dsh-logicprobe 1.3.0 → 1.4.1

package/README.en-US.md

@@ -2,6 +2,19 @@
 
 <p align="center"><strong>English</strong> · <a href="README.md">中文</a></p>
 
+> **Status**: this plugin checks claims about designs, code and plans. It continues
+> as `dsh-model-everything`, which covers the same claim, behaviour, structure, UML,
+> data-model, concurrency, export and report-comparison ground, and adds a design
+> review engine (layering, boundaries, substitutability, interface width, graph
+> shape), a report-reading skill, label explanation, and an optional session-start
+> routing component. It is not an API twin: the UML capability is split across tools
+> where this plugin has one `logicprobe_uml`. It is published as
+> [`dsh-model-everything`](https://github.com/AmethystLuna/dsh-model-everything)
+> ([npm](https://www.npmjs.com/package/dsh-model-everything)). Existing installs
+> keep working. Installation, mount, boot, tool call and uninstall were measured on
+> 0.2.1-rc.2 and 0.2.1-rc.1; per-release evidence is in
+> [DSH-COMPATIBILITY.md](DSH-COMPATIBILITY.md).
+
 [![HOL Guard Scanner](https://img.shields.io/badge/HOL%20Guard-passing-00a67e)](https://github.com/hashgraph-online/hol-guard)
 
 For an unverified design, failure is only a matter of time. However complex the code, model it and run it — then it becomes clear.
@@ -10,6 +23,14 @@ logicprobe checks a claim against the thing it describes. Facts go against the s
 
 **Cross-platform**: works with Claude Code, Codex CLI, Cursor, Kimi CLI, OpenCode, and ZCode. Built on the [Agent Skills](https://agentskills.io) open standard.
 
+> **Use case diagrams and the other UML families**: this plugin models state machines
+> and flows only. A use case diagram (`:Actor: --> (UseCase)`), a class, component or
+> deployment diagram is **refused by name** instead of being misread as a state machine.
+> For render/parse/review across all fourteen UML 2.5 diagram families, use
+> [dsh-model-everything](https://github.com/AmethystLuna/dsh-model-everything), which
+> carries this plugin's whole diagram capability (notation syntax engine, capability
+> matrix, use case and structure family modules).
+
 ## What It Does
 
 | Phase | What |
@@ -292,7 +313,7 @@ Skills are invoked with `$logicprobe`. See `.zcode/INSTALL.md`.
 ## Requirements
 
 - Host: Claude Code v2.1+ / Codex CLI latest / Cursor 2.5+ / Kimi CLI latest / OpenCode latest / ZCode 3.0+
-- DeepSeek Harness (dsh): dev preview, declared support for `>= 0.1.0-rc.7`. The latest round measured install, mount, boot and uninstall on 0.2.1-alpha.1. The earlier round measured 0.1.5-rc.2 through 0.2.0-rc.2. Per-release evidence is in [DSH-COMPATIBILITY.md](DSH-COMPATIBILITY.md).
+- DeepSeek Harness (dsh): dev preview, declared support for `>= 0.1.0-rc.7`. The latest round measured install, mount, boot and uninstall on 0.2.1-rc.2 and 0.2.1-rc.1. The earlier round measured 0.1.5-rc.2 through 0.2.0-rc.2. Per-release evidence is in [DSH-COMPATIBILITY.md](DSH-COMPATIBILITY.md).
 - The Web Plugins-page "Gate injection" switch requires **dsh ≥ 0.1.7-alpha.1**, because its settings service must be able to project live fields. On older dsh the plugin still loads and still injects. The switch is simply absent, with no error.
 - Python 3.8+ (standard library), needed to run the checks outside dsh. The manual mode needs no dependencies.
 

package/README.md

@@ -2,12 +2,27 @@
 
 <p align="center"><a href="README.en-US.md">English</a> · <strong>中文</strong></p>
 
+> **状态**：本插件核验设计、代码与计划中的声称。它继续以 `dsh-model-everything`
+> 的形式发展，同样覆盖声称、行为、结构、UML、数据模型、并发、导出与报告对比，
+> 并加上设计原则审查（分层、边界、可替换性、接口宽度、图形状）、报告阅读技能、
+> 标签口径解释和可选的会话启动路由。它不是本插件的 API 镜像：UML 能力拆在多个
+> 工具里，本插件只有一个 `logicprobe_uml`。它已发布为
+> [`dsh-model-everything`](https://github.com/AmethystLuna/dsh-model-everything)
+> （[npm](https://www.npmjs.com/package/dsh-model-everything)）。现有安装继续可用。
+> 0.2.1-rc.2 与 0.2.1-rc.1 上已实测安装、挂载、启动、工具调用与卸载；逐版本证据见
+> [DSH-COMPATIBILITY.md](DSH-COMPATIBILITY.md)。
+
 没验证过的设计，翻车只是时间问题；再复杂的代码，建模再跑就清楚了。
 
 logicprobe 核验声称与实物是否一致。事实类对着源码查。行为类跑模型：状态机、协议、组合、数据模型、迁移。图按依赖图读，单层或多层。改动前后用基线对比。验不了的维度明说，并指出该用哪个工具。
 
 **跨平台**：支持 Claude Code、Codex CLI、Cursor、Kimi CLI、OpenCode、ZCode。技能基于 [Agent Skills](https://agentskills.io) 开放标准。
 
+> **用例图与其它 UML 图族**：本插件只建模状态机与流程。用例图（`:Actor: --> (UseCase)`）、类图、
+> 组件图、部署图等会被**按名拒绝**，不会被误读成状态机。需要完整 14 类 UML 2.5 图族的
+> render/parse/review 时，用 [dsh-model-everything](https://github.com/AmethystLuna/dsh-model-everything)：
+> 它承接了本插件的全部图能力（记号语法引擎、能力矩阵、用例与结构族模块）。
+
 ## 功能
 
 | 阶段 | 内容 |
@@ -290,7 +305,7 @@ cp -r logicprobe/skills/* .zcode/skills/
 ## 环境要求
 
 - 宿主：Claude Code v2.1+ / Codex CLI 最新 / Cursor 2.5+ / Kimi CLI 最新 / OpenCode 最新 / ZCode 3.0+
-- DeepSeek Harness (dsh)：dev preview，声明支持 `>= 0.1.0-rc.7`。最新一轮在 0.2.1-alpha.1 上实测了安装、挂载、启动与卸载；更早一轮实测覆盖 0.1.5-rc.2 到 0.2.0-rc.2。逐版本证据见 [DSH-COMPATIBILITY.md](DSH-COMPATIBILITY.md)。
+- DeepSeek Harness (dsh)：dev preview，声明支持 `>= 0.1.0-rc.7`。最新一轮在 0.2.1-rc.2 与 0.2.1-rc.1 上实测了安装、挂载、启动与卸载；更早一轮实测覆盖 0.1.5-rc.2 到 0.2.0-rc.2。逐版本证据见 [DSH-COMPATIBILITY.md](DSH-COMPATIBILITY.md)。
 - Web 端的「Gate 注入」开关需要 **dsh ≥ 0.1.7-alpha.1**，因为设置服务必须能投影即时字段。更早的 dsh 上插件照常加载、照常注入，只是开关不出现，也不报错。
 - Python 3.8+（标准库），在 dsh 之外运行验证所需；手动兜底模式不需要任何依赖。
 

package/lib/engine.js

@@ -68,6 +68,18 @@ function refusalGuidance(errors) {
 }
 const DEFAULT_MAX_STATES = 10_000;
 const DEFAULT_MAX_PERMUTATION_EVENTS = 5;
+/**
+ * Budget for the leads-to walk, as a multiple of `maxStates`. That walk is depth-first
+ * over run states, so `maxStates` does not bound it the way it bounds the breadth-first
+ * explorations: an `inc`/`dec` counter whose updates are not pinned by a guard has an
+ * unbounded reachable set, every run state is distinct, and the walk never revisits one.
+ * The budget is shared across every start state of a single check, so a wide search
+ * space cannot multiply it by the number of starts.
+ */
+const LEADS_TO_WALK_FACTOR = 20;
+function leadsToWalkBudget(options) {
+    return Math.max(1_000, options.maxStates * LEADS_TO_WALK_FACTOR);
+}
 function stableStringify(value) {
     if (value === null || typeof value !== 'object')
         return JSON.stringify(value);
@@ -158,6 +170,15 @@ export function verdictOfFindings(findings) {
     const warnings = findings.filter((finding) => finding.severity === 'warning');
     return verdictOf(errors.length, warnings.length, errors[0]?.code);
 }
+/**
+ * Finding codes that mean "the search stopped before deciding", as opposed to "the
+ * model is wrong". They must reach `summary.truncated`, or a caller reading only that
+ * flag would take an unfinished search for a clean one.
+ */
+const UNDECIDED_CODES = new Set(['S7_UNDECIDED', 'A7_UNDECIDED', 'A9_LEADS_TO_UNDECIDED', 'D2_UNDECIDED']);
+function hasUndecidedFinding(checks) {
+    return checks.some((check) => check.findings.some((finding) => UNDECIDED_CODES.has(finding.code)));
+}
 /**
  * Paths of every `_`-prefixed key in the input, sorted (`_source`, `_verified`,
  * `states[0]._note`; a metadata key's own children are not listed, since the subtree is
@@ -1059,6 +1080,108 @@ function guardLeaves(model) {
 function collectGuardConstants(model) {
     return guardLeaves(model).filter((leaf) => typeof leaf.value === 'number').map((leaf) => leaf.value);
 }
+/** How a variable value prints in a message. Shared by every finding that quotes one. */
+function varValueLabel(value) {
+    return typeof value === 'boolean' ? (value ? 'true' : 'false') : String(value);
+}
+/** Deterministic value order: booleans first, then numbers ascending. */
+function compareVarValues(a, b) {
+    const rank = (value) => typeof value === 'number' ? [1, value] : [0, value ? 1 : 0];
+    const [rankA, numberA] = rank(a);
+    const [rankB, numberB] = rank(b);
+    return rankA === rankB ? numberA - numberB : rankA - rankB;
+}
+/**
+ * Values each variable can actually hold, as an over-approximation: `init` plus every
+ * `set` constant the model writes. `null` means "unknown", which is what an `inc` or
+ * `dec` update produces — the reachable set is then unbounded and nothing can be
+ * concluded from it.
+ *
+ * The union is taken across the whole model rather than per state, so the answer can
+ * only be too large, never too small. A guard this function calls dead is therefore
+ * dead in every state, while a live guard may still be unreachable in a particular one.
+ */
+function attainableValues(model) {
+    const attainable = new Map();
+    for (const variable of model.variables ?? [])
+        attainable.set(variable.name, new Set([variable.init]));
+    for (const transition of model.transitions) {
+        for (const update of transition.updates ?? []) {
+            if (!attainable.has(update.variable))
+                continue;
+            if (update.op === 'inc' || update.op === 'dec') {
+                attainable.set(update.variable, null);
+                continue;
+            }
+            const values = attainable.get(update.variable);
+            if (values === null || values === undefined)
+                continue;
+            values.add(update.value ?? 0);
+        }
+    }
+    return attainable;
+}
+/**
+ * Guarded transitions whose guard no reachable variable value can satisfy: the branch
+ * is dead code, and a model that relies on it is not the model the author wrote. This
+ * is the dual of S6_INCOMPLETE_GUARD — a group that never reaches a branch, rather
+ * than one that falls through every branch.
+ *
+ * The test runs over {@link attainableValues}, not over the declared domain: a guard
+ * on a variable the model only ever sets to one of its declared values is satisfiable
+ * on paper and dead in practice, which is exactly the defect worth reporting.
+ */
+function deadGuardFindings(model) {
+    const attainable = attainableValues(model);
+    const findings = [];
+    for (const [key, group] of groupTransitions(model)) {
+        const [from, event] = key.split('|');
+        for (const transition of group) {
+            if (transition.guard === undefined)
+                continue;
+            const names = [...new Set(guardVariables(transition.guard))].filter((name) => attainable.has(name)).sort();
+            if (names.length === 0)
+                continue;
+            const domains = [];
+            let known = true;
+            for (const name of names) {
+                const values = attainable.get(name);
+                if (values === undefined || values === null || values.size === 0) {
+                    known = false;
+                    break;
+                }
+                domains.push(values);
+            }
+            if (!known)
+                continue;
+            let size = 1;
+            for (const values of domains)
+                size *= values.size;
+            if (size > 10_000)
+                continue;
+            const assignment = {};
+            const satisfiable = (index) => {
+                if (index === names.length)
+                    return evalGuard(transition.guard, assignment);
+                for (const value of [...domains[index]].sort(compareVarValues)) {
+                    assignment[names[index]] = value;
+                    if (satisfiable(index + 1))
+                        return true;
+                }
+                return false;
+            };
+            if (satisfiable(0))
+                continue;
+            findings.push({
+                code: 'S6_DEAD_GUARD',
+                severity: 'warning',
+                message: from + ' + ' + event + ' has a guard that can never hold: ' + names.map((name) => name + ' is only ever ' + [...attainable.get(name)].sort(compareVarValues).map(varValueLabel).join('/')).join(', ') + '. The branch is dead.',
+                evidence: { guard: transition.guard, attainable: names.map((name) => ({ variable: name, values: [...attainable.get(name)].sort(compareVarValues).map(varValueLabel) })) },
+            });
+        }
+    }
+    return findings;
+}
 function analyzeGuards(model) {
     const determinism = [];
     const completeness = [];
@@ -1111,6 +1234,7 @@ function analyzeGuards(model) {
         if (truncated)
             break;
     }
+    completeness.push(...deadGuardFindings(model));
     return { determinism, completeness, truncated };
 }
 function S4_determinism(model) {
@@ -1119,7 +1243,11 @@ function S4_determinism(model) {
 }
 function S6_guardCompleteness(model) {
     const analysis = analyzeGuards(model);
-    return checkResult('S6', 'Guard Completeness', analysis.completeness, analysis.completeness.length === 0 ? 'All guard branches defined' : 'Guard findings: ' + analysis.completeness.length);
+    const dead = analysis.completeness.filter((finding) => finding.code === 'S6_DEAD_GUARD').length;
+    const detail = analysis.completeness.length === 0
+        ? 'All guard branches defined'
+        : dead === analysis.completeness.length ? 'Dead guard branches: ' + dead : 'Guard findings: ' + analysis.completeness.length;
+    return checkResult('S6', 'Guard Completeness', analysis.completeness, detail);
 }
 function S5_eventCompleteness(model) {
     const events = allEvents(model);
@@ -1253,12 +1381,17 @@ function pathPropertyViolation(model, options, invariant) {
     if (invariant.kind === 'leads-to') {
         const targets = new Set(leadsToTargets(invariant));
         const label = leadsToTargetLabel(invariant);
+        const budget = leadsToWalkBudget(options);
+        const walk = { remaining: budget };
         for (const runtime of reachableRuntimeStates(model, options)) {
             if (runtime.state !== invariant.from)
                 continue;
-            const bad = findLeadsToBadPath(model, runtime, targets, label);
-            if (bad !== undefined)
-                return { invariant, path: bad.path, reason: bad.reason };
+            const outcome = findLeadsToBadPath(model, runtime, targets, label, walk);
+            if (outcome.undecided) {
+                return { invariant, path: [], reason: 'the walk spent its budget of ' + budget + ' steps without finding a run that avoids ' + label + ', or proving that none exists', undecided: true };
+            }
+            if (outcome.violation !== undefined)
+                return { invariant, path: outcome.violation.path, reason: outcome.violation.reason };
         }
         return undefined;
     }
@@ -1335,14 +1468,22 @@ function runInvariants(model, options, includePathProperties = false) {
 }
 function S7_invariants(model, options) {
     const violations = runInvariants(model, options);
-    const findings = violations.map((violation) => ({
+    const findings = violations.map((violation) => violation.undecided ? {
+        code: 'S7_UNDECIDED',
+        severity: 'warning',
+        message: 'Invariant "' + violation.invariant.id + '" (' + violation.invariant.description + ') could not be decided: ' + violation.reason + '. Absence is not proven.',
+        evidence: { invariant: violation.invariant },
+    } : {
         code: 'S7_INVARIANT_VIOLATION',
         severity: 'error',
         message: 'Invariant "' + violation.invariant.id + '" (' + violation.invariant.description + ') violated: ' + violation.reason,
         path: violation.path,
         evidence: { invariant: violation.invariant },
-    }));
-    return checkResult('S7', 'Invariant Validity', findings, violations.length === 0 ? 'All invariants hold' : 'Invariant violations: ' + violations.length);
+    });
+    const undecided = findings.some((finding) => finding.code === 'S7_UNDECIDED');
+    return checkResult('S7', 'Invariant Validity', findings, violations.length === 0
+        ? 'All invariants hold'
+        : undecided && findings.every((finding) => finding.code === 'S7_UNDECIDED') ? 'Invariants undecided: the search budget ran out' : 'Invariant violations: ' + violations.length);
 }
 // ---------------------------------------------------------------------------
 // A1-A14
@@ -1709,6 +1850,14 @@ function A7_shortestViolations(model, options) {
     // found instead of claiming minimality.
     const violations = runInvariants(model, options, true);
     const findings = violations.map((violation) => {
+        if (violation.undecided) {
+            return {
+                code: 'A7_UNDECIDED',
+                severity: 'warning',
+                message: 'Invariant "' + violation.invariant.id + '" could not be decided: ' + violation.reason + '. Absence is not proven, so there is no shortest counterexample to report.',
+                evidence: { invariant: violation.invariant.id },
+            };
+        }
         const pathLength = violation.path.length;
         const message = isPathPropertyInvariant(violation.invariant)
             ? 'Invariant "' + violation.invariant.id + '" violated: ' + violation.reason
@@ -1891,7 +2040,12 @@ function D2_invariantContinuity(before, after, options, mapping) {
             ? pathPropertyViolation(after, options, mapped)
             : shortestViolationForInvariant(after, options, mapped);
         if (violation !== undefined) {
-            findings.push({
+            findings.push(violation.undecided ? {
+                code: 'D2_UNDECIDED',
+                severity: 'warning',
+                message: 'BEFORE invariant "' + invariant.id + '" could not be re-decided against AFTER: ' + violation.reason + '. Absence is not proven.',
+                evidence: { beforeInvariant: invariant, afterInvariant: mapped },
+            } : {
                 code: 'D2_INVARIANT_REGRESSION',
                 severity: 'error',
                 message: 'BEFORE invariant "' + invariant.id + '" no longer holds in AFTER: ' + violation.reason,
@@ -2046,6 +2200,109 @@ function A8_idempotentReplay(model, exploration) {
     }
     return checkResult('A8', 'Idempotent Replay', findings, findings.length === 0 ? 'Idempotent events are replay-safe' : 'Idempotent replay findings: ' + findings.length);
 }
+/**
+ * Whether the guard proves `variable` stays at or below `bound` wherever it holds.
+ *
+ * Deliberately conservative in one direction only: a guard this function cannot read
+ * answers `false`, so an unreadable guard is reported as "not proven" rather than as
+ * "enforced". A conjunction bounds the value if any conjunct does; a disjunction has to
+ * bound it on every branch; a negation is never reasoned about.
+ */
+function guardImpliesUpperBound(guard, variable, bound) {
+    if (guard === undefined)
+        return false;
+    if ('variable' in guard) {
+        if (guard.variable !== variable || typeof guard.value !== 'number')
+            return false;
+        if (guard.op === '<')
+            return guard.value - 1 <= bound;
+        if (guard.op === '<=' || guard.op === '==')
+            return guard.value <= bound;
+        return false;
+    }
+    if ('all' in guard)
+        return guard.all.some((child) => guardImpliesUpperBound(child, variable, bound));
+    if ('any' in guard)
+        return guard.any.every((child) => guardImpliesUpperBound(child, variable, bound));
+    return false;
+}
+/** Mirror of {@link guardImpliesUpperBound} for the lower bound. */
+function guardImpliesLowerBound(guard, variable, bound) {
+    if (guard === undefined)
+        return false;
+    if ('variable' in guard) {
+        if (guard.variable !== variable || typeof guard.value !== 'number')
+            return false;
+        if (guard.op === '>')
+            return guard.value + 1 >= bound;
+        if (guard.op === '>=' || guard.op === '==')
+            return guard.value >= bound;
+        return false;
+    }
+    if ('all' in guard)
+        return guard.all.some((child) => guardImpliesLowerBound(child, variable, bound));
+    if ('any' in guard)
+        return guard.any.every((child) => guardImpliesLowerBound(child, variable, bound));
+    return false;
+}
+/**
+ * Whether the model's own declarations about a variable hold against what its
+ * transitions do. `inc` and `dec` are never clamped to `min`/`max` — the declared
+ * range is a property to check, not a bound on the search — so a counter whose guard
+ * does not pin it ranges past its own declaration, and the reachable set is unbounded
+ * however narrow the declaration looks.
+ *
+ * Reporting the declaration rather than silently clamping is deliberate. Clamping would
+ * delete the very states a range violation is witnessed by, turning a counterexample
+ * into a false pass.
+ */
+function declaredDomainFindings(model) {
+    const findings = [];
+    for (const transition of model.transitions) {
+        for (const update of transition.updates ?? []) {
+            const variable = (model.variables ?? []).find((entry) => entry.name === update.variable);
+            if (variable === undefined)
+                continue;
+            const delta = typeof update.value === 'number' ? update.value : 1;
+            const at = transition.from + ' + ' + transition.event;
+            if (update.op === 'inc' && variable.max !== undefined && !guardImpliesUpperBound(transition.guard, variable.name, variable.max - delta)) {
+                findings.push({
+                    code: 'S8_DOMAIN_NOT_ENFORCED',
+                    severity: 'warning',
+                    message: at + ' increments ' + variable.name + ', but ' + variable.name + ' declares max ' + variable.max + ' and no guard keeps it there: the declared range is not a bound on reachable values.',
+                    evidence: { variable: variable.name, declaredMax: variable.max, transition: at },
+                });
+            }
+            if (update.op === 'dec' && variable.min !== undefined && !guardImpliesLowerBound(transition.guard, variable.name, variable.min + delta)) {
+                findings.push({
+                    code: 'S8_DOMAIN_NOT_ENFORCED',
+                    severity: 'warning',
+                    message: at + ' decrements ' + variable.name + ', but ' + variable.name + ' declares min ' + variable.min + ' and no guard keeps it there: the declared range is not a bound on reachable values.',
+                    evidence: { variable: variable.name, declaredMin: variable.min, transition: at },
+                });
+            }
+            if (update.op === 'set' && typeof update.value === 'number') {
+                if (variable.min !== undefined && update.value < variable.min) {
+                    findings.push({
+                        code: 'S8_DOMAIN_SET_OUTSIDE',
+                        severity: 'error',
+                        message: at + ' sets ' + variable.name + ' to ' + update.value + ', below its declared min ' + variable.min + '.',
+                        evidence: { variable: variable.name, value: update.value, declaredMin: variable.min },
+                    });
+                }
+                if (variable.max !== undefined && update.value > variable.max) {
+                    findings.push({
+                        code: 'S8_DOMAIN_SET_OUTSIDE',
+                        severity: 'error',
+                        message: at + ' sets ' + variable.name + ' to ' + update.value + ', above its declared max ' + variable.max + '.',
+                        evidence: { variable: variable.name, value: update.value, declaredMax: variable.max },
+                    });
+                }
+            }
+        }
+    }
+    return findings;
+}
 function S8_monotonicVariables(model) {
     const findings = [];
     for (const variable of model.variables ?? []) {
@@ -2067,7 +2324,8 @@ function S8_monotonicVariables(model) {
             }
         }
     }
-    return checkResult('S8', 'Monotonic Variables', findings, findings.length === 0 ? 'Monotonic variables are respected' : 'Monotonic findings: ' + findings.length);
+    findings.push(...declaredDomainFindings(model));
+    return checkResult('S8', 'Variable Declarations', findings, findings.length === 0 ? 'Variable declarations are respected' : 'Variable declaration findings: ' + findings.length);
 }
 /**
  * Target states of a `leads-to` invariant. The schema accepts one state id or a
@@ -2100,16 +2358,39 @@ function leadsToTargetLabel(invariant) {
  * (two branches rejoining) is acyclic and must pass, while a genuine cycle must not.
  * A run is identified by its state plus its variable values, so the same state id
  * with different values is a different node.
+ *
+ * Two properties keep the walk from taking the host down, and both are load-bearing:
+ * the walk is **budgeted**, and it stores a **parent link** per node instead of a copy
+ * of the path. Without the budget an unbounded counter makes the run graph infinite, so
+ * the three colours above never repeat a key and the walk never returns; without the
+ * parent link every frame retains its own copy of the path, which grows the walk's
+ * memory quadratically in its depth. Either one alone turns "the model is wrong" into
+ * an out-of-memory abort, which is the failure this function must not have.
+ *
+ * An exhausted budget is reported as `undecided`, never as `undefined`: a walk that
+ * did not finish has not proven that every run reaches a target.
  */
-function findLeadsToBadPath(model, start, targets, label) {
+function findLeadsToBadPath(model, start, targets, label, walk) {
     if (targets.has(start.state))
-        return undefined;
+        return { undecided: false };
     const GRAY = 1;
     const BLACK = 2;
+    const pathOf = (frame) => {
+        const steps = [];
+        let node = frame;
+        while (node !== undefined && node.step !== undefined) {
+            steps.push(node.step);
+            node = node.parent;
+        }
+        return steps.reverse();
+    };
     const color = new Map();
-    const stack = [{ runtime: start, path: [], nexts: undefined, index: 0 }];
+    const stack = [{ runtime: start, parent: undefined, step: undefined, nexts: undefined, index: 0 }];
     color.set(runtimeKey(start), GRAY);
     while (stack.length > 0) {
+        if (walk.remaining <= 0)
+            return { undecided: true };
+        walk.remaining -= 1;
         const frame = stack[stack.length - 1];
         if (frame.nexts === undefined) {
             const nexts = [];
@@ -2119,7 +2400,7 @@ function findLeadsToBadPath(model, start, targets, label) {
             }
             frame.nexts = nexts;
             if (nexts.length === 0)
-                return { path: frame.path, reason: 'Dead end before target ' + label };
+                return { violation: { path: pathOf(frame), reason: 'Dead end before target ' + label }, undecided: false };
         }
         if (frame.index >= frame.nexts.length) {
             color.set(runtimeKey(frame.runtime), BLACK);
@@ -2134,39 +2415,53 @@ function findLeadsToBadPath(model, start, targets, label) {
         const key = runtimeKey(next);
         const seen = color.get(key);
         if (seen === GRAY)
-            return { path: [...frame.path, step], reason: 'Cycle avoids target ' + label };
+            return { violation: { path: [...pathOf(frame), step], reason: 'Cycle avoids target ' + label }, undecided: false };
         if (seen === BLACK)
             continue;
         color.set(key, GRAY);
-        stack.push({ runtime: next, path: [...frame.path, step], nexts: undefined, index: 0 });
+        stack.push({ runtime: next, parent: frame, step, nexts: undefined, index: 0 });
     }
     // Every branch either reached a target or rejoined a branch that did.
-    return undefined;
+    return { undecided: false };
 }
-function A9_leadsTo(model, exploration) {
+function A9_leadsTo(model, exploration, options) {
     const findings = [];
     for (const invariant of model.invariants ?? []) {
         if (invariant.kind !== 'leads-to')
             continue;
         const targets = new Set(leadsToTargets(invariant));
         const label = leadsToTargetLabel(invariant);
+        const budget = leadsToWalkBudget(options);
+        const walk = { remaining: budget };
         for (const runtime of exploration.reachable) {
             if (runtime.state !== invariant.from)
                 continue;
-            const bad = findLeadsToBadPath(model, runtime, targets, label);
-            if (bad !== undefined) {
+            const outcome = findLeadsToBadPath(model, runtime, targets, label, walk);
+            if (outcome.undecided) {
+                findings.push({
+                    code: 'A9_LEADS_TO_UNDECIDED',
+                    severity: 'warning',
+                    message: 'Leads-to invariant "' + invariant.id + '" is undecided: the walk spent its budget of ' + budget + ' steps from ' + invariant.from + ' without finding a run that avoids ' + label + ', or proving that none exists. Absence is not proven.',
+                    evidence: { invariant },
+                });
+                break;
+            }
+            if (outcome.violation !== undefined) {
                 findings.push({
                     code: 'A9_LEADS_TO_VIOLATION',
                     severity: 'error',
-                    message: 'Leads-to invariant "' + invariant.id + '" violated from ' + invariant.from + ': ' + bad.reason,
-                    path: bad.path,
+                    message: 'Leads-to invariant "' + invariant.id + '" violated from ' + invariant.from + ': ' + outcome.violation.reason,
+                    path: outcome.violation.path,
                     evidence: { invariant },
                 });
                 break;
             }
         }
     }
-    return checkResult('A9', 'Leads-To', findings, findings.length === 0 ? 'All leads-to invariants hold' : 'Leads-to findings: ' + findings.length);
+    const undecided = findings.some((finding) => finding.code === 'A9_LEADS_TO_UNDECIDED');
+    return checkResult('A9', 'Leads-To', findings, findings.length === 0
+        ? 'All leads-to invariants hold'
+        : undecided ? 'Leads-to undecided: the search budget ran out' : 'Leads-to findings: ' + findings.length);
 }
 function findSequenceViolation(model, options, invariant) {
     const events = invariant.events;
@@ -2754,7 +3049,7 @@ export function runVerification(input, options = {}) {
         A6_resourceInjection(model),
         A7_shortestViolations(model, normalized),
         A8_idempotentReplay(model, exploration),
-        A9_leadsTo(model, exploration),
+        A9_leadsTo(model, exploration, normalized),
         A10_sequenceOrder(model, normalized),
         A11_atomicity(model, normalized),
         A12_budget(model, normalized),
@@ -2783,7 +3078,7 @@ export function runVerification(input, options = {}) {
                     errors: beforeValidation.errors.length,
                     warnings: 0,
                     checksRun: checks.length + 1,
-                    truncated: exploration.truncated,
+                    truncated: exploration.truncated || hasUndecidedFinding(checks),
                 },
                 checks: [
                     ...checks,
@@ -2838,7 +3133,7 @@ export function runVerification(input, options = {}) {
             errors,
             warnings,
             checksRun: checks.length,
-            truncated: exploration.truncated,
+            truncated: exploration.truncated || hasUndecidedFinding(checks),
         },
         checks,
         nextSteps: verificationNextSteps(checks, narrativeCoverage),