libpetri 2.13.0 → 3.0.1

package/dist/{chunk-7VJ5CYUU.js → chunk-JZIEWVAV.js}

@@ -3,6 +3,55 @@ import {
   latest
 } from "./chunk-ATT7U5H5.js";
 
+// src/core/in.ts
+function one(place) {
+  return { type: "one", place };
+}
+function exactly(count, place) {
+  if (count < 1) {
+    throw new Error(`count must be >= 1, got: ${count}`);
+  }
+  return { type: "exactly", place, count };
+}
+function all(place) {
+  return { type: "all", place };
+}
+function atLeast(minimum, place) {
+  if (minimum < 1) {
+    throw new Error(`minimum must be >= 1, got: ${minimum}`);
+  }
+  return { type: "at-least", place, minimum };
+}
+function requiredCount(spec) {
+  switch (spec.type) {
+    case "one":
+      return 1;
+    case "exactly":
+      return spec.count;
+    case "all":
+      return 1;
+    case "at-least":
+      return spec.minimum;
+  }
+}
+function consumptionCount(spec, available) {
+  if (available < requiredCount(spec)) {
+    throw new Error(
+      `Cannot consume from '${spec.place.name}': available=${available}, required=${requiredCount(spec)}`
+    );
+  }
+  switch (spec.type) {
+    case "one":
+      return 1;
+    case "exactly":
+      return spec.count;
+    case "all":
+      return available;
+    case "at-least":
+      return available;
+  }
+}
+
 // src/core/out.ts
 function and(...children) {
   if (children.length === 0) {
@@ -612,6 +661,10 @@ function computePInvariants(matrix, flatNet, initialMarking) {
       }
     }
     if (!isZero) continue;
+    if (!rowIsExact(augmented[row], T, P)) {
+      invariants.push(rawInvariant(augmented[row], T, P, flatNet, initialMarking));
+      continue;
+    }
     const weights = new Array(P);
     let allNonNegative = true;
     let hasPositive = false;
@@ -662,6 +715,105 @@ function computePInvariants(matrix, flatNet, initialMarking) {
   }
   return invariants;
 }
+function rowIsExact(row, T, P) {
+  for (let i = 0; i < P; i++) {
+    if (!Number.isSafeInteger(row[T + i])) return false;
+  }
+  return true;
+}
+function rawInvariant(row, T, P, flatNet, initialMarking) {
+  const weights = new Array(P);
+  const support = /* @__PURE__ */ new Set();
+  let constant = 0;
+  for (let i = 0; i < P; i++) {
+    weights[i] = row[T + i];
+    if (weights[i] !== 0) {
+      support.add(i);
+      constant += weights[i] * initialMarking.tokens(flatNet.places[i]);
+    }
+  }
+  return pInvariant(weights, constant, support);
+}
+function validateInvariantsExact(matrix, invariants, flatNet, initialMarking) {
+  const nonlinear = nonlinearPlaces(flatNet);
+  const valid = [];
+  const dropped = [];
+  for (const inv of invariants) {
+    const reason = exactCheckFailure(matrix, inv, nonlinear, flatNet, initialMarking);
+    if (reason === null) {
+      valid.push(inv);
+    } else {
+      dropped.push({ invariant: inv, reason });
+    }
+  }
+  return { valid, dropped };
+}
+function nonlinearPlaces(flatNet) {
+  const nonlinear = /* @__PURE__ */ new Set();
+  for (const ft of flatNet.transitions) {
+    for (let p = 0; p < ft.consumeAll.length; p++) {
+      if (ft.consumeAll[p]) nonlinear.add(p);
+    }
+    for (const p of ft.resetPlaces) nonlinear.add(p);
+  }
+  return nonlinear;
+}
+function exactCheckFailure(matrix, inv, nonlinear, flatNet, initialMarking) {
+  const P = matrix.numPlaces();
+  const T = matrix.numTransitions();
+  if (inv.weights.length !== P) {
+    return `weight vector has ${inv.weights.length} entries, expected ${P}`;
+  }
+  for (let p = 0; p < P; p++) {
+    if (!Number.isSafeInteger(inv.weights[p])) {
+      return `weight overflow at place '${placeName(flatNet, p)}' (exact value outside this implementation's integer extraction range)`;
+    }
+  }
+  if (!Number.isSafeInteger(inv.constant)) {
+    return `constant ${inv.constant} is outside the safe-integer range`;
+  }
+  for (let p = 0; p < inv.weights.length; p++) {
+    if (inv.weights[p] !== 0 && nonlinear.has(p)) {
+      return `support intersects consume-all/reset place '${placeName(flatNet, p)}' (non-linear consumption; see Strengthening.lean H1)`;
+    }
+  }
+  const y = inv.weights.map((w) => BigInt(w));
+  const incidence = matrix.incidence();
+  for (let t = 0; t < T; t++) {
+    const row = incidence[t];
+    let dot = 0n;
+    for (let p = 0; p < P; p++) {
+      if (y[p] === 0n) continue;
+      if (!Number.isSafeInteger(row[p])) {
+        return `incidence entry ${row[p]} at [t=${t}][p=${p}] is outside the safe-integer range`;
+      }
+      dot += y[p] * BigInt(row[p]);
+    }
+    if (dot !== 0n) {
+      return `y*C is ${dot} (not 0) at ${columnName(flatNet, t)}`;
+    }
+  }
+  let exact = 0n;
+  for (let p = 0; p < P; p++) {
+    if (y[p] === 0n) continue;
+    const tokens = initialMarking.tokens(flatNet.places[p]);
+    if (!Number.isSafeInteger(tokens)) {
+      return `initial marking of place ${p} (${tokens}) is outside the safe-integer range`;
+    }
+    exact += y[p] * BigInt(tokens);
+  }
+  if (exact !== BigInt(inv.constant)) {
+    return `constant ${inv.constant} does not match exact y*M0 = ${exact}`;
+  }
+  return null;
+}
+function placeName(flatNet, p) {
+  return flatNet.places[p]?.name ?? `#${p}`;
+}
+function columnName(flatNet, t) {
+  const ft = flatNet.transitions[t];
+  return ft != null ? `transition '${ft.name}'` : `env-injector column ${t - flatNet.transitions.length}`;
+}
 function computePSemiflows(matrix, flatNet, initialMarking) {
   const np = matrix.numPlaces();
   const nt = matrix.numTransitions();
@@ -953,11 +1105,13 @@ async function createSpacerRunner(timeoutMs) {
       const status = await fp.query(errorExpr);
       if (status === "unsat") {
         let invariantFormula = null;
+        let provenAnswer = null;
         const levelInvariants = [];
         try {
           const answer = fp.getAnswer();
           if (answer != null) {
             invariantFormula = answer.toString();
+            provenAnswer = answer;
           }
         } catch {
         }
@@ -973,7 +1127,7 @@ async function createSpacerRunner(timeoutMs) {
           } catch {
           }
         }
-        return { type: "proven", invariantFormula, levelInvariants };
+        return { type: "proven", invariantFormula, levelInvariants, answer: provenAnswer };
       }
       if (status === "sat") {
         let answer = null;
@@ -1058,18 +1212,9 @@ function encodeTransitionRule(ctx, fp, reachable, ft, flatNet, invariants, P) {
   const reachBody = reachable.call(...mVars);
   const enabled = encodeEnabled(ctx, ft, flatNet, mVars, P);
   const fireRelation = encodeFire(ctx, ft, flatNet, mVars, mPrimeVars, P);
-  let nonNeg = ctx.Bool.val(true);
-  for (let i = 0; i < P; i++) {
-    nonNeg = ctx.And(nonNeg, mPrimeVars[i].ge(0));
-  }
+  const nonNeg = encodeNonNegativity(ctx, mPrimeVars, P);
   const invConstraints = encodeInvariantConstraints(ctx, invariants, mPrimeVars, P);
-  let envBounds = ctx.Bool.val(true);
-  for (const [name, bound] of flatNet.environmentBounds) {
-    const idx = flatNet.placeIndex.get(name);
-    if (idx != null) {
-      envBounds = ctx.And(envBounds, mPrimeVars[idx].le(bound));
-    }
-  }
+  const envBounds = encodeEnvBounds(ctx, flatNet, mPrimeVars);
   const body = ctx.And(reachBody, enabled, fireRelation, nonNeg, invConstraints, envBounds);
   const head = reachable.call(...mPrimeVars);
   const allVars = [...mVars, ...mPrimeVars];
@@ -1086,6 +1231,31 @@ function encodeInjectionRule(ctx, fp, reachable, idx, bound, P) {
     mPrimeVars.push(Int.const(`mp${i}`));
   }
   const reachBody = reachable.call(...mVars);
+  const fire = encodeInjectionFire(ctx, idx, mVars, mPrimeVars, P);
+  const guard = encodeInjectionGuard(ctx, idx, bound, mVars);
+  const body = ctx.And(reachBody, guard, fire);
+  const head = reachable.call(...mPrimeVars);
+  const qRule = ctx.ForAll([...mVars, ...mPrimeVars], ctx.Implies(body, head));
+  fp.addRule(qRule, `env_inject_${idx}`);
+}
+function encodeNonNegativity(ctx, vars, P) {
+  let result = ctx.Bool.val(true);
+  for (let i = 0; i < P; i++) {
+    result = ctx.And(result, vars[i].ge(0));
+  }
+  return result;
+}
+function encodeEnvBounds(ctx, flatNet, vars) {
+  let result = ctx.Bool.val(true);
+  for (const [name, bound] of flatNet.environmentBounds) {
+    const idx = flatNet.placeIndex.get(name);
+    if (idx != null) {
+      result = ctx.And(result, vars[idx].le(bound));
+    }
+  }
+  return result;
+}
+function encodeInjectionFire(ctx, idx, mVars, mPrimeVars, P) {
   let fire = ctx.Bool.val(true);
   for (let i = 0; i < P; i++) {
     if (i === idx) {
@@ -1094,11 +1264,31 @@ function encodeInjectionRule(ctx, fp, reachable, idx, bound, P) {
       fire = ctx.And(fire, mPrimeVars[i].eq(mVars[i]));
     }
   }
-  const guard = bound === null ? ctx.Bool.val(true) : mVars[idx].lt(bound);
-  const body = ctx.And(reachBody, guard, fire);
-  const head = reachable.call(...mPrimeVars);
-  const qRule = ctx.ForAll([...mVars, ...mPrimeVars], ctx.Implies(body, head));
-  fp.addRule(qRule, `env_inject_${idx}`);
+  return fire;
+}
+function encodeInjectionGuard(ctx, idx, bound, mVars) {
+  return bound === null ? ctx.Bool.val(true) : mVars[idx].lt(bound);
+}
+function encodeStepRelation(ctx, flatNet, mVars, mPrimeVars) {
+  const P = flatNet.places.length;
+  const disjuncts = [];
+  for (const ft of flatNet.transitions) {
+    const enabled = encodeEnabled(ctx, ft, flatNet, mVars, P);
+    const fire = encodeFire(ctx, ft, flatNet, mVars, mPrimeVars, P);
+    const nonNeg = encodeNonNegativity(ctx, mPrimeVars, P);
+    const envBounds = encodeEnvBounds(ctx, flatNet, mPrimeVars);
+    disjuncts.push(ctx.And(enabled, fire, nonNeg, envBounds));
+  }
+  for (const [name, bound] of flatNet.environmentInjection) {
+    const idx = flatNet.placeIndex.get(name);
+    if (idx == null) continue;
+    disjuncts.push(ctx.And(
+      encodeInjectionGuard(ctx, idx, bound, mVars),
+      encodeInjectionFire(ctx, idx, mVars, mPrimeVars, P)
+    ));
+  }
+  if (disjuncts.length === 0) return ctx.Bool.val(false);
+  return ctx.Or(...disjuncts);
 }
 function injectedEnvIndices(flatNet) {
   const out = /* @__PURE__ */ new Map();
@@ -1249,6 +1439,197 @@ function encodeInvariantConstraints(ctx, invariants, mVars, P) {
   return result;
 }
 
+// src/verification/z3/certificate-checker.ts
+async function checkCertificate(ctx, answer, flatNet, initialMarking, property, invariants, sinkPlaces, timeoutMs) {
+  try {
+    if (answer == null) {
+      return {
+        type: "unavailable",
+        reason: "invariant missing (Z3 produced no inductive-invariant answer)",
+        invariant: null
+      };
+    }
+    const P = flatNet.places.length;
+    const Int = ctx.Int;
+    const mVars = [];
+    const mPrimeVars = [];
+    for (let i = 0; i < P; i++) {
+      mVars.push(Int.const(`m${i}`));
+      mPrimeVars.push(Int.const(`mp${i}`));
+    }
+    const invariant = extractInvariant(ctx, answer, P, mVars);
+    if (invariant == null) {
+      return {
+        type: "unavailable",
+        reason: "invariant unparseable (no Reachable definition recognized in the Z3 answer)",
+        invariant: String(answer)
+      };
+    }
+    const candidate = invariants.length > 0 ? ctx.And(invariant, encodeInvariantConstraints(ctx, invariants, mVars, P)) : invariant;
+    const failure = await validateCandidate(
+      ctx,
+      candidate,
+      flatNet,
+      initialMarking,
+      property,
+      sinkPlaces,
+      timeoutMs,
+      mVars,
+      mPrimeVars
+    );
+    if (failure == null) {
+      return { type: "passed", invariant: String(candidate) };
+    }
+    return { type: "failed", vc: failure.vc, detail: failure.detail, invariant: String(candidate) };
+  } catch (e) {
+    return {
+      type: "unavailable",
+      reason: `certificate check error: ${e?.message ?? e}`,
+      invariant: null
+    };
+  }
+}
+async function validateCandidate(ctx, candidate, flatNet, initialMarking, property, sinkPlaces, timeoutMs, mVars, mPrimeVars) {
+  const P = flatNet.places.length;
+  const Int = ctx.Int;
+  let nonNegM = ctx.Bool.val(true);
+  for (let i = 0; i < P; i++) {
+    nonNegM = ctx.And(nonNegM, mVars[i].ge(0));
+  }
+  const initPairs = mVars.map((v, i) => [
+    v,
+    Int.val(initialMarking.tokens(flatNet.places[i]))
+  ]);
+  const candidateAtInit = ctx.substitute(candidate, ...initPairs);
+  const vc1 = await checkUnsat(ctx, flatNet, mVars, timeoutMs, "initiation (VC1)", [ctx.Not(candidateAtInit)]);
+  if (vc1 != null) return vc1;
+  const primePairs = mVars.map((v, i) => [v, mPrimeVars[i]]);
+  const candidatePrime = ctx.substitute(candidate, ...primePairs);
+  const step = encodeStepRelation(ctx, flatNet, mVars, mPrimeVars);
+  const vc2 = await checkUnsat(
+    ctx,
+    flatNet,
+    mVars,
+    timeoutMs,
+    "consecution (VC2)",
+    [candidate, nonNegM, step, ctx.Not(candidatePrime)]
+  );
+  if (vc2 != null) return vc2;
+  const bad = encodePropertyViolation(ctx, flatNet, property, sinkPlaces, mVars, P);
+  const vc3 = await checkUnsat(ctx, flatNet, mVars, timeoutMs, "safety (VC3)", [candidate, nonNegM, bad]);
+  if (vc3 != null) return vc3;
+  return null;
+}
+function extractInvariant(ctx, answer, P, mVars) {
+  for (const conjunct of topLevelConjuncts(ctx, answer)) {
+    const invariant = tryExtractDefinition(ctx, conjunct, P, mVars);
+    if (invariant != null) return invariant;
+  }
+  return null;
+}
+function topLevelConjuncts(ctx, expr) {
+  if (!ctx.isQuantifier(expr) && ctx.isApp(expr) && String(expr.decl().name()) === "and") {
+    const out = [];
+    const n = expr.numArgs();
+    for (let i = 0; i < n; i++) out.push(expr.arg(i));
+    return out;
+  }
+  return [expr];
+}
+function tryExtractDefinition(ctx, expr, P, mVars) {
+  if (ctx.isQuantifier(expr) && expr.is_forall()) {
+    const q = expr;
+    const parts2 = splitDefinition(ctx, q.body(), P);
+    if (parts2 == null) return null;
+    const numVars = q.num_vars();
+    const to = new Array(numVars);
+    for (let j = 0; j < P; j++) {
+      const arg = parts2.app.arg(j);
+      if (!ctx.isVar(arg)) return null;
+      const idx = ctx.getVarIndex(arg);
+      if (idx >= numVars || to[idx] != null) return null;
+      to[idx] = mVars[j];
+    }
+    for (let i = 0; i < numVars; i++) {
+      if (to[i] == null) to[i] = ctx.Int.const(`certFree${i}`);
+    }
+    return ctx.substituteVars(parts2.phi, ...to);
+  }
+  const parts = splitDefinition(ctx, expr, P);
+  if (parts == null) return null;
+  const pairs = [];
+  for (let j = 0; j < P; j++) {
+    const arg = parts.app.arg(j);
+    if (ctx.isVar(arg)) return null;
+    pairs.push([arg, mVars[j]]);
+  }
+  if (pairs.length === 0) return parts.phi;
+  return ctx.substitute(parts.phi, ...pairs);
+}
+function splitDefinition(ctx, body, P) {
+  if (ctx.isQuantifier(body) || !ctx.isApp(body)) return null;
+  const b = body;
+  const decl = String(b.decl().name());
+  if ((decl === "=" || decl === "iff") && b.numArgs() === 2) {
+    if (isReachableApp(ctx, b.arg(0), P)) return { app: b.arg(0), phi: b.arg(1) };
+    if (isReachableApp(ctx, b.arg(1), P)) return { app: b.arg(1), phi: b.arg(0) };
+    return null;
+  }
+  if (decl === "=>" && b.numArgs() === 2 && isReachableApp(ctx, b.arg(0), P)) {
+    return { app: b.arg(0), phi: b.arg(1) };
+  }
+  return null;
+}
+function isReachableApp(ctx, expr, P) {
+  return ctx.isApp(expr) && String(expr.decl().name()) === "Reachable" && expr.numArgs() === P;
+}
+async function checkUnsat(ctx, flatNet, mVars, timeoutMs, vc, assertions) {
+  const solver = new ctx.Solver();
+  if (timeoutMs > 0) {
+    solver.set("timeout", Math.min(timeoutMs, 2147483647));
+  }
+  for (const assertion of assertions) {
+    solver.add(assertion);
+  }
+  const status = await solver.check();
+  if (status === "unsat") return null;
+  if (status === "sat") {
+    const witness = describeWitness(solver, flatNet, mVars);
+    return {
+      vc,
+      detail: `solver returned SATISFIABLE${witness == null ? "" : ` (witness: ${witness})`}`
+    };
+  }
+  let why = null;
+  try {
+    why = String(solver.reasonUnknown());
+  } catch {
+  }
+  return { vc, detail: `solver returned UNKNOWN${why == null || why === "" ? "" : ` (${why})`}` };
+}
+function describeWitness(solver, flatNet, mVars) {
+  try {
+    const model = solver.model();
+    const parts = [];
+    let length = 0;
+    for (let i = 0; i < mVars.length; i++) {
+      const value = model.eval(mVars[i], false);
+      const text = value == null ? "" : String(value);
+      if (!/^(-?\d+|\(- \d+\))$/.test(text)) continue;
+      const part = `${flatNet.places[i].name}=${text}`;
+      parts.push(part);
+      length += part.length + 2;
+      if (length > 160) {
+        parts.push("...");
+        break;
+      }
+    }
+    return parts.length === 0 ? null : parts.join(", ");
+  } catch {
+    return null;
+  }
+}
+
 // src/verification/analysis/dbm.ts
 var EPSILON = 1e-9;
 var DBM = class _DBM {
@@ -1734,18 +2115,8 @@ function inputRequiredCount(spec) {
       return spec.minimum;
   }
 }
-function inputConsumeCount(spec) {
-  switch (spec.type) {
-    case "one":
-      return 1;
-    case "exactly":
-      return spec.count;
-    case "all":
-      return 1;
-    // Analysis: consume minimum (1 token)
-    case "at-least":
-      return spec.minimum;
-  }
+function inputConsumeCount(spec, available) {
+  return consumptionCount(spec, available);
 }
 function checkPlaceEnabled(place, required, marking, environmentPlaces, environmentMode) {
   if (!environmentPlaces.has(place)) {
@@ -1763,7 +2134,11 @@ function checkPlaceEnabled(place, required, marking, environmentPlaces, environm
 function fireTransition(marking, transition, outputPlaces, environmentPlaces, environmentMode) {
   const builder = MarkingState.builder().copyFrom(marking);
   for (const spec of transition.inputSpecs) {
-    const toConsume = inputConsumeCount(spec);
+    const available = marking.tokens(spec.place);
+    if (available < inputRequiredCount(spec)) {
+      continue;
+    }
+    const toConsume = inputConsumeCount(spec, available);
     consumeFromPlace(builder, spec.place, toConsume, environmentPlaces, environmentMode);
   }
   for (const arc of transition.resets) {
@@ -1788,19 +2163,39 @@ function consumeFromPlace(builder, place, count, environmentPlaces, environmentM
 }
 
 // src/verification/z3/counterexample-decoder.ts
+function describeDecodeFailure(failure) {
+  if (failure == null) {
+    return "no Reachable applications with concrete arguments found in the derivation";
+  }
+  switch (failure.kind) {
+    case "no-answer":
+      return "Z3 produced no derivation answer";
+    case "traversal-error":
+      return `derivation walk failed: ${failure.message}`;
+    case "non-concrete":
+      return `${failure.skipped} Reachable application(s) had non-concrete arguments`;
+  }
+}
 function decode(ctx, answer, flatNet) {
   const trace = [];
   const transitions = [];
+  const stateByKey = /* @__PURE__ */ new Map();
   if (answer == null) {
-    return { trace, transitions };
+    return { trace, transitions, states: /* @__PURE__ */ new Set(), failure: { kind: "no-answer" } };
   }
+  const counters = { skipped: 0 };
+  let failure = null;
   try {
-    extractTrace(ctx, answer, flatNet, trace, transitions);
-  } catch {
+    extractTrace(ctx, answer, flatNet, trace, transitions, stateByKey, counters);
+  } catch (e) {
+    failure = { kind: "traversal-error", message: String(e?.message ?? e) };
   }
-  return { trace, transitions };
+  if (failure == null && counters.skipped > 0) {
+    failure = { kind: "non-concrete", skipped: counters.skipped };
+  }
+  return { trace, transitions, states: new Set(stateByKey.values()), failure };
 }
-function extractTrace(ctx, expr, flatNet, trace, transitions) {
+function extractTrace(ctx, expr, flatNet, trace, transitions, stateByKey, counters) {
   if (expr == null) return;
   if (!ctx.isApp(expr)) return;
   let name;
@@ -1817,6 +2212,10 @@ function extractTrace(ctx, expr, flatNet, trace, transitions) {
       const marking = extractMarking(ctx, expr, flatNet);
       if (marking != null) {
         trace.push(marking);
+        const key = marking.toString();
+        if (!stateByKey.has(key)) stateByKey.set(key, marking);
+      } else {
+        counters.skipped++;
       }
     }
   }
@@ -1824,7 +2223,7 @@ function extractTrace(ctx, expr, flatNet, trace, transitions) {
     const numArgs = expr.numArgs();
     for (let i = 0; i < numArgs; i++) {
       const child = expr.arg(i);
-      extractTrace(ctx, child, flatNet, trace, transitions);
+      extractTrace(ctx, child, flatNet, trace, transitions, stateByKey, counters);
     }
   } catch {
   }
@@ -1850,6 +2249,238 @@ function extractMarking(ctx, reachableApp, flatNet) {
   return builder.build();
 }
 
+// src/verification/z3/abstract-replayer.ts
+function stepName(step) {
+  return step.kind === "fire" ? step.transition : `inject(${step.place})`;
+}
+function stateKey(state) {
+  return state.join(",");
+}
+function vectorize(marking, flatNet) {
+  return flatNet.places.map((p) => marking.tokens(p));
+}
+function toMarkingState(state, flatNet) {
+  const builder = MarkingState.builder();
+  for (let i = 0; i < flatNet.places.length; i++) {
+    if (state[i] > 0) builder.tokens(flatNet.places[i], state[i]);
+  }
+  return builder.build();
+}
+function enabledA(state, ft) {
+  const P = state.length;
+  for (let p = 0; p < P; p++) {
+    if (ft.preVector[p] > 0 && state[p] < ft.preVector[p]) return false;
+  }
+  for (const p of ft.readPlaces) {
+    if (state[p] < 1) return false;
+  }
+  for (const p of ft.inhibitorPlaces) {
+    if (state[p] !== 0) return false;
+  }
+  return true;
+}
+function fireIndexed(state, ft, resets) {
+  const P = state.length;
+  const next = new Array(P);
+  for (let p = 0; p < P; p++) {
+    if (resets.has(p) || ft.consumeAll[p]) {
+      next[p] = ft.postVector[p];
+    } else {
+      next[p] = state[p] - ft.preVector[p] + ft.postVector[p];
+    }
+  }
+  return next;
+}
+function injectA(state, idx) {
+  const next = [...state];
+  next[idx] = next[idx] + 1;
+  return next;
+}
+function buildIndex(flatNet) {
+  const resetSets = flatNet.transitions.map((ft) => new Set(ft.resetPlaces));
+  const envInj = /* @__PURE__ */ new Map();
+  for (const [name, bound] of flatNet.environmentInjection) {
+    const idx = flatNet.placeIndex.get(name);
+    if (idx != null) envInj.set(idx, bound);
+  }
+  const envCaps = [];
+  for (const [name, cap] of flatNet.environmentBounds) {
+    const idx = flatNet.placeIndex.get(name);
+    if (idx != null) envCaps.push([idx, cap]);
+  }
+  return { flatNet, resetSets, envInj, envCaps };
+}
+function withinEnvBounds(index, state) {
+  for (const [idx, cap] of index.envCaps) {
+    if (state[idx] > cap) return false;
+  }
+  return true;
+}
+function successorsIndexed(index, state) {
+  const out = [];
+  const transitions = index.flatNet.transitions;
+  for (let t = 0; t < transitions.length; t++) {
+    const ft = transitions[t];
+    if (!enabledA(state, ft)) continue;
+    const next = fireIndexed(state, ft, index.resetSets[t]);
+    if (!withinEnvBounds(index, next)) continue;
+    out.push({ state: next, step: { kind: "fire", transition: ft.name } });
+  }
+  for (const [name, bound] of index.flatNet.environmentInjection) {
+    const idx = index.flatNet.placeIndex.get(name);
+    if (idx == null) continue;
+    if (bound === null || state[idx] < bound) {
+      out.push({ state: injectA(state, idx), step: { kind: "inject", place: name } });
+    }
+  }
+  return out;
+}
+function enabledRelaxEnv(state, ft, envInj) {
+  const P = state.length;
+  for (let p = 0; p < P; p++) {
+    const pre = ft.preVector[p];
+    if (pre <= 0) continue;
+    if (envInj.has(p)) {
+      const bound = envInj.get(p);
+      if (bound !== null && pre > bound) return false;
+      continue;
+    }
+    if (state[p] < pre) return false;
+  }
+  for (const p of ft.readPlaces) {
+    if (envInj.has(p)) {
+      const bound = envInj.get(p);
+      if (bound !== null && bound < 1) return false;
+      continue;
+    }
+    if (state[p] < 1) return false;
+  }
+  for (const p of ft.inhibitorPlaces) {
+    if (state[p] !== 0) return false;
+  }
+  return true;
+}
+function isDeadlockA(index, state) {
+  for (const ft of index.flatNet.transitions) {
+    if (enabledRelaxEnv(state, ft, index.envInj)) return false;
+  }
+  return true;
+}
+function satisfiesBadIndexed(index, state, property, sinkPlaces) {
+  const flatNet = index.flatNet;
+  switch (property.type) {
+    case "deadlock-free": {
+      if (!isDeadlockA(index, state)) return false;
+      for (const sink of sinkPlaces) {
+        const idx = flatNetIndexOf(flatNet, sink);
+        if (idx >= 0 && state[idx] > 0) return false;
+      }
+      return true;
+    }
+    case "mutual-exclusion": {
+      const idx1 = flatNetIndexOf(flatNet, property.p1);
+      const idx2 = flatNetIndexOf(flatNet, property.p2);
+      if (idx1 < 0 || idx2 < 0) return false;
+      return state[idx1] >= 1 && state[idx2] >= 1;
+    }
+    case "place-bound":
+    case "branch-place-bound": {
+      const idx = flatNetIndexOf(flatNet, property.place);
+      if (idx < 0) return false;
+      return state[idx] > property.bound;
+    }
+    case "joined-or-dead-lettered": {
+      const idx = flatNetIndexOf(flatNet, property.pending);
+      if (idx < 0) return false;
+      return isDeadlockA(index, state) && state[idx] >= 1;
+    }
+    case "unreachable": {
+      let resolved = 0;
+      for (const p of property.places) {
+        const idx = flatNetIndexOf(flatNet, p);
+        if (idx < 0) continue;
+        resolved++;
+        if (state[idx] < 1) return false;
+      }
+      return resolved > 0;
+    }
+  }
+}
+function replayCounterexample(flatNet, initial, decodedStates, property, sinkPlaces, options = {}) {
+  const segmentBudget = options.segmentBudget ?? 3;
+  const nodeBudget = options.nodeBudget ?? 1e4;
+  const anchors = /* @__PURE__ */ new Set();
+  for (const s of decodedStates) anchors.add(stateKey(s));
+  if (anchors.size === 0) {
+    return { kind: "exhausted", reason: "no decoded states to replay", nodesExplored: 0 };
+  }
+  const initKey = stateKey(initial);
+  if (!anchors.has(initKey)) {
+    return {
+      kind: "exhausted",
+      reason: "the initial marking is not among the decoded states",
+      nodesExplored: 0
+    };
+  }
+  const index = buildIndex(flatNet);
+  if (satisfiesBadIndexed(index, initial, property, sinkPlaces)) {
+    return { kind: "confirmed", states: [initial], steps: [], nodesExplored: 1 };
+  }
+  const nodes = [{ state: initial, step: null, parent: -1, segment: 0 }];
+  const bestSegment = /* @__PURE__ */ new Map([[initKey, 0]]);
+  const queue = [0];
+  let truncated = false;
+  for (let head = 0; head < queue.length; head++) {
+    const idx = queue[head];
+    const node = nodes[idx];
+    if (node.segment >= segmentBudget) {
+      truncated = true;
+      continue;
+    }
+    for (const succ of successorsIndexed(index, node.state)) {
+      const key = stateKey(succ.state);
+      const segment = anchors.has(key) ? 0 : node.segment + 1;
+      const prior = bestSegment.get(key);
+      if (prior !== void 0 && prior <= segment) continue;
+      bestSegment.set(key, segment);
+      if (nodes.length >= nodeBudget) {
+        return {
+          kind: "exhausted",
+          reason: `search budget exhausted (${nodeBudget} nodes) before reaching a violating state`,
+          nodesExplored: nodes.length
+        };
+      }
+      nodes.push({ state: succ.state, step: succ.step, parent: idx, segment });
+      const childIdx = nodes.length - 1;
+      if (satisfiesBadIndexed(index, succ.state, property, sinkPlaces)) {
+        const chain = reconstruct(nodes, childIdx);
+        return { kind: "confirmed", ...chain, nodesExplored: nodes.length };
+      }
+      queue.push(childIdx);
+    }
+  }
+  if (truncated) {
+    return {
+      kind: "exhausted",
+      reason: `no violating state within ${segmentBudget} abstract step(s) of a decoded state (${bestSegment.size} state(s) explored)`,
+      nodesExplored: nodes.length
+    };
+  }
+  return { kind: "no-chain", nodesExplored: nodes.length };
+}
+function reconstruct(nodes, last) {
+  const states = [];
+  const steps = [];
+  for (let i = last; i >= 0; i = nodes[i].parent) {
+    const node = nodes[i];
+    states.push(node.state);
+    if (node.step != null) steps.push(node.step);
+  }
+  states.reverse();
+  steps.reverse();
+  return { states, steps };
+}
+
 // src/verification/z3/name-coloured-encoder.ts
 function colourSlotBound(coloured, semiflows) {
   const w = (inv, pid) => inv.weights[pid] ?? 0;
@@ -2323,9 +2954,9 @@ function classify(net, mode, carrierPlaces) {
     role: (tn) => roles.get(tn) ?? { type: "ordinary" }
   };
 }
-function fixedRequiredCount(t, placeName) {
+function fixedRequiredCount(t, placeName2) {
   for (const spec of t.inputSpecs) {
-    if (spec.place.name === placeName) {
+    if (spec.place.name === placeName2) {
       switch (spec.type) {
         case "one":
           return 1;
@@ -2388,11 +3019,11 @@ var NameMarking = class _NameMarking {
     return syms ? [...syms.keys()] : [];
   }
   liveSymbols() {
-    const all = /* @__PURE__ */ new Set();
+    const all2 = /* @__PURE__ */ new Set();
     for (const syms of this.perPlace.values()) {
-      for (const s of syms.keys()) all.add(s);
+      for (const s of syms.keys()) all2.add(s);
     }
-    return [...all];
+    return [...all2];
   }
   /**
    * Symmetry-canonical key over `colouredOrder` (the finiteness mechanism). Two
@@ -2559,10 +3190,10 @@ function sharesConsumedInput(h, l, marking) {
   }
   return false;
 }
-function consumedDemand(t, placeName) {
+function consumedDemand(t, placeName2) {
   let demand = 0;
   for (const spec of t.inputSpecs) {
-    if (spec.place.name === placeName) demand += inputRequiredCount2(spec);
+    if (spec.place.name === placeName2) demand += inputRequiredCount2(spec);
   }
   return demand;
 }
@@ -2756,6 +3387,8 @@ var SmtVerifier = class _SmtVerifier {
   _budgetPlaces = /* @__PURE__ */ new Set();
   _environmentMode = alwaysAvailable();
   _timeoutMs = 6e4;
+  _certificateCheck = true;
+  _counterexampleReplay = true;
   _nuMaxClasses = 1e5;
   _fragmentMode = "base";
   _carrierPlaces = /* @__PURE__ */ new Set();
@@ -2809,6 +3442,34 @@ var SmtVerifier = class _SmtVerifier {
     this._timeoutMs = ms;
     return this;
   }
+  /**
+   * Enables/disables the independent IC3 certificate check (default: enabled).
+   *
+   * When a proven verdict comes from the IC3/Spacer path on the flat count
+   * encoding, the synthesized inductive invariant is re-validated with a plain
+   * solver against the UNSTRENGTHENED step relation — VC1 (init), VC2
+   * (consecution), VC3 (safety) — so a Spacer or encoder defect cannot certify
+   * a false PROVEN. A certificate that fails validation downgrades the verdict
+   * to unknown. Structural proofs and the coloured ν-encoding are unaffected.
+   */
+  certificateCheck(enabled) {
+    this._certificateCheck = enabled;
+    return this;
+  }
+  /**
+   * Enables/disables abstract counterexample replay (default: enabled).
+   *
+   * When a violated verdict comes from the flat count encoding, the decoded
+   * counterexample states (an order-free set — the derivation tree is walked in
+   * traversal order, not firing order) are re-executed TS-side against the
+   * abstract semantics the encoder emits (Lean's `fireA`, Basic.lean), searching
+   * for a firing order from M₀ to a property-violating marking. See
+   * `SmtVerificationResult.counterexampleConfirmed` for how each outcome lands.
+   */
+  counterexampleReplay(enabled) {
+    this._counterexampleReplay = enabled;
+    return this;
+  }
   /**
    * Sets the class-count cap for the ν-aware state-class-graph analysis (NU-050,
    * Route B). When the symbolic name-aware graph would exceed this, the analysis
@@ -2955,6 +3616,7 @@ var SmtVerifier = class _SmtVerifier {
       report.push("=== RESULT ===\n");
       report.push("PROVEN (structural): Deadlock-freedom verified by Commoner's theorem.");
       report.push("  All siphons contain initially marked traps.");
+      report.push("  Certificate check: not applicable (structural proof)");
       return buildResult(
         { type: "proven", method: "structural", inductiveInvariant: null },
         report.join("\n"),
@@ -2968,14 +3630,36 @@ var SmtVerifier = class _SmtVerifier {
     }
     report.push("Phase 3: Computing P-invariants...");
     const matrix = IncidenceMatrix.from(flatNet);
-    const invariants = computePInvariants(matrix, flatNet, this._initialMarking);
-    const semiflows = computePSemiflows(matrix, flatNet, this._initialMarking);
+    const { valid: invariants, dropped: droppedInvariants } = validateInvariantsExact(
+      matrix,
+      computePInvariants(matrix, flatNet, this._initialMarking),
+      flatNet,
+      this._initialMarking
+    );
+    const { valid: semiflows, dropped: droppedSemiflows } = validateInvariantsExact(
+      matrix,
+      computePSemiflows(matrix, flatNet, this._initialMarking),
+      flatNet,
+      this._initialMarking
+    );
     report.push(`  Found: ${invariants.length} P-invariant(s)`);
     const structurallyBounded = isCoveredByInvariants(invariants, flatNet.places.length);
     report.push(`  Structurally bounded: ${structurallyBounded ? "YES" : "NO"}`);
     for (const inv of invariants) {
       report.push(`  ${formatInvariant(inv, flatNet)}`);
     }
+    for (const { invariant, reason } of droppedInvariants) {
+      report.push(`  Dropped invariant: ${formatInvariant(invariant, flatNet)} - ${reason}`);
+    }
+    if (droppedInvariants.length > 0) {
+      report.push(`  Dropped: ${droppedInvariants.length} invariant(s) failed the exact re-check`);
+    }
+    for (const { invariant, reason } of droppedSemiflows) {
+      report.push(`  Dropped semiflow: ${formatInvariant(invariant, flatNet)} - ${reason}`);
+    }
+    if (droppedSemiflows.length > 0) {
+      report.push(`  Dropped: ${droppedSemiflows.length} semiflow(s) failed the exact re-check`);
+    }
     report.push("");
     report.push("Phase 4: IC3/PDR verification via Z3 Spacer...");
     const colouredPlan = hasMatch && nuBounded ? buildColouredPlan(
@@ -3052,7 +3736,45 @@ var SmtVerifier = class _SmtVerifier {
               { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: invariants.length, structuralResult: structResultStr }
             );
           }
-          report.push("  Status: UNSAT (property holds)\n");
+          report.push("  Status: UNSAT (property holds)");
+          if (colouredPlan != null) {
+            report.push("  Certificate check: not applicable (name-coloured encoding)");
+          } else if (!this._certificateCheck) {
+            report.push("  Certificate check: not applicable (disabled)");
+          } else {
+            const certificate = await checkCertificate(
+              runner.ctx,
+              queryResult.answer,
+              flatNet,
+              this._initialMarking,
+              this._property,
+              invariants,
+              this._sinkPlaces,
+              this._timeoutMs
+            );
+            const reason = certificateDowngradeReason(certificate);
+            if (reason != null) {
+              report.push("  Certificate check: FAILED");
+              if (certificate.type !== "passed" && certificate.invariant != null) {
+                report.push(`  Uncertified invariant: ${substituteNames(certificate.invariant, flatNet)}`);
+              }
+              report.push("");
+              report.push("=== RESULT ===\n");
+              report.push(`UNKNOWN: ${reason}`);
+              return buildResult(
+                { type: "unknown", reason },
+                report.join("\n"),
+                invariants,
+                [],
+                [],
+                [],
+                performance.now() - start,
+                { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: invariants.length, structuralResult: structResultStr }
+              );
+            }
+            report.push("  Certificate check: PASSED (init, consecution, safety)");
+          }
+          report.push("");
           const discoveredInvariants = [];
           if (queryResult.invariantFormula != null) {
             discoveredInvariants.push(substituteNames(queryResult.invariantFormula, flatNet));
@@ -3075,7 +3797,7 @@ var SmtVerifier = class _SmtVerifier {
           report.push("=== RESULT ===\n");
           report.push(`PROVEN (IC3/PDR): ${propDesc}`);
           report.push("  Z3 Spacer proved no reachable state violates the property.");
-          report.push("  NOTE: Verification ignores timing constraints and JS guards.");
+          report.push("  NOTE: Verification ignores timing constraints.");
           report.push("  An untimed proof is STRONGER than a timed one (timing only restricts behavior).");
           return this.applyNuGuard(buildResult(
             {
@@ -3095,29 +3817,92 @@ var SmtVerifier = class _SmtVerifier {
         case "violated": {
           report.push("  Status: SAT (counterexample found)\n");
           const decoded = decode(runner.ctx, queryResult.answer, flatNet);
+          const stats = {
+            places: flatNet.places.length,
+            transitions: flatNet.transitions.length,
+            invariantsFound: invariants.length,
+            structuralResult: structResultStr
+          };
+          let confirmed = null;
+          let trace = decoded.trace;
+          let transitions = decoded.transitions;
+          let replayed = false;
+          if (colouredPlan == null && this._counterexampleReplay) {
+            const assessment = assessCounterexample(
+              flatNet,
+              this._initialMarking,
+              decoded.states,
+              this._property,
+              this._sinkPlaces
+            );
+            if (assessment.kind === "confirmed") {
+              confirmed = true;
+              replayed = true;
+              trace = assessment.trace;
+              transitions = assessment.firings;
+              report.push("  Counterexample replay: CONFIRMED (abstract chain M0 -> bad re-executed)");
+            } else if (assessment.kind === "unconfirmed") {
+              confirmed = false;
+              report.push(`  Counterexample replay: UNCONFIRMED (${assessment.note})`);
+              if (decoded.failure != null) {
+                report.push(`  Decoder degradation: ${describeDecodeFailure(decoded.failure)}`);
+              }
+              report.push("  The verdict rests on Spacer's SAT answer.");
+            } else {
+              report.push("  Counterexample replay: FAILED");
+              report.push(`  Decoded states (order-free set, ${decoded.states.size}):`);
+              for (const m of decoded.states) {
+                report.push(`    ${m}`);
+              }
+              if (decoded.trace.length > 0) {
+                report.push(`  Raw traversal-order trace (${decoded.trace.length} states):`);
+                for (let i = 0; i < decoded.trace.length; i++) {
+                  report.push(`    ${i}: ${decoded.trace[i]}`);
+                }
+              }
+              if (decoded.failure != null) {
+                report.push(`  Decoder degradation: ${describeDecodeFailure(decoded.failure)}`);
+              }
+              report.push(`  Raw Z3 answer: ${truncate(String(queryResult.answer), 2e3)}`);
+              report.push("");
+              report.push("=== RESULT ===\n");
+              report.push(`UNKNOWN: ${assessment.reason}`);
+              return buildResult(
+                { type: "unknown", reason: assessment.reason },
+                report.join("\n"),
+                invariants,
+                [],
+                [],
+                [],
+                performance.now() - start,
+                stats,
+                false
+              );
+            }
+          }
           report.push("=== RESULT ===\n");
           report.push(`VIOLATED: ${propDesc}`);
-          if (decoded.trace.length > 0) {
-            report.push(`  Counterexample trace (${decoded.trace.length} states):`);
-            for (let i = 0; i < decoded.trace.length; i++) {
-              report.push(`    ${i}: ${decoded.trace[i]}`);
+          if (trace.length > 0) {
+            report.push(`  Counterexample trace (${replayed ? "replay order, " : ""}${trace.length} states):`);
+            for (let i = 0; i < trace.length; i++) {
+              report.push(`    ${i}: ${trace[i]}`);
             }
           }
-          if (decoded.transitions.length > 0) {
-            report.push(`  Firing sequence: ${decoded.transitions.join(" -> ")}`);
+          if (transitions.length > 0) {
+            report.push(`  Firing sequence: ${transitions.join(" -> ")}`);
           }
           report.push("\n  WARNING: This counterexample is in UNTIMED semantics.");
           report.push("  It may be spurious if timing constraints prevent this sequence.");
-          report.push("  JS guards are also ignored in this analysis.");
           return this.applyNuGuard(buildResult(
             { type: "violated" },
             report.join("\n"),
             invariants,
             [],
-            decoded.trace,
-            decoded.transitions,
+            trace,
+            transitions,
             performance.now() - start,
-            { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: invariants.length, structuralResult: structResultStr }
+            stats,
+            confirmed
           ), hasMatch, nuBounded, colouredPlan != null);
         }
         case "unknown": {
@@ -3210,6 +3995,51 @@ function isReachabilitySafety(property) {
       return false;
   }
 }
+function assessCounterexample(flatNet, initialMarking, decodedStates, property, sinkPlaces) {
+  if (decodedStates.size === 0) {
+    return {
+      kind: "unconfirmed",
+      note: "no counterexample states could be decoded from the Spacer answer, so the abstract replay could not run"
+    };
+  }
+  let outcome;
+  try {
+    outcome = replayCounterexample(
+      flatNet,
+      vectorize(initialMarking, flatNet),
+      [...decodedStates].map((m) => vectorize(m, flatNet)),
+      property,
+      sinkPlaces
+    );
+  } catch (e) {
+    outcome = { kind: "exhausted", reason: `replay threw: ${e?.message ?? e}`, nodesExplored: 0 };
+  }
+  switch (outcome.kind) {
+    case "confirmed":
+      return {
+        kind: "confirmed",
+        trace: outcome.states.map((s) => toMarkingState(s, flatNet)),
+        firings: outcome.steps.map(stepName)
+      };
+    case "exhausted":
+      return { kind: "unconfirmed", note: `abstract replay did not complete: ${outcome.reason}` };
+    case "no-chain":
+      return {
+        kind: "downgraded",
+        reason: "counterexample replay found no firing chain to the violation under the abstract semantics, so VIOLATED is withheld"
+      };
+  }
+}
+function certificateDowngradeReason(outcome) {
+  switch (outcome.type) {
+    case "passed":
+      return null;
+    case "failed":
+      return `certificate check failed: ${outcome.vc} was not UNSAT - ${outcome.detail}; the IC3 certificate could not be independently re-validated against the unstrengthened step relation, so PROVEN is withheld`;
+    case "unavailable":
+      return `certificate check could not run: ${outcome.reason}; PROVEN is withheld without an independently validated certificate`;
+  }
+}
 function downgradeToUnknown(result, reason) {
   return {
     ...result,
@@ -3219,9 +4049,13 @@ Downgraded to UNKNOWN: ${reason}
 `,
     discoveredInvariants: [],
     counterexampleTrace: [],
-    counterexampleTransitions: []
+    counterexampleTransitions: [],
+    counterexampleConfirmed: null
   };
 }
+function truncate(s, max) {
+  return s.length <= max ? s : `${s.slice(0, max)}\u2026 (${s.length - max} chars truncated)`;
+}
 function substituteNames(formula, flatNet) {
   for (let i = flatNet.places.length - 1; i >= 0; i--) {
     formula = formula.replace(new RegExp(`\\bm${i}\\b`, "g"), flatNet.places[i].name);
@@ -3237,10 +4071,10 @@ function formatInvariant(inv, flatNet) {
       parts.push(flatNet.places[idx].name);
     }
   }
-  return `${parts.join(" + ")} = ${inv.constant}`;
+  return `${parts.length === 0 ? "0" : parts.join(" + ")} = ${inv.constant}`;
 }
-function buildResult(verdict, report, invariants, discoveredInvariants, trace, transitions, elapsedMs, statistics) {
-  return { verdict, report, invariants, discoveredInvariants, counterexampleTrace: trace, counterexampleTransitions: transitions, elapsedMs, statistics };
+function buildResult(verdict, report, invariants, discoveredInvariants, trace, transitions, elapsedMs, statistics, counterexampleConfirmed = null) {
+  return { verdict, report, invariants, discoveredInvariants, counterexampleTrace: trace, counterexampleTransitions: transitions, counterexampleConfirmed, elapsedMs, statistics };
 }
 
 // src/verification/smt-verification-result.ts
@@ -3252,6 +4086,12 @@ function isViolated(result) {
 }
 
 export {
+  one,
+  exactly,
+  all,
+  atLeast,
+  requiredCount,
+  consumptionCount,
   and,
   andPlaces,
   xor,
@@ -3298,13 +4138,16 @@ export {
   flatNetTransitionCount,
   flatNetIndexOf,
   encode,
+  checkCertificate,
   DBM,
   StateClass,
   requireOutputProducingActions,
   StateClassGraph,
+  describeDecodeFailure,
   decode,
+  replayCounterexample,
   SmtVerifier,
   isProven,
   isViolated
 };
-//# sourceMappingURL=chunk-7VJ5CYUU.js.map
+//# sourceMappingURL=chunk-JZIEWVAV.js.map