libpetri 2.12.0 → 2.13.0

package/dist/debug/index.d.ts

@@ -1,6 +1,6 @@
 import { Writable } from 'node:stream';
-import { P as PetriNet, b as Transition, T as Token } from '../petri-net-B4wQwsUj.js';
-import { E as EventStore, N as NetEvent } from '../event-store-CAkN_ayv.js';
+import { P as PetriNet, b as Transition, T as Token } from '../petri-net-C3LSY-vm.js';
+import { E as EventStore, N as NetEvent } from '../event-store-DKTenPbC.js';
 
 /**
  * Commands sent from debug UI client to server via WebSocket.

package/dist/doclet/index.d.ts

@@ -1,5 +1,5 @@
 import { Application } from 'typedoc';
-import { P as PetriNet, S as SubnetDef, o as Instance } from '../petri-net-B4wQwsUj.js';
+import { P as PetriNet, S as SubnetDef, o as Instance } from '../petri-net-C3LSY-vm.js';
 
 /**
  * TypeDoc plugin for `@petrinet` and `@subnet` tags — auto-generates

package/dist/{event-store-CAkN_ayv.d.ts → event-store-DKTenPbC.d.ts}

@@ -1,4 +1,4 @@
-import { T as Token } from './petri-net-B4wQwsUj.js';
+import { T as Token } from './petri-net-C3LSY-vm.js';
 
 /**
  * Events emitted during Petri Net execution.

package/dist/export/index.d.ts

@@ -1,4 +1,4 @@
-import { P as PetriNet } from '../petri-net-B4wQwsUj.js';
+import { P as PetriNet } from '../petri-net-C3LSY-vm.js';
 
 /**
  * Format-agnostic typed graph model.

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { P as PetriNet, S as SubnetDef, a as Place, T as Token, b as Transition, E as EnvironmentPlace, c as TransitionContext, O as Out } from './petri-net-B4wQwsUj.js';
-export { A as Arc, d as ArcInhibitor, e as ArcInput, f as ArcOutput, g as ArcRead, h as ArcReset, C as Channel, i as ComposeBindings, F as FusionSet, j as FusionSetBuilder, I as In, k as InAll, l as InAtLeast, m as InExactly, n as InOne, o as Instance, p as Interface, q as InterfaceBuilder, K as KeyFn, L as LogFn, M as MAX_DURATION_MS, r as MatchKey, s as MatchSpec, N as NameId, t as OutAnd, u as OutForwardInput, v as OutPlace, w as OutTimeout, x as OutXor, y as OutputEntry, z as PetriNetBuilder, B as Port, D as PortDirection, G as SubnetDefBuilder, H as SubnetInstance, J as Timing, Q as TimingDeadline, R as TimingDelayed, U as TimingExact, V as TimingImmediate, W as TimingWindow, X as TokenInput, Y as TokenOutput, Z as TransitionAction, _ as TransitionBuilder, $ as VerificationHarness, a0 as VerificationResult, a1 as all, a2 as allPlaces, a3 as and, a4 as andPlaces, a5 as arcPlace, a6 as atLeast, a7 as consumptionCount, a8 as deadline, a9 as delayed, aa as earliest, ab as enumerateBranches, ac as environmentPlace, ad as exact, ae as exactly, af as fork, ag as forwardInput, ah as hasDeadline, ai as hasGuard, aj as immediate, ak as inhibitorArc, al as inputArc, am as isUnit, an as keyForPlace, ao as latest, ap as matchCorrelates, aq as matchKey, ar as matchSpec, as as matchesGuard, at as nameId, au as one, av as outPlace, aw as outputArc, ax as passthrough, ay as place, az as produce, aA as readArc, aB as requiredCount, aC as resetArc, aD as timeout, aE as timeoutPlace, aF as tokenAt, aG as tokenOf, aH as transform, aI as transformAsync, aJ as transformFrom, aK as unitToken, aL as window, aM as withTimeout, aN as xor, aO as xorPlaces } from './petri-net-B4wQwsUj.js';
-import { E as EventStore } from './event-store-CAkN_ayv.js';
-export { A as ActionTimedOut, a as ExecutionCompleted, b as ExecutionStarted, I as InMemoryEventStore, L as LogMessage, M as MarkingSnapshot, N as NetEvent, T as TokenAdded, c as TokenRemoved, d as TransitionClockRestarted, e as TransitionCompleted, f as TransitionEnabled, g as TransitionFailed, h as TransitionStarted, i as TransitionTimedOut, j as eventTransitionName, k as eventsOfType, l as failures, m as filterEvents, n as inMemoryEventStore, o as isFailureEvent, p as noopEventStore, t as transitionEvents } from './event-store-CAkN_ayv.js';
+import { P as PetriNet, S as SubnetDef, a as Place, T as Token, b as Transition, E as EnvironmentPlace, c as TransitionContext, O as Out } from './petri-net-C3LSY-vm.js';
+export { A as Arc, d as ArcInhibitor, e as ArcInput, f as ArcOutput, g as ArcRead, h as ArcReset, C as Channel, i as ComposeBindings, F as FusionSet, j as FusionSetBuilder, I as In, k as InAll, l as InAtLeast, m as InExactly, n as InOne, o as Instance, p as Interface, q as InterfaceBuilder, K as KeyFn, L as LogFn, M as MAX_DURATION_MS, r as MatchKey, s as MatchSpec, N as NameId, t as OutAnd, u as OutForwardInput, v as OutPlace, w as OutTimeout, x as OutXor, y as OutputEntry, z as PetriNetBuilder, B as Port, D as PortDirection, G as SubnetDefBuilder, H as SubnetInstance, J as Timing, Q as TimingDeadline, R as TimingDelayed, U as TimingExact, V as TimingImmediate, W as TimingWindow, X as TokenInput, Y as TokenOutput, Z as TransitionAction, _ as TransitionBuilder, $ as VerificationHarness, a0 as VerificationResult, a1 as all, a2 as allPlaces, a3 as and, a4 as andPlaces, a5 as arcPlace, a6 as atLeast, a7 as consumptionCount, a8 as deadline, a9 as delayed, aa as earliest, ab as enumerateBranches, ac as environmentPlace, ad as exact, ae as exactly, af as fork, ag as forwardInput, ah as hasDeadline, ai as hasGuard, aj as immediate, ak as inhibitorArc, al as inputArc, am as isPassthrough, an as isUnit, ao as keyForPlace, ap as latest, aq as matchCorrelates, ar as matchKey, as as matchSpec, at as matchesGuard, au as nameId, av as one, aw as outPlace, ax as outputArc, ay as passthrough, az as place, aA as produce, aB as readArc, aC as requiredCount, aD as resetArc, aE as timeout, aF as timeoutPlace, aG as tokenAt, aH as tokenOf, aI as transform, aJ as transformAsync, aK as transformFrom, aL as unitToken, aM as window, aN as withTimeout, aO as xor, aP as xorPlaces } from './petri-net-C3LSY-vm.js';
+import { E as EventStore } from './event-store-DKTenPbC.js';
+export { A as ActionTimedOut, a as ExecutionCompleted, b as ExecutionStarted, I as InMemoryEventStore, L as LogMessage, M as MarkingSnapshot, N as NetEvent, T as TokenAdded, c as TokenRemoved, d as TransitionClockRestarted, e as TransitionCompleted, f as TransitionEnabled, g as TransitionFailed, h as TransitionStarted, i as TransitionTimedOut, j as eventTransitionName, k as eventsOfType, l as failures, m as filterEvents, n as inMemoryEventStore, o as isFailureEvent, p as noopEventStore, t as transitionEvents } from './event-store-DKTenPbC.js';
 
 /**
  * Discriminated sum-type abstraction over Petri nets, distinguishing **closed**
@@ -344,6 +344,27 @@ declare class BitmapNetExecutor implements PetriNetExecutor {
      */
     private fireReadyImmediate;
     private fireReadyGeneral;
+    /**
+     * Fires a transition, containing any synchronous throw to that one firing so it fails
+     * only that transition, not the whole run.
+     *
+     * Without this boundary an unchecked throw raised while a transition fires — a hostile
+     * EventStore.append on a token-removed or transition-started emit, or an error thrown while
+     * consuming the matched tokens — unwinds out of the orchestrator loop and kills the executor.
+     * The transition is instead failed and marked dirty for re-evaluation, the same treatment an
+     * asynchronously-reported failure gets. Enablement-phase throws (a guard or key function that
+     * throws inside canEnable, before the firing) run outside this boundary and are not contained
+     * here.
+     *
+     * fireTransition removes tokens from the marking before it reconciles the presence
+     * bitmap, so a throw inside that window would leave bits asserting tokens that are gone;
+     * the recovery re-runs updateBitmapAfterConsumption against the real marking.
+     *
+     * Unlike the Java runtime there is no VirtualMachineError/LinkageError analogue on the JS
+     * side, so every throw is contained here — there is deliberately no fatal-rethrow escape
+     * hatch.
+     */
+    private fireTransitionContained;
     private fireTransition;
     private updateBitmapAfterConsumption;
     private processCompletedTransitions;
@@ -609,6 +630,28 @@ declare class PrecompiledNetExecutor implements PetriNetExecutor {
      */
     private fireReadyImmediate;
     private fireReadyGeneral;
+    /**
+     * Fires a transition, containing any synchronous throw to that one firing so it fails
+     * only that transition, not the whole run.
+     *
+     * Without this boundary an unchecked throw raised while a transition fires — a hostile
+     * EventStore.append on a token-removed or transition-started emit, or an error thrown while
+     * consuming the matched tokens — unwinds out of the orchestrator loop and kills the executor.
+     * The transition is instead failed and marked dirty for re-evaluation, the same treatment an
+     * asynchronously-reported failure gets. Enablement-phase throws (a guard or key function that
+     * throws inside canEnable, before the firing) run outside this boundary and are not contained
+     * here.
+     *
+     * fireTransition drains tokens from the queues before it reconciles the presence bitmap,
+     * so a throw inside that window would leave bits asserting tokens that are gone; the
+     * recovery re-runs updateBitmapAfterConsumption against the true queue lengths.
+     *
+     * Named to avoid colliding with the pre-existing {@link fireTransitionGuarded}
+     * guard-consume helper. Unlike the Java runtime there is no VirtualMachineError/
+     * LinkageError analogue on the JS side, so every throw is contained here — there is
+     * deliberately no fatal-rethrow escape hatch.
+     */
+    private fireTransitionContained;
     private fireTransition;
     /**
      * Consumes the name-matched tokens for a ν-net join (NU-020): correlated
@@ -677,6 +720,10 @@ declare function validateOutSpec(tName: string, spec: Out, producedPlaceNames: S
  * - **AND**: recurses into all children (all branches get tokens).
  * - **XOR**: disallowed — timeout cannot choose a branch non-deterministically.
  * - **Timeout**: disallowed — nested timeouts would create ambiguous recovery paths.
+ *
+ * Writes through {@link TransitionContext.outputToHarvest} rather than `output(...)`:
+ * by this point the context has been detached, so the ordinary write target is closed
+ * and only the harvest collector still reaches the marking.
  */
 declare function produceTimeoutOutput(context: TransitionContext, timeoutChild: Out): void;
 

package/dist/index.js

@@ -4,15 +4,24 @@ import {
   and,
   andPlaces,
   enumerateBranches,
+  fork,
   forwardInput,
+  isPassthrough,
   isProven,
   isViolated,
   outPlace,
+  passthrough,
+  produce,
+  requireOutputProducingActions,
   timeout,
   timeoutPlace,
+  transform,
+  transformAsync,
+  transformFrom,
+  withTimeout,
   xor,
   xorPlaces
-} from "./chunk-V3WTQRHC.js";
+} from "./chunk-7VJ5CYUU.js";
 import {
   eventTransitionName,
   isFailureEvent
@@ -142,83 +151,69 @@ function nameId(value) {
   return value;
 }
 
-// src/core/transition-action.ts
-function passthrough() {
-  return PASSTHROUGH;
-}
-var PASSTHROUGH = async () => {
-};
-function transform(fn) {
-  return async (ctx) => {
-    const result = fn(ctx);
-    for (const outputPlace of ctx.outputPlaces()) {
-      ctx.output(outputPlace, result);
-    }
-  };
-}
-function fork() {
-  return transform((ctx) => {
-    const inputPlaces = ctx.inputPlaces();
-    if (inputPlaces.size !== 1) {
-      throw new Error(`Fork requires exactly 1 input place, found ${inputPlaces.size}`);
-    }
-    const inputPlace = inputPlaces.values().next().value;
-    return ctx.input(inputPlace);
-  });
-}
-function transformFrom(inputPlace, fn) {
-  return transform((ctx) => fn(ctx.input(inputPlace)));
-}
-function transformAsync(fn) {
-  return async (ctx) => {
-    const result = await fn(ctx);
-    for (const outputPlace of ctx.outputPlaces()) {
-      ctx.output(outputPlace, result);
+// src/core/token-output.ts
+var TokenOutput = class {
+  _entries = [];
+  /**
+   * Once true, further writes are dropped instead of appended. Set by the executor
+   * (via {@link import('./transition-context.js').TransitionContext.detachForTimeout})
+   * when a firing times out, so the action it has stopped waiting for can no longer
+   * reach the marking. Irreversible.
+   */
+  detached = false;
+  /** Add a value to an output place (creates token with current timestamp). */
+  add(place2, value) {
+    if (this.detached) return this;
+    this._entries.push({ place: place2, token: tokenOf(value) });
+    return this;
+  }
+  /** Add a pre-existing token to an output place. */
+  addToken(place2, token) {
+    if (this.detached) return this;
+    this._entries.push({ place: place2, token });
+    return this;
+  }
+  /**
+   * @internal Severs this collector: subsequent {@link add}/{@link addToken} calls are
+   * dropped. Executor machinery invoked when a firing times out — never call from an action.
+   */
+  detach() {
+    this.detached = true;
+  }
+  /** Returns all collected outputs. */
+  entries() {
+    return this._entries;
+  }
+  /** Check if any outputs were produced. */
+  isEmpty() {
+    return this._entries.length === 0;
+  }
+  /** Returns the set of place names that received tokens. */
+  placesWithTokens() {
+    const result = /* @__PURE__ */ new Set();
+    for (const entry of this._entries) {
+      result.add(entry.place.name);
     }
-  };
-}
-function produce(place2, value) {
-  return async (ctx) => {
-    ctx.output(place2, value);
-  };
-}
-function withTimeout(action, timeoutMs, timeoutPlace2, timeoutValue) {
-  return (ctx) => {
-    return new Promise((resolve2, reject) => {
-      let completed = false;
-      const timer = setTimeout(() => {
-        if (!completed) {
-          completed = true;
-          ctx.output(timeoutPlace2, timeoutValue);
-          resolve2();
-        }
-      }, timeoutMs);
-      action(ctx).then(
-        () => {
-          if (!completed) {
-            completed = true;
-            clearTimeout(timer);
-            resolve2();
-          }
-        },
-        (err) => {
-          if (!completed) {
-            completed = true;
-            clearTimeout(timer);
-            reject(err);
-          }
-        }
-      );
-    });
-  };
-}
+    return result;
+  }
+};
 
 // src/core/transition-context.ts
 var EMPTY_ALIAS = /* @__PURE__ */ new Map();
 var GLOBAL_FRESH_NAME_COUNTER = 0;
 var TransitionContext = class {
   rawInput;
+  /**
+   * What the executor harvests. Identical to {@link writeTarget} until
+   * {@link detachForTimeout} replaces it with a fresh collector the action cannot reach.
+   */
   _rawOutput;
+  /**
+   * What the action writes to. Never reassigned, so an action already inside
+   * `output(...)` cannot be redirected mid-write; severance happens by detaching this
+   * collector, not by swapping it.
+   */
+  writeTarget;
   allowedInputs;
   allowedReads;
   allowedOutputs;
@@ -234,6 +229,7 @@ var TransitionContext = class {
     this._transitionName = transitionName;
     this.rawInput = rawInput;
     this._rawOutput = rawOutput;
+    this.writeTarget = rawOutput;
     this._inputPlaces = inputPlaces;
     this._readPlaces = readPlaces;
     this._outputPlaces = outputPlaces;
@@ -340,7 +336,7 @@ var TransitionContext = class {
     const actual = this.resolve(place2);
     this.requireOutput(actual);
     for (const value of values) {
-      this._rawOutput.add(actual, value);
+      this.writeTarget.add(actual, value);
     }
     return this;
   }
@@ -356,7 +352,7 @@ var TransitionContext = class {
     const actual = this.resolve(place2);
     this.requireOutput(actual);
     for (const token of tokens) {
-      this._rawOutput.addToken(actual, token);
+      this.writeTarget.addToken(actual, token);
     }
     return this;
   }
@@ -371,6 +367,38 @@ var TransitionContext = class {
       );
     }
   }
+  /**
+   * Severs the action's output from the marking, for use when a firing times out.
+   *
+   * After this call the action's `output(...)` writes are dropped, and the executor
+   * harvests a fresh collector the action holds no reference to. Anything the action
+   * wrote *before* the timeout is discarded with it: a partial result merged with the
+   * timeout branch would violate the transition's own output spec.
+   *
+   * This is the only isolation available — libpetri does not own the promise the action
+   * runs on, so it cannot stop the work, only stop the result from landing.
+   *
+   * @internal Executor machinery — must be called by the executor, never by an action.
+   */
+  detachForTimeout() {
+    this.writeTarget.detach();
+    this._rawOutput = new TokenOutput();
+  }
+  /**
+   * Produces into the executor's harvest collector rather than the action's write target.
+   *
+   * Identical to {@link output} before {@link detachForTimeout}; after it, this is the
+   * only route that still reaches the marking. Used by the executor to deposit the
+   * timeout branch.
+   *
+   * @internal Executor machinery — must be called by the executor, never by an action.
+   */
+  outputToHarvest(place2, value) {
+    const actual = this.resolve(place2);
+    this.requireOutput(actual);
+    this._rawOutput.add(actual, value);
+    return this;
+  }
   // ==================== ν-name minting (NU-010) ====================
   /**
    * @internal Installs the ν-name minter. Wired by the executor at firing time
@@ -462,37 +490,6 @@ var TokenInput = class {
   }
 };
 
-// src/core/token-output.ts
-var TokenOutput = class {
-  _entries = [];
-  /** Add a value to an output place (creates token with current timestamp). */
-  add(place2, value) {
-    this._entries.push({ place: place2, token: tokenOf(value) });
-    return this;
-  }
-  /** Add a pre-existing token to an output place. */
-  addToken(place2, token) {
-    this._entries.push({ place: place2, token });
-    return this;
-  }
-  /** Returns all collected outputs. */
-  entries() {
-    return this._entries;
-  }
-  /** Check if any outputs were produced. */
-  isEmpty() {
-    return this._entries.length === 0;
-  }
-  /** Returns the set of place names that received tokens. */
-  placesWithTokens() {
-    const result = /* @__PURE__ */ new Set();
-    for (const entry of this._entries) {
-      result.add(entry.place.name);
-    }
-    return result;
-  }
-};
-
 // src/core/transition.ts
 var TRANSITION_KEY = /* @__PURE__ */ Symbol("Transition.internal");
 var EMPTY_PLACE_ALIAS = /* @__PURE__ */ new Map();
@@ -1267,10 +1264,6 @@ function describeTiming(t) {
       return `Exact(atMs=${t.atMs})`;
   }
 }
-var PASSTHROUGH_REF = passthrough();
-function isPassthrough(action) {
-  return action === PASSTHROUGH_REF;
-}
 function keyOfIn(arc) {
   switch (arc.type) {
     case "one":
@@ -1513,6 +1506,7 @@ var SubnetDef = class _SubnetDef {
       }
     }
     const syntheticNet = PetriNet.builder("verify_" + this.name).compose(sut, portMappings).build();
+    requireOutputProducingActions(syntheticNet);
     const perProperty = /* @__PURE__ */ new Map();
     for (const property of properties) {
       const verifier = SmtVerifier.forNet(syntheticNet).property(property);
@@ -1864,6 +1858,10 @@ var PetriNet = class _PetriNet {
   }
   /**
    * Creates a new PetriNet with actions bound via a resolver function.
+   *
+   * The resolver is called once per transition with its name. Returning `null`
+   * defers that transition — it keeps whatever action it already carries — which
+   * is what makes staged binding (**MOD-024** AC7) work.
    */
   bindActionsWithResolver(actionResolver) {
     const boundTransitions = /* @__PURE__ */ new Set();
@@ -2497,6 +2495,7 @@ var CompiledNet = class _CompiledNet {
   _hasMatch;
   constructor(net) {
     this.net = net;
+    requireOutputProducingActions(net);
     const allPlacesSet = /* @__PURE__ */ new Map();
     for (const t of net.transitions) {
       for (const spec of t.inputSpecs) allPlacesSet.set(spec.place.name, spec.place);
@@ -3006,6 +3005,25 @@ var OutViolationError = class extends Error {
 };
 
 // src/runtime/executor-support.ts
+function executeAction(t, context) {
+  try {
+    const stage = t.action(context);
+    if (stage == null || typeof stage.then !== "function") {
+      return Promise.reject(new Error(
+        `'${t.name}': action returned null/non-thenable instead of a Promise`
+      ));
+    }
+    return Promise.resolve(stage);
+  } catch (err) {
+    return Promise.reject(err);
+  }
+}
+function swallowEventStoreFailure(when, err) {
+  console.warn(
+    `libpetri: EventStore.append threw while emitting ${when}; the event is dropped`,
+    err
+  );
+}
 var DEADLINE_TOLERANCE_MS = 5;
 function validateOutSpec(tName, spec, producedPlaceNames) {
   switch (spec.type) {
@@ -3047,11 +3065,11 @@ function validateOutSpec(tName, spec, producedPlaceNames) {
 function produceTimeoutOutput(context, timeoutChild) {
   switch (timeoutChild.type) {
     case "place":
-      context.output(timeoutChild.place, null);
+      context.outputToHarvest(timeoutChild.place, null);
       break;
     case "forward-input": {
       const value = context.input(timeoutChild.from);
-      context.output(timeoutChild.to, value);
+      context.outputToHarvest(timeoutChild.to, value);
       break;
     }
     case "and":
@@ -3506,7 +3524,7 @@ var BitmapNetExecutor = class {
     for (let tid = 0; tid < this.compiled.transitionCount; tid++) {
       if (!this.enabledFlags[tid] || this.inFlightFlags[tid]) continue;
       if (this.canEnable(tid, this.markedPlaces)) {
-        this.fireTransition(tid);
+        this.fireTransitionContained(tid);
       } else {
         this.enabledFlags[tid] = 0;
         this.enabledTransitionCount--;
@@ -3538,7 +3556,7 @@ var BitmapNetExecutor = class {
     for (const entry of ready) {
       const { tid } = entry;
       if (this.enabledFlags[tid] && this.canEnable(tid, freshSnap)) {
-        this.fireTransition(tid);
+        this.fireTransitionContained(tid);
         freshSnap.set(this.markedPlaces);
       } else {
         this.enabledFlags[tid] = 0;
@@ -3547,6 +3565,53 @@ var BitmapNetExecutor = class {
       }
     }
   }
+  /**
+   * Fires a transition, containing any synchronous throw to that one firing so it fails
+   * only that transition, not the whole run.
+   *
+   * Without this boundary an unchecked throw raised while a transition fires — a hostile
+   * EventStore.append on a token-removed or transition-started emit, or an error thrown while
+   * consuming the matched tokens — unwinds out of the orchestrator loop and kills the executor.
+   * The transition is instead failed and marked dirty for re-evaluation, the same treatment an
+   * asynchronously-reported failure gets. Enablement-phase throws (a guard or key function that
+   * throws inside canEnable, before the firing) run outside this boundary and are not contained
+   * here.
+   *
+   * fireTransition removes tokens from the marking before it reconciles the presence
+   * bitmap, so a throw inside that window would leave bits asserting tokens that are gone;
+   * the recovery re-runs updateBitmapAfterConsumption against the real marking.
+   *
+   * Unlike the Java runtime there is no VirtualMachineError/LinkageError analogue on the JS
+   * side, so every throw is contained here — there is deliberately no fatal-rethrow escape
+   * hatch.
+   */
+  fireTransitionContained(tid) {
+    try {
+      this.fireTransition(tid);
+    } catch (e) {
+      const t = this.compiled.transition(tid);
+      if (this.enabledFlags[tid]) {
+        this.enabledFlags[tid] = 0;
+        this.enabledTransitionCount--;
+        this.enabledAtMs[tid] = -Infinity;
+      }
+      if (this.inFlight.delete(t)) {
+        this.inFlightFlags[tid] = 0;
+      }
+      this.updateBitmapAfterConsumption(tid);
+      this.matchCaches[tid] = null;
+      const err = e instanceof Error ? e : new Error(String(e));
+      this.emitEvent({
+        type: "transition-failed",
+        timestamp: Date.now(),
+        transitionName: t.name,
+        errorMessage: err.message,
+        exceptionType: err.name,
+        stack: err.stack
+      });
+      this.markTransitionDirty(tid);
+    }
+  }
   fireTransition(tid) {
     const t = this.compiled.transition(tid);
     const inputs = new TokenInput();
@@ -3645,7 +3710,7 @@ var BitmapNetExecutor = class {
     );
     const freshNameBase = t.name;
     context.setFreshNameSupplier(() => nameId(`${freshNameBase}#${this.freshNameCounter++}`));
-    let actionPromise = t.action(context);
+    let actionPromise = executeAction(t, context);
     if (t.hasActionTimeout()) {
       const timeoutSpec = t.actionTimeout;
       if (timeoutSpec === null) throw new Error(`Expected actionTimeout on ${t.name}`);
@@ -3657,6 +3722,7 @@ var BitmapNetExecutor = class {
         )
       ]).catch((err) => {
         if (err instanceof TimeoutSentinel) {
+          context.detachForTimeout();
           produceTimeoutOutput(context, timeoutSpec.child);
           this.emitEvent({
             type: "action-timed-out",
@@ -3927,7 +3993,11 @@ var BitmapNetExecutor = class {
   // ======================== Event Emission ========================
   emitEvent(event) {
     if (this.eventStoreEnabled) {
-      this.eventStore.append(event);
+      try {
+        this.eventStore.append(event);
+      } catch (err) {
+        swallowEventStoreFailure(event.type, err);
+      }
     }
   }
 };
@@ -4764,7 +4834,7 @@ var PrecompiledNetExecutor = class {
     for (let tid = 0; tid < tc; tid++) {
       if (!this.enabledFlags[tid] || this.inFlightFlags[tid]) continue;
       if (this.canEnable(tid, this.markingBitmap)) {
-        this.fireTransition(tid);
+        this.fireTransitionContained(tid);
       } else {
         this.enabledFlags[tid] = 0;
         this.enabledTransitionCount--;
@@ -4795,7 +4865,7 @@ var PrecompiledNetExecutor = class {
     for (const entry of ready) {
       const { tid } = entry;
       if (this.enabledFlags[tid] && this.canEnable(tid, freshSnap)) {
-        this.fireTransition(tid);
+        this.fireTransitionContained(tid);
         freshSnap.set(this.markingBitmap);
       } else {
         this.enabledFlags[tid] = 0;
@@ -4804,6 +4874,60 @@ var PrecompiledNetExecutor = class {
       }
     }
   }
+  /**
+   * Fires a transition, containing any synchronous throw to that one firing so it fails
+   * only that transition, not the whole run.
+   *
+   * Without this boundary an unchecked throw raised while a transition fires — a hostile
+   * EventStore.append on a token-removed or transition-started emit, or an error thrown while
+   * consuming the matched tokens — unwinds out of the orchestrator loop and kills the executor.
+   * The transition is instead failed and marked dirty for re-evaluation, the same treatment an
+   * asynchronously-reported failure gets. Enablement-phase throws (a guard or key function that
+   * throws inside canEnable, before the firing) run outside this boundary and are not contained
+   * here.
+   *
+   * fireTransition drains tokens from the queues before it reconciles the presence bitmap,
+   * so a throw inside that window would leave bits asserting tokens that are gone; the
+   * recovery re-runs updateBitmapAfterConsumption against the true queue lengths.
+   *
+   * Named to avoid colliding with the pre-existing {@link fireTransitionGuarded}
+   * guard-consume helper. Unlike the Java runtime there is no VirtualMachineError/
+   * LinkageError analogue on the JS side, so every throw is contained here — there is
+   * deliberately no fatal-rethrow escape hatch.
+   */
+  fireTransitionContained(tid) {
+    try {
+      this.fireTransition(tid);
+    } catch (e) {
+      const t = this.program.compiled.transition(tid);
+      if (this.enabledFlags[tid]) {
+        this.enabledFlags[tid] = 0;
+        this.enabledTransitionCount--;
+        this.enabledAtMs[tid] = -Infinity;
+      }
+      if (this.inFlightFlags[tid]) {
+        this.inFlightPromises[tid] = null;
+        this.inFlightContexts[tid] = null;
+        this.inFlightConsumed[tid] = null;
+        this.inFlightResolves[tid] = null;
+        this.inFlightErrors[tid] = null;
+        this.inFlightFlags[tid] = 0;
+        this.inFlightCount--;
+      }
+      this.updateBitmapAfterConsumption(tid);
+      this.matchCaches[tid] = null;
+      const err = e instanceof Error ? e : new Error(String(e));
+      this.emitEvent({
+        type: "transition-failed",
+        timestamp: Date.now(),
+        transitionName: t.name,
+        errorMessage: err.message,
+        exceptionType: err.name,
+        stack: err.stack
+      });
+      this.markTransitionDirty(tid);
+    }
+  }
   fireTransition(tid) {
     const prog = this.program;
     const t = prog.compiled.transition(tid);
@@ -4952,7 +5076,7 @@ var PrecompiledNetExecutor = class {
       this.freshNameSuppliers[tid] = freshNameSupplier;
     }
     context.setFreshNameSupplier(freshNameSupplier);
-    let actionPromise = t.action(context);
+    let actionPromise = executeAction(t, context);
     if (t.hasActionTimeout()) {
       const timeoutSpec = t.actionTimeout;
       if (timeoutSpec === null) throw new Error(`Expected actionTimeout on ${t.name}`);
@@ -4964,6 +5088,7 @@ var PrecompiledNetExecutor = class {
         )
       ]).catch((err) => {
         if (err instanceof TimeoutSentinel2) {
+          context.detachForTimeout();
           produceTimeoutOutput(context, timeoutSpec.child);
           this.emitEvent({
             type: "action-timed-out",
@@ -5358,7 +5483,11 @@ var PrecompiledNetExecutor = class {
   // ======================== Event Emission ========================
   emitEvent(event) {
     if (this.eventStoreEnabled) {
-      this.eventStore.append(event);
+      try {
+        this.eventStore.append(event);
+      } catch (err) {
+        swallowEventStoreFailure(event.type, err);
+      }
     }
   }
 };
@@ -5423,6 +5552,7 @@ export {
   inputArc,
   intersects,
   isFailureEvent,
+  isPassthrough,
   isUnit,
   keyForPlace,
   latest,