dsh-logicprobe 0.5.6 → 0.6.0

package/lib/engine.js

@@ -45,6 +45,20 @@ export function validateModel(input) {
                 seen.add(state.id);
             if (state.terminal !== undefined && typeof state.terminal !== 'boolean')
                 bad('states[' + index + '].terminal', 'must be a boolean');
+            for (const kind of ['onEntry', 'onExit']) {
+                const actions = state[kind];
+                if (actions !== undefined) {
+                    if (!Array.isArray(actions))
+                        bad('states[' + index + '].' + kind, 'must be an array of action names');
+                    else if (actions.length > 64)
+                        bad('states[' + index + '].' + kind, 'must not exceed 64 actions');
+                    else
+                        actions.forEach((action, actionIndex) => {
+                            if (typeof action !== 'string' || action.length === 0)
+                                bad('states[' + index + '].' + kind + '[' + actionIndex + ']', 'must be a non-empty string');
+                        });
+                }
+            }
         });
         if (typeof root.init === 'string' && root.init.length > 0 && !seen.has(root.init))
             bad('init', 'must name a declared state');
@@ -92,6 +106,21 @@ export function validateModel(input) {
                             bad(updatePath + '.value', 'must be a number');
                     });
             }
+            if (transition.cost !== undefined) {
+                if (typeof transition.cost !== 'number' || !Number.isFinite(transition.cost) || transition.cost < 0)
+                    bad(path + '.cost', 'must be a non-negative finite number');
+            }
+            if (transition.weight !== undefined) {
+                if (typeof transition.weight !== 'number' || !Number.isFinite(transition.weight) || transition.weight < 0)
+                    bad(path + '.weight', 'must be a non-negative finite number');
+            }
+        });
+    }
+    if (Array.isArray(root.states)) {
+        root.states.forEach((state, index) => {
+            if (state.maxTicks !== undefined && (!Number.isInteger(state.maxTicks) || state.maxTicks < 0)) {
+                bad('states[' + index + '].maxTicks', 'must be a non-negative integer');
+            }
         });
     }
     const variableNames = new Set();
@@ -204,6 +233,18 @@ export function validateModel(input) {
                     if (invariant.rollback !== undefined && typeof invariant.rollback !== 'string')
                         bad(path + '.rollback', 'must be a string');
                 }
+                else if (invariant.kind === 'budget') {
+                    if (typeof invariant.budget !== 'number' || !Number.isFinite(invariant.budget) || invariant.budget < 0)
+                        bad(path + '.budget', 'must be a non-negative finite number');
+                }
+                else if (invariant.kind === 'probability') {
+                    if (typeof invariant.target !== 'string' || invariant.target.length === 0)
+                        bad(path + '.target', 'must be a non-empty string');
+                    if (invariant.op !== '>=' && invariant.op !== '<=' && invariant.op !== '>' && invariant.op !== '<')
+                        bad(path + '.op', "must be one of '>=', '<=', '>', '<'");
+                    if (typeof invariant.p !== 'number' || !Number.isFinite(invariant.p) || invariant.p < 0 || invariant.p > 1)
+                        bad(path + '.p', 'must be a number in [0, 1]');
+                }
                 else {
                     bad(path + '.kind', 'unknown invariant kind');
                 }
@@ -245,6 +286,15 @@ export function validateModel(input) {
                     bad('idempotentEvents[' + index + ']', 'must be a non-empty string');
             });
     }
+    if (root.tickEvents !== undefined) {
+        if (!Array.isArray(root.tickEvents))
+            bad('tickEvents', 'must be an array');
+        else
+            root.tickEvents.forEach((entry, index) => {
+                if (typeof entry !== 'string' || entry.length === 0)
+                    bad('tickEvents[' + index + ']', 'must be a non-empty string');
+            });
+    }
     if (root.resourcePairs !== undefined) {
         if (!Array.isArray(root.resourcePairs))
             bad('resourcePairs', 'must be an array');
@@ -985,15 +1035,57 @@ function A3_orderPermutation(model, options) {
     }
     return checkResult('A3', 'Order Permutation', [], 'Order-independent (sampled first ' + events.length + ' events)');
 }
+function stateActionList(model, stateId, kind) {
+    const state = model.states.find((entry) => entry.id === stateId);
+    const list = state === undefined ? undefined : state[kind];
+    return list ?? [];
+}
+function actionsDeclared(model) {
+    return model.states.some((state) => (state.onEntry ?? []).length > 0 || (state.onExit ?? []).length > 0);
+}
+/** Apply an ordered action list to the held flag. Actions never change state or variables; they only matter to pairing checks. */
+function applyActionList(list, acquireEvent, releaseEvent, held) {
+    let next = held;
+    let reacquired = false;
+    for (const action of list) {
+        if (action === acquireEvent) {
+            if (next)
+                reacquired = true;
+            next = true;
+        }
+        else if (action === releaseEvent) {
+            next = false;
+        }
+    }
+    return { held: next, reacquired };
+}
 function A4_pairSymmetry(model) {
     const findings = [];
+    const hasActions = actionsDeclared(model);
     const transitionEvents = new Set(model.transitions.map((transition) => transition.event));
+    const actionEvents = new Set();
+    if (hasActions) {
+        for (const state of model.states) {
+            for (const action of stateActionList(model, state.id, 'onEntry'))
+                actionEvents.add(action);
+            for (const action of stateActionList(model, state.id, 'onExit'))
+                actionEvents.add(action);
+        }
+    }
+    const pairHasEvent = (event) => transitionEvents.has(event) || actionEvents.has(event);
+    const releaseReachableFrom = (stateId, releaseEvent) => {
+        const reachable = stateGraphReachable(model, stateId);
+        return [...reachable].some((state) => model.transitions.some((transition) => transition.from === state && transition.event === releaseEvent)
+            || (hasActions && (stateActionList(model, state, 'onEntry').includes(releaseEvent) || stateActionList(model, state, 'onExit').includes(releaseEvent))));
+    };
+    const edges = stateGraphEdges(model);
     for (const pair of model.resourcePairs ?? []) {
         const acquireTransitions = model.transitions.filter((transition) => transition.event === pair.acquireEvent);
-        const releaseExists = transitionEvents.has(pair.releaseEvent);
-        if (acquireTransitions.length === 0 && !releaseExists)
+        const actionAcquire = hasActions && model.states.some((state) => stateActionList(model, state.id, 'onEntry').includes(pair.acquireEvent) || stateActionList(model, state.id, 'onExit').includes(pair.acquireEvent));
+        const releaseExists = pairHasEvent(pair.releaseEvent);
+        if (acquireTransitions.length === 0 && !actionAcquire && !releaseExists)
             continue;
-        if (acquireTransitions.length > 0 && !releaseExists) {
+        if ((acquireTransitions.length > 0 || actionAcquire) && !releaseExists) {
             findings.push({
                 code: 'A4_NO_RELEASE_EVENT',
                 severity: 'error',
@@ -1001,23 +1093,57 @@ function A4_pairSymmetry(model) {
             });
             continue;
         }
+        // Collect acquire sites: transitions whose event acquires, and state entry/exit actions that end holding the resource.
+        const seeds = [];
         for (const acquire of acquireTransitions) {
-            // Is any release event reachable in the state graph from the acquired state?
-            const reachable = stateGraphReachable(model, acquire.to);
-            const releaseReachable = [...reachable].some((state) => model.transitions.some((transition) => transition.from === state && transition.event === pair.releaseEvent));
-            if (!releaseReachable) {
+            if (!releaseReachableFrom(acquire.to, pair.releaseEvent)) {
                 findings.push({
                     code: 'A4_NO_RELEASE_REACHABLE',
                     severity: 'error',
-                    message: 'Resource "' + pair.resource + '": after ' + pair.acquireEvent + ' into ' + acquire.to + ', no ' + pair.releaseEvent + ' transition is reachable.',
+                    message: 'Resource "' + pair.resource + '": after ' + pair.acquireEvent + ' into ' + acquire.to + ', no ' + pair.releaseEvent + ' is reachable.',
                     evidence: { acquireTransition: acquire },
                 });
                 continue;
             }
-            // Path-sensitive probe: track the held flag along state-graph paths.
-            const edges = stateGraphEdges(model);
+            seeds.push({ state: acquire.to, held: true, path: [] });
+        }
+        if (hasActions) {
+            for (const state of model.states) {
+                // acquire fired by onEntry: resource is held for the whole stay in the state
+                const entry = stateActionList(model, state.id, 'onEntry');
+                if (entry.includes(pair.acquireEvent)) {
+                    const sim = applyActionList(entry, pair.acquireEvent, pair.releaseEvent, false);
+                    if (sim.reacquired) {
+                        findings.push({
+                            code: 'A4_REACQUIRE_WITHOUT_RELEASE',
+                            severity: 'warning',
+                            message: 'Resource "' + pair.resource + '" is acquired more than once inside onEntry of ' + state.id + ' before ' + pair.releaseEvent + '.',
+                        });
+                    }
+                    if (sim.held)
+                        seeds.push({ state: state.id, held: true, path: [] });
+                }
+                // acquire fired by onExit: happens on every outgoing edge, never on a terminal state
+                const exit = stateActionList(model, state.id, 'onExit');
+                if (exit.includes(pair.acquireEvent) && !state.terminal) {
+                    const sim = applyActionList(exit, pair.acquireEvent, pair.releaseEvent, false);
+                    if (sim.reacquired) {
+                        findings.push({
+                            code: 'A4_REACQUIRE_WITHOUT_RELEASE',
+                            severity: 'warning',
+                            message: 'Resource "' + pair.resource + '" is acquired more than once inside onExit of ' + state.id + ' before ' + pair.releaseEvent + '.',
+                        });
+                    }
+                    if (sim.held)
+                        seeds.push({ state: state.id, held: false, path: [] });
+                }
+            }
+        }
+        // Path-sensitive probe: track the held flag along state-graph paths, firing
+        // onExit of the source state before each transition and onEntry of the target after it.
+        for (const seed of seeds) {
             const visited = new Set();
-            const queue = [{ state: acquire.to, held: true, path: [] }];
+            const queue = [seed];
             let steps = 0;
             while (queue.length > 0) {
                 const entry = queue.shift();
@@ -1038,6 +1164,19 @@ function A4_pairSymmetry(model) {
                 }
                 for (const transition of edges.get(entry.state) ?? []) {
                     let held = entry.held;
+                    if (hasActions) {
+                        const sim = applyActionList(stateActionList(model, entry.state, 'onExit'), pair.acquireEvent, pair.releaseEvent, held);
+                        if (sim.reacquired) {
+                            findings.push({
+                                code: 'A4_REACQUIRE_WITHOUT_RELEASE',
+                                severity: 'warning',
+                                message: 'Resource "' + pair.resource + '" is acquired again in onExit of ' + entry.state + ' before ' + pair.releaseEvent + '.',
+                                path: entry.path,
+                            });
+                            continue;
+                        }
+                        held = sim.held;
+                    }
                     if (transition.event === pair.releaseEvent)
                         held = false;
                     else if (transition.event === pair.acquireEvent) {
@@ -1052,6 +1191,19 @@ function A4_pairSymmetry(model) {
                         }
                         held = true;
                     }
+                    if (hasActions) {
+                        const sim = applyActionList(stateActionList(model, transition.to, 'onEntry'), pair.acquireEvent, pair.releaseEvent, held);
+                        if (sim.reacquired) {
+                            findings.push({
+                                code: 'A4_REACQUIRE_WITHOUT_RELEASE',
+                                severity: 'warning',
+                                message: 'Resource "' + pair.resource + '" is acquired again inside onEntry of ' + transition.to + ' before ' + pair.releaseEvent + '.',
+                                path: [...entry.path, { from: entry.state, event: transition.event, to: transition.to }],
+                            });
+                            continue;
+                        }
+                        held = sim.held;
+                    }
                     queue.push({ state: transition.to, held, path: [...entry.path, { from: entry.state, event: transition.event, to: transition.to }] });
                 }
             }
@@ -1599,6 +1751,442 @@ function A11_atomicity(model, options) {
     return checkResult('A11', 'Atomicity', findings, findings.length === 0 ? 'All atomicity invariants hold' : 'Atomicity findings: ' + findings.length);
 }
 // ---------------------------------------------------------------------------
+// A12 — Budget (worst-case path cost)
+// ---------------------------------------------------------------------------
+function transitionCost(transition) {
+    return transition.cost ?? 1;
+}
+function runtimeGraph(model, options) {
+    const groupMap = groupTransitions(model);
+    const exploration = explore(model, options);
+    const edges = new Map();
+    for (const runtime of exploration.reachable) {
+        const out = [];
+        for (const event of allEvents(model)) {
+            const group = groupMap.get(runtime.state + '|' + event);
+            if (group === undefined || group.length === 0)
+                continue;
+            for (const transition of applicableTransitions(group, runtime)) {
+                const next = applyUpdates(model, transition, runtime);
+                out.push({
+                    to: runtimeKey(next),
+                    step: { from: runtime.state, event: transition.event, to: next.state },
+                    cost: transitionCost(transition),
+                });
+            }
+        }
+        edges.set(runtimeKey(runtime), out);
+    }
+    return {
+        edges,
+        keys: exploration.reachable.map((runtime) => runtimeKey(runtime)),
+        initKey: runtimeKey(exploration.initialState),
+    };
+}
+/** Shortest path from init to targetKey over the runtime graph, or undefined when unreachable. */
+function runtimePathToKey(graph, targetKey) {
+    const parent = new Map();
+    const visited = new Set([graph.initKey]);
+    const queue = [graph.initKey];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (current === targetKey) {
+            const steps = [];
+            let key = targetKey;
+            while (key !== graph.initKey) {
+                const step = parent.get(key);
+                if (step === undefined)
+                    break;
+                steps.unshift(step);
+                key = step.from === undefined ? graph.initKey : keyOfFromStep(graph, step, key);
+            }
+            return steps;
+        }
+        for (const edge of graph.edges.get(current) ?? []) {
+            if (visited.has(edge.to))
+                continue;
+            visited.add(edge.to);
+            parent.set(edge.to, edge.step);
+            queue.push(edge.to);
+        }
+    }
+    return undefined;
+}
+function keyOfFromStep(graph, step, targetKey) {
+    // Reconstruct the source key by scanning predecessors of targetKey whose step matches.
+    for (const [from, edges] of graph.edges) {
+        for (const edge of edges) {
+            if (edge.to === targetKey && edge.step.event === step.event && edge.step.from === step.from && edge.step.to === step.to) {
+                return from;
+            }
+        }
+    }
+    return graph.initKey;
+}
+/** Find a reachable cycle whose total cost is positive; return a witness path init -> one full round. */
+function findUnboundedCycle(model, options) {
+    const graph = runtimeGraph(model, options);
+    const color = new Map();
+    for (const start of graph.keys) {
+        if (color.has(start))
+            continue;
+        const nodeStack = [start];
+        const idxStack = [0];
+        const depthOf = new Map([[start, 0]]);
+        const costAt = new Map([[start, 0]]);
+        const prevKey = new Map();
+        const prevStep = new Map();
+        color.set(start, 1);
+        while (nodeStack.length > 0) {
+            const node = nodeStack[nodeStack.length - 1];
+            const outs = graph.edges.get(node) ?? [];
+            if (idxStack[idxStack.length - 1] < outs.length) {
+                const edge = outs[idxStack[idxStack.length - 1]++];
+                const seen = color.get(edge.to);
+                if (seen === undefined) {
+                    color.set(edge.to, 1);
+                    depthOf.set(edge.to, depthOf.get(node) + 1);
+                    costAt.set(edge.to, costAt.get(node) + edge.cost);
+                    prevKey.set(edge.to, node);
+                    prevStep.set(edge.to, edge.step);
+                    nodeStack.push(edge.to);
+                    idxStack.push(0);
+                }
+                else if (seen === 1) {
+                    // Back edge on the current path: this is a true cycle.
+                    const cycleCost = costAt.get(node) + edge.cost - costAt.get(edge.to);
+                    if (cycleCost > 0) {
+                        const entry = runtimePathToKey(graph, edge.to) ?? [];
+                        const round = [];
+                        let cursor = node;
+                        while (cursor !== edge.to && prevStep.has(cursor)) {
+                            round.unshift(prevStep.get(cursor));
+                            cursor = prevKey.get(cursor);
+                        }
+                        round.push(edge.step);
+                        return [...entry, ...round];
+                    }
+                }
+            }
+            else {
+                color.set(node, 2);
+                nodeStack.pop();
+                idxStack.pop();
+                depthOf.delete(node);
+                costAt.delete(node);
+                prevKey.delete(node);
+                prevStep.delete(node);
+            }
+        }
+    }
+    return undefined;
+}
+function findBudgetViolation(model, options, invariant) {
+    const groupMap = groupTransitions(model);
+    const init = initialState(model);
+    const bestCost = new Map([[runtimeKey(init), 0]]);
+    const queue = [{ runtime: init, cost: 0, path: [] }];
+    let steps = 0;
+    while (queue.length > 0) {
+        const entry = queue.shift();
+        if (++steps > options.maxStates)
+            break;
+        for (const event of allEvents(model)) {
+            const group = groupMap.get(entry.runtime.state + '|' + event);
+            if (group === undefined || group.length === 0)
+                continue;
+            for (const transition of applicableTransitions(group, entry.runtime)) {
+                const next = applyUpdates(model, transition, entry.runtime);
+                const cost = entry.cost + transitionCost(transition);
+                const path = [...entry.path, { from: entry.runtime.state, event: transition.event, to: next.state }];
+                // Costs are non-negative, so the first step that pushes the accumulated cost
+                // over the budget is already a witness.
+                if (cost > invariant.budget)
+                    return { path, cost, unbounded: false };
+                const key = runtimeKey(next);
+                const best = bestCost.get(key);
+                if (best === undefined || cost < best) {
+                    bestCost.set(key, cost);
+                    queue.push({ runtime: next, cost, path });
+                }
+            }
+        }
+    }
+    // No finite path exceeds the budget within reachable space; a reachable positive-cost
+    // cycle still makes the worst-case unbounded. Plain DAG merges are not cycles.
+    const cycle = findUnboundedCycle(model, options);
+    if (cycle !== undefined)
+        return { path: cycle, unbounded: true };
+    return undefined;
+}
+function A12_budget(model, options) {
+    const budgets = (model.invariants ?? []).filter((invariant) => invariant.kind === 'budget');
+    const usesCost = model.transitions.some((transition) => transition.cost !== undefined);
+    const findings = [];
+    if (usesCost && budgets.length === 0) {
+        findings.push({
+            code: 'A12_COST_WITHOUT_BUDGET',
+            severity: 'warning',
+            message: 'Transitions declare cost, but no budget invariant is declared, so worst-case path cost is not verified. Add an invariant of kind budget to check it.',
+        });
+    }
+    for (const invariant of budgets) {
+        const violation = findBudgetViolation(model, options, invariant);
+        if (violation !== undefined) {
+            findings.push({
+                code: 'A12_BUDGET_OVER',
+                severity: 'error',
+                message: violation.unbounded
+                    ? 'Budget invariant "' + invariant.id + '" (' + invariant.description + ') exceeded: a reachable positive-cost cycle lets path cost grow without bound, so no finite budget ' + invariant.budget + ' holds.'
+                    : 'Budget invariant "' + invariant.id + '" (' + invariant.description + ') exceeded: worst-case path cost ' + violation.cost + ' is over budget ' + invariant.budget + '.',
+                path: violation.path,
+                evidence: violation.unbounded ? { invariant, unbounded: true } : { invariant, totalCost: violation.cost, unbounded: false },
+            });
+        }
+    }
+    return checkResult('A12', 'Budget', findings, findings.length === 0 ? (budgets.length === 0 ? 'No budget invariants declared' : 'All budget invariants hold') : 'Budget findings: ' + findings.length);
+}
+// ---------------------------------------------------------------------------
+// A13 — Probability reachability (DTMC)
+// ---------------------------------------------------------------------------
+function probabilityOutcomes(model, runtime) {
+    const groupMap = groupTransitions(model);
+    const outcomes = new Map();
+    for (const event of allEvents(model)) {
+        const group = groupMap.get(runtime.state + '|' + event);
+        if (group === undefined || group.length === 0)
+            continue;
+        for (const transition of applicableTransitions(group, runtime)) {
+            const weight = transition.weight ?? 1;
+            if (!(weight > 0))
+                continue;
+            const next = applyUpdates(model, transition, runtime);
+            const key = runtimeKey(next);
+            const current = outcomes.get(key);
+            if (current === undefined)
+                outcomes.set(key, { state: next.state, weight });
+            else
+                current.weight += weight;
+        }
+    }
+    return outcomes;
+}
+/**
+ * Probability of ever reaching targetState from the initial state under the DTMC
+ * interpretation: at each runtime state every applicable transition with weight > 0 is an
+ * outcome chosen proportionally to its weight. Solved by value iteration (least fixed
+ * point of the absorbing chain).
+ */
+function computeHitProbability(model, options, targetState) {
+    const exploration = explore(model, options);
+    const reachable = exploration.reachable;
+    const n = reachable.length;
+    const keyIndex = new Map();
+    reachable.forEach((runtime, i) => keyIndex.set(runtimeKey(runtime), i));
+    const fixedValue = new Array(n).fill(null);
+    const chains = [];
+    for (let i = 0; i < n; i++) {
+        const runtime = reachable[i];
+        if (runtime.state === targetState) {
+            fixedValue[i] = 1;
+            chains.push([]);
+            continue;
+        }
+        const outs = probabilityOutcomes(model, runtime);
+        let sum = 0;
+        const list = [];
+        for (const [key, entry] of outs) {
+            const j = keyIndex.get(key);
+            if (j === undefined)
+                continue;
+            list.push({ j, w: entry.weight });
+            sum += entry.weight;
+        }
+        if (sum <= 0) {
+            fixedValue[i] = 0;
+            chains.push([]);
+            continue;
+        }
+        chains.push(list.map((item) => ({ j: item.j, w: item.w / sum })));
+    }
+    const p = new Array(n).fill(0);
+    let converged = false;
+    for (let iter = 0; iter < 20000; iter++) {
+        let maxDelta = 0;
+        for (let i = 0; i < n; i++) {
+            if (fixedValue[i] !== null)
+                continue;
+            const list = chains[i];
+            let acc = 0;
+            for (const item of list) {
+                const fixed = fixedValue[item.j];
+                acc += item.w * (fixed === null ? p[item.j] : fixed);
+            }
+            const delta = Math.abs(acc - p[i]);
+            if (delta > maxDelta)
+                maxDelta = delta;
+            p[i] = acc;
+        }
+        if (maxDelta < 1e-9) {
+            converged = true;
+            break;
+        }
+    }
+    const initIndex = keyIndex.get(runtimeKey(exploration.initialState)) ?? 0;
+    const fixed = fixedValue[initIndex];
+    return { probability: fixed === null ? p[initIndex] : fixed, converged };
+}
+function A13_probability(model, options) {
+    const findings = [];
+    const eps = 1e-9;
+    for (const invariant of model.invariants ?? []) {
+        if (invariant.kind !== 'probability')
+            continue;
+        const { probability, converged } = computeHitProbability(model, options, invariant.target);
+        let violated = false;
+        if (invariant.op === '>=')
+            violated = probability < invariant.p - eps;
+        else if (invariant.op === '>')
+            violated = probability <= invariant.p + eps;
+        else if (invariant.op === '<=')
+            violated = probability > invariant.p + eps;
+        else
+            violated = probability >= invariant.p - eps;
+        if (violated) {
+            findings.push({
+                code: 'A13_PROBABILITY_VIOLATION',
+                severity: 'error',
+                message: 'Probability invariant "' + invariant.id + '" (' + invariant.description + ') violated: P(hit ' + invariant.target + ') = ' + probability.toFixed(6) + ' does not satisfy ' + invariant.op + ' ' + invariant.p + '.',
+                evidence: { invariant, computed: probability, converged },
+            });
+        }
+        else if (!converged) {
+            findings.push({
+                code: 'A13_NO_CONVERGENCE',
+                severity: 'warning',
+                message: 'Probability invariant "' + invariant.id + '" passes, but value iteration did not fully converge within the iteration cap.',
+                evidence: { invariant, computed: probability, converged },
+            });
+        }
+    }
+    return checkResult('A13', 'Probability Reachability', findings, findings.length === 0 ? 'No probability invariants declared or all hold' : 'Probability findings: ' + findings.length);
+}
+// ---------------------------------------------------------------------------
+// A14 — Deadline (discrete tick clock)
+// ---------------------------------------------------------------------------
+function A14_deadline(model, options) {
+    const findings = [];
+    const tickEvents = new Set(model.tickEvents ?? []);
+    const limits = new Map();
+    let hasLimit = false;
+    for (const state of model.states) {
+        if (state.maxTicks !== undefined) {
+            limits.set(state.id, state.maxTicks);
+            hasLimit = true;
+        }
+    }
+    if (!hasLimit) {
+        return checkResult('A14', 'Deadline', [], 'No state declares maxTicks');
+    }
+    if (tickEvents.size === 0) {
+        return checkResult('A14', 'Deadline', [{
+                code: 'A14_NO_TICK_EVENTS',
+                severity: 'warning',
+                message: 'States declare maxTicks, but no tickEvents are declared, so deadline compliance cannot be verified.',
+            }], 'Missing tick events');
+    }
+    const groupMap = groupTransitions(model);
+    const init = initialState(model);
+    const limitOf = (stateId) => limits.get(stateId);
+    const queue = [{ runtime: init, ticks: 0, path: [] }];
+    const seen = new Set();
+    let steps = 0;
+    while (queue.length > 0) {
+        const entry = queue.shift();
+        if (++steps > options.maxStates)
+            break;
+        const key = runtimeKey(entry.runtime) + '|' + entry.ticks;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        for (const event of allEvents(model)) {
+            const group = groupMap.get(entry.runtime.state + '|' + event);
+            if (group === undefined || group.length === 0)
+                continue;
+            for (const transition of applicableTransitions(group, entry.runtime)) {
+                const next = applyUpdates(model, transition, entry.runtime);
+                const isTick = tickEvents.has(event);
+                const stays = next.state === entry.runtime.state;
+                const path = [...entry.path, { from: entry.runtime.state, event: transition.event, to: next.state }];
+                let ticks;
+                if (isTick && stays) {
+                    const lim = limitOf(next.state);
+                    if (lim !== undefined && entry.ticks + 1 > lim) {
+                        findings.push({
+                            code: 'A14_DEADLINE_MISS',
+                            severity: 'error',
+                            message: 'Deadline missed: state ' + next.state + ' can remain resident for more than ' + lim + ' tick(s).',
+                            path,
+                            evidence: { state: next.state, maxTicks: lim, ticks: entry.ticks + 1 },
+                        });
+                        continue;
+                    }
+                    ticks = entry.ticks + 1;
+                }
+                else if (isTick && !stays) {
+                    ticks = 0;
+                }
+                else if (!isTick && stays) {
+                    ticks = entry.ticks;
+                }
+                else {
+                    ticks = 0;
+                }
+                const nextKey = runtimeKey(next) + '|' + ticks;
+                if (!seen.has(nextKey))
+                    queue.push({ runtime: next, ticks, path });
+            }
+        }
+    }
+    return checkResult('A14', 'Deadline', findings, findings.length === 0 ? 'All deadlines respected' : 'Deadline findings: ' + findings.length);
+}
+// ---------------------------------------------------------------------------
+// Coverage notes (informational gap notices)
+// ---------------------------------------------------------------------------
+// Underscore-separated identifiers like watchdog_timeout or isr_cmd are common in
+// state machines, so boundaries must treat '_' as a separator rather than a word char.
+const TIMING_VOCABULARY = /(?<![a-z0-9])(timeout|watchdog|timer|tick|deadline|period|delay|elapsed|latency)(?![a-z0-9])/i;
+const PREEMPTION_VOCABULARY = /(?<![a-z0-9])(isr|irq|interrupt|task|thread|preempt|rtos)(?![a-z0-9])/i;
+const HYBRID_VOCABULARY = /(?<![a-z0-9])(pid|plant|feedback|control.?loop|stability|stable|settling|damping|oscillat|chatter|kalman|foc|field.?weaken|motor|torque)(?![a-z0-9])/i;
+const PROBABILISTIC_VOCABULARY = /(?<![a-z0-9])(mtbf|mttf|failure.?rate|reliability|probability|probabilistic|markov|stochastic|fault.?tree|fmea)(?![a-z0-9])/i;
+function computeCoverageNotes(model) {
+    const names = [];
+    for (const state of model.states) {
+        names.push(state.id);
+        for (const action of state.onEntry ?? [])
+            names.push(action);
+        for (const action of state.onExit ?? [])
+            names.push(action);
+    }
+    for (const transition of model.transitions)
+        names.push(transition.event);
+    const corpus = names.join(' ');
+    const notes = [];
+    if (TIMING_VOCABULARY.test(corpus)) {
+        notes.push('The model references time-like vocabulary (timeout/watchdog/timer/deadline...). logicprobe verifies ordering, counts, and path budgets (A12) but not hard real-time semantics: deadlines, periods, and clock invariants need a timed model checker (e.g. UPPAAL).');
+    }
+    if (PREEMPTION_VOCABULARY.test(corpus)) {
+        notes.push('The model references preemption/concurrency vocabulary (ISR/IRQ/task/interrupt...). logicprobe models event-order interleavings (A2/A3) but not preemptive concurrency; absolute claims such as thread-safe or interrupt-safe need dedicated verification (TSan, CBMC, or a model checker such as TLA+).');
+    }
+    if (HYBRID_VOCABULARY.test(corpus)) {
+        notes.push('The model references control/hybrid vocabulary (pid/plant/feedback/stability/motor...). logicprobe verifies discrete transitions only; stability, settling time, and mode-switch dynamics over a continuous plant need hybrid verification (SpaceEx, Flow*, or Simulink/Stateflow analysis).');
+    }
+    if (PROBABILISTIC_VOCABULARY.test(corpus)) {
+        notes.push('The model references probabilistic/reliability vocabulary (mtbf/failure rate/probability...). logicprobe is a qualitative model checker; reliability or probability claims need a stochastic model checker (PRISM, Storm) or fault-tree analysis.');
+    }
+    return notes;
+}
+// ---------------------------------------------------------------------------
 // main entry
 // ---------------------------------------------------------------------------
 export function runVerification(input, options = {}) {
@@ -1644,6 +2232,9 @@ export function runVerification(input, options = {}) {
         A9_leadsTo(model, exploration),
         A10_sequenceOrder(model, normalized),
         A11_atomicity(model, normalized),
+        A12_budget(model, normalized),
+        A13_probability(model, normalized),
+        A14_deadline(model, normalized),
     ];
     let comparison;
     if (options.beforeModel !== undefined) {
@@ -1680,6 +2271,7 @@ export function runVerification(input, options = {}) {
     }
     const errors = checks.reduce((sum, check) => sum + check.findings.filter((finding) => finding.severity === 'error').length, 0);
     const warnings = checks.reduce((sum, check) => sum + check.findings.filter((finding) => finding.severity === 'warning').length, 0);
+    const coverageNotes = computeCoverageNotes(model);
     return {
         ok: true,
         schemaVersion: 1,
@@ -1695,5 +2287,163 @@ export function runVerification(input, options = {}) {
         checks,
         ...(model.narrative === undefined ? {} : { narrative: model.narrative }),
         ...(comparison === undefined ? {} : { comparison }),
+        ...(coverageNotes.length === 0 ? {} : { coverageNotes }),
+    };
+}
+/**
+ * N-machine composition semantics (documented in dsh-model-schema.md):
+ * - a non-rendezvous event advances exactly ONE non-terminal machine that fires it;
+ * - a rendezvous event (handshake) fires only when AT LEAST TWO machines declare it in
+ *   their alphabet and EVERY such non-terminal machine has it enabled (guards held);
+ *   all participants then advance simultaneously. A machine that is terminal, or whose
+ *   alphabet does not include the event, does not participate;
+ * - a terminal machine is stopped and takes no further part.
+ * Checks: C1 composition deadlock (reachable node where no machine can advance while at
+ * least one is not terminal) and C2 rendezvous that can never fire.
+ */
+export function runCompositionVerification(machinesInput, options = {}) {
+    const models = [];
+    const hashes = [];
+    const modelFindings = [];
+    machinesInput.forEach((input, index) => {
+        const validation = validateModel(input);
+        if (!validation.ok) {
+            modelFindings.push({ code: 'MODEL_INVALID', severity: 'error', message: 'machine ' + index + ' invalid: ' + validation.errors.join('; ') });
+        }
+        else {
+            models.push(validation.model);
+            hashes.push(modelHash(validation.model));
+        }
+    });
+    const machineSummary = models.map((m, i) => ({ modelHash: hashes[i] ?? '', states: m.states.length, transitions: m.transitions.length }));
+    if (modelFindings.length > 0 || models.length < 2) {
+        if (models.length < 2 && modelFindings.length === 0) {
+            modelFindings.push({ code: 'MODEL_INVALID', severity: 'error', message: 'composition requires at least two machines' });
+        }
+        return {
+            ok: false,
+            summary: { machineCount: models.length, machines: machineSummary, compositeStates: 0, errors: modelFindings.length, warnings: 0, truncated: false },
+            checks: [{ id: 'MODEL', name: 'Machine Validation', status: 'fail', detail: 'composition input validation failed', findings: modelFindings }],
+        };
+    }
+    const rendezvous = new Set(options.rendezvous ?? []);
+    const maxStates = options.maxStates ?? DEFAULT_MAX_STATES;
+    const machineEventSets = models.map((model) => new Set(model.transitions.map((transition) => transition.event)));
+    const compositionMoves = (node) => {
+        const moves = [];
+        // single-machine (non-rendezvous) steps
+        for (let i = 0; i < models.length; i++) {
+            if (isTerminal(models[i], node.runtimes[i].state))
+                continue;
+            for (const event of allEvents(models[i])) {
+                if (rendezvous.has(event))
+                    continue;
+                for (const next of stepRuntime(models[i], node.runtimes[i], event)) {
+                    const runtimes = node.runtimes.slice();
+                    runtimes[i] = next;
+                    moves.push({ next: { runtimes, path: [] }, event, machines: [i] });
+                }
+            }
+        }
+        // synchronized rendezvous steps (>= 2 participants, all enabled)
+        for (const event of rendezvous) {
+            const participants = [];
+            for (let i = 0; i < models.length; i++) {
+                if (isTerminal(models[i], node.runtimes[i].state))
+                    continue;
+                if (!machineEventSets[i].has(event))
+                    continue;
+                participants.push(i);
+            }
+            if (participants.length < 2)
+                continue; // handshake needs a partner
+            const outcomes = participants.map((i) => stepRuntime(models[i], node.runtimes[i], event));
+            if (outcomes.some((list) => list.length === 0))
+                continue; // not all participants ready
+            let combos = [node.runtimes.slice()];
+            participants.forEach((i, slot) => {
+                const nextCombos = [];
+                for (const combo of combos) {
+                    for (const outcome of outcomes[slot]) {
+                        const copy = combo.slice();
+                        copy[i] = outcome;
+                        nextCombos.push(copy);
+                    }
+                }
+                combos = nextCombos;
+            });
+            for (const runtimes of combos) {
+                moves.push({ next: { runtimes, path: [] }, event, machines: participants });
+            }
+        }
+        return moves;
+    };
+    const keyOf = (node) => node.runtimes.map((runtime) => runtimeKey(runtime)).join('|');
+    const init = { runtimes: models.map((model) => initialState(model)), path: [] };
+    const visited = new Set();
+    const queue = [init];
+    let compositeStates = 0;
+    let truncated = false;
+    const firedCount = new Map();
+    for (const event of rendezvous)
+        firedCount.set(event, 0);
+    const c1Findings = [];
+    while (queue.length > 0) {
+        const node = queue.shift();
+        const key = keyOf(node);
+        if (visited.has(key))
+            continue;
+        visited.add(key);
+        compositeStates += 1;
+        if (compositeStates > maxStates) {
+            truncated = true;
+            break;
+        }
+        const moves = compositionMoves(node);
+        const allTerminal = node.runtimes.every((runtime, i) => isTerminal(models[i], runtime.state));
+        if (moves.length === 0 && !allTerminal) {
+            c1Findings.push({
+                code: 'C1_COMPOSITION_DEADLOCK',
+                severity: 'error',
+                message: 'Composition deadlock: no machine can advance from (' + node.runtimes.map((runtime) => runtime.state).join(', ') + ') while at least one is not terminal.',
+                evidence: { steps: node.path, states: node.runtimes.map((runtime) => runtime.state) },
+            });
+            continue;
+        }
+        for (const move of moves) {
+            if (move.machines.length > 1)
+                firedCount.set(move.event, (firedCount.get(move.event) ?? 0) + 1);
+            const nextKey = keyOf(move.next);
+            if (visited.has(nextKey))
+                continue;
+            queue.push({ runtimes: move.next.runtimes, path: [...node.path, { event: move.event, machines: move.machines }] });
+        }
+    }
+    const c2Findings = [];
+    const allEventsSet = new Set();
+    for (const set of machineEventSets)
+        for (const event of set)
+            allEventsSet.add(event);
+    for (const event of rendezvous) {
+        if (!allEventsSet.has(event))
+            continue;
+        if ((firedCount.get(event) ?? 0) === 0) {
+            c2Findings.push({
+                code: 'C2_RENDEZVOUS_NEVER_FIRES',
+                severity: 'warning',
+                message: 'Rendezvous event ' + event + ' can never fire: fewer than two machines ever jointly enable it.',
+            });
+        }
+    }
+    const errors = c1Findings.length;
+    const warnings = c2Findings.length;
+    const checks = [
+        checkResult('C1', 'Composition Deadlock', c1Findings, c1Findings.length === 0 ? 'No composition deadlock reachable' : 'Composition deadlocks: ' + c1Findings.length),
+        checkResult('C2', 'Rendezvous Sync', c2Findings, c2Findings.length === 0 ? 'All rendezvous events can fire' : 'Rendezvous warnings: ' + c2Findings.length),
+    ];
+    return {
+        ok: errors === 0,
+        summary: { machineCount: models.length, machines: machineSummary, compositeStates, errors, warnings, truncated },
+        checks,
     };
 }