform.numBits_eq <;>
+    unfold System.Platform.numBits at * <;> simp [*] ⟩
+
+def Usize.refined_max : { n:Int // n = U32.max ∨ n = U64.max } :=
+  ⟨ Usize.smax, by
+    simp [Usize.smax]
+    cases System.Platform.numBits_eq <;>
+    unfold System.Platform.numBits at * <;> simp [*] ⟩
+
+def Isize.min := Isize.refined_min.val
+def Isize.max := Isize.refined_max.val
+def Usize.max := Usize.refined_max.val
+
 inductive ScalarTy :=
 | Isize
 | I8
@@ -211,6 +235,36 @@ inductive ScalarTy :=
 | U64
 | U128
 
+def Scalar.smin (ty : ScalarTy) : Int :=
+  match ty with
+  | .Isize => Isize.smin
+  | .I8    => I8.smin
+  | .I16   => I16.smin
+  | .I32   => I32.smin
+  | .I64   => I64.smin
+  | .I128  => I128.smin
+  | .Usize => Usize.smin
+  | .U8    => U8.smin
+  | .U16   => U16.smin
+  | .U32   => U32.smin
+  | .U64   => U64.smin
+  | .U128  => U128.smin
+
+def Scalar.smax (ty : ScalarTy) : Int :=
+  match ty with
+  | .Isize => Isize.smax
+  | .I8    => I8.smax
+  | .I16   => I16.smax
+  | .I32   => I32.smax
+  | .I64   => I64.smax
+  | .I128  => I128.smax
+  | .Usize => Usize.smax
+  | .U8    => U8.smax
+  | .U16   => U16.smax
+  | .U32   => U32.smax
+  | .U64   => U64.smax
+  | .U128  => U128.smax
+
 def Scalar.min (ty : ScalarTy) : Int :=
   match ty with
   | .Isize => Isize.min
@@ -241,44 +295,10 @@ def Scalar.max (ty : ScalarTy) : Int :=
   | .U64   => U64.max
   | .U128  => U128.max
 
-@[simp] def Scalar.norm_min (ty : ScalarTy) : Int :=
-  match ty with
-  -- We can't normalize the bounds for isize/usize
-  | .Isize => Isize.min
-  | .Usize => Usize.min
-  --
-  | .I8    => I8.norm_min
-  | .I16   => I16.norm_min
-  | .I32   => I32.norm_min
-  | .I64   => I64.norm_min
-  | .I128  => I128.norm_min
-  | .U8    => U8.norm_min
-  | .U16   => U16.norm_min
-  | .U32   => U32.norm_min
-  | .U64   => U64.norm_min
-  | .U128  => U128.norm_min
-
-@[simp] def Scalar.norm_max (ty : ScalarTy) : Int :=
-  match ty with
-  -- We can't normalize the bounds for isize/usize
-  | .Isize => Isize.max
-  | .Usize => Usize.max
-  --
-  | .I8    => I8.norm_max
-  | .I16   => I16.norm_max
-  | .I32   => I32.norm_max
-  | .I64   => I64.norm_max
-  | .I128  => I128.norm_max
-  | .U8    => U8.norm_max
-  | .U16   => U16.norm_max
-  | .U32   => U32.norm_max
-  | .U64   => U64.norm_max
-  | .U128  => U128.norm_max
-
-def Scalar.norm_min_eq (ty : ScalarTy) : Scalar.min ty = Scalar.norm_min ty := by
+def Scalar.smin_eq (ty : ScalarTy) : Scalar.min ty = Scalar.smin ty := by
   cases ty <;> rfl
 
-def Scalar.norm_max_eq (ty : ScalarTy) : Scalar.max ty = Scalar.norm_max ty := by
+def Scalar.smax_eq (ty : ScalarTy) : Scalar.max ty = Scalar.smax ty := by
   cases ty <;> rfl
 
 -- "Conservative" bounds
@@ -301,30 +321,22 @@ def Scalar.cMax (ty : ScalarTy) : Int :=
 
 theorem Scalar.cMin_bound ty : Scalar.min ty ≤ Scalar.cMin ty := by
   cases ty <;> simp [Scalar.min, Scalar.max, Scalar.cMin, Scalar.cMax] at *
-  cases System.Platform.numBits_eq <;>
-  unfold System.Platform.numBits at * <;>
-  simp [*]
+  have h := Isize.refined_min.property
+  cases h <;> simp [*, Isize.min]
 
 theorem Scalar.cMax_bound ty : Scalar.cMax ty ≤ Scalar.max ty := by
-  cases ty <;> simp [Scalar.min, Scalar.max, Scalar.cMin, Scalar.cMax] at * <;>
-  cases System.Platform.numBits_eq <;>
-  unfold System.Platform.numBits at * <;>
-  simp [*]
+  cases ty <;> simp [Scalar.min, Scalar.max, Scalar.cMin, Scalar.cMax] at *
+  . have h := Isize.refined_max.property
+    cases h <;> simp [*, Isize.max]
+  . have h := Usize.refined_max.property
+    cases h <;> simp [*, Usize.max]
 
 theorem Scalar.cMin_suffices ty (h : Scalar.cMin ty ≤ x) : Scalar.min ty ≤ x := by
-  cases ty <;> simp [Scalar.min, Scalar.max, Scalar.cMin, Scalar.cMax] at * <;>
-  cases System.Platform.numBits_eq <;>
-  unfold System.Platform.numBits at * <;>
-  simp [*] at *
-  -- TODO: I would have expected terms like `-(1 + 1) ^ 63` to be simplified
+  have := Scalar.cMin_bound ty
   linarith
 
 theorem Scalar.cMax_suffices ty (h : x ≤ Scalar.cMax ty) : x ≤ Scalar.max ty := by
-  cases ty <;> simp [Scalar.min, Scalar.max, Scalar.cMin, Scalar.cMax] at * <;>
-  cases System.Platform.numBits_eq <;>
-  unfold System.Platform.numBits at * <;>
-  simp [*] at * <;>
-  -- TODO: I would have expected terms like `-(1 + 1) ^ 63` to be simplified
+  have := Scalar.cMax_bound ty
   linarith
 
 structure Scalar (ty : ScalarTy) where
@@ -609,7 +621,7 @@ def Vec.new (α : Type u): Vec α := ⟨ [], by apply Scalar.cMax_suffices .Usiz
 
 def Vec.len (α : Type u) (v : Vec α) : Usize :=
   let ⟨ v, l ⟩ := v
-  Usize.ofIntCore (List.length v) (by simp [Scalar.min]) l
+  Usize.ofIntCore (List.length v) (by simp [Scalar.min, Usize.min]) l
  
 -- This shouldn't be used
 def Vec.push_fwd (α : Type u) (_ : Vec α) (_ : α) : Unit := ()
@@ -620,13 +632,9 @@ def Vec.push (α : Type u) (v : Vec α) (x : α) : Result (Vec α)
   let nlen := List.length v.val + 1
   if h : nlen ≤ U32.max || nlen ≤ Usize.max then
     have h : nlen ≤ Usize.max := by
-      simp at *
-      cases System.Platform.numBits_eq <;>
-      unfold System.Platform.numBits at * <;>
-      simp [*] at * <;>
-      try assumption
-      cases h <;>
-      linarith
+      simp [Usize.max] at *
+      have hm := Usize.refined_max.property
+      cases h <;> cases hm <;> simp [U32.max, U64.max] at * <;> try linarith
     return ⟨ List.concat v.val x, by simp at *; assumption ⟩
   else
     fail maximumSizeExceeded
@@ -647,7 +655,6 @@ def Vec.insert (α : Type u) (v: Vec α) (i: Usize) (x: α): Result (Vec α) :=
     .ret ⟨ List.set v.val i x, by
       have h: List.length v.val ≤ Usize.max := v.property
       simp [*] at *
-      assumption
     ⟩
   else
     .fail arrayOutOfBounds
@@ -688,7 +695,6 @@ def Vec.index_mut_back (α : Type u) (v: Vec α) (i: Usize) (x: α): Result (Vec
     .ret ⟨ List.set v.val i x, by
       have h: List.length v.val ≤ Usize.max := v.property
       simp [*] at *
-      assumption
     ⟩
   else
     .fail arrayOutOfBounds
diff --git a/backends/lean/Base/Progress/Progress.lean b/backends/lean/Base/Progress/Progress.lean
index 4c68b3bd..a4df5c96 100644
--- a/backends/lean/Base/Progress/Progress.lean
+++ b/backends/lean/Base/Progress/Progress.lean
@@ -92,9 +92,10 @@ def progressLookupTheorem (asmTac : TacticM Unit) : TacticM Unit := do
       if ← isConj (← inferType h) then
         splitConjTac h (fun h _ => k h)
       else k h
-    -- Simplify the target by using the equality
+    -- Simplify the target by using the equality and some monad simplifications
     splitConj fun h => do
-    simpAt [] [] [h.fvarId!] (.targets #[] true)
+    simpAt [] [``Primitives.bind_tc_ret, ``Primitives.bind_tc_fail, ``Primitives.bind_tc_div]
+           [h.fvarId!] (.targets #[] true)
     -- Clear the equality
     let mgoal ← getMainGoal
     let mgoal ← mgoal.tryClearMany #[h.fvarId!]
-- 
cgit v1.3.1


From e010c10fb9a1e2d88b52a4f6b4a0865448276013 Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Wed, 12 Jul 2023 15:58:38 +0200
Subject: Make the `by inlit` implicit

---
 backends/lean/Base/Primitives.lean |  15 ++--
 compiler/Extract.ml                |   2 +-
 tests/lean/BetreeMain/Funs.lean    |  31 ++++----
 tests/lean/Constants.lean          |  35 ++++-----
 tests/lean/External/Funs.lean      |  10 +--
 tests/lean/Hashmap/Funs.lean       |  81 ++++++++------------
 tests/lean/HashmapMain/Funs.lean   |  86 +++++++++------------
 tests/lean/Loops/Funs.lean         | 140 ++++++++++++++++------------------
 tests/lean/NoNestedBorrows.lean    | 152 +++++++++++++++++--------------------
 tests/lean/Paper.lean              |  48 +++++-------
 tests/lean/lake-manifest.json      |   8 +-
 11 files changed, 277 insertions(+), 331 deletions(-)

(limited to 'backends/lean/Base/Primitives.lean')

diff --git a/backends/lean/Base/Primitives.lean b/backends/lean/Base/Primitives.lean
index 37abdede..0506f4c0 100644
--- a/backends/lean/Base/Primitives.lean
+++ b/backends/lean/Base/Primitives.lean
@@ -356,8 +356,14 @@ def Scalar.ofIntCore {ty : ScalarTy} (x : Int)
   (hmin : Scalar.min ty ≤ x) (hmax : x ≤ Scalar.max ty) : Scalar ty :=
   { val := x, hmin := hmin, hmax := hmax }
 
+-- Tactic to prove that integers are in bounds
+-- TODO: use this: https://leanprover.zulipchat.com/#narrow/stream/270676-lean4/topic/instance.20with.20tactic.20autoparam
+syntax "intlit" : tactic
+macro_rules
+  | `(tactic| intlit) => `(tactic| apply Scalar.bound_suffices; decide)
+
 def Scalar.ofInt {ty : ScalarTy} (x : Int)
-  (h : Scalar.min ty ≤ x ∧ x ≤ Scalar.max ty) : Scalar ty :=
+  (h : Scalar.min ty ≤ x ∧ x ≤ Scalar.max ty := by intlit) : Scalar ty :=
   -- Remark: we initially wrote:
   --  let ⟨ hmin, hmax ⟩ := h
   --  Scalar.ofIntCore x hmin hmax
@@ -573,13 +579,6 @@ instance (ty : ScalarTy) : DecidableEq (Scalar ty) :=
 
 def Scalar.toInt {ty} (n : Scalar ty) : Int := n.val
 
--- Tactic to prove that integers are in bounds
--- TODO: use this: https://leanprover.zulipchat.com/#narrow/stream/270676-lean4/topic/instance.20with.20tactic.20autoparam
-syntax "intlit" : tactic
-
-macro_rules
-  | `(tactic| intlit) => `(tactic| apply Scalar.bound_suffices ; decide)
-
 -- -- We now define a type class that subsumes the various machine integer types, so
 -- -- as to write a concise definition for scalar_cast, rather than exhaustively
 -- -- enumerating all of the possible pairs. We remark that Rust has sane semantics
diff --git a/compiler/Extract.ml b/compiler/Extract.ml
index 558a981d..b16f9639 100644
--- a/compiler/Extract.ml
+++ b/compiler/Extract.ml
@@ -820,7 +820,7 @@ let mk_formatter (ctx : trans_ctx) (crate_name : string)
               F.pp_print_string fmt ")";
               F.pp_print_string fmt ")")
             else Z.pp_print fmt sv.value;
-            F.pp_print_string fmt " (by intlit))")
+            F.pp_print_string fmt ")")
     | Bool b ->
         let b =
           match !backend with
diff --git a/tests/lean/BetreeMain/Funs.lean b/tests/lean/BetreeMain/Funs.lean
index b0939155..142adf08 100644
--- a/tests/lean/BetreeMain/Funs.lean
+++ b/tests/lean/BetreeMain/Funs.lean
@@ -39,33 +39,33 @@ def betree.store_leaf_node
 /- [betree_main::betree::fresh_node_id]: forward function -/
 def betree.fresh_node_id (counter : U64) : Result U64 :=
   do
-    let _ ← counter + (U64.ofInt 1 (by intlit))
+    let _ ← counter + (U64.ofInt 1)
     Result.ret counter
 
 /- [betree_main::betree::fresh_node_id]: backward function 0 -/
 def betree.fresh_node_id_back (counter : U64) : Result U64 :=
-  counter + (U64.ofInt 1 (by intlit))
+  counter + (U64.ofInt 1)
 
 /- [betree_main::betree::NodeIdCounter::{0}::new]: forward function -/
 def betree.NodeIdCounter.new : Result betree.NodeIdCounter :=
-  Result.ret { next_node_id := (U64.ofInt 0 (by intlit)) }
+  Result.ret { next_node_id := (U64.ofInt 0) }
 
 /- [betree_main::betree::NodeIdCounter::{0}::fresh_id]: forward function -/
 def betree.NodeIdCounter.fresh_id (self : betree.NodeIdCounter) : Result U64 :=
   do
-    let _ ← self.next_node_id + (U64.ofInt 1 (by intlit))
+    let _ ← self.next_node_id + (U64.ofInt 1)
     Result.ret self.next_node_id
 
 /- [betree_main::betree::NodeIdCounter::{0}::fresh_id]: backward function 0 -/
 def betree.NodeIdCounter.fresh_id_back
   (self : betree.NodeIdCounter) : Result betree.NodeIdCounter :=
   do
-    let i ← self.next_node_id + (U64.ofInt 1 (by intlit))
+    let i ← self.next_node_id + (U64.ofInt 1)
     Result.ret { next_node_id := i }
 
 /- [core::num::u64::{10}::MAX] -/
 def core_num_u64_max_body : Result U64 :=
-  Result.ret (U64.ofInt 18446744073709551615 (by intlit))
+  Result.ret (U64.ofInt 18446744073709551615)
 def core_num_u64_max_c : U64 := eval_global core_num_u64_max_body (by simp)
 
 /- [betree_main::betree::upsert_update]: forward function -/
@@ -75,7 +75,7 @@ def betree.upsert_update
   | Option.none =>
     match st with
     | betree.UpsertFunState.Add v => Result.ret v
-    | betree.UpsertFunState.Sub i => Result.ret (U64.ofInt 0 (by intlit))
+    | betree.UpsertFunState.Sub i => Result.ret (U64.ofInt 0)
   | Option.some prev0 =>
     match st with
     | betree.UpsertFunState.Add v =>
@@ -87,7 +87,7 @@ def betree.upsert_update
     | betree.UpsertFunState.Sub v =>
       if prev0 >= v
       then prev0 - v
-      else Result.ret (U64.ofInt 0 (by intlit))
+      else Result.ret (U64.ofInt 0)
 
 /- [betree_main::betree::List::{1}::len]: forward function -/
 divergent def betree.List.len (T : Type) (self : betree.List T) : Result U64 :=
@@ -95,21 +95,21 @@ divergent def betree.List.len (T : Type) (self : betree.List T) : Result U64 :=
   | betree.List.Cons t tl =>
     do
       let i ← betree.List.len T tl
-      (U64.ofInt 1 (by intlit)) + i
-  | betree.List.Nil => Result.ret (U64.ofInt 0 (by intlit))
+      (U64.ofInt 1) + i
+  | betree.List.Nil => Result.ret (U64.ofInt 0)
 
 /- [betree_main::betree::List::{1}::split_at]: forward function -/
 divergent def betree.List.split_at
   (T : Type) (self : betree.List T) (n : U64) :
   Result ((betree.List T) × (betree.List T))
   :=
-  if n = (U64.ofInt 0 (by intlit))
+  if n = (U64.ofInt 0)
   then Result.ret (betree.List.Nil, self)
   else
     match self with
     | betree.List.Cons hd tl =>
       do
-        let i ← n - (U64.ofInt 1 (by intlit))
+        let i ← n - (U64.ofInt 1)
         let p ← betree.List.split_at T tl i
         let (ls0, ls1) := p
         let l := ls0
@@ -740,7 +740,7 @@ mutual divergent def betree.Node.apply_messages
       let (st0, content) ← betree.load_leaf_node node.id st
       let content0 ← betree.Node.apply_messages_to_leaf content msgs
       let len ← betree.List.len (U64 × U64) content0
-      let i ← (U64.ofInt 2 (by intlit)) * params.split_size
+      let i ← (U64.ofInt 2) * params.split_size
       if len >= i
       then
         do
@@ -790,7 +790,7 @@ divergent def betree.Node.apply_messages_back
       let (st0, content) ← betree.load_leaf_node node.id st
       let content0 ← betree.Node.apply_messages_to_leaf content msgs
       let len ← betree.List.len (U64 × U64) content0
-      let i ← (U64.ofInt 2 (by intlit)) * params.split_size
+      let i ← (U64.ofInt 2) * params.split_size
       if len >= i
       then
         do
@@ -922,8 +922,7 @@ def betree.BeTree.new
         params :=
           { min_flush_size := min_flush_size, split_size := split_size },
         node_id_cnt := node_id_cnt0,
-        root :=
-          (betree.Node.Leaf { id := id, size := (U64.ofInt 0 (by intlit)) })
+        root := (betree.Node.Leaf { id := id, size := (U64.ofInt 0) })
       })
 
 /- [betree_main::betree::BeTree::{6}::apply]: forward function -/
diff --git a/tests/lean/Constants.lean b/tests/lean/Constants.lean
index 8f22bfba..4a5a7b8f 100644
--- a/tests/lean/Constants.lean
+++ b/tests/lean/Constants.lean
@@ -5,12 +5,11 @@ open Primitives
 namespace constants
 
 /- [constants::X0] -/
-def x0_body : Result U32 := Result.ret (U32.ofInt 0 (by intlit))
+def x0_body : Result U32 := Result.ret (U32.ofInt 0)
 def x0_c : U32 := eval_global x0_body (by simp)
 
 /- [core::num::u32::{9}::MAX] -/
-def core_num_u32_max_body : Result U32 :=
-  Result.ret (U32.ofInt 4294967295 (by intlit))
+def core_num_u32_max_body : Result U32 := Result.ret (U32.ofInt 4294967295)
 def core_num_u32_max_c : U32 := eval_global core_num_u32_max_body (by simp)
 
 /- [constants::X1] -/
@@ -18,15 +17,15 @@ def x1_body : Result U32 := Result.ret core_num_u32_max_c
 def x1_c : U32 := eval_global x1_body (by simp)
 
 /- [constants::X2] -/
-def x2_body : Result U32 := Result.ret (U32.ofInt 3 (by intlit))
+def x2_body : Result U32 := Result.ret (U32.ofInt 3)
 def x2_c : U32 := eval_global x2_body (by simp)
 
 /- [constants::incr]: forward function -/
 def incr (n : U32) : Result U32 :=
-  n + (U32.ofInt 1 (by intlit))
+  n + (U32.ofInt 1)
 
 /- [constants::X3] -/
-def x3_body : Result U32 := incr (U32.ofInt 32 (by intlit))
+def x3_body : Result U32 := incr (U32.ofInt 32)
 def x3_c : U32 := eval_global x3_body (by simp)
 
 /- [constants::mk_pair0]: forward function -/
@@ -43,23 +42,20 @@ def mk_pair1 (x : U32) (y : U32) : Result (Pair U32 U32) :=
   Result.ret { x := x, y := y }
 
 /- [constants::P0] -/
-def p0_body : Result (U32 × U32) :=
-  mk_pair0 (U32.ofInt 0 (by intlit)) (U32.ofInt 1 (by intlit))
+def p0_body : Result (U32 × U32) := mk_pair0 (U32.ofInt 0) (U32.ofInt 1)
 def p0_c : (U32 × U32) := eval_global p0_body (by simp)
 
 /- [constants::P1] -/
-def p1_body : Result (Pair U32 U32) :=
-  mk_pair1 (U32.ofInt 0 (by intlit)) (U32.ofInt 1 (by intlit))
+def p1_body : Result (Pair U32 U32) := mk_pair1 (U32.ofInt 0) (U32.ofInt 1)
 def p1_c : Pair U32 U32 := eval_global p1_body (by simp)
 
 /- [constants::P2] -/
-def p2_body : Result (U32 × U32) :=
-  Result.ret ((U32.ofInt 0 (by intlit)), (U32.ofInt 1 (by intlit)))
+def p2_body : Result (U32 × U32) := Result.ret ((U32.ofInt 0), (U32.ofInt 1))
 def p2_c : (U32 × U32) := eval_global p2_body (by simp)
 
 /- [constants::P3] -/
 def p3_body : Result (Pair U32 U32) :=
-  Result.ret { x := (U32.ofInt 0 (by intlit)), y := (U32.ofInt 1 (by intlit)) }
+  Result.ret { x := (U32.ofInt 0), y := (U32.ofInt 1) }
 def p3_c : Pair U32 U32 := eval_global p3_body (by simp)
 
 /- [constants::Wrap] -/
@@ -71,7 +67,7 @@ def Wrap.new (T : Type) (val : T) : Result (Wrap T) :=
   Result.ret { val := val }
 
 /- [constants::Y] -/
-def y_body : Result (Wrap I32) := Wrap.new I32 (I32.ofInt 2 (by intlit))
+def y_body : Result (Wrap I32) := Wrap.new I32 (I32.ofInt 2)
 def y_c : Wrap I32 := eval_global y_body (by simp)
 
 /- [constants::unwrap_y]: forward function -/
@@ -83,7 +79,7 @@ def yval_body : Result I32 := unwrap_y
 def yval_c : I32 := eval_global yval_body (by simp)
 
 /- [constants::get_z1::Z1] -/
-def get_z1_z1_body : Result I32 := Result.ret (I32.ofInt 3 (by intlit))
+def get_z1_z1_body : Result I32 := Result.ret (I32.ofInt 3)
 def get_z1_z1_c : I32 := eval_global get_z1_z1_body (by simp)
 
 /- [constants::get_z1]: forward function -/
@@ -95,7 +91,7 @@ def add (a : I32) (b : I32) : Result I32 :=
   a + b
 
 /- [constants::Q1] -/
-def q1_body : Result I32 := Result.ret (I32.ofInt 5 (by intlit))
+def q1_body : Result I32 := Result.ret (I32.ofInt 5)
 def q1_c : I32 := eval_global q1_body (by simp)
 
 /- [constants::Q2] -/
@@ -103,7 +99,7 @@ def q2_body : Result I32 := Result.ret q1_c
 def q2_c : I32 := eval_global q2_body (by simp)
 
 /- [constants::Q3] -/
-def q3_body : Result I32 := add q2_c (I32.ofInt 3 (by intlit))
+def q3_body : Result I32 := add q2_c (I32.ofInt 3)
 def q3_c : I32 := eval_global q3_body (by simp)
 
 /- [constants::get_z2]: forward function -/
@@ -114,7 +110,7 @@ def get_z2 : Result I32 :=
     add q1_c i0
 
 /- [constants::S1] -/
-def s1_body : Result U32 := Result.ret (U32.ofInt 6 (by intlit))
+def s1_body : Result U32 := Result.ret (U32.ofInt 6)
 def s1_c : U32 := eval_global s1_body (by simp)
 
 /- [constants::S2] -/
@@ -126,8 +122,7 @@ def s3_body : Result (Pair U32 U32) := Result.ret p3_c
 def s3_c : Pair U32 U32 := eval_global s3_body (by simp)
 
 /- [constants::S4] -/
-def s4_body : Result (Pair U32 U32) :=
-  mk_pair1 (U32.ofInt 7 (by intlit)) (U32.ofInt 8 (by intlit))
+def s4_body : Result (Pair U32 U32) := mk_pair1 (U32.ofInt 7) (U32.ofInt 8)
 def s4_c : Pair U32 U32 := eval_global s4_body (by simp)
 
 end constants
diff --git a/tests/lean/External/Funs.lean b/tests/lean/External/Funs.lean
index 122f94da..674aaebd 100644
--- a/tests/lean/External/Funs.lean
+++ b/tests/lean/External/Funs.lean
@@ -36,7 +36,7 @@ def test_new_non_zero_u32
 def test_vec : Result Unit :=
   do
     let v := Vec.new U32
-    let _ ← Vec.push U32 v (U32.ofInt 0 (by intlit))
+    let _ ← Vec.push U32 v (U32.ofInt 0)
     Result.ret ()
 
 /- Unit test for [external::test_vec] -/
@@ -74,14 +74,14 @@ def test_custom_swap_back
   (x : U32) (y : U32) (st : State) (st0 : State) :
   Result (State × (U32 × U32))
   :=
-  custom_swap_back U32 x y st (U32.ofInt 1 (by intlit)) st0
+  custom_swap_back U32 x y st (U32.ofInt 1) st0
 
 /- [external::test_swap_non_zero]: forward function -/
 def test_swap_non_zero (x : U32) (st : State) : Result (State × U32) :=
   do
-    let (st0, _) ← swap U32 x (U32.ofInt 0 (by intlit)) st
-    let (st1, (x0, _)) ← swap_back U32 x (U32.ofInt 0 (by intlit)) st st0
-    if x0 = (U32.ofInt 0 (by intlit))
+    let (st0, _) ← swap U32 x (U32.ofInt 0) st
+    let (st1, (x0, _)) ← swap_back U32 x (U32.ofInt 0) st st0
+    if x0 = (U32.ofInt 0)
     then Result.fail Error.panic
     else Result.ret (st1, x0)
 
diff --git a/tests/lean/Hashmap/Funs.lean b/tests/lean/Hashmap/Funs.lean
index 5e11ffdd..870693b5 100644
--- a/tests/lean/Hashmap/Funs.lean
+++ b/tests/lean/Hashmap/Funs.lean
@@ -12,11 +12,11 @@ def hash_key (k : Usize) : Result Usize :=
 /- [hashmap::HashMap::{0}::allocate_slots]: loop 0: forward function -/
 divergent def HashMap.allocate_slots_loop
   (T : Type) (slots : Vec (List T)) (n : Usize) : Result (Vec (List T)) :=
-  if n > (Usize.ofInt 0 (by intlit))
+  if n > (Usize.ofInt 0)
   then
     do
       let slots0 ← Vec.push (List T) slots List.Nil
-      let n0 ← n - (Usize.ofInt 1 (by intlit))
+      let n0 ← n - (Usize.ofInt 1)
       HashMap.allocate_slots_loop T slots0 n0
   else Result.ret slots
 
@@ -38,7 +38,7 @@ def HashMap.new_with_capacity
     let i0 ← i / max_load_divisor
     Result.ret
       {
-        num_entries := (Usize.ofInt 0 (by intlit)),
+        num_entries := (Usize.ofInt 0),
         max_load_factor := (max_load_dividend, max_load_divisor),
         max_load := i0,
         slots := slots
@@ -46,8 +46,7 @@ def HashMap.new_with_capacity
 
 /- [hashmap::HashMap::{0}::new]: forward function -/
 def HashMap.new (T : Type) : Result (HashMap T) :=
-  HashMap.new_with_capacity T (Usize.ofInt 32 (by intlit))
-    (Usize.ofInt 4 (by intlit)) (Usize.ofInt 5 (by intlit))
+  HashMap.new_with_capacity T (Usize.ofInt 32) (Usize.ofInt 4) (Usize.ofInt 5)
 
 /- [hashmap::HashMap::{0}::clear]: loop 0: merged forward/backward function
    (there is a single backward function, and the forward function returns ()) -/
@@ -57,7 +56,7 @@ divergent def HashMap.clear_loop
   if i < i0
   then
     do
-      let i1 ← i + (Usize.ofInt 1 (by intlit))
+      let i1 ← i + (Usize.ofInt 1)
       let slots0 ← Vec.index_mut_back (List T) slots i List.Nil
       HashMap.clear_loop T slots0 i1
   else Result.ret slots
@@ -66,9 +65,8 @@ divergent def HashMap.clear_loop
    (there is a single backward function, and the forward function returns ()) -/
 def HashMap.clear (T : Type) (self : HashMap T) : Result (HashMap T) :=
   do
-    let v ← HashMap.clear_loop T self.slots (Usize.ofInt 0 (by intlit))
-    Result.ret
-      { self with num_entries := (Usize.ofInt 0 (by intlit)), slots := v }
+    let v ← HashMap.clear_loop T self.slots (Usize.ofInt 0)
+    Result.ret { self with num_entries := (Usize.ofInt 0), slots := v }
 
 /- [hashmap::HashMap::{0}::len]: forward function -/
 def HashMap.len (T : Type) (self : HashMap T) : Result Usize :=
@@ -123,7 +121,7 @@ def HashMap.insert_no_resize
     if inserted
     then
       do
-        let i0 ← self.num_entries + (Usize.ofInt 1 (by intlit))
+        let i0 ← self.num_entries + (Usize.ofInt 1)
         let l0 ← HashMap.insert_in_list_back T key value l
         let v ← Vec.index_mut_back (List T) self.slots hash_mod l0
         Result.ret { self with num_entries := i0, slots := v }
@@ -134,8 +132,7 @@ def HashMap.insert_no_resize
         Result.ret { self with slots := v }
 
 /- [core::num::u32::{9}::MAX] -/
-def core_num_u32_max_body : Result U32 :=
-  Result.ret (U32.ofInt 4294967295 (by intlit))
+def core_num_u32_max_body : Result U32 := Result.ret (U32.ofInt 4294967295)
 def core_num_u32_max_c : U32 := eval_global core_num_u32_max_body (by simp)
 
 /- [hashmap::HashMap::{0}::move_elements_from_list]: loop 0: merged forward/backward function
@@ -168,7 +165,7 @@ divergent def HashMap.move_elements_loop
       let l ← Vec.index_mut (List T) slots i
       let ls := mem.replace (List T) l List.Nil
       let ntable0 ← HashMap.move_elements_from_list T ntable ls
-      let i1 ← i + (Usize.ofInt 1 (by intlit))
+      let i1 ← i + (Usize.ofInt 1)
       let l0 := mem.replace_back (List T) l List.Nil
       let slots0 ← Vec.index_mut_back (List T) slots i l0
       HashMap.move_elements_loop T ntable0 slots0 i1
@@ -188,16 +185,16 @@ def HashMap.try_resize (T : Type) (self : HashMap T) : Result (HashMap T) :=
   do
     let max_usize ← Scalar.cast .Usize core_num_u32_max_c
     let capacity := Vec.len (List T) self.slots
-    let n1 ← max_usize / (Usize.ofInt 2 (by intlit))
+    let n1 ← max_usize / (Usize.ofInt 2)
     let (i, i0) := self.max_load_factor
     let i1 ← n1 / i
     if capacity <= i1
     then
       do
-        let i2 ← capacity * (Usize.ofInt 2 (by intlit))
+        let i2 ← capacity * (Usize.ofInt 2)
         let ntable ← HashMap.new_with_capacity T i2 i i0
         let (ntable0, _) ←
-          HashMap.move_elements T ntable self.slots (Usize.ofInt 0 (by intlit))
+          HashMap.move_elements T ntable self.slots (Usize.ofInt 0)
         Result.ret
           {
             ntable0
@@ -377,7 +374,7 @@ def HashMap.remove
     | Option.none => Result.ret Option.none
     | Option.some x0 =>
       do
-        let _ ← self.num_entries - (Usize.ofInt 1 (by intlit))
+        let _ ← self.num_entries - (Usize.ofInt 1)
         Result.ret (Option.some x0)
 
 /- [hashmap::HashMap::{0}::remove]: backward function 0 -/
@@ -397,7 +394,7 @@ def HashMap.remove_back
         Result.ret { self with slots := v }
     | Option.some x0 =>
       do
-        let i0 ← self.num_entries - (Usize.ofInt 1 (by intlit))
+        let i0 ← self.num_entries - (Usize.ofInt 1)
         let l0 ← HashMap.remove_from_list_back T key l
         let v ← Vec.index_mut_back (List T) self.slots hash_mod l0
         Result.ret { self with num_entries := i0, slots := v }
@@ -406,55 +403,43 @@ def HashMap.remove_back
 def test1 : Result Unit :=
   do
     let hm ← HashMap.new U64
-    let hm0 ←
-      HashMap.insert U64 hm (Usize.ofInt 0 (by intlit))
-        (U64.ofInt 42 (by intlit))
-    let hm1 ←
-      HashMap.insert U64 hm0 (Usize.ofInt 128 (by intlit))
-        (U64.ofInt 18 (by intlit))
-    let hm2 ←
-      HashMap.insert U64 hm1 (Usize.ofInt 1024 (by intlit))
-        (U64.ofInt 138 (by intlit))
-    let hm3 ←
-      HashMap.insert U64 hm2 (Usize.ofInt 1056 (by intlit))
-        (U64.ofInt 256 (by intlit))
-    let i ← HashMap.get U64 hm3 (Usize.ofInt 128 (by intlit))
-    if not (i = (U64.ofInt 18 (by intlit)))
+    let hm0 ← HashMap.insert U64 hm (Usize.ofInt 0) (U64.ofInt 42)
+    let hm1 ← HashMap.insert U64 hm0 (Usize.ofInt 128) (U64.ofInt 18)
+    let hm2 ← HashMap.insert U64 hm1 (Usize.ofInt 1024) (U64.ofInt 138)
+    let hm3 ← HashMap.insert U64 hm2 (Usize.ofInt 1056) (U64.ofInt 256)
+    let i ← HashMap.get U64 hm3 (Usize.ofInt 128)
+    if not (i = (U64.ofInt 18))
     then Result.fail Error.panic
     else
       do
         let hm4 ←
-          HashMap.get_mut_back U64 hm3 (Usize.ofInt 1024 (by intlit))
-            (U64.ofInt 56 (by intlit))
-        let i0 ← HashMap.get U64 hm4 (Usize.ofInt 1024 (by intlit))
-        if not (i0 = (U64.ofInt 56 (by intlit)))
+          HashMap.get_mut_back U64 hm3 (Usize.ofInt 1024) (U64.ofInt 56)
+        let i0 ← HashMap.get U64 hm4 (Usize.ofInt 1024)
+        if not (i0 = (U64.ofInt 56))
         then Result.fail Error.panic
         else
           do
-            let x ← HashMap.remove U64 hm4 (Usize.ofInt 1024 (by intlit))
+            let x ← HashMap.remove U64 hm4 (Usize.ofInt 1024)
             match x with
             | Option.none => Result.fail Error.panic
             | Option.some x0 =>
-              if not (x0 = (U64.ofInt 56 (by intlit)))
+              if not (x0 = (U64.ofInt 56))
               then Result.fail Error.panic
               else
                 do
-                  let hm5 ←
-                    HashMap.remove_back U64 hm4 (Usize.ofInt 1024 (by intlit))
-                  let i1 ← HashMap.get U64 hm5 (Usize.ofInt 0 (by intlit))
-                  if not (i1 = (U64.ofInt 42 (by intlit)))
+                  let hm5 ← HashMap.remove_back U64 hm4 (Usize.ofInt 1024)
+                  let i1 ← HashMap.get U64 hm5 (Usize.ofInt 0)
+                  if not (i1 = (U64.ofInt 42))
                   then Result.fail Error.panic
                   else
                     do
-                      let i2 ←
-                        HashMap.get U64 hm5 (Usize.ofInt 128 (by intlit))
-                      if not (i2 = (U64.ofInt 18 (by intlit)))
+                      let i2 ← HashMap.get U64 hm5 (Usize.ofInt 128)
+                      if not (i2 = (U64.ofInt 18))
                       then Result.fail Error.panic
                       else
                         do
-                          let i3 ←
-                            HashMap.get U64 hm5 (Usize.ofInt 1056 (by intlit))
-                          if not (i3 = (U64.ofInt 256 (by intlit)))
+                          let i3 ← HashMap.get U64 hm5 (Usize.ofInt 1056)
+                          if not (i3 = (U64.ofInt 256))
                           then Result.fail Error.panic
                           else Result.ret ()
 
diff --git a/tests/lean/HashmapMain/Funs.lean b/tests/lean/HashmapMain/Funs.lean
index e82cc9b2..610bae46 100644
--- a/tests/lean/HashmapMain/Funs.lean
+++ b/tests/lean/HashmapMain/Funs.lean
@@ -15,11 +15,11 @@ divergent def hashmap.HashMap.allocate_slots_loop
   (T : Type) (slots : Vec (hashmap.List T)) (n : Usize) :
   Result (Vec (hashmap.List T))
   :=
-  if n > (Usize.ofInt 0 (by intlit))
+  if n > (Usize.ofInt 0)
   then
     do
       let slots0 ← Vec.push (hashmap.List T) slots hashmap.List.Nil
-      let n0 ← n - (Usize.ofInt 1 (by intlit))
+      let n0 ← n - (Usize.ofInt 1)
       hashmap.HashMap.allocate_slots_loop T slots0 n0
   else Result.ret slots
 
@@ -43,7 +43,7 @@ def hashmap.HashMap.new_with_capacity
     let i0 ← i / max_load_divisor
     Result.ret
       {
-        num_entries := (Usize.ofInt 0 (by intlit)),
+        num_entries := (Usize.ofInt 0),
         max_load_factor := (max_load_dividend, max_load_divisor),
         max_load := i0,
         slots := slots
@@ -51,8 +51,8 @@ def hashmap.HashMap.new_with_capacity
 
 /- [hashmap_main::hashmap::HashMap::{0}::new]: forward function -/
 def hashmap.HashMap.new (T : Type) : Result (hashmap.HashMap T) :=
-  hashmap.HashMap.new_with_capacity T (Usize.ofInt 32 (by intlit))
-    (Usize.ofInt 4 (by intlit)) (Usize.ofInt 5 (by intlit))
+  hashmap.HashMap.new_with_capacity T (Usize.ofInt 32) (Usize.ofInt 4)
+    (Usize.ofInt 5)
 
 /- [hashmap_main::hashmap::HashMap::{0}::clear]: loop 0: merged forward/backward function
    (there is a single backward function, and the forward function returns ()) -/
@@ -64,7 +64,7 @@ divergent def hashmap.HashMap.clear_loop
   if i < i0
   then
     do
-      let i1 ← i + (Usize.ofInt 1 (by intlit))
+      let i1 ← i + (Usize.ofInt 1)
       let slots0 ←
         Vec.index_mut_back (hashmap.List T) slots i hashmap.List.Nil
       hashmap.HashMap.clear_loop T slots0 i1
@@ -75,10 +75,8 @@ divergent def hashmap.HashMap.clear_loop
 def hashmap.HashMap.clear
   (T : Type) (self : hashmap.HashMap T) : Result (hashmap.HashMap T) :=
   do
-    let v ←
-      hashmap.HashMap.clear_loop T self.slots (Usize.ofInt 0 (by intlit))
-    Result.ret
-      { self with num_entries := (Usize.ofInt 0 (by intlit)), slots := v }
+    let v ← hashmap.HashMap.clear_loop T self.slots (Usize.ofInt 0)
+    Result.ret { self with num_entries := (Usize.ofInt 0), slots := v }
 
 /- [hashmap_main::hashmap::HashMap::{0}::len]: forward function -/
 def hashmap.HashMap.len (T : Type) (self : hashmap.HashMap T) : Result Usize :=
@@ -138,7 +136,7 @@ def hashmap.HashMap.insert_no_resize
     if inserted
     then
       do
-        let i0 ← self.num_entries + (Usize.ofInt 1 (by intlit))
+        let i0 ← self.num_entries + (Usize.ofInt 1)
         let l0 ← hashmap.HashMap.insert_in_list_back T key value l
         let v ← Vec.index_mut_back (hashmap.List T) self.slots hash_mod l0
         Result.ret { self with num_entries := i0, slots := v }
@@ -149,8 +147,7 @@ def hashmap.HashMap.insert_no_resize
         Result.ret { self with slots := v }
 
 /- [core::num::u32::{9}::MAX] -/
-def core_num_u32_max_body : Result U32 :=
-  Result.ret (U32.ofInt 4294967295 (by intlit))
+def core_num_u32_max_body : Result U32 := Result.ret (U32.ofInt 4294967295)
 def core_num_u32_max_c : U32 := eval_global core_num_u32_max_body (by simp)
 
 /- [hashmap_main::hashmap::HashMap::{0}::move_elements_from_list]: loop 0: merged forward/backward function
@@ -188,7 +185,7 @@ divergent def hashmap.HashMap.move_elements_loop
       let l ← Vec.index_mut (hashmap.List T) slots i
       let ls := mem.replace (hashmap.List T) l hashmap.List.Nil
       let ntable0 ← hashmap.HashMap.move_elements_from_list T ntable ls
-      let i1 ← i + (Usize.ofInt 1 (by intlit))
+      let i1 ← i + (Usize.ofInt 1)
       let l0 := mem.replace_back (hashmap.List T) l hashmap.List.Nil
       let slots0 ← Vec.index_mut_back (hashmap.List T) slots i l0
       hashmap.HashMap.move_elements_loop T ntable0 slots0 i1
@@ -210,17 +207,16 @@ def hashmap.HashMap.try_resize
   do
     let max_usize ← Scalar.cast .Usize core_num_u32_max_c
     let capacity := Vec.len (hashmap.List T) self.slots
-    let n1 ← max_usize / (Usize.ofInt 2 (by intlit))
+    let n1 ← max_usize / (Usize.ofInt 2)
     let (i, i0) := self.max_load_factor
     let i1 ← n1 / i
     if capacity <= i1
     then
       do
-        let i2 ← capacity * (Usize.ofInt 2 (by intlit))
+        let i2 ← capacity * (Usize.ofInt 2)
         let ntable ← hashmap.HashMap.new_with_capacity T i2 i i0
         let (ntable0, _) ←
-          hashmap.HashMap.move_elements T ntable self.slots
-            (Usize.ofInt 0 (by intlit))
+          hashmap.HashMap.move_elements T ntable self.slots (Usize.ofInt 0)
         Result.ret
           {
             ntable0
@@ -411,7 +407,7 @@ def hashmap.HashMap.remove
     | Option.none => Result.ret Option.none
     | Option.some x0 =>
       do
-        let _ ← self.num_entries - (Usize.ofInt 1 (by intlit))
+        let _ ← self.num_entries - (Usize.ofInt 1)
         Result.ret (Option.some x0)
 
 /- [hashmap_main::hashmap::HashMap::{0}::remove]: backward function 0 -/
@@ -433,7 +429,7 @@ def hashmap.HashMap.remove_back
         Result.ret { self with slots := v }
     | Option.some x0 =>
       do
-        let i0 ← self.num_entries - (Usize.ofInt 1 (by intlit))
+        let i0 ← self.num_entries - (Usize.ofInt 1)
         let l0 ← hashmap.HashMap.remove_from_list_back T key l
         let v ← Vec.index_mut_back (hashmap.List T) self.slots hash_mod l0
         Result.ret { self with num_entries := i0, slots := v }
@@ -442,60 +438,48 @@ def hashmap.HashMap.remove_back
 def hashmap.test1 : Result Unit :=
   do
     let hm ← hashmap.HashMap.new U64
-    let hm0 ←
-      hashmap.HashMap.insert U64 hm (Usize.ofInt 0 (by intlit))
-        (U64.ofInt 42 (by intlit))
-    let hm1 ←
-      hashmap.HashMap.insert U64 hm0 (Usize.ofInt 128 (by intlit))
-        (U64.ofInt 18 (by intlit))
+    let hm0 ← hashmap.HashMap.insert U64 hm (Usize.ofInt 0) (U64.ofInt 42)
+    let hm1 ← hashmap.HashMap.insert U64 hm0 (Usize.ofInt 128) (U64.ofInt 18)
     let hm2 ←
-      hashmap.HashMap.insert U64 hm1 (Usize.ofInt 1024 (by intlit))
-        (U64.ofInt 138 (by intlit))
+      hashmap.HashMap.insert U64 hm1 (Usize.ofInt 1024) (U64.ofInt 138)
     let hm3 ←
-      hashmap.HashMap.insert U64 hm2 (Usize.ofInt 1056 (by intlit))
-        (U64.ofInt 256 (by intlit))
-    let i ← hashmap.HashMap.get U64 hm3 (Usize.ofInt 128 (by intlit))
-    if not (i = (U64.ofInt 18 (by intlit)))
+      hashmap.HashMap.insert U64 hm2 (Usize.ofInt 1056) (U64.ofInt 256)
+    let i ← hashmap.HashMap.get U64 hm3 (Usize.ofInt 128)
+    if not (i = (U64.ofInt 18))
     then Result.fail Error.panic
     else
       do
         let hm4 ←
-          hashmap.HashMap.get_mut_back U64 hm3 (Usize.ofInt 1024 (by intlit))
-            (U64.ofInt 56 (by intlit))
-        let i0 ← hashmap.HashMap.get U64 hm4 (Usize.ofInt 1024 (by intlit))
-        if not (i0 = (U64.ofInt 56 (by intlit)))
+          hashmap.HashMap.get_mut_back U64 hm3 (Usize.ofInt 1024)
+            (U64.ofInt 56)
+        let i0 ← hashmap.HashMap.get U64 hm4 (Usize.ofInt 1024)
+        if not (i0 = (U64.ofInt 56))
         then Result.fail Error.panic
         else
           do
-            let x ←
-              hashmap.HashMap.remove U64 hm4 (Usize.ofInt 1024 (by intlit))
+            let x ← hashmap.HashMap.remove U64 hm4 (Usize.ofInt 1024)
             match x with
             | Option.none => Result.fail Error.panic
             | Option.some x0 =>
-              if not (x0 = (U64.ofInt 56 (by intlit)))
+              if not (x0 = (U64.ofInt 56))
               then Result.fail Error.panic
               else
                 do
                   let hm5 ←
-                    hashmap.HashMap.remove_back U64 hm4
-                      (Usize.ofInt 1024 (by intlit))
-                  let i1 ←
-                    hashmap.HashMap.get U64 hm5 (Usize.ofInt 0 (by intlit))
-                  if not (i1 = (U64.ofInt 42 (by intlit)))
+                    hashmap.HashMap.remove_back U64 hm4 (Usize.ofInt 1024)
+                  let i1 ← hashmap.HashMap.get U64 hm5 (Usize.ofInt 0)
+                  if not (i1 = (U64.ofInt 42))
                   then Result.fail Error.panic
                   else
                     do
-                      let i2 ←
-                        hashmap.HashMap.get U64 hm5
-                          (Usize.ofInt 128 (by intlit))
-                      if not (i2 = (U64.ofInt 18 (by intlit)))
+                      let i2 ← hashmap.HashMap.get U64 hm5 (Usize.ofInt 128)
+                      if not (i2 = (U64.ofInt 18))
                       then Result.fail Error.panic
                       else
                         do
                           let i3 ←
-                            hashmap.HashMap.get U64 hm5
-                              (Usize.ofInt 1056 (by intlit))
-                          if not (i3 = (U64.ofInt 256 (by intlit)))
+                            hashmap.HashMap.get U64 hm5 (Usize.ofInt 1056)
+                          if not (i3 = (U64.ofInt 256))
                           then Result.fail Error.panic
                           else Result.ret ()
 
diff --git a/tests/lean/Loops/Funs.lean b/tests/lean/Loops/Funs.lean
index 8cac7ac0..f7e6603d 100644
--- a/tests/lean/Loops/Funs.lean
+++ b/tests/lean/Loops/Funs.lean
@@ -8,16 +8,15 @@ namespace loops
 /- [loops::sum]: loop 0: forward function -/
 divergent def sum_loop (max : U32) (i : U32) (s : U32) : Result U32 :=
   if i < max
-  then
-    do
-      let s0 ← s + i
-      let i0 ← i + (U32.ofInt 1 (by intlit))
-      sum_loop max i0 s0
-  else s * (U32.ofInt 2 (by intlit))
+  then do
+         let s0 ← s + i
+         let i0 ← i + (U32.ofInt 1)
+         sum_loop max i0 s0
+  else s * (U32.ofInt 2)
 
 /- [loops::sum]: forward function -/
 def sum (max : U32) : Result U32 :=
-  sum_loop max (U32.ofInt 0 (by intlit)) (U32.ofInt 0 (by intlit))
+  sum_loop max (U32.ofInt 0) (U32.ofInt 0)
 
 /- [loops::sum_with_mut_borrows]: loop 0: forward function -/
 divergent def sum_with_mut_borrows_loop
@@ -26,14 +25,13 @@ divergent def sum_with_mut_borrows_loop
   then
     do
       let ms0 ← ms + mi
-      let mi0 ← mi + (U32.ofInt 1 (by intlit))
+      let mi0 ← mi + (U32.ofInt 1)
       sum_with_mut_borrows_loop max mi0 ms0
-  else ms * (U32.ofInt 2 (by intlit))
+  else ms * (U32.ofInt 2)
 
 /- [loops::sum_with_mut_borrows]: forward function -/
 def sum_with_mut_borrows (max : U32) : Result U32 :=
-  sum_with_mut_borrows_loop max (U32.ofInt 0 (by intlit))
-    (U32.ofInt 0 (by intlit))
+  sum_with_mut_borrows_loop max (U32.ofInt 0) (U32.ofInt 0)
 
 /- [loops::sum_with_shared_borrows]: loop 0: forward function -/
 divergent def sum_with_shared_borrows_loop
@@ -41,15 +39,14 @@ divergent def sum_with_shared_borrows_loop
   if i < max
   then
     do
-      let i0 ← i + (U32.ofInt 1 (by intlit))
+      let i0 ← i + (U32.ofInt 1)
       let s0 ← s + i0
       sum_with_shared_borrows_loop max i0 s0
-  else s * (U32.ofInt 2 (by intlit))
+  else s * (U32.ofInt 2)
 
 /- [loops::sum_with_shared_borrows]: forward function -/
 def sum_with_shared_borrows (max : U32) : Result U32 :=
-  sum_with_shared_borrows_loop max (U32.ofInt 0 (by intlit))
-    (U32.ofInt 0 (by intlit))
+  sum_with_shared_borrows_loop max (U32.ofInt 0) (U32.ofInt 0)
 
 /- [loops::clear]: loop 0: merged forward/backward function
    (there is a single backward function, and the forward function returns ()) -/
@@ -58,15 +55,15 @@ divergent def clear_loop (v : Vec U32) (i : Usize) : Result (Vec U32) :=
   if i < i0
   then
     do
-      let i1 ← i + (Usize.ofInt 1 (by intlit))
-      let v0 ← Vec.index_mut_back U32 v i (U32.ofInt 0 (by intlit))
+      let i1 ← i + (Usize.ofInt 1)
+      let v0 ← Vec.index_mut_back U32 v i (U32.ofInt 0)
       clear_loop v0 i1
   else Result.ret v
 
 /- [loops::clear]: merged forward/backward function
    (there is a single backward function, and the forward function returns ()) -/
 def clear (v : Vec U32) : Result (Vec U32) :=
-  clear_loop v (Usize.ofInt 0 (by intlit))
+  clear_loop v (Usize.ofInt 0)
 
 /- [loops::list_mem]: loop 0: forward function -/
 divergent def list_mem_loop (x : U32) (ls : List U32) : Result Bool :=
@@ -85,12 +82,11 @@ divergent def list_nth_mut_loop_loop
   (T : Type) (ls : List T) (i : U32) : Result T :=
   match ls with
   | List.Cons x tl =>
-    if i = (U32.ofInt 0 (by intlit))
+    if i = (U32.ofInt 0)
     then Result.ret x
-    else
-      do
-        let i0 ← i - (U32.ofInt 1 (by intlit))
-        list_nth_mut_loop_loop T tl i0
+    else do
+           let i0 ← i - (U32.ofInt 1)
+           list_nth_mut_loop_loop T tl i0
   | List.Nil => Result.fail Error.panic
 
 /- [loops::list_nth_mut_loop]: forward function -/
@@ -102,11 +98,11 @@ divergent def list_nth_mut_loop_loop_back
   (T : Type) (ls : List T) (i : U32) (ret0 : T) : Result (List T) :=
   match ls with
   | List.Cons x tl =>
-    if i = (U32.ofInt 0 (by intlit))
+    if i = (U32.ofInt 0)
     then Result.ret (List.Cons ret0 tl)
     else
       do
-        let i0 ← i - (U32.ofInt 1 (by intlit))
+        let i0 ← i - (U32.ofInt 1)
         let tl0 ← list_nth_mut_loop_loop_back T tl i0 ret0
         Result.ret (List.Cons x tl0)
   | List.Nil => Result.fail Error.panic
@@ -121,12 +117,11 @@ divergent def list_nth_shared_loop_loop
   (T : Type) (ls : List T) (i : U32) : Result T :=
   match ls with
   | List.Cons x tl =>
-    if i = (U32.ofInt 0 (by intlit))
+    if i = (U32.ofInt 0)
     then Result.ret x
-    else
-      do
-        let i0 ← i - (U32.ofInt 1 (by intlit))
-        list_nth_shared_loop_loop T tl i0
+    else do
+           let i0 ← i - (U32.ofInt 1)
+           list_nth_shared_loop_loop T tl i0
   | List.Nil => Result.fail Error.panic
 
 /- [loops::list_nth_shared_loop]: forward function -/
@@ -144,7 +139,7 @@ divergent def get_elem_mut_loop (x : Usize) (ls : List Usize) : Result Usize :=
 /- [loops::get_elem_mut]: forward function -/
 def get_elem_mut (slots : Vec (List Usize)) (x : Usize) : Result Usize :=
   do
-    let l ← Vec.index_mut (List Usize) slots (Usize.ofInt 0 (by intlit))
+    let l ← Vec.index_mut (List Usize) slots (Usize.ofInt 0)
     get_elem_mut_loop x l
 
 /- [loops::get_elem_mut]: loop 0: backward function 0 -/
@@ -166,9 +161,9 @@ def get_elem_mut_back
   Result (Vec (List Usize))
   :=
   do
-    let l ← Vec.index_mut (List Usize) slots (Usize.ofInt 0 (by intlit))
+    let l ← Vec.index_mut (List Usize) slots (Usize.ofInt 0)
     let l0 ← get_elem_mut_loop_back x l ret0
-    Vec.index_mut_back (List Usize) slots (Usize.ofInt 0 (by intlit)) l0
+    Vec.index_mut_back (List Usize) slots (Usize.ofInt 0) l0
 
 /- [loops::get_elem_shared]: loop 0: forward function -/
 divergent def get_elem_shared_loop
@@ -182,7 +177,7 @@ divergent def get_elem_shared_loop
 /- [loops::get_elem_shared]: forward function -/
 def get_elem_shared (slots : Vec (List Usize)) (x : Usize) : Result Usize :=
   do
-    let l ← Vec.index (List Usize) slots (Usize.ofInt 0 (by intlit))
+    let l ← Vec.index (List Usize) slots (Usize.ofInt 0)
     get_elem_shared_loop x l
 
 /- [loops::id_mut]: forward function -/
@@ -202,12 +197,11 @@ divergent def list_nth_mut_loop_with_id_loop
   (T : Type) (i : U32) (ls : List T) : Result T :=
   match ls with
   | List.Cons x tl =>
-    if i = (U32.ofInt 0 (by intlit))
+    if i = (U32.ofInt 0)
     then Result.ret x
-    else
-      do
-        let i0 ← i - (U32.ofInt 1 (by intlit))
-        list_nth_mut_loop_with_id_loop T i0 tl
+    else do
+           let i0 ← i - (U32.ofInt 1)
+           list_nth_mut_loop_with_id_loop T i0 tl
   | List.Nil => Result.fail Error.panic
 
 /- [loops::list_nth_mut_loop_with_id]: forward function -/
@@ -221,11 +215,11 @@ divergent def list_nth_mut_loop_with_id_loop_back
   (T : Type) (i : U32) (ls : List T) (ret0 : T) : Result (List T) :=
   match ls with
   | List.Cons x tl =>
-    if i = (U32.ofInt 0 (by intlit))
+    if i = (U32.ofInt 0)
     then Result.ret (List.Cons ret0 tl)
     else
       do
-        let i0 ← i - (U32.ofInt 1 (by intlit))
+        let i0 ← i - (U32.ofInt 1)
         let tl0 ← list_nth_mut_loop_with_id_loop_back T i0 tl ret0
         Result.ret (List.Cons x tl0)
   | List.Nil => Result.fail Error.panic
@@ -243,11 +237,11 @@ divergent def list_nth_shared_loop_with_id_loop
   (T : Type) (i : U32) (ls : List T) : Result T :=
   match ls with
   | List.Cons x tl =>
-    if i = (U32.ofInt 0 (by intlit))
+    if i = (U32.ofInt 0)
     then Result.ret x
     else
       do
-        let i0 ← i - (U32.ofInt 1 (by intlit))
+        let i0 ← i - (U32.ofInt 1)
         list_nth_shared_loop_with_id_loop T i0 tl
   | List.Nil => Result.fail Error.panic
 
@@ -265,11 +259,11 @@ divergent def list_nth_mut_loop_pair_loop
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
-      if i = (U32.ofInt 0 (by intlit))
+      if i = (U32.ofInt 0)
       then Result.ret (x0, x1)
       else
         do
-          let i0 ← i - (U32.ofInt 1 (by intlit))
+          let i0 ← i - (U32.ofInt 1)
           list_nth_mut_loop_pair_loop T tl0 tl1 i0
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
@@ -288,11 +282,11 @@ divergent def list_nth_mut_loop_pair_loop_back'a
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
-      if i = (U32.ofInt 0 (by intlit))
+      if i = (U32.ofInt 0)
       then Result.ret (List.Cons ret0 tl0)
       else
         do
-          let i0 ← i - (U32.ofInt 1 (by intlit))
+          let i0 ← i - (U32.ofInt 1)
           let tl00 ← list_nth_mut_loop_pair_loop_back'a T tl0 tl1 i0 ret0
           Result.ret (List.Cons x0 tl00)
     | List.Nil => Result.fail Error.panic
@@ -314,11 +308,11 @@ divergent def list_nth_mut_loop_pair_loop_back'b
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
-      if i = (U32.ofInt 0 (by intlit))
+      if i = (U32.ofInt 0)
       then Result.ret (List.Cons ret0 tl1)
       else
         do
-          let i0 ← i - (U32.ofInt 1 (by intlit))
+          let i0 ← i - (U32.ofInt 1)
           let tl10 ← list_nth_mut_loop_pair_loop_back'b T tl0 tl1 i0 ret0
           Result.ret (List.Cons x1 tl10)
     | List.Nil => Result.fail Error.panic
@@ -338,11 +332,11 @@ divergent def list_nth_shared_loop_pair_loop
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
-      if i = (U32.ofInt 0 (by intlit))
+      if i = (U32.ofInt 0)
       then Result.ret (x0, x1)
       else
         do
-          let i0 ← i - (U32.ofInt 1 (by intlit))
+          let i0 ← i - (U32.ofInt 1)
           list_nth_shared_loop_pair_loop T tl0 tl1 i0
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
@@ -359,11 +353,11 @@ divergent def list_nth_mut_loop_pair_merge_loop
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
-      if i = (U32.ofInt 0 (by intlit))
+      if i = (U32.ofInt 0)
       then Result.ret (x0, x1)
       else
         do
-          let i0 ← i - (U32.ofInt 1 (by intlit))
+          let i0 ← i - (U32.ofInt 1)
           list_nth_mut_loop_pair_merge_loop T tl0 tl1 i0
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
@@ -382,12 +376,12 @@ divergent def list_nth_mut_loop_pair_merge_loop_back
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
-      if i = (U32.ofInt 0 (by intlit))
+      if i = (U32.ofInt 0)
       then let (t, t0) := ret0
            Result.ret (List.Cons t tl0, List.Cons t0 tl1)
       else
         do
-          let i0 ← i - (U32.ofInt 1 (by intlit))
+          let i0 ← i - (U32.ofInt 1)
           let (tl00, tl10) ←
             list_nth_mut_loop_pair_merge_loop_back T tl0 tl1 i0 ret0
           Result.ret (List.Cons x0 tl00, List.Cons x1 tl10)
@@ -408,11 +402,11 @@ divergent def list_nth_shared_loop_pair_merge_loop
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
-      if i = (U32.ofInt 0 (by intlit))
+      if i = (U32.ofInt 0)
       then Result.ret (x0, x1)
       else
         do
-          let i0 ← i - (U32.ofInt 1 (by intlit))
+          let i0 ← i - (U32.ofInt 1)
           list_nth_shared_loop_pair_merge_loop T tl0 tl1 i0
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
@@ -429,11 +423,11 @@ divergent def list_nth_mut_shared_loop_pair_loop
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
-      if i = (U32.ofInt 0 (by intlit))
+      if i = (U32.ofInt 0)
       then Result.ret (x0, x1)
       else
         do
-          let i0 ← i - (U32.ofInt 1 (by intlit))
+          let i0 ← i - (U32.ofInt 1)
           list_nth_mut_shared_loop_pair_loop T tl0 tl1 i0
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
@@ -452,11 +446,11 @@ divergent def list_nth_mut_shared_loop_pair_loop_back
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
-      if i = (U32.ofInt 0 (by intlit))
+      if i = (U32.ofInt 0)
       then Result.ret (List.Cons ret0 tl0)
       else
         do
-          let i0 ← i - (U32.ofInt 1 (by intlit))
+          let i0 ← i - (U32.ofInt 1)
           let tl00 ←
             list_nth_mut_shared_loop_pair_loop_back T tl0 tl1 i0 ret0
           Result.ret (List.Cons x0 tl00)
@@ -477,11 +471,11 @@ divergent def list_nth_mut_shared_loop_pair_merge_loop
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
-      if i = (U32.ofInt 0 (by intlit))
+      if i = (U32.ofInt 0)
       then Result.ret (x0, x1)
       else
         do
-          let i0 ← i - (U32.ofInt 1 (by intlit))
+          let i0 ← i - (U32.ofInt 1)
           list_nth_mut_shared_loop_pair_merge_loop T tl0 tl1 i0
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
@@ -500,11 +494,11 @@ divergent def list_nth_mut_shared_loop_pair_merge_loop_back
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
-      if i = (U32.ofInt 0 (by intlit))
+      if i = (U32.ofInt 0)
       then Result.ret (List.Cons ret0 tl0)
       else
         do
-          let i0 ← i - (U32.ofInt 1 (by intlit))
+          let i0 ← i - (U32.ofInt 1)
           let tl00 ←
             list_nth_mut_shared_loop_pair_merge_loop_back T tl0 tl1 i0 ret0
           Result.ret (List.Cons x0 tl00)
@@ -525,11 +519,11 @@ divergent def list_nth_shared_mut_loop_pair_loop
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
-      if i = (U32.ofInt 0 (by intlit))
+      if i = (U32.ofInt 0)
       then Result.ret (x0, x1)
       else
         do
-          let i0 ← i - (U32.ofInt 1 (by intlit))
+          let i0 ← i - (U32.ofInt 1)
           list_nth_shared_mut_loop_pair_loop T tl0 tl1 i0
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
@@ -548,11 +542,11 @@ divergent def list_nth_shared_mut_loop_pair_loop_back
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
-      if i = (U32.ofInt 0 (by intlit))
+      if i = (U32.ofInt 0)
       then Result.ret (List.Cons ret0 tl1)
       else
         do
-          let i0 ← i - (U32.ofInt 1 (by intlit))
+          let i0 ← i - (U32.ofInt 1)
           let tl10 ←
             list_nth_shared_mut_loop_pair_loop_back T tl0 tl1 i0 ret0
           Result.ret (List.Cons x1 tl10)
@@ -573,11 +567,11 @@ divergent def list_nth_shared_mut_loop_pair_merge_loop
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
-      if i = (U32.ofInt 0 (by intlit))
+      if i = (U32.ofInt 0)
       then Result.ret (x0, x1)
       else
         do
-          let i0 ← i - (U32.ofInt 1 (by intlit))
+          let i0 ← i - (U32.ofInt 1)
           list_nth_shared_mut_loop_pair_merge_loop T tl0 tl1 i0
     | List.Nil => Result.fail Error.panic
   | List.Nil => Result.fail Error.panic
@@ -596,11 +590,11 @@ divergent def list_nth_shared_mut_loop_pair_merge_loop_back
   | List.Cons x0 tl0 =>
     match ls1 with
     | List.Cons x1 tl1 =>
-      if i = (U32.ofInt 0 (by intlit))
+      if i = (U32.ofInt 0)
       then Result.ret (List.Cons ret0 tl1)
       else
         do
-          let i0 ← i - (U32.ofInt 1 (by intlit))
+          let i0 ← i - (U32.ofInt 1)
           let tl10 ←
             list_nth_shared_mut_loop_pair_merge_loop_back T tl0 tl1 i0 ret0
           Result.ret (List.Cons x1 tl10)
diff --git a/tests/lean/NoNestedBorrows.lean b/tests/lean/NoNestedBorrows.lean
index 1c6421bb..bc707fd9 100644
--- a/tests/lean/NoNestedBorrows.lean
+++ b/tests/lean/NoNestedBorrows.lean
@@ -53,7 +53,7 @@ def div_test (x : U32) (y : U32) : Result U32 :=
 
 /- [no_nested_borrows::div_test1]: forward function -/
 def div_test1 (x : U32) : Result U32 :=
-  x / (U32.ofInt 2 (by intlit))
+  x / (U32.ofInt 2)
 
 /- [no_nested_borrows::rem_test]: forward function -/
 def rem_test (x : U32) (y : U32) : Result U32 :=
@@ -66,7 +66,7 @@ def cast_test (x : U32) : Result I32 :=
 /- [no_nested_borrows::test2]: forward function -/
 def test2 : Result Unit :=
   do
-    let _ ← (U32.ofInt 23 (by intlit)) + (U32.ofInt 44 (by intlit))
+    let _ ← (U32.ofInt 23) + (U32.ofInt 44)
     Result.ret ()
 
 /- Unit test for [no_nested_borrows::test2] -/
@@ -81,10 +81,10 @@ def get_max (x : U32) (y : U32) : Result U32 :=
 /- [no_nested_borrows::test3]: forward function -/
 def test3 : Result Unit :=
   do
-    let x ← get_max (U32.ofInt 4 (by intlit)) (U32.ofInt 3 (by intlit))
-    let y ← get_max (U32.ofInt 10 (by intlit)) (U32.ofInt 11 (by intlit))
+    let x ← get_max (U32.ofInt 4) (U32.ofInt 3)
+    let y ← get_max (U32.ofInt 10) (U32.ofInt 11)
     let z ← x + y
-    if not (z = (U32.ofInt 15 (by intlit)))
+    if not (z = (U32.ofInt 15))
     then Result.fail Error.panic
     else Result.ret ()
 
@@ -94,8 +94,8 @@ def test3 : Result Unit :=
 /- [no_nested_borrows::test_neg1]: forward function -/
 def test_neg1 : Result Unit :=
   do
-    let y ← - (I32.ofInt 3 (by intlit))
-    if not (y = (I32.ofInt (-(3:Int)) (by intlit)))
+    let y ← - (I32.ofInt 3)
+    if not (y = (I32.ofInt (-(3:Int))))
     then Result.fail Error.panic
     else Result.ret ()
 
@@ -104,7 +104,7 @@ def test_neg1 : Result Unit :=
 
 /- [no_nested_borrows::refs_test1]: forward function -/
 def refs_test1 : Result Unit :=
-  if not ((I32.ofInt 1 (by intlit)) = (I32.ofInt 1 (by intlit)))
+  if not ((I32.ofInt 1) = (I32.ofInt 1))
   then Result.fail Error.panic
   else Result.ret ()
 
@@ -113,16 +113,16 @@ def refs_test1 : Result Unit :=
 
 /- [no_nested_borrows::refs_test2]: forward function -/
 def refs_test2 : Result Unit :=
-  if not ((I32.ofInt 2 (by intlit)) = (I32.ofInt 2 (by intlit)))
+  if not ((I32.ofInt 2) = (I32.ofInt 2))
   then Result.fail Error.panic
   else
-    if not ((I32.ofInt 0 (by intlit)) = (I32.ofInt 0 (by intlit)))
+    if not ((I32.ofInt 0) = (I32.ofInt 0))
     then Result.fail Error.panic
     else
-      if not ((I32.ofInt 2 (by intlit)) = (I32.ofInt 2 (by intlit)))
+      if not ((I32.ofInt 2) = (I32.ofInt 2))
       then Result.fail Error.panic
       else
-        if not ((I32.ofInt 2 (by intlit)) = (I32.ofInt 2 (by intlit)))
+        if not ((I32.ofInt 2) = (I32.ofInt 2))
         then Result.fail Error.panic
         else Result.ret ()
 
@@ -138,9 +138,9 @@ def test_list1 : Result Unit :=
 
 /- [no_nested_borrows::test_box1]: forward function -/
 def test_box1 : Result Unit :=
-  let b := (I32.ofInt 1 (by intlit))
+  let b := (I32.ofInt 1)
   let x := b
-  if not (x = (I32.ofInt 1 (by intlit)))
+  if not (x = (I32.ofInt 1))
   then Result.fail Error.panic
   else Result.ret ()
 
@@ -166,8 +166,8 @@ def test_panic (b : Bool) : Result Unit :=
 /- [no_nested_borrows::test_copy_int]: forward function -/
 def test_copy_int : Result Unit :=
   do
-    let y ← copy_int (I32.ofInt 0 (by intlit))
-    if not ((I32.ofInt 0 (by intlit)) = y)
+    let y ← copy_int (I32.ofInt 0)
+    if not ((I32.ofInt 0) = y)
     then Result.fail Error.panic
     else Result.ret ()
 
@@ -184,7 +184,7 @@ def is_cons (T : Type) (l : List T) : Result Bool :=
 def test_is_cons : Result Unit :=
   do
     let l := List.Nil
-    let b ← is_cons I32 (List.Cons (I32.ofInt 0 (by intlit)) l)
+    let b ← is_cons I32 (List.Cons (I32.ofInt 0) l)
     if not b
     then Result.fail Error.panic
     else Result.ret ()
@@ -202,9 +202,9 @@ def split_list (T : Type) (l : List T) : Result (T × (List T)) :=
 def test_split_list : Result Unit :=
   do
     let l := List.Nil
-    let p ← split_list I32 (List.Cons (I32.ofInt 0 (by intlit)) l)
+    let p ← split_list I32 (List.Cons (I32.ofInt 0) l)
     let (hd, _) := p
-    if not (hd = (I32.ofInt 0 (by intlit)))
+    if not (hd = (I32.ofInt 0))
     then Result.fail Error.panic
     else Result.ret ()
 
@@ -227,20 +227,17 @@ def choose_back
 /- [no_nested_borrows::choose_test]: forward function -/
 def choose_test : Result Unit :=
   do
-    let z ←
-      choose I32 true (I32.ofInt 0 (by intlit)) (I32.ofInt 0 (by intlit))
-    let z0 ← z + (I32.ofInt 1 (by intlit))
-    if not (z0 = (I32.ofInt 1 (by intlit)))
+    let z ← choose I32 true (I32.ofInt 0) (I32.ofInt 0)
+    let z0 ← z + (I32.ofInt 1)
+    if not (z0 = (I32.ofInt 1))
     then Result.fail Error.panic
     else
       do
-        let (x, y) ←
-          choose_back I32 true (I32.ofInt 0 (by intlit))
-            (I32.ofInt 0 (by intlit)) z0
-        if not (x = (I32.ofInt 1 (by intlit)))
+        let (x, y) ← choose_back I32 true (I32.ofInt 0) (I32.ofInt 0) z0
+        if not (x = (I32.ofInt 1))
         then Result.fail Error.panic
         else
-          if not (y = (I32.ofInt 0 (by intlit)))
+          if not (y = (I32.ofInt 0))
           then Result.fail Error.panic
           else Result.ret ()
 
@@ -268,20 +265,19 @@ end
 /- [no_nested_borrows::list_length]: forward function -/
 divergent def list_length (T : Type) (l : List T) : Result U32 :=
   match l with
-  | List.Cons t l1 =>
-    do
-      let i ← list_length T l1
-      (U32.ofInt 1 (by intlit)) + i
-  | List.Nil => Result.ret (U32.ofInt 0 (by intlit))
+  | List.Cons t l1 => do
+                        let i ← list_length T l1
+                        (U32.ofInt 1) + i
+  | List.Nil => Result.ret (U32.ofInt 0)
 
 /- [no_nested_borrows::list_nth_shared]: forward function -/
 divergent def list_nth_shared (T : Type) (l : List T) (i : U32) : Result T :=
   match l with
   | List.Cons x tl =>
-    if i = (U32.ofInt 0 (by intlit))
+    if i = (U32.ofInt 0)
     then Result.ret x
     else do
-           let i0 ← i - (U32.ofInt 1 (by intlit))
+           let i0 ← i - (U32.ofInt 1)
            list_nth_shared T tl i0
   | List.Nil => Result.fail Error.panic
 
@@ -289,10 +285,10 @@ divergent def list_nth_shared (T : Type) (l : List T) (i : U32) : Result T :=
 divergent def list_nth_mut (T : Type) (l : List T) (i : U32) : Result T :=
   match l with
   | List.Cons x tl =>
-    if i = (U32.ofInt 0 (by intlit))
+    if i = (U32.ofInt 0)
     then Result.ret x
     else do
-           let i0 ← i - (U32.ofInt 1 (by intlit))
+           let i0 ← i - (U32.ofInt 1)
            list_nth_mut T tl i0
   | List.Nil => Result.fail Error.panic
 
@@ -301,11 +297,11 @@ divergent def list_nth_mut_back
   (T : Type) (l : List T) (i : U32) (ret0 : T) : Result (List T) :=
   match l with
   | List.Cons x tl =>
-    if i = (U32.ofInt 0 (by intlit))
+    if i = (U32.ofInt 0)
     then Result.ret (List.Cons ret0 tl)
     else
       do
-        let i0 ← i - (U32.ofInt 1 (by intlit))
+        let i0 ← i - (U32.ofInt 1)
         let tl0 ← list_nth_mut_back T tl i0 ret0
         Result.ret (List.Cons x tl0)
   | List.Nil => Result.fail Error.panic
@@ -327,52 +323,47 @@ def list_rev (T : Type) (l : List T) : Result (List T) :=
 def test_list_functions : Result Unit :=
   do
     let l := List.Nil
-    let l0 := List.Cons (I32.ofInt 2 (by intlit)) l
-    let l1 := List.Cons (I32.ofInt 1 (by intlit)) l0
-    let i ← list_length I32 (List.Cons (I32.ofInt 0 (by intlit)) l1)
-    if not (i = (U32.ofInt 3 (by intlit)))
+    let l0 := List.Cons (I32.ofInt 2) l
+    let l1 := List.Cons (I32.ofInt 1) l0
+    let i ← list_length I32 (List.Cons (I32.ofInt 0) l1)
+    if not (i = (U32.ofInt 3))
     then Result.fail Error.panic
     else
       do
         let i0 ←
-          list_nth_shared I32 (List.Cons (I32.ofInt 0 (by intlit)) l1)
-            (U32.ofInt 0 (by intlit))
-        if not (i0 = (I32.ofInt 0 (by intlit)))
+          list_nth_shared I32 (List.Cons (I32.ofInt 0) l1) (U32.ofInt 0)
+        if not (i0 = (I32.ofInt 0))
         then Result.fail Error.panic
         else
           do
             let i1 ←
-              list_nth_shared I32 (List.Cons (I32.ofInt 0 (by intlit)) l1)
-                (U32.ofInt 1 (by intlit))
-            if not (i1 = (I32.ofInt 1 (by intlit)))
+              list_nth_shared I32 (List.Cons (I32.ofInt 0) l1) (U32.ofInt 1)
+            if not (i1 = (I32.ofInt 1))
             then Result.fail Error.panic
             else
               do
                 let i2 ←
-                  list_nth_shared I32 (List.Cons (I32.ofInt 0 (by intlit)) l1)
-                    (U32.ofInt 2 (by intlit))
-                if not (i2 = (I32.ofInt 2 (by intlit)))
+                  list_nth_shared I32 (List.Cons (I32.ofInt 0) l1)
+                    (U32.ofInt 2)
+                if not (i2 = (I32.ofInt 2))
                 then Result.fail Error.panic
                 else
                   do
                     let ls ←
-                      list_nth_mut_back I32 (List.Cons
-                        (I32.ofInt 0 (by intlit)) l1) (U32.ofInt 1 (by intlit))
-                        (I32.ofInt 3 (by intlit))
-                    let i3 ← list_nth_shared I32 ls (U32.ofInt 0 (by intlit))
-                    if not (i3 = (I32.ofInt 0 (by intlit)))
+                      list_nth_mut_back I32 (List.Cons (I32.ofInt 0) l1)
+                        (U32.ofInt 1) (I32.ofInt 3)
+                    let i3 ← list_nth_shared I32 ls (U32.ofInt 0)
+                    if not (i3 = (I32.ofInt 0))
                     then Result.fail Error.panic
                     else
                       do
-                        let i4 ←
-                          list_nth_shared I32 ls (U32.ofInt 1 (by intlit))
-                        if not (i4 = (I32.ofInt 3 (by intlit)))
+                        let i4 ← list_nth_shared I32 ls (U32.ofInt 1)
+                        if not (i4 = (I32.ofInt 3))
                         then Result.fail Error.panic
                         else
                           do
-                            let i5 ←
-                              list_nth_shared I32 ls (U32.ofInt 2 (by intlit))
-                            if not (i5 = (I32.ofInt 2 (by intlit)))
+                            let i5 ← list_nth_shared I32 ls (U32.ofInt 2)
+                            if not (i5 = (I32.ofInt 2))
                             then Result.fail Error.panic
                             else Result.ret ()
 
@@ -435,15 +426,15 @@ structure StructWithTuple (T1 T2 : Type) where
 
 /- [no_nested_borrows::new_tuple1]: forward function -/
 def new_tuple1 : Result (StructWithTuple U32 U32) :=
-  Result.ret { p := ((U32.ofInt 1 (by intlit)), (U32.ofInt 2 (by intlit))) }
+  Result.ret { p := ((U32.ofInt 1), (U32.ofInt 2)) }
 
 /- [no_nested_borrows::new_tuple2]: forward function -/
 def new_tuple2 : Result (StructWithTuple I16 I16) :=
-  Result.ret { p := ((I16.ofInt 1 (by intlit)), (I16.ofInt 2 (by intlit))) }
+  Result.ret { p := ((I16.ofInt 1), (I16.ofInt 2)) }
 
 /- [no_nested_borrows::new_tuple3]: forward function -/
 def new_tuple3 : Result (StructWithTuple U64 I64) :=
-  Result.ret { p := ((U64.ofInt 1 (by intlit)), (I64.ofInt 2 (by intlit))) }
+  Result.ret { p := ((U64.ofInt 1), (I64.ofInt 2)) }
 
 /- [no_nested_borrows::StructWithPair] -/
 structure StructWithPair (T1 T2 : Type) where
@@ -451,32 +442,31 @@ structure StructWithPair (T1 T2 : Type) where
 
 /- [no_nested_borrows::new_pair1]: forward function -/
 def new_pair1 : Result (StructWithPair U32 U32) :=
-  Result.ret
-  { p := { x := (U32.ofInt 1 (by intlit)), y := (U32.ofInt 2 (by intlit)) } }
+  Result.ret { p := { x := (U32.ofInt 1), y := (U32.ofInt 2) } }
 
 /- [no_nested_borrows::test_constants]: forward function -/
 def test_constants : Result Unit :=
   do
     let swt ← new_tuple1
     let (i, _) := swt.p
-    if not (i = (U32.ofInt 1 (by intlit)))
+    if not (i = (U32.ofInt 1))
     then Result.fail Error.panic
     else
       do
         let swt0 ← new_tuple2
         let (i0, _) := swt0.p
-        if not (i0 = (I16.ofInt 1 (by intlit)))
+        if not (i0 = (I16.ofInt 1))
         then Result.fail Error.panic
         else
           do
             let swt1 ← new_tuple3
             let (i1, _) := swt1.p
-            if not (i1 = (U64.ofInt 1 (by intlit)))
+            if not (i1 = (U64.ofInt 1))
             then Result.fail Error.panic
             else
               do
                 let swp ← new_pair1
-                if not (swp.p.x = (U32.ofInt 1 (by intlit)))
+                if not (swp.p.x = (U32.ofInt 1))
                 then Result.fail Error.panic
                 else Result.ret ()
 
@@ -493,29 +483,29 @@ def test_weird_borrows1 : Result Unit :=
 /- [no_nested_borrows::test_mem_replace]: merged forward/backward function
    (there is a single backward function, and the forward function returns ()) -/
 def test_mem_replace (px : U32) : Result U32 :=
-  let y := mem.replace U32 px (U32.ofInt 1 (by intlit))
-  if not (y = (U32.ofInt 0 (by intlit)))
+  let y := mem.replace U32 px (U32.ofInt 1)
+  if not (y = (U32.ofInt 0))
   then Result.fail Error.panic
-  else Result.ret (U32.ofInt 2 (by intlit))
+  else Result.ret (U32.ofInt 2)
 
 /- [no_nested_borrows::test_shared_borrow_bool1]: forward function -/
 def test_shared_borrow_bool1 (b : Bool) : Result U32 :=
   if b
-  then Result.ret (U32.ofInt 0 (by intlit))
-  else Result.ret (U32.ofInt 1 (by intlit))
+  then Result.ret (U32.ofInt 0)
+  else Result.ret (U32.ofInt 1)
 
 /- [no_nested_borrows::test_shared_borrow_bool2]: forward function -/
 def test_shared_borrow_bool2 : Result U32 :=
-  Result.ret (U32.ofInt 0 (by intlit))
+  Result.ret (U32.ofInt 0)
 
 /- [no_nested_borrows::test_shared_borrow_enum1]: forward function -/
 def test_shared_borrow_enum1 (l : List U32) : Result U32 :=
   match l with
-  | List.Cons i l0 => Result.ret (U32.ofInt 1 (by intlit))
-  | List.Nil => Result.ret (U32.ofInt 0 (by intlit))
+  | List.Cons i l0 => Result.ret (U32.ofInt 1)
+  | List.Nil => Result.ret (U32.ofInt 0)
 
 /- [no_nested_borrows::test_shared_borrow_enum2]: forward function -/
 def test_shared_borrow_enum2 : Result U32 :=
-  Result.ret (U32.ofInt 0 (by intlit))
+  Result.ret (U32.ofInt 0)
 
 end no_nested_borrows
diff --git a/tests/lean/Paper.lean b/tests/lean/Paper.lean
index ade65656..cee7128a 100644
--- a/tests/lean/Paper.lean
+++ b/tests/lean/Paper.lean
@@ -7,13 +7,13 @@ namespace paper
 /- [paper::ref_incr]: merged forward/backward function
    (there is a single backward function, and the forward function returns ()) -/
 def ref_incr (x : I32) : Result I32 :=
-  x + (I32.ofInt 1 (by intlit))
+  x + (I32.ofInt 1)
 
 /- [paper::test_incr]: forward function -/
 def test_incr : Result Unit :=
   do
-    let x ← ref_incr (I32.ofInt 0 (by intlit))
-    if not (x = (I32.ofInt 1 (by intlit)))
+    let x ← ref_incr (I32.ofInt 0)
+    if not (x = (I32.ofInt 1))
     then Result.fail Error.panic
     else Result.ret ()
 
@@ -36,20 +36,17 @@ def choose_back
 /- [paper::test_choose]: forward function -/
 def test_choose : Result Unit :=
   do
-    let z ←
-      choose I32 true (I32.ofInt 0 (by intlit)) (I32.ofInt 0 (by intlit))
-    let z0 ← z + (I32.ofInt 1 (by intlit))
-    if not (z0 = (I32.ofInt 1 (by intlit)))
+    let z ← choose I32 true (I32.ofInt 0) (I32.ofInt 0)
+    let z0 ← z + (I32.ofInt 1)
+    if not (z0 = (I32.ofInt 1))
     then Result.fail Error.panic
     else
       do
-        let (x, y) ←
-          choose_back I32 true (I32.ofInt 0 (by intlit))
-            (I32.ofInt 0 (by intlit)) z0
-        if not (x = (I32.ofInt 1 (by intlit)))
+        let (x, y) ← choose_back I32 true (I32.ofInt 0) (I32.ofInt 0) z0
+        if not (x = (I32.ofInt 1))
         then Result.fail Error.panic
         else
-          if not (y = (I32.ofInt 0 (by intlit)))
+          if not (y = (I32.ofInt 0))
           then Result.fail Error.panic
           else Result.ret ()
 
@@ -65,10 +62,10 @@ inductive List (T : Type) :=
 divergent def list_nth_mut (T : Type) (l : List T) (i : U32) : Result T :=
   match l with
   | List.Cons x tl =>
-    if i = (U32.ofInt 0 (by intlit))
+    if i = (U32.ofInt 0)
     then Result.ret x
     else do
-           let i0 ← i - (U32.ofInt 1 (by intlit))
+           let i0 ← i - (U32.ofInt 1)
            list_nth_mut T tl i0
   | List.Nil => Result.fail Error.panic
 
@@ -77,11 +74,11 @@ divergent def list_nth_mut_back
   (T : Type) (l : List T) (i : U32) (ret0 : T) : Result (List T) :=
   match l with
   | List.Cons x tl =>
-    if i = (U32.ofInt 0 (by intlit))
+    if i = (U32.ofInt 0)
     then Result.ret (List.Cons ret0 tl)
     else
       do
-        let i0 ← i - (U32.ofInt 1 (by intlit))
+        let i0 ← i - (U32.ofInt 1)
         let tl0 ← list_nth_mut_back T tl i0 ret0
         Result.ret (List.Cons x tl0)
   | List.Nil => Result.fail Error.panic
@@ -92,23 +89,20 @@ divergent def sum (l : List I32) : Result I32 :=
   | List.Cons x tl => do
                         let i ← sum tl
                         x + i
-  | List.Nil => Result.ret (I32.ofInt 0 (by intlit))
+  | List.Nil => Result.ret (I32.ofInt 0)
 
 /- [paper::test_nth]: forward function -/
 def test_nth : Result Unit :=
   do
     let l := List.Nil
-    let l0 := List.Cons (I32.ofInt 3 (by intlit)) l
-    let l1 := List.Cons (I32.ofInt 2 (by intlit)) l0
-    let x ←
-      list_nth_mut I32 (List.Cons (I32.ofInt 1 (by intlit)) l1)
-        (U32.ofInt 2 (by intlit))
-    let x0 ← x + (I32.ofInt 1 (by intlit))
+    let l0 := List.Cons (I32.ofInt 3) l
+    let l1 := List.Cons (I32.ofInt 2) l0
+    let x ← list_nth_mut I32 (List.Cons (I32.ofInt 1) l1) (U32.ofInt 2)
+    let x0 ← x + (I32.ofInt 1)
     let l2 ←
-      list_nth_mut_back I32 (List.Cons (I32.ofInt 1 (by intlit)) l1)
-        (U32.ofInt 2 (by intlit)) x0
+      list_nth_mut_back I32 (List.Cons (I32.ofInt 1) l1) (U32.ofInt 2) x0
     let i ← sum l2
-    if not (i = (I32.ofInt 7 (by intlit)))
+    if not (i = (I32.ofInt 7))
     then Result.fail Error.panic
     else Result.ret ()
 
@@ -120,7 +114,7 @@ def call_choose (p : (U32 × U32)) : Result U32 :=
   do
     let (px, py) := p
     let pz ← choose U32 true px py
-    let pz0 ← pz + (U32.ofInt 1 (by intlit))
+    let pz0 ← pz + (U32.ofInt 1)
     let (px0, _) ← choose_back U32 true px py pz0
     Result.ret px0
 
diff --git a/tests/lean/lake-manifest.json b/tests/lean/lake-manifest.json
index 75f7010a..8bbfb7cd 100644
--- a/tests/lean/lake-manifest.json
+++ b/tests/lean/lake-manifest.json
@@ -8,10 +8,16 @@
     "name": "proofwidgets",
     "inputRev?": "v0.0.11"}},
   {"path": {"name": "Base", "dir": "./../../backends/lean"}},
+  {"git":
+   {"url": "https://github.com/mhuisi/lean4-cli.git",
+    "subDir?": null,
+    "rev": "5a858c32963b6b19be0d477a30a1f4b6c120be7e",
+    "name": "Cli",
+    "inputRev?": "nightly"}},
   {"git":
    {"url": "https://github.com/leanprover-community/mathlib4.git",
     "subDir?": null,
-    "rev": "bb4fb766e41dd3a64197263ec132c7f9c4b50065",
+    "rev": "82fe7e902b01fe686b91c19550f1e228ad2dec1c",
     "name": "mathlib",
     "inputRev?": null}},
   {"git":
-- 
cgit v1.3.1


From d45c6ed9e8049b81170c3e6950043d08006ba9f2 Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Mon, 17 Jul 2023 12:14:03 +0200
Subject: Move a definition

---
 backends/lean/Base/Arith/Arith.lean | 3 ---
 backends/lean/Base/Primitives.lean  | 3 +++
 2 files changed, 3 insertions(+), 3 deletions(-)

(limited to 'backends/lean/Base/Primitives.lean')

diff --git a/backends/lean/Base/Arith/Arith.lean b/backends/lean/Base/Arith/Arith.lean
index 8bfad6ae..da263e86 100644
--- a/backends/lean/Base/Arith/Arith.lean
+++ b/backends/lean/Base/Arith/Arith.lean
@@ -15,9 +15,6 @@ namespace Arith
 
 open Primitives Utils
 
--- TODO: move
-instance Vec.cast (a : Type): Coe (Vec a) (List a)  where coe := λ v => v.val
-
 -- TODO: move
 /- Remark: we can't write the following instance because of restrictions about
    the type class parameters (`ty` doesn't appear in the return type, which is
diff --git a/backends/lean/Base/Primitives.lean b/backends/lean/Base/Primitives.lean
index 0506f4c0..1a0c665d 100644
--- a/backends/lean/Base/Primitives.lean
+++ b/backends/lean/Base/Primitives.lean
@@ -616,6 +616,9 @@ def Scalar.toInt {ty} (n : Scalar ty) : Int := n.val
 
 def Vec (α : Type u) := { l : List α // List.length l ≤ Usize.max }
 
+-- TODO: do we really need it? It should be with Subtype by default
+instance Vec.cast (a : Type): Coe (Vec a) (List a)  where coe := λ v => v.val
+
 def Vec.new (α : Type u): Vec α := ⟨ [], by apply Scalar.cMax_suffices .Usize; simp ⟩
 
 def Vec.len (α : Type u) (v : Vec α) : Usize :=
-- 
cgit v1.3.1


From 3e8060b5501ec83940a4309389a68898df26ebd0 Mon Sep 17 00:00:00 2001
From: Son Ho
Date: Mon, 17 Jul 2023 23:37:31 +0200
Subject: Reorganize the Lean backend

---
 backends/lean/Base/Arith.lean             |   3 +-
 backends/lean/Base/Arith/Arith.lean       | 329 --------------
 backends/lean/Base/Arith/Int.lean         | 236 ++++++++++
 backends/lean/Base/Arith/Scalar.lean      |  48 ++
 backends/lean/Base/IList.lean             | 127 +-----
 backends/lean/Base/IList/IList.lean       | 142 ++++++
 backends/lean/Base/Primitives.lean        | 718 +-----------------------------
 backends/lean/Base/Primitives/Base.lean   | 130 ++++++
 backends/lean/Base/Primitives/Scalar.lean | 507 +++++++++++++++++++++
 backends/lean/Base/Primitives/Vec.lean    | 113 +++++
 backends/lean/Base/Progress/Progress.lean |   2 +
 11 files changed, 1184 insertions(+), 1171 deletions(-)
 create mode 100644 backends/lean/Base/Arith/Int.lean
 create mode 100644 backends/lean/Base/Arith/Scalar.lean
 create mode 100644 backends/lean/Base/IList/IList.lean
 create mode 100644 backends/lean/Base/Primitives/Base.lean
 create mode 100644 backends/lean/Base/Primitives/Scalar.lean
 create mode 100644 backends/lean/Base/Primitives/Vec.lean

(limited to 'backends/lean/Base/Primitives.lean')

diff --git a/backends/lean/Base/Arith.lean b/backends/lean/Base/Arith.lean
index fd5698c5..c0d09fd2 100644
--- a/backends/lean/Base/Arith.lean
+++ b/backends/lean/Base/Arith.lean
@@ -1 +1,2 @@
-import Base.Arith.Arith
+import Base.Arith.Int
+import Base.Arith.Scalar
diff --git a/backends/lean/Base/Arith/Arith.lean b/backends/lean/Base/Arith/Arith.lean
index da263e86..e69de29b 100644
--- a/backends/lean/Base/Arith/Arith.lean
+++ b/backends/lean/Base/Arith/Arith.lean
@@ -1,329 +0,0 @@
-/- This file contains tactics to solve arithmetic goals -/
-
-import Lean
-import Lean.Meta.Tactic.Simp
-import Init.Data.List.Basic
-import Mathlib.Tactic.RunCmd
-import Mathlib.Tactic.Linarith
--- TODO: there is no Omega tactic for now - it seems it hasn't been ported yet
---import Mathlib.Tactic.Omega
-import Base.Primitives
-import Base.Utils
-import Base.Arith.Base
-
-namespace Arith
-
-open Primitives Utils
-
--- TODO: move
-/- Remark: we can't write the following instance because of restrictions about
-   the type class parameters (`ty` doesn't appear in the return type, which is
-   forbidden):
-
-   ```
-   instance Scalar.cast (ty : ScalarTy) : Coe (Scalar ty) Int where coe := λ v => v.val
-   ```
- -/
-def Scalar.toInt {ty : ScalarTy} (x : Scalar ty) : Int := x.val
-
--- Remark: I tried a version of the shape `HasScalarProp {a : Type} (x : a)`
--- but the lookup didn't work
-class HasScalarProp (a : Sort u) where
-  prop_ty : a → Prop
-  prop : ∀ x:a, prop_ty x
-
-class HasIntProp (a : Sort u) where
-  prop_ty : a → Prop
-  prop : ∀ x:a, prop_ty x
-
-instance (ty : ScalarTy) : HasScalarProp (Scalar ty) where
-  -- prop_ty is inferred
-  prop := λ x => And.intro x.hmin x.hmax
-
-instance (a : Type) : HasScalarProp (Vec a) where
-  prop_ty := λ v => v.val.length ≤ Scalar.max ScalarTy.Usize
-  prop := λ ⟨ _, l ⟩ => l
-
-class PropHasImp (x : Prop) where
-  concl : Prop
-  prop : x → concl
-
--- This also works for `x ≠ y` because this expression reduces to `¬ x = y`
--- and `Ne` is marked as `reducible`
-instance (x y : Int) : PropHasImp (¬ x = y) where
-  concl := x < y ∨ x > y
-  prop := λ (h:x ≠ y) => ne_is_lt_or_gt h
-
-open Lean Lean.Elab Command Term Lean.Meta
-
--- Small utility: print all the declarations in the context
-elab "print_all_decls" : tactic => do
-  let ctx ← Lean.MonadLCtx.getLCtx
-  for decl in ← ctx.getDecls do
-    let ty ← Lean.Meta.inferType decl.toExpr
-    logInfo m!"{decl.toExpr} : {ty}"
-  pure ()
-
--- Explore a term by decomposing the applications (we explore the applied
--- functions and their arguments, but ignore lambdas, forall, etc. -
--- should we go inside?).
-partial def foldTermApps (k : α → Expr → MetaM α) (s : α) (e : Expr) : MetaM α := do
-  -- We do it in a very simpler manner: we deconstruct applications,
-  -- and recursively explore the sub-expressions. Note that we do
-  -- not go inside foralls and abstractions (should we?).
-  e.withApp fun f args => do
-    let s ← k s f
-    args.foldlM (foldTermApps k) s
-
--- Provided a function `k` which lookups type class instances on an expression,
--- collect all the instances lookuped by applying `k` on the sub-expressions of `e`.
-def collectInstances
-  (k : Expr → MetaM (Option Expr)) (s : HashSet Expr) (e : Expr) : MetaM (HashSet Expr) := do
-  let k s e := do
-    match ← k e with
-    | none => pure s
-    | some i => pure (s.insert i)
-  foldTermApps k s e
-
--- Similar to `collectInstances`, but explores all the local declarations in the
--- main context.
-def collectInstancesFromMainCtx (k : Expr → MetaM (Option Expr)) : Tactic.TacticM (HashSet Expr) := do
-  Tactic.withMainContext do
-  -- Get the local context
-  let ctx ← Lean.MonadLCtx.getLCtx
-  -- Just a matter of precaution
-  let ctx ← instantiateLCtxMVars ctx
-  -- Initialize the hashset
-  let hs := HashSet.empty
-  -- Explore the declarations
-  let decls ← ctx.getDecls
-  decls.foldlM (fun hs d => collectInstances k hs d.toExpr) hs
-
--- Helper
-def lookupProp (fName : String) (className : Name) (e : Expr) : MetaM (Option Expr) := do
-  trace[Arith] fName
-  -- TODO: do we need Lean.observing?
-  -- This actually eliminates the error messages
-  Lean.observing? do
-    trace[Arith] m!"{fName}: observing"
-    let ty ← Lean.Meta.inferType e
-    let hasProp ← mkAppM className #[ty]
-    let hasPropInst ← trySynthInstance hasProp
-    match hasPropInst with
-    | LOption.some i =>
-      trace[Arith] "Found HasScalarProp instance"
-      let i_prop ← mkProjection i (Name.mkSimple "prop")
-      some (← mkAppM' i_prop #[e])
-    | _ => none
-
--- Return an instance of `HasIntProp` for `e` if it has some
-def lookupHasIntProp (e : Expr) : MetaM (Option Expr) :=
-  lookupProp "lookupHasScalarProp" ``HasIntProp e
-
--- Return an instance of `HasScalarProp` for `e` if it has some
-def lookupHasScalarProp (e : Expr) : MetaM (Option Expr) :=
-  lookupProp "lookupHasScalarProp" ``HasScalarProp e
-
--- Collect the instances of `HasIntProp` for the subexpressions in the context
-def collectHasIntPropInstancesFromMainCtx : Tactic.TacticM (HashSet Expr) := do
-  collectInstancesFromMainCtx lookupHasIntProp
-
--- Collect the instances of `HasScalarProp` for the subexpressions in the context
-def collectHasScalarPropInstancesFromMainCtx : Tactic.TacticM (HashSet Expr) := do
-  collectInstancesFromMainCtx lookupHasScalarProp
-
-elab "display_has_prop_instances" : tactic => do
-  trace[Arith] "Displaying the HasScalarProp instances"
-  let hs ← collectHasScalarPropInstancesFromMainCtx
-  hs.forM fun e => do
-    trace[Arith] "+ HasScalarProp instance: {e}"
-
-example (x : U32) : True := by
-  let i : HasScalarProp U32 := inferInstance
-  have p := @HasScalarProp.prop _ i x
-  simp only [HasScalarProp.prop_ty] at p
-  display_has_prop_instances
-  simp
-
--- Return an instance of `PropHasImp` for `e` if it has some
-def lookupPropHasImp (e : Expr) : MetaM (Option Expr) := do
-  trace[Arith] "lookupPropHasImp"
-  -- TODO: do we need Lean.observing?
-  -- This actually eliminates the error messages
-  Lean.observing? do
-    trace[Arith] "lookupPropHasImp: observing"
-    let ty ← Lean.Meta.inferType e
-    trace[Arith] "lookupPropHasImp: ty: {ty}"
-    let cl ← mkAppM ``PropHasImp #[ty]
-    let inst ← trySynthInstance cl
-    match inst with
-    | LOption.some i =>
-      trace[Arith] "Found PropHasImp instance"
-      let i_prop ←  mkProjection i (Name.mkSimple "prop")
-      some (← mkAppM' i_prop #[e])
-    | _ => none
-
--- Collect the instances of `PropHasImp` for the subexpressions in the context
-def collectPropHasImpInstancesFromMainCtx : Tactic.TacticM (HashSet Expr) := do
-  collectInstancesFromMainCtx lookupPropHasImp
-
-elab "display_prop_has_imp_instances" : tactic => do
-  trace[Arith] "Displaying the PropHasImp instances"
-  let hs ← collectPropHasImpInstancesFromMainCtx
-  hs.forM fun e => do
-    trace[Arith] "+ PropHasImp instance: {e}"
-
-example (x y : Int) (_ : x ≠ y) (_ : ¬ x = y) : True := by
-  display_prop_has_imp_instances
-  simp
-
--- Lookup instances in a context and introduce them with additional declarations.
-def introInstances (declToUnfold : Name) (lookup : Expr → MetaM (Option Expr)) : Tactic.TacticM (Array Expr) := do
-  let hs ← collectInstancesFromMainCtx lookup
-  hs.toArray.mapM fun e => do
-    let type ← inferType e
-    let name ← mkFreshUserName `h
-    -- Add a declaration
-    let nval ← Utils.addDeclTac name e type (asLet := false)
-    -- Simplify to unfold the declaration to unfold (i.e., the projector)
-    Utils.simpAt [declToUnfold] [] [] (Tactic.Location.targets #[mkIdent name] false)
-    -- Return the new value
-    pure nval
-
-def introHasIntPropInstances : Tactic.TacticM (Array Expr) := do
-  trace[Arith] "Introducing the HasIntProp instances"
-  introInstances ``HasIntProp.prop_ty lookupHasIntProp
-
-def introHasScalarPropInstances : Tactic.TacticM (Array Expr) := do
-  trace[Arith] "Introducing the HasScalarProp instances"
-  introInstances ``HasScalarProp.prop_ty lookupHasScalarProp
-
--- Lookup the instances of `HasScalarProp for all the sub-expressions in the context,
--- and introduce the corresponding assumptions
-elab "intro_has_prop_instances" : tactic => do
-  let _ ← introHasScalarPropInstances
-
-example (x y : U32) : x.val ≤ Scalar.max ScalarTy.U32 := by
-  intro_has_prop_instances
-  simp [*]
-
-example {a: Type} (v : Vec a) : v.val.length ≤ Scalar.max ScalarTy.Usize := by
-  intro_has_prop_instances
-  simp_all [Scalar.max, Scalar.min]
-
--- Lookup the instances of `PropHasImp for all the sub-expressions in the context,
--- and introduce the corresponding assumptions
-elab "intro_prop_has_imp_instances" : tactic => do
-  trace[Arith] "Introducing the PropHasImp instances"
-  let _ ← introInstances ``PropHasImp.concl lookupPropHasImp
-
-example (x y : Int) (h0 : x ≤ y) (h1 : x ≠ y) : x < y := by
-  intro_prop_has_imp_instances
-  rename_i h
-  split_disj h
-  . linarith
-  . linarith
-
-/- Boosting a bit the linarith tac.
-
-   We do the following:
-   - for all the assumptions of the shape `(x : Int) ≠ y` or `¬ (x = y), we
-     introduce two goals with the assumptions `x < y` and `x > y`
-     TODO: we could create a PR for mathlib.
- -/
-def intTacPreprocess : Tactic.TacticM Unit := do
-  Tactic.withMainContext do
-  -- Lookup the instances of PropHasImp (this is how we detect assumptions
-  -- of the proper shape), introduce assumptions in the context and split
-  -- on those
-  -- TODO: get rid of the assumptions that we split
-  let rec splitOnAsms (asms : List Expr) : Tactic.TacticM Unit :=
-    match asms with
-    | [] => pure ()
-    | asm :: asms =>
-      let k := splitOnAsms asms
-      Utils.splitDisjTac asm k k
-  -- Introduce
-  let _ ← introHasIntPropInstances
-  let asms ← introInstances ``PropHasImp.concl lookupPropHasImp
-  -- Split
-  splitOnAsms asms.toList
-
-elab "int_tac_preprocess" : tactic =>
-  intTacPreprocess
-
-def intTac : Tactic.TacticM Unit := do
-  Tactic.withMainContext do
-  Tactic.focus do
-  -- Preprocess - wondering if we should do this before or after splitting
-  -- the goal. I think before leads to a smaller proof term?
-  Tactic.allGoals intTacPreprocess
-  -- Split the conjunctions in the goal
-  Utils.repeatTac Utils.splitConjTarget
-  -- Call linarith
-  let linarith :=
-    let cfg : Linarith.LinarithConfig := {
-      -- We do this with our custom preprocessing
-      splitNe := false
-    }
-    Tactic.liftMetaFinishingTactic <| Linarith.linarith false [] cfg
-  Tactic.allGoals linarith
-
-elab "int_tac" : tactic =>
-  intTac
-
-example (x : Int) (h0: 0 ≤ x) (h1: x ≠ 0) : 0 < x := by
-  int_tac_preprocess
-  linarith
-  linarith
-
-example (x : Int) (h0: 0 ≤ x) (h1: x ≠ 0) : 0 < x := by
-  int_tac
-
--- Checking that things append correctly when there are several disjunctions
-example (x y : Int) (h0: 0 ≤ x) (h1: x ≠ 0) (h2 : 0 ≤ y) (h3 : y ≠ 0) : 0 < x ∧ 0 < y := by
-  int_tac
-
--- Checking that things append correctly when there are several disjunctions
-example (x y : Int) (h0: 0 ≤ x) (h1: x ≠ 0) (h2 : 0 ≤ y) (h3 : y ≠ 0) : 0 < x ∧ 0 < y ∧ x + y ≥ 2 := by
-  int_tac
-
-def scalarTacPreprocess (tac : Tactic.TacticM Unit) : Tactic.TacticM Unit := do
-   Tactic.withMainContext do
-   -- Introduce the scalar bounds
-   let _ ← introHasScalarPropInstances
-   Tactic.allGoals do
-   -- Inroduce the bounds for the isize/usize types
-   let add (e : Expr) : Tactic.TacticM Unit := do
-     let ty ← inferType e
-     let _ ← Utils.addDeclTac (← mkFreshUserName `h) e ty (asLet := false)
-   add (← mkAppM ``Scalar.cMin_bound #[.const ``ScalarTy.Isize []])
-   add (← mkAppM ``Scalar.cMax_bound #[.const ``ScalarTy.Usize []])
-   add (← mkAppM ``Scalar.cMax_bound #[.const ``ScalarTy.Isize []])
-   -- Reveal the concrete bounds
-   Utils.simpAt [``Scalar.min, ``Scalar.max, ``Scalar.cMin, ``Scalar.cMax,
-                 ``I8.min, ``I16.min, ``I32.min, ``I64.min, ``I128.min,
-                 ``I8.max, ``I16.max, ``I32.max, ``I64.max, ``I128.max,
-                 ``U8.min, ``U16.min, ``U32.min, ``U64.min, ``U128.min,
-                 ``U8.max, ``U16.max, ``U32.max, ``U64.max, ``U128.max
-                 ] [] [] .wildcard
-   -- Finish the proof
-   tac
-
-elab "scalar_tac_preprocess" : tactic =>
-  scalarTacPreprocess intTacPreprocess
-
--- A tactic to solve linear arithmetic goals in the presence of scalars
-def scalarTac : Tactic.TacticM Unit := do
-  scalarTacPreprocess intTac
-
-elab "scalar_tac" : tactic =>
-  scalarTac
-
-example (x y : U32) : x.val ≤ Scalar.max ScalarTy.U32 := by
-  scalar_tac
-
-example {a: Type} (v : Vec a) : v.val.length ≤ Scalar.max ScalarTy.Usize := by
-  scalar_tac
-
-end Arith
diff --git a/backends/lean/Base/Arith/Int.lean b/backends/lean/Base/Arith/Int.lean
new file mode 100644
index 00000000..5f00ab52
--- /dev/null
+++ b/backends/lean/Base/Arith/Int.lean
@@ -0,0 +1,236 @@
+/- This file contains tactics to solve arithmetic goals -/
+
+import Lean
+import Lean.Meta.Tactic.Simp
+import Init.Data.List.Basic
+import Mathlib.Tactic.RunCmd
+import Mathlib.Tactic.Linarith
+-- TODO: there is no Omega tactic for now - it seems it hasn't been ported yet
+--import Mathlib.Tactic.Omega
+import Base.Utils
+import Base.Arith.Base
+
+namespace Arith
+
+open Utils
+
+-- Remark: I tried a version of the shape `HasScalarProp {a : Type} (x : a)`
+-- but the lookup didn't work
+class HasIntProp (a : Sort u) where
+  prop_ty : a → Prop
+  prop : ∀ x:a, prop_ty x
+
+class PropHasImp (x : Prop) where
+  concl : Prop
+  prop : x → concl
+
+-- This also works for `x ≠ y` because this expression reduces to `¬ x = y`
+-- and `Ne` is marked as `reducible`
+instance (x y : Int) : PropHasImp (¬ x = y) where
+  concl := x < y ∨ x > y
+  prop := λ (h:x ≠ y) => ne_is_lt_or_gt h
+
+open Lean Lean.Elab Lean.Meta
+
+-- Small utility: print all the declarations in the context
+elab "print_all_decls" : tactic => do
+  let ctx ← Lean.MonadLCtx.getLCtx
+  for decl in ← ctx.getDecls do
+    let ty ← Lean.Meta.inferType decl.toExpr
+    logInfo m!"{decl.toExpr} : {ty}"
+  pure ()
+
+-- Explore a term by decomposing the applications (we explore the applied
+-- functions and their arguments, but ignore lambdas, forall, etc. -
+-- should we go inside?).
+partial def foldTermApps (k : α → Expr → MetaM α) (s : α) (e : Expr) : MetaM α := do
+  -- We do it in a very simpler manner: we deconstruct applications,
+  -- and recursively explore the sub-expressions. Note that we do
+  -- not go inside foralls and abstractions (should we?).
+  e.withApp fun f args => do
+    let s ← k s f
+    args.foldlM (foldTermApps k) s
+
+-- Provided a function `k` which lookups type class instances on an expression,
+-- collect all the instances lookuped by applying `k` on the sub-expressions of `e`.
+def collectInstances
+  (k : Expr → MetaM (Option Expr)) (s : HashSet Expr) (e : Expr) : MetaM (HashSet Expr) := do
+  let k s e := do
+    match ← k e with
+    | none => pure s
+    | some i => pure (s.insert i)
+  foldTermApps k s e
+
+-- Similar to `collectInstances`, but explores all the local declarations in the
+-- main context.
+def collectInstancesFromMainCtx (k : Expr → MetaM (Option Expr)) : Tactic.TacticM (HashSet Expr) := do
+  Tactic.withMainContext do
+  -- Get the local context
+  let ctx ← Lean.MonadLCtx.getLCtx
+  -- Just a matter of precaution
+  let ctx ← instantiateLCtxMVars ctx
+  -- Initialize the hashset
+  let hs := HashSet.empty
+  -- Explore the declarations
+  let decls ← ctx.getDecls
+  decls.foldlM (fun hs d => collectInstances k hs d.toExpr) hs
+
+-- Helper
+def lookupProp (fName : String) (className : Name) (e : Expr) : MetaM (Option Expr) := do
+  trace[Arith] fName
+  -- TODO: do we need Lean.observing?
+  -- This actually eliminates the error messages
+  Lean.observing? do
+    trace[Arith] m!"{fName}: observing"
+    let ty ← Lean.Meta.inferType e
+    let hasProp ← mkAppM className #[ty]
+    let hasPropInst ← trySynthInstance hasProp
+    match hasPropInst with
+    | LOption.some i =>
+      trace[Arith] "Found {fName} instance"
+      let i_prop ← mkProjection i (Name.mkSimple "prop")
+      some (← mkAppM' i_prop #[e])
+    | _ => none
+
+-- Return an instance of `HasIntProp` for `e` if it has some
+def lookupHasIntProp (e : Expr) : MetaM (Option Expr) :=
+  lookupProp "lookupHasIntProp" ``HasIntProp e
+
+-- Collect the instances of `HasIntProp` for the subexpressions in the context
+def collectHasIntPropInstancesFromMainCtx : Tactic.TacticM (HashSet Expr) := do
+  collectInstancesFromMainCtx lookupHasIntProp
+
+-- Return an instance of `PropHasImp` for `e` if it has some
+def lookupPropHasImp (e : Expr) : MetaM (Option Expr) := do
+  trace[Arith] "lookupPropHasImp"
+  -- TODO: do we need Lean.observing?
+  -- This actually eliminates the error messages
+  Lean.observing? do
+    trace[Arith] "lookupPropHasImp: observing"
+    let ty ← Lean.Meta.inferType e
+    trace[Arith] "lookupPropHasImp: ty: {ty}"
+    let cl ← mkAppM ``PropHasImp #[ty]
+    let inst ← trySynthInstance cl
+    match inst with
+    | LOption.some i =>
+      trace[Arith] "Found PropHasImp instance"
+      let i_prop ←  mkProjection i (Name.mkSimple "prop")
+      some (← mkAppM' i_prop #[e])
+    | _ => none
+
+-- Collect the instances of `PropHasImp` for the subexpressions in the context
+def collectPropHasImpInstancesFromMainCtx : Tactic.TacticM (HashSet Expr) := do
+  collectInstancesFromMainCtx lookupPropHasImp
+
+elab "display_prop_has_imp_instances" : tactic => do
+  trace[Arith] "Displaying the PropHasImp instances"
+  let hs ← collectPropHasImpInstancesFromMainCtx
+  hs.forM fun e => do
+    trace[Arith] "+ PropHasImp instance: {e}"
+
+example (x y : Int) (_ : x ≠ y) (_ : ¬ x = y) : True := by
+  display_prop_has_imp_instances
+  simp
+
+-- Lookup instances in a context and introduce them with additional declarations.
+def introInstances (declToUnfold : Name) (lookup : Expr → MetaM (Option Expr)) : Tactic.TacticM (Array Expr) := do
+  let hs ← collectInstancesFromMainCtx lookup
+  hs.toArray.mapM fun e => do
+    let type ← inferType e
+    let name ← mkFreshUserName `h
+    -- Add a declaration
+    let nval ← Utils.addDeclTac name e type (asLet := false)
+    -- Simplify to unfold the declaration to unfold (i.e., the projector)
+    Utils.simpAt [declToUnfold] [] [] (Tactic.Location.targets #[mkIdent name] false)
+    -- Return the new value
+    pure nval
+
+def introHasIntPropInstances : Tactic.TacticM (Array Expr) := do
+  trace[Arith] "Introducing the HasIntProp instances"
+  introInstances ``HasIntProp.prop_ty lookupHasIntProp
+
+-- Lookup the instances of `HasIntProp for all the sub-expressions in the context,
+-- and introduce the corresponding assumptions
+elab "intro_has_int_prop_instances" : tactic => do
+  let _ ← introHasIntPropInstances
+
+-- Lookup the instances of `PropHasImp for all the sub-expressions in the context,
+-- and introduce the corresponding assumptions
+elab "intro_prop_has_imp_instances" : tactic => do
+  trace[Arith] "Introducing the PropHasImp instances"
+  let _ ← introInstances ``PropHasImp.concl lookupPropHasImp
+
+example (x y : Int) (h0 : x ≤ y) (h1 : x ≠ y) : x < y := by
+  intro_prop_has_imp_instances
+  rename_i h
+  split_disj h
+  . linarith
+  . linarith
+
+/- Boosting a bit the linarith tac.
+
+   We do the following:
+   - for all the assumptions of the shape `(x : Int) ≠ y` or `¬ (x = y), we
+     introduce two goals with the assumptions `x < y` and `x > y`
+     TODO: we could create a PR for mathlib.
+ -/
+def intTacPreprocess (extraPreprocess :  Tactic.TacticM Unit) : Tactic.TacticM Unit := do
+  Tactic.withMainContext do
+  -- Lookup the instances of PropHasImp (this is how we detect assumptions
+  -- of the proper shape), introduce assumptions in the context and split
+  -- on those
+  -- TODO: get rid of the assumptions that we split
+  let rec splitOnAsms (asms : List Expr) : Tactic.TacticM Unit :=
+    match asms with
+    | [] => pure ()
+    | asm :: asms =>
+      let k := splitOnAsms asms
+      Utils.splitDisjTac asm k k
+  -- Introduce the scalar bounds
+  let _ ← introHasIntPropInstances
+  -- Extra preprocessing, before we split on the disjunctions
+  extraPreprocess
+  -- Split
+  let asms ← introInstances ``PropHasImp.concl lookupPropHasImp
+  splitOnAsms asms.toList
+
+elab "int_tac_preprocess" : tactic =>
+  intTacPreprocess (do pure ())
+
+def intTac (extraPreprocess :  Tactic.TacticM Unit) : Tactic.TacticM Unit := do
+  Tactic.withMainContext do
+  Tactic.focus do
+  -- Preprocess - wondering if we should do this before or after splitting
+  -- the goal. I think before leads to a smaller proof term?
+  Tactic.allGoals (intTacPreprocess extraPreprocess)
+  -- Split the conjunctions in the goal
+  Tactic.allGoals (Utils.repeatTac Utils.splitConjTarget)
+  -- Call linarith
+  let linarith :=
+    let cfg : Linarith.LinarithConfig := {
+      -- We do this with our custom preprocessing
+      splitNe := false
+    }
+    Tactic.liftMetaFinishingTactic <| Linarith.linarith false [] cfg
+  Tactic.allGoals linarith
+
+elab "int_tac" : tactic =>
+  intTac (do pure ())
+
+example (x : Int) (h0: 0 ≤ x) (h1: x ≠ 0) : 0 < x := by
+  int_tac_preprocess
+  linarith
+  linarith
+
+example (x : Int) (h0: 0 ≤ x) (h1: x ≠ 0) : 0 < x := by
+  int_tac
+
+-- Checking that things append correctly when there are several disjunctions
+example (x y : Int) (h0: 0 ≤ x) (h1: x ≠ 0) (h2 : 0 ≤ y) (h3 : y ≠ 0) : 0 < x ∧ 0 < y := by
+  int_tac
+
+-- Checking that things append correctly when there are several disjunctions
+example (x y : Int) (h0: 0 ≤ x) (h1: x ≠ 0) (h2 : 0 ≤ y) (h3 : y ≠ 0) : 0 < x ∧ 0 < y ∧ x + y ≥ 2 := by
+  int_tac
+
+end Arith
diff --git a/backends/lean/Base/Arith/Scalar.lean b/backends/lean/Base/Arith/Scalar.lean
new file mode 100644
index 00000000..f8903ecf
--- /dev/null
+++ b/backends/lean/Base/Arith/Scalar.lean
@@ -0,0 +1,48 @@
+import Base.Arith.Int
+import Base.Primitives.Scalar
+
+/- Automation for scalars - TODO: not sure it is worth having two files (Int.lean and Scalar.lean) -/
+namespace Arith
+
+open Lean Lean.Elab Lean.Meta
+open Primitives
+
+def scalarTacExtraPreprocess : Tactic.TacticM Unit := do
+   Tactic.withMainContext do
+   -- Inroduce the bounds for the isize/usize types
+   let add (e : Expr) : Tactic.TacticM Unit := do
+     let ty ← inferType e
+     let _ ← Utils.addDeclTac (← mkFreshUserName `h) e ty (asLet := false)
+   add (← mkAppM ``Scalar.cMin_bound #[.const ``ScalarTy.Isize []])
+   add (← mkAppM ``Scalar.cMax_bound #[.const ``ScalarTy.Usize []])
+   add (← mkAppM ``Scalar.cMax_bound #[.const ``ScalarTy.Isize []])
+   -- Reveal the concrete bounds
+   Utils.simpAt [``Scalar.min, ``Scalar.max, ``Scalar.cMin, ``Scalar.cMax,
+                 ``I8.min, ``I16.min, ``I32.min, ``I64.min, ``I128.min,
+                 ``I8.max, ``I16.max, ``I32.max, ``I64.max, ``I128.max,
+                 ``U8.min, ``U16.min, ``U32.min, ``U64.min, ``U128.min,
+                 ``U8.max, ``U16.max, ``U32.max, ``U64.max, ``U128.max
+                 ] [] [] .wildcard
+
+elab "scalar_tac_preprocess" : tactic =>
+  intTacPreprocess scalarTacExtraPreprocess
+
+-- A tactic to solve linear arithmetic goals in the presence of scalars
+def scalarTac : Tactic.TacticM Unit := do
+  intTac scalarTacExtraPreprocess
+
+elab "scalar_tac" : tactic =>
+  scalarTac
+
+instance (ty : ScalarTy) : HasIntProp (Scalar ty) where
+  -- prop_ty is inferred
+  prop := λ x => And.intro x.hmin x.hmax
+
+example (x y : U32) : x.val ≤ Scalar.max ScalarTy.U32 := by
+  intro_has_int_prop_instances
+  simp [*]
+
+example (x y : U32) : x.val ≤ Scalar.max ScalarTy.U32 := by
+  scalar_tac
+
+end Arith
diff --git a/backends/lean/Base/IList.lean b/backends/lean/Base/IList.lean
index 3db00cbb..31b66ffa 100644
--- a/backends/lean/Base/IList.lean
+++ b/backends/lean/Base/IList.lean
@@ -1,126 +1 @@
-/- Complementary list functions and lemmas which operate on integers rather
-   than natural numbers. -/
-
-import Std.Data.Int.Lemmas
-import Mathlib.Tactic.Linarith
-import Base.Arith
-
-namespace List
-
-def len (ls : List α) : Int :=
-  match ls with
-  | [] => 0
-  | _ :: tl => 1 + len tl
-
--- Remark: if i < 0, then the result is none
-def optIndex (i : Int) (ls : List α) : Option α :=
-  match ls with
-  | [] => none
-  | hd :: tl => if i = 0 then some hd else optIndex (i - 1) tl
-
--- Remark: if i < 0, then the result is the defaul element
-def index [Inhabited α] (i : Int) (ls : List α) : α :=
-  match ls with
-  | [] => Inhabited.default
-  | x :: tl =>
-    if i = 0 then x else index (i - 1) tl
-
--- Remark: the list is unchanged if the index is not in bounds (in particular
--- if it is < 0)
-def update (ls : List α) (i : Int) (y : α) : List α :=
-  match ls with
-  | [] => []
-  | x :: tl => if i = 0 then y :: tl else x :: update tl (i - 1) y
-
--- Remark: the whole list is dropped if the index is not in bounds (in particular
--- if it is < 0)
-def idrop (i : Int) (ls : List α) : List α :=
-  match ls with
-  | [] => []
-  | x :: tl => if i = 0 then x :: tl else idrop (i - 1) tl
-
-@[simp] theorem len_nil : len ([] : List α) = 0 := by simp [len]
-@[simp] theorem len_cons : len ((x :: tl) : List α) = 1 + len tl := by simp [len]
-
-@[simp] theorem index_zero_cons [Inhabited α] : index 0 ((x :: tl) : List α) = x := by simp [index]
-@[simp] theorem index_nzero_cons [Inhabited α] (hne : i ≠ 0) : index i ((x :: tl) : List α) = index (i - 1) tl := by simp [*, index]
-
-@[simp] theorem update_nil : update ([] : List α) i y = [] := by simp [update]
-@[simp] theorem update_zero_cons : update ((x :: tl) : List α) 0 y = y :: tl := by simp [update]
-@[simp] theorem update_nzero_cons (hne : i ≠ 0) : update ((x :: tl) : List α) i y = x :: update tl (i - 1) y := by simp [*, update]
-
-@[simp] theorem idrop_nil : idrop i ([] : List α) = [] := by simp [idrop]
-@[simp] theorem idrop_zero : idrop 0 (ls : List α) = ls := by cases ls <;> simp [idrop]
-@[simp] theorem idrop_nzero_cons (hne : i ≠ 0) : idrop i ((x :: tl) : List α) = idrop (i - 1) tl := by simp [*, idrop]
-
-theorem len_eq_length (ls : List α) : ls.len = ls.length := by
-  induction ls
-  . rfl
-  . simp [*, Int.ofNat_succ, Int.add_comm]
-
-theorem len_pos : 0 ≤ (ls : List α).len := by
-  induction ls <;> simp [*]
-  linarith
-
-instance (a : Type u) : Arith.HasIntProp (List a) where
-  prop_ty := λ ls => 0 ≤ ls.len
-  prop := λ ls => ls.len_pos
-
-@[simp] theorem len_append (l1 l2 : List α) : (l1 ++ l2).len = l1.len + l2.len := by
-  -- Remark: simp loops here because of the following rewritings:
-  -- @Nat.cast_add: ↑(List.length l1 + List.length l2) ==> ↑(List.length l1) + ↑(List.length l2)
-  -- Int.ofNat_add_ofNat: ↑(List.length l1) + ↑(List.length l2) ==> ↑(List.length l1 + List.length l2)
-  -- TODO: post an issue?
-  simp only [len_eq_length]
-  simp only [length_append]
-  simp only [Int.ofNat_add]
-
-theorem left_length_eq_append_eq (l1 l2 l1' l2' : List α) (heq : l1.length = l1'.length) :
-  l1 ++ l2 = l1' ++ l2' ↔ l1 = l1' ∧ l2 = l2' := by
-  revert l1'
-  induction l1
-  . intro l1'; cases l1' <;> simp [*]
-  . intro l1'; cases l1' <;> simp_all; tauto
-
-theorem right_length_eq_append_eq (l1 l2 l1' l2' : List α) (heq : l2.length = l2'.length) :
-  l1 ++ l2 = l1' ++ l2' ↔ l1 = l1' ∧ l2 = l2' := by
-  have := left_length_eq_append_eq l1 l2 l1' l2'
-  constructor <;> intro heq2 <;>
-  have : l1.length + l2.length = l1'.length + l2'.length := by
-    have : (l1 ++ l2).length = (l1' ++ l2').length := by simp [*]
-    simp only [length_append] at this
-    apply this
-  . simp [heq] at this
-    tauto
-  . tauto
-
-theorem left_len_eq_append_eq (l1 l2 l1' l2' : List α) (heq : l1.len = l1'.len) :
-  l1 ++ l2 = l1' ++ l2' ↔ l1 = l1' ∧ l2 = l2' := by
-  simp [len_eq_length] at heq
-  apply left_length_eq_append_eq
-  assumption
-
-theorem right_len_eq_append_eq (l1 l2 l1' l2' : List α) (heq : l2.len = l2'.len) :
-  l1 ++ l2 = l1' ++ l2' ↔ l1 = l1' ∧ l2 = l2' := by
-  simp [len_eq_length] at heq
-  apply right_length_eq_append_eq
-  assumption
-
-open Arith in
-theorem idrop_eq_nil_of_le (hineq : ls.len ≤ i) : idrop i ls = [] := by
-  revert i
-  induction ls <;> simp [*]
-  rename_i hd tl hi
-  intro i hineq
-  if heq: i = 0 then
-    simp [*] at *
-    have := tl.len_pos
-    linarith
-  else
-    simp at hineq
-    have : 0 < i := by int_tac
-    simp [*]
-    apply hi
-    linarith
-
-end List
+import Base.IList.IList
diff --git a/backends/lean/Base/IList/IList.lean b/backends/lean/Base/IList/IList.lean
new file mode 100644
index 00000000..2a335cac
--- /dev/null
+++ b/backends/lean/Base/IList/IList.lean
@@ -0,0 +1,142 @@
+/- Complementary list functions and lemmas which operate on integers rather
+   than natural numbers. -/
+
+import Std.Data.Int.Lemmas
+import Base.Arith
+
+namespace List
+
+def len (ls : List α) : Int :=
+  match ls with
+  | [] => 0
+  | _ :: tl => 1 + len tl
+
+-- Remark: if i < 0, then the result is none
+def indexOpt (ls : List α) (i : Int) : Option α :=
+  match ls with
+  | [] => none
+  | hd :: tl => if i = 0 then some hd else indexOpt tl (i - 1)
+
+-- Remark: if i < 0, then the result is the defaul element
+def index [Inhabited α] (ls : List α) (i : Int) : α :=
+  match ls with
+  | [] => Inhabited.default
+  | x :: tl =>
+    if i = 0 then x else index tl (i - 1)
+
+-- Remark: the list is unchanged if the index is not in bounds (in particular
+-- if it is < 0)
+def update (ls : List α) (i : Int) (y : α) : List α :=
+  match ls with
+  | [] => []
+  | x :: tl => if i = 0 then y :: tl else x :: update tl (i - 1) y
+
+-- Remark: the whole list is dropped if the index is not in bounds (in particular
+-- if it is < 0)
+def idrop (i : Int) (ls : List α) : List α :=
+  match ls with
+  | [] => []
+  | x :: tl => if i = 0 then x :: tl else idrop (i - 1) tl
+
+section Lemmas
+
+variable {α : Type u} 
+
+@[simp] theorem len_nil : len ([] : List α) = 0 := by simp [len]
+@[simp] theorem len_cons : len ((x :: tl) : List α) = 1 + len tl := by simp [len]
+
+@[simp] theorem index_zero_cons [Inhabited α] : index ((x :: tl) : List α) 0 = x := by simp [index]
+@[simp] theorem index_nzero_cons [Inhabited α] (hne : i ≠ 0) : index ((x :: tl) : List α) i = index tl (i - 1) := by simp [*, index]
+
+@[simp] theorem update_nil : update ([] : List α) i y = [] := by simp [update]
+@[simp] theorem update_zero_cons : update ((x :: tl) : List α) 0 y = y :: tl := by simp [update]
+@[simp] theorem update_nzero_cons (hne : i ≠ 0) : update ((x :: tl) : List α) i y = x :: update tl (i - 1) y := by simp [*, update]
+
+@[simp] theorem idrop_nil : idrop i ([] : List α) = [] := by simp [idrop]
+@[simp] theorem idrop_zero : idrop 0 (ls : List α) = ls := by cases ls <;> simp [idrop]
+@[simp] theorem idrop_nzero_cons (hne : i ≠ 0) : idrop i ((x :: tl) : List α) = idrop (i - 1) tl := by simp [*, idrop]
+
+theorem len_eq_length (ls : List α) : ls.len = ls.length := by
+  induction ls
+  . rfl
+  . simp [*, Int.ofNat_succ, Int.add_comm]
+
+@[simp] theorem len_append (l1 l2 : List α) : (l1 ++ l2).len = l1.len + l2.len := by
+  -- Remark: simp loops here because of the following rewritings:
+  -- @Nat.cast_add: ↑(List.length l1 + List.length l2) ==> ↑(List.length l1) + ↑(List.length l2)
+  -- Int.ofNat_add_ofNat: ↑(List.length l1) + ↑(List.length l2) ==> ↑(List.length l1 + List.length l2)
+  -- TODO: post an issue?
+  simp only [len_eq_length]
+  simp only [length_append]
+  simp only [Int.ofNat_add]
+
+@[simp]
+theorem length_update (ls : List α) (i : Int) (x : α) : (ls.update i x).length = ls.length := by
+  revert i
+  induction ls <;> simp_all [length, update]
+  intro; split <;> simp [*]
+
+@[simp]
+theorem len_update (ls : List α) (i : Int) (x : α) : (ls.update i x).len = ls.len := by
+  simp [len_eq_length]
+
+
+theorem len_pos : 0 ≤ (ls : List α).len := by
+  induction ls <;> simp [*]
+  linarith
+
+instance (a : Type u) : Arith.HasIntProp (List a) where
+  prop_ty := λ ls => 0 ≤ ls.len
+  prop := λ ls => ls.len_pos
+
+theorem left_length_eq_append_eq (l1 l2 l1' l2' : List α) (heq : l1.length = l1'.length) :
+  l1 ++ l2 = l1' ++ l2' ↔ l1 = l1' ∧ l2 = l2' := by
+  revert l1'
+  induction l1
+  . intro l1'; cases l1' <;> simp [*]
+  . intro l1'; cases l1' <;> simp_all; tauto
+
+theorem right_length_eq_append_eq (l1 l2 l1' l2' : List α) (heq : l2.length = l2'.length) :
+  l1 ++ l2 = l1' ++ l2' ↔ l1 = l1' ∧ l2 = l2' := by
+  have := left_length_eq_append_eq l1 l2 l1' l2'
+  constructor <;> intro heq2 <;>
+  have : l1.length + l2.length = l1'.length + l2'.length := by
+    have : (l1 ++ l2).length = (l1' ++ l2').length := by simp [*]
+    simp only [length_append] at this
+    apply this
+  . simp [heq] at this
+    tauto
+  . tauto
+
+theorem left_len_eq_append_eq (l1 l2 l1' l2' : List α) (heq : l1.len = l1'.len) :
+  l1 ++ l2 = l1' ++ l2' ↔ l1 = l1' ∧ l2 = l2' := by
+  simp [len_eq_length] at heq
+  apply left_length_eq_append_eq
+  assumption
+
+theorem right_len_eq_append_eq (l1 l2 l1' l2' : List α) (heq : l2.len = l2'.len) :
+  l1 ++ l2 = l1' ++ l2' ↔ l1 = l1' ∧ l2 = l2' := by
+  simp [len_eq_length] at heq
+  apply right_length_eq_append_eq
+  assumption
+
+open Arith in
+theorem idrop_eq_nil_of_le (hineq : ls.len ≤ i) : idrop i ls = [] := by
+  revert i
+  induction ls <;> simp [*]
+  rename_i hd tl hi
+  intro i hineq
+  if heq: i = 0 then
+    simp [*] at *
+    have := tl.len_pos
+    linarith
+  else
+    simp at hineq
+    have : 0 < i := by int_tac
+    simp [*]
+    apply hi
+    linarith
+
+end Lemmas
+
+end List
diff --git a/backends/lean/Base/Primitives.lean b/backends/lean/Base/Primitives.lean
index 1a0c665d..91823cb6 100644
--- a/backends/lean/Base/Primitives.lean
+++ b/backends/lean/Base/Primitives.lean
@@ -1,715 +1,3 @@
-import Lean
-import Lean.Meta.Tactic.Simp
-import Init.Data.List.Basic
-import Mathlib.Tactic.RunCmd
-import Mathlib.Tactic.Linarith
-
-namespace Primitives
-
---------------------
--- ASSERT COMMAND --Std.
---------------------
-
-open Lean Elab Command Term Meta
-
-syntax (name := assert) "#assert" term: command
-
-@[command_elab assert]
-unsafe
-def assertImpl : CommandElab := fun (_stx: Syntax) => do
-  runTermElabM (fun _ => do
-    let r ← evalTerm Bool (mkConst ``Bool) _stx[1]
-    if not r then
-      logInfo ("Assertion failed for:\n" ++ _stx[1])
-      throwError ("Expression reduced to false:\n"  ++ _stx[1])
-    pure ())
-
-#eval 2 == 2
-#assert (2 == 2)
-
--------------
--- PRELUDE --
--------------
-
--- Results & monadic combinators
-
-inductive Error where
-   | assertionFailure: Error
-   | integerOverflow: Error
-   | divisionByZero: Error
-   | arrayOutOfBounds: Error
-   | maximumSizeExceeded: Error
-   | panic: Error
-deriving Repr, BEq
-
-open Error
-
-inductive Result (α : Type u) where
-  | ret (v: α): Result α
-  | fail (e: Error): Result α
-  | div
-deriving Repr, BEq
-
-open Result
-
-instance Result_Inhabited (α : Type u) : Inhabited (Result α) :=
-  Inhabited.mk (fail panic)
-
-instance Result_Nonempty (α : Type u) : Nonempty (Result α) :=
-  Nonempty.intro div
-
-/- HELPERS -/
-
-def ret? {α: Type u} (r: Result α): Bool :=
-  match r with
-  | ret _ => true
-  | fail _ | div => false
-
-def div? {α: Type u} (r: Result α): Bool :=
-  match r with
-  | div => true
-  | ret _ | fail _ => false
-
-def massert (b:Bool) : Result Unit :=
-  if b then ret () else fail assertionFailure
-
-def eval_global {α: Type u} (x: Result α) (_: ret? x): α :=
-  match x with
-  | fail _ | div => by contradiction
-  | ret x => x
-
-/- DO-DSL SUPPORT -/
-
-def bind {α : Type u} {β : Type v} (x: Result α) (f: α -> Result β) : Result β :=
-  match x with
-  | ret v  => f v 
-  | fail v => fail v
-  | div => div
-
--- Allows using Result in do-blocks
-instance : Bind Result where
-  bind := bind
-
--- Allows using return x in do-blocks
-instance : Pure Result where
-  pure := fun x => ret x
-
-@[simp] theorem bind_ret (x : α) (f : α → Result β) : bind (.ret x) f = f x := by simp [bind]
-@[simp] theorem bind_fail (x : Error) (f : α → Result β) : bind (.fail x) f = .fail x := by simp [bind]
-@[simp] theorem bind_div (f : α → Result β) : bind .div f = .div := by simp [bind]
-
-/- CUSTOM-DSL SUPPORT -/
-
--- Let-binding the Result of a monadic operation is oftentimes not sufficient,
--- because we may need a hypothesis for equational reasoning in the scope. We
--- rely on subtype, and a custom let-binding operator, in effect recreating our
--- own variant of the do-dsl
-
-def Result.attach {α: Type} (o : Result α): Result { x : α // o = ret x } :=
-  match o with
-  | ret x => ret ⟨x, rfl⟩
-  | fail e => fail e
-  | div => div
-
-@[simp] theorem bind_tc_ret (x : α) (f : α → Result β) :
-  (do let y ← .ret x; f y) = f x := by simp [Bind.bind, bind]
-
-@[simp] theorem bind_tc_fail (x : Error) (f : α → Result β) :
-  (do let y ← fail x; f y) = fail x := by simp [Bind.bind, bind]
-
-@[simp] theorem bind_tc_div (f : α → Result β) :
-  (do let y ← div; f y) = div := by simp [Bind.bind, bind]
-
-----------------------
--- MACHINE INTEGERS --
-----------------------
-
--- We redefine our machine integers types.
-
--- For Isize/Usize, we reuse `getNumBits` from `USize`. You cannot reduce `getNumBits`
--- using the simplifier, meaning that proofs do not depend on the compile-time value of
--- USize.size. (Lean assumes 32 or 64-bit platforms, and Rust doesn't really support, at
--- least officially, 16-bit microcontrollers, so this seems like a fine design decision
--- for now.)
-
--- Note from Chris Bailey: "If there's more than one salient property of your
--- definition then the subtyping strategy might get messy, and the property part
--- of a subtype is less discoverable by the simplifier or tactics like
--- library_search." So, we will not add refinements on the return values of the
--- operations defined on Primitives, but will rather rely on custom lemmas to
--- invert on possible return values of the primitive operations.
-
--- Machine integer constants, done via `ofNatCore`, which requires a proof that
--- the `Nat` fits within the desired integer type. We provide a custom tactic.
-
-open System.Platform.getNumBits
-
--- TODO: is there a way of only importing System.Platform.getNumBits?
---
-@[simp] def size_num_bits : Nat := (System.Platform.getNumBits ()).val
-
--- Remark: Lean seems to use < for the comparisons with the upper bounds by convention.
-
--- The "structured" bounds
-def Isize.smin : Int := - (HPow.hPow 2 (size_num_bits - 1))
-def Isize.smax : Int := (HPow.hPow 2 (size_num_bits - 1)) - 1
-def I8.smin    : Int := - (HPow.hPow 2 7)
-def I8.smax    : Int := HPow.hPow 2 7 - 1
-def I16.smin   : Int := - (HPow.hPow 2 15)
-def I16.smax   : Int := HPow.hPow 2 15 - 1
-def I32.smin   : Int := -(HPow.hPow 2 31)
-def I32.smax   : Int := HPow.hPow 2 31 - 1
-def I64.smin   : Int := -(HPow.hPow 2 63)
-def I64.smax   : Int := HPow.hPow 2 63 - 1
-def I128.smin  : Int := -(HPow.hPow 2 127)
-def I128.smax  : Int := HPow.hPow 2 127 - 1
-def Usize.smin : Int := 0
-def Usize.smax : Int := HPow.hPow 2 size_num_bits - 1
-def U8.smin    : Int := 0
-def U8.smax    : Int := HPow.hPow 2 8 - 1
-def U16.smin   : Int := 0
-def U16.smax   : Int := HPow.hPow 2 16 - 1
-def U32.smin   : Int := 0
-def U32.smax   : Int := HPow.hPow 2 32 - 1
-def U64.smin   : Int := 0
-def U64.smax   : Int := HPow.hPow 2 64 - 1
-def U128.smin  : Int := 0
-def U128.smax  : Int := HPow.hPow 2 128 - 1
-
--- The "normalized" bounds, that we use in practice
-def I8.min    := -128
-def I8.max   := 127
-def I16.min  := -32768
-def I16.max  := 32767
-def I32.min  := -2147483648
-def I32.max  := 2147483647
-def I64.min  := -9223372036854775808
-def I64.max  := 9223372036854775807
-def I128.min := -170141183460469231731687303715884105728
-def I128.max := 170141183460469231731687303715884105727
-@[simp] def U8.min   := 0
-def U8.max   := 255
-@[simp] def U16.min  := 0
-def U16.max  := 65535
-@[simp] def U32.min  := 0
-def U32.max  := 4294967295
-@[simp] def U64.min  := 0
-def U64.max  := 18446744073709551615
-@[simp] def U128.min := 0
-def U128.max := 340282366920938463463374607431768211455
-@[simp] def Usize.min := 0
-
-def Isize.refined_min : { n:Int // n = I32.min ∨ n = I64.min } :=
-  ⟨ Isize.smin, by
-    simp [Isize.smin]
-    cases System.Platform.numBits_eq <;>
-    unfold System.Platform.numBits at * <;> simp [*] ⟩
-
-def Isize.refined_max : { n:Int // n = I32.max ∨ n = I64.max } :=
-  ⟨ Isize.smax, by
-    simp [Isize.smax]
-    cases System.Platform.numBits_eq <;>
-    unfold System.Platform.numBits at * <;> simp [*] ⟩
-
-def Usize.refined_max : { n:Int // n = U32.max ∨ n = U64.max } :=
-  ⟨ Usize.smax, by
-    simp [Usize.smax]
-    cases System.Platform.numBits_eq <;>
-    unfold System.Platform.numBits at * <;> simp [*] ⟩
-
-def Isize.min := Isize.refined_min.val
-def Isize.max := Isize.refined_max.val
-def Usize.max := Usize.refined_max.val
-
-inductive ScalarTy :=
-| Isize
-| I8
-| I16
-| I32
-| I64
-| I128
-| Usize
-| U8
-| U16
-| U32
-| U64
-| U128
-
-def Scalar.smin (ty : ScalarTy) : Int :=
-  match ty with
-  | .Isize => Isize.smin
-  | .I8    => I8.smin
-  | .I16   => I16.smin
-  | .I32   => I32.smin
-  | .I64   => I64.smin
-  | .I128  => I128.smin
-  | .Usize => Usize.smin
-  | .U8    => U8.smin
-  | .U16   => U16.smin
-  | .U32   => U32.smin
-  | .U64   => U64.smin
-  | .U128  => U128.smin
-
-def Scalar.smax (ty : ScalarTy) : Int :=
-  match ty with
-  | .Isize => Isize.smax
-  | .I8    => I8.smax
-  | .I16   => I16.smax
-  | .I32   => I32.smax
-  | .I64   => I64.smax
-  | .I128  => I128.smax
-  | .Usize => Usize.smax
-  | .U8    => U8.smax
-  | .U16   => U16.smax
-  | .U32   => U32.smax
-  | .U64   => U64.smax
-  | .U128  => U128.smax
-
-def Scalar.min (ty : ScalarTy) : Int :=
-  match ty with
-  | .Isize => Isize.min
-  | .I8    => I8.min
-  | .I16   => I16.min
-  | .I32   => I32.min
-  | .I64   => I64.min
-  | .I128  => I128.min
-  | .Usize => Usize.min
-  | .U8    => U8.min
-  | .U16   => U16.min
-  | .U32   => U32.min
-  | .U64   => U64.min
-  | .U128  => U128.min
-
-def Scalar.max (ty : ScalarTy) : Int :=
-  match ty with
-  | .Isize => Isize.max
-  | .I8    => I8.max
-  | .I16   => I16.max
-  | .I32   => I32.max
-  | .I64   => I64.max
-  | .I128  => I128.max
-  | .Usize => Usize.max
-  | .U8    => U8.max
-  | .U16   => U16.max
-  | .U32   => U32.max
-  | .U64   => U64.max
-  | .U128  => U128.max
-
-def Scalar.smin_eq (ty : ScalarTy) : Scalar.min ty = Scalar.smin ty := by
-  cases ty <;> rfl
-
-def Scalar.smax_eq (ty : ScalarTy) : Scalar.max ty = Scalar.smax ty := by
-  cases ty <;> rfl
-
--- "Conservative" bounds
--- We use those because we can't compare to the isize bounds (which can't
--- reduce at compile-time). Whenever we perform an arithmetic operation like
--- addition we need to check that the result is in bounds: we first compare
--- to the conservative bounds, which reduce, then compare to the real bounds.
--- This is useful for the various #asserts that we want to reduce at
--- type-checking time.
-def Scalar.cMin (ty : ScalarTy) : Int :=
-  match ty with
-  | .Isize => Scalar.min .I32
-  | _ => Scalar.min ty
-
-def Scalar.cMax (ty : ScalarTy) : Int :=
-  match ty with
-  | .Isize => Scalar.max .I32
-  | .Usize => Scalar.max .U32
-  | _ => Scalar.max ty
-
-theorem Scalar.cMin_bound ty : Scalar.min ty ≤ Scalar.cMin ty := by
-  cases ty <;> simp [Scalar.min, Scalar.max, Scalar.cMin, Scalar.cMax] at *
-  have h := Isize.refined_min.property
-  cases h <;> simp [*, Isize.min]
-
-theorem Scalar.cMax_bound ty : Scalar.cMax ty ≤ Scalar.max ty := by
-  cases ty <;> simp [Scalar.min, Scalar.max, Scalar.cMin, Scalar.cMax] at *
-  . have h := Isize.refined_max.property
-    cases h <;> simp [*, Isize.max]
-  . have h := Usize.refined_max.property
-    cases h <;> simp [*, Usize.max]
-
-theorem Scalar.cMin_suffices ty (h : Scalar.cMin ty ≤ x) : Scalar.min ty ≤ x := by
-  have := Scalar.cMin_bound ty
-  linarith
-
-theorem Scalar.cMax_suffices ty (h : x ≤ Scalar.cMax ty) : x ≤ Scalar.max ty := by
-  have := Scalar.cMax_bound ty
-  linarith
-
-structure Scalar (ty : ScalarTy) where
-  val : Int
-  hmin : Scalar.min ty ≤ val
-  hmax : val ≤ Scalar.max ty
-deriving Repr
-
-theorem Scalar.bound_suffices (ty : ScalarTy) (x : Int) :
-  Scalar.cMin ty ≤ x ∧ x ≤ Scalar.cMax ty ->
-  Scalar.min ty ≤ x ∧ x ≤ Scalar.max ty
-  :=
-  λ h => by
-  apply And.intro <;> have hmin := Scalar.cMin_bound ty <;> have hmax := Scalar.cMax_bound ty <;> linarith
-
-def Scalar.ofIntCore {ty : ScalarTy} (x : Int)
-  (hmin : Scalar.min ty ≤ x) (hmax : x ≤ Scalar.max ty) : Scalar ty :=
-  { val := x, hmin := hmin, hmax := hmax }
-
--- Tactic to prove that integers are in bounds
--- TODO: use this: https://leanprover.zulipchat.com/#narrow/stream/270676-lean4/topic/instance.20with.20tactic.20autoparam
-syntax "intlit" : tactic
-macro_rules
-  | `(tactic| intlit) => `(tactic| apply Scalar.bound_suffices; decide)
-
-def Scalar.ofInt {ty : ScalarTy} (x : Int)
-  (h : Scalar.min ty ≤ x ∧ x ≤ Scalar.max ty := by intlit) : Scalar ty :=
-  -- Remark: we initially wrote:
-  --  let ⟨ hmin, hmax ⟩ := h
-  --  Scalar.ofIntCore x hmin hmax
-  -- We updated to the line below because a similar pattern in `Scalar.tryMk`
-  -- made reduction block. Both versions seem to work for `Scalar.ofInt`, though.
-  -- TODO: investigate
-  Scalar.ofIntCore x h.left h.right
-
-@[simp] def Scalar.check_bounds (ty : ScalarTy) (x : Int) : Bool :=
-  (Scalar.cMin ty ≤ x || Scalar.min ty ≤ x) ∧ (x ≤ Scalar.cMax ty || x ≤ Scalar.max ty)
-
-theorem Scalar.check_bounds_prop {ty : ScalarTy} {x : Int} (h: Scalar.check_bounds ty x) :
-  Scalar.min ty ≤ x ∧ x ≤ Scalar.max ty := by
-  simp at *
-  have ⟨ hmin, hmax ⟩ := h
-  have hbmin := Scalar.cMin_bound ty
-  have hbmax := Scalar.cMax_bound ty
-  cases hmin <;> cases hmax <;> apply And.intro <;> linarith
-
--- Further thoughts: look at what has been done here:
--- https://github.com/leanprover-community/mathlib4/blob/master/Mathlib/Data/Fin/Basic.lean
--- and
--- https://github.com/leanprover-community/mathlib4/blob/master/Mathlib/Data/UInt.lean
--- which both contain a fair amount of reasoning already!
-def Scalar.tryMk (ty : ScalarTy) (x : Int) : Result (Scalar ty) :=
-  if h:Scalar.check_bounds ty x then
-    -- If we do:
-    -- ```
-    -- let ⟨ hmin, hmax ⟩ := (Scalar.check_bounds_prop h)
-    -- Scalar.ofIntCore x hmin hmax
-    -- ```
-    -- then normalization blocks (for instance, some proofs which use reflexivity fail).
-    -- However, the version below doesn't block reduction (TODO: investigate):
-    return Scalar.ofInt x (Scalar.check_bounds_prop h)
-  else fail integerOverflow
-
-def Scalar.neg {ty : ScalarTy} (x : Scalar ty) : Result (Scalar ty) := Scalar.tryMk ty (- x.val)
-
-def Scalar.div {ty : ScalarTy} (x : Scalar ty) (y : Scalar ty) : Result (Scalar ty) :=
-  if y.val != 0 then Scalar.tryMk ty (x.val / y.val) else fail divisionByZero
-
--- Our custom remainder operation, which satisfies the semantics of Rust
--- TODO: is there a better way?
-def scalar_rem (x y : Int) : Int :=
-  if 0 ≤ x then |x| % |y|
-  else - (|x| % |y|)
-
--- Our custom division operation, which satisfies the semantics of Rust
--- TODO: is there a better way?
-def scalar_div (x y : Int) : Int :=
-  if 0 ≤ x && 0 ≤ y then |x| / |y|
-  else if 0 ≤ x && y < 0 then - (|x| / |y|)
-  else if x < 0 && 0 ≤ y then - (|x| / |y|)
-  else |x| / |y|
-
--- Checking that the remainder operation is correct
-#assert scalar_rem 1 2 = 1
-#assert scalar_rem (-1) 2 = -1
-#assert scalar_rem 1 (-2) = 1
-#assert scalar_rem (-1) (-2) = -1
-#assert scalar_rem 7 3 = (1:Int)
-#assert scalar_rem (-7) 3 = -1
-#assert scalar_rem 7 (-3) = 1
-#assert scalar_rem (-7) (-3) = -1
-
--- Checking that the division operation is correct
-#assert scalar_div 3 2 = 1
-#assert scalar_div (-3) 2 = -1
-#assert scalar_div 3 (-2) = -1
-#assert scalar_div (-3) (-2) = 1
-#assert scalar_div 7 3 = 2
-#assert scalar_div (-7) 3 = -2
-#assert scalar_div 7 (-3) = -2
-#assert scalar_div (-7) (-3) = 2
-
-def Scalar.rem {ty : ScalarTy} (x : Scalar ty) (y : Scalar ty) : Result (Scalar ty) :=
-  if y.val != 0 then Scalar.tryMk ty (x.val % y.val) else fail divisionByZero
-
-def Scalar.add {ty : ScalarTy} (x : Scalar ty) (y : Scalar ty) : Result (Scalar ty) :=
-  Scalar.tryMk ty (x.val + y.val)
-
-def Scalar.sub {ty : ScalarTy} (x : Scalar ty) (y : Scalar ty) : Result (Scalar ty) :=
-  Scalar.tryMk ty (x.val - y.val)
-
-def Scalar.mul {ty : ScalarTy} (x : Scalar ty) (y : Scalar ty) : Result (Scalar ty) :=
-  Scalar.tryMk ty (x.val * y.val)
-
--- TODO: instances of +, -, * etc. for scalars
-
--- Cast an integer from a [src_ty] to a [tgt_ty]
--- TODO: check the semantics of casts in Rust
-def Scalar.cast {src_ty : ScalarTy} (tgt_ty : ScalarTy) (x : Scalar src_ty) : Result (Scalar tgt_ty) :=
-  Scalar.tryMk tgt_ty x.val
-
--- The scalar types
--- We declare the definitions as reducible so that Lean can unfold them (useful
--- for type class resolution for instance).
-@[reducible] def Isize := Scalar .Isize
-@[reducible] def I8    := Scalar .I8
-@[reducible] def I16   := Scalar .I16
-@[reducible] def I32   := Scalar .I32
-@[reducible] def I64   := Scalar .I64
-@[reducible] def I128  := Scalar .I128
-@[reducible] def Usize := Scalar .Usize
-@[reducible] def U8    := Scalar .U8
-@[reducible] def U16   := Scalar .U16
-@[reducible] def U32   := Scalar .U32
-@[reducible] def U64   := Scalar .U64
-@[reducible] def U128  := Scalar .U128
-
--- TODO: below: not sure this is the best way.
--- Should we rather overload operations like +, -, etc.?
--- Also, it is possible to automate the generation of those definitions
--- with macros (but would it be a good idea? It would be less easy to
--- read the file, which is not supposed to change a lot)
-
--- Negation
-
-/--
-Remark: there is no heterogeneous negation in the Lean prelude: we thus introduce
-one here.
-
-The notation typeclass for heterogeneous addition.
-This enables the notation `- a : β` where `a : α`.
--/
-class HNeg (α : Type u) (β : outParam (Type v)) where
-  /-- `- a` computes the negation of `a`.
-  The meaning of this notation is type-dependent. -/
-  hNeg : α → β
-
-prefix:75  "-"   => HNeg.hNeg
-
-instance : HNeg Isize (Result Isize) where hNeg x := Scalar.neg x
-instance : HNeg I8 (Result I8) where hNeg x := Scalar.neg x
-instance : HNeg I16 (Result I16) where hNeg x := Scalar.neg x
-instance : HNeg I32 (Result I32) where hNeg x := Scalar.neg x
-instance : HNeg I64 (Result I64) where hNeg x := Scalar.neg x
-instance : HNeg I128 (Result I128) where hNeg x := Scalar.neg x
-
--- Addition
-instance {ty} : HAdd (Scalar ty) (Scalar ty) (Result (Scalar ty)) where
-  hAdd x y := Scalar.add x y
-
--- Substraction
-instance {ty} : HSub (Scalar ty) (Scalar ty) (Result (Scalar ty)) where
-  hSub x y := Scalar.sub x y
-
--- Multiplication
-instance {ty} : HMul (Scalar ty) (Scalar ty) (Result (Scalar ty)) where
-  hMul x y := Scalar.mul x y
-
--- Division
-instance {ty} : HDiv (Scalar ty) (Scalar ty) (Result (Scalar ty)) where
-  hDiv x y := Scalar.div x y
-
--- Remainder
-instance {ty} : HMod (Scalar ty) (Scalar ty) (Result (Scalar ty)) where
-  hMod x y := Scalar.rem x y
-
--- ofIntCore
--- TODO: typeclass?
-def Isize.ofIntCore := @Scalar.ofIntCore .Isize
-def I8.ofIntCore    := @Scalar.ofIntCore .I8
-def I16.ofIntCore   := @Scalar.ofIntCore .I16
-def I32.ofIntCore   := @Scalar.ofIntCore .I32
-def I64.ofIntCore   := @Scalar.ofIntCore .I64
-def I128.ofIntCore  := @Scalar.ofIntCore .I128
-def Usize.ofIntCore := @Scalar.ofIntCore .Usize
-def U8.ofIntCore    := @Scalar.ofIntCore .U8
-def U16.ofIntCore   := @Scalar.ofIntCore .U16
-def U32.ofIntCore   := @Scalar.ofIntCore .U32
-def U64.ofIntCore   := @Scalar.ofIntCore .U64
-def U128.ofIntCore  := @Scalar.ofIntCore .U128
-
---  ofInt
--- TODO: typeclass?
-def Isize.ofInt := @Scalar.ofInt .Isize
-def I8.ofInt    := @Scalar.ofInt .I8
-def I16.ofInt   := @Scalar.ofInt .I16
-def I32.ofInt   := @Scalar.ofInt .I32
-def I64.ofInt   := @Scalar.ofInt .I64
-def I128.ofInt  := @Scalar.ofInt .I128
-def Usize.ofInt := @Scalar.ofInt .Usize
-def U8.ofInt    := @Scalar.ofInt .U8
-def U16.ofInt   := @Scalar.ofInt .U16
-def U32.ofInt   := @Scalar.ofInt .U32
-def U64.ofInt   := @Scalar.ofInt .U64
-def U128.ofInt  := @Scalar.ofInt .U128
-
--- Comparisons
-instance {ty} : LT (Scalar ty) where
-  lt a b := LT.lt a.val b.val
-
-instance {ty} : LE (Scalar ty) where le a b := LE.le a.val b.val
-
-instance Scalar.decLt {ty} (a b : Scalar ty) : Decidable (LT.lt a b) := Int.decLt ..
-instance Scalar.decLe {ty} (a b : Scalar ty) : Decidable (LE.le a b) := Int.decLe ..
-
-theorem Scalar.eq_of_val_eq {ty} : ∀ {i j : Scalar ty}, Eq i.val j.val → Eq i j
-  | ⟨_, _, _⟩, ⟨_, _, _⟩, rfl => rfl
-
-theorem Scalar.val_eq_of_eq {ty} {i j : Scalar ty} (h : Eq i j) : Eq i.val j.val :=
-  h ▸ rfl
-
-theorem Scalar.ne_of_val_ne {ty} {i j : Scalar ty} (h : Not (Eq i.val j.val)) : Not (Eq i j) :=
-  fun h' => absurd (val_eq_of_eq h') h
-
-instance (ty : ScalarTy) : DecidableEq (Scalar ty) :=
-  fun i j =>
-    match decEq i.val j.val with
-    | isTrue h  => isTrue (Scalar.eq_of_val_eq h)
-    | isFalse h => isFalse (Scalar.ne_of_val_ne h)
-
-def Scalar.toInt {ty} (n : Scalar ty) : Int := n.val
-
--- -- We now define a type class that subsumes the various machine integer types, so
--- -- as to write a concise definition for scalar_cast, rather than exhaustively
--- -- enumerating all of the possible pairs. We remark that Rust has sane semantics
--- -- and fails if a cast operation would involve a truncation or modulo.
-
--- class MachineInteger (t: Type) where
---   size: Nat
---   val: t -> Fin size
---   ofNatCore: (n:Nat) -> LT.lt n size -> t
-
--- set_option hygiene false in
--- run_cmd
---   for typeName in [`UInt8, `UInt16, `UInt32, `UInt64, `USize].map Lean.mkIdent do
---   Lean.Elab.Command.elabCommand (← `(
---     namespace $typeName
---     instance: MachineInteger $typeName where
---       size := size
---       val := val
---       ofNatCore := ofNatCore
---     end $typeName
---   ))
-
--- -- Aeneas only instantiates the destination type (`src` is implicit). We rely on
--- -- Lean to infer `src`.
-
--- def scalar_cast { src: Type } (dst: Type) [ MachineInteger src ] [ MachineInteger dst ] (x: src): Result dst :=
---   if h: MachineInteger.val x < MachineInteger.size dst then
---     .ret (MachineInteger.ofNatCore (MachineInteger.val x).val h)
---   else
---     .fail integerOverflow
-
--------------
--- VECTORS --
--------------
-
-def Vec (α : Type u) := { l : List α // List.length l ≤ Usize.max }
-
--- TODO: do we really need it? It should be with Subtype by default
-instance Vec.cast (a : Type): Coe (Vec a) (List a)  where coe := λ v => v.val
-
-def Vec.new (α : Type u): Vec α := ⟨ [], by apply Scalar.cMax_suffices .Usize; simp ⟩
-
-def Vec.len (α : Type u) (v : Vec α) : Usize :=
-  let ⟨ v, l ⟩ := v
-  Usize.ofIntCore (List.length v) (by simp [Scalar.min, Usize.min]) l
- 
--- This shouldn't be used
-def Vec.push_fwd (α : Type u) (_ : Vec α) (_ : α) : Unit := ()
-
--- This is actually the backward function
-def Vec.push (α : Type u) (v : Vec α) (x : α) : Result (Vec α)
-  :=
-  let nlen := List.length v.val + 1
-  if h : nlen ≤ U32.max || nlen ≤ Usize.max then
-    have h : nlen ≤ Usize.max := by
-      simp [Usize.max] at *
-      have hm := Usize.refined_max.property
-      cases h <;> cases hm <;> simp [U32.max, U64.max] at * <;> try linarith
-    return ⟨ List.concat v.val x, by simp at *; assumption ⟩
-  else
-    fail maximumSizeExceeded
-
--- This shouldn't be used
-def Vec.insert_fwd (α : Type u) (v: Vec α) (i: Usize) (_: α): Result Unit :=
-  if i.val < List.length v.val then
-    .ret ()
-  else
-    .fail arrayOutOfBounds
-
--- This is actually the backward function
-def Vec.insert (α : Type u) (v: Vec α) (i: Usize) (x: α): Result (Vec α) :=
-  if i.val < List.length v.val then
-    -- TODO: maybe we should redefine a list library which uses integers
-    -- (instead of natural numbers)
-    let i := i.val.toNat
-    .ret ⟨ List.set v.val i x, by
-      have h: List.length v.val ≤ Usize.max := v.property
-      simp [*] at *
-    ⟩
-  else
-    .fail arrayOutOfBounds
-
-def Vec.index_to_fin {α : Type u} {v: Vec α} {i: Usize} (h : i.val < List.length v.val) :
-  Fin (List.length v.val) :=
-  let j := i.val.toNat
-  let h: j < List.length v.val := by
-    have heq := @Int.toNat_lt (List.length v.val) i.val i.hmin
-    apply heq.mpr
-    assumption
-  ⟨j, h⟩
-
-def Vec.index (α : Type u) (v: Vec α) (i: Usize): Result α :=
-  if h: i.val < List.length v.val then
-    let i := Vec.index_to_fin h
-    .ret (List.get v.val i)
-  else
-    .fail arrayOutOfBounds
-
--- This shouldn't be used
-def Vec.index_back (α : Type u) (v: Vec α) (i: Usize) (_: α): Result Unit :=
-  if i.val < List.length v.val then
-    .ret ()
-  else
-    .fail arrayOutOfBounds
-
-def Vec.index_mut (α : Type u) (v: Vec α) (i: Usize): Result α :=
-  if h: i.val < List.length v.val then
-    let i := Vec.index_to_fin h
-    .ret (List.get v.val i)
-  else
-    .fail arrayOutOfBounds
-
-def Vec.index_mut_back (α : Type u) (v: Vec α) (i: Usize) (x: α): Result (Vec α) :=
-  if h: i.val < List.length v.val then
-    let i := Vec.index_to_fin h
-    .ret ⟨ List.set v.val i x, by
-      have h: List.length v.val ≤ Usize.max := v.property
-      simp [*] at *
-    ⟩
-  else
-    .fail arrayOutOfBounds
-
-----------
--- MISC --
-----------
-
-@[simp] def mem.replace (a : Type) (x : a) (_ : a) : a := x
-@[simp] def mem.replace_back (a : Type) (_ : a) (y : a) : a := y
-
-/-- Aeneas-translated function -- useful to reduce non-recursive definitions.
- Use with `simp [ aeneas ]` -/
-register_simp_attr aeneas
-
-end Primitives
+import Base.Primitives.Base
+import Base.Primitives.Scalar
+import Base.Primitives.Vec
diff --git a/backends/lean/Base/Primitives/Base.lean b/backends/lean/Base/Primitives/Base.lean
new file mode 100644
index 00000000..db462c38
--- /dev/null
+++ b/backends/lean/Base/Primitives/Base.lean
@@ -0,0 +1,130 @@
+import Lean
+
+namespace Primitives
+
+--------------------
+-- ASSERT COMMAND --Std.
+--------------------
+
+open Lean Elab Command Term Meta
+
+syntax (name := assert) "#assert" term: command
+
+@[command_elab assert]
+unsafe
+def assertImpl : CommandElab := fun (_stx: Syntax) => do
+  runTermElabM (fun _ => do
+    let r ← evalTerm Bool (mkConst ``Bool) _stx[1]
+    if not r then
+      logInfo ("Assertion failed for:\n" ++ _stx[1])
+      throwError ("Expression reduced to false:\n"  ++ _stx[1])
+    pure ())
+
+#eval 2 == 2
+#assert (2 == 2)
+
+-------------
+-- PRELUDE --
+-------------
+
+-- Results & monadic combinators
+
+inductive Error where
+   | assertionFailure: Error
+   | integerOverflow: Error
+   | divisionByZero: Error
+   | arrayOutOfBounds: Error
+   | maximumSizeExceeded: Error
+   | panic: Error
+deriving Repr, BEq
+
+open Error
+
+inductive Result (α : Type u) where
+  | ret (v: α): Result α
+  | fail (e: Error): Result α
+  | div
+deriving Repr, BEq
+
+open Result
+
+instance Result_Inhabited (α : Type u) : Inhabited (Result α) :=
+  Inhabited.mk (fail panic)
+
+instance Result_Nonempty (α : Type u) : Nonempty (Result α) :=
+  Nonempty.intro div
+
+/- HELPERS -/
+
+def ret? {α: Type u} (r: Result α): Bool :=
+  match r with
+  | ret _ => true
+  | fail _ | div => false
+
+def div? {α: Type u} (r: Result α): Bool :=
+  match r with
+  | div => true
+  | ret _ | fail _ => false
+
+def massert (b:Bool) : Result Unit :=
+  if b then ret () else fail assertionFailure
+
+def eval_global {α: Type u} (x: Result α) (_: ret? x): α :=
+  match x with
+  | fail _ | div => by contradiction
+  | ret x => x
+
+/- DO-DSL SUPPORT -/
+
+def bind {α : Type u} {β : Type v} (x: Result α) (f: α -> Result β) : Result β :=
+  match x with
+  | ret v  => f v 
+  | fail v => fail v
+  | div => div
+
+-- Allows using Result in do-blocks
+instance : Bind Result where
+  bind := bind
+
+-- Allows using return x in do-blocks
+instance : Pure Result where
+  pure := fun x => ret x
+
+@[simp] theorem bind_ret (x : α) (f : α → Result β) : bind (.ret x) f = f x := by simp [bind]
+@[simp] theorem bind_fail (x : Error) (f : α → Result β) : bind (.fail x) f = .fail x := by simp [bind]
+@[simp] theorem bind_div (f : α → Result β) : bind .div f = .div := by simp [bind]
+
+/- CUSTOM-DSL SUPPORT -/
+
+-- Let-binding the Result of a monadic operation is oftentimes not sufficient,
+-- because we may need a hypothesis for equational reasoning in the scope. We
+-- rely on subtype, and a custom let-binding operator, in effect recreating our
+-- own variant of the do-dsl
+
+def Result.attach {α: Type} (o : Result α): Result { x : α // o = ret x } :=
+  match o with
+  | ret x => ret ⟨x, rfl⟩
+  | fail e => fail e
+  | div => div
+
+@[simp] theorem bind_tc_ret (x : α) (f : α → Result β) :
+  (do let y ← .ret x; f y) = f x := by simp [Bind.bind, bind]
+
+@[simp] theorem bind_tc_fail (x : Error) (f : α → Result β) :
+  (do let y ← fail x; f y) = fail x := by simp [Bind.bind, bind]
+
+@[simp] theorem bind_tc_div (f : α → Result β) :
+  (do let y ← div; f y) = div := by simp [Bind.bind, bind]
+
+----------
+-- MISC --
+----------
+
+@[simp] def mem.replace (a : Type) (x : a) (_ : a) : a := x
+@[simp] def mem.replace_back (a : Type) (_ : a) (y : a) : a := y
+
+/-- Aeneas-translated function -- useful to reduce non-recursive definitions.
+ Use with `simp [ aeneas ]` -/
+register_simp_attr aeneas
+
+end Primitives
diff --git a/backends/lean/Base/Primitives/Scalar.lean b/backends/lean/Base/Primitives/Scalar.lean
new file mode 100644
index 00000000..241dfa07
--- /dev/null
+++ b/backends/lean/Base/Primitives/Scalar.lean
@@ -0,0 +1,507 @@
+import Lean
+import Lean.Meta.Tactic.Simp
+import Mathlib.Tactic.Linarith
+import Base.Primitives.Base
+
+namespace Primitives
+
+----------------------
+-- MACHINE INTEGERS --
+----------------------
+
+-- We redefine our machine integers types.
+
+-- For Isize/Usize, we reuse `getNumBits` from `USize`. You cannot reduce `getNumBits`
+-- using the simplifier, meaning that proofs do not depend on the compile-time value of
+-- USize.size. (Lean assumes 32 or 64-bit platforms, and Rust doesn't really support, at
+-- least officially, 16-bit microcontrollers, so this seems like a fine design decision
+-- for now.)
+
+-- Note from Chris Bailey: "If there's more than one salient property of your
+-- definition then the subtyping strategy might get messy, and the property part
+-- of a subtype is less discoverable by the simplifier or tactics like
+-- library_search." So, we will not add refinements on the return values of the
+-- operations defined on Primitives, but will rather rely on custom lemmas to
+-- invert on possible return values of the primitive operations.
+
+-- Machine integer constants, done via `ofNatCore`, which requires a proof that
+-- the `Nat` fits within the desired integer type. We provide a custom tactic.
+
+open Result Error
+open System.Platform.getNumBits
+
+-- TODO: is there a way of only importing System.Platform.getNumBits?
+--
+@[simp] def size_num_bits : Nat := (System.Platform.getNumBits ()).val
+
+-- Remark: Lean seems to use < for the comparisons with the upper bounds by convention.
+
+-- The "structured" bounds
+def Isize.smin : Int := - (HPow.hPow 2 (size_num_bits - 1))
+def Isize.smax : Int := (HPow.hPow 2 (size_num_bits - 1)) - 1
+def I8.smin    : Int := - (HPow.hPow 2 7)
+def I8.smax    : Int := HPow.hPow 2 7 - 1
+def I16.smin   : Int := - (HPow.hPow 2 15)
+def I16.smax   : Int := HPow.hPow 2 15 - 1
+def I32.smin   : Int := -(HPow.hPow 2 31)
+def I32.smax   : Int := HPow.hPow 2 31 - 1
+def I64.smin   : Int := -(HPow.hPow 2 63)
+def I64.smax   : Int := HPow.hPow 2 63 - 1
+def I128.smin  : Int := -(HPow.hPow 2 127)
+def I128.smax  : Int := HPow.hPow 2 127 - 1
+def Usize.smin : Int := 0
+def Usize.smax : Int := HPow.hPow 2 size_num_bits - 1
+def U8.smin    : Int := 0
+def U8.smax    : Int := HPow.hPow 2 8 - 1
+def U16.smin   : Int := 0
+def U16.smax   : Int := HPow.hPow 2 16 - 1
+def U32.smin   : Int := 0
+def U32.smax   : Int := HPow.hPow 2 32 - 1
+def U64.smin   : Int := 0
+def U64.smax   : Int := HPow.hPow 2 64 - 1
+def U128.smin  : Int := 0
+def U128.smax  : Int := HPow.hPow 2 128 - 1
+
+-- The "normalized" bounds, that we use in practice
+def I8.min    := -128
+def I8.max   := 127
+def I16.min  := -32768
+def I16.max  := 32767
+def I32.min  := -2147483648
+def I32.max  := 2147483647
+def I64.min  := -9223372036854775808
+def I64.max  := 9223372036854775807
+def I128.min := -170141183460469231731687303715884105728
+def I128.max := 170141183460469231731687303715884105727
+@[simp] def U8.min   := 0
+def U8.max   := 255
+@[simp] def U16.min  := 0
+def U16.max  := 65535
+@[simp] def U32.min  := 0
+def U32.max  := 4294967295
+@[simp] def U64.min  := 0
+def U64.max  := 18446744073709551615
+@[simp] def U128.min := 0
+def U128.max := 340282366920938463463374607431768211455
+@[simp] def Usize.min := 0
+
+def Isize.refined_min : { n:Int // n = I32.min ∨ n = I64.min } :=
+  ⟨ Isize.smin, by
+    simp [Isize.smin]
+    cases System.Platform.numBits_eq <;>
+    unfold System.Platform.numBits at * <;> simp [*] ⟩
+
+def Isize.refined_max : { n:Int // n = I32.max ∨ n = I64.max } :=
+  ⟨ Isize.smax, by
+    simp [Isize.smax]
+    cases System.Platform.numBits_eq <;>
+    unfold System.Platform.numBits at * <;> simp [*] ⟩
+
+def Usize.refined_max : { n:Int // n = U32.max ∨ n = U64.max } :=
+  ⟨ Usize.smax, by
+    simp [Usize.smax]
+    cases System.Platform.numBits_eq <;>
+    unfold System.Platform.numBits at * <;> simp [*] ⟩
+
+def Isize.min := Isize.refined_min.val
+def Isize.max := Isize.refined_max.val
+def Usize.max := Usize.refined_max.val
+
+inductive ScalarTy :=
+| Isize
+| I8
+| I16
+| I32
+| I64
+| I128
+| Usize
+| U8
+| U16
+| U32
+| U64
+| U128
+
+def Scalar.smin (ty : ScalarTy) : Int :=
+  match ty with
+  | .Isize => Isize.smin
+  | .I8    => I8.smin
+  | .I16   => I16.smin
+  | .I32   => I32.smin
+  | .I64   => I64.smin
+  | .I128  => I128.smin
+  | .Usize => Usize.smin
+  | .U8    => U8.smin
+  | .U16   => U16.smin
+  | .U32   => U32.smin
+  | .U64   => U64.smin
+  | .U128  => U128.smin
+
+def Scalar.smax (ty : ScalarTy) : Int :=
+  match ty with
+  | .Isize => Isize.smax
+  | .I8    => I8.smax
+  | .I16   => I16.smax
+  | .I32   => I32.smax
+  | .I64   => I64.smax
+  | .I128  => I128.smax
+  | .Usize => Usize.smax
+  | .U8    => U8.smax
+  | .U16   => U16.smax
+  | .U32   => U32.smax
+  | .U64   => U64.smax
+  | .U128  => U128.smax
+
+def Scalar.min (ty : ScalarTy) : Int :=
+  match ty with
+  | .Isize => Isize.min
+  | .I8    => I8.min
+  | .I16   => I16.min
+  | .I32   => I32.min
+  | .I64   => I64.min
+  | .I128  => I128.min
+  | .Usize => Usize.min
+  | .U8    => U8.min
+  | .U16   => U16.min
+  | .U32   => U32.min
+  | .U64   => U64.min
+  | .U128  => U128.min
+
+def Scalar.max (ty : ScalarTy) : Int :=
+  match ty with
+  | .Isize => Isize.max
+  | .I8    => I8.max
+  | .I16   => I16.max
+  | .I32   => I32.max
+  | .I64   => I64.max
+  | .I128  => I128.max
+  | .Usize => Usize.max
+  | .U8    => U8.max
+  | .U16   => U16.max
+  | .U32   => U32.max
+  | .U64   => U64.max
+  | .U128  => U128.max
+
+def Scalar.smin_eq (ty : ScalarTy) : Scalar.min ty = Scalar.smin ty := by
+  cases ty <;> rfl
+
+def Scalar.smax_eq (ty : ScalarTy) : Scalar.max ty = Scalar.smax ty := by
+  cases ty <;> rfl
+
+-- "Conservative" bounds
+-- We use those because we can't compare to the isize bounds (which can't
+-- reduce at compile-time). Whenever we perform an arithmetic operation like
+-- addition we need to check that the result is in bounds: we first compare
+-- to the conservative bounds, which reduce, then compare to the real bounds.
+-- This is useful for the various #asserts that we want to reduce at
+-- type-checking time.
+def Scalar.cMin (ty : ScalarTy) : Int :=
+  match ty with
+  | .Isize => Scalar.min .I32
+  | _ => Scalar.min ty
+
+def Scalar.cMax (ty : ScalarTy) : Int :=
+  match ty with
+  | .Isize => Scalar.max .I32
+  | .Usize => Scalar.max .U32
+  | _ => Scalar.max ty
+
+theorem Scalar.cMin_bound ty : Scalar.min ty ≤ Scalar.cMin ty := by
+  cases ty <;> simp [Scalar.min, Scalar.max, Scalar.cMin, Scalar.cMax] at *
+  have h := Isize.refined_min.property
+  cases h <;> simp [*, Isize.min]
+
+theorem Scalar.cMax_bound ty : Scalar.cMax ty ≤ Scalar.max ty := by
+  cases ty <;> simp [Scalar.min, Scalar.max, Scalar.cMin, Scalar.cMax] at *
+  . have h := Isize.refined_max.property
+    cases h <;> simp [*, Isize.max]
+  . have h := Usize.refined_max.property
+    cases h <;> simp [*, Usize.max]
+
+theorem Scalar.cMin_suffices ty (h : Scalar.cMin ty ≤ x) : Scalar.min ty ≤ x := by
+  have := Scalar.cMin_bound ty
+  linarith
+
+theorem Scalar.cMax_suffices ty (h : x ≤ Scalar.cMax ty) : x ≤ Scalar.max ty := by
+  have := Scalar.cMax_bound ty
+  linarith
+
+structure Scalar (ty : ScalarTy) where
+  val : Int
+  hmin : Scalar.min ty ≤ val
+  hmax : val ≤ Scalar.max ty
+deriving Repr
+
+theorem Scalar.bound_suffices (ty : ScalarTy) (x : Int) :
+  Scalar.cMin ty ≤ x ∧ x ≤ Scalar.cMax ty ->
+  Scalar.min ty ≤ x ∧ x ≤ Scalar.max ty
+  :=
+  λ h => by
+  apply And.intro <;> have hmin := Scalar.cMin_bound ty <;> have hmax := Scalar.cMax_bound ty <;> linarith
+
+def Scalar.ofIntCore {ty : ScalarTy} (x : Int)
+  (hmin : Scalar.min ty ≤ x) (hmax : x ≤ Scalar.max ty) : Scalar ty :=
+  { val := x, hmin := hmin, hmax := hmax }
+
+-- Tactic to prove that integers are in bounds
+-- TODO: use this: https://leanprover.zulipchat.com/#narrow/stream/270676-lean4/topic/instance.20with.20tactic.20autoparam
+syntax "intlit" : tactic
+macro_rules
+  | `(tactic| intlit) => `(tactic| apply Scalar.bound_suffices; decide)
+
+def Scalar.ofInt {ty : ScalarTy} (x : Int)
+  (h : Scalar.min ty ≤ x ∧ x ≤ Scalar.max ty := by intlit) : Scalar ty :=
+  -- Remark: we initially wrote:
+  --  let ⟨ hmin, hmax ⟩ := h
+  --  Scalar.ofIntCore x hmin hmax
+  -- We updated to the line below because a similar pattern in `Scalar.tryMk`
+  -- made reduction block. Both versions seem to work for `Scalar.ofInt`, though.
+  -- TODO: investigate
+  Scalar.ofIntCore x h.left h.right
+
+@[simp] def Scalar.check_bounds (ty : ScalarTy) (x : Int) : Bool :=
+  (Scalar.cMin ty ≤ x || Scalar.min ty ≤ x) ∧ (x ≤ Scalar.cMax ty || x ≤ Scalar.max ty)
+
+theorem Scalar.check_bounds_prop {ty : ScalarTy} {x : Int} (h: Scalar.check_bounds ty x) :
+  Scalar.min ty ≤ x ∧ x ≤ Scalar.max ty := by
+  simp at *
+  have ⟨ hmin, hmax ⟩ := h
+  have hbmin := Scalar.cMin_bound ty
+  have hbmax := Scalar.cMax_bound ty
+  cases hmin <;> cases hmax <;> apply And.intro <;> linarith
+
+-- Further thoughts: look at what has been done here:
+-- https://github.com/leanprover-community/mathlib4/blob/master/Mathlib/Data/Fin/Basic.lean
+-- and
+-- https://github.com/leanprover-community/mathlib4/blob/master/Mathlib/Data/UInt.lean
+-- which both contain a fair amount of reasoning already!
+def Scalar.tryMk (ty : ScalarTy) (x : Int) : Result (Scalar ty) :=
+  if h:Scalar.check_bounds ty x then
+    -- If we do:
+    -- ```
+    -- let ⟨ hmin, hmax ⟩ := (Scalar.check_bounds_prop h)
+    -- Scalar.ofIntCore x hmin hmax
+    -- ```
+    -- then normalization blocks (for instance, some proofs which use reflexivity fail).
+    -- However, the version below doesn't block reduction (TODO: investigate):
+    return Scalar.ofInt x (Scalar.check_bounds_prop h)
+  else fail integerOverflow
+
+def Scalar.neg {ty : ScalarTy} (x : Scalar ty) : Result (Scalar ty) := Scalar.tryMk ty (- x.val)
+
+def Scalar.div {ty : ScalarTy} (x : Scalar ty) (y : Scalar ty) : Result (Scalar ty) :=
+  if y.val != 0 then Scalar.tryMk ty (x.val / y.val) else fail divisionByZero
+
+-- Our custom remainder operation, which satisfies the semantics of Rust
+-- TODO: is there a better way?
+def scalar_rem (x y : Int) : Int :=
+  if 0 ≤ x then |x| % |y|
+  else - (|x| % |y|)
+
+-- Our custom division operation, which satisfies the semantics of Rust
+-- TODO: is there a better way?
+def scalar_div (x y : Int) : Int :=
+  if 0 ≤ x && 0 ≤ y then |x| / |y|
+  else if 0 ≤ x && y < 0 then - (|x| / |y|)
+  else if x < 0 && 0 ≤ y then - (|x| / |y|)
+  else |x| / |y|
+
+-- Checking that the remainder operation is correct
+#assert scalar_rem 1 2 = 1
+#assert scalar_rem (-1) 2 = -1
+#assert scalar_rem 1 (-2) = 1
+#assert scalar_rem (-1) (-2) = -1
+#assert scalar_rem 7 3 = (1:Int)
+#assert scalar_rem (-7) 3 = -1
+#assert scalar_rem 7 (-3) = 1
+#assert scalar_rem (-7) (-3) = -1
+
+-- Checking that the division operation is correct
+#assert scalar_div 3 2 = 1
+#assert scalar_div (-3) 2 = -1
+#assert scalar_div 3 (-2) = -1
+#assert scalar_div (-3) (-2) = 1
+#assert scalar_div 7 3 = 2
+#assert scalar_div (-7) 3 = -2
+#assert scalar_div 7 (-3) = -2
+#assert scalar_div (-7) (-3) = 2
+
+def Scalar.rem {ty : ScalarTy} (x : Scalar ty) (y : Scalar ty) : Result (Scalar ty) :=
+  if y.val != 0 then Scalar.tryMk ty (x.val % y.val) else fail divisionByZero
+
+def Scalar.add {ty : ScalarTy} (x : Scalar ty) (y : Scalar ty) : Result (Scalar ty) :=
+  Scalar.tryMk ty (x.val + y.val)
+
+def Scalar.sub {ty : ScalarTy} (x : Scalar ty) (y : Scalar ty) : Result (Scalar ty) :=
+  Scalar.tryMk ty (x.val - y.val)
+
+def Scalar.mul {ty : ScalarTy} (x : Scalar ty) (y : Scalar ty) : Result (Scalar ty) :=
+  Scalar.tryMk ty (x.val * y.val)
+
+-- TODO: instances of +, -, * etc. for scalars
+
+-- Cast an integer from a [src_ty] to a [tgt_ty]
+-- TODO: check the semantics of casts in Rust
+def Scalar.cast {src_ty : ScalarTy} (tgt_ty : ScalarTy) (x : Scalar src_ty) : Result (Scalar tgt_ty) :=
+  Scalar.tryMk tgt_ty x.val
+
+-- The scalar types
+-- We declare the definitions as reducible so that Lean can unfold them (useful
+-- for type class resolution for instance).
+@[reducible] def Isize := Scalar .Isize
+@[reducible] def I8    := Scalar .I8
+@[reducible] def I16   := Scalar .I16
+@[reducible] def I32   := Scalar .I32
+@[reducible] def I64   := Scalar .I64
+@[reducible] def I128  := Scalar .I128
+@[reducible] def Usize := Scalar .Usize
+@[reducible] def U8    := Scalar .U8
+@[reducible] def U16   := Scalar .U16
+@[reducible] def U32   := Scalar .U32
+@[reducible] def U64   := Scalar .U64
+@[reducible] def U128  := Scalar .U128
+
+-- TODO: below: not sure this is the best way.
+-- Should we rather overload operations like +, -, etc.?
+-- Also, it is possible to automate the generation of those definitions
+-- with macros (but would it be a good idea? It would be less easy to
+-- read the file, which is not supposed to change a lot)
+
+-- Negation
+
+/--
+Remark: there is no heterogeneous negation in the Lean prelude: we thus introduce
+one here.
+
+The notation typeclass for heterogeneous addition.
+This enables the notation `- a : β` where `a : α`.
+-/
+class HNeg (α : Type u) (β : outParam (Type v)) where
+  /-- `- a` computes the negation of `a`.
+  The meaning of this notation is type-dependent. -/
+  hNeg : α → β
+
+prefix:75  "-"   => HNeg.hNeg
+
+instance : HNeg Isize (Result Isize) where hNeg x := Scalar.neg x
+instance : HNeg I8 (Result I8) where hNeg x := Scalar.neg x
+instance : HNeg I16 (Result I16) where hNeg x := Scalar.neg x
+instance : HNeg I32 (Result I32) where hNeg x := Scalar.neg x
+instance : HNeg I64 (Result I64) where hNeg x := Scalar.neg x
+instance : HNeg I128 (Result I128) where hNeg x := Scalar.neg x
+
+-- Addition
+instance {ty} : HAdd (Scalar ty) (Scalar ty) (Result (Scalar ty)) where
+  hAdd x y := Scalar.add x y
+
+-- Substraction
+instance {ty} : HSub (Scalar ty) (Scalar ty) (Result (Scalar ty)) where
+  hSub x y := Scalar.sub x y
+
+-- Multiplication
+instance {ty} : HMul (Scalar ty) (Scalar ty) (Result (Scalar ty)) where
+  hMul x y := Scalar.mul x y
+
+-- Division
+instance {ty} : HDiv (Scalar ty) (Scalar ty) (Result (Scalar ty)) where
+  hDiv x y := Scalar.div x y
+
+-- Remainder
+instance {ty} : HMod (Scalar ty) (Scalar ty) (Result (Scalar ty)) where
+  hMod x y := Scalar.rem x y
+
+-- ofIntCore
+-- TODO: typeclass?
+def Isize.ofIntCore := @Scalar.ofIntCore .Isize
+def I8.ofIntCore    := @Scalar.ofIntCore .I8
+def I16.ofIntCore   := @Scalar.ofIntCore .I16
+def I32.ofIntCore   := @Scalar.ofIntCore .I32
+def I64.ofIntCore   := @Scalar.ofIntCore .I64
+def I128.ofIntCore  := @Scalar.ofIntCore .I128
+def Usize.ofIntCore := @Scalar.ofIntCore .Usize
+def U8.ofIntCore    := @Scalar.ofIntCore .U8
+def U16.ofIntCore   := @Scalar.ofIntCore .U16
+def U32.ofIntCore   := @Scalar.ofIntCore .U32
+def U64.ofIntCore   := @Scalar.ofIntCore .U64
+def U128.ofIntCore  := @Scalar.ofIntCore .U128
+
+--  ofInt
+-- TODO: typeclass?
+def Isize.ofInt := @Scalar.ofInt .Isize
+def I8.ofInt    := @Scalar.ofInt .I8
+def I16.ofInt   := @Scalar.ofInt .I16
+def I32.ofInt   := @Scalar.ofInt .I32
+def I64.ofInt   := @Scalar.ofInt .I64
+def I128.ofInt  := @Scalar.ofInt .I128
+def Usize.ofInt := @Scalar.ofInt .Usize
+def U8.ofInt    := @Scalar.ofInt .U8
+def U16.ofInt   := @Scalar.ofInt .U16
+def U32.ofInt   := @Scalar.ofInt .U32
+def U64.ofInt   := @Scalar.ofInt .U64
+def U128.ofInt  := @Scalar.ofInt .U128
+
+-- Comparisons
+instance {ty} : LT (Scalar ty) where
+  lt a b := LT.lt a.val b.val
+
+instance {ty} : LE (Scalar ty) where le a b := LE.le a.val b.val
+
+instance Scalar.decLt {ty} (a b : Scalar ty) : Decidable (LT.lt a b) := Int.decLt ..
+instance Scalar.decLe {ty} (a b : Scalar ty) : Decidable (LE.le a b) := Int.decLe ..
+
+theorem Scalar.eq_of_val_eq {ty} : ∀ {i j : Scalar ty}, Eq i.val j.val → Eq i j
+  | ⟨_, _, _⟩, ⟨_, _, _⟩, rfl => rfl
+
+theorem Scalar.val_eq_of_eq {ty} {i j : Scalar ty} (h : Eq i j) : Eq i.val j.val :=
+  h ▸ rfl
+
+theorem Scalar.ne_of_val_ne {ty} {i j : Scalar ty} (h : Not (Eq i.val j.val)) : Not (Eq i j) :=
+  fun h' => absurd (val_eq_of_eq h') h
+
+instance (ty : ScalarTy) : DecidableEq (Scalar ty) :=
+  fun i j =>
+    match decEq i.val j.val with
+    | isTrue h  => isTrue (Scalar.eq_of_val_eq h)
+    | isFalse h => isFalse (Scalar.ne_of_val_ne h)
+
+/- Remark: we can't write the following instance because of restrictions about
+   the type class parameters (`ty` doesn't appear in the return type, which is
+   forbidden):
+
+   ```
+   instance Scalar.cast (ty : ScalarTy) : Coe (Scalar ty) Int where coe := λ v => v.val
+   ```
+ -/
+def Scalar.toInt {ty} (n : Scalar ty) : Int := n.val
+
+-- -- We now define a type class that subsumes the various machine integer types, so
+-- -- as to write a concise definition for scalar_cast, rather than exhaustively
+-- -- enumerating all of the possible pairs. We remark that Rust has sane semantics
+-- -- and fails if a cast operation would involve a truncation or modulo.
+
+-- class MachineInteger (t: Type) where
+--   size: Nat
+--   val: t -> Fin size
+--   ofNatCore: (n:Nat) -> LT.lt n size -> t
+
+-- set_option hygiene false in
+-- run_cmd
+--   for typeName in [`UInt8, `UInt16, `UInt32, `UInt64, `USize].map Lean.mkIdent do
+--   Lean.Elab.Command.elabCommand (← `(
+--     namespace $typeName
+--     instance: MachineInteger $typeName where
+--       size := size
+--       val := val
+--       ofNatCore := ofNatCore
+--     end $typeName
+--   ))
+
+-- -- Aeneas only instantiates the destination type (`src` is implicit). We rely on
+-- -- Lean to infer `src`.
+
+-- def scalar_cast { src: Type } (dst: Type) [ MachineInteger src ] [ MachineInteger dst ] (x: src): Result dst :=
+--   if h: MachineInteger.val x < MachineInteger.size dst then
+--     .ret (MachineInteger.ofNatCore (MachineInteger.val x).val h)
+--   else
+--     .fail integerOverflow
+
+end Primitives
diff --git a/backends/lean/Base/Primitives/Vec.lean b/backends/lean/Base/Primitives/Vec.lean
new file mode 100644
index 00000000..7851a232
--- /dev/null
+++ b/backends/lean/Base/Primitives/Vec.lean
@@ -0,0 +1,113 @@
+import Lean
+import Lean.Meta.Tactic.Simp
+import Init.Data.List.Basic
+import Mathlib.Tactic.RunCmd
+import Mathlib.Tactic.Linarith
+import Base.IList
+import Base.Primitives.Scalar
+import Base.Arith
+
+namespace Primitives
+
+open Result Error
+
+-------------
+-- VECTORS --
+-------------
+
+def Vec (α : Type u) := { l : List α // List.length l ≤ Usize.max }
+
+-- TODO: do we really need it? It should be with Subtype by default
+instance Vec.cast (a : Type): Coe (Vec a) (List a)  where coe := λ v => v.val
+
+instance (a : Type) : Arith.HasIntProp (Vec a) where
+  prop_ty := λ v => v.val.length ≤ Scalar.max ScalarTy.Usize
+  prop := λ ⟨ _, l ⟩ => l
+
+example {a: Type} (v : Vec a) : v.val.length ≤ Scalar.max ScalarTy.Usize := by
+  intro_has_int_prop_instances
+  simp_all [Scalar.max, Scalar.min]
+
+example {a: Type} (v : Vec a) : v.val.length ≤ Scalar.max ScalarTy.Usize := by
+  scalar_tac
+
+def Vec.new (α : Type u): Vec α := ⟨ [], by apply Scalar.cMax_suffices .Usize; simp ⟩
+
+def Vec.len (α : Type u) (v : Vec α) : Usize :=
+  let ⟨ v, l ⟩ := v
+  Usize.ofIntCore (List.length v) (by simp [Scalar.min, Usize.min]) l
+
+def Vec.length {α : Type u} (v : Vec α) : Int := v.val.len
+
+-- This shouldn't be used
+def Vec.push_fwd (α : Type u) (_ : Vec α) (_ : α) : Unit := ()
+
+-- This is actually the backward function
+def Vec.push (α : Type u) (v : Vec α) (x : α) : Result (Vec α)
+  :=
+  let nlen := List.length v.val + 1
+  if h : nlen ≤ U32.max || nlen ≤ Usize.max then
+    have h : nlen ≤ Usize.max := by
+      simp [Usize.max] at *
+      have hm := Usize.refined_max.property
+      cases h <;> cases hm <;> simp [U32.max, U64.max] at * <;> try linarith
+    return ⟨ List.concat v.val x, by simp at *; assumption ⟩
+  else
+    fail maximumSizeExceeded
+
+-- This shouldn't be used
+def Vec.insert_fwd (α : Type u) (v: Vec α) (i: Usize) (_: α): Result Unit :=
+  if i.val < List.length v.val then
+    .ret ()
+  else
+    .fail arrayOutOfBounds
+
+-- This is actually the backward function
+def Vec.insert (α : Type u) (v: Vec α) (i: Usize) (x: α): Result (Vec α) :=
+  if i.val < List.length v.val then
+    -- TODO: maybe we should redefine a list library which uses integers
+    -- (instead of natural numbers)
+    .ret ⟨ v.val.update i.val x, by have := v.property; simp [*] ⟩
+  else
+    .fail arrayOutOfBounds
+
+-- TODO: remove
+def Vec.index_to_fin {α : Type u} {v: Vec α} {i: Usize} (h : i.val < List.length v.val) :
+  Fin (List.length v.val) :=
+  let j := i.val.toNat
+  let h: j < List.length v.val := by
+    have heq := @Int.toNat_lt (List.length v.val) i.val i.hmin
+    apply heq.mpr
+    assumption
+  ⟨j, h⟩
+
+def Vec.index (α : Type u) (v: Vec α) (i: Usize): Result α :=
+  match v.val.indexOpt i.val with
+  | none => fail .arrayOutOfBounds
+  | some x => ret x
+
+-- This shouldn't be used
+def Vec.index_back (α : Type u) (v: Vec α) (i: Usize) (_: α): Result Unit :=
+  if i.val < List.length v.val then
+    .ret ()
+  else
+    .fail arrayOutOfBounds
+
+def Vec.index_mut (α : Type u) (v: Vec α) (i: Usize): Result α :=
+  if h: i.val < List.length v.val then
+    let i := Vec.index_to_fin h
+    .ret (List.get v.val i)
+  else
+    .fail arrayOutOfBounds
+
+def Vec.index_mut_back (α : Type u) (v: Vec α) (i: Usize) (x: α): Result (Vec α) :=
+  if h: i.val < List.length v.val then
+    let i := Vec.index_to_fin h
+    .ret ⟨ List.set v.val i x, by
+      have h: List.length v.val ≤ Usize.max := v.property
+      simp [*] at *
+    ⟩
+  else
+    .fail arrayOutOfBounds
+
+end Primitives
diff --git a/backends/lean/Base/Progress/Progress.lean b/backends/lean/Base/Progress/Progress.lean
index 35a3c25a..af7b426a 100644
--- a/backends/lean/Base/Progress/Progress.lean
+++ b/backends/lean/Base/Progress/Progress.lean
@@ -7,6 +7,7 @@ namespace Progress
 open Lean Elab Term Meta Tactic
 open Utils
 
+-- TODO: remove
 namespace Test
   open Primitives
 
@@ -199,6 +200,7 @@ def evalProgress (args : TSyntax `Progress.progressArgs) : TacticM Unit := do
 elab "progress" args:progressArgs : tactic =>
   evalProgress args
 
+-- TODO: remove
 namespace Test
   open Primitives
 
-- 
cgit v1.3.1