dsh-model-everything 0.0.0-stage → 0.1.0

package/lib/engine.js

@@ -0,0 +1,4343 @@
+import { createHash } from 'node:crypto';
+export const ENGINE_SCHEMA_VERSION = 1;
+export function isStateGuard(when) {
+    return 'state' in when;
+}
+/** Allowed keys per invariant kind — the schema is closed, so anything else is a typo or an unsupported feature. */
+const INVARIANT_KEYS = {
+    'never-states': new Set(['id', 'description', 'kind', 'states']),
+    'var-in-range': new Set(['id', 'description', 'kind', 'variable', 'min', 'max', 'when']),
+    'event-before-state': new Set(['id', 'description', 'kind', 'event', 'state']),
+    'leads-to': new Set(['id', 'description', 'kind', 'from', 'to']),
+    'sequence': new Set(['id', 'description', 'kind', 'events']),
+    'atomicity': new Set(['id', 'description', 'kind', 'events', 'commit', 'rollback']),
+    'budget': new Set(['id', 'description', 'kind', 'budget']),
+    'probability': new Set(['id', 'description', 'kind', 'target', 'op', 'p']),
+};
+const KNOWN_INVARIANT_KINDS = new Set(Object.keys(INVARIANT_KEYS));
+/**
+ * Declared keys per model part. The model schema is closed: a key that is not
+ * declared is a typo or an unsupported feature, and silently ignoring it can make
+ * the engine report a property that the model does not actually have (a mistyped
+ * guard variable reads as an always-false guard, which prunes real paths and can
+ * yield a false "no deadlock"). Rejecting is the only safe option for a verifier.
+ */
+const MODEL_KEYS = {
+    root: new Set(['schemaVersion', 'init', 'states', 'transitions', 'variables', 'invariants', 'concurrentPairs', 'boundaryChecks', 'resourcePairs', 'idempotentEvents', 'tickEvents', 'narrative']),
+    state: new Set(['id', 'terminal', 'onEntry', 'onExit', 'maxTicks']),
+    transition: new Set(['from', 'event', 'to', 'guard', 'updates', 'cost', 'weight']),
+    update: new Set(['variable', 'op', 'value']),
+    variable: new Set(['name', 'kind', 'init', 'min', 'max', 'monotonic']),
+    // LogicModelV1 boundary checks are (variable, values). The data-model engine has
+    // its own (entity, field) shape and its own validator — the two must not be mixed.
+    boundaryCheck: new Set(['variable', 'values']),
+    resourcePair: new Set(['resource', 'acquireEvent', 'releaseEvent', 'failEvent']),
+    narrative: new Set(['states', 'events', 'scenarios']),
+    scenario: new Set(['from', 'event', 'scenario']),
+};
+/**
+ * The next-steps list every verification report carries. Derived only from the checks
+ * and the narrative coverage, so two runs over the same model produce the same list.
+ */
+function verificationNextSteps(checks, coverage) {
+    const steps = [];
+    // The name leads and the code follows in parentheses, so a reader who has never seen a report can act
+    // on this sentence, and a reader who wants the code still has it. The code is a label for the check,
+    // not the check's name.
+    const failed = checks.filter((check) => check.status === 'fail').map((check) => check.name + ' (' + check.id + ')');
+    const warningCodes = [...new Set(checks.flatMap((check) => check.findings).filter((finding) => finding.severity === 'warning').map((finding) => finding.code))].sort();
+    if (failed.length > 0)
+        steps.push('Resolve the failing checks first: ' + failed.join(', ') + '.');
+    // A check that had nothing to examine is named here, because a reader who is not told will assume every
+    // named check looked at the model. A list of failures does not say that, and neither does `pass`.
+    const skipped = checks.filter((check) => check.status === 'skip').map((check) => check.name + ' (' + check.id + ')');
+    if (skipped.length > 0) {
+        steps.push('These examined nothing, so their silence is not a result: ' + skipped.join(', ') + '. Declare what each one would need, or accept that the model is unverified on those points.');
+    }
+    // Named checks above, bare codes here. That is deliberate: each warning is a different kind of thing,
+    // so there is no single name to give the set, and the sentence points at where each one IS explained
+    // rather than leaving a reader to guess what the codes stand for.
+    if (warningCodes.length > 0)
+        steps.push('Review the warning findings (' + warningCodes.join(', ') + '): they are not failures, but they are not silence either. Each one is explained in its own `message` under `findings`.');
+    if (coverage !== undefined && !narrativeComplete(coverage)) {
+        steps.push('Complete the narrative (states ' + coverage.states + ', events ' + coverage.events + ', scenarios ' + coverage.scenarios + ') — a partial narrative is valid, but a reader still has to re-derive the missing symbols.');
+    }
+    // The range is dropped: the code that would be reported back is already named in `findings`, and a
+    // reader who has not seen a report yet learns nothing from four digits.
+    steps.push('Re-run with beforeModel/stateMapping after the change to prove the behaviour did not regress: behaviour preserved, invariants continuous, the state mapping consistent. Then compare the two reports with `report_diff` rather than reading them side by side.');
+    return steps;
+}
+/**
+ * Repair guidance for a rejected model. A refusal reports the offending path and the rule
+ * it broke, but not what to write instead; for fields whose absence is a documented trap,
+ * that is the difference between "fix it" and "guess again". Derived only from the
+ * validation messages, so the list stays deterministic.
+ */
+function refusalGuidance(errors) {
+    const steps = [];
+    if (errors.some((message) => message.includes('.description'))) {
+        steps.push('Add the required "description" string to every invariant (for example "description": "what this invariant guarantees"); a `_`-prefixed key is not a substitute, and the value takes part in `modelHash`.');
+    }
+    return steps;
+}
+const DEFAULT_MAX_STATES = 10_000;
+const DEFAULT_MAX_PERMUTATION_EVENTS = 5;
+/**
+ * Ceilings the caller cannot raise.
+ *
+ * These are not budget opinions, they are the difference between a bounded answer and an aborted
+ * process. `maxStates` bounds every walk in the engine with `steps > options.maxStates`, so a `NaN`
+ * makes that comparison false forever and the walk allocates until the heap dies - the robustness
+ * audit measured 4 GB and a fatal V8 error at about 70 s, from an option the tool schema accepts.
+ * `Infinity` never stops at all.
+ *
+ * The state ceiling is ten times the default, so a caller who genuinely needs more can ask.
+ * Permutations are factorial, which makes that ceiling hard: 9! is 362 880 orderings, three orders
+ * of magnitude past the default's 120, and A2's sampling path exists for the cases beyond it.
+ */
+const MAX_STATES_CEILING = 100_000;
+const MAX_PERMUTATION_EVENTS_CEILING = 9;
+/**
+ * A caller-supplied bound, or the default when the value could not bound anything.
+ *
+ * The engine never throws for a bad option, so this neither refuses nor throws: it replaces or
+ * clamps the value and records that it did, and the report carries the note. A non-finite or
+ * non-integer bound is not a claim to disagree with - it is a bound that does not bound, and
+ * `steps > NaN` is false forever.
+ */
+function boundedOption(value, fallback, ceiling, name, notes) {
+    if (value === undefined)
+        return fallback;
+    if (!Number.isFinite(value) || !Number.isInteger(value) || value < 1) {
+        notes.push(name + ' was ' + String(value) + ', which cannot bound a search; the default of ' + String(fallback) + ' was used instead.');
+        return fallback;
+    }
+    if (value > ceiling) {
+        notes.push(name + ' was ' + String(value) + '; it was clamped to ' + String(ceiling) + '. A larger bound does not buy a larger answer here: the search would run until the process ran out of memory.');
+        return ceiling;
+    }
+    return value;
+}
+/**
+ * Budget for the leads-to walk, as a multiple of `maxStates`. That walk is depth-first
+ * over run states, so `maxStates` does not bound it the way it bounds the breadth-first
+ * explorations: an `inc`/`dec` counter whose updates are not pinned by a guard has an
+ * unbounded reachable set, every run state is distinct, and the walk never revisits one.
+ * The budget is shared across every start state of a single check, so a wide search
+ * space cannot multiply it by the number of starts.
+ */
+const LEADS_TO_WALK_FACTOR = 20;
+function leadsToWalkBudget(options) {
+    return Math.max(1_000, options.maxStates * LEADS_TO_WALK_FACTOR);
+}
+function stableStringify(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return '[' + value.map((item) => stableStringify(item)).join(',') + ']';
+    const record = value;
+    return '{' + Object.keys(record).sort().map((key) => JSON.stringify(key) + ':' + stableStringify(record[key])).join(',') + '}';
+}
+/**
+ * The hash of any model this plugin carries: the same normalization as `modelHash`,
+ * over whatever object the family defines. A use case diagram and a state machine are
+ * hashed by one rule, so a report can name either.
+ */
+export function valueHash(value, spec = DEFAULT_HASH_SPEC) {
+    return createHash('sha256').update(stableStringify(hashPayload(value, spec))).digest('hex');
+}
+export function modelHash(model, spec = DEFAULT_HASH_SPEC) {
+    return valueHash(model, spec);
+}
+/**
+ * Deterministic JSON (sorted keys, no insignificant whitespace) — the serialization the
+ * hash specification is defined over. Exported so every report hashes inputs the same way.
+ */
+export function canonicalJson(value) {
+    return stableStringify(value);
+}
+export const PUBLISHED_HASH_SPECS = ['v0', 'v1'];
+export const DEFAULT_HASH_SPEC = 'v1';
+/**
+ * Versioned report contracts. Every tool result carries `schema`, so a consumer can
+ * branch on the contract instead of sniffing fields, and a change to a report's shape
+ * is a version bump here rather than a silent break. `findings[]` keeps the same
+ * stable core in every family: `{code, severity, message, detail?, evidence?, path?}`.
+ */
+export const REPORT_SCHEMAS = {
+    verify: 'model-everything/verify/v1',
+    compose: 'model-everything/compose/v1',
+    datamodel: 'model-everything/datamodel/v1',
+    concurrency: 'model-everything/concurrency/v1',
+    export: 'model-everything/export/v1',
+    umlRender: 'model-everything/uml/render/v1',
+    umlParse: 'model-everything/uml/parse/v1',
+    umlReview: 'model-everything/uml/review/v1',
+    umlExplainLabels: 'model-everything/uml/explain-labels/v1',
+    // A UML refusal happens before the action resolves, so there is no action schema to name. It still carries
+    // one: every other family's refusal does, and a reader who keys on `schema` was left with nothing.
+    umlRefusal: 'model-everything/uml/refusal/v1',
+    structure: 'model-everything/structure/v1',
+    granularity: 'model-everything/granularity/v1',
+    design: 'model-everything/design/v1',
+    baseline: 'model-everything/baseline/v1',
+};
+export function narrativeCoverageOf(model) {
+    const narrative = model.narrative;
+    if (narrative === undefined)
+        return undefined;
+    const describedStates = narrative.states === undefined ? 0 : Object.keys(narrative.states).length;
+    const describedEvents = narrative.events === undefined ? 0 : Object.keys(narrative.events).length;
+    const groups = new Set(model.transitions.map((transition) => transition.from + '|' + transition.event));
+    const describedGroups = narrative.scenarios === undefined
+        ? 0
+        : new Set(narrative.scenarios.map((scenario) => scenario.from + '|' + scenario.event)).size;
+    const events = new Set(model.transitions.map((transition) => transition.event));
+    return {
+        states: String(describedStates) + '/' + String(model.states.length),
+        events: String(describedEvents) + '/' + String(events.size),
+        scenarios: String(describedGroups) + '/' + String(groups.size),
+    };
+}
+/** True when every dimension of the coverage is fully described. */
+export function narrativeComplete(coverage) {
+    if (coverage === undefined)
+        return false;
+    return coverage.states.split('/')[0] === coverage.states.split('/')[1]
+        && coverage.events.split('/')[0] === coverage.events.split('/')[1]
+        && coverage.scenarios.split('/')[0] === coverage.scenarios.split('/')[1];
+}
+/** A tool that refused the request before running anything: it neither passed nor failed a review. */
+export function refusalVerdict(reason) {
+    return { verdict: 'fail', verdictReason: 'the tool did not run: ' + reason };
+}
+/**
+ * Decide the verdict from finding counts. Any error-severity finding fails the review
+ * even though the tool ran successfully — that gap is exactly what `verdict` closes.
+ */
+export function verdictOf(errors, warnings, firstCode) {
+    if (errors > 0) {
+        return {
+            verdict: 'fail',
+            // `first error:` rather than `first:`: what follows is a code, and a reader who does not know the
+            // codes should still be able to tell that this field is pointing at one. The code is the label; the
+            // finding's own `message` carries the sentence.
+            verdictReason: String(errors) + ' error finding(s)' + (firstCode === undefined ? '' : ' (first error: ' + firstCode + ')'),
+        };
+    }
+    if (warnings > 0) {
+        return { verdict: 'pass_with_findings', verdictReason: 'no error findings; ' + String(warnings) + ' warning finding(s)' };
+    }
+    return { verdict: 'pass', verdictReason: 'no error or warning findings' };
+}
+export function verdictOfFindings(findings) {
+    const errors = findings.filter((finding) => finding.severity === 'error');
+    const warnings = findings.filter((finding) => finding.severity === 'warning');
+    return verdictOf(errors.length, warnings.length, errors[0]?.code);
+}
+/**
+ * Whether a finding means "the search stopped before deciding", as opposed to "the model is wrong".
+ * Such a finding must reach `summary.truncated`, or a caller reading only that flag would take an
+ * unfinished search for a clean one.
+ *
+ * The shipped schema reference states the rule as a name: the check that stopped carries a finding
+ * whose code ends in `_UNDECIDED`, and the report sets `summary.truncated`. Read from the name, that
+ * is one rule in one place. It used to be a hand-written set of codes, and A12 and A14 minted their
+ * own codes without joining it: the report carried an undecided finding and `truncated` stayed
+ * false, so the two halves of that sentence disagreed.
+ */
+function hasUndecidedFinding(checks) {
+    return checks.some((check) => check.findings.some((finding) => finding.code.endsWith('_UNDECIDED')));
+}
+/**
+ * Paths of every `_`-prefixed key in the input, sorted (`_source`, `_verified`,
+ * `states[0]._note`; a metadata key's own children are not listed, since the subtree is
+ * metadata as a whole). The schema ignores these keys as annotation metadata; echoing
+ * them in the report makes the ignored metadata auditable instead of invisible.
+ *
+ * Iterative, with an explicit stack: this runs before validation on whatever the caller passed, so
+ * a recursive walk overflowed the stack on a deeply nested model and the `RangeError` arrived
+ * instead of any report at all. A guard nested ten thousand deep is nonsense, and it has to be
+ * refused rather than crash the walk that was going to refuse it.
+ */
+export function metadataKeysOf(input) {
+    const keys = [];
+    const stack = [{ value: input, path: '' }];
+    while (stack.length > 0) {
+        const frame = stack.pop();
+        const value = frame.value;
+        if (value === null || typeof value !== 'object')
+            continue;
+        if (Array.isArray(value)) {
+            for (let index = value.length - 1; index >= 0; index -= 1) {
+                stack.push({ value: value[index], path: frame.path + '[' + String(index) + ']' });
+            }
+            continue;
+        }
+        for (const [key, entry] of Object.entries(value)) {
+            const child = frame.path === '' ? key : frame.path + '.' + key;
+            if (key.startsWith('_'))
+                keys.push(child);
+            stack.push({ value: entry, path: child });
+        }
+    }
+    return keys.sort();
+}
+function withoutMetadata(value) {
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (Array.isArray(value))
+        return value.map((entry) => withoutMetadata(entry));
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+        if (key.startsWith('_'))
+            continue;
+        out[key] = withoutMetadata(entry);
+    }
+    return out;
+}
+/**
+ * The exact payload a hash spec hashes. Exported so the specification has one
+ * implementation and the documentation can be checked against it.
+ */
+export function hashPayload(model, spec = DEFAULT_HASH_SPEC) {
+    return spec === 'v1' ? withoutMetadata(model) : model;
+}
+export function validateModel(input) {
+    const errors = [];
+    const bad = (path, message) => {
+        errors.push(path + ': ' + message);
+    };
+    if (typeof input !== 'object' || input === null || Array.isArray(input)) {
+        return { ok: false, errors: ['model: must be an object'] };
+    }
+    const root = input;
+    // `_`-prefixed keys are annotation metadata (provenance, verification snapshots,
+    // extraction caveats). They are ignored here and excluded from the hash, so a model
+    // can carry its own archive record without a sidecar that drifts away from it.
+    // Everything else stays closed: a mistyped `sttes` must still be an error.
+    const rejectUnknownKeys = (value, allowed, path) => {
+        const unexpected = Object.keys(value).filter((key) => !allowed.has(key) && !key.startsWith('_'));
+        if (unexpected.length > 0) {
+            bad(path + '.' + unexpected[0], 'unknown field (allowed: ' + [...allowed].join(', ') + ')');
+        }
+    };
+    rejectUnknownKeys(root, MODEL_KEYS.root, 'model');
+    if (root.schemaVersion !== 1)
+        bad('schemaVersion', 'must be 1');
+    if (typeof root.init !== 'string' || root.init.length === 0)
+        bad('init', 'must be a non-empty string');
+    if (!Array.isArray(root.states) || root.states.length === 0) {
+        bad('states', 'must be a non-empty array');
+    }
+    else {
+        const seen = new Set();
+        root.states.forEach((entry, index) => {
+            if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+                bad('states[' + index + ']', 'must be an object');
+                return;
+            }
+            const state = entry;
+            rejectUnknownKeys(state, MODEL_KEYS.state, 'states[' + index + ']');
+            if (typeof state.id !== 'string' || state.id.length === 0)
+                bad('states[' + index + '].id', 'must be a non-empty string');
+            else if (seen.has(state.id))
+                bad('states[' + index + '].id', 'duplicate state id ' + state.id);
+            else
+                seen.add(state.id);
+            if (state.terminal !== undefined && typeof state.terminal !== 'boolean')
+                bad('states[' + index + '].terminal', 'must be a boolean');
+            for (const kind of ['onEntry', 'onExit']) {
+                const actions = state[kind];
+                if (actions !== undefined) {
+                    if (!Array.isArray(actions))
+                        bad('states[' + index + '].' + kind, 'must be an array of action names');
+                    else if (actions.length > 64)
+                        bad('states[' + index + '].' + kind, 'must not exceed 64 actions');
+                    else
+                        actions.forEach((action, actionIndex) => {
+                            if (typeof action !== 'string' || action.length === 0)
+                                bad('states[' + index + '].' + kind + '[' + actionIndex + ']', 'must be a non-empty string');
+                        });
+                }
+            }
+        });
+        if (typeof root.init === 'string' && root.init.length > 0 && !seen.has(root.init))
+            bad('init', 'must name a declared state');
+    }
+    if (!Array.isArray(root.transitions)) {
+        bad('transitions', 'must be an array');
+    }
+    else {
+        const stateIds = new Set(Array.isArray(root.states) ? root.states.map((state) => state.id) : []);
+        root.transitions.forEach((entry, index) => {
+            const path = 'transitions[' + index + ']';
+            if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+                bad(path, 'must be an object');
+                return;
+            }
+            const transition = entry;
+            rejectUnknownKeys(transition, MODEL_KEYS.transition, path);
+            if (typeof transition.from !== 'string' || transition.from.length === 0)
+                bad(path + '.from', 'must be a non-empty string');
+            else if (!stateIds.has(transition.from))
+                bad(path + '.from', 'unknown state ' + transition.from);
+            if (typeof transition.event !== 'string' || transition.event.length === 0)
+                bad(path + '.event', 'must be a non-empty string');
+            if (typeof transition.to !== 'string' || transition.to.length === 0)
+                bad(path + '.to', 'must be a non-empty string');
+            else if (!stateIds.has(transition.to))
+                bad(path + '.to', 'unknown state ' + transition.to);
+            if (transition.guard !== undefined)
+                validateGuard(transition.guard, path + '.guard', errors, bad);
+            if (transition.updates !== undefined) {
+                if (!Array.isArray(transition.updates))
+                    bad(path + '.updates', 'must be an array');
+                else
+                    transition.updates.forEach((update, updateIndex) => {
+                        const updatePath = path + '.updates[' + updateIndex + ']';
+                        if (typeof update !== 'object' || update === null || Array.isArray(update)) {
+                            bad(updatePath, 'must be an object');
+                            return;
+                        }
+                        const record = update;
+                        rejectUnknownKeys(record, MODEL_KEYS.update, updatePath);
+                        if (typeof record.variable !== 'string' || record.variable.length === 0)
+                            bad(updatePath + '.variable', 'must be a non-empty string');
+                        if (record.op !== 'set' && record.op !== 'inc' && record.op !== 'dec')
+                            bad(updatePath + '.op', "must be 'set', 'inc', or 'dec'");
+                        if (record.value !== undefined && (typeof record.value !== 'number' || !Number.isFinite(record.value))) {
+                            // `typeof NaN === 'number'`, so the type check alone let a NaN through, and every
+                            // comparison against a NaN is false: the update silently did nothing.
+                            bad(updatePath + '.value', 'must be a finite number');
+                        }
+                    });
+            }
+            if (transition.cost !== undefined) {
+                if (typeof transition.cost !== 'number' || !Number.isFinite(transition.cost) || transition.cost < 0)
+                    bad(path + '.cost', 'must be a non-negative finite number');
+            }
+            if (transition.weight !== undefined) {
+                if (typeof transition.weight !== 'number' || !Number.isFinite(transition.weight) || transition.weight < 0)
+                    bad(path + '.weight', 'must be a non-negative finite number');
+            }
+        });
+    }
+    if (Array.isArray(root.states)) {
+        root.states.forEach((state, index) => {
+            if (state.maxTicks !== undefined && (!Number.isInteger(state.maxTicks) || state.maxTicks < 0)) {
+                bad('states[' + index + '].maxTicks', 'must be a non-negative integer');
+            }
+        });
+    }
+    const variableNames = new Set();
+    if (root.variables !== undefined) {
+        if (!Array.isArray(root.variables))
+            bad('variables', 'must be an array');
+        else
+            root.variables.forEach((entry, index) => {
+                const path = 'variables[' + index + ']';
+                if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+                    bad(path, 'must be an object');
+                    return;
+                }
+                const variable = entry;
+                rejectUnknownKeys(variable, MODEL_KEYS.variable, path);
+                if (typeof variable.name !== 'string' || variable.name.length === 0)
+                    bad(path + '.name', 'must be a non-empty string');
+                else if (variableNames.has(variable.name))
+                    bad(path + '.name', 'duplicate variable ' + variable.name);
+                else
+                    variableNames.add(variable.name);
+                if (variable.kind !== 'integer' && variable.kind !== 'boolean')
+                    bad(path + '.kind', "must be 'integer' or 'boolean'");
+                const expected = variable.kind === 'boolean' ? 'boolean' : 'number';
+                if (typeof variable.init !== expected)
+                    bad(path + '.init', 'must be a ' + expected);
+                // `typeof NaN === 'number'`, so the type check alone accepts NaN, and a variable initialised
+                // to NaN makes every guard over it false: the model would read as if that branch were dead.
+                else if (expected === 'number' && !Number.isFinite(variable.init))
+                    bad(path + '.init', 'must be a finite number');
+                if (variable.min !== undefined && (typeof variable.min !== 'number' || !Number.isFinite(variable.min)))
+                    bad(path + '.min', 'must be a finite number');
+                if (variable.max !== undefined && (typeof variable.max !== 'number' || !Number.isFinite(variable.max)))
+                    bad(path + '.max', 'must be a finite number');
+                if (typeof variable.min === 'number' && typeof variable.max === 'number' && variable.min > variable.max)
+                    bad(path + '.max', 'must be >= min');
+                if (variable.monotonic !== undefined && variable.monotonic !== 'inc' && variable.monotonic !== 'dec')
+                    bad(path + '.monotonic', "must be 'inc' or 'dec'");
+                if (variable.kind === 'integer' && typeof variable.init === 'number') {
+                    if (typeof variable.min === 'number' && variable.init < variable.min)
+                        bad(path + '.init', 'must be >= min');
+                    if (typeof variable.max === 'number' && variable.init > variable.max)
+                        bad(path + '.init', 'must be <= max');
+                }
+            });
+    }
+    const validateVariableRef = (name, path) => {
+        if (typeof name !== 'string' || name.length === 0)
+            bad(path, 'must be a non-empty string');
+        else if (!variableNames.has(name))
+            bad(path, 'references unknown variable ' + name);
+    };
+    const invariantStateIds = new Set(Array.isArray(root.states) ? root.states.map((state) => state.id) : []);
+    // Reference sets for invariant targets: denormalising a kind's target into the
+    // report makes a mistyped id look authoritative, so every reference must resolve.
+    const invariantEventIds = new Set(Array.isArray(root.transitions) ? root.transitions.map((transition) => transition.event) : []);
+    if (root.invariants !== undefined) {
+        if (!Array.isArray(root.invariants))
+            bad('invariants', 'must be an array');
+        else
+            root.invariants.forEach((entry, index) => {
+                const path = 'invariants[' + index + ']';
+                if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+                    bad(path, 'must be an object');
+                    return;
+                }
+                const invariant = entry;
+                if (typeof invariant.id !== 'string' || invariant.id.length === 0)
+                    bad(path + '.id', 'must be a non-empty string');
+                if (typeof invariant.description !== 'string')
+                    bad(path + '.description', 'must be a string');
+                // Reject keys the selected kind does not declare instead of silently ignoring
+                // them: an ignored field (e.g. a `when` scope on a kind that cannot honor it)
+                // still shows up in the echoed report and reads as if it took effect. Kinds an
+                // older reader may not know are skipped so they still fail on `.kind` alone.
+                if (KNOWN_INVARIANT_KINDS.has(invariant.kind)) {
+                    const allowed = INVARIANT_KEYS[invariant.kind];
+                    const unexpected = Object.keys(invariant).filter((key) => !allowed.has(key) && !key.startsWith('_'));
+                    if (unexpected.length > 0) {
+                        bad(path + '.' + unexpected[0], 'unknown field for kind ' + String(invariant.kind) + ' (allowed: ' + [...allowed].join(', ') + ')');
+                    }
+                }
+                if (invariant.kind === 'never-states') {
+                    if (!Array.isArray(invariant.states) || invariant.states.length === 0)
+                        bad(path + '.states', 'must be a non-empty array');
+                    else
+                        invariant.states.forEach((state, stateIndex) => {
+                            if (typeof state !== 'string' || state.length === 0)
+                                bad(path + '.states[' + stateIndex + ']', 'must be a non-empty string');
+                            else if (!invariantStateIds.has(state))
+                                bad(path + '.states[' + stateIndex + ']', 'references unknown state ' + state);
+                        });
+                }
+                else if (invariant.kind === 'var-in-range') {
+                    validateVariableRef(invariant.variable, path + '.variable');
+                    if (invariant.min !== undefined && typeof invariant.min !== 'number')
+                        bad(path + '.min', 'must be a number');
+                    if (invariant.max !== undefined && typeof invariant.max !== 'number')
+                        bad(path + '.max', 'must be a number');
+                    if (invariant.min === undefined && invariant.max === undefined)
+                        bad(path, 'requires min or max (a range with neither bound is vacuous)');
+                    if (invariant.when !== undefined) {
+                        const when = invariant.when;
+                        if (typeof when !== 'object' || when === null || Array.isArray(when)) {
+                            bad(path + '.when', 'must be an object');
+                        }
+                        else if ('state' in when) {
+                            const scope = when;
+                            for (const key of Object.keys(scope)) {
+                                if (key !== 'state' && !key.startsWith('_'))
+                                    bad(path + '.when.' + key, 'unknown field for a state scope (allowed: state)');
+                            }
+                            const state = scope.state;
+                            if (typeof state !== 'string' || state.length === 0)
+                                bad(path + '.when.state', 'must be a non-empty string');
+                            else if (!invariantStateIds.has(state))
+                                bad(path + '.when.state', 'references unknown state ' + state);
+                        }
+                        else {
+                            validateGuard(when, path + '.when', errors, bad);
+                            for (const variable of guardVariables(when)) {
+                                if (variable === invariant.variable) {
+                                    bad(path + '.when', 'must not reference the constrained variable ' + invariant.variable + ' (it can mask its own violation)');
+                                }
+                                else {
+                                    validateVariableRef(variable, path + '.when');
+                                }
+                            }
+                        }
+                    }
+                }
+                else if (invariant.kind === 'event-before-state') {
+                    if (typeof invariant.event !== 'string' || invariant.event.length === 0)
+                        bad(path + '.event', 'must be a non-empty string');
+                    else if (!invariantEventIds.has(invariant.event))
+                        bad(path + '.event', 'references unknown event ' + invariant.event);
+                    if (typeof invariant.state !== 'string' || invariant.state.length === 0)
+                        bad(path + '.state', 'must be a non-empty string');
+                    else if (!invariantStateIds.has(invariant.state))
+                        bad(path + '.state', 'references unknown state ' + invariant.state);
+                }
+                else if (invariant.kind === 'leads-to') {
+                    if (typeof invariant.from !== 'string' || invariant.from.length === 0)
+                        bad(path + '.from', 'must be a non-empty string');
+                    else if (!invariantStateIds.has(invariant.from))
+                        bad(path + '.from', 'references unknown state ' + invariant.from);
+                    // `to` is one state id or a target set. A set with a duplicate member is a
+                    // model-authoring slip that would otherwise give one meaning two hashes, so it
+                    // is rejected rather than silently deduplicated.
+                    if (typeof invariant.to === 'string') {
+                        if (invariant.to.length === 0)
+                            bad(path + '.to', 'must be a non-empty string');
+                        else if (!invariantStateIds.has(invariant.to))
+                            bad(path + '.to', 'references unknown state ' + invariant.to);
+                    }
+                    else if (Array.isArray(invariant.to)) {
+                        if (invariant.to.length === 0)
+                            bad(path + '.to', 'must be a non-empty array of state ids');
+                        else {
+                            const targets = new Set();
+                            invariant.to.forEach((target, targetIndex) => {
+                                const at = path + '.to[' + targetIndex + ']';
+                                if (typeof target !== 'string' || target.length === 0)
+                                    bad(at, 'must be a non-empty string');
+                                else if (!invariantStateIds.has(target))
+                                    bad(at, 'references unknown state ' + target);
+                                else if (targets.has(target))
+                                    bad(at, 'duplicates state ' + target + ' in the target set');
+                                else
+                                    targets.add(target);
+                            });
+                        }
+                    }
+                    else {
+                        bad(path + '.to', 'must be a state id or a non-empty array of state ids');
+                    }
+                }
+                else if (invariant.kind === 'sequence') {
+                    if (!Array.isArray(invariant.events) || invariant.events.length === 0)
+                        bad(path + '.events', 'must be a non-empty array');
+                    else
+                        invariant.events.forEach((event, eventIndex) => {
+                            if (typeof event !== 'string' || event.length === 0)
+                                bad(path + '.events[' + eventIndex + ']', 'must be a non-empty string');
+                        });
+                }
+                else if (invariant.kind === 'atomicity') {
+                    if (!Array.isArray(invariant.events) || invariant.events.length === 0)
+                        bad(path + '.events', 'must be a non-empty array');
+                    else
+                        invariant.events.forEach((event, eventIndex) => {
+                            if (typeof event !== 'string' || event.length === 0)
+                                bad(path + '.events[' + eventIndex + ']', 'must be a non-empty string');
+                        });
+                    if (typeof invariant.commit !== 'string' || invariant.commit.length === 0)
+                        bad(path + '.commit', 'must be a non-empty string');
+                    if (invariant.rollback !== undefined && typeof invariant.rollback !== 'string')
+                        bad(path + '.rollback', 'must be a string');
+                }
+                else if (invariant.kind === 'budget') {
+                    if (typeof invariant.budget !== 'number' || !Number.isFinite(invariant.budget) || invariant.budget < 0)
+                        bad(path + '.budget', 'must be a non-negative finite number');
+                }
+                else if (invariant.kind === 'probability') {
+                    if (typeof invariant.target !== 'string' || invariant.target.length === 0)
+                        bad(path + '.target', 'must be a non-empty string');
+                    else if (!invariantStateIds.has(invariant.target))
+                        bad(path + '.target', 'references unknown state ' + invariant.target);
+                    if (invariant.op !== '>=' && invariant.op !== '<=' && invariant.op !== '>' && invariant.op !== '<')
+                        bad(path + '.op', "must be one of '>=', '<=', '>', '<'");
+                    if (typeof invariant.p !== 'number' || !Number.isFinite(invariant.p) || invariant.p < 0 || invariant.p > 1)
+                        bad(path + '.p', 'must be a number in [0, 1]');
+                }
+                else {
+                    bad(path + '.kind', 'unknown invariant kind');
+                }
+            });
+    }
+    if (root.concurrentPairs !== undefined) {
+        if (!Array.isArray(root.concurrentPairs))
+            bad('concurrentPairs', 'must be an array');
+        else
+            root.concurrentPairs.forEach((entry, index) => {
+                const path = 'concurrentPairs[' + index + ']';
+                if (!Array.isArray(entry) || entry.length !== 2 || typeof entry[0] !== 'string' || typeof entry[1] !== 'string') {
+                    bad(path, 'must be a [event, event] string pair');
+                }
+            });
+    }
+    if (root.boundaryChecks !== undefined) {
+        if (!Array.isArray(root.boundaryChecks))
+            bad('boundaryChecks', 'must be an array');
+        else
+            root.boundaryChecks.forEach((entry, index) => {
+                const path = 'boundaryChecks[' + index + ']';
+                if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+                    bad(path, 'must be an object');
+                    return;
+                }
+                const check = entry;
+                rejectUnknownKeys(check, MODEL_KEYS.boundaryCheck, path);
+                validateVariableRef(check.variable, path + '.variable');
+                if (!Array.isArray(check.values) || check.values.some((value) => typeof value !== 'number'))
+                    bad(path + '.values', 'must be an array of numbers');
+            });
+    }
+    if (root.idempotentEvents !== undefined) {
+        if (!Array.isArray(root.idempotentEvents))
+            bad('idempotentEvents', 'must be an array');
+        else
+            root.idempotentEvents.forEach((entry, index) => {
+                if (typeof entry !== 'string' || entry.length === 0)
+                    bad('idempotentEvents[' + index + ']', 'must be a non-empty string');
+            });
+    }
+    if (root.tickEvents !== undefined) {
+        if (!Array.isArray(root.tickEvents))
+            bad('tickEvents', 'must be an array');
+        else
+            root.tickEvents.forEach((entry, index) => {
+                if (typeof entry !== 'string' || entry.length === 0)
+                    bad('tickEvents[' + index + ']', 'must be a non-empty string');
+            });
+    }
+    if (root.resourcePairs !== undefined) {
+        if (!Array.isArray(root.resourcePairs))
+            bad('resourcePairs', 'must be an array');
+        else
+            root.resourcePairs.forEach((entry, index) => {
+                const path = 'resourcePairs[' + index + ']';
+                if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+                    bad(path, 'must be an object');
+                    return;
+                }
+                const pair = entry;
+                rejectUnknownKeys(pair, MODEL_KEYS.resourcePair, path);
+                if (typeof pair.resource !== 'string' || pair.resource.length === 0)
+                    bad(path + '.resource', 'must be a non-empty string');
+                if (typeof pair.acquireEvent !== 'string' || pair.acquireEvent.length === 0)
+                    bad(path + '.acquireEvent', 'must be a non-empty string');
+                if (typeof pair.releaseEvent !== 'string' || pair.releaseEvent.length === 0)
+                    bad(path + '.releaseEvent', 'must be a non-empty string');
+                if (pair.failEvent !== undefined && typeof pair.failEvent !== 'string')
+                    bad(path + '.failEvent', 'must be a string');
+            });
+    }
+    if (root.narrative !== undefined) {
+        const narrativePath = 'narrative';
+        if (typeof root.narrative !== 'object' || root.narrative === null || Array.isArray(root.narrative)) {
+            bad(narrativePath, 'must be an object');
+        }
+        else {
+            const narrative = root.narrative;
+            rejectUnknownKeys(narrative, MODEL_KEYS.narrative, narrativePath);
+            const stateIds = new Set(Array.isArray(root.states) ? root.states.map((state) => state.id) : []);
+            const eventIds = new Set(Array.isArray(root.transitions) ? root.transitions.map((transition) => transition.event) : []);
+            // A narrative is allowed to cover part of the model: states first, events and
+            // scenarios later is the natural authoring order, and `narrativeCoverage` reports
+            // what is still missing instead of rejecting the file. What stays an error is a
+            // narrative that is *wrong* (unknown id, empty description, duplicate scenario) or
+            // empty — an empty block claims documentation that does not exist.
+            const declaredDimensions = ['states', 'events', 'scenarios'].filter((key) => narrative[key] !== undefined);
+            if (declaredDimensions.length === 0) {
+                bad(narrativePath, 'declares no dimension: give at least one of states, events or scenarios (a partial narrative is fine)');
+            }
+            if (narrative.states !== undefined) {
+                if (typeof narrative.states !== 'object' || narrative.states === null || Array.isArray(narrative.states)) {
+                    bad(narrativePath + '.states', 'must be an object mapping state id -> natural-language description');
+                }
+                else {
+                    for (const [id, description] of Object.entries(narrative.states)) {
+                        if (!stateIds.has(id))
+                            bad(narrativePath + '.states', 'references unknown state ' + id);
+                        if (typeof description !== 'string' || description.length === 0)
+                            bad(narrativePath + '.states.' + id, 'must be a non-empty string');
+                    }
+                }
+            }
+            if (narrative.events !== undefined) {
+                if (typeof narrative.events !== 'object' || narrative.events === null || Array.isArray(narrative.events)) {
+                    bad(narrativePath + '.events', 'must be an object mapping event id -> natural-language description');
+                }
+                else {
+                    for (const [id, description] of Object.entries(narrative.events)) {
+                        if (!eventIds.has(id))
+                            bad(narrativePath + '.events', 'references unknown event ' + id);
+                        if (typeof description !== 'string' || description.length === 0)
+                            bad(narrativePath + '.events.' + id, 'must be a non-empty string');
+                    }
+                }
+            }
+            if (narrative.scenarios !== undefined) {
+                if (!Array.isArray(narrative.scenarios)) {
+                    bad(narrativePath + '.scenarios', 'must be an array of { from, event, scenario }');
+                }
+                else {
+                    const seen = new Set();
+                    narrative.scenarios.forEach((entry, index) => {
+                        const scenarioPath = narrativePath + '.scenarios[' + index + ']';
+                        if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+                            bad(scenarioPath, 'must be an object');
+                            return;
+                        }
+                        const scenario = entry;
+                        rejectUnknownKeys(scenario, MODEL_KEYS.scenario, scenarioPath);
+                        if (typeof scenario.from !== 'string' || scenario.from.length === 0)
+                            bad(scenarioPath + '.from', 'must be a non-empty string');
+                        else if (!stateIds.has(scenario.from))
+                            bad(scenarioPath + '.from', 'unknown state ' + scenario.from);
+                        if (typeof scenario.event !== 'string' || scenario.event.length === 0)
+                            bad(scenarioPath + '.event', 'must be a non-empty string');
+                        else if (!eventIds.has(scenario.event))
+                            bad(scenarioPath + '.event', 'unknown event ' + scenario.event);
+                        if (typeof scenario.scenario !== 'string' || scenario.scenario.length === 0)
+                            bad(scenarioPath + '.scenario', 'must be a non-empty string');
+                        const key = String(scenario.from) + '|' + String(scenario.event);
+                        if (seen.has(key))
+                            bad(scenarioPath, 'duplicate scenario for (' + scenario.from + ', ' + scenario.event + ')');
+                        seen.add(key);
+                    });
+                }
+            }
+        }
+    }
+    // Guard/update variable references were validated structurally; re-walk for references.
+    if (Array.isArray(root.transitions)) {
+        for (const entry of root.transitions) {
+            walkGuardReferences(entry.guard, variableNames, errors, bad);
+            for (const update of entry.updates ?? []) {
+                if (!variableNames.has(update.variable))
+                    bad('transitions.updates', 'references unknown variable ' + update.variable);
+                if (update.op !== 'set' && update.value !== undefined && update.value === 0) {
+                    // zero delta is harmless; no finding
+                }
+            }
+        }
+    }
+    if (errors.length > 0)
+        return { ok: false, errors };
+    return { ok: true, model: root };
+}
+/**
+ * Event names in the adversarial declarations that no transition and no entry/exit action
+ * declares.
+ *
+ * The robustness audit called this the dominant defect class: a misspelled name made a check
+ * skip and then report its all-clear - "All pairs balanced", "No race conditions detected", "All
+ * deadlines respected" - for a model it never ran on. A reader cannot tell an empty check from a
+ * passing one, which is what a verifier must never do.
+ *
+ * A name that resolves to nothing is reported by the check that would have used it, not refused
+ * by validation, because for some fields the absence IS the defect: a
+ * `resourcePairs[].releaseEvent` naming a step nobody built is what `A4_NO_RELEASE_EVENT` says,
+ * and refusing it would replace a finding that names the missing step with a generic one.
+ */
+export function unresolvedEventNames(root) {
+    const declared = new Set(Array.isArray(root.transitions) ? root.transitions.map((transition) => transition.event) : []);
+    // `onEntry`/`onExit` actions count: A4 treats them as implicit acquire/release events, so a
+    // lock modelled as an entry action is declared even though no transition names it.
+    if (Array.isArray(root.states)) {
+        for (const state of root.states) {
+            for (const action of state.onEntry ?? [])
+                declared.add(action);
+            for (const action of state.onExit ?? [])
+                declared.add(action);
+        }
+    }
+    const found = [];
+    const note = (value, path, check) => {
+        if (typeof value !== 'string' || declared.has(value))
+            return;
+        found.push({ path, value, check });
+    };
+    if (Array.isArray(root.concurrentPairs)) {
+        root.concurrentPairs.forEach((entry, index) => {
+            if (!Array.isArray(entry) || entry.length !== 2)
+                return;
+            note(entry[0], 'concurrentPairs[' + String(index) + '][0]', 'A2');
+            note(entry[1], 'concurrentPairs[' + String(index) + '][1]', 'A2');
+        });
+    }
+    if (Array.isArray(root.idempotentEvents)) {
+        root.idempotentEvents.forEach((entry, index) => note(entry, 'idempotentEvents[' + String(index) + ']', 'A8'));
+    }
+    if (Array.isArray(root.tickEvents)) {
+        root.tickEvents.forEach((entry, index) => note(entry, 'tickEvents[' + String(index) + ']', 'A14'));
+    }
+    if (Array.isArray(root.resourcePairs)) {
+        root.resourcePairs.forEach((entry, index) => {
+            if (typeof entry !== 'object' || entry === null || Array.isArray(entry))
+                return;
+            const pair = entry;
+            const path = 'resourcePairs[' + String(index) + ']';
+            note(pair.acquireEvent, path + '.acquireEvent', 'A4');
+            note(pair.releaseEvent, path + '.releaseEvent', 'A4');
+            note(pair.failEvent, path + '.failEvent', 'A6');
+        });
+    }
+    return found;
+}
+/**
+ * The check's own findings, plus a note for each declared event name it did not already account
+ * for.
+ *
+ * The severity is a warning, and that is a measured decision rather than a hedge. Three shapes
+ * exist, and the repository's own textbook cases pin all three:
+ *
+ * - the check can still run and reports the defect itself (`A4_NO_RELEASE_EVENT`,
+ *   `A6_NO_FAILURE_HANDLER`): the check's code owns it and the sweep stays silent. The textbook
+ *   semaphore case declares `failEvent: 'timeout'`, a name that exists nowhere, and expects A6
+ *   to fire with no error - because "there is no timeout handler" is the defect;
+ * - the check cannot run at all because the name resolved to nothing (A2 with a misnamed pair,
+ *   A8, A14, and A4's acquire event): its `detail` would otherwise read "No race conditions
+ *   detected" beside a `fail` status, and the finding supplies what the `detail` cannot;
+ * - a check with nothing to run on for other reasons is a `skip`, and stays one.
+ *
+ * Raising it to an error would make a working model unshippable for a merely sloppy declaration,
+ * which is a different defect from a check that lied about what it examined.
+ */
+function withUnresolved(model, check, findings) {
+    const accounted = new Set();
+    for (const finding of findings) {
+        const event = finding.evidence?.event;
+        if (typeof event === 'string')
+            accounted.add(event);
+    }
+    const extra = unresolvedEventNames(model)
+        .filter((entry) => entry.check === check && !accounted.has(entry.value))
+        .map((entry) => ({
+        code: 'MODEL_UNRESOLVED_EVENT',
+        severity: 'warning',
+        message: entry.path + ': no transition and no entry/exit action declares ' + JSON.stringify(entry.value) + ', so ' + entry.check + ' had nothing to run on it. Declare the event, or remove the declaration if it is a typo',
+        detail: 'While a declared name resolves to nothing, this check reports a result it did not earn. The rest of the report is unaffected: the name is a declaration defect, not a model defect.',
+        evidence: { path: entry.path, event: entry.value, check: entry.check },
+    }));
+    return extra.length === 0 ? findings : [...findings, ...extra];
+}
+/**
+ * How deeply a guard may nest.
+ *
+ * A guard is a boolean expression a person writes and reads. The limit is a structural prior
+ * rather than a runtime catch: the depth is decided while walking, so the walk must not itself be
+ * recursive - a recursive validator overflowed the stack BEFORE it could reach a depth of thirty
+ * two, which is the defect this limit was meant to prevent.
+ */
+const MAX_GUARD_DEPTH = 32;
+/**
+ * Validate a guard tree, iteratively.
+ *
+ * The walk uses an explicit stack for the reason above: recursion here would make the depth limit
+ * unreachable, and a guard nested ten thousand deep has to produce the refusal below rather than a
+ * `RangeError` the caller cannot route on.
+ */
+function validateGuard(input, path, errors, bad) {
+    const stack = [{ node: input, path, depth: 0 }];
+    while (stack.length > 0) {
+        const frame = stack.pop();
+        const node = frame.node;
+        if (frame.depth > MAX_GUARD_DEPTH) {
+            bad(frame.path, 'nests more than ' + String(MAX_GUARD_DEPTH) + ' levels deep. A guard is a boolean expression over model variables; one this deep is not read by a person.');
+            continue;
+        }
+        if (typeof node !== 'object' || node === null || Array.isArray(node)) {
+            bad(frame.path, 'must be an object');
+            continue;
+        }
+        const guard = node;
+        if (guard.variable !== undefined) {
+            if (typeof guard.variable !== 'string' || guard.variable.length === 0)
+                bad(frame.path + '.variable', 'must be a non-empty string');
+            if (guard.op !== '==' && guard.op !== '!=' && guard.op !== '<' && guard.op !== '<=' && guard.op !== '>' && guard.op !== '>=') {
+                bad(frame.path + '.op', 'must be a comparison operator');
+            }
+            if (typeof guard.value !== 'number' && typeof guard.value !== 'boolean')
+                bad(frame.path + '.value', 'must be a number or boolean');
+            // A NaN operand makes every comparison false, so the branch would read as dead and the model
+            // would say it has a condition it can never satisfy.
+            else if (typeof guard.value === 'number' && !Number.isFinite(guard.value))
+                bad(frame.path + '.value', 'must be a finite number');
+            continue;
+        }
+        let pushed = false;
+        for (const key of ['all', 'any']) {
+            const children = guard[key];
+            if (children === undefined)
+                continue;
+            pushed = true;
+            if (!Array.isArray(children)) {
+                bad(frame.path + '.' + key, 'must be an array');
+                break;
+            }
+            if (children.length === 0) {
+                // Vacuously true for `all`, vacuously false for `any`: the first makes a guarded transition
+                // unconditional, the second makes a live branch dead.
+                bad(frame.path + '.' + key, key === 'all'
+                    ? 'must not be empty: an empty conjunction is always true, which would make this transition unconditional while it reads as guarded'
+                    : 'must not be empty: an empty disjunction is always false, so this transition can never fire');
+                break;
+            }
+            for (let index = children.length - 1; index >= 0; index -= 1) {
+                stack.push({ node: children[index], path: frame.path + '.' + key + '[' + String(index) + ']', depth: frame.depth + 1 });
+            }
+            break;
+        }
+        if (pushed)
+            continue;
+        if (guard.not !== undefined) {
+            stack.push({ node: guard.not, path: frame.path + '.not', depth: frame.depth + 1 });
+            continue;
+        }
+        bad(frame.path, 'must be a leaf ({ variable, op, value }), { all }, { any }, or { not }');
+    }
+}
+/**
+ * Every variable a guard names.
+ *
+ * Total over arbitrary JSON, and iterative for the same reason `validateGuard` is: this runs while
+ * validating, so a recursive walk overflows the stack on a deeply nested guard and the caller gets a
+ * `RangeError` instead of the refusal that says the guard is too deep. A node it does not recognise
+ * contributes no references, which is the safe direction - the guard is already an error, so nothing
+ * is decided from it either way.
+ */
+function isGuardObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function walkGuardReferences(guard, variableNames, errors, bad) {
+    const stack = [guard];
+    while (stack.length > 0) {
+        const node = stack.pop();
+        if (node === undefined)
+            continue;
+        if (!isGuardObject(node))
+            continue;
+        if (node.variable !== undefined) {
+            if (typeof node.variable !== 'string')
+                continue;
+            if (!variableNames.has(node.variable))
+                bad('guard', 'references unknown variable ' + node.variable);
+            continue;
+        }
+        let descended = false;
+        for (const key of ['all', 'any']) {
+            const children = node[key];
+            if (children === undefined)
+                continue;
+            descended = true;
+            // An empty array is the degenerate answer - true for `all`, false for `any` - and
+            // `validateGuard` refuses it. Here it simply carries no references.
+            if (!Array.isArray(children))
+                break;
+            for (const child of children)
+                stack.push(child);
+            break;
+        }
+        if (descended)
+            continue;
+        if (node.not !== undefined)
+            stack.push(node.not);
+    }
+}
+/**
+ * Every variable a guard names, total and iterative for the same reasons as
+ * `walkGuardReferences`.
+ */
+export function guardVariables(guard) {
+    const found = [];
+    const stack = [guard];
+    while (stack.length > 0) {
+        const node = stack.pop();
+        if (node === undefined)
+            continue;
+        if (!isGuardObject(node))
+            continue;
+        if (typeof node.variable === 'string') {
+            found.push(node.variable);
+            continue;
+        }
+        let descended = false;
+        for (const key of ['all', 'any']) {
+            const children = node[key];
+            if (children === undefined)
+                continue;
+            descended = true;
+            if (!Array.isArray(children))
+                break;
+            for (const child of children)
+                stack.push(child);
+            break;
+        }
+        if (descended)
+            continue;
+        if (node.not !== undefined)
+            stack.push(node.not);
+    }
+    return found;
+}
+/**
+ * Whether a guard holds, TOTAL over arbitrary JSON.
+ *
+ * A node that is not one of the four shapes is a guard that is never true, so a malformed guard
+ * cannot fire a transition. Safely false is the right answer rather than a throw: the validator has
+ * already refused the model, and a review that crashes tells the caller less than a review that
+ * names the field that is wrong.
+ */
+function evalGuard(guard, vars) {
+    if (!isGuardObject(guard))
+        return false;
+    if (typeof guard.variable === 'string') {
+        const actual = vars[guard.variable];
+        switch (guard.op) {
+            case '==': return actual === guard.value;
+            case '!=': return actual !== guard.value;
+            case '<': return actual < guard.value;
+            case '<=': return actual <= guard.value;
+            case '>': return actual > guard.value;
+            case '>=': return actual >= guard.value;
+        }
+        return false;
+    }
+    for (const key of ['all', 'any']) {
+        const children = guard[key];
+        if (children === undefined)
+            continue;
+        // An empty conjunction is true and an empty disjunction is false, which is also what
+        // every/some do. The validator refuses both; this keeps the evaluator total for a model that
+        // arrived anyway.
+        if (!Array.isArray(children))
+            return false;
+        return key === 'all'
+            ? children.every((child) => evalGuard(child, vars))
+            : children.some((child) => evalGuard(child, vars));
+    }
+    if (guard.not !== undefined)
+        return !evalGuard(guard.not, vars);
+    return false;
+}
+function initialState(model) {
+    const vars = {};
+    for (const variable of model.variables ?? [])
+        vars[variable.name] = variable.init;
+    return { state: model.init, vars };
+}
+function runtimeKey(runtime) {
+    return runtime.state + '|' + stableStringify(runtime.vars);
+}
+function applyUpdates(model, transition, runtime) {
+    const vars = { ...runtime.vars };
+    for (const update of transition.updates ?? []) {
+        const current = vars[update.variable];
+        if (update.op === 'set')
+            vars[update.variable] = update.value ?? 0;
+        else if (update.op === 'inc')
+            vars[update.variable] = ((typeof current === 'number' ? current : 0) + (update.value ?? 1));
+        else
+            vars[update.variable] = ((typeof current === 'number' ? current : 0) - (update.value ?? 1));
+    }
+    return { state: transition.to, vars };
+}
+function groupTransitions(model) {
+    const groups = new Map();
+    for (const transition of model.transitions) {
+        const key = transition.from + '|' + transition.event;
+        const list = groups.get(key) ?? [];
+        list.push(transition);
+        groups.set(key, list);
+    }
+    return groups;
+}
+function applicableTransitions(group, runtime) {
+    const guarded = [];
+    const unguarded = [];
+    for (const transition of group) {
+        if (transition.guard === undefined)
+            unguarded.push(transition);
+        else
+            guarded.push(transition);
+    }
+    const matched = guarded.filter((transition) => evalGuard(transition.guard, runtime.vars));
+    if (matched.length > 0)
+        return matched;
+    return unguarded;
+}
+function stepRuntime(model, runtime, event) {
+    const group = groupTransitions(model).get(runtime.state + '|' + event);
+    if (group === undefined || group.length === 0)
+        return [];
+    const seen = new Set();
+    const outcomes = [];
+    for (const transition of applicableTransitions(group, runtime)) {
+        const next = applyUpdates(model, transition, runtime);
+        const key = runtimeKey(next);
+        if (!seen.has(key)) {
+            seen.add(key);
+            outcomes.push(next);
+        }
+    }
+    return outcomes;
+}
+function explore(model, options) {
+    const init = initialState(model);
+    const reachable = [];
+    const reachableKeys = new Set();
+    const queue = [init];
+    let truncated = false;
+    while (queue.length > 0) {
+        const runtime = queue.shift();
+        const key = runtimeKey(runtime);
+        if (reachableKeys.has(key))
+            continue;
+        reachableKeys.add(key);
+        reachable.push(runtime);
+        if (reachable.length > options.maxStates) {
+            truncated = true;
+            break;
+        }
+        for (const event of allEvents(model)) {
+            for (const next of stepRuntime(model, runtime, event)) {
+                if (!reachableKeys.has(runtimeKey(next)))
+                    queue.push(next);
+            }
+        }
+    }
+    return { reachable, reachableKeys, truncated, initialState: init };
+}
+function allEvents(model) {
+    return [...new Set(model.transitions.map((transition) => transition.event))].sort();
+}
+function stateById(model, id) {
+    return model.states.find((state) => state.id === id);
+}
+function isTerminal(model, state) {
+    return stateById(model, state)?.terminal === true;
+}
+function uniqueTargets(transitions) {
+    return [...new Set(transitions.map((transition) => transition.to))];
+}
+/**
+ * What a check would have needed in order to examine anything, or `undefined` if it had it.
+ *
+ * The verification family had no way to say "I did not look": a check whose vocabulary was empty
+ * returned `pass` with a detail like "No budget invariants declared", and `summary.checksRun` counted
+ * it as run. The design family has always reported `skip` for the same situation, and this file's own
+ * doctrine says a check with nothing to run on "is a `skip`, and stays one" - so `pass` here was the
+ * false green the repository forbids, not a stylistic difference.
+ *
+ * The table is one place on purpose. Eleven return sites across eleven functions would each have to
+ * remember, and the twelfth would be the one that forgot. A check that produced a finding is never
+ * turned into a skip: the finding is evidence that something was examined, and a name that resolved to
+ * nothing is exactly the case where the check cannot run but must still fail loudly.
+ */
+function nothingToExamine(id, model) {
+    const invariantsOfKind = (kind) => (model.invariants ?? []).filter((invariant) => invariant.kind === kind).length;
+    switch (id) {
+        case 'S7':
+            // S7 decides state predicates. A roster of path-property invariants alone leaves it nothing to decide,
+            // and "All invariants hold" over that roster is a pass over nothing: the verdict belongs to A9-A13.
+            return (model.invariants ?? []).filter((invariant) => !isPathPropertyInvariant(invariant)).length === 0
+                ? 'no never-states or var-in-range invariant was declared'
+                : undefined;
+        case 'A7':
+            return (model.invariants ?? []).length === 0 ? 'no invariants were declared' : undefined;
+        case 'A2':
+        case 'A4':
+            return (model.concurrentPairs ?? []).length === 0 ? 'no concurrent pairs were declared' : undefined;
+        case 'A3': {
+            const events = new Set(model.transitions.map((transition) => transition.event));
+            return events.size < 2 ? 'fewer than two distinct events to permute' : undefined;
+        }
+        case 'A5':
+            return (model.boundaryChecks ?? []).length === 0 ? 'no boundary checks were declared' : undefined;
+        case 'A6':
+            return (model.resourcePairs ?? []).length === 0 ? 'no resource pairs were declared' : undefined;
+        case 'A8':
+            return (model.idempotentEvents ?? []).length === 0 ? 'no idempotent events were declared' : undefined;
+        case 'S8':
+            return (model.variables ?? []).length === 0 ? 'no variables were declared' : undefined;
+        case 'S6':
+            return model.transitions.some((transition) => transition.guard !== undefined) ? undefined : 'no transition declares a guard';
+        case 'A9':
+            return invariantsOfKind('leads-to') === 0 ? 'no leads-to invariant was declared' : undefined;
+        case 'A10':
+            return invariantsOfKind('sequence') === 0 ? 'no sequence invariant was declared' : undefined;
+        case 'A11':
+            return invariantsOfKind('atomicity') === 0 ? 'no atomicity invariant was declared' : undefined;
+        case 'A12':
+            return invariantsOfKind('budget') === 0 ? 'no budget invariant was declared' : undefined;
+        case 'A13':
+            return invariantsOfKind('probability') === 0 ? 'no probability invariant was declared' : undefined;
+        case 'A14':
+            return model.states.some((state) => state.maxTicks !== undefined) ? undefined : 'no state declares maxTicks';
+        default:
+            return undefined;
+    }
+}
+function checkResult(id, name, findings, detail) {
+    const errors = findings.filter((finding) => finding.severity === 'error').length;
+    const warnings = findings.filter((finding) => finding.severity === 'warning').length;
+    return {
+        id,
+        name,
+        // An info finding is a note, not a defect: it must not flip a check to `fail`, or the
+        // check would be dragged into the "resolve the failing checks" list for a remark.
+        status: errors + warnings === 0 ? 'pass' : 'fail',
+        detail: detail + (errors > 0 ? ' (' + errors + ' errors' + (warnings > 0 ? ', ' + warnings + ' warnings' : '') + ')' : warnings > 0 ? ' (' + warnings + ' warnings)' : ''),
+        findings,
+    };
+}
+// ---------------------------------------------------------------------------
+// S1-S8
+// ---------------------------------------------------------------------------
+function S1_reachability(model, exploration) {
+    const reached = new Set(exploration.reachable.map((runtime) => runtime.state));
+    const unreachable = model.states.filter((state) => !reached.has(state.id)).map((state) => state.id);
+    const findings = unreachable.map((state) => ({
+        code: 'S1_UNREACHABLE_STATE',
+        severity: 'warning',
+        message: 'State ' + state + ' is not reachable from init.',
+    }));
+    return checkResult('S1', 'Reachability', findings, unreachable.length === 0 ? 'All states reachable' : 'Unreachable states: ' + unreachable.join(', '));
+}
+function S2_deadlock(model) {
+    const outgoing = new Set(model.transitions.map((transition) => transition.from));
+    const findings = [];
+    for (const state of model.states) {
+        if (state.terminal === true)
+            continue;
+        if (!outgoing.has(state.id)) {
+            findings.push({
+                code: 'S2_NO_TRANSITIONS',
+                severity: 'error',
+                message: 'Non-terminal state ' + state.id + ' has no outgoing transitions.',
+            });
+        }
+    }
+    return checkResult('S2', 'Deadlock', findings, findings.length === 0 ? 'No deadlocks' : 'Deadlocks: ' + findings.map((finding) => finding.message).join('; '));
+}
+function sccs(model) {
+    const states = model.states.map((state) => state.id);
+    const edges = new Map();
+    for (const state of states)
+        edges.set(state, []);
+    for (const transition of model.transitions) {
+        const list = edges.get(transition.from);
+        if (list !== undefined)
+            list.push(transition.to);
+    }
+    let index = 0;
+    const indices = new Map();
+    const low = new Map();
+    const onStack = new Set();
+    const stack = [];
+    const components = [];
+    const visit = (node) => {
+        indices.set(node, index);
+        low.set(node, index);
+        index += 1;
+        stack.push(node);
+        onStack.add(node);
+        for (const next of edges.get(node) ?? []) {
+            if (!indices.has(next)) {
+                visit(next);
+                low.set(node, Math.min(low.get(node), low.get(next)));
+            }
+            else if (onStack.has(next)) {
+                low.set(node, Math.min(low.get(node), indices.get(next)));
+            }
+        }
+        if (low.get(node) === indices.get(node)) {
+            const component = [];
+            while (stack.length > 0) {
+                const member = stack.pop();
+                onStack.delete(member);
+                component.push(member);
+                if (member === node)
+                    break;
+            }
+            components.push(component);
+        }
+    };
+    for (const state of states) {
+        if (!indices.has(state))
+            visit(state);
+    }
+    return components;
+}
+function S3_liveness(model) {
+    const components = sccs(model);
+    const findings = [];
+    for (const component of components) {
+        const componentSet = new Set(component);
+        const internalEdges = model.transitions.filter((transition) => componentSet.has(transition.from) && componentSet.has(transition.to));
+        const escapingEdges = model.transitions.filter((transition) => componentSet.has(transition.from) && !componentSet.has(transition.to));
+        if (internalEdges.length === 0 || escapingEdges.length > 0)
+            continue;
+        if (component.some((state) => isTerminal(model, state)))
+            continue;
+        findings.push({
+            code: 'S3_CLOSED_SCC',
+            severity: 'error',
+            message: 'Closed SCC has no exit and contains no terminal state: ' + component.sort().join(', '),
+            evidence: { states: component.sort(), transitions: internalEdges.length },
+        });
+    }
+    return checkResult('S3', 'Liveness', findings, findings.length === 0 ? 'No harmful closed SCCs' : 'Closed SCCs: ' + findings.length);
+}
+function assignmentsFor(model, variables) {
+    const specs = (model.variables ?? []).filter((variable) => variables.includes(variable.name));
+    let combinations = [{}];
+    for (const spec of specs) {
+        let values;
+        if (spec.kind === 'boolean')
+            values = [false, true];
+        else {
+            const constants = collectGuardConstants(model).filter((value) => guardLeaves(model).some((leaf) => leaf.variable === spec.name && typeof leaf.value === 'number' && leaf.value === value));
+            if (spec.min !== undefined && spec.max !== undefined) {
+                values = [];
+                for (let value = spec.min; value <= spec.max && value <= spec.min + 200; value++)
+                    values.push(value);
+            }
+            else {
+                const set = new Set([-1, 0, 1, ...constants]);
+                values = [...set].sort((a, b) => a - b);
+            }
+        }
+        const next = [];
+        for (const assignment of combinations) {
+            for (const value of values) {
+                next.push({ ...assignment, [spec.name]: value });
+                if (next.length > 10_000)
+                    return null;
+            }
+        }
+        combinations = next;
+    }
+    return combinations;
+}
+function guardLeaves(model) {
+    const leaves = [];
+    const visit = (guard) => {
+        if ('variable' in guard)
+            leaves.push(guard);
+        else if ('all' in guard)
+            guard.all.forEach(visit);
+        else if ('any' in guard)
+            guard.any.forEach(visit);
+        else if ('not' in guard)
+            visit(guard.not);
+    };
+    for (const transition of model.transitions)
+        if (transition.guard !== undefined)
+            visit(transition.guard);
+    return leaves;
+}
+function collectGuardConstants(model) {
+    return guardLeaves(model).filter((leaf) => typeof leaf.value === 'number').map((leaf) => leaf.value);
+}
+/** How a variable value prints in a message. Shared by every finding that quotes one. */
+function varValueLabel(value) {
+    return typeof value === 'boolean' ? (value ? 'true' : 'false') : String(value);
+}
+/** Deterministic value order: booleans first, then numbers ascending. */
+function compareVarValues(a, b) {
+    const rank = (value) => typeof value === 'number' ? [1, value] : [0, value ? 1 : 0];
+    const [rankA, numberA] = rank(a);
+    const [rankB, numberB] = rank(b);
+    return rankA === rankB ? numberA - numberB : rankA - rankB;
+}
+/**
+ * Values each variable can actually hold, as an over-approximation: `init` plus every
+ * `set` constant the model writes. `null` means "unknown", which is what an `inc` or
+ * `dec` update produces — the reachable set is then unbounded and nothing can be
+ * concluded from it.
+ *
+ * The union is taken across the whole model rather than per state, so the answer can
+ * only be too large, never too small. A guard this function calls dead is therefore
+ * dead in every state, while a live guard may still be unreachable in a particular one.
+ */
+function attainableValues(model) {
+    const attainable = new Map();
+    for (const variable of model.variables ?? [])
+        attainable.set(variable.name, new Set([variable.init]));
+    for (const transition of model.transitions) {
+        for (const update of transition.updates ?? []) {
+            if (!attainable.has(update.variable))
+                continue;
+            if (update.op === 'inc' || update.op === 'dec') {
+                attainable.set(update.variable, null);
+                continue;
+            }
+            const values = attainable.get(update.variable);
+            if (values === null || values === undefined)
+                continue;
+            values.add(update.value ?? 0);
+        }
+    }
+    return attainable;
+}
+/**
+ * Guarded transitions whose guard no reachable variable value can satisfy: the branch
+ * is dead code, and a model that relies on it is not the model the author wrote. This
+ * is the dual of S6_INCOMPLETE_GUARD — a group that never reaches a branch, rather
+ * than one that falls through every branch.
+ *
+ * The test runs over {@link attainableValues}, not over the declared domain: a guard
+ * on a variable the model only ever sets to one of its declared values is satisfiable
+ * on paper and dead in practice, which is exactly the defect worth reporting.
+ */
+function deadGuardFindings(model) {
+    const attainable = attainableValues(model);
+    const findings = [];
+    for (const [key, group] of groupTransitions(model)) {
+        const [from, event] = key.split('|');
+        for (const transition of group) {
+            if (transition.guard === undefined)
+                continue;
+            const names = [...new Set(guardVariables(transition.guard))].filter((name) => attainable.has(name)).sort();
+            if (names.length === 0)
+                continue;
+            const domains = [];
+            let known = true;
+            for (const name of names) {
+                const values = attainable.get(name);
+                if (values === undefined || values === null || values.size === 0) {
+                    known = false;
+                    break;
+                }
+                domains.push(values);
+            }
+            if (!known)
+                continue;
+            let size = 1;
+            for (const values of domains)
+                size *= values.size;
+            if (size > 10_000)
+                continue;
+            const assignment = {};
+            const satisfiable = (index) => {
+                if (index === names.length)
+                    return evalGuard(transition.guard, assignment);
+                for (const value of [...domains[index]].sort(compareVarValues)) {
+                    assignment[names[index]] = value;
+                    if (satisfiable(index + 1))
+                        return true;
+                }
+                return false;
+            };
+            if (satisfiable(0))
+                continue;
+            findings.push({
+                code: 'S6_DEAD_GUARD',
+                severity: 'warning',
+                message: from + ' + ' + event + ' has a guard that can never hold: ' + names.map((name) => name + ' is only ever ' + [...attainable.get(name)].sort(compareVarValues).map(varValueLabel).join('/')).join(', ') + '. The branch is dead.',
+                evidence: { guard: transition.guard, attainable: names.map((name) => ({ variable: name, values: [...attainable.get(name)].sort(compareVarValues).map(varValueLabel) })) },
+            });
+        }
+    }
+    return findings;
+}
+function analyzeGuards(model) {
+    const determinism = [];
+    const completeness = [];
+    let truncated = false;
+    const groups = groupTransitions(model);
+    for (const [key, group] of groups) {
+        const [from, event] = key.split('|');
+        const unguarded = group.filter((transition) => transition.guard === undefined);
+        const guarded = group.filter((transition) => transition.guard !== undefined);
+        if (unguarded.length > 1) {
+            determinism.push({
+                code: 'S4_AMBIGUOUS_DEFAULT',
+                severity: 'error',
+                message: from + ' + ' + event + ' has multiple unconditional transitions: ' + uniqueTargets(unguarded).join(', '),
+            });
+        }
+        if (guarded.length === 0)
+            continue;
+        const variables = [...new Set(group.flatMap((transition) => guardVariables(transition.guard)))];
+        const assignments = assignmentsFor(model, variables);
+        if (assignments === null) {
+            completeness.push({ code: 'S6_UNBOUNDED_DOMAIN', severity: 'warning', message: from + ' + ' + event + ': guard domain too large to enumerate; exhaustive check skipped.' });
+            truncated = true;
+            continue;
+        }
+        const targets = uniqueTargets(group);
+        for (const assignment of assignments) {
+            const trueBranches = guarded.filter((transition) => evalGuard(transition.guard, assignment));
+            if (trueBranches.length > 1) {
+                determinism.push({
+                    code: 'S4_NONDETERMINISTIC_GUARDS',
+                    severity: 'error',
+                    message: from + ' + ' + event + ' has ' + trueBranches.length + ' simultaneously true guards for assignment ' + stableStringify(assignment) + ': ' + uniqueTargets(trueBranches).join(', '),
+                    evidence: { assignment },
+                });
+            }
+            if (trueBranches.length === 0 && unguarded.length === 0) {
+                completeness.push({
+                    code: 'S6_INCOMPLETE_GUARD',
+                    severity: 'error',
+                    message: from + ' + ' + event + ' has no true guard and no default branch for assignment ' + stableStringify(assignment),
+                    evidence: { assignment, branches: targets },
+                });
+            }
+            if (determinism.length + completeness.length > 200) {
+                truncated = true;
+                break;
+            }
+        }
+        if (truncated)
+            break;
+    }
+    completeness.push(...deadGuardFindings(model));
+    return { determinism, completeness, truncated };
+}
+function S4_determinism(model) {
+    const analysis = analyzeGuards(model);
+    return checkResult('S4', 'Determinism', analysis.determinism, analysis.determinism.length === 0 ? 'Deterministic' : 'Nondeterminism findings: ' + analysis.determinism.length);
+}
+/**
+ * A variable whose reachable domain is provably infinite, decided from the model rather than from
+ * a search that ran out of room.
+ *
+ * The engine already bounds every exploration with `steps > options.maxStates`, and reports a
+ * search that hit the bound as undecided rather than as a pass. That is the right report, but it
+ * is the wrong way to find out: the audit got a 4 GB heap and a fatal error from a `NaN` bound,
+ * and a caller who passes no bound at all still pays for ten thousand states before being told the
+ * answer was never decidable.
+ *
+ * Whether the space is infinite is a property of the model, and it can be read off the transition
+ * graph:
+ *
+ *   - a variable is MONOTONE over a cycle when every update to it on that cycle moves the same way
+ *     (`inc`, or `dec`). An unrelated update to another variable does not break it;
+ *   - if such a cycle is reachable from the initial state and nothing on it stops the climb, then
+ *     repeating the cycle yields a distinct runtime state every time. The reachable set is infinite,
+ *     so NO bound decides the question - not a larger one, not a smaller one;
+ *   - two things stop a climb, and both are read from the model: a `set` on the cycle pins the value
+ *     to a constant, and a guard that fails as the value moves that way disables the cycle. A declared
+ *     `min`/`max` does not stop it - `inc`/`dec` are never clamped to the declaration, so a counter can
+ *     walk past its own range (which S7 then reports);
+ *
+ * One direction is enough to make the space infinite, and any monotone direction counts, so this
+ * reports the variable rather than trying to be exhaustive about which check suffers.
+ *
+ * The same reasoning answers the modelling question the audit's D-series kept circling: a model
+ * whose state space is infinite cannot be refuted by enumeration, so "this model cannot be decided
+ * by search" is itself a review result rather than an internal detail. It is reported as an error
+ * for that reason - it is not the reviewer's problem, it is a gap in the model.
+ */
+function unboundedDomainFindings(model) {
+    const variables = new Map();
+    for (const variable of model.variables ?? [])
+        variables.set(variable.name, variable);
+    // The state graph: which states each transition connects, taken from the transitions alone. No
+    // runtime state is constructed, which is the point - this runs before any exploration.
+    const successors = new Map();
+    for (const state of model.states)
+        successors.set(state.id, []);
+    for (const transition of model.transitions) {
+        if (transition.to === undefined)
+            continue;
+        const out = successors.get(transition.from);
+        if (out === undefined)
+            continue;
+        for (const to of String(transition.to).split('|')) {
+            if (successors.has(to))
+                out.push({ to, step: { from: transition.from, event: transition.event, to } });
+        }
+    }
+    const findings = [];
+    const reported = new Set();
+    // Only states reachable from the initial one matter: a monotone cycle on an island no event
+    // reaches does not make the reachable set infinite, and reporting it would be a defect invented
+    // by the analysis rather than found in the model.
+    const start = initialState(model);
+    const reachable = new Set([start.state]);
+    const frontier = [start.state];
+    while (frontier.length > 0) {
+        const id = frontier.pop();
+        for (const edge of successors.get(id) ?? []) {
+            if (reachable.has(edge.to))
+                continue;
+            reachable.add(edge.to);
+            frontier.push(edge.to);
+        }
+    }
+    for (const state of model.states) {
+        if (!reachable.has(state.id))
+            continue;
+        // Depth-first over the state graph with an explicit stack, so a deep model cannot overflow it.
+        const onPath = new Map();
+        const path = [];
+        const visited = new Set();
+        const stack = [{ id: state.id, index: 0 }];
+        onPath.set(state.id, 0);
+        while (stack.length > 0) {
+            const frame = stack[stack.length - 1];
+            const edges = (successors.get(frame.id) ?? []).filter((edge) => reachable.has(edge.to));
+            if (frame.index >= edges.length) {
+                onPath.delete(frame.id);
+                visited.add(frame.id);
+                stack.pop();
+                path.pop();
+                continue;
+            }
+            const edge = edges[frame.index++];
+            const seenAt = onPath.get(edge.to);
+            if (seenAt !== undefined) {
+                // A cycle: the edges from `seenAt` on the current path, plus this closing edge.
+                const cycleSteps = [...path.slice(seenAt).map((entry) => entry.step), edge.step];
+                for (const variable of variables.values()) {
+                    if (variable.kind !== 'integer')
+                        continue;
+                    if (reported.has(variable.name))
+                        continue;
+                    const analysis = monotoneOverCycle(model, cycleSteps, variable);
+                    if (analysis === undefined)
+                        continue;
+                    reported.add(variable.name);
+                    const advice = analysis.direction === 'inc'
+                        ? 'a guard that pins it from above (`{ "variable": "' + variable.name + '", "op": "<", "value": 4 }`)'
+                        : 'a guard that pins it from below (`{ "variable": "' + variable.name + '", "op": ">", "value": 0 }`)';
+                    findings.push({
+                        code: 'S6_UNBOUNDED_VARIABLE',
+                        severity: 'error',
+                        message: 'the reachable state space is infinite: ' + variable.name + ' is only ever ' + analysis.word + ' around the cycle ' + cycleSteps.map((step) => step.from + ' -> ' + step.to).join(' -> ') + ', and nothing on that cycle stops it.',
+                        detail: 'Repeating this cycle produces a distinct runtime state every time, so no search bound decides any question about this model: a larger bound walks further without deciding, and a smaller one reports truncation sooner. Declare ' + advice + ', or a `set` that resets it on the cycle, to make the model decidable. A declared min/max does not bound it: inc/dec are never clamped.',
+                        evidence: { variable: variable.name, direction: analysis.direction, events: cycleSteps.map((step) => step.event) },
+                    });
+                }
+                continue;
+            }
+            if (visited.has(edge.to))
+                continue;
+            onPath.set(edge.to, path.length + 1);
+            path.push(edge);
+            stack.push({ id: edge.to, index: 0 });
+        }
+    }
+    return findings;
+}
+const NEGATED_OP = { '<': '>=', '<=': '>', '>': '<=', '>=': '<', '==': '!=', '!=': '==' };
+/** Whether `op` is a comparison that stops holding once the value moves far enough in `direction`. */
+function pinningComparison(op, direction) {
+    if (op === '==')
+        return true;
+    return direction === 'inc' ? op === '<' || op === '<=' : op === '>' || op === '>=';
+}
+/**
+ * Whether a guard pins `variable` against a climb in `direction`, i.e. eventually disables the transition.
+ *
+ * Only shapes that certainly fail count, because the finding this feeds accuses the model of an infinite
+ * reachable set, and a guess in that direction is a false accusation:
+ *
+ *   - `all` is a conjunction, so one pinning clause is enough; `any` is a disjunction, so every branch has to pin;
+ *   - a negation is read through De Morgan rather than skipped, so `not { n >= 40 }` counts as `n < 40`;
+ *   - a guard on another variable says nothing about this one.
+ */
+function guardPinsVariable(guard, variable, direction, negated = false) {
+    if (isStateGuard(guard))
+        return false;
+    if ('all' in guard) {
+        return negated
+            ? guard.all.every((part) => guardPinsVariable(part, variable, direction, true))
+            : guard.all.some((part) => guardPinsVariable(part, variable, direction, false));
+    }
+    if ('any' in guard) {
+        return negated
+            ? guard.any.some((part) => guardPinsVariable(part, variable, direction, true))
+            : guard.any.every((part) => guardPinsVariable(part, variable, direction, false));
+    }
+    if ('not' in guard)
+        return guardPinsVariable(guard.not, variable, direction, !negated);
+    if (guard.variable !== variable)
+        return false;
+    return pinningComparison(negated ? NEGATED_OP[guard.op] : guard.op, direction);
+}
+/**
+ * Whether one variable climbs one way along the whole cycle and nothing stops it.
+ *
+ * Three things stop a climb, and the analysis has to read all three because it reports "the reachable state
+ * space is infinite":
+ *
+ *   - a `set` anywhere on the cycle pins the value to a constant, so lap after lap cannot climb (the constant's
+ *     own value does not matter);
+ *   - a guard that fails as the value moves that way disables the cycle, which is how the schema reference tells
+ *     a modeller to bound a counter;
+ *   - a declared `min`/`max` does NOT stop it: `inc`/`dec` are never clamped to the declaration, so a model that
+ *     declares `max: 5` and increments unguarded climbs past 5. S7 reports the range violation that proves it,
+ *     and reading the declaration as a bound here made the two checks disagree about the same model.
+ *
+ * A `dec` on the same cycle means it does not climb after all, and `undefined` says so.
+ */
+function monotoneOverCycle(model, steps, variable) {
+    let direction;
+    const moving = [];
+    for (const step of steps) {
+        const matching = model.transitions.filter((transition) => transition.from === step.from && transition.event === step.event && transition.to === step.to);
+        // Only the transitions that actually move the variable matter: a branch of the same event that leaves it alone
+        // neither climbs nor stops a climb, and counting it as an unpinned climber would accuse a bounded model.
+        const climbers = matching.filter((transition) => (transition.updates ?? []).some((update) => update.variable === variable.name && update.op !== 'set'));
+        for (const transition of matching) {
+            for (const update of transition.updates ?? []) {
+                if (update.variable !== variable.name)
+                    continue;
+                // A `set` fixes the value at a constant, so no lap sequence climbs without bound.
+                if (update.op === 'set')
+                    return undefined;
+                if (direction === undefined)
+                    direction = update.op;
+                else if (direction !== update.op)
+                    return undefined;
+            }
+        }
+        if (climbers.length > 0)
+            moving.push({ op: direction, climbers });
+    }
+    if (direction === undefined)
+        return undefined;
+    // One pinned edge is enough: the cycle cannot complete once that edge is disabled, whichever other edges
+    // still allow a move.
+    const pinned = moving
+        .filter((edge) => edge.op === direction)
+        .some((edge) => edge.climbers.every((transition) => transition.guard !== undefined && guardPinsVariable(transition.guard, variable.name, direction)));
+    if (pinned)
+        return undefined;
+    return { direction, word: direction === 'inc' ? 'incremented' : 'decremented' };
+}
+function S6_guardCompleteness(model) {
+    const analysis = analyzeGuards(model);
+    // The domain findings come first: an infinite state space is why the guard enumeration could not
+    // finish, so a reader meets the cause before the symptom.
+    const findings = [...unboundedDomainFindings(model), ...analysis.completeness];
+    const dead = analysis.completeness.filter((finding) => finding.code === 'S6_DEAD_GUARD').length;
+    const unbounded = findings.filter((finding) => finding.code === 'S6_UNBOUNDED_VARIABLE').length;
+    const detail = unbounded > 0
+        ? 'The reachable state space is infinite: ' + String(unbounded) + ' variable(s) climb around a reachable cycle that nothing stops'
+        : findings.length === 0
+            ? 'All guard branches defined'
+            : dead === analysis.completeness.length ? 'Dead guard branches: ' + String(dead) : 'Guard findings: ' + String(findings.length);
+    return checkResult('S6', 'Guard Completeness', findings, detail);
+}
+function S5_eventCompleteness(model) {
+    const events = allEvents(model);
+    const findings = [];
+    for (const state of model.states) {
+        if (state.terminal === true)
+            continue;
+        const handled = new Set(model.transitions.filter((transition) => transition.from === state.id).map((transition) => transition.event));
+        for (const event of events) {
+            if (!handled.has(event)) {
+                findings.push({
+                    code: 'S5_UNHANDLED_EVENT',
+                    severity: 'warning',
+                    message: state.id + ' silently ignores event ' + event,
+                });
+            }
+        }
+    }
+    return checkResult('S5', 'Event Completeness', findings, findings.length === 0 ? 'All states handle all relevant events' : findings.length + ' unhandled (state, event) pairs');
+}
+/**
+ * Why a walk that stopped at its budget reports undecided rather than a verdict. One phrasing for
+ * every invariant walk: a reader who sees two different sentences for the same situation starts
+ * looking for a difference between them.
+ */
+function invariantCapReason(options) {
+    return 'the walk stopped at the ' + String(options.maxStates) + ' state budget before it finished';
+}
+/** Whether a `var-in-range` `when` scope selects this runtime state. */
+function whenScopeHolds(when, runtime) {
+    return isStateGuard(when) ? when.state === runtime.state : evalGuard(when, runtime.vars);
+}
+function invariantHolds(invariant, runtime, isInitial = false) {
+    if (invariant.kind === 'never-states')
+        return !invariant.states.includes(runtime.state);
+    if (invariant.kind === 'var-in-range') {
+        // The initial runtime state is checked unconditionally: a machine must never be
+        // able to escape the range simply by starting outside the scope.
+        if (!isInitial && invariant.when !== undefined && !whenScopeHolds(invariant.when, runtime))
+            return true;
+        const value = runtime.vars[invariant.variable];
+        if (typeof value !== 'number')
+            return false;
+        if (invariant.min !== undefined && value < invariant.min)
+            return false;
+        if (invariant.max !== undefined && value > invariant.max)
+            return false;
+        return true;
+    }
+    return true;
+}
+function shortestViolationForInvariant(model, options, invariant) {
+    if (invariant.kind === 'event-before-state') {
+        return shortestEventBeforeStateViolation(model, options, invariant);
+    }
+    const init = initialState(model);
+    if (!invariantHolds(invariant, init, true)) {
+        return { invariant, path: [], reason: 'Initial state violates the invariant.' };
+    }
+    const visited = new Set([runtimeKey(init)]);
+    const queue = [{ runtime: init, path: [] }];
+    let steps = 0;
+    // Whether the walk stopped on its budget rather than on an exhausted space. The two used to share the
+    // `undefined` return, so S7 answered "All invariants hold" for a search that never finished.
+    let capped = false;
+    while (queue.length > 0) {
+        const entry = queue.shift();
+        if (++steps > options.maxStates) {
+            capped = true;
+            break;
+        }
+        for (const event of allEvents(model)) {
+            for (const next of stepRuntime(model, entry.runtime, event)) {
+                const key = runtimeKey(next);
+                if (visited.has(key))
+                    continue;
+                const path = [...entry.path, { from: entry.runtime.state, event, to: next.state }];
+                if (!invariantHolds(invariant, next)) {
+                    return { invariant, path, reason: 'Invariant violated after ' + path.length + ' events.' };
+                }
+                visited.add(key);
+                queue.push({ runtime: next, path });
+            }
+        }
+    }
+    if (capped)
+        return { invariant, path: [], reason: invariantCapReason(options), undecided: true };
+    return undefined;
+}
+/**
+ * Whether an invariant asserts a property of whole runs rather than of a single
+ * runtime state. These kinds cannot be decided by a state predicate, so they are not
+ * part of `shortestViolationForInvariant` (and therefore not of S7), which owns the
+ * states; A9-A13 own the verdicts, and `pathPropertyViolation` below makes the same
+ * verdicts available to A7 and D2.
+ */
+function isPathPropertyInvariant(invariant) {
+    return invariant.kind === 'leads-to'
+        || invariant.kind === 'sequence'
+        || invariant.kind === 'atomicity'
+        || invariant.kind === 'budget'
+        || invariant.kind === 'probability';
+}
+/** Whether a probability invariant's bound fails for the computed hit probability. */
+function probabilityViolated(invariant, probability) {
+    const eps = 1e-9;
+    if (invariant.op === '>=')
+        return probability < invariant.p - eps;
+    if (invariant.op === '>')
+        return probability <= invariant.p + eps;
+    if (invariant.op === '<=')
+        return probability > invariant.p + eps;
+    return probability >= invariant.p - eps;
+}
+/** Every runtime state reachable from init, capped like the other searches. */
+function reachableRuntimeStates(model, options) {
+    const init = initialState(model);
+    const visited = new Set([runtimeKey(init)]);
+    const reached = [init];
+    const queue = [init];
+    let steps = 0;
+    while (queue.length > 0) {
+        if (++steps > options.maxStates)
+            break;
+        const current = queue.shift();
+        for (const event of allEvents(model)) {
+            for (const next of stepRuntime(model, current, event)) {
+                const key = runtimeKey(next);
+                if (visited.has(key))
+                    continue;
+                visited.add(key);
+                reached.push(next);
+                queue.push(next);
+            }
+        }
+    }
+    return reached;
+}
+/**
+ * Violation of a path-property invariant, or undefined when it holds. Each kind
+ * delegates to the search its dedicated probe uses (A9 leads-to, A10 sequence, A11
+ * atomicity, A12 budget, A13 probability), so a verdict reported here can never
+ * disagree with the probe that owns the kind.
+ */
+function pathPropertyViolation(model, options, invariant) {
+    if (invariant.kind === 'leads-to') {
+        const targets = new Set(leadsToTargets(invariant));
+        const label = leadsToTargetLabel(invariant);
+        const budget = leadsToWalkBudget(options);
+        const walk = { remaining: budget };
+        for (const runtime of reachableRuntimeStates(model, options)) {
+            if (runtime.state !== invariant.from)
+                continue;
+            const outcome = findLeadsToBadPath(model, runtime, targets, label, walk);
+            if (outcome.undecided) {
+                return { invariant, path: [], reason: 'the walk spent its budget of ' + budget + ' steps without finding a run that avoids ' + label + ', or proving that none exists', undecided: true };
+            }
+            if (outcome.violation !== undefined)
+                return { invariant, path: outcome.violation.path, reason: outcome.violation.reason };
+        }
+        return undefined;
+    }
+    if (invariant.kind === 'sequence')
+        return findSequenceViolation(model, options, invariant);
+    if (invariant.kind === 'atomicity')
+        return findAtomicityViolation(model, options, invariant);
+    if (invariant.kind === 'budget') {
+        const violation = findBudgetViolation(model, options, invariant);
+        // The walk can also stop early, and that is the third outcome: no witness was found, and the walk did not
+        // finish looking. Folding it into `undefined` made A7 (and D2) report "every invariant holds" about a search
+        // that decided nothing - the same defect the other walks had, in the one caller that reads this function.
+        if (violation === 'undecided')
+            return { invariant, path: [], reason: invariantCapReason(options), undecided: true };
+        if (violation === undefined)
+            return undefined;
+        return {
+            invariant,
+            path: violation.path,
+            reason: violation.unbounded
+                ? 'a reachable cycle keeps accumulating cost, so no finite budget holds'
+                : 'a run accumulates cost ' + String(violation.cost) + ', above the declared budget ' + String(invariant.budget),
+        };
+    }
+    if (invariant.kind === 'probability') {
+        const { probability, converged } = computeHitProbability(model, options, invariant.target);
+        if (!probabilityViolated(invariant, probability))
+            return undefined;
+        return {
+            invariant,
+            path: [],
+            reason: 'P(hit ' + invariant.target + ') = ' + probability.toFixed(6) + ' does not satisfy ' + invariant.op + ' ' + String(invariant.p)
+                + (converged ? '' : ' (value iteration did not converge)'),
+        };
+    }
+    return undefined;
+}
+function shortestEventBeforeStateViolation(model, options, invariant) {
+    const init = initialState(model);
+    const seenInitially = false;
+    if (init.state === invariant.state && !seenInitially) {
+        return { invariant, path: [], reason: 'Target state ' + invariant.state + ' is initial and the required event ' + invariant.event + ' has not occurred.' };
+    }
+    const key = (runtime, seen) => runtimeKey(runtime) + '|' + (seen ? '1' : '0');
+    const visited = new Set([key(init, false)]);
+    const queue = [{ runtime: init, seen: false, path: [] }];
+    let steps = 0;
+    let capped = false;
+    while (queue.length > 0) {
+        const entry = queue.shift();
+        if (++steps > options.maxStates) {
+            capped = true;
+            break;
+        }
+        for (const event of allEvents(model)) {
+            for (const next of stepRuntime(model, entry.runtime, event)) {
+                const seen = entry.seen || event === invariant.event;
+                const nextKey = key(next, seen);
+                if (visited.has(nextKey))
+                    continue;
+                const path = [...entry.path, { from: entry.runtime.state, event, to: next.state }];
+                if (next.state === invariant.state && !seen) {
+                    return { invariant, path, reason: 'Target state ' + invariant.state + ' is reachable without event ' + invariant.event + ' in ' + path.length + ' steps.' };
+                }
+                visited.add(nextKey);
+                queue.push({ runtime: next, seen, path });
+            }
+        }
+    }
+    // Same cap, same answer: this walk is S7's too, so an unfinished search here must not read as a pass.
+    if (capped)
+        return { invariant, path: [], reason: invariantCapReason(options), undecided: true };
+    return undefined;
+}
+function runInvariants(model, options, includePathProperties = false) {
+    const violations = [];
+    for (const invariant of model.invariants ?? []) {
+        // A path property is not a predicate of one runtime state, so without `includePathProperties` this loop
+        // has nothing to say about it. Walking the space anyway was harmless only while a cap read as a pass: the
+        // walk can never find a violation (the predicate holds for these kinds by construction), so once it
+        // reports its budget honestly it reports undecided about a question it was never asked. S7's roster is
+        // the state kinds; A9-A13 and D2 decide the rest.
+        if (!includePathProperties && isPathPropertyInvariant(invariant))
+            continue;
+        const violation = isPathPropertyInvariant(invariant)
+            ? pathPropertyViolation(model, options, invariant)
+            : shortestViolationForInvariant(model, options, invariant);
+        if (violation !== undefined)
+            violations.push(violation);
+    }
+    return violations;
+}
+function S7_invariants(model, options) {
+    const violations = runInvariants(model, options);
+    const findings = violations.map((violation) => violation.undecided ? {
+        code: 'S7_UNDECIDED',
+        severity: 'warning',
+        message: 'Invariant "' + violation.invariant.id + '" (' + violation.invariant.description + ') could not be decided: ' + violation.reason + '. Absence is not proven.',
+        evidence: { invariant: violation.invariant },
+    } : {
+        code: 'S7_INVARIANT_VIOLATION',
+        severity: 'error',
+        message: 'Invariant "' + violation.invariant.id + '" (' + violation.invariant.description + ') violated: ' + violation.reason,
+        path: violation.path,
+        evidence: { invariant: violation.invariant },
+    });
+    const undecided = findings.some((finding) => finding.code === 'S7_UNDECIDED');
+    return checkResult('S7', 'Invariant Validity', findings, violations.length === 0
+        ? 'All invariants hold'
+        : undecided && findings.every((finding) => finding.code === 'S7_UNDECIDED') ? 'Invariants undecided: the search budget ran out' : 'Invariant violations: ' + violations.length);
+}
+// ---------------------------------------------------------------------------
+// A1-A14
+// ---------------------------------------------------------------------------
+function A1_unexpectedEvents(model) {
+    const events = allEvents(model);
+    const findings = [];
+    for (const state of model.states) {
+        if (state.terminal === true)
+            continue;
+        const handled = new Set(model.transitions.filter((transition) => transition.from === state.id).map((transition) => transition.event));
+        for (const event of events) {
+            if (!handled.has(event)) {
+                findings.push({
+                    code: 'A1_UNHANDLED_EVENT',
+                    severity: 'warning',
+                    message: 'Event ' + event + ' in state ' + state.id + ' has no defined transition (silent ignore).',
+                });
+            }
+        }
+    }
+    return checkResult('A1', 'Unexpected Event Injection', findings, findings.length === 0 ? 'All event/state combinations defined' : findings.length + ' unhandled combinations');
+}
+function firstOutcome(runtime, outcomes) {
+    return outcomes[0];
+}
+function A2_raceInterleaving(model, exploration) {
+    const findings = [];
+    for (const [e1, e2] of model.concurrentPairs ?? []) {
+        for (const runtime of exploration.reachable) {
+            const first = firstOutcome(runtime, stepRuntime(model, runtime, e1));
+            const second = firstOutcome(runtime, stepRuntime(model, runtime, e2));
+            if (first === undefined && second === undefined)
+                continue;
+            const final12 = first === undefined ? runtime : firstOutcome(first, stepRuntime(model, first, e2)) ?? first;
+            const final21 = second === undefined ? runtime : firstOutcome(second, stepRuntime(model, second, e1)) ?? second;
+            if (runtimeKey(final12) !== runtimeKey(final21)) {
+                findings.push({
+                    code: 'A2_ORDER_DEPENDENT',
+                    severity: 'warning',
+                    message: 'Events ' + e1 + ' and ' + e2 + ' produce order-dependent outcomes from state ' + runtime.state,
+                    evidence: { e1ThenE2: final12, e2ThenE1: final21 },
+                });
+            }
+        }
+    }
+    return checkResult('A2', 'Race Interleaving', withUnresolved(model, 'A2', findings), findings.length === 0 ? 'No race conditions detected' : 'Order-dependent outcomes: ' + findings.length);
+}
+function stepSequence(model, init, events) {
+    let runtime = init;
+    for (const event of events) {
+        const next = firstOutcome(runtime, stepRuntime(model, runtime, event));
+        if (next === undefined)
+            continue;
+        runtime = next;
+    }
+    return runtime;
+}
+function permutations(items) {
+    if (items.length === 0)
+        return [[]];
+    const result = [];
+    for (let index = 0; index < items.length; index++) {
+        const rest = items.slice(0, index).concat(items.slice(index + 1));
+        for (const suffix of permutations(rest))
+            result.push([items[index], ...suffix]);
+    }
+    return result;
+}
+function A3_orderPermutation(model, options) {
+    const events = allEvents(model).slice(0, options.maxPermutationEvents);
+    if (events.length < 2)
+        return checkResult('A3', 'Order Permutation', [], 'Fewer than 2 events — skipped');
+    const init = initialState(model);
+    const outcomes = new Map();
+    for (const permutation of permutations(events)) {
+        const final = stepSequence(model, init, permutation);
+        const key = runtimeKey(final);
+        const list = outcomes.get(key) ?? [];
+        if (list.length < 3)
+            list.push(permutation.join(','));
+        outcomes.set(key, list);
+    }
+    if (outcomes.size > 1) {
+        const examples = [...outcomes.entries()].map(([key, sequences]) => ({ final: key.split('|')[0], example: sequences[0] }));
+        return checkResult('A3', 'Order Permutation', [{
+                code: 'A3_ORDER_DEPENDENT',
+                severity: 'warning',
+                message: 'Same event set produces ' + outcomes.size + ' different outcomes depending on order.',
+                evidence: { examples },
+            }], 'Order-dependent outcomes: ' + outcomes.size);
+    }
+    return checkResult('A3', 'Order Permutation', [], 'Order-independent (sampled first ' + events.length + ' events)');
+}
+function stateActionList(model, stateId, kind) {
+    const state = model.states.find((entry) => entry.id === stateId);
+    const list = state === undefined ? undefined : state[kind];
+    return list ?? [];
+}
+function actionsDeclared(model) {
+    return model.states.some((state) => (state.onEntry ?? []).length > 0 || (state.onExit ?? []).length > 0);
+}
+/** Apply an ordered action list to the held flag. Actions never change state or variables; they only matter to pairing checks. */
+function applyActionList(list, acquireEvent, releaseEvent, held) {
+    let next = held;
+    let reacquired = false;
+    for (const action of list) {
+        if (action === acquireEvent) {
+            if (next)
+                reacquired = true;
+            next = true;
+        }
+        else if (action === releaseEvent) {
+            next = false;
+        }
+    }
+    return { held: next, reacquired };
+}
+function A4_pairSymmetry(model) {
+    const findings = [];
+    const hasActions = actionsDeclared(model);
+    const transitionEvents = new Set(model.transitions.map((transition) => transition.event));
+    const actionEvents = new Set();
+    if (hasActions) {
+        for (const state of model.states) {
+            for (const action of stateActionList(model, state.id, 'onEntry'))
+                actionEvents.add(action);
+            for (const action of stateActionList(model, state.id, 'onExit'))
+                actionEvents.add(action);
+        }
+    }
+    const pairHasEvent = (event) => transitionEvents.has(event) || actionEvents.has(event);
+    const releaseReachableFrom = (stateId, releaseEvent) => {
+        const reachable = stateGraphReachable(model, stateId);
+        return [...reachable].some((state) => model.transitions.some((transition) => transition.from === state && transition.event === releaseEvent)
+            || (hasActions && (stateActionList(model, state, 'onEntry').includes(releaseEvent) || stateActionList(model, state, 'onExit').includes(releaseEvent))));
+    };
+    const edges = stateGraphEdges(model);
+    for (const pair of model.resourcePairs ?? []) {
+        const acquireTransitions = model.transitions.filter((transition) => transition.event === pair.acquireEvent);
+        const actionAcquire = hasActions && model.states.some((state) => stateActionList(model, state.id, 'onEntry').includes(pair.acquireEvent) || stateActionList(model, state.id, 'onExit').includes(pair.acquireEvent));
+        const releaseExists = pairHasEvent(pair.releaseEvent);
+        if (acquireTransitions.length === 0 && !actionAcquire && !releaseExists)
+            continue;
+        if ((acquireTransitions.length > 0 || actionAcquire) && !releaseExists) {
+            findings.push({
+                code: 'A4_NO_RELEASE_EVENT',
+                severity: 'error',
+                message: 'Resource "' + pair.resource + '": acquire event ' + pair.acquireEvent + ' exists but release event ' + pair.releaseEvent + ' is never defined.',
+                // In the evidence so the sweep can see that this finding already accounts for the name:
+                // one defect, one finding, in the vocabulary of the check that owns it.
+                evidence: { resource: pair.resource, acquireEvent: pair.acquireEvent, releaseEvent: pair.releaseEvent, event: pair.releaseEvent },
+            });
+            continue;
+        }
+        // Collect acquire sites: transitions whose event acquires, and state entry/exit actions that end holding the resource.
+        const seeds = [];
+        for (const acquire of acquireTransitions) {
+            if (!releaseReachableFrom(acquire.to, pair.releaseEvent)) {
+                findings.push({
+                    code: 'A4_NO_RELEASE_REACHABLE',
+                    severity: 'error',
+                    message: 'Resource "' + pair.resource + '": after ' + pair.acquireEvent + ' into ' + acquire.to + ', no ' + pair.releaseEvent + ' is reachable.',
+                    evidence: { acquireTransition: acquire },
+                });
+                continue;
+            }
+            seeds.push({ state: acquire.to, held: true, path: [] });
+        }
+        if (hasActions) {
+            for (const state of model.states) {
+                // acquire fired by onEntry: resource is held for the whole stay in the state
+                const entry = stateActionList(model, state.id, 'onEntry');
+                if (entry.includes(pair.acquireEvent)) {
+                    const sim = applyActionList(entry, pair.acquireEvent, pair.releaseEvent, false);
+                    if (sim.reacquired) {
+                        findings.push({
+                            code: 'A4_REACQUIRE_WITHOUT_RELEASE',
+                            severity: 'warning',
+                            message: 'Resource "' + pair.resource + '" is acquired more than once inside onEntry of ' + state.id + ' before ' + pair.releaseEvent + '.',
+                        });
+                    }
+                    if (sim.held)
+                        seeds.push({ state: state.id, held: true, path: [] });
+                }
+                // acquire fired by onExit: happens on every outgoing edge, never on a terminal state
+                const exit = stateActionList(model, state.id, 'onExit');
+                if (exit.includes(pair.acquireEvent) && !state.terminal) {
+                    const sim = applyActionList(exit, pair.acquireEvent, pair.releaseEvent, false);
+                    if (sim.reacquired) {
+                        findings.push({
+                            code: 'A4_REACQUIRE_WITHOUT_RELEASE',
+                            severity: 'warning',
+                            message: 'Resource "' + pair.resource + '" is acquired more than once inside onExit of ' + state.id + ' before ' + pair.releaseEvent + '.',
+                        });
+                    }
+                    if (sim.held)
+                        seeds.push({ state: state.id, held: false, path: [] });
+                }
+            }
+        }
+        // Path-sensitive probe: track the held flag along state-graph paths, firing
+        // onExit of the source state before each transition and onEntry of the target after it.
+        for (const seed of seeds) {
+            const visited = new Set();
+            const queue = [seed];
+            let steps = 0;
+            while (queue.length > 0) {
+                const entry = queue.shift();
+                if (++steps > 1000)
+                    break;
+                const key = entry.state + '|' + (entry.held ? '1' : '0');
+                if (visited.has(key))
+                    continue;
+                visited.add(key);
+                if (entry.held && isTerminal(model, entry.state)) {
+                    findings.push({
+                        code: 'A4_TERMINAL_WITH_RESOURCE',
+                        severity: 'error',
+                        message: 'Resource "' + pair.resource + '" is still held when entering terminal state ' + entry.state + '.',
+                        path: entry.path,
+                    });
+                    continue;
+                }
+                for (const transition of edges.get(entry.state) ?? []) {
+                    let held = entry.held;
+                    if (hasActions) {
+                        const sim = applyActionList(stateActionList(model, entry.state, 'onExit'), pair.acquireEvent, pair.releaseEvent, held);
+                        if (sim.reacquired) {
+                            findings.push({
+                                code: 'A4_REACQUIRE_WITHOUT_RELEASE',
+                                severity: 'warning',
+                                message: 'Resource "' + pair.resource + '" is acquired again in onExit of ' + entry.state + ' before ' + pair.releaseEvent + '.',
+                                path: entry.path,
+                            });
+                            continue;
+                        }
+                        held = sim.held;
+                    }
+                    if (transition.event === pair.releaseEvent)
+                        held = false;
+                    else if (transition.event === pair.acquireEvent) {
+                        if (held) {
+                            findings.push({
+                                code: 'A4_REACQUIRE_WITHOUT_RELEASE',
+                                severity: 'warning',
+                                message: 'Resource "' + pair.resource + '" is acquired again in state ' + entry.state + ' before ' + pair.releaseEvent + '.',
+                                path: [...entry.path, { from: entry.state, event: transition.event, to: transition.to }],
+                            });
+                            continue;
+                        }
+                        held = true;
+                    }
+                    if (hasActions) {
+                        const sim = applyActionList(stateActionList(model, transition.to, 'onEntry'), pair.acquireEvent, pair.releaseEvent, held);
+                        if (sim.reacquired) {
+                            findings.push({
+                                code: 'A4_REACQUIRE_WITHOUT_RELEASE',
+                                severity: 'warning',
+                                message: 'Resource "' + pair.resource + '" is acquired again inside onEntry of ' + transition.to + ' before ' + pair.releaseEvent + '.',
+                                path: [...entry.path, { from: entry.state, event: transition.event, to: transition.to }],
+                            });
+                            continue;
+                        }
+                        held = sim.held;
+                    }
+                    queue.push({ state: transition.to, held, path: [...entry.path, { from: entry.state, event: transition.event, to: transition.to }] });
+                }
+            }
+        }
+    }
+    return checkResult('A4', 'Pair Symmetry', withUnresolved(model, 'A4', findings), findings.length === 0 ? 'All pairs balanced' : 'Asymmetric pairs: ' + findings.length);
+}
+function stateGraphEdges(model) {
+    const edges = new Map();
+    for (const state of model.states)
+        edges.set(state.id, []);
+    for (const transition of model.transitions)
+        edges.get(transition.from)?.push(transition);
+    return edges;
+}
+function stateGraphReachable(model, start) {
+    const edges = new Map();
+    for (const state of model.states)
+        edges.set(state.id, []);
+    for (const transition of model.transitions)
+        edges.get(transition.from)?.push(transition.to);
+    const visited = new Set();
+    const queue = [start];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (visited.has(current))
+            continue;
+        visited.add(current);
+        for (const next of edges.get(current) ?? [])
+            queue.push(next);
+    }
+    return visited;
+}
+function A5_boundaryBlast(model) {
+    const findings = [];
+    for (const check of model.boundaryChecks ?? []) {
+        const variable = (model.variables ?? []).find((entry) => entry.name === check.variable);
+        if (variable === undefined)
+            continue;
+        for (const value of check.values) {
+            if (variable.min !== undefined && value < variable.min) {
+                findings.push({ code: 'A5_OUT_OF_DOMAIN', severity: 'warning', message: 'Boundary value ' + value + ' for ' + check.variable + ' is below min ' + variable.min });
+            }
+            if (variable.max !== undefined && value > variable.max) {
+                findings.push({ code: 'A5_OUT_OF_DOMAIN', severity: 'warning', message: 'Boundary value ' + value + ' for ' + check.variable + ' is above max ' + variable.max });
+            }
+            const assignment = { ...(model.variables ?? []).reduce((result, entry) => { result[entry.name] = entry.init; return result; }, {}), [check.variable]: value };
+            for (const [key, group] of groupTransitions(model)) {
+                const [from, event] = key.split('|');
+                if (!group.some((transition) => guardVariables(transition.guard).includes(check.variable)))
+                    continue;
+                const guarded = group.filter((transition) => transition.guard !== undefined);
+                const unguarded = group.filter((transition) => transition.guard === undefined);
+                const matched = guarded.filter((transition) => evalGuard(transition.guard, assignment));
+                if (matched.length === 0 && unguarded.length === 0) {
+                    findings.push({
+                        code: 'A5_GUARD_HOLE',
+                        severity: 'warning',
+                        message: from + ' + ' + event + ' has no branch for ' + check.variable + '=' + value,
+                        evidence: { assignment },
+                    });
+                }
+                if (matched.length > 1) {
+                    findings.push({
+                        code: 'A5_GUARD_OVERLAP',
+                        severity: 'warning',
+                        message: from + ' + ' + event + ' has ' + matched.length + ' true branches for ' + check.variable + '=' + value,
+                        evidence: { assignment },
+                    });
+                }
+            }
+        }
+    }
+    return checkResult('A5', 'Boundary Blast', findings, findings.length === 0 ? 'Boundary checks passed' : 'Boundary findings: ' + findings.length);
+}
+function A6_resourceInjection(model) {
+    const findings = [];
+    for (const pair of model.resourcePairs ?? []) {
+        if (pair.failEvent === undefined)
+            continue;
+        const acquireStates = new Set(model.transitions.filter((transition) => transition.event === pair.acquireEvent).map((transition) => transition.from));
+        for (const state of acquireStates) {
+            const handled = model.transitions.some((transition) => transition.from === state && transition.event === pair.failEvent);
+            if (!handled) {
+                findings.push({
+                    code: 'A6_NO_FAILURE_HANDLER',
+                    severity: 'warning',
+                    message: 'State ' + state + ' can ' + pair.acquireEvent + ' for "' + pair.resource + '" but has no ' + pair.failEvent + ' transition.',
+                });
+            }
+        }
+    }
+    return checkResult('A6', 'Resource Injection', withUnresolved(model, 'A6', findings), findings.length === 0 ? 'No resource vulnerabilities detected' : 'Resource failure paths missing: ' + findings.length);
+}
+function A7_shortestViolations(model, options) {
+    // Path-property invariants are included: "for any invariant that fails" is this
+    // check's contract, and a check that silently skips five of the eight kinds cannot
+    // honour it. The searches for the state kinds, for sequence, atomicity and budget
+    // are breadth-first, so their first witness is the shortest one; the leads-to walk
+    // and the probability bound have no such guarantee, and their message says what it
+    // found instead of claiming minimality.
+    const violations = runInvariants(model, options, true);
+    const findings = violations.map((violation) => {
+        if (violation.undecided) {
+            return {
+                code: 'A7_UNDECIDED',
+                severity: 'warning',
+                message: 'Invariant "' + violation.invariant.id + '" could not be decided: ' + violation.reason + '. Absence is not proven, so there is no shortest counterexample to report.',
+                evidence: { invariant: violation.invariant.id },
+            };
+        }
+        const pathLength = violation.path.length;
+        const message = isPathPropertyInvariant(violation.invariant)
+            ? 'Invariant "' + violation.invariant.id + '" violated: ' + violation.reason
+                + (pathLength === 0 ? '' : ' (witness path length: ' + pathLength + ')')
+            : 'Invariant "' + violation.invariant.id + '" shortest violating path length: ' + pathLength + (pathLength === 0 ? ' (initial state)' : '');
+        return {
+            code: 'A7_SHORTEST_COUNTEREXAMPLE',
+            severity: 'warning',
+            message,
+            path: violation.path,
+            evidence: { invariant: violation.invariant.id },
+        };
+    });
+    const undecided = findings.some((finding) => finding.code === 'A7_UNDECIDED');
+    return checkResult('A7', 'Minimal Counter-Example', findings, violations.length === 0
+        ? 'All invariants hold for all reachable paths'
+        : undecided && findings.every((finding) => finding.code === 'A7_UNDECIDED') ? 'Invariant walks stopped at the state budget: undecided' : 'Violated invariants: ' + findings.length);
+}
+function mapStateId(mapping, state) {
+    return mapping[state] ?? state;
+}
+function D1_behavioralPreservation(before, after, mapping) {
+    const findings = [];
+    const afterStates = new Set(after.states.map((state) => state.id));
+    const afterByFromEvent = new Map();
+    for (const transition of after.transitions) {
+        const key = transition.from + '|' + transition.event;
+        const set = afterByFromEvent.get(key) ?? new Set();
+        set.add(transition.to);
+        afterByFromEvent.set(key, set);
+    }
+    const beforeInitMapped = mapStateId(mapping, before.init);
+    if (beforeInitMapped !== after.init) {
+        findings.push({
+            code: 'D1_INIT_MISMATCH',
+            severity: 'warning',
+            message: 'Mapped BEFORE init ' + beforeInitMapped + ' does not match AFTER init ' + after.init + '.',
+            evidence: { beforeInit: before.init, mappedInit: beforeInitMapped, afterInit: after.init },
+        });
+    }
+    for (const state of before.states) {
+        const mapped = mapStateId(mapping, state.id);
+        if (!afterStates.has(mapped)) {
+            findings.push({
+                code: 'D1_MAPPED_STATE_MISSING',
+                severity: 'error',
+                message: 'BEFORE state ' + state.id + ' maps to ' + mapped + ', which is not declared in AFTER.',
+                evidence: { beforeState: state.id, mappedState: mapped },
+            });
+            continue;
+        }
+        for (const transition of before.transitions.filter((entry) => entry.from === state.id)) {
+            const key = mapped + '|' + transition.event;
+            const targets = afterByFromEvent.get(key);
+            if (targets === undefined || targets.size === 0) {
+                findings.push({
+                    code: 'D1_EVENT_DISABLED',
+                    severity: 'error',
+                    message: 'BEFORE can fire event ' + transition.event + ' from ' + state.id + ' (mapped to ' + mapped + '), but AFTER has no transition for that (state, event).',
+                    path: [{ from: state.id, event: transition.event, to: transition.to }],
+                    evidence: { beforeState: state.id, mappedState: mapped, event: transition.event },
+                });
+            }
+        }
+    }
+    return checkResult('D1', 'Behavioral Preservation', findings, findings.length === 0 ? 'BEFORE event behavior is preserved in AFTER' : 'Behavioral preservation findings: ' + findings.length);
+}
+function mapInvariantForComparison(invariant, mapping) {
+    if (invariant.kind === 'never-states') {
+        return {
+            ...invariant,
+            id: invariant.id + ':before',
+            description: invariant.description + ' (from BEFORE)',
+            states: invariant.states.map((state) => mapStateId(mapping, state)),
+        };
+    }
+    if (invariant.kind === 'event-before-state') {
+        return {
+            ...invariant,
+            id: invariant.id + ':before',
+            description: invariant.description + ' (from BEFORE)',
+            state: mapStateId(mapping, invariant.state),
+        };
+    }
+    if (invariant.kind === 'var-in-range') {
+        const mapped = { ...invariant, id: invariant.id + ':before', description: invariant.description + ' (from BEFORE)' };
+        // A state scope must follow the state rename, otherwise D2 reports a spurious
+        // regression when the scope later refers to a state id that no longer exists.
+        if (mapped.when !== undefined && isStateGuard(mapped.when)) {
+            mapped.when = { state: mapStateId(mapping, mapped.when.state) };
+        }
+        return mapped;
+    }
+    if (invariant.kind === 'leads-to') {
+        // A target set maps member by member; a rename that drops a state is reported by
+        // D2's own mapped-state check rather than silently changing the property.
+        return {
+            ...invariant,
+            id: invariant.id + ':before',
+            description: invariant.description + ' (from BEFORE)',
+            from: mapStateId(mapping, invariant.from),
+            to: typeof invariant.to === 'string' ? mapStateId(mapping, invariant.to) : invariant.to.map((state) => mapStateId(mapping, state)),
+        };
+    }
+    if (invariant.kind === 'probability') {
+        return {
+            ...invariant,
+            id: invariant.id + ':before',
+            description: invariant.description + ' (from BEFORE)',
+            target: mapStateId(mapping, invariant.target),
+        };
+    }
+    return { ...invariant, id: invariant.id + ':before', description: invariant.description + ' (from BEFORE)' };
+}
+function D2_invariantContinuity(before, after, options, mapping) {
+    const findings = [];
+    const afterStates = new Set(after.states.map((state) => state.id));
+    const afterVariables = new Set((after.variables ?? []).map((variable) => variable.name));
+    for (const invariant of before.invariants ?? []) {
+        const mapped = mapInvariantForComparison(invariant, mapping);
+        if (mapped.kind === 'never-states') {
+            for (const state of mapped.states) {
+                if (!afterStates.has(state)) {
+                    findings.push({
+                        code: 'D2_MAPPED_STATE_MISSING',
+                        severity: 'warning',
+                        message: 'BEFORE invariant "' + invariant.id + '" maps to state ' + state + ', which is not declared in AFTER.',
+                        evidence: { invariant: invariant.id, state },
+                    });
+                }
+            }
+        }
+        else if (mapped.kind === 'event-before-state') {
+            if (!afterStates.has(mapped.state)) {
+                findings.push({
+                    code: 'D2_MAPPED_STATE_MISSING',
+                    severity: 'warning',
+                    message: 'BEFORE invariant "' + invariant.id + '" maps to state ' + mapped.state + ', which is not declared in AFTER.',
+                    evidence: { invariant: invariant.id, state: mapped.state },
+                });
+            }
+        }
+        else if (mapped.kind === 'var-in-range') {
+            if (!afterVariables.has(mapped.variable)) {
+                findings.push({
+                    code: 'D2_VARIABLE_MISSING',
+                    severity: 'warning',
+                    message: 'BEFORE invariant "' + invariant.id + '" references variable ' + mapped.variable + ', which is not declared in AFTER.',
+                    evidence: { invariant: invariant.id, variable: mapped.variable },
+                });
+                continue;
+            }
+        }
+        else if (mapped.kind === 'leads-to') {
+            // The state references of a path-property invariant must follow stateMapping too,
+            // otherwise a pure rename searches for a state AFTER does not declare.
+            for (const state of [mapped.from, ...leadsToTargets(mapped)]) {
+                if (!afterStates.has(state)) {
+                    findings.push({
+                        code: 'D2_MAPPED_STATE_MISSING',
+                        severity: 'warning',
+                        message: 'BEFORE invariant "' + invariant.id + '" maps to state ' + state + ', which is not declared in AFTER.',
+                        evidence: { invariant: invariant.id, state },
+                    });
+                }
+            }
+        }
+        else if (mapped.kind === 'probability') {
+            if (!afterStates.has(mapped.target)) {
+                findings.push({
+                    code: 'D2_MAPPED_STATE_MISSING',
+                    severity: 'warning',
+                    message: 'BEFORE invariant "' + invariant.id + '" maps to state ' + mapped.target + ', which is not declared in AFTER.',
+                    evidence: { invariant: invariant.id, state: mapped.target },
+                });
+            }
+        }
+        // Every invariant the engine can decide is re-decided against AFTER. Path-property
+        // kinds go through the same searches their dedicated probes use, so D2 can no
+        // longer report "all BEFORE invariants continue to hold" while A9-A13 fail on the
+        // very same model.
+        const violation = isPathPropertyInvariant(mapped)
+            ? pathPropertyViolation(after, options, mapped)
+            : shortestViolationForInvariant(after, options, mapped);
+        if (violation !== undefined) {
+            findings.push(violation.undecided ? {
+                code: 'D2_UNDECIDED',
+                severity: 'warning',
+                message: 'BEFORE invariant "' + invariant.id + '" could not be re-decided against AFTER: ' + violation.reason + '. Absence is not proven.',
+                evidence: { beforeInvariant: invariant, afterInvariant: mapped },
+            } : {
+                code: 'D2_INVARIANT_REGRESSION',
+                severity: 'error',
+                message: 'BEFORE invariant "' + invariant.id + '" no longer holds in AFTER: ' + violation.reason,
+                path: violation.path,
+                evidence: { beforeInvariant: invariant, afterInvariant: mapped },
+            });
+        }
+    }
+    return checkResult('D2', 'Invariant Continuity', findings, findings.length === 0 ? 'All BEFORE invariants continue to hold' : 'Invariant continuity findings: ' + findings.length);
+}
+function D3_regressionDelta(before, after, mapping) {
+    const afterStateIds = new Set(after.states.map((state) => state.id));
+    const beforeMappedIds = new Set(before.states.map((state) => mapStateId(mapping, state.id)));
+    const addedStates = after.states.filter((state) => !beforeMappedIds.has(state.id)).map((state) => state.id).sort();
+    const removedStates = before.states.filter((state) => !afterStateIds.has(mapStateId(mapping, state.id))).map((state) => state.id).sort();
+    const beforeEvents = new Set(before.transitions.map((transition) => transition.event));
+    const afterEvents = new Set(after.transitions.map((transition) => transition.event));
+    const addedEvents = [...afterEvents].filter((event) => !beforeEvents.has(event)).sort();
+    const removedEvents = [...beforeEvents].filter((event) => !afterEvents.has(event)).sort();
+    const removedTransitions = before.transitions.filter((transition) => !after.transitions.some((candidate) => candidate.from === mapStateId(mapping, transition.from) &&
+        candidate.event === transition.event &&
+        candidate.to === mapStateId(mapping, transition.to)));
+    const addedTransitions = after.transitions.filter((transition) => !before.transitions.some((candidate) => mapStateId(mapping, candidate.from) === transition.from &&
+        candidate.event === transition.event &&
+        mapStateId(mapping, candidate.to) === transition.to));
+    const findings = [];
+    for (const state of removedStates) {
+        findings.push({ code: 'D3_REMOVED_STATE', severity: 'warning', message: 'BEFORE state ' + state + ' is not present in AFTER under the given mapping.', evidence: { state } });
+    }
+    for (const event of removedEvents) {
+        findings.push({ code: 'D3_REMOVED_EVENT', severity: 'warning', message: 'BEFORE event ' + event + ' is not present in AFTER.', evidence: { event } });
+    }
+    for (const transition of removedTransitions) {
+        findings.push({
+            code: 'D3_REMOVED_TRANSITION',
+            severity: 'warning',
+            message: 'BEFORE transition ' + transition.from + ' -' + transition.event + '-> ' + transition.to + ' has no exact AFTER counterpart.',
+            evidence: { transition },
+        });
+    }
+    const detail = 'Delta: +' + addedStates.length + ' states, -' + removedStates.length + ' states, +' + addedEvents.length + ' events, -' + removedEvents.length + ' events, +' + addedTransitions.length + ' transitions, -' + removedTransitions.length + ' transitions';
+    return checkResult('D3', 'Regression Delta', findings, detail);
+}
+function deadlockStateIds(model) {
+    const outgoing = new Set(model.transitions.map((transition) => transition.from));
+    return model.states.filter((state) => state.terminal !== true && !outgoing.has(state.id)).map((state) => state.id);
+}
+function closedSccStateSets(model) {
+    return sccs(model)
+        .filter((component) => {
+        const componentSet = new Set(component);
+        const internalEdges = model.transitions.some((transition) => componentSet.has(transition.from) && componentSet.has(transition.to));
+        const escapingEdges = model.transitions.some((transition) => componentSet.has(transition.from) && !componentSet.has(transition.to));
+        return internalEdges && !escapingEdges && !component.some((state) => isTerminal(model, state));
+    })
+        .map((component) => component.sort());
+}
+function D4_deadlockLivenessRegression(before, after, mapping) {
+    const findings = [];
+    const beforeDeadlock = new Set(deadlockStateIds(before).map((state) => mapStateId(mapping, state)));
+    const afterDeadlock = deadlockStateIds(after);
+    for (const state of afterDeadlock) {
+        if (!beforeDeadlock.has(state)) {
+            findings.push({
+                code: 'D4_DEADLOCK_REGRESSION',
+                severity: 'error',
+                message: 'AFTER introduces deadlock in state ' + state + ' that was not deadlocked in BEFORE.',
+                evidence: { state },
+            });
+        }
+    }
+    const beforeScc = new Set(closedSccStateSets(before).map((component) => component.map((state) => mapStateId(mapping, state)).sort().join(',')));
+    const afterScc = closedSccStateSets(after);
+    for (const component of afterScc) {
+        const key = component.join(',');
+        if (!beforeScc.has(key)) {
+            findings.push({
+                code: 'D4_LIVENESS_REGRESSION',
+                severity: 'error',
+                message: 'AFTER introduces a closed SCC with no exit and no terminal state: ' + key,
+                evidence: { states: component },
+            });
+        }
+    }
+    return checkResult('D4', 'Deadlock/Liveness Regression', findings, findings.length === 0 ? 'No new deadlock or liveness regressions' : 'Regression findings: ' + findings.length);
+}
+function buildComparisonSummary(before, after, mapping) {
+    const afterStateIds = new Set(after.states.map((state) => state.id));
+    const beforeMappedIds = new Set(before.states.map((state) => mapStateId(mapping, state.id)));
+    const addedStates = after.states.filter((state) => !beforeMappedIds.has(state.id)).map((state) => state.id).sort();
+    const removedStates = before.states.filter((state) => !afterStateIds.has(mapStateId(mapping, state.id))).map((state) => state.id).sort();
+    const beforeEvents = new Set(before.transitions.map((transition) => transition.event));
+    const afterEvents = new Set(after.transitions.map((transition) => transition.event));
+    const addedEvents = [...afterEvents].filter((event) => !beforeEvents.has(event)).sort();
+    const removedEvents = [...beforeEvents].filter((event) => !afterEvents.has(event)).sort();
+    const removedTransitions = before.transitions.filter((transition) => !after.transitions.some((candidate) => candidate.from === mapStateId(mapping, transition.from) &&
+        candidate.event === transition.event &&
+        candidate.to === mapStateId(mapping, transition.to)));
+    const addedTransitions = after.transitions.filter((transition) => !before.transitions.some((candidate) => mapStateId(mapping, candidate.from) === transition.from &&
+        candidate.event === transition.event &&
+        mapStateId(mapping, candidate.to) === transition.to));
+    return {
+        beforeModelHash: modelHash(before),
+        afterModelHash: modelHash(after),
+        stateMapping: mapping,
+        beforeStates: before.states.length,
+        beforeTransitions: before.transitions.length,
+        afterStates: after.states.length,
+        afterTransitions: after.transitions.length,
+        addedStates,
+        removedStates,
+        addedEvents,
+        removedEvents,
+        addedTransitions,
+        removedTransitions,
+    };
+}
+function A8_idempotentReplay(model, exploration) {
+    const events = model.idempotentEvents ?? [];
+    const findings = [];
+    for (const event of events) {
+        for (const runtime of exploration.reachable) {
+            const onceOptions = stepRuntime(model, runtime, event);
+            if (onceOptions.length === 0)
+                continue;
+            for (const once of onceOptions) {
+                const twiceOptions = stepRuntime(model, once, event);
+                if (twiceOptions.length === 0) {
+                    findings.push({
+                        code: 'A8_NOT_REPLAYABLE',
+                        severity: 'warning',
+                        message: 'Idempotent event ' + event + ' is not replayable after first application from ' + runtime.state + '.',
+                        path: [{ from: runtime.state, event, to: once.state }],
+                        evidence: { state: runtime.state, event },
+                    });
+                    continue;
+                }
+                for (const twice of twiceOptions) {
+                    if (runtimeKey(twice) !== runtimeKey(once)) {
+                        findings.push({
+                            code: 'A8_NOT_IDEMPOTENT',
+                            severity: 'error',
+                            message: 'Idempotent event ' + event + ' changes state when applied twice from ' + runtime.state + '.',
+                            path: [{ from: runtime.state, event, to: once.state }, { from: once.state, event, to: twice.state }],
+                            evidence: { state: runtime.state, event, afterOnce: once, afterTwice: twice },
+                        });
+                        break;
+                    }
+                }
+            }
+        }
+    }
+    return checkResult('A8', 'Idempotent Replay', withUnresolved(model, 'A8', findings), findings.length === 0 ? 'Idempotent events are replay-safe' : 'Idempotent replay findings: ' + findings.length);
+}
+/**
+ * Whether the guard proves `variable` stays at or below `bound` wherever it holds.
+ *
+ * Deliberately conservative in one direction only: a guard this function cannot read
+ * answers `false`, so an unreadable guard is reported as "not proven" rather than as
+ * "enforced". A conjunction bounds the value if any conjunct does; a disjunction has to
+ * bound it on every branch; a negation is never reasoned about.
+ */
+function guardImpliesUpperBound(guard, variable, bound) {
+    if (guard === undefined)
+        return false;
+    if ('variable' in guard) {
+        if (guard.variable !== variable || typeof guard.value !== 'number')
+            return false;
+        if (guard.op === '<')
+            return guard.value - 1 <= bound;
+        if (guard.op === '<=' || guard.op === '==')
+            return guard.value <= bound;
+        return false;
+    }
+    if ('all' in guard)
+        return guard.all.some((child) => guardImpliesUpperBound(child, variable, bound));
+    if ('any' in guard)
+        return guard.any.every((child) => guardImpliesUpperBound(child, variable, bound));
+    return false;
+}
+/** Mirror of {@link guardImpliesUpperBound} for the lower bound. */
+function guardImpliesLowerBound(guard, variable, bound) {
+    if (guard === undefined)
+        return false;
+    if ('variable' in guard) {
+        if (guard.variable !== variable || typeof guard.value !== 'number')
+            return false;
+        if (guard.op === '>')
+            return guard.value + 1 >= bound;
+        if (guard.op === '>=' || guard.op === '==')
+            return guard.value >= bound;
+        return false;
+    }
+    if ('all' in guard)
+        return guard.all.some((child) => guardImpliesLowerBound(child, variable, bound));
+    if ('any' in guard)
+        return guard.any.every((child) => guardImpliesLowerBound(child, variable, bound));
+    return false;
+}
+/**
+ * Whether the model's own declarations about a variable hold against what its
+ * transitions do. `inc` and `dec` are never clamped to `min`/`max` — the declared
+ * range is a property to check, not a bound on the search — so a counter whose guard
+ * does not pin it ranges past its own declaration, and the reachable set is unbounded
+ * however narrow the declaration looks.
+ *
+ * Reporting the declaration rather than silently clamping is deliberate. Clamping would
+ * delete the very states a range violation is witnessed by, turning a counterexample
+ * into a false pass.
+ */
+function declaredDomainFindings(model) {
+    const findings = [];
+    for (const transition of model.transitions) {
+        for (const update of transition.updates ?? []) {
+            const variable = (model.variables ?? []).find((entry) => entry.name === update.variable);
+            if (variable === undefined)
+                continue;
+            const delta = typeof update.value === 'number' ? update.value : 1;
+            const at = transition.from + ' + ' + transition.event;
+            if (update.op === 'inc' && variable.max !== undefined && !guardImpliesUpperBound(transition.guard, variable.name, variable.max - delta)) {
+                findings.push({
+                    code: 'S8_DOMAIN_NOT_ENFORCED',
+                    severity: 'warning',
+                    message: at + ' increments ' + variable.name + ', but ' + variable.name + ' declares max ' + variable.max + ' and no guard keeps it there: the declared range is not a bound on reachable values.',
+                    evidence: { variable: variable.name, declaredMax: variable.max, transition: at },
+                });
+            }
+            if (update.op === 'dec' && variable.min !== undefined && !guardImpliesLowerBound(transition.guard, variable.name, variable.min + delta)) {
+                findings.push({
+                    code: 'S8_DOMAIN_NOT_ENFORCED',
+                    severity: 'warning',
+                    message: at + ' decrements ' + variable.name + ', but ' + variable.name + ' declares min ' + variable.min + ' and no guard keeps it there: the declared range is not a bound on reachable values.',
+                    evidence: { variable: variable.name, declaredMin: variable.min, transition: at },
+                });
+            }
+            if (update.op === 'set' && typeof update.value === 'number') {
+                if (variable.min !== undefined && update.value < variable.min) {
+                    findings.push({
+                        code: 'S8_DOMAIN_SET_OUTSIDE',
+                        severity: 'error',
+                        message: at + ' sets ' + variable.name + ' to ' + update.value + ', below its declared min ' + variable.min + '.',
+                        evidence: { variable: variable.name, value: update.value, declaredMin: variable.min },
+                    });
+                }
+                if (variable.max !== undefined && update.value > variable.max) {
+                    findings.push({
+                        code: 'S8_DOMAIN_SET_OUTSIDE',
+                        severity: 'error',
+                        message: at + ' sets ' + variable.name + ' to ' + update.value + ', above its declared max ' + variable.max + '.',
+                        evidence: { variable: variable.name, value: update.value, declaredMax: variable.max },
+                    });
+                }
+            }
+        }
+    }
+    return findings;
+}
+function S8_monotonicVariables(model) {
+    const findings = [];
+    for (const variable of model.variables ?? []) {
+        if (variable.monotonic === undefined)
+            continue;
+        for (const transition of model.transitions) {
+            for (const update of transition.updates ?? []) {
+                if (update.variable !== variable.name)
+                    continue;
+                if (variable.monotonic === 'inc' && update.op === 'dec') {
+                    findings.push({ code: 'S8_MONOTONIC_DECREASE', severity: 'error', message: 'Monotonic (inc) variable ' + variable.name + ' is decreased by ' + transition.event + '.', evidence: { variable: variable.name, transition } });
+                }
+                else if (variable.monotonic === 'dec' && update.op === 'inc') {
+                    findings.push({ code: 'S8_MONOTONIC_INCREASE', severity: 'error', message: 'Monotonic (dec) variable ' + variable.name + ' is increased by ' + transition.event + '.', evidence: { variable: variable.name, transition } });
+                }
+                else if (update.op === 'set') {
+                    findings.push({ code: 'S8_MONOTONIC_SET_REVIEW', severity: 'warning', message: 'Monotonic variable ' + variable.name + ' uses set in ' + transition.event + '; verify it cannot move backwards.', evidence: { variable: variable.name, transition } });
+                }
+            }
+        }
+    }
+    findings.push(...declaredDomainFindings(model));
+    return checkResult('S8', 'Variable Declarations', findings, findings.length === 0 ? 'Variable declarations are respected' : 'Variable declaration findings: ' + findings.length);
+}
+/**
+ * Target states of a `leads-to` invariant. The schema accepts one state id or a
+ * non-empty array of them, so "reach any of these" needs no separate invariant kind.
+ */
+function leadsToTargets(invariant) {
+    return typeof invariant.to === 'string' ? [invariant.to] : invariant.to;
+}
+/** Target list as findings print it. A single target renders as its bare id, so existing messages stay byte-identical. */
+function leadsToTargetLabel(invariant) {
+    return leadsToTargets(invariant).join(', ');
+}
+/**
+ * Find a run from `start` that reaches none of `targets`, or return undefined when
+ * every run reaches at least one of them. The property is universal (see the A9 row
+ * in `SKILL.md`): one branch that loops forever, or that stops before any target,
+ * refutes it.
+ *
+ * The search is a depth-first walk of the run graph with three colours, and runs at a
+ * target are success leaves that are never expanded:
+ *
+ * - a node reached while it is on the current walk (GRAY) closes a cycle that avoids
+ *   every target, so some run never reaches one;
+ * - a node with no outgoing step at all stops the machine where it stands, which is
+ *   the same violation for a different reason;
+ * - a node whose walk completed without a violation is BLACK, and reaching it again
+ *   from another branch is a shared sub-graph, not a cycle.
+ *
+ * That last point is why the colour map cannot be a plain visited set: a diamond
+ * (two branches rejoining) is acyclic and must pass, while a genuine cycle must not.
+ * A run is identified by its state plus its variable values, so the same state id
+ * with different values is a different node.
+ *
+ * Two properties keep the walk from taking the host down, and both are load-bearing:
+ * the walk is **budgeted**, and it stores a **parent link** per node instead of a copy
+ * of the path. Without the budget an unbounded counter makes the run graph infinite, so
+ * the three colours above never repeat a key and the walk never returns; without the
+ * parent link every frame retains its own copy of the path, which grows the walk's
+ * memory quadratically in its depth. Either one alone turns "the model is wrong" into
+ * an out-of-memory abort, which is the failure this function must not have.
+ *
+ * An exhausted budget is reported as `undecided`, never as `undefined`: a walk that
+ * did not finish has not proven that every run reaches a target.
+ */
+function findLeadsToBadPath(model, start, targets, label, walk) {
+    if (targets.has(start.state))
+        return { undecided: false };
+    const GRAY = 1;
+    const BLACK = 2;
+    const pathOf = (frame) => {
+        const steps = [];
+        let node = frame;
+        while (node !== undefined && node.step !== undefined) {
+            steps.push(node.step);
+            node = node.parent;
+        }
+        return steps.reverse();
+    };
+    const color = new Map();
+    const stack = [{ runtime: start, parent: undefined, step: undefined, nexts: undefined, index: 0 }];
+    color.set(runtimeKey(start), GRAY);
+    while (stack.length > 0) {
+        if (walk.remaining <= 0)
+            return { undecided: true };
+        walk.remaining -= 1;
+        const frame = stack[stack.length - 1];
+        if (frame.nexts === undefined) {
+            const nexts = [];
+            for (const event of allEvents(model)) {
+                for (const next of stepRuntime(model, frame.runtime, event))
+                    nexts.push({ next, event });
+            }
+            frame.nexts = nexts;
+            if (nexts.length === 0)
+                return { violation: { path: pathOf(frame), reason: 'Dead end before target ' + label }, undecided: false };
+        }
+        if (frame.index >= frame.nexts.length) {
+            color.set(runtimeKey(frame.runtime), BLACK);
+            stack.pop();
+            continue;
+        }
+        const { next, event } = frame.nexts[frame.index];
+        frame.index += 1;
+        const step = { from: frame.runtime.state, event, to: next.state };
+        if (targets.has(next.state))
+            continue;
+        const key = runtimeKey(next);
+        const seen = color.get(key);
+        if (seen === GRAY)
+            return { violation: { path: [...pathOf(frame), step], reason: 'Cycle avoids target ' + label }, undecided: false };
+        if (seen === BLACK)
+            continue;
+        color.set(key, GRAY);
+        stack.push({ runtime: next, parent: frame, step, nexts: undefined, index: 0 });
+    }
+    // Every branch either reached a target or rejoined a branch that did.
+    return { undecided: false };
+}
+function A9_leadsTo(model, exploration, options) {
+    const findings = [];
+    for (const invariant of model.invariants ?? []) {
+        if (invariant.kind !== 'leads-to')
+            continue;
+        const targets = new Set(leadsToTargets(invariant));
+        const label = leadsToTargetLabel(invariant);
+        const budget = leadsToWalkBudget(options);
+        const walk = { remaining: budget };
+        for (const runtime of exploration.reachable) {
+            if (runtime.state !== invariant.from)
+                continue;
+            const outcome = findLeadsToBadPath(model, runtime, targets, label, walk);
+            if (outcome.undecided) {
+                findings.push({
+                    code: 'A9_LEADS_TO_UNDECIDED',
+                    severity: 'warning',
+                    message: 'Leads-to invariant "' + invariant.id + '" is undecided: the walk spent its budget of ' + budget + ' steps from ' + invariant.from + ' without finding a run that avoids ' + label + ', or proving that none exists. Absence is not proven.',
+                    evidence: { invariant },
+                });
+                break;
+            }
+            if (outcome.violation !== undefined) {
+                findings.push({
+                    code: 'A9_LEADS_TO_VIOLATION',
+                    severity: 'error',
+                    message: 'Leads-to invariant "' + invariant.id + '" violated from ' + invariant.from + ': ' + outcome.violation.reason,
+                    path: outcome.violation.path,
+                    evidence: { invariant },
+                });
+                break;
+            }
+        }
+    }
+    const undecided = findings.some((finding) => finding.code === 'A9_LEADS_TO_UNDECIDED');
+    return checkResult('A9', 'Leads-To', findings, findings.length === 0
+        ? 'All leads-to invariants hold'
+        : undecided ? 'Leads-to undecided: the search budget ran out' : 'Leads-to findings: ' + findings.length);
+}
+function findSequenceViolation(model, options, invariant) {
+    const events = invariant.events;
+    const init = initialState(model);
+    const key = (runtime, progress) => runtimeKey(runtime) + '|' + progress;
+    const visited = new Set([key(init, 0)]);
+    const queue = [{ runtime: init, progress: 0, path: [] }];
+    let steps = 0;
+    // A cap is not a verdict. This walk keys on the runtime plus the progress along the declared order, so it
+    // outlasts the exploration, and the caller has to be able to tell "no violation" from "not finished".
+    let capped = false;
+    while (queue.length > 0) {
+        const entry = queue.shift();
+        if (++steps > options.maxStates) {
+            capped = true;
+            break;
+        }
+        for (const event of allEvents(model)) {
+            for (const next of stepRuntime(model, entry.runtime, event)) {
+                let progress = entry.progress;
+                let violation = false;
+                if (progress < events.length && event === events[progress]) {
+                    progress += 1;
+                }
+                else {
+                    const index = events.indexOf(event);
+                    if (index > progress)
+                        violation = true;
+                }
+                const path = [...entry.path, { from: entry.runtime.state, event, to: next.state }];
+                if (violation) {
+                    return { invariant, path, reason: 'Event ' + event + ' occurred before ' + events[progress] };
+                }
+                const nextKey = key(next, progress);
+                if (!visited.has(nextKey)) {
+                    visited.add(nextKey);
+                    queue.push({ runtime: next, progress, path });
+                }
+            }
+        }
+    }
+    if (capped)
+        return { invariant, path: [], reason: invariantCapReason(options), undecided: true };
+    return undefined;
+}
+function A10_sequenceOrder(model, options) {
+    const findings = [];
+    for (const invariant of model.invariants ?? []) {
+        if (invariant.kind !== 'sequence')
+            continue;
+        const violation = findSequenceViolation(model, options, invariant);
+        if (violation === undefined)
+            continue;
+        if (violation.undecided) {
+            findings.push({
+                code: 'A10_UNDECIDED',
+                severity: 'warning',
+                message: 'Sequence invariant "' + invariant.id + '" (' + invariant.description + ') could not be decided: ' + violation.reason + '. Absence of a violation is not proven.',
+                evidence: { invariant, maxStates: options.maxStates },
+            });
+            continue;
+        }
+        findings.push({
+            code: 'A10_SEQUENCE_VIOLATION',
+            severity: 'error',
+            message: 'Sequence invariant "' + invariant.id + '" violated: ' + violation.reason,
+            path: violation.path,
+            evidence: { invariant },
+        });
+    }
+    const undecided = findings.some((finding) => finding.code === 'A10_UNDECIDED');
+    return checkResult('A10', 'Sequence Order', findings, findings.length === 0
+        ? 'All sequence invariants hold'
+        : undecided && findings.every((finding) => finding.code === 'A10_UNDECIDED') ? 'Sequence walk stopped at the state budget: undecided' : 'Sequence findings: ' + findings.length);
+}
+function findAtomicityViolation(model, options, invariant) {
+    const atomic = new Set(invariant.events);
+    const init = initialState(model);
+    const key = (runtime, started, closed) => runtimeKey(runtime) + '|' + (started ? '1' : '0') + '|' + (closed ? '1' : '0');
+    const visited = new Set([key(init, false, false)]);
+    const queue = [{ runtime: init, started: false, closed: false, path: [] }];
+    let steps = 0;
+    // Same third outcome as the other walks: this one keys on the runtime plus the two flags of the atomic group,
+    // so it can outlast the exploration, and "no leak" is not the same answer as "not finished".
+    let capped = false;
+    while (queue.length > 0) {
+        const entry = queue.shift();
+        if (++steps > options.maxStates) {
+            capped = true;
+            break;
+        }
+        for (const event of allEvents(model)) {
+            for (const next of stepRuntime(model, entry.runtime, event)) {
+                const started = entry.started || atomic.has(event);
+                const closed = entry.closed || event === invariant.commit || (invariant.rollback !== undefined && event === invariant.rollback);
+                const path = [...entry.path, { from: entry.runtime.state, event, to: next.state }];
+                if (entry.started && !entry.closed && !atomic.has(event) && event !== invariant.commit && event !== invariant.rollback) {
+                    return { invariant, path, reason: 'Left atomic scope via ' + event + ' without commit/rollback' };
+                }
+                if (started && !closed && isTerminal(model, next.state)) {
+                    return { invariant, path, reason: 'Terminal state reached with incomplete atomic group' };
+                }
+                const nextKey = key(next, started, closed);
+                if (!visited.has(nextKey)) {
+                    visited.add(nextKey);
+                    queue.push({ runtime: next, started, closed, path });
+                }
+            }
+        }
+    }
+    if (capped)
+        return { invariant, path: [], reason: invariantCapReason(options), undecided: true };
+    return undefined;
+}
+function A11_atomicity(model, options) {
+    const findings = [];
+    for (const invariant of model.invariants ?? []) {
+        if (invariant.kind !== 'atomicity')
+            continue;
+        const violation = findAtomicityViolation(model, options, invariant);
+        if (violation === undefined)
+            continue;
+        if (violation.undecided) {
+            findings.push({
+                code: 'A11_UNDECIDED',
+                severity: 'warning',
+                message: 'Atomicity invariant "' + invariant.id + '" (' + invariant.description + ') could not be decided: ' + violation.reason + '. Absence of a violation is not proven.',
+                evidence: { invariant, maxStates: options.maxStates },
+            });
+            continue;
+        }
+        findings.push({
+            code: 'A11_ATOMICITY_VIOLATION',
+            severity: 'error',
+            message: 'Atomicity invariant "' + invariant.id + '" violated: ' + violation.reason,
+            path: violation.path,
+            evidence: { invariant },
+        });
+    }
+    const undecided = findings.some((finding) => finding.code === 'A11_UNDECIDED');
+    return checkResult('A11', 'Atomicity', findings, findings.length === 0
+        ? 'All atomicity invariants hold'
+        : undecided && findings.every((finding) => finding.code === 'A11_UNDECIDED') ? 'Atomicity walk stopped at the state budget: undecided' : 'Atomicity findings: ' + findings.length);
+}
+// ---------------------------------------------------------------------------
+// A12 — Budget (worst-case path cost)
+// ---------------------------------------------------------------------------
+function transitionCost(transition) {
+    return transition.cost ?? 1;
+}
+function runtimeGraph(model, options) {
+    const groupMap = groupTransitions(model);
+    const exploration = explore(model, options);
+    const edges = new Map();
+    for (const runtime of exploration.reachable) {
+        const out = [];
+        for (const event of allEvents(model)) {
+            const group = groupMap.get(runtime.state + '|' + event);
+            if (group === undefined || group.length === 0)
+                continue;
+            for (const transition of applicableTransitions(group, runtime)) {
+                const next = applyUpdates(model, transition, runtime);
+                out.push({
+                    to: runtimeKey(next),
+                    step: { from: runtime.state, event: transition.event, to: next.state },
+                    cost: transitionCost(transition),
+                });
+            }
+        }
+        edges.set(runtimeKey(runtime), out);
+    }
+    return {
+        edges,
+        keys: exploration.reachable.map((runtime) => runtimeKey(runtime)),
+        initKey: runtimeKey(exploration.initialState),
+    };
+}
+/** Shortest path from init to targetKey over the runtime graph, or undefined when unreachable. */
+function runtimePathToKey(graph, targetKey) {
+    const parent = new Map();
+    const visited = new Set([graph.initKey]);
+    const queue = [graph.initKey];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (current === targetKey) {
+            const steps = [];
+            let key = targetKey;
+            while (key !== graph.initKey) {
+                const step = parent.get(key);
+                if (step === undefined)
+                    break;
+                steps.unshift(step);
+                key = step.from === undefined ? graph.initKey : keyOfFromStep(graph, step, key);
+            }
+            return steps;
+        }
+        for (const edge of graph.edges.get(current) ?? []) {
+            if (visited.has(edge.to))
+                continue;
+            visited.add(edge.to);
+            parent.set(edge.to, edge.step);
+            queue.push(edge.to);
+        }
+    }
+    return undefined;
+}
+function keyOfFromStep(graph, step, targetKey) {
+    // Reconstruct the source key by scanning predecessors of targetKey whose step matches.
+    for (const [from, edges] of graph.edges) {
+        for (const edge of edges) {
+            if (edge.to === targetKey && edge.step.event === step.event && edge.step.from === step.from && edge.step.to === step.to) {
+                return from;
+            }
+        }
+    }
+    return graph.initKey;
+}
+/** Find a reachable cycle whose total cost is positive; return a witness path init -> one full round. */
+function findUnboundedCycle(model, options) {
+    const graph = runtimeGraph(model, options);
+    const color = new Map();
+    for (const start of graph.keys) {
+        if (color.has(start))
+            continue;
+        const nodeStack = [start];
+        const idxStack = [0];
+        const depthOf = new Map([[start, 0]]);
+        const costAt = new Map([[start, 0]]);
+        const prevKey = new Map();
+        const prevStep = new Map();
+        color.set(start, 1);
+        while (nodeStack.length > 0) {
+            const node = nodeStack[nodeStack.length - 1];
+            const outs = graph.edges.get(node) ?? [];
+            if (idxStack[idxStack.length - 1] < outs.length) {
+                const edge = outs[idxStack[idxStack.length - 1]++];
+                const seen = color.get(edge.to);
+                if (seen === undefined) {
+                    color.set(edge.to, 1);
+                    depthOf.set(edge.to, depthOf.get(node) + 1);
+                    costAt.set(edge.to, costAt.get(node) + edge.cost);
+                    prevKey.set(edge.to, node);
+                    prevStep.set(edge.to, edge.step);
+                    nodeStack.push(edge.to);
+                    idxStack.push(0);
+                }
+                else if (seen === 1) {
+                    // Back edge on the current path: this is a true cycle.
+                    const cycleCost = costAt.get(node) + edge.cost - costAt.get(edge.to);
+                    if (cycleCost > 0) {
+                        const entry = runtimePathToKey(graph, edge.to) ?? [];
+                        const round = [];
+                        let cursor = node;
+                        while (cursor !== edge.to && prevStep.has(cursor)) {
+                            round.unshift(prevStep.get(cursor));
+                            cursor = prevKey.get(cursor);
+                        }
+                        round.push(edge.step);
+                        return [...entry, ...round];
+                    }
+                }
+            }
+            else {
+                color.set(node, 2);
+                nodeStack.pop();
+                idxStack.pop();
+                depthOf.delete(node);
+                costAt.delete(node);
+                prevKey.delete(node);
+                prevStep.delete(node);
+            }
+        }
+    }
+    return undefined;
+}
+function findBudgetViolation(model, options, invariant) {
+    const groupMap = groupTransitions(model);
+    const init = initialState(model);
+    const bestCost = new Map([[runtimeKey(init), 0]]);
+    const queue = [{ runtime: init, cost: 0, path: [] }];
+    let steps = 0;
+    while (queue.length > 0) {
+        const entry = queue.shift();
+        // Stopping here decides nothing: the cost of the paths beyond the budget is unknown, which is not the
+        // same answer as 'no violation'. It is the third outcome this function now has.
+        if (++steps > options.maxStates)
+            return 'undecided';
+        for (const event of allEvents(model)) {
+            const group = groupMap.get(entry.runtime.state + '|' + event);
+            if (group === undefined || group.length === 0)
+                continue;
+            for (const transition of applicableTransitions(group, entry.runtime)) {
+                const next = applyUpdates(model, transition, entry.runtime);
+                const cost = entry.cost + transitionCost(transition);
+                const path = [...entry.path, { from: entry.runtime.state, event: transition.event, to: next.state }];
+                // Costs are non-negative, so the first step that pushes the accumulated cost
+                // over the budget is already a witness.
+                if (cost > invariant.budget)
+                    return { path, cost, unbounded: false };
+                const key = runtimeKey(next);
+                const best = bestCost.get(key);
+                if (best === undefined || cost < best) {
+                    bestCost.set(key, cost);
+                    queue.push({ runtime: next, cost, path });
+                }
+            }
+        }
+    }
+    // No finite path exceeds the budget within reachable space; a reachable positive-cost
+    // cycle still makes the worst-case unbounded. Plain DAG merges are not cycles.
+    const cycle = findUnboundedCycle(model, options);
+    if (cycle !== undefined)
+        return { path: cycle, unbounded: true };
+    return undefined;
+}
+function A12_budget(model, options) {
+    const budgets = (model.invariants ?? []).filter((invariant) => invariant.kind === 'budget');
+    const usesCost = model.transitions.some((transition) => transition.cost !== undefined);
+    const findings = [];
+    if (usesCost && budgets.length === 0) {
+        findings.push({
+            code: 'A12_COST_WITHOUT_BUDGET',
+            severity: 'warning',
+            message: 'Transitions declare cost, but no budget invariant is declared, so worst-case path cost is not verified. Add an invariant of kind budget to check it.',
+        });
+    }
+    for (const invariant of budgets) {
+        const violation = findBudgetViolation(model, options, invariant);
+        if (violation === 'undecided') {
+            findings.push({
+                code: 'A12_UNDECIDED',
+                severity: 'warning',
+                message: 'The worst-case path search for budget invariant "' + invariant.id + '" stopped at the ' + String(options.maxStates) + ' state budget before it finished, so the budget is undecided rather than met. Raise maxStates, or narrow the model.',
+                evidence: { invariant, maxStates: options.maxStates },
+            });
+            continue;
+        }
+        if (violation !== undefined) {
+            findings.push({
+                code: 'A12_BUDGET_OVER',
+                severity: 'error',
+                message: violation.unbounded
+                    ? 'Budget invariant "' + invariant.id + '" (' + invariant.description + ') exceeded: a reachable positive-cost cycle lets path cost grow without bound, so no finite budget ' + invariant.budget + ' holds.'
+                    : 'Budget invariant "' + invariant.id + '" (' + invariant.description + ') exceeded: worst-case path cost ' + violation.cost + ' is over budget ' + invariant.budget + '.',
+                path: violation.path,
+                evidence: violation.unbounded ? { invariant, unbounded: true } : { invariant, totalCost: violation.cost, unbounded: false },
+            });
+        }
+    }
+    const undecided = findings.some((finding) => finding.code === 'A12_UNDECIDED');
+    return checkResult('A12', 'Budget', findings, undecided ? 'Budget walk stopped at the state budget: undecided' : findings.length === 0 ? (budgets.length === 0 ? 'No budget invariants declared' : 'All budget invariants hold') : 'Budget findings: ' + findings.length);
+}
+// ---------------------------------------------------------------------------
+// A13 — Probability reachability (DTMC)
+// ---------------------------------------------------------------------------
+function probabilityOutcomes(model, runtime) {
+    const groupMap = groupTransitions(model);
+    const outcomes = new Map();
+    for (const event of allEvents(model)) {
+        const group = groupMap.get(runtime.state + '|' + event);
+        if (group === undefined || group.length === 0)
+            continue;
+        for (const transition of applicableTransitions(group, runtime)) {
+            const weight = transition.weight ?? 1;
+            if (!(weight > 0))
+                continue;
+            const next = applyUpdates(model, transition, runtime);
+            const key = runtimeKey(next);
+            const current = outcomes.get(key);
+            if (current === undefined)
+                outcomes.set(key, { state: next.state, weight });
+            else
+                current.weight += weight;
+        }
+    }
+    return outcomes;
+}
+/**
+ * Probability of ever reaching targetState from the initial state under the DTMC
+ * interpretation: at each runtime state every applicable transition with weight > 0 is an
+ * outcome chosen proportionally to its weight. Solved by value iteration (least fixed
+ * point of the absorbing chain).
+ */
+function computeHitProbability(model, options, targetState) {
+    const exploration = explore(model, options);
+    const reachable = exploration.reachable;
+    const n = reachable.length;
+    const keyIndex = new Map();
+    reachable.forEach((runtime, i) => keyIndex.set(runtimeKey(runtime), i));
+    const fixedValue = new Array(n).fill(null);
+    const chains = [];
+    for (let i = 0; i < n; i++) {
+        const runtime = reachable[i];
+        if (runtime.state === targetState) {
+            fixedValue[i] = 1;
+            chains.push([]);
+            continue;
+        }
+        const outs = probabilityOutcomes(model, runtime);
+        let sum = 0;
+        const list = [];
+        for (const [key, entry] of outs) {
+            const j = keyIndex.get(key);
+            if (j === undefined)
+                continue;
+            list.push({ j, w: entry.weight });
+            sum += entry.weight;
+        }
+        if (sum <= 0) {
+            fixedValue[i] = 0;
+            chains.push([]);
+            continue;
+        }
+        chains.push(list.map((item) => ({ j: item.j, w: item.w / sum })));
+    }
+    const p = new Array(n).fill(0);
+    let converged = false;
+    for (let iter = 0; iter < 20000; iter++) {
+        let maxDelta = 0;
+        for (let i = 0; i < n; i++) {
+            if (fixedValue[i] !== null)
+                continue;
+            const list = chains[i];
+            let acc = 0;
+            for (const item of list) {
+                const fixed = fixedValue[item.j];
+                acc += item.w * (fixed === null ? p[item.j] : fixed);
+            }
+            const delta = Math.abs(acc - p[i]);
+            if (delta > maxDelta)
+                maxDelta = delta;
+            p[i] = acc;
+        }
+        if (maxDelta < 1e-9) {
+            converged = true;
+            break;
+        }
+    }
+    const initIndex = keyIndex.get(runtimeKey(exploration.initialState)) ?? 0;
+    const fixed = fixedValue[initIndex];
+    return { probability: fixed === null ? p[initIndex] : fixed, converged };
+}
+function A13_probability(model, options) {
+    const findings = [];
+    for (const invariant of model.invariants ?? []) {
+        if (invariant.kind !== 'probability')
+            continue;
+        const { probability, converged } = computeHitProbability(model, options, invariant.target);
+        if (probabilityViolated(invariant, probability)) {
+            findings.push({
+                code: 'A13_PROBABILITY_VIOLATION',
+                severity: 'error',
+                message: 'Probability invariant "' + invariant.id + '" (' + invariant.description + ') violated: P(hit ' + invariant.target + ') = ' + probability.toFixed(6) + ' does not satisfy ' + invariant.op + ' ' + invariant.p + '.',
+                evidence: { invariant, computed: probability, converged },
+            });
+        }
+        else if (!converged) {
+            findings.push({
+                code: 'A13_NO_CONVERGENCE',
+                severity: 'warning',
+                message: 'Probability invariant "' + invariant.id + '" passes, but value iteration did not fully converge within the iteration cap.',
+                evidence: { invariant, computed: probability, converged },
+            });
+        }
+    }
+    return checkResult('A13', 'Probability Reachability', findings, findings.length === 0 ? 'No probability invariants declared or all hold' : 'Probability findings: ' + findings.length);
+}
+// ---------------------------------------------------------------------------
+// A14 — Deadline (discrete tick clock)
+// ---------------------------------------------------------------------------
+function A14_deadline(model, options) {
+    const findings = [];
+    const tickEvents = new Set(model.tickEvents ?? []);
+    const limits = new Map();
+    let hasLimit = false;
+    for (const state of model.states) {
+        if (state.maxTicks !== undefined) {
+            limits.set(state.id, state.maxTicks);
+            hasLimit = true;
+        }
+    }
+    if (!hasLimit) {
+        return checkResult('A14', 'Deadline', withUnresolved(model, 'A14', []), 'No state declares maxTicks');
+    }
+    if (tickEvents.size === 0) {
+        return checkResult('A14', 'Deadline', withUnresolved(model, 'A14', [{
+                code: 'A14_NO_TICK_EVENTS',
+                severity: 'warning',
+                message: 'States declare maxTicks, but no tickEvents are declared, so deadline compliance cannot be verified.',
+            }]), 'Missing tick events');
+    }
+    const groupMap = groupTransitions(model);
+    const init = initialState(model);
+    const limitOf = (stateId) => limits.get(stateId);
+    const queue = [{ runtime: init, ticks: 0, path: [] }];
+    const seen = new Set();
+    let steps = 0;
+    // Whether the walk stopped because the budget ran out rather than because the space was exhausted. A
+    // search that did not finish cannot answer "all deadlines hold", so the check has to say which it was.
+    let capped = false;
+    while (queue.length > 0) {
+        const entry = queue.shift();
+        if (++steps > options.maxStates) {
+            capped = true;
+            break;
+        }
+        const key = runtimeKey(entry.runtime) + '|' + entry.ticks;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        for (const event of allEvents(model)) {
+            const group = groupMap.get(entry.runtime.state + '|' + event);
+            if (group === undefined || group.length === 0)
+                continue;
+            for (const transition of applicableTransitions(group, entry.runtime)) {
+                const next = applyUpdates(model, transition, entry.runtime);
+                const isTick = tickEvents.has(event);
+                const stays = next.state === entry.runtime.state;
+                const path = [...entry.path, { from: entry.runtime.state, event: transition.event, to: next.state }];
+                let ticks;
+                if (isTick && stays) {
+                    const lim = limitOf(next.state);
+                    if (lim !== undefined && entry.ticks + 1 > lim) {
+                        findings.push({
+                            code: 'A14_DEADLINE_MISS',
+                            severity: 'error',
+                            message: 'Deadline missed: state ' + next.state + ' can remain resident for more than ' + lim + ' tick(s).',
+                            path,
+                            evidence: { state: next.state, maxTicks: lim, ticks: entry.ticks + 1 },
+                        });
+                        continue;
+                    }
+                    ticks = entry.ticks + 1;
+                }
+                else if (isTick && !stays) {
+                    ticks = 0;
+                }
+                else if (!isTick && stays) {
+                    ticks = entry.ticks;
+                }
+                else {
+                    ticks = 0;
+                }
+                const nextKey = runtimeKey(next) + '|' + ticks;
+                if (!seen.has(nextKey))
+                    queue.push({ runtime: next, ticks, path });
+            }
+        }
+    }
+    // A capped walk decided nothing about the part it never reached. `_UNDECIDED` is the vocabulary the schema
+    // reference names for exactly this, and a code ending in `_UNDECIDED` carries it into `summary.truncated`.
+    if (capped) {
+        findings.push({
+            code: 'A14_UNDECIDED',
+            severity: 'warning',
+            message: 'The deadline walk stopped at the ' + String(options.maxStates) + ' state budget before it finished, so deadline compliance is undecided rather than proven. Raise maxStates, or narrow the model.',
+            evidence: { maxStates: options.maxStates, steps },
+        });
+    }
+    return checkResult('A14', 'Deadline', withUnresolved(model, 'A14', findings), capped ? 'Deadline walk stopped at the state budget: undecided' : findings.length === 0 ? 'All deadlines respected' : 'Deadline findings: ' + findings.length);
+}
+// ---------------------------------------------------------------------------
+// Coverage notes (informational gap notices)
+// ---------------------------------------------------------------------------
+// Underscore-separated identifiers like watchdog_timeout or isr_cmd are common in
+// state machines, so boundaries must treat '_' as a separator rather than a word char.
+const TIMING_VOCABULARY = /(?<![a-z0-9])(timeout|watchdog|timer|tick|deadline|period|delay|elapsed|latency)(?![a-z0-9])/i;
+const PREEMPTION_VOCABULARY = /(?<![a-z0-9])(isr|irq|interrupt|task|thread|preempt|rtos)(?![a-z0-9])/i;
+const HYBRID_VOCABULARY = /(?<![a-z0-9])(pid|plant|feedback|control.?loop|stability|stable|settling|damping|oscillat|chatter|kalman|foc|field.?weaken|motor|torque)(?![a-z0-9])/i;
+const PROBABILISTIC_VOCABULARY = /(?<![a-z0-9])(mtbf|mttf|failure.?rate|reliability|probability|probabilistic|markov|stochastic|fault.?tree|fmea)(?![a-z0-9])/i;
+function computeCoverageNotes(model) {
+    const names = [];
+    for (const state of model.states) {
+        names.push(state.id);
+        for (const action of state.onEntry ?? [])
+            names.push(action);
+        for (const action of state.onExit ?? [])
+            names.push(action);
+    }
+    for (const transition of model.transitions)
+        names.push(transition.event);
+    const corpus = names.join(' ');
+    const notes = [];
+    if (TIMING_VOCABULARY.test(corpus)) {
+        notes.push('The model references time-like vocabulary (timeout/watchdog/timer/deadline...). This plugin verifies ordering, counts and path budgets (A12) but not hard real-time semantics: deadlines, periods, and clock invariants need a timed model checker (e.g. UPPAAL).');
+    }
+    if (PREEMPTION_VOCABULARY.test(corpus)) {
+        notes.push('The model references preemption/concurrency vocabulary (ISR/IRQ/task/interrupt...). This plugin models event-order interleavings (A2/A3) but not preemptive concurrency; absolute claims such as thread-safe or interrupt-safe need dedicated verification (TSan, CBMC, or a model checker such as TLA+).');
+    }
+    if (HYBRID_VOCABULARY.test(corpus)) {
+        notes.push('The model references control/hybrid vocabulary (pid/plant/feedback/stability/motor...). This plugin verifies discrete transitions only; stability, settling time, and mode-switch dynamics over a continuous plant need hybrid verification (SpaceEx, Flow*, or Simulink/Stateflow analysis).');
+    }
+    if (PROBABILISTIC_VOCABULARY.test(corpus)) {
+        notes.push('The model references probabilistic/reliability vocabulary (mtbf/failure rate/probability...). This plugin is a qualitative model checker; reliability or probability claims need a stochastic model checker (PRISM, Storm) or fault-tree analysis.');
+    }
+    return notes;
+}
+// ---------------------------------------------------------------------------
+// main entry
+// ---------------------------------------------------------------------------
+export function runVerification(input, options = {}) {
+    // A bound that was replaced or clamped is recorded here and reported through the summary, so a
+    // caller who asked for 10^12 learns the answer came from a smaller search instead of reading a
+    // truncated report as a complete one.
+    const boundNotes = [];
+    const normalized = {
+        maxStates: boundedOption(options.maxStates, DEFAULT_MAX_STATES, MAX_STATES_CEILING, 'maxStates', boundNotes),
+        maxPermutationEvents: boundedOption(options.maxPermutationEvents, DEFAULT_MAX_PERMUTATION_EVENTS, MAX_PERMUTATION_EVENTS_CEILING, 'maxPermutationEvents', boundNotes),
+    };
+    const hashSpec = options.hashSpec ?? DEFAULT_HASH_SPEC;
+    const metadataKeys = metadataKeysOf(input);
+    const metadata = metadataKeys.length === 0 ? {} : { metadataKeys };
+    const validation = validateModel(input);
+    if (!validation.ok) {
+        const findings = validation.errors.map((message) => ({ code: 'MODEL_INVALID', severity: 'error', message }));
+        const modelCheck = {
+            id: 'MODEL',
+            name: 'Model Validation',
+            status: 'fail',
+            detail: 'Model schema validation failed: ' + validation.errors.length + ' errors',
+            findings,
+        };
+        return {
+            ok: false,
+            ran: true,
+            ...verdictOfFindings(findings),
+            schema: REPORT_SCHEMAS.verify,
+            schemaVersion: 1,
+            hashSpec,
+            modelHash: '',
+            hashes: { hashSpec, modelHash: '' },
+            ...metadata,
+            summary: { states: 0, transitions: 0, errors: validation.errors.length, warnings: 0, checksRun: 0 },
+            checks: [modelCheck],
+            nextSteps: [...refusalGuidance(validation.errors), ...verificationNextSteps([modelCheck], undefined)],
+        };
+    }
+    const model = validation.model;
+    const exploration = explore(model, normalized);
+    const checks = [
+        S1_reachability(model, exploration),
+        S2_deadlock(model),
+        S3_liveness(model),
+        S4_determinism(model),
+        S5_eventCompleteness(model),
+        S6_guardCompleteness(model),
+        S7_invariants(model, normalized),
+        S8_monotonicVariables(model),
+        A1_unexpectedEvents(model),
+        A2_raceInterleaving(model, exploration),
+        A3_orderPermutation(model, normalized),
+        A4_pairSymmetry(model),
+        A5_boundaryBlast(model),
+        A6_resourceInjection(model),
+        A7_shortestViolations(model, normalized),
+        A8_idempotentReplay(model, exploration),
+        A9_leadsTo(model, exploration, normalized),
+        A10_sequenceOrder(model, normalized),
+        A11_atomicity(model, normalized),
+        A12_budget(model, normalized),
+        A13_probability(model, normalized),
+        A14_deadline(model, normalized),
+    ];
+    let comparison;
+    if (options.beforeModel !== undefined) {
+        const beforeValidation = validateModel(options.beforeModel);
+        if (!beforeValidation.ok) {
+            const beforeFindings = beforeValidation.errors.map((message) => ({ code: 'BEFORE_MODEL_INVALID', severity: 'error', message }));
+            const allFindings = [...checks.flatMap((check) => check.findings), ...beforeFindings];
+            return {
+                ok: false,
+                ran: true,
+                ...verdictOfFindings(allFindings),
+                schema: REPORT_SCHEMAS.verify,
+                schemaVersion: 1,
+                hashSpec,
+                modelHash: modelHash(model, hashSpec),
+                hashes: { hashSpec, modelHash: modelHash(model, hashSpec), afterModelHash: modelHash(model, hashSpec) },
+                ...metadata,
+                summary: {
+                    states: model.states.length,
+                    transitions: model.transitions.length,
+                    errors: beforeValidation.errors.length,
+                    warnings: 0,
+                    checksRun: checks.length + 1,
+                    truncated: exploration.truncated || hasUndecidedFinding(checks),
+                },
+                checks: [
+                    ...checks,
+                    {
+                        id: 'BEFORE_MODEL',
+                        name: 'Before Model Validation',
+                        status: 'fail',
+                        detail: 'Before model schema validation failed: ' + beforeValidation.errors.length + ' errors',
+                        findings: beforeFindings,
+                    },
+                ],
+                nextSteps: verificationNextSteps(checks, narrativeCoverageOf(model)),
+            };
+        }
+        const before = beforeValidation.model;
+        const mapping = options.stateMapping ?? {};
+        checks.push(D1_behavioralPreservation(before, model, mapping), D2_invariantContinuity(before, model, normalized, mapping), D3_regressionDelta(before, model, mapping), D4_deadlockLivenessRegression(before, model, mapping));
+        comparison = buildComparisonSummary(before, model, mapping);
+    }
+    // A check whose vocabulary the model never declared examined nothing, and says so. It has to happen
+    // before the summary and `nextSteps` are derived, or both keep counting it as a run.
+    for (const check of checks) {
+        if (check.status !== 'pass')
+            continue;
+        const why = nothingToExamine(check.id, model);
+        if (why === undefined)
+            continue;
+        check.status = 'skip';
+        check.detail = 'skipped: ' + why;
+    }
+    const errors = checks.reduce((sum, check) => sum + check.findings.filter((finding) => finding.severity === 'error').length, 0);
+    const warnings = checks.reduce((sum, check) => sum + check.findings.filter((finding) => finding.severity === 'warning').length, 0);
+    const coverageNotes = computeCoverageNotes(model);
+    const narrativeCoverage = narrativeCoverageOf(model);
+    // R3: a partial narrative is valid, but the gap must be machine-readable instead of only a
+    // sentence in `nextSteps`. It rides on S5 — the check that already reports undocumented
+    // (state, event) combinations — so the documented check count stays 22.
+    if (narrativeCoverage !== undefined && !narrativeComplete(narrativeCoverage)) {
+        checks.find((check) => check.id === 'S5')?.findings.push({
+            code: 'NARRATIVE_PARTIAL',
+            severity: 'info',
+            message: 'Narrative coverage is partial (states ' + narrativeCoverage.states + ', events ' + narrativeCoverage.events + ', scenarios ' + narrativeCoverage.scenarios + '): the checks still run over the whole model, but the undocumented symbols have to be re-derived by the reader.',
+        });
+    }
+    return {
+        ok: true,
+        ran: true,
+        ...verdictOfFindings(checks.flatMap((check) => check.findings)),
+        schema: REPORT_SCHEMAS.verify,
+        schemaVersion: 1,
+        hashSpec,
+        modelHash: modelHash(model, hashSpec),
+        hashes: {
+            hashSpec,
+            modelHash: modelHash(model, hashSpec),
+            ...(comparison === undefined ? {} : { beforeModelHash: comparison.beforeModelHash, afterModelHash: comparison.afterModelHash }),
+        },
+        ...metadata,
+        ...(narrativeCoverage === undefined ? {} : { narrativeCoverage }),
+        summary: {
+            states: model.states.length,
+            transitions: model.transitions.length,
+            errors,
+            warnings,
+            // `checksRun` counts the checks that examined the model, which is what the name promises. It used to
+            // count every check object, so a model that declared nothing still read as "22 checks ran".
+            checksRun: checks.filter((check) => check.status !== 'skip').length,
+            ...(() => {
+                const skipped = checks.filter((check) => check.status === 'skip').map((check) => check.id);
+                return skipped.length === 0 ? {} : { checksSkipped: skipped };
+            })(),
+            truncated: exploration.truncated || hasUndecidedFinding(checks),
+            ...(boundNotes.length === 0 ? {} : { boundNotes }),
+        },
+        checks,
+        nextSteps: verificationNextSteps(checks, narrativeCoverage),
+        ...(model.narrative === undefined ? {} : { narrative: model.narrative }),
+        ...(comparison === undefined ? {} : { comparison }),
+        ...(coverageNotes.length === 0 ? {} : { coverageNotes }),
+    };
+}
+/**
+ * Check the sharing declarations before the search runs.
+ *
+ * A declaration that names a machine, an event or a location that does not exist would
+ * otherwise quietly exclude that access from every later check - the access simply would not
+ * be found, and the report would say "no race" about a pair it never looked at.
+ */
+function analyzeSharing(models, machineEventSets, options) {
+    const findings = [];
+    const byMachine = new Map();
+    const locations = new Set();
+    for (const location of options.shared ?? []) {
+        if (locations.has(location.id)) {
+            findings.push({ code: 'C3_SHARED_ACCESS_INVALID', severity: 'error', message: 'shared location "' + location.id + '" is declared twice; one declaration per location' });
+            continue;
+        }
+        locations.add(location.id);
+    }
+    const accesses = options.accesses ?? [];
+    if (accesses.length > 0 && locations.size === 0) {
+        findings.push({ code: 'C3_SHARED_ACCESS_INVALID', severity: 'error', message: 'accesses were declared but `shared` names no location, so no access can be checked' });
+    }
+    accesses.forEach((access, index) => {
+        const where = 'accesses[' + String(index) + ']';
+        if (!Number.isInteger(access.machine) || access.machine < 0 || access.machine >= models.length) {
+            findings.push({ code: 'C3_SHARED_ACCESS_INVALID', severity: 'error', message: where + ' names machine ' + String(access.machine) + ', and this composition has ' + String(models.length) });
+            return;
+        }
+        if (machineEventSets[access.machine]?.has(access.event) !== true) {
+            findings.push({ code: 'C3_SHARED_ACCESS_INVALID', severity: 'error', message: where + ' names event "' + access.event + '", which machine ' + String(access.machine) + ' does not declare in any transition' });
+            return;
+        }
+        if (!locations.has(access.location)) {
+            findings.push({ code: 'C3_SHARED_ACCESS_INVALID', severity: 'error', message: where + ' names location "' + access.location + '", which `shared` does not declare' });
+            return;
+        }
+        if (access.kind !== 'read' && access.kind !== 'write' && access.kind !== 'read-write') {
+            findings.push({ code: 'C3_SHARED_ACCESS_INVALID', severity: 'error', message: where + ' has kind "' + String(access.kind) + '"; expected read, write or read-write' });
+            return;
+        }
+        if (access.protectedBy !== undefined && !locations.has(access.protectedBy)) {
+            findings.push({ code: 'C3_SHARED_ACCESS_INVALID', severity: 'error', message: where + ' is protected by "' + access.protectedBy + '", which `shared` does not declare' });
+            return;
+        }
+        const perMachine = byMachine.get(access.machine) ?? new Map();
+        const list = perMachine.get(access.event) ?? [];
+        list.push(access);
+        perMachine.set(access.event, list);
+        byMachine.set(access.machine, perMachine);
+    });
+    return { findings, byMachine, locations, accessCount: accesses.length };
+}
+/**
+ * N-machine composition semantics (documented in dsh-model-schema.md):
+ * - a non-rendezvous event advances exactly ONE non-terminal machine that fires it;
+ * - a rendezvous event (handshake) fires only when AT LEAST TWO machines declare it in
+ *   their alphabet and EVERY such non-terminal machine has it enabled (guards held);
+ *   all participants then advance simultaneously. A machine that is terminal, or whose
+ *   alphabet does not include the event, does not participate;
+ * - a terminal machine is stopped and takes no further part.
+ * Checks: C1 composition deadlock (reachable node where no machine can advance while at
+ * least one is not terminal) and C2 rendezvous that can never fire.
+ */
+export function runCompositionVerification(machinesInput, options = {}) {
+    const hashSpec = options.hashSpec ?? DEFAULT_HASH_SPEC;
+    const models = [];
+    const hashes = [];
+    const modelFindings = [];
+    machinesInput.forEach((input, index) => {
+        const validation = validateModel(input);
+        if (!validation.ok) {
+            modelFindings.push({ code: 'MODEL_INVALID', severity: 'error', message: 'machine ' + index + ' invalid: ' + validation.errors.join('; ') });
+        }
+        else {
+            models.push(validation.model);
+            hashes.push(modelHash(validation.model, hashSpec));
+        }
+    });
+    const machineSummary = models.map((m, i) => ({ modelHash: hashes[i] ?? '', states: m.states.length, transitions: m.transitions.length }));
+    if (modelFindings.length > 0 || models.length < 2) {
+        if (models.length < 2 && modelFindings.length === 0) {
+            modelFindings.push({ code: 'MODEL_INVALID', severity: 'error', message: 'composition requires at least two machines' });
+        }
+        return {
+            ok: false,
+            ran: true,
+            ...verdictOfFindings(modelFindings),
+            schema: REPORT_SCHEMAS.compose,
+            hashSpec,
+            hashes: { hashSpec, machines: hashes },
+            summary: { machineCount: models.length, machines: machineSummary, compositeStates: 0, errors: modelFindings.length, warnings: 0, truncated: false },
+            checks: [{ id: 'MODEL', name: 'Machine Validation', status: 'fail', detail: 'composition input validation failed', findings: modelFindings }],
+            nextSteps: ['Fix the machine that failed validation, then re-run the composition.'],
+        };
+    }
+    const rendezvous = new Set(options.rendezvous ?? []);
+    const maxStates = options.maxStates ?? DEFAULT_MAX_STATES;
+    const machineEventSets = models.map((model) => new Set(model.transitions.map((transition) => transition.event)));
+    // Sharing: which machine events touch which declared location, and how. The declarations are
+    // checked first (C3), because an access that names a machine or location that does not exist
+    // simply never enters the scan below - and the report would then say "no race" about a pair it
+    // never looked at.
+    const sharing = analyzeSharing(models, machineEventSets, options);
+    const c3Findings = [...sharing.findings];
+    const c4Findings = [];
+    const c5Findings = [];
+    const accessEventsByMachine = new Map();
+    for (const [machine, perEvent] of sharing.byMachine)
+        accessEventsByMachine.set(machine, [...perEvent.keys()]);
+    const seenSharedPairs = new Set();
+    let excludedPairs = 0;
+    /** A cap, so a large model cannot turn this into a quadratic report: 64 witnesses is plenty. */
+    const MAX_SHARED_WITNESSES = 64;
+    /**
+     * Look for two accesses on the same location that are both enabled in this composite state.
+     *
+     * Co-enabled means the model does not exclude the interleaving: with a read-modify-write on
+     * each side, read(A), read(B), write(A), write(B) is reachable and loses one update. Two
+     * accesses that name the SAME lock are treated as exclusive and counted, not reported; that
+     * the lock is actually held across the whole operation is a single-machine question and is
+     * not decided here.
+     */
+    const scanSharedAccesses = (node) => {
+        if (c4Findings.length + c5Findings.length >= MAX_SHARED_WITNESSES)
+            return;
+        const enabled = [];
+        for (const [machine, events] of accessEventsByMachine) {
+            if (machine >= models.length)
+                continue;
+            if (isTerminal(models[machine], node.runtimes[machine].state))
+                continue;
+            for (const event of events) {
+                if (stepRuntime(models[machine], node.runtimes[machine], event).length === 0)
+                    continue;
+                for (const access of sharing.byMachine.get(machine)?.get(event) ?? [])
+                    enabled.push({ machine, event, access });
+            }
+        }
+        for (let left = 0; left < enabled.length; left += 1) {
+            for (let right = left + 1; right < enabled.length; right += 1) {
+                const first = enabled[left];
+                const second = enabled[right];
+                if (first.machine === second.machine)
+                    continue;
+                if (first.access.location !== second.access.location)
+                    continue;
+                const bothRead = first.access.kind === 'read' && second.access.kind === 'read';
+                if (bothRead)
+                    continue;
+                if (first.access.protectedBy !== undefined && first.access.protectedBy === second.access.protectedBy) {
+                    excludedPairs += 1;
+                    continue;
+                }
+                const pairKey = [first.access.location, String(first.machine) + ':' + first.event, String(second.machine) + ':' + second.event].join('|');
+                if (seenSharedPairs.has(pairKey))
+                    continue;
+                seenSharedPairs.add(pairKey);
+                if (c4Findings.length + c5Findings.length >= MAX_SHARED_WITNESSES)
+                    return;
+                const nonAtomic = first.access.kind === 'read-write' && second.access.kind === 'read-write';
+                const where = 'machine ' + String(first.machine) + ' "' + first.event + '" (' + first.access.kind + ') and machine ' + String(second.machine) + ' "' + second.event + '" (' + second.access.kind + ')';
+                const guarding = first.access.protectedBy === undefined && second.access.protectedBy === undefined
+                    ? 'Neither access names a protecting lock.'
+                    : 'The two accesses name different protecting locks (' + (first.access.protectedBy ?? 'none') + ' / ' + (second.access.protectedBy ?? 'none') + '), so neither excludes the other.';
+                const at = node.runtimes.map((runtime) => runtime.state).join(', ');
+                const finding = {
+                    code: nonAtomic ? 'C5_NON_ATOMIC_UPDATE' : 'C4_SHARED_WRITE_RACE',
+                    severity: nonAtomic ? 'error' : 'warning',
+                    message: nonAtomic
+                        ? 'Non-atomic update of "' + first.access.location + '": ' + where + ' both declare read-modify-write and are both enabled at (' + at + ').'
+                        : 'Shared write to "' + first.access.location + '" without exclusion: ' + where + ' are both enabled at (' + at + ') and at least one writes.',
+                    detail: 'Shortest interleaving to the co-enabled state: ' + String(node.path.length) + ' step(s) from the initial state. ' + guarding + (nonAtomic
+                        ? ' Read(A), read(B), write(A), write(B) is an interleaving this model does not exclude, and it loses one update. What makes it safe is outside the model: a single atomic step (compare-and-set, atomic increment), one owner, or a lock both sides name and hold across the whole operation.'
+                        : ' Which write lands last is decided at runtime. If last-writer-wins is the design, say so; otherwise order the accesses with a lock both sides name, or with a rendezvous.'),
+                    evidence: {
+                        location: first.access.location,
+                        machines: [first.machine, second.machine],
+                        events: [first.event, second.event],
+                        kinds: [first.access.kind, second.access.kind],
+                        states: node.runtimes.map((runtime) => runtime.state),
+                        depth: node.path.length,
+                        path: node.path,
+                    },
+                };
+                if (nonAtomic)
+                    c5Findings.push(finding);
+                else
+                    c4Findings.push(finding);
+            }
+        }
+    };
+    const compositionMoves = (node) => {
+        const moves = [];
+        // single-machine (non-rendezvous) steps
+        for (let i = 0; i < models.length; i++) {
+            if (isTerminal(models[i], node.runtimes[i].state))
+                continue;
+            for (const event of allEvents(models[i])) {
+                if (rendezvous.has(event))
+                    continue;
+                for (const next of stepRuntime(models[i], node.runtimes[i], event)) {
+                    const runtimes = node.runtimes.slice();
+                    runtimes[i] = next;
+                    moves.push({ next: { runtimes, path: [] }, event, machines: [i] });
+                }
+            }
+        }
+        // synchronized rendezvous steps (>= 2 participants, all enabled)
+        for (const event of rendezvous) {
+            const participants = [];
+            for (let i = 0; i < models.length; i++) {
+                if (isTerminal(models[i], node.runtimes[i].state))
+                    continue;
+                if (!machineEventSets[i].has(event))
+                    continue;
+                participants.push(i);
+            }
+            if (participants.length < 2)
+                continue; // handshake needs a partner
+            const outcomes = participants.map((i) => stepRuntime(models[i], node.runtimes[i], event));
+            if (outcomes.some((list) => list.length === 0))
+                continue; // not all participants ready
+            let combos = [node.runtimes.slice()];
+            participants.forEach((i, slot) => {
+                const nextCombos = [];
+                for (const combo of combos) {
+                    for (const outcome of outcomes[slot]) {
+                        const copy = combo.slice();
+                        copy[i] = outcome;
+                        nextCombos.push(copy);
+                    }
+                }
+                combos = nextCombos;
+            });
+            for (const runtimes of combos) {
+                moves.push({ next: { runtimes, path: [] }, event, machines: participants });
+            }
+        }
+        return moves;
+    };
+    const keyOf = (node) => node.runtimes.map((runtime) => runtimeKey(runtime)).join('|');
+    const init = { runtimes: models.map((model) => initialState(model)), path: [] };
+    const visited = new Set();
+    const queue = [init];
+    let compositeStates = 0;
+    let truncated = false;
+    const firedCount = new Map();
+    for (const event of rendezvous)
+        firedCount.set(event, 0);
+    // Per-machine enablement, collected while the state space is explored: a rendezvous
+    // that never fires needs to say *which* machine never had it enabled, not just that
+    // the handshake did not happen.
+    const everEnabled = new Map();
+    const enabledStates = new Map();
+    const coEnabledNodes = new Map();
+    for (const event of rendezvous) {
+        everEnabled.set(event, new Set());
+        enabledStates.set(event, models.map(() => []));
+        coEnabledNodes.set(event, 0);
+    }
+    const c1Findings = [];
+    while (queue.length > 0) {
+        const node = queue.shift();
+        const key = keyOf(node);
+        if (visited.has(key))
+            continue;
+        visited.add(key);
+        compositeStates += 1;
+        if (compositeStates > maxStates) {
+            truncated = true;
+            break;
+        }
+        if (accessEventsByMachine.size > 0)
+            scanSharedAccesses(node);
+        const moves = compositionMoves(node);
+        const allTerminal = node.runtimes.every((runtime, i) => isTerminal(models[i], runtime.state));
+        // Enablement census for C2: which machines could fire each rendezvous here.
+        for (const event of rendezvous) {
+            const declaring = [];
+            for (let i = 0; i < models.length; i++)
+                if (machineEventSets[i].has(event))
+                    declaring.push(i);
+            if (declaring.length === 0)
+                continue;
+            let allEnabled = declaring.length >= 2;
+            for (const i of declaring) {
+                const enabled = !isTerminal(models[i], node.runtimes[i].state) && stepRuntime(models[i], node.runtimes[i], event).length > 0;
+                if (!enabled) {
+                    allEnabled = false;
+                    continue;
+                }
+                everEnabled.get(event)?.add(i);
+                const states = enabledStates.get(event)?.[i];
+                if (states !== undefined && !states.includes(node.runtimes[i].state) && states.length < 8)
+                    states.push(node.runtimes[i].state);
+            }
+            if (allEnabled)
+                coEnabledNodes.set(event, (coEnabledNodes.get(event) ?? 0) + 1);
+        }
+        if (moves.length === 0 && !allTerminal) {
+            // Why nobody can advance, per machine: its state, its alphabet, and for every event
+            // either the rendezvous partner that is not ready or the transition that does not fire.
+            const perMachine = node.runtimes.map((runtime, i) => {
+                const terminal = isTerminal(models[i], runtime.state);
+                const blocked = terminal ? [] : allEvents(models[i]).map((event) => {
+                    const enabled = stepRuntime(models[i], runtime, event).length > 0;
+                    // A rendezvous event is not fireable just because this machine has a transition:
+                    // it needs every declaring machine enabled at the same time. Check that first, or
+                    // the deadlock census would report "enabled" for a handshake nobody can complete.
+                    if (!rendezvous.has(event))
+                        return { event, reason: enabled ? 'enabled' : 'no-enabled-transition' };
+                    const declaring = [];
+                    for (let j = 0; j < models.length; j++)
+                        if (machineEventSets[j].has(event))
+                            declaring.push(j);
+                    if (declaring.length < 2)
+                        return { event, reason: 'rendezvous-needs-partner' };
+                    const partnersReady = declaring.every((j) => !isTerminal(models[j], node.runtimes[j].state)
+                        && stepRuntime(models[j], node.runtimes[j], event).length > 0);
+                    if (!partnersReady)
+                        return { event, reason: 'rendezvous-partner-not-ready' };
+                    return { event, reason: enabled ? 'enabled' : 'no-enabled-transition' };
+                });
+                return { index: i, state: runtime.state, terminal, blocked };
+            });
+            const reasons = perMachine
+                .filter((machine) => !machine.terminal)
+                .map((machine) => 'machine ' + String(machine.index) + ' at ' + machine.state + ': ' + (machine.blocked.length === 0
+                ? 'empty event alphabet'
+                : machine.blocked.map((entry) => entry.event + ' (' + entry.reason + ')').join(', ')));
+            // A non-terminal state with no outgoing transition anywhere in its own model is a
+            // modelling gap, not a design defect: without this note the census reads as
+            // "the architecture deadlocks" when the model was simply left unfinished.
+            const gaps = node.runtimes
+                .map((runtime, index) => ({ index, state: runtime.state }))
+                .filter((entry) => !isTerminal(models[entry.index], entry.state)
+                && !models[entry.index].transitions.some((transition) => transition.from === entry.state));
+            const gapNote = gaps.length === 0
+                ? ''
+                : ' Modelling note: ' + gaps.map((gap) => 'machine ' + String(gap.index) + ' state ' + gap.state).join(', ') + ' has no outgoing transition in its own model, so this deadlock may be a modelling gap rather than a design defect.';
+            c1Findings.push({
+                code: 'C1_COMPOSITION_DEADLOCK',
+                severity: 'error',
+                message: 'Composition deadlock: no machine can advance from (' + node.runtimes.map((runtime) => runtime.state).join(', ') + ') while at least one is not terminal.',
+                detail: 'Shortest counterexample (breadth-first): ' + String(node.path.length) + ' step(s) to reach it. ' + reasons.join(' | ') + gapNote,
+                evidence: { steps: node.path, states: node.runtimes.map((runtime) => runtime.state), depth: node.path.length, perMachine, reasons },
+            });
+            continue;
+        }
+        for (const move of moves) {
+            if (move.machines.length > 1)
+                firedCount.set(move.event, (firedCount.get(move.event) ?? 0) + 1);
+            const nextKey = keyOf(move.next);
+            if (visited.has(nextKey))
+                continue;
+            queue.push({ runtimes: move.next.runtimes, path: [...node.path, { event: move.event, machines: move.machines }] });
+        }
+    }
+    const c2Findings = [];
+    const allEventsSet = new Set();
+    for (const set of machineEventSets)
+        for (const event of set)
+            allEventsSet.add(event);
+    // A name the machines never declare resolves to nothing, and the loop below used to `continue` past it: a
+    // typo in `rendezvous` skipped the handshake entirely while the detail still reported that every rendezvous
+    // can fire - a pass over a check that never ran. The verify family answers the same mistake with
+    // MODEL_UNRESOLVED_EVENT; this is that answer for the composition.
+    for (const event of rendezvous) {
+        if (allEventsSet.has(event))
+            continue;
+        c2Findings.push({
+            code: 'C2_RENDEZVOUS_UNRESOLVED',
+            // An error: the caller named a handshake and the composition could not check it. As a warning the report said
+            // `pass_with_findings` for a composition whose named handshake was never verified - the false green the rest of
+            // this report contract exists to prevent.
+            severity: 'error',
+            message: 'Rendezvous event "' + event + '" is declared nowhere: no machine has a transition or action on it, so this handshake was not checked. Name an event the machines declare, or remove it from `rendezvous`.',
+            evidence: { event, declared: [...allEventsSet].sort() },
+        });
+    }
+    for (const event of rendezvous) {
+        if (!allEventsSet.has(event))
+            continue;
+        if ((firedCount.get(event) ?? 0) === 0) {
+            // Why the handshake never happens: who declares it, who ever had it enabled, and
+            // whether the enabling states could ever coincide.
+            const machines = models.map((model, index) => ({
+                index,
+                declares: machineEventSets[index].has(event),
+                everEnabled: everEnabled.get(event)?.has(index) === true,
+                enabledAt: enabledStates.get(event)?.[index] ?? [],
+            }));
+            const declaring = machines.filter((machine) => machine.declares);
+            const neverEnabled = declaring.filter((machine) => !machine.everEnabled);
+            const coEnabled = coEnabledNodes.get(event) ?? 0;
+            let reason;
+            if (declaring.length < 2) {
+                reason = 'only ' + String(declaring.length) + ' machine(s) declare it (machine ' + declaring.map((machine) => machine.index).join(', ') + '); a handshake needs at least two';
+            }
+            else if (neverEnabled.length > 0) {
+                reason = 'machine ' + neverEnabled.map((machine) => machine.index).join(', ') + ' declares it but never has it enabled (no transition, or the guard never holds)';
+            }
+            else {
+                reason = 'every declaring machine enables it somewhere, but never at the same time (' + String(coEnabled) + ' composite state(s) had all of them ready)';
+            }
+            // A truncated exploration cannot prove that a handshake never happens: it may simply
+            // not have reached the composite state where both machines are ready.
+            const caveat = truncated ? ' The search was truncated at ' + String(maxStates) + ' composite states, so this may be an artefact of the cap rather than a property of the model.' : '';
+            c2Findings.push({
+                code: 'C2_RENDEZVOUS_NEVER_FIRES',
+                severity: 'error',
+                message: 'Rendezvous event ' + event + ' can never fire: ' + reason + '.' + caveat,
+                detail: machines.map((machine) => 'machine ' + String(machine.index) + (machine.declares ? ' declares' : ' does not declare')
+                    + (machine.everEnabled ? ', enabled at ' + (machine.enabledAt.length === 0 ? 'no visited state' : machine.enabledAt.join('/')) : ', never enabled')).join(' | '),
+                evidence: { event, machines, declaring: declaring.map((machine) => machine.index), coEnabledNodes: coEnabled, reason, truncated },
+            });
+        }
+    }
+    // C2 is an error, not a warning: a rendezvous that can never fire means the composition
+    // cannot advance through that handshake — the same "stuck forever" outcome C1 reports,
+    // so a gate that only reads `verdict` must be able to stop on it.
+    const allCompositionFindings = [...c1Findings, ...c2Findings, ...c3Findings, ...c4Findings, ...c5Findings];
+    const errors = allCompositionFindings.filter((finding) => finding.severity === 'error').length;
+    const warnings = allCompositionFindings.filter((finding) => finding.severity === 'warning').length;
+    const c1Detail = c1Findings.length > 0
+        ? 'Composition deadlocks: ' + String(c1Findings.length)
+        : truncated
+            ? 'No composition deadlock found, but the search was truncated at ' + String(maxStates) + ' composite states: absence is not proven'
+            : 'No composition deadlock reachable';
+    // The detail has to describe what was established. A name that resolved to nothing was never examined, so
+    // the count of findings is not the same statement as "every rendezvous can fire".
+    const unresolvedCount = c2Findings.filter((finding) => finding.code === 'C2_RENDEZVOUS_UNRESOLVED').length;
+    const c2Detail = c2Findings.length > 0
+        ? (unresolvedCount === c2Findings.length && c2Findings.length > 0
+            ? String(unresolvedCount) + ' rendezvous name(s) resolved to no event, so that handshake was not checked'
+            : 'Rendezvous errors: ' + String(c2Findings.length) + (unresolvedCount > 0 ? ' (' + String(unresolvedCount) + ' unresolved name(s))' : ''))
+        : truncated
+            ? 'All rendezvous events fired, but the search was truncated at ' + String(maxStates) + ' composite states'
+            : 'All rendezvous events can fire';
+    // The sharing checks say what they established, not only how many findings they produced: a
+    // composition that declares nothing shares nothing, and that is a different statement from
+    // "the shared accesses were checked and they are exclusive".
+    const c3Detail = c3Findings.length > 0
+        ? 'Sharing declarations are inconsistent: ' + String(c3Findings.length) + ' declaration error(s); those accesses were not checked'
+        : sharing.accessCount === 0
+            ? 'No shared location is declared, so nothing is shared between the machines'
+            : 'Sharing declarations resolve: ' + String(sharing.locations.size) + ' location(s), ' + String(sharing.accessCount) + ' access(es)';
+    const sharedExclusion = excludedPairs === 0 ? '' : ' ' + String(excludedPairs) + ' co-enabled access pair(s) were excluded by a lock both sides name.';
+    const c4Detail = c4Findings.length > 0
+        ? 'Shared writes that the model does not order: ' + String(c4Findings.length) + '.' + sharedExclusion
+        : sharing.accessCount === 0
+            ? 'Not checked: no shared access was declared'
+            : truncated
+                ? 'No unordered shared write found, but the search was truncated at ' + String(maxStates) + ' composite states: absence is not proven'
+                : 'Every co-enabled shared write names one lock on both sides, or never overlaps.' + sharedExclusion;
+    const c5Detail = c5Findings.length > 0
+        ? 'Read-modify-write pairs that are not atomic together: ' + String(c5Findings.length) + '.' + sharedExclusion
+        : sharing.accessCount === 0
+            ? 'Not checked: no shared access was declared'
+            : truncated
+                ? 'No non-atomic update found, but the search was truncated at ' + String(maxStates) + ' composite states: absence is not proven'
+                : 'No read-modify-write pair is left co-enabled without a shared lock.' + sharedExclusion;
+    const checks = [
+        checkResult('C1', 'Composition Deadlock', c1Findings, c1Detail),
+        checkResult('C2', 'Rendezvous Sync', c2Findings, c2Detail),
+        checkResult('C3', 'Shared Access Declarations', c3Findings, c3Detail),
+        checkResult('C4', 'Shared Write Order', c4Findings, c4Detail),
+        checkResult('C5', 'Atomic Shared Update', c5Findings, c5Detail),
+    ];
+    const nextSteps = [];
+    if (errors > 0) {
+        const why = c1Findings.length > 0
+            ? 'the composition deadlocks at a reachable state, so at least one machine is missing an exit or a handshake partner'
+            : c5Findings.length > 0
+                ? 'two machines update one shared location without one atomic step between them, so an update can be lost'
+                : c3Findings.length > 0
+                    ? 'a sharing declaration names something the composition does not have, so those accesses were never checked'
+                    : 'a rendezvous event can never fire, so the composition cannot advance through that handshake';
+        nextSteps.push('Resolve the error findings first: ' + why + '.');
+    }
+    if (c5Findings.length > 0) {
+        nextSteps.push('Make the update atomic: one machine owns the value, a compare-and-set or atomic increment replaces read-then-write, or both sides name one lock in `protectedBy` and hold it across the whole operation.');
+    }
+    if (c4Findings.length > 0) {
+        nextSteps.push('Decide what the overlapping write means: last-writer-wins by design (say so in the narrative), a lock both sides name in `protectedBy`, or a rendezvous that orders the two events.');
+    }
+    if (excludedPairs > 0) {
+        nextSteps.push('The lock names make ' + String(excludedPairs) + ' pair(s) exclusive, and that is all this checks: whether the lock is acquired and released around the whole operation is a single-machine question - model that machine and run `model_verify` on it.');
+    }
+    // Composition couples machines through rendezvous and, since the sharing declarations exist,
+    // through a location both declare. Each machine's `variables` are still private to it, so two
+    // machines cannot share a predicate. Name them when the input looks like it is trying to.
+    const owners = models
+        .map((entry, index) => ({ index, names: (entry.variables ?? []).map((variable) => variable.name) }))
+        .filter((entry) => entry.names.length > 0);
+    if (owners.length >= 2) {
+        nextSteps.push('Each machine\'s variables are private to it (' + owners.map((entry) => 'machine ' + String(entry.index) + ': ' + entry.names.join(', ')).join('; ') + '): a value two machines must agree on is either declared in `shared` with an `accesses` entry per side, or modelled as a handshake.' + (sharing.accessCount === 0 ? ' This composition declares no shared location, so nothing is shared between its machines.' : ''));
+    }
+    // A composition answers a question no single machine can, so the next step names the tool that answers
+    // the other one. Without it a reader who wanted per-machine detail has nowhere to go from here.
+    nextSteps.push('Re-run the composition after the change; every machine must be able to advance, or explain why it is terminal. For one machine on its own - its unreachable states, its invariants, its cost against budget - use `model_verify`, then compare the two compositions with `report_diff`.');
+    return {
+        ok: errors === 0,
+        ran: true,
+        ...verdictOf(errors, warnings, [...c1Findings, ...c2Findings, ...c3Findings, ...c4Findings, ...c5Findings][0]?.code),
+        schema: REPORT_SCHEMAS.compose,
+        hashSpec,
+        hashes: { hashSpec, machines: hashes },
+        summary: { machineCount: models.length, machines: machineSummary, compositeStates, errors, warnings, truncated },
+        checks,
+        nextSteps,
+    };
+}