libpetri 2.3.2 → 2.5.0

package/dist/index.js

@@ -635,69 +635,235 @@ function findForwardInputs(out) {
   }
 }
 
-// src/core/compose-bindings.ts
-var COMPOSE_BINDINGS_KEY = /* @__PURE__ */ Symbol("ComposeBindings.internal");
-var ComposeBindings = class {
-  _portBindings = /* @__PURE__ */ new Map();
-  _channelBindings = /* @__PURE__ */ new Map();
+// src/core/interface.ts
+var INTERFACE_KEY = /* @__PURE__ */ Symbol("Interface.internal");
+var Interface = class {
+  ports;
+  channels;
+  /** @internal Use {@link Interface.builder} to create instances. */
+  constructor(key, ports, channels) {
+    if (key !== INTERFACE_KEY) throw new Error("Use Interface.builder() to create instances");
+    this.ports = ports;
+    this.channels = channels;
+  }
+  /** Looks up a port by name. Returns undefined when absent. */
+  port(name) {
+    return this.ports.get(name);
+  }
+  /** Looks up a channel by name. Returns undefined when absent. */
+  channel(name) {
+    return this.channels.get(name);
+  }
   /**
-   * @internal Use {@link PetriNetBuilder.compose} — instances are produced
-   * by the host builder and supplied to the caller's callback.
+   * Looks up a port by name and returns its underlying place, narrowed to
+   * `Place<T>`. Returns undefined when the port does not exist.
+   *
+   * Note: TypeScript erases generics at runtime, so unlike Java's
+   * `portPlaceAs(name, Class<T>)` this method cannot verify the token type at
+   * runtime — the caller is trusted to supply the correct `T`. Per **MOD-022**,
+   * type compatibility is enforced at compile time only in TypeScript.
    */
-  constructor(key) {
-    if (key !== COMPOSE_BINDINGS_KEY) {
-      throw new Error(
-        "Use PetriNetBuilder.compose(instance, b => ...) \u2014 ComposeBindings is not directly constructible"
-      );
+  placeAs(name) {
+    const p = this.ports.get(name);
+    if (p === void 0) return void 0;
+    return p.place;
+  }
+  static builder() {
+    return new InterfaceBuilder();
+  }
+};
+var InterfaceBuilder = class {
+  _ports = /* @__PURE__ */ new Map();
+  _channels = /* @__PURE__ */ new Map();
+  /** Add a pre-built port (rejects duplicate names). */
+  port(port) {
+    if (this._ports.has(port.name)) {
+      throw new Error(`Duplicate port name: '${port.name}'`);
+    }
+    this._ports.set(port.name, port);
+    return this;
+  }
+  /** Add an input port (advisory direction). */
+  inputPort(name, place2) {
+    return this.port({ name, direction: "input", place: place2 });
+  }
+  /** Add an output port (advisory direction). */
+  outputPort(name, place2) {
+    return this.port({ name, direction: "output", place: place2 });
+  }
+  /** Add an in-out port (advisory direction). */
+  inoutPort(name, place2) {
+    return this.port({ name, direction: "inout", place: place2 });
+  }
+  channel(channelOrName, transition) {
+    const ch = typeof channelOrName === "string" ? { name: channelOrName, transition } : channelOrName;
+    if (this._channels.has(ch.name)) {
+      throw new Error(`Duplicate channel name: '${ch.name}'`);
+    }
+    this._channels.set(ch.name, ch);
+    return this;
+  }
+  /** @internal Bulk-add ports already validated by the caller. */
+  portsAll(ports) {
+    for (const p of ports) this.port(p);
+    return this;
+  }
+  /** @internal Bulk-add channels already validated by the caller. */
+  channelsAll(channels) {
+    for (const c of channels) this.channel(c);
+    return this;
+  }
+  build() {
+    return new Interface(
+      INTERFACE_KEY,
+      new Map(this._ports),
+      new Map(this._channels)
+    );
+  }
+};
+
+// src/core/instance.ts
+var INSTANCE_KEY = /* @__PURE__ */ Symbol("Instance.internal");
+var Instance = class {
+  prefix;
+  def;
+  renamedBody;
+  portHandles;
+  channelHandles;
+  params;
+  /**
+   * @internal Use {@link SubnetDef.instantiate} (or the internal factory
+   * {@link __createInstance}) to create instances.
+   */
+  constructor(key, prefix, def, renamedBody, portHandles, channelHandles, params) {
+    if (key !== INSTANCE_KEY) {
+      throw new Error("Use SubnetDef.instantiate() to create Instance values");
     }
+    this.prefix = prefix;
+    this.def = def;
+    this.renamedBody = renamedBody;
+    this.portHandles = portHandles;
+    this.channelHandles = channelHandles;
+    this.params = params;
   }
   /**
-   * Binds the named interface port to the given caller place per **MOD-020**.
+   * Returns the renamed {@link Place} corresponding to the named port.
    *
-   * The port name is the **original** (pre-prefix) name declared in the
-   * subnet's `Interface`. The typed `<T>` parameter ensures the caller
-   * place's token type matches the interface port's token type at compile
-   * time per [MOD-022]; TypeScript does not validate the type at runtime
-   * because generics are erased.
+   * The port name is the **original** (pre-prefix) name as declared in the
+   * subnet's `Interface`. Per **MOD-022**, TypeScript enforces token-type
+   * compatibility at compile time only; this method does not validate `T`
+   * at runtime. A missing name raises an `Error`.
    *
-   * @throws when `portName` is already bound on this builder
+   * @throws when the port name is unknown
    */
-  bindPort(portName, callerPlace) {
-    if (this._portBindings.has(portName)) {
-      throw new Error(`Port '${portName}' is already bound`);
+  port(name) {
+    const p = this.portHandles.get(name);
+    if (p === void 0) {
+      throw new Error(`No port named '${name}' in instance '${this.prefix}'`);
     }
-    this._portBindings.set(portName, callerPlace);
-    return this;
+    return p;
   }
   /**
-   * Records a synchronous channel binding per **MOD-021**: at compose time,
-   * the instance-side renamed channel transition is merged with
-   * `callerTransition` into a single transition in the resulting flat net.
-   *
-   * **Status**: channel composition is implemented in task #13. Recording a
-   * channel binding here is permitted, but `compose(...)` currently raises
-   * an `Error` when any channel binding is present.
+   * Returns the renamed {@link Transition} corresponding to the named channel.
    *
-   * @throws when `channelName` is already bound on this builder
+   * @throws when the channel name is unknown
    */
-  bindChannel(channelName, callerTransition) {
-    if (this._channelBindings.has(channelName)) {
-      throw new Error(`Channel '${channelName}' is already bound`);
+  channel(name) {
+    const t = this.channelHandles.get(name);
+    if (t === void 0) {
+      throw new Error(`No channel named '${name}' in instance '${this.prefix}'`);
     }
-    this._channelBindings.set(channelName, callerTransition);
-    return this;
+    return t;
   }
-  /** Returns an unmodifiable view of the recorded port bindings. */
-  portBindings() {
-    return this._portBindings;
+  /**
+   * Returns the debug-UI descriptor for this instance per **MOD-041**.
+   */
+  descriptor() {
+    const transitions = [];
+    for (const t of this.renamedBody.transitions) transitions.push(t.name);
+    const exposedPlaces = [];
+    for (const p of this.portHandles.values()) exposedPlaces.push(p.name);
+    return {
+      prefix: this.prefix,
+      defName: this.def.name,
+      transitions,
+      exposedPlaces,
+      params: this.params,
+      parentPrefix: null
+    };
   }
-  /** Returns an unmodifiable view of the recorded channel bindings. */
-  channelBindings() {
-    return this._channelBindings;
+  /**
+   * Produces a derived instance whose specified transitions (named by their
+   * **original**, pre-prefix names) carry the supplied actions per **MOD-030**.
+   *
+   * For each entry `[originalName, action]`, the renamed body is searched for
+   * the transition whose name equals `prefix + "/" + originalName`. The
+   * resulting instance shares the original `def`, `prefix`, `params`, and
+   * port/channel handle topology — only the renamed body is rebuilt with new
+   * actions. Per **MOD-030**, calling `bindActions` on one instance does NOT
+   * affect the actions held by other instances of the same `def`.
+   *
+   * Unrecognised original names raise an `Error` so typos surface eagerly.
+   */
+  bindActions(actionsByOriginalName) {
+    const prefixedByName = /* @__PURE__ */ new Map();
+    const renamedNames = /* @__PURE__ */ new Set();
+    for (const t of this.renamedBody.transitions) {
+      renamedNames.add(t.name);
+    }
+    for (const originalName of Object.keys(actionsByOriginalName)) {
+      const prefixed = this.prefix + "/" + originalName;
+      if (!renamedNames.has(prefixed)) {
+        throw new Error(
+          `Instance.bindActions: no transition '${originalName}' (resolved as '${prefixed}') in instance '${this.prefix}' of subnet '${this.def.name}'`
+        );
+      }
+      prefixedByName.set(prefixed, actionsByOriginalName[originalName]);
+    }
+    const reboundBody = this.renamedBody.bindActionsWithResolver((name) => {
+      const action = prefixedByName.get(name);
+      if (action !== void 0) return action;
+      for (const t of this.renamedBody.transitions) {
+        if (t.name === name) return t.action;
+      }
+      throw new Error(`Instance.bindActions: resolver invoked with unknown name '${name}'`);
+    });
+    const reboundChannelHandles = /* @__PURE__ */ new Map();
+    if (this.channelHandles.size > 0) {
+      const byName = /* @__PURE__ */ new Map();
+      for (const t of reboundBody.transitions) {
+        byName.set(t.name, t);
+      }
+      for (const [name, oldT] of this.channelHandles) {
+        const refreshed = byName.get(oldT.name);
+        if (refreshed === void 0) {
+          throw new Error(
+            `Instance.bindActions: channel '${name}' transition '${oldT.name}' not found in rebound body`
+          );
+        }
+        reboundChannelHandles.set(name, refreshed);
+      }
+    }
+    return __createInstance(
+      this.prefix,
+      this.def,
+      reboundBody,
+      this.portHandles,
+      reboundChannelHandles,
+      this.params
+    );
   }
 };
-function __createComposeBindings() {
-  return new ComposeBindings(COMPOSE_BINDINGS_KEY);
+function __createInstance(prefix, def, renamedBody, portHandles, channelHandles, params) {
+  return new Instance(
+    INSTANCE_KEY,
+    prefix,
+    def,
+    renamedBody,
+    portHandles,
+    channelHandles,
+    params
+  );
 }
 
 // src/core/internal/subnet-rewriter.ts
@@ -958,1043 +1124,1030 @@ function applyFusion(transitions, fusionMap) {
   return rewritten;
 }
 
-// src/core/fusion-set.ts
-var FUSION_SET_KEY = /* @__PURE__ */ Symbol("FusionSet.internal");
-var FusionSet = class _FusionSet {
+// src/verification/verification-harness.ts
+function buildVerificationResult(syntheticNet, perProperty) {
+  const frozen = new Map(perProperty);
+  return {
+    syntheticNet,
+    perProperty: frozen,
+    allProven() {
+      for (const r of frozen.values()) {
+        if (!isProven(r)) return false;
+      }
+      return true;
+    },
+    anyViolated() {
+      for (const r of frozen.values()) {
+        if (isViolated(r)) return true;
+      }
+      return false;
+    }
+  };
+}
+function normaliseGenerators(generators) {
+  if (generators instanceof Map) return new Map(generators);
+  return new Map(Object.entries(generators));
+}
+function normaliseProperties(properties) {
+  if (Array.isArray(properties)) return [...properties];
+  return [...properties];
+}
+
+// src/core/subnet-def.ts
+var SUBNET_DEF_KEY = /* @__PURE__ */ Symbol("SubnetDef.internal");
+var SubnetDef = class _SubnetDef {
   name;
-  members;
-  /** @internal Use {@link FusionSet.builder} or {@link FusionSet.of} to create instances. */
-  constructor(key, name, members) {
-    if (key !== FUSION_SET_KEY) {
-      throw new Error("Use FusionSet.builder() or FusionSet.of() to create instances");
+  body;
+  iface;
+  /** @internal Use {@link SubnetDef.builder} or {@link SubnetDef.fromNet} to create instances. */
+  constructor(key, name, body, iface) {
+    if (key !== SUBNET_DEF_KEY) {
+      throw new Error("Use SubnetDef.builder() or SubnetDef.fromNet() to create instances");
     }
     this.name = name;
-    this.members = members;
-  }
-  /**
-   * Returns the canonical member — by convention, the first declared member.
-   * The canonical place's identity survives into the resulting flat net.
-   */
-  get canonical() {
-    return this.members[0];
+    this.body = body;
+    this.iface = iface;
   }
   /**
-   * Returns all members **except** the canonical member, in declaration order.
-   * These are the places that get substituted away at
-   * {@link import('./petri-net.js').PetriNetBuilder.build} time.
+   * Produces a renamed module instance per **MOD-010**, **MOD-011**, **MOD-012**,
+   * and **MOD-030**.
    *
-   * For a single-member (degenerate) set, returns an empty array.
-   */
-  nonCanonical() {
-    if (this.members.length <= 1) return [];
-    return this.members.slice(1);
-  }
-  toString() {
-    return `FusionSet[${this.name}, canonical=${this.canonical.name}, members=${this.members.length}]`;
-  }
-  // ============================================================
-  //  Static factories
-  // ============================================================
-  /** Returns a fresh {@link FusionSetBuilder} with the given human-readable name. */
-  static builder(name) {
-    return new FusionSetBuilder(name);
-  }
-  /**
-   * Convenience factory: builds a fusion set whose first member is `first`
-   * (the canonical) and whose remaining members are `rest`, all sharing the
-   * type `<T>`.
+   * The rename pass walks every place and transition of the body net,
+   * substituting each name with `prefix + "/" + originalName`, and rebuilds
+   * every arc with rewritten place references. Transition timing, priority,
+   * and action are carried through by reference (action sharing per
+   * [MOD-030]). The renamed body is itself a structurally valid `PetriNet`
+   * per [CORE-040]; per-instance state isolation per [MOD-012] is a
+   * structural consequence of distinct prefixed names.
    *
-   * The varargs form ensures static-type homogeneity at the call site (the
-   * TypeScript compiler checks every `rest` entry is a `Place<T>`).
-   */
-  static of(name, first, ...rest) {
-    const members = [first];
-    for (const p of rest) members.push(p);
-    return new _FusionSet(FUSION_SET_KEY, name, Object.freeze(members));
-  }
-};
-var FusionSetBuilder = class {
-  _name;
-  _members = [];
-  constructor(name) {
-    if (typeof name !== "string" || name.length === 0) {
-      throw new Error("FusionSet.builder: name must be a non-empty string");
-    }
-    this._name = name;
-  }
-  /**
-   * Appends a member to the fusion set. The first member becomes the canonical
-   * place per the convention documented on {@link FusionSet}.
+   * ## Prefix validation
    *
-   * The `<T>` parameter is for compile-time guidance only: callers writing
-   * typed code at the same call site benefit from the compiler checking
-   * `Place<T>` at each member.
-   */
-  member(place2) {
-    if (place2 === void 0 || place2 === null) {
-      throw new Error(`FusionSet '${this._name}': member place must not be null`);
-    }
-    this._members.push(place2);
-    return this;
-  }
-  /**
-   * Builds the immutable {@link FusionSet}. Validates that the set has at
-   * least one member; the empty set is rejected as malformed per **MOD-060**.
-   * Single-member sets are accepted as a structurally degenerate no-op.
-   */
-  build() {
-    if (this._members.length === 0) {
-      throw new Error(
-        `FusionSet '${this._name}': must have at least one member (MOD-060)`
-      );
-    }
-    return new FusionSet(FUSION_SET_KEY, this._name, Object.freeze(this._members.slice()));
-  }
-};
-
-// src/core/petri-net.ts
-var PETRI_NET_KEY = /* @__PURE__ */ Symbol("PetriNet.internal");
-var PetriNet = class _PetriNet {
-  name;
-  places;
-  transitions;
-  /** @internal Use {@link PetriNet.builder} to create instances. */
-  constructor(key, name, places, transitions) {
-    if (key !== PETRI_NET_KEY) throw new Error("Use PetriNet.builder() to create instances");
-    this.name = name;
-    this.places = places;
-    this.transitions = transitions;
-  }
-  /**
-   * Creates a new PetriNet with actions bound to transitions by name.
-   * Unbound transitions keep passthrough action.
-   */
-  bindActions(actionBindings) {
-    const bindings = actionBindings instanceof Map ? actionBindings : new Map(Object.entries(actionBindings));
-    return this.bindActionsWithResolver(
-      (name) => bindings.get(name) ?? passthrough()
-    );
-  }
-  /**
-   * Creates a new PetriNet with actions bound via a resolver function.
+   * The `"/"` character is reserved as the prefix separator (per [MOD-010]).
+   * User-supplied prefixes MUST NOT contain `"/"`; nested instantiation is
+   * performed by the future `PetriNetBuilder.compose(...)` mechanism (per
+   * [MOD-013]). A prefix containing `"/"` raises an `Error`.
+   *
+   * @param prefix the rename prefix (non-empty, must not contain `"/"`)
+   * @param params the parameter value carried through to `Instance.params`
+   *               (may be omitted when `P` is `void`)
+   * @throws when `prefix` is empty or contains `"/"`
    */
-  bindActionsWithResolver(actionResolver) {
-    const boundTransitions = /* @__PURE__ */ new Set();
-    for (const t of this.transitions) {
-      const action = actionResolver(t.name);
-      if (action !== null && action !== t.action) {
-        boundTransitions.add(rebuildWithAction(t, action));
-      } else {
-        boundTransitions.add(t);
+  instantiate(prefix, params) {
+    validatePrefix(prefix);
+    const placeRemap = /* @__PURE__ */ new Map();
+    const transitionRemap = /* @__PURE__ */ new Map();
+    const renamedBody = renameNet(this.body, prefix, placeRemap, transitionRemap);
+    const portHandles = /* @__PURE__ */ new Map();
+    for (const port of this.iface.ports.values()) {
+      const renamed = placeRemap.get(port.place.name);
+      if (renamed === void 0) {
+        throw new Error(
+          `Port '${port.name}' references place '${port.place.name}' that was not found in the renamed body. This indicates a SubnetDef invariant violation.`
+        );
       }
+      portHandles.set(port.name, renamed);
     }
-    return new _PetriNet(PETRI_NET_KEY, this.name, this.places, boundTransitions);
-  }
-  static builder(name) {
-    return new PetriNetBuilder(name);
-  }
-};
-var PetriNetBuilder = class {
-  _name;
-  _places = /* @__PURE__ */ new Set();
-  _transitions = /* @__PURE__ */ new Set();
-  _fusionSets = [];
-  constructor(name) {
-    this._name = name;
-  }
-  /** Add an explicit place. */
-  place(place2) {
-    this._places.add(place2);
-    return this;
-  }
-  /** Add explicit places. */
-  places(...places) {
-    for (const p of places) this._places.add(p);
-    return this;
-  }
-  /** Add a transition (auto-collects places from arcs). */
-  transition(transition) {
-    this._transitions.add(transition);
-    for (const spec of transition.inputSpecs) {
-      this._places.add(spec.place);
-    }
-    for (const p of transition.outputPlaces()) {
-      this._places.add(p);
-    }
-    for (const inh of transition.inhibitors) {
-      this._places.add(inh.place);
-    }
-    for (const r of transition.reads) {
-      this._places.add(r.place);
-    }
-    for (const r of transition.resets) {
-      this._places.add(r.place);
-    }
-    return this;
-  }
-  /** Add transitions (auto-collects places from arcs). */
-  transitions(...transitions) {
-    for (const t of transitions) this.transition(t);
-    return this;
-  }
-  compose(instance, arg) {
-    if (arg === void 0) {
-      return this.composeAuto(instance);
-    }
-    if (typeof arg === "function") {
-      const bindings = __createComposeBindings();
-      arg(bindings);
-      return this.composeInternal(instance, bindings.portBindings(), bindings.channelBindings());
+    const channelHandles = /* @__PURE__ */ new Map();
+    for (const channel of this.iface.channels.values()) {
+      const renamed = transitionRemap.get(channel.transition.name);
+      if (renamed === void 0) {
+        throw new Error(
+          `Channel '${channel.name}' references transition '${channel.transition.name}' that was not found in the renamed body. This indicates a SubnetDef invariant violation.`
+        );
+      }
+      channelHandles.set(channel.name, renamed);
     }
-    const portMappings = arg instanceof Map ? arg : new Map(Object.entries(arg));
-    return this.composeInternal(instance, portMappings, /* @__PURE__ */ new Map());
+    return __createInstance(
+      prefix,
+      this,
+      renamedBody,
+      portHandles,
+      channelHandles,
+      params
+    );
   }
   /**
-   * Identity-default auto-compose per **MOD-024**.
+   * Verifies safety properties of this subnet definition **in isolation** per
+   * **MOD-051**, by wrapping it in a synthetic enclosing net where each input
+   * port is fed by an {@link EnvironmentPlace} (token-source per the harness
+   * generator) and each output port is observed via a synthetic place. The
+   * standard {@link SmtVerifier} (per [MOD-050]) is invoked once per property
+   * declared in the harness; the resulting per-property outcomes are
+   * aggregated into a {@link VerificationResult}.
    *
-   * Each declared interface port auto-binds to its own `port.place` — the
-   * Place the SubnetDef builder declared via `.inputPort(name, hostPlace)`
-   * (or `outputPort` / `inoutPort`). If the host builder already declares
-   * the equal place, the two merge; if not, the place arrives implicitly
-   * via the rewritten transitions' arcs (same flow as explicit `bindPort`).
+   * ## Synthetic-net construction
    *
-   * If the subnet declares no interface ports at all, body places are
-   * checked against this builder's place set **by name** (matching the
-   * existing TS Place equality semantics; see [CORE-002] note in
-   * `spec/11-modular-composition.md` MOD-024). Body places that don't match
-   * stay private under their prefixed names per [MOD-010].
+   * The synthetic enclosing net is built by:
+   * 1. Instantiating this `SubnetDef` with the prefix `"sut"` (system-under-test)
+   *    and `harness.params`.
+   * 2. For each input or in-out port on the interface, looking up the
+   *    harness generator by port name, allocating a synthetic
+   *    {@link Place}`<unknown>` of the same conceptual token type as the
+   *    port, wrapping it in an {@link EnvironmentPlace}, and binding the
+   *    port to that synthetic place via
+   *    {@link import('./petri-net.js').PetriNetBuilder.compose}. The supplier
+   *    is invoked once at construction time to materialize the seed token —
+   *    its presence is what bounds the input behavior under analysis. **If
+   *    the harness map is missing a generator for a required input or in-out
+   *    port, an `Error` is thrown.**
+   * 3. For each output or in-out port, allocating a synthetic observation
+   *    {@link Place}`<unknown>` and binding the port to it via the same
+   *    `compose(...)` call. The verifier inspects this place's reachability
+   *    / marking through the standard property APIs ({@link SmtProperty}).
+   * 4. Building the resulting flat {@link PetriNet} per [MOD-023] (the
+   *    verifier is composition-unaware per [MOD-050]).
    *
-   * Channels are NOT auto-bound — transition identity is too delicate for
-   * inference. If the subnet declares any channel, this overload throws.
+   * ## Per-property invocation
+   *
+   * Each {@link SmtProperty} in the harness is verified independently against
+   * the same synthetic net. The synthetic environment places are passed
+   * through to the verifier so that places driven by the harness generators
+   * are treated under the verifier's environment-analysis semantics rather
+   * than as ordinary sink places.
+   *
+   * @param harness the verification harness — supplies parameters, input-port
+   *                token generators, and the property set
+   * @returns a {@link VerificationResult} aggregating per-property
+   *          {@link SmtVerificationResult}s
+   * @throws when an input or in-out port is missing a harness generator
    */
-  composeAuto(instance) {
-    const iface = instance.def.iface;
-    if (iface.channels.size > 0) {
-      const channelNames = [];
-      for (const c of iface.channels.values()) channelNames.push(c.name);
-      channelNames.sort();
-      throw new Error(
-        `compose(Instance): subnet '${instance.def.name}' (instance prefix '${instance.prefix}') declares channels [${channelNames.join(", ")}]; auto-compose does not bind channels. Use compose(instance, bind => bind.bindChannel(...)) with explicit channel bindings.`
-      );
+  async verify(harness) {
+    if (harness === null || harness === void 0) {
+      throw new Error("SubnetDef.verify: harness must not be null/undefined");
     }
-    const hostByName = /* @__PURE__ */ new Map();
-    for (const p of this._places) hostByName.set(p.name, p);
-    if (iface.ports.size > 0) {
-      const portMappings = /* @__PURE__ */ new Map();
-      for (const port of iface.ports.values()) {
-        const hostMatch = hostByName.get(port.place.name);
-        portMappings.set(port.name, hostMatch ?? port.place);
+    const sut = this.instantiate("sut", harness.params);
+    const generators = normaliseGenerators(harness.portInputGenerators);
+    const properties = normaliseProperties(harness.properties);
+    const envPlaces = [];
+    const portMappings = /* @__PURE__ */ new Map();
+    for (const port of this.iface.ports.values()) {
+      const portName = port.name;
+      switch (port.direction) {
+        case "input": {
+          const generator = generators.get(portName);
+          if (generator === void 0) {
+            throw new Error(
+              `verify: harness is missing an input generator for port '${portName}' on subnet '${this.name}' (MOD-051)`
+            );
+          }
+          const seed = generator();
+          if (seed === null || seed === void 0) {
+            throw new Error(
+              `verify: input generator for port '${portName}' on subnet '${this.name}' produced null/undefined`
+            );
+          }
+          const synth = place(`harness_in_${portName}`);
+          envPlaces.push(environmentPlace(synth.name));
+          portMappings.set(portName, synth);
+          break;
+        }
+        case "output": {
+          const synth = place(`harness_out_${portName}`);
+          portMappings.set(portName, synth);
+          break;
+        }
+        case "inout": {
+          const generator = generators.get(portName);
+          if (generator === void 0) {
+            throw new Error(
+              `verify: harness is missing an input generator for in-out port '${portName}' on subnet '${this.name}' (MOD-051)`
+            );
+          }
+          const seed = generator();
+          if (seed === null || seed === void 0) {
+            throw new Error(
+              `verify: input generator for in-out port '${portName}' on subnet '${this.name}' produced null/undefined`
+            );
+          }
+          const synth = place(`harness_io_${portName}`);
+          envPlaces.push(environmentPlace(synth.name));
+          portMappings.set(portName, synth);
+          break;
+        }
       }
-      return this.composeInternal(instance, portMappings, /* @__PURE__ */ new Map());
     }
-    const mergeMap = /* @__PURE__ */ new Map();
-    const prefix = instance.prefix + "/";
-    for (const renamed of instance.renamedBody.places) {
-      if (!renamed.name.startsWith(prefix)) continue;
-      const originalName = renamed.name.substring(prefix.length);
-      const hostMatch = hostByName.get(originalName);
-      if (hostMatch !== void 0) {
-        mergeMap.set(renamed.name, hostMatch);
+    const syntheticNet = PetriNet.builder("verify_" + this.name).compose(sut, portMappings).build();
+    const perProperty = /* @__PURE__ */ new Map();
+    for (const property of properties) {
+      const verifier = SmtVerifier.forNet(syntheticNet).property(property);
+      if (envPlaces.length > 0) {
+        verifier.environmentPlaces(...envPlaces);
       }
+      const result = await verifier.verify();
+      perProperty.set(property, result);
     }
-    return this.applyComposition(instance, mergeMap, /* @__PURE__ */ new Map());
+    return buildVerificationResult(syntheticNet, perProperty);
+  }
+  // ============================================================
+  //  Static factories
+  // ============================================================
+  static builder(name) {
+    return new SubnetDefBuilder(name);
   }
   /**
-   * @internal Shared compose implementation: validates port and channel
-   * bindings, builds the place-substitution map, walks every renamed-body
-   * transition through {@link substitutePlaces}, applies channel merges per
-   * [MOD-021], and adds the resulting transitions to this builder.
-   *
-   * ## Channel-merge flow ([MOD-021])
+   * Retrofit utility per **MOD-014**: wraps an existing closed {@link PetriNet}
+   * plus an {@link Interface} into an unparameterised `SubnetDef<void>`.
    *
-   * 1. Collect rewritten instance transitions into a working `Map<string,
-   *    Transition>` keyed by prefixed transition name (deferred — not yet
-   *    added to the builder's transition set).
-   * 2. For each channel binding, resolve the renamed instance-side
-   *    transition through `instance.channel(channelName)`, then look up its
-   *    rewritten counterpart in the working map by name.
-   * 3. Replace the working-map entry with a {@link mergeTransitions} result
-   *    that fuses caller-side + instance-side; remove the rewritten
-   *    instance-side entry. Also replace (or add) the caller-side
-   *    transition in this builder's transition set with the same merged
-   *    result, indexed under the caller's name slot.
-   * 4. Add the surviving (un-merged) entries to this builder.
+   * Validation per **MOD-014** / **MOD-006** is enforced before the result is
+   * constructed:
+   * - Every port's underlying `Place` must be present in `net.places`.
+   * - Every channel's underlying `Transition` must be present in `net.transitions`.
+   * - Port and channel name uniqueness is re-validated defensively (the
+   *   `Interface` builder already enforces this; hand-built `Interface`
+   *   values bypass that path).
    *
-   * The deferral matters: writing the rewritten instance transitions to the
-   * builder eagerly would force a second "remove-then-replace" pass to
-   * apply the channel merges, complicating the place-collection invariants.
-   * Collecting first and merging second keeps the builder's transition set
-   * finalized exactly once.
+   * The resulting subnet definition is unparameterised (parameter type is `void`).
    *
-   * Keying the working map by prefixed transition name (rather than by
-   * Transition reference) is also robust against a prior
-   * {@link Instance.bindActions} call that may have rebuilt the renamed-body
-   * transitions, breaking identity equality between the body and the
-   * channel-handle map — but the prefixed names remain stable.
+   * @throws when a port place is not in `net.places`, a channel transition is
+   *         not in `net.transitions`, or port/channel names are not unique.
    */
-  composeInternal(instance, portMappings, channelBindings) {
-    const iface = instance.def.iface;
-    const mergeMap = /* @__PURE__ */ new Map();
-    for (const [portName, callerPlace] of portMappings) {
-      const port = iface.port(portName);
-      if (port === void 0) {
-        const knownPorts = [];
-        for (const p of iface.ports.values()) knownPorts.push(p.name);
+  static fromNet(net, iface) {
+    const bodyPlaces = net.places;
+    const bodyTransitions = net.transitions;
+    const seenPortNames = /* @__PURE__ */ new Set();
+    for (const port of iface.ports.values()) {
+      if (seenPortNames.has(port.name)) {
         throw new Error(
-          `compose: no port named '${portName}' on subnet '${instance.def.name}' (instance prefix '${instance.prefix}'). Known ports: [${knownPorts.join(", ")}]`
+          `fromNet: duplicate port name '${port.name}' on interface for net '${net.name}' (MOD-006)`
+        );
+      }
+      seenPortNames.add(port.name);
+      if (!bodyPlaces.has(port.place)) {
+        throw new Error(
+          `fromNet: port '${port.name}' references place '${port.place.name}' which is not in net '${net.name}' (MOD-014/MOD-006)`
         );
       }
-      const ifacePlace = instance.port(portName);
-      mergeMap.set(ifacePlace.name, callerPlace);
-    }
-    return this.applyComposition(instance, mergeMap, channelBindings);
-  }
-  /**
-   * Shared post-mergeMap pipeline: rewrites renamed-body transitions
-   * through `mergeMap`, applies channel merges per **MOD-021**, and adds
-   * the surviving transitions to the builder.
-   *
-   * Used by both the explicit-binding path (`composeInternal`) and the
-   * auto-compose path (`composeAuto` per **MOD-024**). The two paths differ
-   * only in how the (renamed Place name → host Place) `mergeMap` is built.
-   */
-  applyComposition(instance, mergeMap, channelBindings) {
-    const iface = instance.def.iface;
-    const rewrittenByName = /* @__PURE__ */ new Map();
-    for (const t of instance.renamedBody.transitions) {
-      rewrittenByName.set(t.name, substitutePlaces(t, mergeMap));
     }
-    for (const [channelName, callerTrans] of channelBindings) {
-      let instanceRenamedChannel;
-      try {
-        instanceRenamedChannel = instance.channel(channelName);
-      } catch (cause) {
-        const knownChannels = [];
-        for (const c of iface.channels.values()) knownChannels.push(c.name);
-        const err = new Error(
-          `compose: no channel named '${channelName}' on subnet '${instance.def.name}' (instance prefix '${instance.prefix}'). Known channels: [${knownChannels.join(", ")}]`
+    const seenChannelNames = /* @__PURE__ */ new Set();
+    for (const channel of iface.channels.values()) {
+      if (seenChannelNames.has(channel.name)) {
+        throw new Error(
+          `fromNet: duplicate channel name '${channel.name}' on interface for net '${net.name}' (MOD-006)`
         );
-        err.cause = cause;
-        throw err;
       }
-      const rewrittenInstanceChannel = rewrittenByName.get(instanceRenamedChannel.name);
-      if (rewrittenInstanceChannel === void 0) {
+      seenChannelNames.add(channel.name);
+      if (!bodyTransitions.has(channel.transition)) {
         throw new Error(
-          `compose: channel '${channelName}' resolved to a transition '${instanceRenamedChannel.name}' that is not present in the renamed body. This indicates a SubnetDef invariant violation.`
+          `fromNet: channel '${channel.name}' references transition '${channel.transition.name}' which is not in net '${net.name}' (MOD-014/MOD-006)`
         );
       }
-      const merged = mergeTransitions(callerTrans, rewrittenInstanceChannel, callerTrans.name);
-      rewrittenByName.delete(instanceRenamedChannel.name);
-      this._transitions.delete(callerTrans);
-      this.transition(merged);
-    }
-    for (const rewritten of rewrittenByName.values()) {
-      this.transition(rewritten);
     }
+    return new _SubnetDef(SUBNET_DEF_KEY, net.name, net, iface);
+  }
+};
+var SubnetDefBuilder = class {
+  _name;
+  _bodyBuilder;
+  _ports = [];
+  _channels = [];
+  constructor(name) {
+    this._name = name;
+    this._bodyBuilder = PetriNet.builder(name);
+  }
+  // -------- body construction (delegates to PetriNet.Builder) --------
+  transition(transition) {
+    this._bodyBuilder.transition(transition);
     return this;
   }
-  fuse(...args) {
-    if (args.length === 1 && typeof args[0] === "function") {
-      const declarer = args[0];
-      const fb = FusionSet.builder(this._name + "-fusion");
-      declarer(fb);
-      this._fusionSets.push(fb.build());
-      return this;
-    }
-    for (const s of args) {
-      if (s === void 0 || s === null) {
-        throw new Error("fuse: fusion set must not be null");
-      }
-      this._fusionSets.push(s);
-    }
+  transitions(...transitions) {
+    this._bodyBuilder.transitions(...transitions);
     return this;
   }
-  /**
-   * Builds the immutable {@link PetriNet}, applying fusion resolution (per
-   * **MOD-061**) AFTER all transition/composition accumulation:
-   *
-   * 1. Detect overlapping fusion sets — a single place declared in two sets
-   *    is rejected with an `Error`.
-   * 2. Build the `non-canonical → canonical` substitution map across all
-   *    sets, keyed by non-canonical place name (matching the rewriter's
-   *    Map<string, Place<unknown>> convention — TypeScript Place identity is
-   *    name-based per `runtime/compiled-net.ts`).
-   * 3. Walk every transition through {@link applyFusion} to rewrite arc place
-   *    references.
-   * 4. Re-derive the place set from the rewritten transitions plus any
-   *    caller-declared standalone places, dropping non-canonical members.
-   *    Caller-declared standalone places that happen to be non-canonical
-   *    members are also dropped.
-   *
-   * If no fusion sets were registered, the build is the trivial
-   * `new PetriNet(...)` — the fusion machinery has no per-build cost when
-   * unused.
-   *
-   * @throws when two fusion sets share a place
-   */
-  build() {
-    if (this._fusionSets.length === 0) {
-      return new PetriNet(PETRI_NET_KEY, this._name, this._places, this._transitions);
-    }
-    return this.buildWithFusion();
+  place(place2) {
+    this._bodyBuilder.place(place2);
+    return this;
   }
-  /**
-   * @internal Fusion-resolution pass per **MOD-061**. Split out from
-   * {@link build} so the no-fusion fast path stays trivial.
-   */
-  buildWithFusion() {
-    const ownership = /* @__PURE__ */ new Map();
-    for (const set of this._fusionSets) {
-      for (const member of set.members) {
-        const prior = ownership.get(member.name);
-        if (prior !== void 0 && prior !== set) {
-          throw new Error(
-            `Fusion overlap: place '${member.name}' appears in two fusion sets ('${prior.name}' and '${set.name}'). A place may appear in at most one fusion set (MOD-060).`
-          );
-        }
-        ownership.set(member.name, set);
+  // -------- interface declarations --------
+  inputPort(name, place2) {
+    this._ports.push({ name, direction: "input", place: place2 });
+    return this;
+  }
+  outputPort(name, place2) {
+    this._ports.push({ name, direction: "output", place: place2 });
+    return this;
+  }
+  inoutPort(name, place2) {
+    this._ports.push({ name, direction: "inout", place: place2 });
+    return this;
+  }
+  channel(name, transition) {
+    this._channels.push({ name, transition });
+    return this;
+  }
+  // -------- build & validate (MOD-006) --------
+  build() {
+    const built = this._bodyBuilder.build();
+    const bodyPlaces = built.places;
+    const bodyTransitions = built.transitions;
+    const portNames = /* @__PURE__ */ new Set();
+    for (const port of this._ports) {
+      if (portNames.has(port.name)) {
+        throw new Error(`Subnet '${this._name}': duplicate port name '${port.name}'`);
       }
-    }
-    const fusionMap = /* @__PURE__ */ new Map();
-    const nonCanonicalNames = /* @__PURE__ */ new Set();
-    for (const set of this._fusionSets) {
-      const canonical = set.canonical;
-      for (const nc of set.nonCanonical()) {
-        fusionMap.set(nc.name, canonical);
-        nonCanonicalNames.add(nc.name);
+      portNames.add(port.name);
+      if (!bodyPlaces.has(port.place)) {
+        throw new Error(
+          `Subnet '${this._name}': port '${port.name}' references place '${port.place.name}' which is not in the body`
+        );
       }
     }
-    const rewrittenTransitions = applyFusion(this._transitions, fusionMap);
-    const rebuiltPlaces = /* @__PURE__ */ new Set();
-    for (const p of this._places) {
-      if (!nonCanonicalNames.has(p.name)) {
-        rebuiltPlaces.add(p);
+    const channelNames = /* @__PURE__ */ new Set();
+    for (const channel of this._channels) {
+      if (channelNames.has(channel.name)) {
+        throw new Error(`Subnet '${this._name}': duplicate channel name '${channel.name}'`);
+      }
+      channelNames.add(channel.name);
+      if (!bodyTransitions.has(channel.transition)) {
+        throw new Error(
+          `Subnet '${this._name}': channel '${channel.name}' references transition '${channel.transition.name}' which is not in the body`
+        );
       }
     }
-    for (const t of rewrittenTransitions) {
-      for (const spec of t.inputSpecs) rebuiltPlaces.add(spec.place);
-      for (const p of t.outputPlaces()) rebuiltPlaces.add(p);
-      for (const inh of t.inhibitors) rebuiltPlaces.add(inh.place);
-      for (const r of t.reads) rebuiltPlaces.add(r.place);
-      for (const r of t.resets) rebuiltPlaces.add(r.place);
-    }
-    return new PetriNet(PETRI_NET_KEY, this._name, rebuiltPlaces, rewrittenTransitions);
+    const ifaceBuilder = Interface.builder();
+    ifaceBuilder.portsAll(this._ports);
+    ifaceBuilder.channelsAll(this._channels);
+    const iface = ifaceBuilder.build();
+    return new SubnetDef(SUBNET_DEF_KEY, this._name, built, iface);
   }
 };
-function rebuildWithAction(t, action) {
-  const builder = Transition.builder(t.name).timing(t.timing).priority(t.priority).action(action);
-  if (t.inputSpecs.length > 0) {
-    builder.inputs(...t.inputSpecs);
-  }
-  if (t.outputSpec !== null) {
-    builder.outputs(t.outputSpec);
-  }
-  for (const inh of t.inhibitors) {
-    builder.inhibitor(inh.place);
-  }
-  for (const r of t.reads) {
-    builder.read(r.place);
+function validatePrefix(prefix) {
+  if (typeof prefix !== "string" || prefix.length === 0) {
+    throw new Error("SubnetDef.instantiate: prefix must be a non-empty string");
   }
-  for (const r of t.resets) {
-    builder.reset(r.place);
+  if (prefix.indexOf("/") >= 0) {
+    throw new Error(
+      `SubnetDef.instantiate: prefix must not contain '/' (reserved as the prefix separator per MOD-010); use compose(...) for nested instantiation. Got: '${prefix}'`
+    );
   }
-  return builder.build();
-}
-
-// src/core/subnet.ts
-function closedSubnet(net) {
-  return { kind: "closed", net };
-}
-function openSubnet(def) {
-  return { kind: "open", def };
 }
 
-// src/core/interface.ts
-var INTERFACE_KEY = /* @__PURE__ */ Symbol("Interface.internal");
-var Interface = class {
-  ports;
-  channels;
-  /** @internal Use {@link Interface.builder} to create instances. */
-  constructor(key, ports, channels) {
-    if (key !== INTERFACE_KEY) throw new Error("Use Interface.builder() to create instances");
-    this.ports = ports;
-    this.channels = channels;
-  }
-  /** Looks up a port by name. Returns undefined when absent. */
-  port(name) {
-    return this.ports.get(name);
+// src/core/compose-bindings.ts
+var COMPOSE_BINDINGS_KEY = /* @__PURE__ */ Symbol("ComposeBindings.internal");
+var ComposeBindings = class {
+  _portBindings = /* @__PURE__ */ new Map();
+  _channelBindings = /* @__PURE__ */ new Map();
+  /**
+   * @internal Use {@link PetriNetBuilder.compose} — instances are produced
+   * by the host builder and supplied to the caller's callback.
+   */
+  constructor(key) {
+    if (key !== COMPOSE_BINDINGS_KEY) {
+      throw new Error(
+        "Use PetriNetBuilder.compose(instance, b => ...) \u2014 ComposeBindings is not directly constructible"
+      );
+    }
   }
-  /** Looks up a channel by name. Returns undefined when absent. */
-  channel(name) {
-    return this.channels.get(name);
+  /**
+   * Binds the named interface port to the given caller place per **MOD-020**.
+   *
+   * The port name is the **original** (pre-prefix) name declared in the
+   * subnet's `Interface`. The typed `<T>` parameter ensures the caller
+   * place's token type matches the interface port's token type at compile
+   * time per [MOD-022]; TypeScript does not validate the type at runtime
+   * because generics are erased.
+   *
+   * @throws when `portName` is already bound on this builder
+   */
+  bindPort(portName, callerPlace) {
+    if (this._portBindings.has(portName)) {
+      throw new Error(`Port '${portName}' is already bound`);
+    }
+    this._portBindings.set(portName, callerPlace);
+    return this;
   }
   /**
-   * Looks up a port by name and returns its underlying place, narrowed to
-   * `Place<T>`. Returns undefined when the port does not exist.
+   * Records a synchronous channel binding per **MOD-021**: at compose time,
+   * the instance-side renamed channel transition is merged with
+   * `callerTransition` into a single transition in the resulting flat net.
    *
-   * Note: TypeScript erases generics at runtime, so unlike Java's
-   * `portPlaceAs(name, Class<T>)` this method cannot verify the token type at
-   * runtime — the caller is trusted to supply the correct `T`. Per **MOD-022**,
-   * type compatibility is enforced at compile time only in TypeScript.
+   * **Status**: channel composition is implemented in task #13. Recording a
+   * channel binding here is permitted, but `compose(...)` currently raises
+   * an `Error` when any channel binding is present.
+   *
+   * @throws when `channelName` is already bound on this builder
    */
-  placeAs(name) {
-    const p = this.ports.get(name);
-    if (p === void 0) return void 0;
-    return p.place;
+  bindChannel(channelName, callerTransition) {
+    if (this._channelBindings.has(channelName)) {
+      throw new Error(`Channel '${channelName}' is already bound`);
+    }
+    this._channelBindings.set(channelName, callerTransition);
+    return this;
   }
-  static builder() {
-    return new InterfaceBuilder();
+  /** Returns an unmodifiable view of the recorded port bindings. */
+  portBindings() {
+    return this._portBindings;
+  }
+  /** Returns an unmodifiable view of the recorded channel bindings. */
+  channelBindings() {
+    return this._channelBindings;
   }
 };
-var InterfaceBuilder = class {
-  _ports = /* @__PURE__ */ new Map();
-  _channels = /* @__PURE__ */ new Map();
-  /** Add a pre-built port (rejects duplicate names). */
-  port(port) {
-    if (this._ports.has(port.name)) {
-      throw new Error(`Duplicate port name: '${port.name}'`);
+function __createComposeBindings() {
+  return new ComposeBindings(COMPOSE_BINDINGS_KEY);
+}
+
+// src/core/fusion-set.ts
+var FUSION_SET_KEY = /* @__PURE__ */ Symbol("FusionSet.internal");
+var FusionSet = class _FusionSet {
+  name;
+  members;
+  /** @internal Use {@link FusionSet.builder} or {@link FusionSet.of} to create instances. */
+  constructor(key, name, members) {
+    if (key !== FUSION_SET_KEY) {
+      throw new Error("Use FusionSet.builder() or FusionSet.of() to create instances");
     }
-    this._ports.set(port.name, port);
-    return this;
-  }
-  /** Add an input port (advisory direction). */
-  inputPort(name, place2) {
-    return this.port({ name, direction: "input", place: place2 });
+    this.name = name;
+    this.members = members;
   }
-  /** Add an output port (advisory direction). */
-  outputPort(name, place2) {
-    return this.port({ name, direction: "output", place: place2 });
+  /**
+   * Returns the canonical member — by convention, the first declared member.
+   * The canonical place's identity survives into the resulting flat net.
+   */
+  get canonical() {
+    return this.members[0];
   }
-  /** Add an in-out port (advisory direction). */
-  inoutPort(name, place2) {
-    return this.port({ name, direction: "inout", place: place2 });
+  /**
+   * Returns all members **except** the canonical member, in declaration order.
+   * These are the places that get substituted away at
+   * {@link import('./petri-net.js').PetriNetBuilder.build} time.
+   *
+   * For a single-member (degenerate) set, returns an empty array.
+   */
+  nonCanonical() {
+    if (this.members.length <= 1) return [];
+    return this.members.slice(1);
   }
-  channel(channelOrName, transition) {
-    const ch = typeof channelOrName === "string" ? { name: channelOrName, transition } : channelOrName;
-    if (this._channels.has(ch.name)) {
-      throw new Error(`Duplicate channel name: '${ch.name}'`);
-    }
-    this._channels.set(ch.name, ch);
-    return this;
+  toString() {
+    return `FusionSet[${this.name}, canonical=${this.canonical.name}, members=${this.members.length}]`;
   }
-  /** @internal Bulk-add ports already validated by the caller. */
-  portsAll(ports) {
-    for (const p of ports) this.port(p);
-    return this;
+  // ============================================================
+  //  Static factories
+  // ============================================================
+  /** Returns a fresh {@link FusionSetBuilder} with the given human-readable name. */
+  static builder(name) {
+    return new FusionSetBuilder(name);
   }
-  /** @internal Bulk-add channels already validated by the caller. */
-  channelsAll(channels) {
-    for (const c of channels) this.channel(c);
-    return this;
+  /**
+   * Convenience factory: builds a fusion set whose first member is `first`
+   * (the canonical) and whose remaining members are `rest`, all sharing the
+   * type `<T>`.
+   *
+   * The varargs form ensures static-type homogeneity at the call site (the
+   * TypeScript compiler checks every `rest` entry is a `Place<T>`).
+   */
+  static of(name, first, ...rest) {
+    const members = [first];
+    for (const p of rest) members.push(p);
+    return new _FusionSet(FUSION_SET_KEY, name, Object.freeze(members));
   }
-  build() {
-    return new Interface(
-      INTERFACE_KEY,
-      new Map(this._ports),
-      new Map(this._channels)
-    );
+};
+var FusionSetBuilder = class {
+  _name;
+  _members = [];
+  constructor(name) {
+    if (typeof name !== "string" || name.length === 0) {
+      throw new Error("FusionSet.builder: name must be a non-empty string");
+    }
+    this._name = name;
   }
-};
-
-// src/core/instance.ts
-var INSTANCE_KEY = /* @__PURE__ */ Symbol("Instance.internal");
-var Instance = class {
-  prefix;
-  def;
-  renamedBody;
-  portHandles;
-  channelHandles;
-  params;
   /**
-   * @internal Use {@link SubnetDef.instantiate} (or the internal factory
-   * {@link __createInstance}) to create instances.
+   * Appends a member to the fusion set. The first member becomes the canonical
+   * place per the convention documented on {@link FusionSet}.
+   *
+   * The `<T>` parameter is for compile-time guidance only: callers writing
+   * typed code at the same call site benefit from the compiler checking
+   * `Place<T>` at each member.
    */
-  constructor(key, prefix, def, renamedBody, portHandles, channelHandles, params) {
-    if (key !== INSTANCE_KEY) {
-      throw new Error("Use SubnetDef.instantiate() to create Instance values");
+  member(place2) {
+    if (place2 === void 0 || place2 === null) {
+      throw new Error(`FusionSet '${this._name}': member place must not be null`);
     }
-    this.prefix = prefix;
-    this.def = def;
-    this.renamedBody = renamedBody;
-    this.portHandles = portHandles;
-    this.channelHandles = channelHandles;
-    this.params = params;
+    this._members.push(place2);
+    return this;
   }
   /**
-   * Returns the renamed {@link Place} corresponding to the named port.
-   *
-   * The port name is the **original** (pre-prefix) name as declared in the
-   * subnet's `Interface`. Per **MOD-022**, TypeScript enforces token-type
-   * compatibility at compile time only; this method does not validate `T`
-   * at runtime. A missing name raises an `Error`.
-   *
-   * @throws when the port name is unknown
+   * Builds the immutable {@link FusionSet}. Validates that the set has at
+   * least one member; the empty set is rejected as malformed per **MOD-060**.
+   * Single-member sets are accepted as a structurally degenerate no-op.
    */
-  port(name) {
-    const p = this.portHandles.get(name);
-    if (p === void 0) {
-      throw new Error(`No port named '${name}' in instance '${this.prefix}'`);
+  build() {
+    if (this._members.length === 0) {
+      throw new Error(
+        `FusionSet '${this._name}': must have at least one member (MOD-060)`
+      );
     }
-    return p;
+    return new FusionSet(FUSION_SET_KEY, this._name, Object.freeze(this._members.slice()));
   }
+};
+
+// src/core/petri-net.ts
+var PETRI_NET_KEY = /* @__PURE__ */ Symbol("PetriNet.internal");
+var PetriNet = class _PetriNet {
+  name;
+  places;
+  transitions;
   /**
-   * Returns the renamed {@link Transition} corresponding to the named channel.
+   * Subnet-membership metadata per **MOD-026**: maps each node name (place or
+   * transition) contributed by exactly one directly-composed subnet to that
+   * subnet's name. Shared places contributed by two or more subnets, and every
+   * node of a net not built via {@link PetriNetBuilder.compose}`(SubnetDef)`,
+   * are absent. Never null — an empty map when there is no metadata. The DOT
+   * exporter renders `subgraph cluster_*` blocks from this map.
    *
-   * @throws when the channel name is unknown
+   * V8 `Map` is insertion-ordered, preserving compose order so cluster
+   * subgraphs render deterministically (cross-language byte-parity).
    */
-  channel(name) {
-    const t = this.channelHandles.get(name);
-    if (t === void 0) {
-      throw new Error(`No channel named '${name}' in instance '${this.prefix}'`);
-    }
-    return t;
+  subnetMembership;
+  /** @internal Use {@link PetriNet.builder} to create instances. */
+  constructor(key, name, places, transitions, subnetMembership = /* @__PURE__ */ new Map()) {
+    if (key !== PETRI_NET_KEY) throw new Error("Use PetriNet.builder() to create instances");
+    this.name = name;
+    this.places = places;
+    this.transitions = transitions;
+    this.subnetMembership = subnetMembership;
   }
   /**
-   * Returns the debug-UI descriptor for this instance per **MOD-041**.
+   * Creates a new PetriNet with actions bound to transitions by name.
+   * Unbound transitions keep passthrough action.
    */
-  descriptor() {
-    const transitions = [];
-    for (const t of this.renamedBody.transitions) transitions.push(t.name);
-    const exposedPlaces = [];
-    for (const p of this.portHandles.values()) exposedPlaces.push(p.name);
-    return {
-      prefix: this.prefix,
-      defName: this.def.name,
-      transitions,
-      exposedPlaces,
-      params: this.params,
-      parentPrefix: null
-    };
+  bindActions(actionBindings) {
+    const bindings = actionBindings instanceof Map ? actionBindings : new Map(Object.entries(actionBindings));
+    return this.bindActionsWithResolver(
+      (name) => bindings.get(name) ?? passthrough()
+    );
   }
   /**
-   * Produces a derived instance whose specified transitions (named by their
-   * **original**, pre-prefix names) carry the supplied actions per **MOD-030**.
-   *
-   * For each entry `[originalName, action]`, the renamed body is searched for
-   * the transition whose name equals `prefix + "/" + originalName`. The
-   * resulting instance shares the original `def`, `prefix`, `params`, and
-   * port/channel handle topology — only the renamed body is rebuilt with new
-   * actions. Per **MOD-030**, calling `bindActions` on one instance does NOT
-   * affect the actions held by other instances of the same `def`.
-   *
-   * Unrecognised original names raise an `Error` so typos surface eagerly.
+   * Creates a new PetriNet with actions bound via a resolver function.
    */
-  bindActions(actionsByOriginalName) {
-    const prefixedByName = /* @__PURE__ */ new Map();
-    const renamedNames = /* @__PURE__ */ new Set();
-    for (const t of this.renamedBody.transitions) {
-      renamedNames.add(t.name);
-    }
-    for (const originalName of Object.keys(actionsByOriginalName)) {
-      const prefixed = this.prefix + "/" + originalName;
-      if (!renamedNames.has(prefixed)) {
-        throw new Error(
-          `Instance.bindActions: no transition '${originalName}' (resolved as '${prefixed}') in instance '${this.prefix}' of subnet '${this.def.name}'`
-        );
-      }
-      prefixedByName.set(prefixed, actionsByOriginalName[originalName]);
-    }
-    const reboundBody = this.renamedBody.bindActionsWithResolver((name) => {
-      const action = prefixedByName.get(name);
-      if (action !== void 0) return action;
-      for (const t of this.renamedBody.transitions) {
-        if (t.name === name) return t.action;
-      }
-      throw new Error(`Instance.bindActions: resolver invoked with unknown name '${name}'`);
-    });
-    const reboundChannelHandles = /* @__PURE__ */ new Map();
-    if (this.channelHandles.size > 0) {
-      const byName = /* @__PURE__ */ new Map();
-      for (const t of reboundBody.transitions) {
-        byName.set(t.name, t);
-      }
-      for (const [name, oldT] of this.channelHandles) {
-        const refreshed = byName.get(oldT.name);
-        if (refreshed === void 0) {
-          throw new Error(
-            `Instance.bindActions: channel '${name}' transition '${oldT.name}' not found in rebound body`
-          );
-        }
-        reboundChannelHandles.set(name, refreshed);
+  bindActionsWithResolver(actionResolver) {
+    const boundTransitions = /* @__PURE__ */ new Set();
+    for (const t of this.transitions) {
+      const action = actionResolver(t.name);
+      if (action !== null && action !== t.action) {
+        boundTransitions.add(rebuildWithAction(t, action));
+      } else {
+        boundTransitions.add(t);
       }
     }
-    return __createInstance(
-      this.prefix,
-      this.def,
-      reboundBody,
-      this.portHandles,
-      reboundChannelHandles,
-      this.params
+    return new _PetriNet(
+      PETRI_NET_KEY,
+      this.name,
+      this.places,
+      boundTransitions,
+      this.subnetMembership
     );
   }
+  static builder(name) {
+    return new PetriNetBuilder(name);
+  }
 };
-function __createInstance(prefix, def, renamedBody, portHandles, channelHandles, params) {
-  return new Instance(
-    INSTANCE_KEY,
-    prefix,
-    def,
-    renamedBody,
-    portHandles,
-    channelHandles,
-    params
-  );
-}
-
-// src/verification/verification-harness.ts
-function buildVerificationResult(syntheticNet, perProperty) {
-  const frozen = new Map(perProperty);
-  return {
-    syntheticNet,
-    perProperty: frozen,
-    allProven() {
-      for (const r of frozen.values()) {
-        if (!isProven(r)) return false;
-      }
-      return true;
-    },
-    anyViolated() {
-      for (const r of frozen.values()) {
-        if (isViolated(r)) return true;
-      }
-      return false;
+var PetriNetBuilder = class _PetriNetBuilder {
+  _name;
+  _places = /* @__PURE__ */ new Set();
+  _transitions = /* @__PURE__ */ new Set();
+  _fusionSets = [];
+  // MOD-026: node name -> set of subnet names that contributed it via
+  // compose(SubnetDef), in first-contribution order. Resolved to single-owner
+  // membership at build(). V8 Map/Set iterate in insertion order, preserving
+  // compose order for cross-language byte-parity.
+  _subnetContributions = /* @__PURE__ */ new Map();
+  constructor(name) {
+    this._name = name;
+  }
+  /** Add an explicit place. */
+  place(place2) {
+    this._places.add(place2);
+    return this;
+  }
+  /** Add explicit places. */
+  places(...places) {
+    for (const p of places) this._places.add(p);
+    return this;
+  }
+  /** Add a transition (auto-collects places from arcs). */
+  transition(transition) {
+    this._transitions.add(transition);
+    for (const spec of transition.inputSpecs) {
+      this._places.add(spec.place);
     }
-  };
-}
-function normaliseGenerators(generators) {
-  if (generators instanceof Map) return new Map(generators);
-  return new Map(Object.entries(generators));
-}
-function normaliseProperties(properties) {
-  if (Array.isArray(properties)) return [...properties];
-  return [...properties];
-}
-
-// src/core/subnet-def.ts
-var SUBNET_DEF_KEY = /* @__PURE__ */ Symbol("SubnetDef.internal");
-var SubnetDef = class _SubnetDef {
-  name;
-  body;
-  iface;
-  /** @internal Use {@link SubnetDef.builder} or {@link SubnetDef.fromNet} to create instances. */
-  constructor(key, name, body, iface) {
-    if (key !== SUBNET_DEF_KEY) {
-      throw new Error("Use SubnetDef.builder() or SubnetDef.fromNet() to create instances");
+    for (const p of transition.outputPlaces()) {
+      this._places.add(p);
+    }
+    for (const inh of transition.inhibitors) {
+      this._places.add(inh.place);
+    }
+    for (const r of transition.reads) {
+      this._places.add(r.place);
+    }
+    for (const r of transition.resets) {
+      this._places.add(r.place);
+    }
+    return this;
+  }
+  /** Add transitions (auto-collects places from arcs). */
+  transitions(...transitions) {
+    for (const t of transitions) this.transition(t);
+    return this;
+  }
+  compose(instanceOrDef, arg) {
+    if (instanceOrDef instanceof SubnetDef) {
+      return this.composeDirect(instanceOrDef);
     }
-    this.name = name;
-    this.body = body;
-    this.iface = iface;
+    const instance = instanceOrDef;
+    if (arg === void 0) {
+      return this.composeAuto(instance);
+    }
+    if (typeof arg === "function") {
+      const bindings = __createComposeBindings();
+      arg(bindings);
+      return this.composeInternal(instance, bindings.portBindings(), bindings.channelBindings());
+    }
+    const portMappings = arg instanceof Map ? arg : new Map(Object.entries(arg));
+    return this.composeInternal(instance, portMappings, /* @__PURE__ */ new Map());
   }
   /**
-   * Produces a renamed module instance per **MOD-010**, **MOD-011**, **MOD-012**,
-   * and **MOD-030**.
+   * Composes a subnet {@link SubnetDef} **directly** into this builder per
+   * **MOD-025** — **without instantiation**, and without the prefix-renaming
+   * of {@link SubnetDef.instantiate}.
    *
-   * The rename pass walks every place and transition of the body net,
-   * substituting each name with `prefix + "/" + originalName`, and rebuilds
-   * every arc with rewritten place references. Transition timing, priority,
-   * and action are carried through by reference (action sharing per
-   * [MOD-030]). The renamed body is itself a structurally valid `PetriNet`
-   * per [CORE-040]; per-instance state isolation per [MOD-012] is a
-   * structural consequence of distinct prefixed names.
+   * Every body place and transition is added under its **original**
+   * (un-prefixed) name. Places merge into this builder by name: a body place
+   * whose name equals an enclosing-net place *is* that place in the composed
+   * flat net. This is the mode for wiring a subnet in as a single shared copy.
    *
-   * ## Prefix validation
+   * Direct composition is **order-independent**: composing the same set of
+   * subnets in any order yields the same flat net, because merging is by
+   * place name and not by a probe of the builder's place set at call time —
+   * contrast the no-interface body-inference branch of {@link composeAuto}
+   * (MOD-024), which is order-sensitive.
    *
-   * The `"/"` character is reserved as the prefix separator (per [MOD-010]).
-   * User-supplied prefixes MUST NOT contain `"/"`; nested instantiation is
-   * performed by the future `PetriNetBuilder.compose(...)` mechanism (per
-   * [MOD-013]). A prefix containing `"/"` raises an `Error`.
+   * For multiple *independent* copies — each with isolated per-instance state
+   * per [MOD-012] — use {@link SubnetDef.instantiate} + the `compose(instance)`
+   * overload instead.
    *
-   * @param prefix the rename prefix (non-empty, must not contain `"/"`)
-   * @param params the parameter value carried through to `Instance.params`
-   *               (may be omitted when `P` is `void`)
-   * @throws when `prefix` is empty or contains `"/"`
+   * Rejections: a body transition whose name already exists in this builder
+   * (use `instantiate(prefix)` for independent copies); a subnet whose
+   * interface declares any channel (direct composition does not bind
+   * channels — use `instantiate` + the channel-binding `compose` overload).
+   *
+   * Token-type conflicts on a same-named place cannot be detected: TS
+   * {@link Place} equality is name-only at runtime (the documented carve-out,
+   * same as MOD-024).
+   *
+   * @throws when the subnet declares channels, or a body transition name
+   *         collides with a transition already in this builder.
    */
-  instantiate(prefix, params) {
-    validatePrefix(prefix);
-    const placeRemap = /* @__PURE__ */ new Map();
-    const transitionRemap = /* @__PURE__ */ new Map();
-    const renamedBody = renameNet(this.body, prefix, placeRemap, transitionRemap);
-    const portHandles = /* @__PURE__ */ new Map();
-    for (const port of this.iface.ports.values()) {
-      const renamed = placeRemap.get(port.place.name);
-      if (renamed === void 0) {
-        throw new Error(
-          `Port '${port.name}' references place '${port.place.name}' that was not found in the renamed body. This indicates a SubnetDef invariant violation.`
-        );
-      }
-      portHandles.set(port.name, renamed);
+  composeDirect(def) {
+    const iface = def.iface;
+    if (iface.channels.size > 0) {
+      const channelNames = [];
+      for (const c of iface.channels.values()) channelNames.push(c.name);
+      channelNames.sort();
+      throw new Error(
+        `compose(SubnetDef): subnet '${def.name}' declares channels [${channelNames.join(", ")}]; direct composition does not bind channels. Use def.instantiate(prefix) + compose(instance, bind => bind.bindChannel(...)).`
+      );
     }
-    const channelHandles = /* @__PURE__ */ new Map();
-    for (const channel of this.iface.channels.values()) {
-      const renamed = transitionRemap.get(channel.transition.name);
-      if (renamed === void 0) {
+    const body = def.body;
+    const hostTransitionNames = /* @__PURE__ */ new Set();
+    for (const t of this._transitions) hostTransitionNames.add(t.name);
+    for (const t of body.transitions) {
+      if (hostTransitionNames.has(t.name)) {
         throw new Error(
-          `Channel '${channel.name}' references transition '${channel.transition.name}' that was not found in the renamed body. This indicates a SubnetDef invariant violation.`
+          `compose(SubnetDef): transition '${t.name}' from subnet '${def.name}' collides with a transition already in net '${this._name}'. Direct composition merges by name; for independent copies use def.instantiate(prefix) + compose(instance).`
         );
       }
-      channelHandles.set(channel.name, renamed);
     }
-    return __createInstance(
-      prefix,
-      this,
-      renamedBody,
-      portHandles,
-      channelHandles,
-      params
-    );
+    const hostByName = /* @__PURE__ */ new Map();
+    for (const p of this._places) hostByName.set(p.name, p);
+    const subnetName = def.name.replace(/\//g, "_");
+    const mergeMap = /* @__PURE__ */ new Map();
+    for (const p of body.places) {
+      const host = hostByName.get(p.name);
+      this.place(host ?? p);
+      if (host !== void 0) mergeMap.set(p.name, host);
+      this.recordContribution(p.name, subnetName);
+    }
+    for (const t of body.transitions) {
+      this.transition(substitutePlaces(t, mergeMap));
+      this.recordContribution(t.name, subnetName);
+    }
+    return this;
+  }
+  /** @internal MOD-026: records a node as contributed by the named subnet. */
+  recordContribution(nodeName, subnetName) {
+    let owners = this._subnetContributions.get(nodeName);
+    if (owners === void 0) {
+      owners = /* @__PURE__ */ new Set();
+      this._subnetContributions.set(nodeName, owners);
+    }
+    owners.add(subnetName);
   }
   /**
-   * Verifies safety properties of this subnet definition **in isolation** per
-   * **MOD-051**, by wrapping it in a synthetic enclosing net where each input
-   * port is fed by an {@link EnvironmentPlace} (token-source per the harness
-   * generator) and each output port is observed via a synthetic place. The
-   * standard {@link SmtVerifier} (per [MOD-050]) is invoked once per property
-   * declared in the harness; the resulting per-property outcomes are
-   * aggregated into a {@link VerificationResult}.
-   *
-   * ## Synthetic-net construction
-   *
-   * The synthetic enclosing net is built by:
-   * 1. Instantiating this `SubnetDef` with the prefix `"sut"` (system-under-test)
-   *    and `harness.params`.
-   * 2. For each input or in-out port on the interface, looking up the
-   *    harness generator by port name, allocating a synthetic
-   *    {@link Place}`<unknown>` of the same conceptual token type as the
-   *    port, wrapping it in an {@link EnvironmentPlace}, and binding the
-   *    port to that synthetic place via
-   *    {@link import('./petri-net.js').PetriNetBuilder.compose}. The supplier
-   *    is invoked once at construction time to materialize the seed token —
-   *    its presence is what bounds the input behavior under analysis. **If
-   *    the harness map is missing a generator for a required input or in-out
-   *    port, an `Error` is thrown.**
-   * 3. For each output or in-out port, allocating a synthetic observation
-   *    {@link Place}`<unknown>` and binding the port to it via the same
-   *    `compose(...)` call. The verifier inspects this place's reachability
-   *    / marking through the standard property APIs ({@link SmtProperty}).
-   * 4. Building the resulting flat {@link PetriNet} per [MOD-023] (the
-   *    verifier is composition-unaware per [MOD-050]).
+   * Identity-default auto-compose per **MOD-024**.
    *
-   * ## Per-property invocation
+   * Each declared interface port auto-binds to its own `port.place` — the
+   * Place the SubnetDef builder declared via `.inputPort(name, hostPlace)`
+   * (or `outputPort` / `inoutPort`). If the host builder already declares
+   * the equal place, the two merge; if not, the place arrives implicitly
+   * via the rewritten transitions' arcs (same flow as explicit `bindPort`).
    *
-   * Each {@link SmtProperty} in the harness is verified independently against
-   * the same synthetic net. The synthetic environment places are passed
-   * through to the verifier so that places driven by the harness generators
-   * are treated under the verifier's environment-analysis semantics rather
-   * than as ordinary sink places.
+   * If the subnet declares no interface ports at all, body places are
+   * checked against this builder's place set **by name** (matching the
+   * existing TS Place equality semantics; see [CORE-002] note in
+   * `spec/11-modular-composition.md` MOD-024). Body places that don't match
+   * stay private under their prefixed names per [MOD-010].
    *
-   * @param harness the verification harness — supplies parameters, input-port
-   *                token generators, and the property set
-   * @returns a {@link VerificationResult} aggregating per-property
-   *          {@link SmtVerificationResult}s
-   * @throws when an input or in-out port is missing a harness generator
+   * Channels are NOT auto-bound — transition identity is too delicate for
+   * inference. If the subnet declares any channel, this overload throws.
    */
-  async verify(harness) {
-    if (harness === null || harness === void 0) {
-      throw new Error("SubnetDef.verify: harness must not be null/undefined");
+  composeAuto(instance) {
+    const iface = instance.def.iface;
+    if (iface.channels.size > 0) {
+      const channelNames = [];
+      for (const c of iface.channels.values()) channelNames.push(c.name);
+      channelNames.sort();
+      throw new Error(
+        `compose(Instance): subnet '${instance.def.name}' (instance prefix '${instance.prefix}') declares channels [${channelNames.join(", ")}]; auto-compose does not bind channels. Use compose(instance, bind => bind.bindChannel(...)) with explicit channel bindings.`
+      );
     }
-    const sut = this.instantiate("sut", harness.params);
-    const generators = normaliseGenerators(harness.portInputGenerators);
-    const properties = normaliseProperties(harness.properties);
-    const envPlaces = [];
-    const portMappings = /* @__PURE__ */ new Map();
-    for (const port of this.iface.ports.values()) {
-      const portName = port.name;
-      switch (port.direction) {
-        case "input": {
-          const generator = generators.get(portName);
-          if (generator === void 0) {
-            throw new Error(
-              `verify: harness is missing an input generator for port '${portName}' on subnet '${this.name}' (MOD-051)`
-            );
-          }
-          const seed = generator();
-          if (seed === null || seed === void 0) {
-            throw new Error(
-              `verify: input generator for port '${portName}' on subnet '${this.name}' produced null/undefined`
-            );
-          }
-          const synth = place(`harness_in_${portName}`);
-          envPlaces.push(environmentPlace(synth.name));
-          portMappings.set(portName, synth);
-          break;
-        }
-        case "output": {
-          const synth = place(`harness_out_${portName}`);
-          portMappings.set(portName, synth);
-          break;
-        }
-        case "inout": {
-          const generator = generators.get(portName);
-          if (generator === void 0) {
-            throw new Error(
-              `verify: harness is missing an input generator for in-out port '${portName}' on subnet '${this.name}' (MOD-051)`
-            );
-          }
-          const seed = generator();
-          if (seed === null || seed === void 0) {
-            throw new Error(
-              `verify: input generator for in-out port '${portName}' on subnet '${this.name}' produced null/undefined`
-            );
-          }
-          const synth = place(`harness_io_${portName}`);
-          envPlaces.push(environmentPlace(synth.name));
-          portMappings.set(portName, synth);
-          break;
-        }
+    const hostByName = /* @__PURE__ */ new Map();
+    for (const p of this._places) hostByName.set(p.name, p);
+    if (iface.ports.size > 0) {
+      const portMappings = /* @__PURE__ */ new Map();
+      for (const port of iface.ports.values()) {
+        const hostMatch = hostByName.get(port.place.name);
+        portMappings.set(port.name, hostMatch ?? port.place);
       }
+      return this.composeInternal(instance, portMappings, /* @__PURE__ */ new Map());
     }
-    const syntheticNet = PetriNet.builder("verify_" + this.name).compose(sut, portMappings).build();
-    const perProperty = /* @__PURE__ */ new Map();
-    for (const property of properties) {
-      const verifier = SmtVerifier.forNet(syntheticNet).property(property);
-      if (envPlaces.length > 0) {
-        verifier.environmentPlaces(...envPlaces);
+    const mergeMap = /* @__PURE__ */ new Map();
+    const prefix = instance.prefix + "/";
+    for (const renamed of instance.renamedBody.places) {
+      if (!renamed.name.startsWith(prefix)) continue;
+      const originalName = renamed.name.substring(prefix.length);
+      const hostMatch = hostByName.get(originalName);
+      if (hostMatch !== void 0) {
+        mergeMap.set(renamed.name, hostMatch);
       }
-      const result = await verifier.verify();
-      perProperty.set(property, result);
     }
-    return buildVerificationResult(syntheticNet, perProperty);
-  }
-  // ============================================================
-  //  Static factories
-  // ============================================================
-  static builder(name) {
-    return new SubnetDefBuilder(name);
+    return this.applyComposition(instance, mergeMap, /* @__PURE__ */ new Map());
   }
   /**
-   * Retrofit utility per **MOD-014**: wraps an existing closed {@link PetriNet}
-   * plus an {@link Interface} into an unparameterised `SubnetDef<void>`.
+   * @internal Shared compose implementation: validates port and channel
+   * bindings, builds the place-substitution map, walks every renamed-body
+   * transition through {@link substitutePlaces}, applies channel merges per
+   * [MOD-021], and adds the resulting transitions to this builder.
    *
-   * Validation per **MOD-014** / **MOD-006** is enforced before the result is
-   * constructed:
-   * - Every port's underlying `Place` must be present in `net.places`.
-   * - Every channel's underlying `Transition` must be present in `net.transitions`.
-   * - Port and channel name uniqueness is re-validated defensively (the
-   *   `Interface` builder already enforces this; hand-built `Interface`
-   *   values bypass that path).
+   * ## Channel-merge flow ([MOD-021])
    *
-   * The resulting subnet definition is unparameterised (parameter type is `void`).
+   * 1. Collect rewritten instance transitions into a working `Map<string,
+   *    Transition>` keyed by prefixed transition name (deferred — not yet
+   *    added to the builder's transition set).
+   * 2. For each channel binding, resolve the renamed instance-side
+   *    transition through `instance.channel(channelName)`, then look up its
+   *    rewritten counterpart in the working map by name.
+   * 3. Replace the working-map entry with a {@link mergeTransitions} result
+   *    that fuses caller-side + instance-side; remove the rewritten
+   *    instance-side entry. Also replace (or add) the caller-side
+   *    transition in this builder's transition set with the same merged
+   *    result, indexed under the caller's name slot.
+   * 4. Add the surviving (un-merged) entries to this builder.
    *
-   * @throws when a port place is not in `net.places`, a channel transition is
-   *         not in `net.transitions`, or port/channel names are not unique.
+   * The deferral matters: writing the rewritten instance transitions to the
+   * builder eagerly would force a second "remove-then-replace" pass to
+   * apply the channel merges, complicating the place-collection invariants.
+   * Collecting first and merging second keeps the builder's transition set
+   * finalized exactly once.
+   *
+   * Keying the working map by prefixed transition name (rather than by
+   * Transition reference) is also robust against a prior
+   * {@link Instance.bindActions} call that may have rebuilt the renamed-body
+   * transitions, breaking identity equality between the body and the
+   * channel-handle map — but the prefixed names remain stable.
    */
-  static fromNet(net, iface) {
-    const bodyPlaces = net.places;
-    const bodyTransitions = net.transitions;
-    const seenPortNames = /* @__PURE__ */ new Set();
-    for (const port of iface.ports.values()) {
-      if (seenPortNames.has(port.name)) {
-        throw new Error(
-          `fromNet: duplicate port name '${port.name}' on interface for net '${net.name}' (MOD-006)`
-        );
-      }
-      seenPortNames.add(port.name);
-      if (!bodyPlaces.has(port.place)) {
+  composeInternal(instance, portMappings, channelBindings) {
+    const iface = instance.def.iface;
+    const mergeMap = /* @__PURE__ */ new Map();
+    for (const [portName, callerPlace] of portMappings) {
+      const port = iface.port(portName);
+      if (port === void 0) {
+        const knownPorts = [];
+        for (const p of iface.ports.values()) knownPorts.push(p.name);
         throw new Error(
-          `fromNet: port '${port.name}' references place '${port.place.name}' which is not in net '${net.name}' (MOD-014/MOD-006)`
+          `compose: no port named '${portName}' on subnet '${instance.def.name}' (instance prefix '${instance.prefix}'). Known ports: [${knownPorts.join(", ")}]`
         );
       }
+      const ifacePlace = instance.port(portName);
+      mergeMap.set(ifacePlace.name, callerPlace);
     }
-    const seenChannelNames = /* @__PURE__ */ new Set();
-    for (const channel of iface.channels.values()) {
-      if (seenChannelNames.has(channel.name)) {
-        throw new Error(
-          `fromNet: duplicate channel name '${channel.name}' on interface for net '${net.name}' (MOD-006)`
+    return this.applyComposition(instance, mergeMap, channelBindings);
+  }
+  /**
+   * Shared post-mergeMap pipeline: rewrites renamed-body transitions
+   * through `mergeMap`, applies channel merges per **MOD-021**, and adds
+   * the surviving transitions to the builder.
+   *
+   * Used by both the explicit-binding path (`composeInternal`) and the
+   * auto-compose path (`composeAuto` per **MOD-024**). The two paths differ
+   * only in how the (renamed Place name → host Place) `mergeMap` is built.
+   */
+  applyComposition(instance, mergeMap, channelBindings) {
+    const iface = instance.def.iface;
+    const rewrittenByName = /* @__PURE__ */ new Map();
+    for (const t of instance.renamedBody.transitions) {
+      rewrittenByName.set(t.name, substitutePlaces(t, mergeMap));
+    }
+    for (const [channelName, callerTrans] of channelBindings) {
+      let instanceRenamedChannel;
+      try {
+        instanceRenamedChannel = instance.channel(channelName);
+      } catch (cause) {
+        const knownChannels = [];
+        for (const c of iface.channels.values()) knownChannels.push(c.name);
+        const err = new Error(
+          `compose: no channel named '${channelName}' on subnet '${instance.def.name}' (instance prefix '${instance.prefix}'). Known channels: [${knownChannels.join(", ")}]`
         );
+        err.cause = cause;
+        throw err;
       }
-      seenChannelNames.add(channel.name);
-      if (!bodyTransitions.has(channel.transition)) {
+      const rewrittenInstanceChannel = rewrittenByName.get(instanceRenamedChannel.name);
+      if (rewrittenInstanceChannel === void 0) {
         throw new Error(
-          `fromNet: channel '${channel.name}' references transition '${channel.transition.name}' which is not in net '${net.name}' (MOD-014/MOD-006)`
+          `compose: channel '${channelName}' resolved to a transition '${instanceRenamedChannel.name}' that is not present in the renamed body. This indicates a SubnetDef invariant violation.`
         );
       }
+      const merged = mergeTransitions(callerTrans, rewrittenInstanceChannel, callerTrans.name);
+      rewrittenByName.delete(instanceRenamedChannel.name);
+      this._transitions.delete(callerTrans);
+      this.transition(merged);
+    }
+    for (const rewritten of rewrittenByName.values()) {
+      this.transition(rewritten);
     }
-    return new _SubnetDef(SUBNET_DEF_KEY, net.name, net, iface);
-  }
-};
-var SubnetDefBuilder = class {
-  _name;
-  _bodyBuilder;
-  _ports = [];
-  _channels = [];
-  constructor(name) {
-    this._name = name;
-    this._bodyBuilder = PetriNet.builder(name);
-  }
-  // -------- body construction (delegates to PetriNet.Builder) --------
-  transition(transition) {
-    this._bodyBuilder.transition(transition);
-    return this;
-  }
-  transitions(...transitions) {
-    this._bodyBuilder.transitions(...transitions);
-    return this;
-  }
-  place(place2) {
-    this._bodyBuilder.place(place2);
-    return this;
-  }
-  // -------- interface declarations --------
-  inputPort(name, place2) {
-    this._ports.push({ name, direction: "input", place: place2 });
     return this;
   }
-  outputPort(name, place2) {
-    this._ports.push({ name, direction: "output", place: place2 });
+  fuse(...args) {
+    if (args.length === 1 && typeof args[0] === "function") {
+      const declarer = args[0];
+      const fb = FusionSet.builder(this._name + "-fusion");
+      declarer(fb);
+      this._fusionSets.push(fb.build());
+      return this;
+    }
+    for (const s of args) {
+      if (s === void 0 || s === null) {
+        throw new Error("fuse: fusion set must not be null");
+      }
+      this._fusionSets.push(s);
+    }
     return this;
   }
-  inoutPort(name, place2) {
-    this._ports.push({ name, direction: "inout", place: place2 });
-    return this;
+  /**
+   * Builds the immutable {@link PetriNet}, applying fusion resolution (per
+   * **MOD-061**) AFTER all transition/composition accumulation:
+   *
+   * 1. Detect overlapping fusion sets — a single place declared in two sets
+   *    is rejected with an `Error`.
+   * 2. Build the `non-canonical → canonical` substitution map across all
+   *    sets, keyed by non-canonical place name (matching the rewriter's
+   *    Map<string, Place<unknown>> convention — TypeScript Place identity is
+   *    name-based per `runtime/compiled-net.ts`).
+   * 3. Walk every transition through {@link applyFusion} to rewrite arc place
+   *    references.
+   * 4. Re-derive the place set from the rewritten transitions plus any
+   *    caller-declared standalone places, dropping non-canonical members.
+   *    Caller-declared standalone places that happen to be non-canonical
+   *    members are also dropped.
+   *
+   * If no fusion sets were registered, the build is the trivial
+   * `new PetriNet(...)` — the fusion machinery has no per-build cost when
+   * unused.
+   *
+   * @throws when two fusion sets share a place
+   */
+  build() {
+    const membership = this.resolveSubnetMembership();
+    if (this._fusionSets.length === 0) {
+      return new PetriNet(
+        PETRI_NET_KEY,
+        this._name,
+        this._places,
+        this._transitions,
+        membership
+      );
+    }
+    return this.buildWithFusion(membership);
   }
-  channel(name, transition) {
-    this._channels.push({ name, transition });
-    return this;
+  /**
+   * @internal Resolves the per-compose contributions recorded by
+   * `composeDirect` into the final node-name → subnet-name membership map per
+   * **MOD-026**. A node contributed by exactly one subnet maps to that subnet;
+   * a place contributed by two or more subnets is a shared rendezvous place
+   * and is omitted (it renders top-level, outside any cluster). Returns an
+   * empty map — the common case — when no subnet was composed directly.
+   */
+  resolveSubnetMembership() {
+    const resolved = /* @__PURE__ */ new Map();
+    for (const [nodeName, owners] of this._subnetContributions) {
+      if (owners.size === 1) {
+        resolved.set(nodeName, owners.values().next().value);
+      }
+    }
+    return resolved;
   }
-  // -------- build & validate (MOD-006) --------
-  build() {
-    const built = this._bodyBuilder.build();
-    const bodyPlaces = built.places;
-    const bodyTransitions = built.transitions;
-    const portNames = /* @__PURE__ */ new Set();
-    for (const port of this._ports) {
-      if (portNames.has(port.name)) {
-        throw new Error(`Subnet '${this._name}': duplicate port name '${port.name}'`);
+  /**
+   * @internal Drops membership entries for places removed by fusion: a
+   * non-canonical fused member no longer exists in the net, so its
+   * `node-name → subnet` entry would dangle. The surviving canonical place
+   * keeps its own entry. Per **MOD-026**.
+   */
+  static filterFusedMembership(membership, nonCanonicalNames) {
+    if (membership.size === 0 || nonCanonicalNames.size === 0) {
+      return membership;
+    }
+    const filtered = /* @__PURE__ */ new Map();
+    for (const [key, value] of membership) {
+      if (!nonCanonicalNames.has(key)) {
+        filtered.set(key, value);
       }
-      portNames.add(port.name);
-      if (!bodyPlaces.has(port.place)) {
-        throw new Error(
-          `Subnet '${this._name}': port '${port.name}' references place '${port.place.name}' which is not in the body`
-        );
+    }
+    return filtered;
+  }
+  /**
+   * @internal Fusion-resolution pass per **MOD-061**. Split out from
+   * {@link build} so the no-fusion fast path stays trivial.
+   */
+  buildWithFusion(membership) {
+    const ownership = /* @__PURE__ */ new Map();
+    for (const set of this._fusionSets) {
+      for (const member of set.members) {
+        const prior = ownership.get(member.name);
+        if (prior !== void 0 && prior !== set) {
+          throw new Error(
+            `Fusion overlap: place '${member.name}' appears in two fusion sets ('${prior.name}' and '${set.name}'). A place may appear in at most one fusion set (MOD-060).`
+          );
+        }
+        ownership.set(member.name, set);
       }
     }
-    const channelNames = /* @__PURE__ */ new Set();
-    for (const channel of this._channels) {
-      if (channelNames.has(channel.name)) {
-        throw new Error(`Subnet '${this._name}': duplicate channel name '${channel.name}'`);
+    const fusionMap = /* @__PURE__ */ new Map();
+    const nonCanonicalNames = /* @__PURE__ */ new Set();
+    for (const set of this._fusionSets) {
+      const canonical = set.canonical;
+      for (const nc of set.nonCanonical()) {
+        fusionMap.set(nc.name, canonical);
+        nonCanonicalNames.add(nc.name);
       }
-      channelNames.add(channel.name);
-      if (!bodyTransitions.has(channel.transition)) {
-        throw new Error(
-          `Subnet '${this._name}': channel '${channel.name}' references transition '${channel.transition.name}' which is not in the body`
-        );
+    }
+    const rewrittenTransitions = applyFusion(this._transitions, fusionMap);
+    const rebuiltPlaces = /* @__PURE__ */ new Set();
+    for (const p of this._places) {
+      if (!nonCanonicalNames.has(p.name)) {
+        rebuiltPlaces.add(p);
       }
     }
-    const ifaceBuilder = Interface.builder();
-    ifaceBuilder.portsAll(this._ports);
-    ifaceBuilder.channelsAll(this._channels);
-    const iface = ifaceBuilder.build();
-    return new SubnetDef(SUBNET_DEF_KEY, this._name, built, iface);
+    for (const t of rewrittenTransitions) {
+      for (const spec of t.inputSpecs) rebuiltPlaces.add(spec.place);
+      for (const p of t.outputPlaces()) rebuiltPlaces.add(p);
+      for (const inh of t.inhibitors) rebuiltPlaces.add(inh.place);
+      for (const r of t.reads) rebuiltPlaces.add(r.place);
+      for (const r of t.resets) rebuiltPlaces.add(r.place);
+    }
+    return new PetriNet(
+      PETRI_NET_KEY,
+      this._name,
+      rebuiltPlaces,
+      rewrittenTransitions,
+      _PetriNetBuilder.filterFusedMembership(membership, nonCanonicalNames)
+    );
   }
 };
-function validatePrefix(prefix) {
-  if (typeof prefix !== "string" || prefix.length === 0) {
-    throw new Error("SubnetDef.instantiate: prefix must be a non-empty string");
+function rebuildWithAction(t, action) {
+  const builder = Transition.builder(t.name).timing(t.timing).priority(t.priority).action(action);
+  if (t.inputSpecs.length > 0) {
+    builder.inputs(...t.inputSpecs);
   }
-  if (prefix.indexOf("/") >= 0) {
-    throw new Error(
-      `SubnetDef.instantiate: prefix must not contain '/' (reserved as the prefix separator per MOD-010); use compose(...) for nested instantiation. Got: '${prefix}'`
-    );
+  if (t.outputSpec !== null) {
+    builder.outputs(t.outputSpec);
+  }
+  for (const inh of t.inhibitors) {
+    builder.inhibitor(inh.place);
+  }
+  for (const r of t.reads) {
+    builder.read(r.place);
   }
+  for (const r of t.resets) {
+    builder.reset(r.place);
+  }
+  return builder.build();
+}
+
+// src/core/subnet.ts
+function closedSubnet(net) {
+  return { kind: "closed", net };
+}
+function openSubnet(def) {
+  return { kind: "open", def };
 }
 
 // src/runtime/marking.ts