diff --git a/copilot-language.cabal b/copilot-language.cabal
--- a/copilot-language.cabal
+++ b/copilot-language.cabal
@@ -1,6 +1,6 @@
 cabal-version:       >=1.10
 name:                copilot-language
-version:             2.2.0
+version:             2.2.1
 synopsis:            A Haskell-embedded DSL for monitoring hard real-time
                      distributed systems.
 description:
@@ -37,8 +37,8 @@
                , data-reify >= 0.6
                , mtl >= 2.0 && < 3
                , ghc-prim >= 0.2
-               , copilot-core == 2.2.0
-               , copilot-theorem == 0.2
+               , copilot-core >= 2.2.1
+               , copilot-theorem >= 2.1
   exposed-modules: Copilot
                  , Copilot.Language
                  , Copilot.Language.Operators.BitWise
@@ -70,9 +70,9 @@
     -Wall
 
     -fpackage-trust
-    -- Trusted packages:
+    -trust=array
     -trust=base
     -trust=containers
-    -trust=array
+    -trust=copilot-core
 
 
diff --git a/src/Copilot/Language.hs b/src/Copilot/Language.hs
--- a/src/Copilot/Language.hs
+++ b/src/Copilot/Language.hs
@@ -4,7 +4,7 @@
 
 -- | Main Copilot language export file.
 
-{-# LANGUAGE Trustworthy #-}
+{-# LANGUAGE Safe #-}
 
 module Copilot.Language
   ( module Data.Int
diff --git a/src/Copilot/Language/Analyze.hs b/src/Copilot/Language/Analyze.hs
--- a/src/Copilot/Language/Analyze.hs
+++ b/src/Copilot/Language/Analyze.hs
@@ -2,7 +2,7 @@
 -- Copyright © 2011 National Institute of Aerospace / Galois, Inc.
 --------------------------------------------------------------------------------
 
-{-# LANGUAGE Trustworthy #-}
+{-# LANGUAGE Safe #-}
 {-# LANGUAGE DeriveDataTypeable #-}
 {-# LANGUAGE GADTs #-}
 {-# LANGUAGE ScopedTypeVariables #-}
diff --git a/src/Copilot/Language/Error.hs b/src/Copilot/Language/Error.hs
--- a/src/Copilot/Language/Error.hs
+++ b/src/Copilot/Language/Error.hs
@@ -4,13 +4,13 @@
 
 {-# LANGUAGE Safe #-}
 
-module Copilot.Language.Error 
+module Copilot.Language.Error
   ( impossible
   , badUsage ) where
 
 impossible :: String -> String -> a
-impossible function package = 
-  error $ "Impossible error in function " ++ function ++ ", in package " ++ 
+impossible function package =
+  error $ "Impossible error in function " ++ function ++ ", in package " ++
     package ++ ".  Please email Lee Pike at <lee pike @ gmail . com> " ++
     "(remove spaces) or file a bug report on github.com."
 
diff --git a/src/Copilot/Language/Interpret.hs b/src/Copilot/Language/Interpret.hs
--- a/src/Copilot/Language/Interpret.hs
+++ b/src/Copilot/Language/Interpret.hs
@@ -2,13 +2,13 @@
 
 -- | The interpreter.
 
-{-# LANGUAGE Trustworthy #-} -- Copilot Core uses Data.Map in Containers.
+{-# LANGUAGE Safe #-}
 {-# LANGUAGE GADTs, FlexibleInstances #-}
 
 module Copilot.Language.Interpret
   ( --Input
     csv
-  , interpret 
+  , interpret
 --  , var
 --  , array
 --  , func
@@ -52,7 +52,7 @@
 
 --------------------------------------------------------------------------------
 
--- | Much slower, but pretty-printed interpreter output.  
+-- | Much slower, but pretty-printed interpreter output.
 interpret :: Integer -> Spec -> IO ()
 interpret = interpret' I.Table
 
@@ -72,23 +72,23 @@
   -- -- We do the two folds below over the data type separately, since one
   -- -- component is monadic.
   -- funcExts :: IO [(Name, C.Spec)]
-  -- funcExts = 
+  -- funcExts =
   --   let (names, specs) = unzip $ foldl' envf [] inputs in
   --   do ss <- sequence specs
   --      return $ zip names ss
   --   where
   --   envf :: [(Name, IO C.Spec)] -> Input -> [(Name, IO C.Spec)]
-  --   envf acc (Func name strm) = 
+  --   envf acc (Func name strm) =
   --     (name, reify $ observer name strm) : acc
   --   envf acc _ = acc
 
   -- varArrExts :: ExtEnv
   -- varArrExts = foldl' env (ExtEnv [] []) inputs
-  --   where 
+  --   where
   --   env :: ExtEnv -> Input -> ExtEnv
-  --   env acc (Var name xs) = 
-  --     acc { varEnv = (name, toDynF typeOf xs) : varEnv acc } 
-  --   env acc (Arr name xs) = 
+  --   env acc (Var name xs) =
+  --     acc { varEnv = (name, toDynF typeOf xs) : varEnv acc }
+  --   env acc (Arr name xs) =
   --     acc { arrEnv = (name, map (toDynF typeOf) xs) : arrEnv acc }
 --    env acc _ = acc
 
diff --git a/src/Copilot/Language/Operators/BitWise.hs b/src/Copilot/Language/Operators/BitWise.hs
--- a/src/Copilot/Language/Operators/BitWise.hs
+++ b/src/Copilot/Language/Operators/BitWise.hs
@@ -4,7 +4,8 @@
 
 -- | Bitwise operators.
 
-{-# LANGUAGE Trustworthy #-}
+{-# LANGUAGE Safe #-}
+
 {-# OPTIONS_GHC -fno-warn-orphans #-}
 
 module Copilot.Language.Operators.BitWise
@@ -29,7 +30,11 @@
   shiftR       = P.error "shiftR undefined, for right-shifting use .>>."
   rotate       = P.error "tbd: rotate"
   bitSize      = P.error "tbd: bitSize"
+  bitSizeMaybe = P.error "tbd: bitSizeMaybe"
   isSigned     = P.error "tbd: issigned"
+  testBit      = P.error "tbd: testBit"
+  bit          = P.error "tbd: bit"
+  popCount     = P.error "tbd: popCount"
 
 -- Avoid redefinition of the Operators.Boolean xor
 (.^.) :: Bits a => a -> a -> a
diff --git a/src/Copilot/Language/Operators/Boolean.hs b/src/Copilot/Language/Operators/Boolean.hs
--- a/src/Copilot/Language/Operators/Boolean.hs
+++ b/src/Copilot/Language/Operators/Boolean.hs
@@ -4,7 +4,7 @@
 
 -- | Boolean operators.
 
-{-# LANGUAGE Trustworthy #-}
+{-# LANGUAGE Safe #-}
 
 module Copilot.Language.Operators.Boolean
   ( (&&)
diff --git a/src/Copilot/Language/Operators/Cast.hs b/src/Copilot/Language/Operators/Cast.hs
--- a/src/Copilot/Language/Operators/Cast.hs
+++ b/src/Copilot/Language/Operators/Cast.hs
@@ -4,7 +4,7 @@
 
 -- | Type-safe casting operators.
 
-{-# LANGUAGE Trustworthy #-}
+{-# LANGUAGE Safe #-}
 {-# LANGUAGE MultiParamTypeClasses #-}
 
 module Copilot.Language.Operators.Cast
diff --git a/src/Copilot/Language/Operators/Constant.hs b/src/Copilot/Language/Operators/Constant.hs
--- a/src/Copilot/Language/Operators/Constant.hs
+++ b/src/Copilot/Language/Operators/Constant.hs
@@ -4,7 +4,7 @@
 
 -- | Constants.
 
-{-# LANGUAGE Trustworthy #-}
+{-# LANGUAGE Safe #-}
 
 module Copilot.Language.Operators.Constant
   ( constant
@@ -37,7 +37,7 @@
 constB   :: Bool -> Stream Bool
 constB   = constant
 constW8  :: Word8 -> Stream Word8
-constW8  = constant 
+constW8  = constant
 constW16 :: Word16 -> Stream Word16
 constW16 = constant
 constW32 :: Word32 -> Stream Word32
diff --git a/src/Copilot/Language/Operators/Eq.hs b/src/Copilot/Language/Operators/Eq.hs
--- a/src/Copilot/Language/Operators/Eq.hs
+++ b/src/Copilot/Language/Operators/Eq.hs
@@ -4,7 +4,7 @@
 
 -- | Equality operator.
 
-{-# LANGUAGE Trustworthy #-}
+{-# LANGUAGE Safe #-}
 
 module Copilot.Language.Operators.Eq
   ( (==)
diff --git a/src/Copilot/Language/Operators/Extern.hs b/src/Copilot/Language/Operators/Extern.hs
--- a/src/Copilot/Language/Operators/Extern.hs
+++ b/src/Copilot/Language/Operators/Extern.hs
@@ -4,7 +4,7 @@
 
 -- | External variables, arrays, and functions.
 
-{-# LANGUAGE Trustworthy #-}
+{-# LANGUAGE Safe #-}
 
 module Copilot.Language.Operators.Extern
   ( extern
diff --git a/src/Copilot/Language/Operators/Integral.hs b/src/Copilot/Language/Operators/Integral.hs
--- a/src/Copilot/Language/Operators/Integral.hs
+++ b/src/Copilot/Language/Operators/Integral.hs
@@ -4,7 +4,7 @@
 
 -- | Integral class operators.
 
-{-# LANGUAGE Trustworthy #-}
+{-# LANGUAGE Safe #-}
 
 module Copilot.Language.Operators.Integral
   ( div
@@ -35,7 +35,7 @@
 (Const x) `mod` (Const y) = Const (x `P.mod` y)
 x `mod` y = Op2 (Core.Mod typeOf) x y
 
-(^) :: (Typed a, Typed b, P.Num a, B.Bits a, P.Integral b) 
+(^) :: (Typed a, Typed b, P.Num a, B.Bits a, P.Integral b)
     => Stream a -> Stream b -> Stream a
 (Const 0) ^ (Const 0)  = Const 1
 (Const 0) ^ x          = Op3 (Core.Mux typeOf) (Op2 (Core.Eq typeOf) x 0) (1) (0)
diff --git a/src/Copilot/Language/Operators/Label.hs b/src/Copilot/Language/Operators/Label.hs
--- a/src/Copilot/Language/Operators/Label.hs
+++ b/src/Copilot/Language/Operators/Label.hs
@@ -4,7 +4,7 @@
 
 -- | Let expressions.
 
-{-# LANGUAGE Trustworthy #-}
+{-# LANGUAGE Safe #-}
 
 module Copilot.Language.Operators.Label
   ( label
diff --git a/src/Copilot/Language/Operators/Local.hs b/src/Copilot/Language/Operators/Local.hs
--- a/src/Copilot/Language/Operators/Local.hs
+++ b/src/Copilot/Language/Operators/Local.hs
@@ -4,7 +4,7 @@
 
 -- | Let expressions.
 
-{-# LANGUAGE Trustworthy #-}
+{-# LANGUAGE Safe #-}
 
 module Copilot.Language.Operators.Local
   ( local
diff --git a/src/Copilot/Language/Operators/Mux.hs b/src/Copilot/Language/Operators/Mux.hs
--- a/src/Copilot/Language/Operators/Mux.hs
+++ b/src/Copilot/Language/Operators/Mux.hs
@@ -4,7 +4,7 @@
 
 -- | if-then-else.
 
-{-# LANGUAGE Trustworthy #-}
+{-# LANGUAGE Safe #-}
 
 module Copilot.Language.Operators.Mux
   ( mux
diff --git a/src/Copilot/Language/Operators/Ord.hs b/src/Copilot/Language/Operators/Ord.hs
--- a/src/Copilot/Language/Operators/Ord.hs
+++ b/src/Copilot/Language/Operators/Ord.hs
@@ -4,7 +4,7 @@
 
 -- | Comparison operators.
 
-{-# LANGUAGE Trustworthy #-}
+{-# LANGUAGE Safe #-}
 
 module Copilot.Language.Operators.Ord
   ( (<=)
diff --git a/src/Copilot/Language/Operators/Propositional.hs b/src/Copilot/Language/Operators/Propositional.hs
--- a/src/Copilot/Language/Operators/Propositional.hs
+++ b/src/Copilot/Language/Operators/Propositional.hs
@@ -2,7 +2,7 @@
 -- Copyright © 2011 National Institute of Aerospace / Galois, Inc.
 --------------------------------------------------------------------------------
 
-{-# LANGUAGE Trustworthy, FlexibleInstances, GADTs, MultiParamTypeClasses #-}
+{-# LANGUAGE Safe, FlexibleInstances, GADTs, MultiParamTypeClasses #-}
 
 module Copilot.Language.Operators.Propositional (not) where
 
diff --git a/src/Copilot/Language/Operators/Temporal.hs b/src/Copilot/Language/Operators/Temporal.hs
--- a/src/Copilot/Language/Operators/Temporal.hs
+++ b/src/Copilot/Language/Operators/Temporal.hs
@@ -4,7 +4,7 @@
 
 -- | Stream construction.
 
-{-# LANGUAGE Trustworthy #-}
+{-# LANGUAGE Safe #-}
 
 module Copilot.Language.Operators.Temporal
   ( (++)
diff --git a/src/Copilot/Language/Prelude.hs b/src/Copilot/Language/Prelude.hs
--- a/src/Copilot/Language/Prelude.hs
+++ b/src/Copilot/Language/Prelude.hs
@@ -22,14 +22,14 @@
   , const
   , drop
   , not
-  , mod 
+  , mod
   , until
   , sum
   , max
   , min
   , (!!)
   , cycle
-  , take 
+  , take
   )
 
 --------------------------------------------------------------------------------
diff --git a/src/Copilot/Language/Reify.hs b/src/Copilot/Language/Reify.hs
--- a/src/Copilot/Language/Reify.hs
+++ b/src/Copilot/Language/Reify.hs
@@ -5,7 +5,7 @@
 -- | Transforms a Copilot Language specification into a Copilot Core
 -- specification.
 
-{-# LANGUAGE Trustworthy #-}
+{-# LANGUAGE Safe #-}
 {-# LANGUAGE ExistentialQuantification, Rank2Types #-}
 
 module Copilot.Language.Reify
diff --git a/src/Copilot/Language/Spec.hs b/src/Copilot/Language/Spec.hs
--- a/src/Copilot/Language/Spec.hs
+++ b/src/Copilot/Language/Spec.hs
@@ -4,7 +4,7 @@
 
 -- | Copilot specifications.
 
-{-# LANGUAGE Trustworthy #-}
+{-# LANGUAGE Safe #-}
 {-# LANGUAGE GADTs #-}
 {-# LANGUAGE KindSignatures #-}
 {-# LANGUAGE RankNTypes #-}
diff --git a/src/Copilot/Language/Stream.hs b/src/Copilot/Language/Stream.hs
--- a/src/Copilot/Language/Stream.hs
+++ b/src/Copilot/Language/Stream.hs
@@ -4,14 +4,14 @@
 
 -- | Abstract syntax for streams and operators.
 
-{-# LANGUAGE Trustworthy #-}
+{-# LANGUAGE Safe #-}
 {-# LANGUAGE GADTs #-}
 {-# LANGUAGE KindSignatures #-}
 {-# LANGUAGE Rank2Types #-}
 
 module Copilot.Language.Stream
-  ( Stream (..) 
-  , Arg (..) 
+  ( Stream (..)
+  , Arg (..)
   , StructArg (..)
   ) where
 
@@ -24,14 +24,14 @@
 --------------------------------------------------------------------------------
 
 data Stream :: * -> * where
-  Append      :: Typed a 
+  Append      :: Typed a
               => [a] -> Maybe (Stream Bool) -> Stream a -> Stream a
   Const       :: Typed a => a -> Stream a
   Drop        :: Typed a
               => Int -> Stream a -> Stream a
   Extern      :: Typed a
               => String -> Maybe [a] -> Stream a
-  ExternFun   :: Typed a 
+  ExternFun   :: Typed a
               => String -> [Arg] -> Maybe (Stream a) -> Stream a
   ExternArray :: (Typed a, Typed b, Integral a)
               => String -> Stream a -> Int -> Maybe [[b]] -> Stream b
@@ -39,9 +39,9 @@
               => String -> [(String, Arg)] -> Stream a
   GetField    :: (Typed a, Typed b)
               => Stream a -> String -> Stream b
-  Local       :: (Typed a, Typed b) 
+  Local       :: (Typed a, Typed b)
               => Stream a -> (Stream a -> Stream b) -> Stream b
-  Var         :: Typed a 
+  Var         :: Typed a
               => String -> Stream a
   Op1         :: (Typed a, Typed b)
               => Core.Op1 a b -> Stream a -> Stream b
@@ -103,7 +103,7 @@
 -- XXX we may not want to precompute these if they're constants if someone is
 -- relying on certain floating-point behavior.
 instance (Typed a, P.Eq a, Fractional a) => Fractional (Stream a) where
-  (/)                     = Op2 (Core.Fdiv typeOf) 
+  (/)                     = Op2 (Core.Fdiv typeOf)
 
   recip (Const x)         = Const (recip x)
   recip x                 = Op1 (Core.Recip typeOf) x
diff --git a/src/System/Mem/StableName/Map.hs b/src/System/Mem/StableName/Map.hs
--- a/src/System/Mem/StableName/Map.hs
+++ b/src/System/Mem/StableName/Map.hs
@@ -27,8 +27,8 @@
 
 import Copilot.Core.Error (impossible)
 
-data Map a = Map { getMap  :: IntMap [(DynStableName, a)] 
-                 , getSize :: Int } 
+data Map a = Map { getMap  :: IntMap [(DynStableName, a)]
+                 , getSize :: Int }
 
 empty :: Map a
 empty = Map IntMap.empty 0
@@ -37,7 +37,7 @@
 null (Map m _) = IntMap.null m
 
 singleton :: DynStableName -> a -> Map a
-singleton k v = 
+singleton k v =
   Map (IntMap.singleton (hashDynStableName k) [(k,v)]) 1
 
 member :: DynStableName -> Map a -> Bool
@@ -46,7 +46,7 @@
     Just _ -> True
 
 notMember :: DynStableName -> Map a -> Bool
-notMember k m = not $ member k m 
+notMember k m = not $ member k m
 
 insert :: DynStableName -> a -> Map a -> Map a
 insert k v Map { getMap  = mp
@@ -61,11 +61,11 @@
 -- @(key, f new_value old_value)@
 insertWith :: (a -> a -> a) -> DynStableName -> a -> Map a -> Map a
 insertWith f k v Map { getMap  = mp
-                     , getSize = sz } 
+                     , getSize = sz }
   = Map (IntMap.insertWith go (hashDynStableName k) [(k,v)] mp)
         (sz + 1)
-    where 
-        go _ ((k',v'):kvs) 
+    where
+        go _ ((k',v'):kvs)
             | k == k' = (k', f v v') : kvs
             | otherwise = (k',v') : go undefined kvs
         go _ [] = []
@@ -73,17 +73,17 @@
 -- | Same as 'insertWith', but with the combining function applied strictly.
 insertWith' :: (a -> a -> a) -> DynStableName -> a -> Map a -> Map a
 insertWith' f k v Map { getMap  = mp
-                      , getSize = sz } 
+                      , getSize = sz }
   = Map (IntMap.insertWith go (hashDynStableName k) [(k,v)] mp)
         (sz + 1)
-    where 
-        go _ ((k',v'):kvs) 
+    where
+        go _ ((k',v'):kvs)
             | k == k' = let v'' = f v v' in v'' `seq` (k', v'') : kvs
             | otherwise = (k', v') : go undefined kvs
         go _ [] = []
 
 -- | /O(log n)/. Lookup the value at a key in the map.
--- 
+--
 -- The function will return the corresponding value as a @('Just' value)@
 -- or 'Nothing' if the key isn't in the map.
 lookup :: DynStableName -> Map v -> Maybe v
@@ -94,10 +94,10 @@
 find :: DynStableName -> Map v -> v
 find k m = case lookup k m of
     Nothing -> impossible "find" "copilot-language"
-    Just x -> x 
+    Just x -> x
 
 -- | /O(log n)/. The expression @('findWithDefault' def k map)@ returns
 -- the value at key @k@ or returns the default value @def@
 -- when the key is not in the map.
 findWithDefault :: v -> DynStableName -> Map v -> v
-findWithDefault dflt k m = maybe dflt id $ lookup k m 
+findWithDefault dflt k m = maybe dflt id $ lookup k m