libpetri 3.0.0 → 4.0.0

package/dist/{chunk-5W6SVYPD.js → chunk-WYCGGQAW.js}

@@ -409,7 +409,7 @@ function flatten(net, environmentPlaces = /* @__PURE__ */ new Set(), environment
     for (const arc of t.reads) allPlacesSet.set(arc.place.name, arc.place);
     for (const arc of t.resets) allPlacesSet.set(arc.place.name, arc.place);
   }
-  const places = [...allPlacesSet.values()].sort((a, b) => a.name.localeCompare(b.name));
+  const places = [...allPlacesSet.values()].sort((a, b) => compareCodePoints(a.name, b.name));
   const placeIndex = /* @__PURE__ */ new Map();
   for (let i = 0; i < places.length; i++) {
     placeIndex.set(places[i].name, i);
@@ -497,6 +497,20 @@ function enumerateOutputBranches(t) {
   }
   return [/* @__PURE__ */ new Set()];
 }
+function compareCodePoints(a, b) {
+  const ia = a[Symbol.iterator]();
+  const ib = b[Symbol.iterator]();
+  for (; ; ) {
+    const na = ia.next();
+    const nb = ib.next();
+    if (na.done && nb.done) return 0;
+    if (na.done) return -1;
+    if (nb.done) return 1;
+    const ca = na.value.codePointAt(0);
+    const cb = nb.value.codePointAt(0);
+    if (ca !== cb) return ca - cb;
+  }
+}
 
 // src/verification/encoding/incidence-matrix.ts
 var IncidenceMatrix = class _IncidenceMatrix {
@@ -661,42 +675,21 @@ function computePInvariants(matrix, flatNet, initialMarking) {
       }
     }
     if (!isZero) continue;
+    if (!rowIsExact(augmented[row], T, P)) {
+      invariants.push(rawInvariant(augmented[row], T, P, flatNet, initialMarking));
+      continue;
+    }
     const weights = new Array(P);
-    let allNonNegative = true;
     let hasPositive = false;
+    let hasNegative = false;
     for (let i = 0; i < P; i++) {
       weights[i] = augmented[row][T + i];
-      if (weights[i] < 0) {
-        allNonNegative = false;
-        break;
-      }
       if (weights[i] > 0) hasPositive = true;
+      if (weights[i] < 0) hasNegative = true;
     }
-    if (!allNonNegative) {
-      let allNonPositive = true;
-      for (let i = 0; i < P; i++) {
-        if (augmented[row][T + i] > 0) {
-          allNonPositive = false;
-          break;
-        }
-      }
-      if (allNonPositive) {
-        for (let i = 0; i < P; i++) {
-          weights[i] = -augmented[row][T + i];
-        }
-        hasPositive = true;
-        allNonNegative = true;
-      }
-    }
-    if (!allNonNegative || !hasPositive) continue;
-    let g = 0;
-    for (const w of weights) {
-      if (w > 0) g = gcd(g, w);
-    }
-    if (g > 1) {
-      for (let i = 0; i < P; i++) {
-        weights[i] = weights[i] / g;
-      }
+    if (!hasPositive && !hasNegative) continue;
+    if (!hasPositive) {
+      for (let i = 0; i < P; i++) weights[i] = -weights[i];
     }
     const support = /* @__PURE__ */ new Set();
     let constant = 0;
@@ -711,6 +704,123 @@ function computePInvariants(matrix, flatNet, initialMarking) {
   }
   return invariants;
 }
+function rowIsExact(row, T, P) {
+  for (let i = 0; i < P; i++) {
+    if (!Number.isSafeInteger(row[T + i])) return false;
+  }
+  return true;
+}
+function rawInvariant(row, T, P, flatNet, initialMarking) {
+  const weights = new Array(P);
+  const support = /* @__PURE__ */ new Set();
+  let constant = 0;
+  for (let i = 0; i < P; i++) {
+    weights[i] = row[T + i];
+    if (weights[i] !== 0) {
+      support.add(i);
+      constant += weights[i] * initialMarking.tokens(flatNet.places[i]);
+    }
+  }
+  return pInvariant(weights, constant, support);
+}
+function validateInvariantsExact(matrix, invariants, flatNet, initialMarking) {
+  const nonlinear = nonlinearPlaces(flatNet);
+  const valid = [];
+  const dropped = [];
+  for (const inv of invariants) {
+    const reason = exactCheckFailure(matrix, inv, nonlinear, flatNet, initialMarking);
+    if (reason === null) {
+      valid.push(inv);
+    } else {
+      dropped.push({ invariant: inv, reason });
+    }
+  }
+  return { valid, dropped };
+}
+function nonlinearPlaces(flatNet) {
+  const nonlinear = /* @__PURE__ */ new Set();
+  for (const ft of flatNet.transitions) {
+    for (let p = 0; p < ft.consumeAll.length; p++) {
+      if (ft.consumeAll[p]) nonlinear.add(p);
+    }
+    for (const p of ft.resetPlaces) nonlinear.add(p);
+  }
+  return nonlinear;
+}
+function exactCheckFailure(matrix, inv, nonlinear, flatNet, initialMarking) {
+  const P = matrix.numPlaces();
+  const T = matrix.numTransitions();
+  if (inv.weights.length !== P) {
+    return `weight vector has ${inv.weights.length} entries, expected ${P}`;
+  }
+  for (let p = 0; p < P; p++) {
+    if (!Number.isSafeInteger(inv.weights[p])) {
+      return `weight overflow at place '${placeName(flatNet, p)}' (exact value outside this implementation's integer extraction range)`;
+    }
+  }
+  if (!Number.isSafeInteger(inv.constant)) {
+    return `constant ${inv.constant} is outside the safe-integer range`;
+  }
+  for (let p = 0; p < inv.weights.length; p++) {
+    if (inv.weights[p] !== 0 && nonlinear.has(p)) {
+      return `support intersects consume-all/reset place '${placeName(flatNet, p)}' (non-linear consumption; see Strengthening.lean H1)`;
+    }
+  }
+  const y = inv.weights.map((w) => BigInt(w));
+  const incidence = matrix.incidence();
+  for (let t = 0; t < T; t++) {
+    const row = incidence[t];
+    let dot = 0n;
+    for (let p = 0; p < P; p++) {
+      if (y[p] === 0n) continue;
+      if (!Number.isSafeInteger(row[p])) {
+        return `incidence entry ${row[p]} at [t=${t}][p=${p}] is outside the safe-integer range`;
+      }
+      dot += y[p] * BigInt(row[p]);
+    }
+    if (dot !== 0n) {
+      return `y*C is ${dot} (not 0) at ${columnName(flatNet, t)}`;
+    }
+  }
+  let exact = 0n;
+  for (let p = 0; p < P; p++) {
+    if (y[p] === 0n) continue;
+    const tokens = initialMarking.tokens(flatNet.places[p]);
+    if (!Number.isSafeInteger(tokens)) {
+      return `initial marking of place ${p} (${tokens}) is outside the safe-integer range`;
+    }
+    exact += y[p] * BigInt(tokens);
+  }
+  if (exact !== BigInt(inv.constant)) {
+    return `constant ${inv.constant} does not match exact y*M0 = ${exact}`;
+  }
+  return null;
+}
+function placeName(flatNet, p) {
+  return flatNet.places[p]?.name ?? `#${p}`;
+}
+function columnName(flatNet, t) {
+  const ft = flatNet.transitions[t];
+  return ft != null ? `transition '${ft.name}'` : `env-injector column ${t - flatNet.transitions.length}`;
+}
+function sameInvariant(a, b) {
+  if (a.constant !== b.constant || a.weights.length !== b.weights.length) return false;
+  for (let i = 0; i < a.weights.length; i++) {
+    if (a.weights[i] !== b.weights[i]) return false;
+  }
+  return true;
+}
+function strengthenWithSemiflows(invariants, semiflows) {
+  const strengthened = [...invariants];
+  let added = 0;
+  for (const sf of semiflows) {
+    if (!strengthened.some((inv) => sameInvariant(inv, sf))) {
+      strengthened.push(sf);
+      added++;
+    }
+  }
+  return { invariants: strengthened, added };
+}
 function computePSemiflows(matrix, flatNet, initialMarking) {
   const np = matrix.numPlaces();
   const nt = matrix.numTransitions();
@@ -798,6 +908,7 @@ function keepSupportMinimal(rows) {
 function isCoveredByInvariants(invariants, numPlaces) {
   const covered = new Array(numPlaces).fill(false);
   for (const inv of invariants) {
+    if (inv.weights.some((w) => w < 0)) continue;
     for (const idx of inv.support) {
       if (idx < numPlaces) covered[idx] = true;
     }
@@ -825,6 +936,19 @@ function gcd(a, b) {
   }
   return a;
 }
+function canonicalInvariantOrder(invariants) {
+  const lex = (a, b) => {
+    const n = Math.min(a.length, b.length);
+    for (let i = 0; i < n; i++) {
+      if (a[i] !== b[i]) return a[i] - b[i];
+    }
+    return a.length - b.length;
+  };
+  const support = (inv) => [...inv.support].sort((x, y) => x - y);
+  return [...invariants].sort(
+    (a, b) => lex(support(a), support(b)) || lex(a.weights, b.weights) || a.constant - b.constant
+  );
+}
 
 // src/verification/invariant/structural-check.ts
 var MAX_PLACES_FOR_SIPHON_ANALYSIS = 50;
@@ -987,315 +1111,675 @@ function isSubsetOf(sub, sup) {
   return true;
 }
 
-// src/verification/z3/spacer-runner.ts
-import { init } from "z3-solver";
-async function createSpacerRunner(timeoutMs) {
-  const { Context } = await init();
-  const ctx = new Context("main");
-  const fp = new ctx.Fixedpoint();
-  fp.set("engine", "spacer");
-  if (timeoutMs > 0) {
-    fp.set("timeout", Math.min(timeoutMs, 2147483647));
-  }
-  async function query(errorExpr, reachableDecl) {
-    try {
-      const status = await fp.query(errorExpr);
-      if (status === "unsat") {
-        let invariantFormula = null;
-        const levelInvariants = [];
-        try {
-          const answer = fp.getAnswer();
-          if (answer != null) {
-            invariantFormula = answer.toString();
-          }
-        } catch {
-        }
-        if (reachableDecl != null) {
-          try {
-            const levels = fp.getNumLevels(reachableDecl);
-            for (let i = 0; i < levels; i++) {
-              const cover = fp.getCoverDelta(i, reachableDecl);
-              if (cover != null && !ctx.isTrue(cover)) {
-                levelInvariants.push(`Level ${i}: ${cover.toString()}`);
-              }
-            }
-          } catch {
-          }
-        }
-        return { type: "proven", invariantFormula, levelInvariants };
-      }
-      if (status === "sat") {
-        let answer = null;
-        try {
-          answer = fp.getAnswer();
-        } catch {
-        }
-        return { type: "violated", answer };
-      }
-      return { type: "unknown", reason: fp.getReasonUnknown() };
-    } catch (e) {
-      return { type: "unknown", reason: `Z3 exception: ${e.message ?? e}` };
-    }
+// src/verification/z3/z3-process.ts
+import { spawn, spawnSync } from "child_process";
+import { existsSync, mkdirSync, statSync, writeFileSync } from "fs";
+import * as path from "path";
+
+// src/verification/z3/smt-text.ts
+function classifyFirstLine(stdout) {
+  for (const raw of stdout.split("\n")) {
+    const line = raw.trim();
+    if (line === "sat" || line === "unsat" || line === "unknown") return line;
+  }
+  return null;
+}
+function timeoutLine(stdout) {
+  return stdout.split("\n").some((l) => l.trim() === "timeout");
+}
+function errorLine(text) {
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (line.startsWith("(error")) return line;
+  }
+  return null;
+}
+function sexprEnd(s, start) {
+  let depth = 0;
+  let inString = false;
+  let inSymbol = false;
+  for (let i = start; i < s.length; i++) {
+    const c = s[i];
+    if (inString) {
+      if (c === '"') inString = false;
+    } else if (inSymbol) {
+      if (c === "|") inSymbol = false;
+    } else if (c === '"') {
+      inString = true;
+    } else if (c === "|") {
+      inSymbol = true;
+    } else if (c === "(") {
+      depth++;
+    } else if (c === ")") {
+      depth--;
+      if (depth === 0) return i + 1;
+    }
+  }
+  return -1;
+}
+function extractDefineFuns(output) {
+  const defs = [];
+  let from = 0;
+  for (; ; ) {
+    const pos = output.indexOf("(define-fun", from);
+    if (pos < 0) break;
+    const end = sexprEnd(output, pos);
+    if (end < 0) break;
+    defs.push(output.slice(pos, end));
+    from = end;
+  }
+  return defs;
+}
+function extractInvariant(output) {
+  const defs = extractDefineFuns(output);
+  return defs.length === 0 ? null : defs.join("\n");
+}
+
+// src/verification/z3/z3-process.ts
+var Z3_ENV = "LIBPETRI_Z3";
+var DUMP_ENV = "LIBPETRI_SMT_DUMP";
+var GRACE_MS = 1e3;
+var VERSION_PROBE_MS = 5e3;
+var MIN_Z3_VERSION = { major: 4, minor: 8, patch: 0 };
+function parseZ3Version(text) {
+  const m = /Z3 version (\d+)\.(\d+)(?:\.(\d+))?/.exec(text);
+  if (m == null) return null;
+  return { major: Number(m[1]), minor: Number(m[2]), patch: m[3] == null ? 0 : Number(m[3]) };
+}
+function formatZ3Version(v) {
+  return `${v.major}.${v.minor}.${v.patch}`;
+}
+function compareZ3Version(a, b) {
+  return a.major - b.major || a.minor - b.minor || a.patch - b.patch;
+}
+var Z3Unavailable = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "Z3Unavailable";
   }
-  function dispose() {
+};
+var Z3ProcessError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "Z3ProcessError";
+  }
+};
+function replySucceeded(reply) {
+  return reply.exit.kind === "exited" && reply.exit.code === 0;
+}
+function argsFor(timeoutMs) {
+  return ["-smt2", "-in", `-t:${timeoutMs}`, `-T:${hardTimeoutSecs(timeoutMs)}`];
+}
+function hardTimeoutSecs(timeoutMs) {
+  return Math.max(1, Math.ceil((timeoutMs + GRACE_MS) / 1e3));
+}
+function watchdogMs(timeoutMs) {
+  return timeoutMs + 2 * GRACE_MS;
+}
+function timeoutBudget(timeoutMs) {
+  return Math.max(1, Math.floor(Number.isFinite(timeoutMs) ? timeoutMs : 1));
+}
+function failureReason(reply, timeoutMs) {
+  if (timeoutLine(reply.stdout)) {
+    return `z3 hard timeout after ${hardTimeoutSecs(timeoutMs)}s`;
+  }
+  if (reply.exit.kind === "killed") {
+    return `z3 did not exit within ${watchdogMs(timeoutMs)} ms and was killed`;
+  }
+  const err = errorLine(reply.stdout) ?? errorLine(reply.stderr);
+  if (err != null) return `Z3 error: ${err}`;
+  const stderr = reply.stderr.trim();
+  if (stderr !== "") return `Z3 error: ${stderr}`;
+  return `Unexpected Z3 output: ${reply.stdout.trim()}`;
+}
+function locateZ3(program, env = process.env) {
+  const isFile = (p) => {
     try {
-      fp.release();
+      return existsSync(p) && statSync(p).isFile();
     } catch {
+      return false;
     }
-  }
-  return {
-    ctx,
-    fp,
-    query,
-    dispose
   };
+  if (program.includes("/") || program.includes(path.sep) || path.isAbsolute(program)) {
+    return isFile(program) ? program : null;
+  }
+  const searchPath = env["PATH"] ?? "";
+  const windows = process.platform === "win32";
+  for (const dir of searchPath.split(path.delimiter)) {
+    if (dir === "") continue;
+    const candidate2 = path.join(dir, program);
+    if (isFile(candidate2)) return candidate2;
+    if (windows && isFile(candidate2 + ".exe")) return candidate2 + ".exe";
+  }
+  return null;
 }
-
-// src/verification/encoding/flat-net.ts
-function flatNetPlaceCount(net) {
-  return net.places.length;
+function z3SolverAt(program, env = process.env) {
+  const located = locateZ3(program, env);
+  if (located == null) {
+    throw new Z3Unavailable(
+      `z3 binary not found: ${program}; install z3 >= ${formatZ3Version(MIN_Z3_VERSION)} or set ${Z3_ENV}`
+    );
+  }
+  const probe = spawnSync(located, ["--version"], {
+    encoding: "utf8",
+    timeout: VERSION_PROBE_MS,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (probe.error != null) {
+    if (probe.error.code === "ETIMEDOUT") {
+      throw new Z3Unavailable(`${program} --version did not answer within ${VERSION_PROBE_MS} ms`);
+    }
+    throw new Z3Unavailable(`failed to spawn ${program}: ${probe.error.message}`);
+  }
+  const version = parseZ3Version(probe.stdout ?? "");
+  if (version == null) {
+    const line = `${probe.stdout ?? ""}
+${probe.stderr ?? ""}`.split("\n").map((l) => l.trim()).find((l) => l !== "") ?? "";
+    throw new Z3Unavailable(`z3 --version did not report a version: ${line}`);
+  }
+  if (compareZ3Version(version, MIN_Z3_VERSION) < 0) {
+    throw new Z3Unavailable(
+      `z3 ${formatZ3Version(version)} is older than the minimum ${formatZ3Version(MIN_Z3_VERSION)}`
+    );
+  }
+  return { program: located, version, dumpDir: null };
 }
-function flatNetTransitionCount(net) {
-  return net.transitions.length;
+function resolveZ3(env = process.env) {
+  const configured = env[Z3_ENV];
+  const program = configured == null || configured.trim() === "" ? "z3" : configured;
+  const dump = env[DUMP_ENV];
+  const solver = z3SolverAt(program, env);
+  return { ...solver, dumpDir: dump == null || dump.trim() === "" ? null : dump };
 }
-function flatNetIndexOf(net, place) {
-  return net.placeIndex.get(place.name) ?? -1;
+function z3Available(env = process.env) {
+  try {
+    resolveZ3(env);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var dumpCounter = 0;
+function dumpSlot(solver, phase, script2) {
+  if (solver.dumpDir == null) return null;
+  dumpCounter += 1;
+  try {
+    mkdirSync(solver.dumpDir, { recursive: true });
+    const base = path.join(solver.dumpDir, `${String(dumpCounter).padStart(3, "0")}-${phase}`);
+    writeFileSync(`${base}.smt2`, script2);
+    return base;
+  } catch {
+    return null;
+  }
+}
+function dumpWrite(file, text) {
+  try {
+    writeFileSync(file, text);
+  } catch {
+  }
+}
+function runZ3Text(solver, script2, phase, timeoutMs, extraArgs = []) {
+  const budget = timeoutBudget(timeoutMs);
+  const base = dumpSlot(solver, phase, script2);
+  return new Promise((resolve, reject) => {
+    const child = spawn(solver.program, [...argsFor(budget), ...extraArgs], {
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const out = [];
+    const err = [];
+    let killed = false;
+    let settled = false;
+    child.stdout.on("data", (chunk) => out.push(chunk));
+    child.stderr.on("data", (chunk) => err.push(chunk));
+    child.stdin.on("error", () => {
+    });
+    const watchdog = setTimeout(() => {
+      killed = true;
+      child.kill("SIGKILL");
+    }, watchdogMs(budget));
+    child.on("error", (e) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(watchdog);
+      reject(new Z3ProcessError(`failed to spawn ${solver.program}: ${e.message}`));
+    });
+    child.on("close", (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(watchdog);
+      const reply = {
+        stdout: Buffer.concat(out).toString("utf8"),
+        stderr: Buffer.concat(err).toString("utf8"),
+        exit: killed ? { kind: "killed" } : { kind: "exited", code }
+      };
+      if (base != null) {
+        dumpWrite(`${base}.out`, reply.stdout);
+        if (reply.stderr.trim() !== "") dumpWrite(`${base}.err`, reply.stderr);
+      }
+      resolve(reply);
+    });
+    child.stdin.end(script2);
+  });
+}
+
+// src/verification/z3/spacer-runner.ts
+async function runZ3Spacer(solver, timeoutMs, smt2, phase) {
+  let reply;
+  try {
+    reply = await runZ3Text(solver, smt2, phase, timeoutMs, ["fp.engine=spacer"]);
+  } catch (e) {
+    return { type: "unknown", reason: String(e?.message ?? e) };
+  }
+  const stdout = reply.stdout.trim();
+  switch (classifyFirstLine(stdout)) {
+    // unsat => no inductive invariant excludes the bad state => VIOLATED.
+    case "unsat":
+      return { type: "violated", answer: stdout };
+    // sat => an inductive invariant exists => PROVEN.
+    case "sat":
+      return { type: "proven", invariantFormula: extractInvariant(stdout) };
+    case "unknown":
+      return { type: "unknown", reason: "Z3 answered unknown" };
+    default:
+      return { type: "unknown", reason: failureReason(reply, timeoutBudget(timeoutMs)) };
+  }
 }
 
 // src/verification/z3/smt-encoder.ts
-function encode(ctx, fp, flatNet, initialMarking, property, invariants, sinkPlaces = /* @__PURE__ */ new Set()) {
+function encode(flatNet, initialMarking, property, invariants, sinkPlaces = /* @__PURE__ */ new Set(), produceProofs = false) {
   const P = flatNet.places.length;
-  const Int = ctx.Int;
-  const Bool_ = ctx.Bool;
-  const intSort = Int.sort();
-  const boolSort = Bool_.sort();
-  const markingSorts = new Array(P).fill(intSort);
-  const reachable = ctx.Function.declare("Reachable", ...markingSorts, boolSort);
-  fp.registerRelation(reachable);
-  const error = ctx.Function.declare("Error", boolSort);
-  fp.registerRelation(error);
-  const m0Args = [];
-  for (let i = 0; i < P; i++) {
-    const tokens = initialMarking.tokens(flatNet.places[i]);
-    m0Args.push(Int.val(tokens));
-  }
-  const initFact = reachable.call(...m0Args);
-  fp.addRule(initFact, "init");
-  for (let t = 0; t < flatNet.transitions.length; t++) {
-    const ft = flatNet.transitions[t];
-    encodeTransitionRule(ctx, fp, reachable, ft, flatNet, invariants, P);
-  }
+  const lines = [];
+  const envInject = resolveEnvInjection(flatNet);
+  if (produceProofs) lines.push("(set-option :produce-proofs true)");
+  lines.push("(set-logic HORN)");
+  lines.push("");
+  lines.push(`(declare-fun Reachable (${ints(P).join(" ")}) Bool)`);
+  lines.push("(declare-fun Error () Bool)");
+  lines.push("");
+  const mVars = vars(P, "");
+  const mpVars = vars(P, "p");
+  const m0 = [];
+  for (let i = 0; i < P; i++) m0.push(String(initialMarking.tokens(flatNet.places[i])));
+  lines.push(`(assert (Reachable ${m0.join(" ")}))`);
+  lines.push("");
+  for (const ft of flatNet.transitions) {
+    lines.push(encodeTransitionRule(flatNet, ft, mVars, mpVars, invariants));
+  }
+  for (const inj of envInject) {
+    lines.push(encodeInjectionRule(P, inj.pid, inj.bound, mVars, mpVars));
+  }
+  lines.push("");
+  lines.push(encodeErrorRule(flatNet, property, mVars, sinkPlaces, envInject));
+  lines.push("");
+  lines.push("(assert (not Error))");
+  lines.push("(check-sat)");
+  if (produceProofs) lines.push("(get-proof)");
+  lines.push("(get-model)");
+  return { smt2: lines.join("\n"), placeCount: P };
+}
+function resolveEnvInjection(flatNet) {
+  const out = [];
   for (const [name, bound] of flatNet.environmentInjection) {
-    const idx = flatNet.placeIndex.get(name);
-    if (idx == null) continue;
-    encodeInjectionRule(ctx, fp, reachable, idx, bound, P);
+    const pid = flatNet.placeIndex.get(name);
+    if (pid != null) out.push({ pid, bound });
   }
-  encodeErrorRule(ctx, fp, reachable, error, flatNet, property, sinkPlaces, P);
-  return {
-    errorExpr: error.call(),
-    reachableDecl: reachable
-  };
+  out.sort((a, b) => a.pid - b.pid);
+  return out;
 }
-function encodeTransitionRule(ctx, fp, reachable, ft, flatNet, invariants, P) {
-  const Int = ctx.Int;
-  const mVars = [];
-  const mPrimeVars = [];
-  for (let i = 0; i < P; i++) {
-    mVars.push(Int.const(`m${i}`));
-    mPrimeVars.push(Int.const(`mp${i}`));
-  }
-  const reachBody = reachable.call(...mVars);
-  const enabled = encodeEnabled(ctx, ft, flatNet, mVars, P);
-  const fireRelation = encodeFire(ctx, ft, flatNet, mVars, mPrimeVars, P);
-  let nonNeg = ctx.Bool.val(true);
-  for (let i = 0; i < P; i++) {
-    nonNeg = ctx.And(nonNeg, mPrimeVars[i].ge(0));
-  }
-  const invConstraints = encodeInvariantConstraints(ctx, invariants, mPrimeVars, P);
-  let envBounds = ctx.Bool.val(true);
-  for (const [name, bound] of flatNet.environmentBounds) {
-    const idx = flatNet.placeIndex.get(name);
-    if (idx != null) {
-      envBounds = ctx.And(envBounds, mPrimeVars[idx].le(bound));
-    }
+function envBounds(flatNet) {
+  const out = [];
+  for (const [name, max] of flatNet.environmentBounds) {
+    const pid = flatNet.placeIndex.get(name);
+    if (pid != null) out.push([pid, max]);
   }
-  const body = ctx.And(reachBody, enabled, fireRelation, nonNeg, invConstraints, envBounds);
-  const head = reachable.call(...mPrimeVars);
-  const allVars = [...mVars, ...mPrimeVars];
-  const rule = ctx.Implies(body, head);
-  const qRule = ctx.ForAll(allVars, rule);
-  fp.addRule(qRule, `t_${ft.name}`);
+  out.sort((a, b) => a[0] - b[0]);
+  return out;
 }
-function encodeInjectionRule(ctx, fp, reachable, idx, bound, P) {
-  const Int = ctx.Int;
-  const mVars = [];
-  const mPrimeVars = [];
+function ints(n) {
+  return new Array(n).fill("Int");
+}
+function vars(P, suffix) {
+  const out = [];
+  for (let i = 0; i < P; i++) out.push(`m${i}${suffix}`);
+  return out;
+}
+function quantified(names) {
+  return names.map((v) => `(${v} Int)`).join(" ");
+}
+function firingConditions(flatNet, ft, mVars, mpVars) {
+  const P = flatNet.places.length;
+  const conditions = [];
   for (let i = 0; i < P; i++) {
-    mVars.push(Int.const(`m${i}`));
-    mPrimeVars.push(Int.const(`mp${i}`));
+    if (ft.preVector[i] > 0) conditions.push(`(>= ${mVars[i]} ${ft.preVector[i]})`);
   }
-  const reachBody = reachable.call(...mVars);
-  let fire = ctx.Bool.val(true);
+  for (const inh of ft.inhibitorPlaces) conditions.push(`(= ${mVars[inh]} 0)`);
+  for (const rd of ft.readPlaces) conditions.push(`(>= ${mVars[rd]} 1)`);
   for (let i = 0; i < P; i++) {
-    if (i === idx) {
-      fire = ctx.And(fire, mPrimeVars[i].eq(mVars[i].add(1)));
+    if (ft.resetPlaces.includes(i) || ft.consumeAll[i]) {
+      conditions.push(`(= ${mpVars[i]} ${ft.postVector[i]})`);
     } else {
-      fire = ctx.And(fire, mPrimeVars[i].eq(mVars[i]));
+      const delta = ft.postVector[i] - ft.preVector[i];
+      if (delta > 0) conditions.push(`(= ${mpVars[i]} (+ ${mVars[i]} ${delta}))`);
+      else if (delta < 0) conditions.push(`(= ${mpVars[i]} (- ${mVars[i]} ${-delta}))`);
+      else conditions.push(`(= ${mpVars[i]} ${mVars[i]})`);
     }
   }
-  const guard = bound === null ? ctx.Bool.val(true) : mVars[idx].lt(bound);
-  const body = ctx.And(reachBody, guard, fire);
-  const head = reachable.call(...mPrimeVars);
-  const qRule = ctx.ForAll([...mVars, ...mPrimeVars], ctx.Implies(body, head));
-  fp.addRule(qRule, `env_inject_${idx}`);
+  for (let i = 0; i < P; i++) conditions.push(`(>= ${mpVars[i]} 0)`);
+  return conditions;
 }
-function injectedEnvIndices(flatNet) {
-  const out = /* @__PURE__ */ new Map();
-  for (const [name, bound] of flatNet.environmentInjection) {
-    const idx = flatNet.placeIndex.get(name);
-    if (idx != null) out.set(idx, bound);
+function invariantConditions(invariants, names) {
+  const conditions = [];
+  for (const inv of invariants) {
+    const terms = [...inv.support].sort((a, b) => a - b).map((i) => `(* ${inv.weights[i]} ${names[i]})`);
+    if (terms.length === 0) continue;
+    const sum = terms.length === 1 ? terms[0] : `(+ ${terms.join(" ")})`;
+    conditions.push(`(= ${sum} ${inv.constant})`);
   }
-  return out;
+  return conditions;
 }
-function encodeEnabled(ctx, ft, flatNet, mVars, P, relaxEnv = false) {
-  let result = ctx.Bool.val(true);
-  const envInj = relaxEnv ? injectedEnvIndices(flatNet) : void 0;
-  for (let p = 0; p < P; p++) {
-    const pre = ft.preVector[p];
-    if (pre <= 0) continue;
-    if (envInj?.has(p)) {
-      const bound = envInj.get(p);
-      if (bound !== null && pre > bound) return ctx.Bool.val(false);
-      continue;
-    }
-    result = ctx.And(result, mVars[p].ge(pre));
+function envBoundConditions(flatNet, mpVars) {
+  return envBounds(flatNet).map(([pid, max]) => `(<= ${mpVars[pid]} ${max})`);
+}
+function injectionConditions(P, pid, bound, mVars, mpVars) {
+  const conditions = [];
+  if (bound != null) conditions.push(`(< ${mVars[pid]} ${bound})`);
+  for (let i = 0; i < P; i++) {
+    if (i === pid) conditions.push(`(= ${mpVars[i]} (+ ${mVars[i]} 1))`);
+    else conditions.push(`(= ${mpVars[i]} ${mVars[i]})`);
   }
-  for (const p of ft.readPlaces) {
-    if (envInj?.has(p)) {
-      const bound = envInj.get(p);
-      if (bound !== null && bound < 1) return ctx.Bool.val(false);
-      continue;
-    }
-    result = ctx.And(result, mVars[p].ge(1));
+  return conditions;
+}
+function encodeTransitionRule(flatNet, ft, mVars, mpVars, invariants) {
+  const conditions = [`(Reachable ${mVars.join(" ")})`];
+  conditions.push(...firingConditions(flatNet, ft, mVars, mpVars));
+  conditions.push(...invariantConditions(invariants, mpVars));
+  conditions.push(...envBoundConditions(flatNet, mpVars));
+  const body = `(and ${conditions.join("\n            ")})`;
+  return `(assert (forall (${quantified([...mVars, ...mpVars])})
+  (=> ${body}
+      (Reachable ${mpVars.join(" ")}))))`;
+}
+function encodeInjectionRule(P, pid, bound, mVars, mpVars) {
+  const conditions = [`(Reachable ${mVars.join(" ")})`];
+  conditions.push(...injectionConditions(P, pid, bound, mVars, mpVars));
+  const body = `(and ${conditions.join("\n            ")})`;
+  return `(assert (forall (${quantified([...mVars, ...mpVars])})
+  (=> ${body}
+      (Reachable ${mpVars.join(" ")}))))`;
+}
+function conjoin(conditions) {
+  if (conditions.length === 0) return "true";
+  if (conditions.length === 1) return conditions[0];
+  return `(and ${conditions.join(" ")})`;
+}
+function encodeStepRelationSmt2(flatNet) {
+  const P = flatNet.places.length;
+  const mVars = vars(P, "");
+  const mpVars = vars(P, "p");
+  const disjuncts = [];
+  for (const ft of flatNet.transitions) {
+    const conditions = firingConditions(flatNet, ft, mVars, mpVars);
+    conditions.push(...envBoundConditions(flatNet, mpVars));
+    disjuncts.push(conjoin(conditions));
   }
-  for (const p of ft.inhibitorPlaces) {
-    result = ctx.And(result, mVars[p].eq(0));
+  for (const inj of resolveEnvInjection(flatNet)) {
+    disjuncts.push(conjoin(injectionConditions(P, inj.pid, inj.bound, mVars, mpVars)));
   }
-  for (let p = 0; p < P; p++) {
-    result = ctx.And(result, mVars[p].ge(0));
-  }
-  return result;
+  if (disjuncts.length === 0) return "false";
+  if (disjuncts.length === 1) return disjuncts[0];
+  return `(or ${disjuncts.join("\n    ")})`;
 }
-function encodeFire(ctx, ft, _flatNet, mVars, mPrimeVars, P) {
-  let result = ctx.Bool.val(true);
-  for (let p = 0; p < P; p++) {
-    const isReset = ft.resetPlaces.includes(p);
-    if (isReset || ft.consumeAll[p]) {
-      result = ctx.And(result, mPrimeVars[p].eq(ft.postVector[p]));
-    } else {
-      const delta = ft.postVector[p] - ft.preVector[p];
-      if (delta === 0) {
-        result = ctx.And(result, mPrimeVars[p].eq(mVars[p]));
-      } else {
-        result = ctx.And(result, mPrimeVars[p].eq(mVars[p].add(delta)));
-      }
-    }
-  }
-  return result;
+function encodeErrorRule(flatNet, property, mVars, sinkPlaces, envInject) {
+  const violation = encodePropertyViolation(flatNet, property, mVars, sinkPlaces, envInject);
+  return `(assert (forall (${quantified(mVars)})
+  (=> (and (Reachable ${mVars.join(" ")}) ${violation})
+      Error)))`;
 }
-function encodeErrorRule(ctx, fp, reachable, error, flatNet, property, sinkPlaces, P) {
-  const Int = ctx.Int;
-  const mVars = [];
-  for (let i = 0; i < P; i++) {
-    mVars.push(Int.const(`em${i}`));
+function indexOrdered(flatNet, places) {
+  const idx = /* @__PURE__ */ new Set();
+  for (const place of places) {
+    const i = flatNet.placeIndex.get(place.name);
+    if (i != null) idx.add(i);
   }
-  const reachBody = reachable.call(...mVars);
-  const violation = encodePropertyViolation(ctx, flatNet, property, sinkPlaces, mVars, P);
-  const head = error.call();
-  const body = ctx.And(reachBody, violation);
-  const rule = ctx.Implies(body, head);
-  const qRule = ctx.ForAll(mVars, rule);
-  fp.addRule(qRule, `error_${property.type}`);
+  return [...idx].sort((a, b) => a - b);
 }
-function encodePropertyViolation(ctx, flatNet, property, sinkPlaces, mVars, P) {
+function encodePropertyViolation(flatNet, property, mVars, sinkPlaces, envInject) {
   switch (property.type) {
-    case "deadlock-free": {
-      const deadlock = encodeDeadlock(ctx, flatNet, mVars, P);
-      if (sinkPlaces.size > 0) {
-        let notAtSink = ctx.Bool.val(true);
-        for (const sink of sinkPlaces) {
-          const idx = flatNetIndexOf(flatNet, sink);
-          if (idx >= 0) {
-            notAtSink = ctx.And(notAtSink, mVars[idx].eq(0));
-          }
-        }
-        return ctx.And(deadlock, notAtSink);
-      }
-      return deadlock;
-    }
+    case "deadlock-free":
+      return encodeDeadlock(flatNet, mVars, sinkPlaces, envInject);
     case "mutual-exclusion": {
-      const idx1 = flatNetIndexOf(flatNet, property.p1);
-      const idx2 = flatNetIndexOf(flatNet, property.p2);
-      if (idx1 < 0) throw new Error(`MutualExclusion references unknown place: ${property.p1.name}`);
-      if (idx2 < 0) throw new Error(`MutualExclusion references unknown place: ${property.p2.name}`);
-      return ctx.And(mVars[idx1].ge(1), mVars[idx2].ge(1));
-    }
-    case "place-bound": {
-      const idx = flatNetIndexOf(flatNet, property.place);
-      if (idx < 0) throw new Error(`PlaceBound references unknown place: ${property.place.name}`);
-      return mVars[idx].gt(property.bound);
+      const conditions = indexOrdered(flatNet, [property.p1, property.p2]).map((i) => `(>= ${mVars[i]} 1)`);
+      return conditions.length === 0 ? "false" : `(and ${conditions.join(" ")})`;
     }
+    case "place-bound":
     case "branch-place-bound": {
-      const idx = flatNetIndexOf(flatNet, property.place);
-      if (idx < 0) throw new Error(`BranchPlaceBound references unknown place: ${property.place.name}`);
-      return mVars[idx].gt(property.bound);
+      const pid = flatNet.placeIndex.get(property.place.name);
+      return pid == null ? "false" : `(> ${mVars[pid]} ${property.bound})`;
+    }
+    case "unreachable": {
+      const conditions = indexOrdered(flatNet, property.places).map((i) => `(>= ${mVars[i]} 1)`);
+      return conditions.length === 0 ? "false" : `(and ${conditions.join(" ")})`;
     }
     case "joined-or-dead-lettered": {
-      const idx = flatNetIndexOf(flatNet, property.pending);
-      if (idx < 0) return ctx.Bool.val(false);
-      const deadlock = encodeDeadlock(ctx, flatNet, mVars, P);
-      return ctx.And(deadlock, mVars[idx].ge(1));
+      const deadlock = encodeDeadlock(flatNet, mVars, sinkPlaces, envInject);
+      const pid = flatNet.placeIndex.get(property.pending.name);
+      return pid == null ? "false" : `(and ${deadlock} (>= ${mVars[pid]} 1))`;
     }
-    case "unreachable": {
-      let allMarked = ctx.Bool.val(true);
-      for (const place of property.places) {
-        const idx = flatNetIndexOf(flatNet, place);
-        if (idx >= 0) {
-          allMarked = ctx.And(allMarked, mVars[idx].ge(1));
+  }
+}
+function encodeDeadlock(flatNet, mVars, sinkPlaces, envInject) {
+  const envBound = /* @__PURE__ */ new Map();
+  for (const inj of envInject) envBound.set(inj.pid, inj.bound);
+  const disabledConditions = [];
+  for (const ft of flatNet.transitions) {
+    const disableReasons = [];
+    let permanentlyDisabled = false;
+    for (let i = 0; i < flatNet.places.length; i++) {
+      if (ft.preVector[i] > 0) {
+        if (envBound.has(i)) {
+          const k = envBound.get(i);
+          if (k != null && ft.preVector[i] > k) permanentlyDisabled = true;
+          continue;
         }
+        disableReasons.push(`(< ${mVars[i]} ${ft.preVector[i]})`);
       }
-      return allMarked;
     }
+    for (const inh of ft.inhibitorPlaces) disableReasons.push(`(> ${mVars[inh]} 0)`);
+    for (const rd of ft.readPlaces) {
+      if (envBound.has(rd)) {
+        const k = envBound.get(rd);
+        if (k != null && k < 1) permanentlyDisabled = true;
+        continue;
+      }
+      disableReasons.push(`(< ${mVars[rd]} 1)`);
+    }
+    if (permanentlyDisabled) {
+      disabledConditions.push("true");
+      continue;
+    }
+    if (disableReasons.length === 0) return "false";
+    disabledConditions.push(`(or ${disableReasons.join(" ")})`);
+  }
+  for (const pid of indexOrdered(flatNet, sinkPlaces)) {
+    disabledConditions.push(`(= ${mVars[pid]} 0)`);
   }
+  return disabledConditions.length === 0 ? "true" : `(and ${disabledConditions.join("\n         ")})`;
 }
-function encodeDeadlock(ctx, flatNet, mVars, P) {
-  let deadlock = ctx.Bool.val(true);
-  for (const ft of flatNet.transitions) {
-    const enabled = encodeEnabled(
-      ctx,
-      ft,
-      flatNet,
-      mVars,
-      P,
-      /* relaxEnv */
-      true
-    );
-    deadlock = ctx.And(deadlock, ctx.Not(enabled));
+function injectionMap(flatNet) {
+  const out = /* @__PURE__ */ new Map();
+  for (const inj of resolveEnvInjection(flatNet)) out.set(inj.pid, inj.bound);
+  return out;
+}
+
+// src/verification/z3/certificate-checker.ts
+var VC_LABELS = ["initiation (VC1)", "consecution (VC2)", "safety (VC3)"];
+async function checkCertificate(certificate, flatNet, initialMarking, property, invariants, sinkPlaces, solver, timeoutMs) {
+  if (certificate == null) {
+    return {
+      type: "unavailable",
+      reason: "no inductive invariant (define-fun block) could be extracted from the z3 model",
+      invariant: null
+    };
+  }
+  const shape = shapeFailure(flatNet, invariants);
+  if (shape != null) return { type: "unavailable", reason: shape, invariant: certificate };
+  if (!certificate.includes("(define-fun Reachable ") && !certificate.includes("(define-fun |Reachable| ")) {
+    return { type: "unavailable", reason: "certificate does not define Reachable", invariant: certificate };
+  }
+  const vcs = buildVerificationConditions(certificate, flatNet, initialMarking, property, sinkPlaces, invariants);
+  let results;
+  try {
+    results = await runVcScript(script(vcs), timeoutMs, solver);
+  } catch (e) {
+    return { type: "unavailable", reason: String(e?.message ?? e), invariant: certificate };
+  }
+  for (let i = 0; i < results.length; i++) {
+    if (results[i] !== "unsat") {
+      const detail = await detailFor(vcs, i, results[i], flatNet, timeoutMs, solver);
+      return { type: "failed", vc: VC_LABELS[i], detail, invariant: certificate };
+    }
   }
-  return deadlock;
+  return { type: "passed", invariant: certificate };
 }
-function encodeInvariantConstraints(ctx, invariants, mVars, P) {
-  let result = ctx.Bool.val(true);
+function vcScript(certificate, flatNet, initialMarking, property, sinkPlaces, invariants) {
+  return script(buildVerificationConditions(certificate, flatNet, initialMarking, property, sinkPlaces, invariants));
+}
+function shapeFailure(flatNet, invariants) {
+  const P = flatNet.places.length;
   for (const inv of invariants) {
-    let sum = ctx.Int.val(0);
-    for (const idx of inv.support) {
-      if (idx < P) {
-        sum = sum.add(mVars[idx].mul(inv.weights[idx]));
-      }
+    if (inv.weights.length !== P) {
+      return `P-invariant has ${inv.weights.length} weights for a ${P}-place net`;
+    }
+    for (const pid of inv.support) {
+      if (pid >= P || pid < 0) return `P-invariant support names place index ${pid} in a ${P}-place net`;
     }
-    result = ctx.And(result, sum.eq(inv.constant));
   }
-  return result;
+  return null;
+}
+var VcFailure = class extends Error {
+};
+async function runVcScript(text, timeoutMs, solver) {
+  const reply = await runZ3Text(solver, text, "certificate", timeoutMs, []);
+  const budget = timeoutBudget(timeoutMs);
+  const err = errorLine(reply.stderr);
+  if (err != null) throw new VcFailure(`z3 reported an error on stderr: ${err}`);
+  if (timeoutLine(reply.stdout)) {
+    throw new VcFailure(`z3 hard timeout after ${hardTimeoutSecs(budget)}s while checking the certificate`);
+  }
+  if (reply.exit.kind === "killed") {
+    throw new VcFailure(`z3 did not exit within ${watchdogMs(budget)} ms while checking the certificate and was killed`);
+  }
+  const results = parseVcResults(reply.stdout);
+  if (!replySucceeded(reply)) {
+    const status = reply.exit.kind === "exited" ? `exit status: ${reply.exit.code}` : "the watchdog kill";
+    throw new VcFailure(`z3 exited with ${status} after answering [${results.join(", ")}]`);
+  }
+  return results;
+}
+function parseVcResults(stdout) {
+  const err = errorLine(stdout);
+  if (err != null) throw new VcFailure(`z3 error while checking the certificate: ${err}`);
+  if (timeoutLine(stdout)) throw new VcFailure("z3 hard timeout while checking the certificate");
+  const results = stdout.split("\n").map((l) => l.trim()).filter((l) => l === "sat" || l === "unsat" || l === "unknown");
+  if (results.length !== 3) {
+    throw new VcFailure(`expected 3 VC answers from z3, got ${results.length}: [${results.join(", ")}]`);
+  }
+  return results;
+}
+function buildVerificationConditions(certificate, flatNet, initialMarking, property, sinkPlaces, invariants) {
+  const P = flatNet.places.length;
+  const mVars = [];
+  const mpVars = [];
+  for (let i = 0; i < P; i++) {
+    mVars.push(`m${i}`);
+    mpVars.push(`m${i}p`);
+  }
+  const prelude = [
+    "; IC3/PDR certificate check (plain SMT-LIB2, not HORN):",
+    "; each VC below must be unsat for the certificate to stand.",
+    certificate,
+    ""
+  ];
+  for (const v of mVars) prelude.push(`(declare-const ${v} Int)`);
+  for (const v of mpVars) prelude.push(`(declare-const ${v} Int)`);
+  const m0 = [];
+  for (let i = 0; i < P; i++) m0.push(String(initialMarking.tokens(flatNet.places[i])));
+  const vc1 = [`(assert (not ${candidate(m0, invariants)}))`];
+  const nonNegative = mVars.map((v) => `(assert (>= ${v} 0))`);
+  const step = encodeStepRelationSmt2(flatNet);
+  const vc2 = [
+    ...nonNegative,
+    `(assert ${candidate(mVars, invariants)})`,
+    `(assert ${step})`,
+    `(assert (not ${candidate(mpVars, invariants)}))`
+  ];
+  const bad = encodePropertyViolation(flatNet, property, mVars, sinkPlaces, resolveEnvInjection(flatNet));
+  const vc3 = [...nonNegative, `(assert ${candidate(mVars, invariants)})`, `(assert ${bad})`];
+  return { prelude, asserts: [vc1, vc2, vc3] };
+}
+function script(vcs) {
+  const lines = [...vcs.prelude];
+  for (let i = 0; i < vcs.asserts.length; i++) {
+    lines.push("");
+    lines.push(`; VC${i + 1} ${VC_LABELS[i]}`);
+    lines.push("(push)");
+    lines.push(...vcs.asserts[i]);
+    lines.push("(check-sat)");
+    lines.push("(pop)");
+  }
+  return lines.join("\n");
+}
+async function detailFor(vcs, i, answer, flatNet, timeoutMs, solver) {
+  const lines = ["(set-option :produce-models true)", ...vcs.prelude, ...vcs.asserts[i], "(check-sat)"];
+  lines.push(answer === "sat" ? "(get-model)" : "(get-info :reason-unknown)");
+  let reply = "";
+  try {
+    reply = (await runZ3Text(solver, lines.join("\n"), "certificate-detail", timeoutMs, [])).stdout;
+  } catch {
+    reply = "";
+  }
+  if (answer === "sat") {
+    const w = witness(reply, flatNet);
+    return w == null ? "solver returned SATISFIABLE" : `solver returned SATISFIABLE (witness: ${w})`;
+  }
+  const r = reasonUnknown(reply);
+  return r == null ? "solver returned UNKNOWN" : `solver returned UNKNOWN (${r})`;
+}
+function witness(model, flatNet) {
+  const parts = [];
+  for (let i = 0; i < flatNet.places.length; i++) {
+    const needle = `(define-fun m${i} () Int`;
+    const at = model.indexOf(needle);
+    if (at < 0) continue;
+    const rest = model.slice(at + needle.length).trimStart();
+    let value;
+    if (rest.startsWith("(")) {
+      const end = sexprEnd(rest, 0);
+      if (end < 0) continue;
+      value = rest.slice(1, end - 1).trim().split(/\s+/).join("");
+    } else {
+      let end = 0;
+      while (end < rest.length && !/\s/.test(rest[end]) && rest[end] !== ")") end++;
+      if (end === 0) continue;
+      value = rest.slice(0, end);
+    }
+    parts.push(`${flatNet.places[i].name}=${value}`);
+  }
+  return parts.length === 0 ? null : parts.join(", ");
+}
+function reasonUnknown(reply) {
+  const at = reply.indexOf(":reason-unknown");
+  if (at < 0) return null;
+  const rest = reply.slice(at + ":reason-unknown".length).trimStart();
+  const end = rest.indexOf(")");
+  if (end < 0) return null;
+  let reason = rest.slice(0, end).trim();
+  if (reason.startsWith('"') && reason.endsWith('"') && reason.length >= 2) reason = reason.slice(1, -1);
+  reason = reason.trim();
+  return reason === "" ? null : reason;
+}
+function candidate(names, invariants) {
+  return conjoin([`(Reachable ${names.join(" ")})`, ...invariantConditions(invariants, names)]);
 }
 
 // src/verification/analysis/dbm.ts
@@ -1831,66 +2315,321 @@ function consumeFromPlace(builder, place, count, environmentPlaces, environmentM
 }
 
 // src/verification/z3/counterexample-decoder.ts
-function decode(ctx, answer, flatNet) {
-  const trace = [];
-  const transitions = [];
-  if (answer == null) {
-    return { trace, transitions };
+function decode(answer, flatNet) {
+  const states = decodeStateSet(answer, flatNet);
+  return { states, note: states.size === 0 ? "no ground Reachable states in the z3 proof" : null };
+}
+function decodeStateSet(answer, flatNet) {
+  const byKey = /* @__PURE__ */ new Map();
+  const P = flatNet.places.length;
+  for (const head of ["(Reachable", "(|Reachable|"]) {
+    let from = 0;
+    for (; ; ) {
+      const start = answer.indexOf(head, from);
+      if (start < 0) break;
+      from = start + head.length;
+      if (head === "(Reachable") {
+        const next = answer[from];
+        if (next == null || !(/\s/.test(next) || next === ")")) continue;
+      }
+      const end = sexprEnd(answer, start);
+      if (end < 0) break;
+      const inner = answer.slice(start + head.length, end - 1);
+      const args = parseGroundIntArgs(inner);
+      if (args != null && args.length === P) {
+        const marking = toMarking(args, flatNet);
+        const key = marking.toString();
+        if (!byKey.has(key)) byKey.set(key, marking);
+      }
+    }
   }
-  try {
-    extractTrace(ctx, answer, flatNet, trace, transitions);
-  } catch {
+  return new Set(byKey.values());
+}
+function toMarking(args, flatNet) {
+  const builder = MarkingState.builder();
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] > 0) builder.tokens(flatNet.places[i], args[i]);
+  }
+  return builder.build();
+}
+function parseGroundIntArgs(inner) {
+  const args = [];
+  let rest = inner.trimStart();
+  while (rest !== "") {
+    if (rest.startsWith("(")) {
+      const stripped = rest.slice(1);
+      const close = stripped.indexOf(")");
+      if (close < 0) return null;
+      const body = stripped.slice(0, close);
+      if (body.includes("(")) return null;
+      const trimmed = body.trim();
+      if (!trimmed.startsWith("-")) return null;
+      const n = parseInt64(trimmed.slice(1).trim());
+      if (n == null) return null;
+      args.push(-n);
+      rest = stripped.slice(close + 1).trimStart();
+    } else {
+      let tokenEnd = rest.length;
+      for (let i = 0; i < rest.length; i++) {
+        const c = rest[i];
+        if (/\s/.test(c) || c === "(" || c === ")") {
+          tokenEnd = i;
+          break;
+        }
+      }
+      const n = parseInt64(rest.slice(0, tokenEnd));
+      if (n == null) return null;
+      args.push(n);
+      rest = rest.slice(tokenEnd).trimStart();
+    }
+  }
+  return args;
+}
+function parseInt64(token) {
+  return /^-?\d+$/.test(token) ? Number(token) : null;
+}
+
+// src/verification/encoding/flat-net.ts
+function flatNetPlaceCount(net) {
+  return net.places.length;
+}
+function flatNetTransitionCount(net) {
+  return net.transitions.length;
+}
+function flatNetIndexOf(net, place) {
+  return net.placeIndex.get(place.name) ?? -1;
+}
+
+// src/verification/z3/abstract-replayer.ts
+function stepName(step) {
+  return step.kind === "fire" ? step.transition : `inject(${step.place})`;
+}
+function stateKey(state) {
+  return state.join(",");
+}
+function vectorize(marking, flatNet) {
+  return flatNet.places.map((p) => marking.tokens(p));
+}
+function toMarkingState(state, flatNet) {
+  const builder = MarkingState.builder();
+  for (let i = 0; i < flatNet.places.length; i++) {
+    if (state[i] > 0) builder.tokens(flatNet.places[i], state[i]);
+  }
+  return builder.build();
+}
+function enabledA(state, ft) {
+  const P = state.length;
+  for (let p = 0; p < P; p++) {
+    if (ft.preVector[p] > 0 && state[p] < ft.preVector[p]) return false;
+  }
+  for (const p of ft.readPlaces) {
+    if (state[p] < 1) return false;
+  }
+  for (const p of ft.inhibitorPlaces) {
+    if (state[p] !== 0) return false;
+  }
+  return true;
+}
+function fireIndexed(state, ft, resets) {
+  const P = state.length;
+  const next = new Array(P);
+  for (let p = 0; p < P; p++) {
+    if (resets.has(p) || ft.consumeAll[p]) {
+      next[p] = ft.postVector[p];
+    } else {
+      next[p] = state[p] - ft.preVector[p] + ft.postVector[p];
+    }
+  }
+  return next;
+}
+function injectA(state, idx) {
+  const next = [...state];
+  next[idx] = next[idx] + 1;
+  return next;
+}
+function buildIndex(flatNet) {
+  const resetSets = flatNet.transitions.map((ft) => new Set(ft.resetPlaces));
+  const envInj = /* @__PURE__ */ new Map();
+  for (const [name, bound] of flatNet.environmentInjection) {
+    const idx = flatNet.placeIndex.get(name);
+    if (idx != null) envInj.set(idx, bound);
+  }
+  const envCaps = [];
+  for (const [name, cap] of flatNet.environmentBounds) {
+    const idx = flatNet.placeIndex.get(name);
+    if (idx != null) envCaps.push([idx, cap]);
+  }
+  return { flatNet, resetSets, envInj, envCaps };
+}
+function withinEnvBounds(index, state) {
+  for (const [idx, cap] of index.envCaps) {
+    if (state[idx] > cap) return false;
+  }
+  return true;
+}
+function successorsIndexed(index, state) {
+  const out = [];
+  const transitions = index.flatNet.transitions;
+  for (let t = 0; t < transitions.length; t++) {
+    const ft = transitions[t];
+    if (!enabledA(state, ft)) continue;
+    const next = fireIndexed(state, ft, index.resetSets[t]);
+    if (!withinEnvBounds(index, next)) continue;
+    out.push({ state: next, step: { kind: "fire", transition: ft.name } });
+  }
+  for (const [name, bound] of index.flatNet.environmentInjection) {
+    const idx = index.flatNet.placeIndex.get(name);
+    if (idx == null) continue;
+    if (bound === null || state[idx] < bound) {
+      out.push({ state: injectA(state, idx), step: { kind: "inject", place: name } });
+    }
+  }
+  return out;
+}
+function enabledRelaxEnv(state, ft, envInj) {
+  const P = state.length;
+  for (let p = 0; p < P; p++) {
+    const pre = ft.preVector[p];
+    if (pre <= 0) continue;
+    if (envInj.has(p)) {
+      const bound = envInj.get(p);
+      if (bound !== null && pre > bound) return false;
+      continue;
+    }
+    if (state[p] < pre) return false;
+  }
+  for (const p of ft.readPlaces) {
+    if (envInj.has(p)) {
+      const bound = envInj.get(p);
+      if (bound !== null && bound < 1) return false;
+      continue;
+    }
+    if (state[p] < 1) return false;
   }
-  return { trace, transitions };
+  for (const p of ft.inhibitorPlaces) {
+    if (state[p] !== 0) return false;
+  }
+  return true;
 }
-function extractTrace(ctx, expr, flatNet, trace, transitions) {
-  if (expr == null) return;
-  if (!ctx.isApp(expr)) return;
-  let name;
-  try {
-    const decl = expr.decl();
-    name = String(decl.name());
-  } catch {
-    return;
+function isDeadlockA(index, state) {
+  for (const ft of index.flatNet.transitions) {
+    if (enabledRelaxEnv(state, ft, index.envInj)) return false;
   }
-  const P = flatNet.places.length;
-  if (name === "Reachable") {
-    const numArgs = expr.numArgs();
-    if (numArgs === P) {
-      const marking = extractMarking(ctx, expr, flatNet);
-      if (marking != null) {
-        trace.push(marking);
+  return true;
+}
+function satisfiesBadIndexed(index, state, property, sinkPlaces) {
+  const flatNet = index.flatNet;
+  switch (property.type) {
+    case "deadlock-free": {
+      if (!isDeadlockA(index, state)) return false;
+      for (const sink of sinkPlaces) {
+        const idx = flatNetIndexOf(flatNet, sink);
+        if (idx >= 0 && state[idx] > 0) return false;
       }
+      return true;
     }
-  }
-  try {
-    const numArgs = expr.numArgs();
-    for (let i = 0; i < numArgs; i++) {
-      const child = expr.arg(i);
-      extractTrace(ctx, child, flatNet, trace, transitions);
+    case "mutual-exclusion": {
+      const idx1 = flatNetIndexOf(flatNet, property.p1);
+      const idx2 = flatNetIndexOf(flatNet, property.p2);
+      if (idx1 < 0 || idx2 < 0) return false;
+      return state[idx1] >= 1 && state[idx2] >= 1;
+    }
+    case "place-bound":
+    case "branch-place-bound": {
+      const idx = flatNetIndexOf(flatNet, property.place);
+      if (idx < 0) return false;
+      return state[idx] > property.bound;
+    }
+    case "joined-or-dead-lettered": {
+      const idx = flatNetIndexOf(flatNet, property.pending);
+      if (idx < 0) return false;
+      return isDeadlockA(index, state) && state[idx] >= 1;
+    }
+    case "unreachable": {
+      let resolved = 0;
+      for (const p of property.places) {
+        const idx = flatNetIndexOf(flatNet, p);
+        if (idx < 0) continue;
+        resolved++;
+        if (state[idx] < 1) return false;
+      }
+      return resolved > 0;
     }
-  } catch {
-  }
-  if (name.startsWith("t_")) {
-    transitions.push(name.substring(2));
   }
 }
-function extractMarking(ctx, reachableApp, flatNet) {
-  const P = flatNet.places.length;
-  if (reachableApp.numArgs() !== P) return null;
-  const builder = MarkingState.builder();
-  for (let i = 0; i < P; i++) {
-    const arg = reachableApp.arg(i);
-    if (ctx.isIntVal(arg)) {
-      const tokens = Number(arg.value());
-      if (tokens > 0) {
-        builder.tokens(flatNet.places[i], tokens);
+function replayCounterexample(flatNet, initial, decodedStates, property, sinkPlaces, options = {}) {
+  const segmentBudget = options.segmentBudget ?? 3;
+  const nodeBudget = options.nodeBudget ?? 1e4;
+  const anchors = /* @__PURE__ */ new Set();
+  for (const s of decodedStates) anchors.add(stateKey(s));
+  if (anchors.size === 0) {
+    return { kind: "exhausted", reason: "no decoded states to replay", nodesExplored: 0 };
+  }
+  const initKey = stateKey(initial);
+  if (!anchors.has(initKey)) {
+    return {
+      kind: "exhausted",
+      reason: "the initial marking is not among the decoded states",
+      nodesExplored: 0
+    };
+  }
+  const index = buildIndex(flatNet);
+  if (satisfiesBadIndexed(index, initial, property, sinkPlaces)) {
+    return { kind: "confirmed", states: [initial], steps: [], nodesExplored: 1 };
+  }
+  const nodes = [{ state: initial, step: null, parent: -1, segment: 0 }];
+  const bestSegment = /* @__PURE__ */ new Map([[initKey, 0]]);
+  const queue = [0];
+  let truncated = false;
+  for (let head = 0; head < queue.length; head++) {
+    const idx = queue[head];
+    const node = nodes[idx];
+    if (node.segment >= segmentBudget) {
+      truncated = true;
+      continue;
+    }
+    for (const succ of successorsIndexed(index, node.state)) {
+      const key = stateKey(succ.state);
+      const segment = anchors.has(key) ? 0 : node.segment + 1;
+      const prior = bestSegment.get(key);
+      if (prior !== void 0 && prior <= segment) continue;
+      bestSegment.set(key, segment);
+      if (nodes.length >= nodeBudget) {
+        return {
+          kind: "exhausted",
+          reason: `search budget exhausted (${nodeBudget} nodes) before reaching a violating state`,
+          nodesExplored: nodes.length
+        };
       }
-    } else {
-      return null;
+      nodes.push({ state: succ.state, step: succ.step, parent: idx, segment });
+      const childIdx = nodes.length - 1;
+      if (satisfiesBadIndexed(index, succ.state, property, sinkPlaces)) {
+        const chain = reconstruct(nodes, childIdx);
+        return { kind: "confirmed", ...chain, nodesExplored: nodes.length };
+      }
+      queue.push(childIdx);
     }
   }
-  return builder.build();
+  if (truncated) {
+    return {
+      kind: "exhausted",
+      reason: `no violating state within ${segmentBudget} abstract step(s) of a decoded state (${bestSegment.size} state(s) explored)`,
+      nodesExplored: nodes.length
+    };
+  }
+  return { kind: "no-chain", nodesExplored: nodes.length };
+}
+function reconstruct(nodes, last) {
+  const states = [];
+  const steps = [];
+  for (let i = last; i >= 0; i = nodes[i].parent) {
+    const node = nodes[i];
+    states.push(node.state);
+    if (node.step != null) steps.push(node.step);
+  }
+  states.reverse();
+  steps.reverse();
+  return { states, steps };
 }
 
 // src/verification/z3/name-coloured-encoder.ts
@@ -1899,25 +2638,29 @@ function colourSlotBound(coloured, semiflows) {
   const isSemiflow = (inv) => inv.weights.every((x) => x >= 0);
   let single = null;
   for (const inv of semiflows) {
-    if (isSemiflow(inv) && inv.constant >= 1 && coloured.every((pid) => w(inv, pid) >= 1)) {
+    if (isSemiflow(inv) && coloured.every((pid) => w(inv, pid) >= 1)) {
       if (single === null || inv.constant < single) single = inv.constant;
     }
   }
   if (single !== null) return single;
-  let sumConst = 0;
   const covered = new Array(coloured.length).fill(false);
   for (const inv of semiflows) {
-    if (!isSemiflow(inv)) continue;
-    let touches = false;
+    if (!isSemiflow(inv) || inv.constant !== 0) continue;
     for (let i = 0; i < coloured.length; i++) {
-      if (w(inv, coloured[i]) >= 1) {
-        covered[i] = true;
-        touches = true;
-      }
+      if (w(inv, coloured[i]) >= 1) covered[i] = true;
+    }
+  }
+  const free = [...covered];
+  let sumConst = 0;
+  for (const inv of semiflows) {
+    if (!isSemiflow(inv) || inv.constant === 0) continue;
+    if (!coloured.some((pid, i) => !free[i] && w(inv, pid) >= 1)) continue;
+    for (let i = 0; i < coloured.length; i++) {
+      if (w(inv, coloured[i]) >= 1) covered[i] = true;
     }
-    if (touches) sumConst += inv.constant;
+    sumConst += inv.constant;
   }
-  if (covered.every((c) => c) && sumConst >= 1) return sumConst;
+  if (covered.every((c) => c)) return sumConst;
   return null;
 }
 function buildColouredPlan(net, flat, initial, budgetNames, fragmentMode, carrierPlaces, semiflows) {
@@ -1947,6 +2690,7 @@ function buildColouredPlan(net, flat, initial, budgetNames, fragmentMode, carrie
   }
   const k = colourSlotBound(coloured, semiflows);
   if (k === null) return null;
+  if (k === 0 && coloured.length === P) return null;
   const budgetIdx = /* @__PURE__ */ new Set();
   for (const n of budgetNames) {
     const i = flat.placeIndex.get(n);
@@ -1982,324 +2726,278 @@ function buildColouredPlan(net, flat, initial, budgetNames, fragmentMode, carrie
   }
   return { coloured, isColoured, k, classes };
 }
-function buildLayout(ctx, plan, P) {
+function buildLayout(plan, P) {
   const colUnc = new Array(P).fill(-1);
   const colCol = Array.from({ length: P }, () => []);
-  let nCols = 0;
+  const cur = [];
+  const nxt = [];
   for (let i = 0; i < P; i++) {
     if (plan.isColoured[i]) {
       const idxs = [];
-      for (let c = 0; c < plan.k; c++) idxs.push(nCols++);
+      for (let c = 0; c < plan.k; c++) {
+        idxs.push(cur.length);
+        cur.push(`m${i}_${c}`);
+        nxt.push(`m${i}_${c}p`);
+      }
       colCol[i] = idxs;
     } else {
-      colUnc[i] = nCols++;
+      colUnc[i] = cur.length;
+      cur.push(`m${i}`);
+      nxt.push(`m${i}p`);
     }
   }
-  const cur = [];
-  const nxt = [];
-  for (let col = 0; col < nCols; col++) {
-    cur.push(ctx.Int.const(`c${col}`));
-    nxt.push(ctx.Int.const(`cp${col}`));
-  }
-  return { colUnc, colCol, nCols, cur, nxt };
+  return { colUnc, colCol, cur, nxt };
 }
-function encodeColoured(ctx, fp, plan, flat, initial, property, invariants, sinkPlaces = /* @__PURE__ */ new Set()) {
+function quantified2(names) {
+  return names.map((v) => `(${v} Int)`).join(" ");
+}
+function encodeColoured(plan, flat, initial, property, invariants, sinkPlaces) {
   const P = flat.places.length;
   const k = plan.k;
-  const lay = buildLayout(ctx, plan, P);
-  const intSort = ctx.Int.sort();
-  const boolSort = ctx.Bool.sort();
-  const markingSorts = new Array(lay.nCols).fill(intSort);
-  const reachable = ctx.Function.declare("Reachable", ...markingSorts, boolSort);
-  fp.registerRelation(reachable);
-  const error = ctx.Function.declare("Error", boolSort);
-  fp.registerRelation(error);
-  const initArgs = new Array(lay.nCols);
+  const lay = buildLayout(plan, P);
+  const nCols = lay.cur.length;
+  const lines = [];
+  lines.push("(set-logic HORN)");
+  lines.push("");
+  lines.push(`(declare-fun Reachable (${new Array(nCols).fill("Int").join(" ")}) Bool)`);
+  lines.push("(declare-fun Error () Bool)");
+  lines.push("");
+  const init = [];
   for (let i = 0; i < P; i++) {
     if (plan.isColoured[i]) {
-      for (let c = 0; c < k; c++) initArgs[lay.colCol[i][c]] = ctx.Int.val(0);
+      for (let c = 0; c < k; c++) init.push("0");
     } else {
-      initArgs[lay.colUnc[i]] = ctx.Int.val(initial.tokens(flat.places[i]));
+      init.push(String(initial.tokens(flat.places[i])));
     }
   }
-  fp.addRule(reachable.call(...initArgs), "init");
+  lines.push(`(assert (Reachable ${init.join(" ")}))`);
+  lines.push("");
   for (let ti = 0; ti < plan.classes.length; ti++) {
     const cls = plan.classes[ti];
     const ft = flat.transitions[ti];
-    if (cls.kind === "untouched") {
-      addRule(
-        ctx,
-        fp,
-        reachable,
-        lay,
-        plan,
-        invariants,
-        `${ft.name}_u`,
-        (enab, upd) => uncolouredIncidence(ctx, lay, plan, ft, enab, upd)
-      );
-    } else if (cls.kind === "mint") {
-      const colouredOut = cls.colouredOut;
-      for (let c = 0; c < k; c++) {
-        const cc = c;
-        addRule(ctx, fp, reachable, lay, plan, invariants, `${ft.name}_mint_${cc}`, (enab, upd) => {
-          uncolouredIncidence(ctx, lay, plan, ft, enab, upd);
-          for (const q of plan.coloured) enab.push(lay.cur[lay.colCol[q][cc]].eq(0));
-          for (const o of colouredOut) {
-            const col = lay.colCol[o][cc];
-            upd.set(col, lay.cur[col].add(1));
-          }
-        });
-      }
-    } else if (cls.kind === "join") {
-      const colouredIn = cls.colouredIn;
-      for (let c = 0; c < k; c++) {
-        const cc = c;
-        addRule(ctx, fp, reachable, lay, plan, invariants, `${ft.name}_join_${cc}`, (enab, upd) => {
-          uncolouredIncidence(ctx, lay, plan, ft, enab, upd);
-          for (const ip of colouredIn) {
-            const col = lay.colCol[ip][cc];
-            enab.push(lay.cur[col].ge(1));
-            upd.set(col, lay.cur[col].add(-1));
-          }
-        });
-      }
-    } else {
-      const inputCol = cls.inputCol;
-      const colouredOut = cls.colouredOut;
-      for (let c = 0; c < k; c++) {
-        const cc = c;
-        addRule(ctx, fp, reachable, lay, plan, invariants, `${ft.name}_consume_${cc}`, (enab, upd) => {
-          uncolouredIncidence(ctx, lay, plan, ft, enab, upd);
-          const icol = lay.colCol[inputCol][cc];
-          enab.push(lay.cur[icol].ge(1));
-          upd.set(icol, lay.cur[icol].add(-1));
-          for (const o of colouredOut) {
-            const ocol = lay.colCol[o][cc];
-            upd.set(ocol, lay.cur[ocol].add(1));
-          }
-        });
-      }
+    switch (cls.kind) {
+      case "untouched":
+        lines.push(encodeRule(plan, lay, invariants, (enab, upd) => uncolouredIncidence(lay, plan, ft, enab, upd)));
+        break;
+      case "mint":
+        for (let c = 0; c < k; c++) {
+          lines.push(encodeRule(plan, lay, invariants, (enab, upd) => {
+            uncolouredIncidence(lay, plan, ft, enab, upd);
+            for (const q of plan.coloured) enab.push(`(= ${lay.cur[lay.colCol[q][c]]} 0)`);
+            for (const o of cls.colouredOut) {
+              const col = lay.colCol[o][c];
+              upd.push({ col, expr: `(+ ${lay.cur[col]} 1)` });
+            }
+          }));
+        }
+        break;
+      case "join":
+        for (let c = 0; c < k; c++) {
+          lines.push(encodeRule(plan, lay, invariants, (enab, upd) => {
+            uncolouredIncidence(lay, plan, ft, enab, upd);
+            for (const ip of cls.colouredIn) {
+              const col = lay.colCol[ip][c];
+              enab.push(`(>= ${lay.cur[col]} 1)`);
+              upd.push({ col, expr: `(- ${lay.cur[col]} 1)` });
+            }
+          }));
+        }
+        break;
+      case "consume":
+        for (let c = 0; c < k; c++) {
+          lines.push(encodeRule(plan, lay, invariants, (enab, upd) => {
+            uncolouredIncidence(lay, plan, ft, enab, upd);
+            const icol = lay.colCol[cls.inputCol][c];
+            enab.push(`(>= ${lay.cur[icol]} 1)`);
+            upd.push({ col: icol, expr: `(- ${lay.cur[icol]} 1)` });
+            for (const o of cls.colouredOut) {
+              const ocol = lay.colCol[o][c];
+              upd.push({ col: ocol, expr: `(+ ${lay.cur[ocol]} 1)` });
+            }
+          }));
+        }
+        break;
     }
   }
-  if (!addErrorRule(ctx, fp, reachable, error, lay, plan, flat, property, sinkPlaces)) {
-    return null;
-  }
-  return {
-    errorExpr: error.call(),
-    reachableDecl: reachable
-  };
+  lines.push("");
+  const error = encodeError(plan, lay, flat, property, sinkPlaces, injectionMap(flat));
+  if (error == null) return null;
+  lines.push(error);
+  lines.push("");
+  lines.push("(assert (not Error))");
+  lines.push("(check-sat)");
+  return { smt2: lines.join("\n"), placeCount: P };
 }
-function addRule(ctx, fp, reachable, lay, plan, invariants, ruleName, fill) {
+function encodeRule(plan, lay, invariants, fill) {
   const enab = [];
-  const upd = /* @__PURE__ */ new Map();
+  const upd = [];
   fill(enab, upd);
-  const conds = [reachable.call(...lay.cur), ...enab];
-  for (let col = 0; col < lay.nCols; col++) {
-    const expr = upd.get(col);
-    if (expr !== void 0) {
-      conds.push(lay.nxt[col].eq(expr), lay.nxt[col].ge(0));
+  const conditions = [`(Reachable ${lay.cur.join(" ")})`, ...enab];
+  const changed = new Array(lay.cur.length).fill(null);
+  for (const u of upd) changed[u.col] = u.expr;
+  for (let col = 0; col < lay.cur.length; col++) {
+    const expr = changed[col];
+    if (expr != null) {
+      conditions.push(`(= ${lay.nxt[col]} ${expr})`);
+      conditions.push(`(>= ${lay.nxt[col]} 0)`);
     } else {
-      conds.push(lay.nxt[col].eq(lay.cur[col]));
+      conditions.push(`(= ${lay.nxt[col]} ${lay.cur[col]})`);
     }
   }
   for (const inv of invariants) {
-    const eq = liftedInvariant(ctx, inv, plan, lay, lay.nxt);
-    if (eq) conds.push(eq);
+    const eq = liftedInvariant(inv, plan, lay, lay.nxt);
+    if (eq != null) conditions.push(eq);
   }
-  const body = ctx.And(...conds);
-  const head = reachable.call(...lay.nxt);
-  const qRule = ctx.ForAll([...lay.cur, ...lay.nxt], ctx.Implies(body, head));
-  fp.addRule(qRule, ruleName);
+  const body = `(and ${conditions.join("\n            ")})`;
+  return `(assert (forall (${quantified2([...lay.cur, ...lay.nxt])})
+  (=> ${body}
+      (Reachable ${lay.nxt.join(" ")}))))`;
 }
-function uncolouredIncidence(ctx, lay, plan, ft, enab, upd) {
+function uncolouredIncidence(lay, plan, ft, enab, upd) {
   const P = ft.preVector.length;
   for (let i = 0; i < P; i++) {
     if (plan.isColoured[i]) continue;
     const col = lay.colUnc[i];
     const pre = ft.preVector[i];
-    if (pre > 0) enab.push(lay.cur[col].ge(pre));
+    if (pre > 0) enab.push(`(>= ${lay.cur[col]} ${pre})`);
     if (ft.resetPlaces.includes(i) || ft.consumeAll[i]) {
-      upd.set(col, ctx.Int.val(ft.postVector[i]));
+      upd.push({ col, expr: String(ft.postVector[i]) });
     } else {
       const delta = ft.postVector[i] - ft.preVector[i];
-      if (delta !== 0) upd.set(col, lay.cur[col].add(delta));
+      if (delta > 0) upd.push({ col, expr: `(+ ${lay.cur[col]} ${delta})` });
+      else if (delta < 0) upd.push({ col, expr: `(- ${lay.cur[col]} ${-delta})` });
     }
   }
-  for (const pid of ft.inhibitorPlaces) enab.push(lay.cur[lay.colUnc[pid]].eq(0));
-  for (const pid of ft.readPlaces) enab.push(lay.cur[lay.colUnc[pid]].ge(1));
+  for (const pid of ft.inhibitorPlaces) enab.push(`(= ${lay.cur[lay.colUnc[pid]]} 0)`);
+  for (const pid of ft.readPlaces) enab.push(`(>= ${lay.cur[lay.colUnc[pid]]} 1)`);
 }
-function aggregate(plan, lay, place, vars) {
+function aggregate(plan, lay, place, names) {
   if (plan.isColoured[place]) {
     const cols = lay.colCol[place];
-    let sum = vars[cols[0]];
-    for (let c = 1; c < cols.length; c++) sum = sum.add(vars[cols[c]]);
-    return sum;
+    if (cols.length === 0) return "0";
+    if (cols.length === 1) return names[cols[0]];
+    return `(+ ${cols.map((c) => names[c]).join(" ")})`;
   }
-  return vars[lay.colUnc[place]];
+  return names[lay.colUnc[place]];
 }
-function liftedInvariant(ctx, inv, plan, lay, vars) {
-  if (inv.support.size === 0) return null;
-  let sum = ctx.Int.val(0);
-  for (const i of inv.support) {
-    const agg = aggregate(plan, lay, i, vars);
+function liftedInvariant(inv, plan, lay, names) {
+  const terms = [];
+  for (const i of [...inv.support].sort((a, b) => a - b)) {
+    const agg = aggregate(plan, lay, i, names);
     const w = inv.weights[i];
-    sum = sum.add(w === 1 ? agg : agg.mul(w));
-  }
-  return sum.eq(inv.constant);
-}
-function addErrorRule(ctx, fp, reachable, error, lay, plan, flat, property, sinkPlaces) {
-  const violation = encodeViolation(ctx, plan, lay, flat, property, lay.cur, sinkPlaces);
-  if (violation === null) return false;
-  const reachBody = reachable.call(...lay.cur);
-  const body = ctx.And(reachBody, violation);
-  const head = error.call();
-  const qRule = ctx.ForAll([...lay.cur], ctx.Implies(body, head));
-  fp.addRule(qRule, "error");
-  return true;
+    terms.push(w === 1 ? agg : `(* ${w} ${agg})`);
+  }
+  if (terms.length === 0) return null;
+  const sum = terms.length === 1 ? terms[0] : `(+ ${terms.join(" ")})`;
+  return `(= ${sum} ${inv.constant})`;
 }
-function encodeViolation(ctx, plan, lay, flat, property, cur, sinkPlaces) {
+function encodeError(plan, lay, flat, property, sinkPlaces, envInj) {
+  const violation = encodeViolation(plan, lay, flat, property, sinkPlaces, envInj);
+  if (violation == null) return null;
+  return `(assert (forall (${quantified2(lay.cur)})
+  (=> (and (Reachable ${lay.cur.join(" ")}) ${violation})
+      Error)))`;
+}
+function encodeViolation(plan, lay, flat, property, sinkPlaces, envInj) {
+  const anyPlacePresent = (places) => {
+    const conds = indexOrdered(flat, places).map((pid) => `(>= ${aggregate(plan, lay, pid, lay.cur)} 1)`);
+    return conds.length === 0 ? "false" : `(and ${conds.join(" ")})`;
+  };
   switch (property.type) {
     case "place-bound":
     case "branch-place-bound": {
-      const idx = flatNetIndexOf(flat, property.place);
-      if (idx < 0) return null;
-      return aggregate(plan, lay, idx, cur).gt(property.bound);
-    }
-    case "mutual-exclusion": {
-      const i1 = flatNetIndexOf(flat, property.p1);
-      const i2 = flatNetIndexOf(flat, property.p2);
-      if (i1 < 0 || i2 < 0) return ctx.Bool.val(false);
-      return ctx.And(aggregate(plan, lay, i1, cur).ge(1), aggregate(plan, lay, i2, cur).ge(1));
-    }
-    case "unreachable": {
-      const conds = [];
-      for (const place of property.places) {
-        const idx = flatNetIndexOf(flat, place);
-        if (idx >= 0) conds.push(aggregate(plan, lay, idx, cur).ge(1));
-      }
-      if (conds.length === 0) return ctx.Bool.val(false);
-      return conds.length === 1 ? conds[0] : ctx.And(...conds);
+      const pid = flat.placeIndex.get(property.place.name);
+      if (pid == null) return null;
+      return `(> ${aggregate(plan, lay, pid, lay.cur)} ${property.bound})`;
     }
+    case "mutual-exclusion":
+      return anyPlacePresent([property.p1, property.p2]);
+    case "unreachable":
+      return anyPlacePresent(property.places);
     case "deadlock-free":
-      return encodeColouredDeadlock(ctx, plan, lay, flat, sinkPlaces);
+      return encodeColouredDeadlock(plan, lay, flat, sinkPlaces, envInj);
     case "joined-or-dead-lettered": {
-      const idx = flatNetIndexOf(flat, property.pending);
-      if (idx < 0) return null;
-      const deadlock = encodeColouredDeadlock(ctx, plan, lay, flat, sinkPlaces);
-      return ctx.And(deadlock, aggregate(plan, lay, idx, cur).ge(1));
+      const pid = flat.placeIndex.get(property.pending.name);
+      if (pid == null) return null;
+      const deadlock = encodeColouredDeadlock(plan, lay, flat, sinkPlaces, envInj);
+      return `(and ${deadlock} (>= ${aggregate(plan, lay, pid, lay.cur)} 1))`;
     }
   }
 }
-function andAll(ctx, xs) {
-  if (xs.length === 0) return ctx.Bool.val(true);
-  let r = xs[0];
-  for (let i = 1; i < xs.length; i++) r = ctx.And(r, xs[i]);
-  return r;
-}
-function orAll(ctx, xs) {
-  if (xs.length === 0) return ctx.Bool.val(false);
-  let r = xs[0];
-  for (let i = 1; i < xs.length; i++) r = ctx.Or(r, xs[i]);
-  return r;
-}
-function injectedEnvIndices2(flat) {
-  const out = /* @__PURE__ */ new Map();
-  for (const [name, bound] of flat.environmentInjection) {
-    const idx = flat.placeIndex.get(name);
-    if (idx != null) out.set(idx, bound);
-  }
-  return out;
-}
-function uncolouredDisable(ft, lay, plan, envInj) {
-  const reasons = [];
+function uncolouredDisable(ft, lay, plan, envInj, reasons) {
   let permanentlyDisabled = false;
   const P = ft.preVector.length;
   for (let i = 0; i < P; i++) {
     if (plan.isColoured[i] || ft.preVector[i] === 0) continue;
     if (envInj.has(i)) {
       const bound = envInj.get(i);
-      if (bound !== null && ft.preVector[i] > bound) permanentlyDisabled = true;
+      if (bound != null && ft.preVector[i] > bound) permanentlyDisabled = true;
       continue;
     }
-    reasons.push(lay.cur[lay.colUnc[i]].lt(ft.preVector[i]));
-  }
-  for (const inh of ft.inhibitorPlaces) {
-    reasons.push(lay.cur[lay.colUnc[inh]].gt(0));
+    reasons.push(`(< ${lay.cur[lay.colUnc[i]]} ${ft.preVector[i]})`);
   }
+  for (const inh of ft.inhibitorPlaces) reasons.push(`(> ${lay.cur[lay.colUnc[inh]]} 0)`);
   for (const rd of ft.readPlaces) {
     if (envInj.has(rd)) {
       const bound = envInj.get(rd);
-      if (bound !== null && bound < 1) permanentlyDisabled = true;
+      if (bound != null && bound < 1) permanentlyDisabled = true;
       continue;
     }
-    reasons.push(lay.cur[lay.colUnc[rd]].lt(1));
+    reasons.push(`(< ${lay.cur[lay.colUnc[rd]]} 1)`);
   }
-  return { reasons, permanentlyDisabled };
+  return permanentlyDisabled;
 }
-function colouredDisabledTerm(ctx, cls, plan, lay) {
+function colouredDisabledTerm(cls, plan, lay) {
   const k = plan.k;
+  if (k === 0) {
+    return cls.kind === "untouched" ? null : "true";
+  }
   switch (cls.kind) {
     case "untouched":
       return null;
     case "mint": {
       const perColour = [];
       for (let c = 0; c < k; c++) {
-        const present = plan.coloured.map((q) => lay.cur[lay.colCol[q][c]].ge(1));
-        perColour.push(orAll(ctx, present));
+        const present = plan.coloured.map((q) => `(>= ${lay.cur[lay.colCol[q][c]]} 1)`);
+        perColour.push(`(or ${present.join(" ")})`);
       }
-      return andAll(ctx, perColour);
+      return `(and ${perColour.join(" ")})`;
     }
     case "join": {
       const perColour = [];
       for (let c = 0; c < k; c++) {
-        const missing = cls.colouredIn.map((i) => lay.cur[lay.colCol[i][c]].eq(0));
-        perColour.push(orAll(ctx, missing));
+        const missing = cls.colouredIn.map((i) => `(= ${lay.cur[lay.colCol[i][c]]} 0)`);
+        perColour.push(`(or ${missing.join(" ")})`);
       }
-      return andAll(ctx, perColour);
+      return `(and ${perColour.join(" ")})`;
     }
     case "consume": {
       const perColour = [];
-      for (let c = 0; c < k; c++) {
-        perColour.push(lay.cur[lay.colCol[cls.inputCol][c]].eq(0));
-      }
-      return andAll(ctx, perColour);
+      for (let c = 0; c < k; c++) perColour.push(`(= ${lay.cur[lay.colCol[cls.inputCol][c]]} 0)`);
+      return `(and ${perColour.join(" ")})`;
     }
   }
 }
-function encodeColouredDeadlock(ctx, plan, lay, flat, sinkPlaces) {
-  const envInj = injectedEnvIndices2(flat);
+function encodeColouredDeadlock(plan, lay, flat, sinkPlaces, envInj) {
   const disabledConditions = [];
   for (let ti = 0; ti < plan.classes.length; ti++) {
     const cls = plan.classes[ti];
     const ft = flat.transitions[ti];
-    const { reasons, permanentlyDisabled } = uncolouredDisable(ft, lay, plan, envInj);
+    const reasons = [];
+    const permanentlyDisabled = uncolouredDisable(ft, lay, plan, envInj, reasons);
     if (permanentlyDisabled) {
-      disabledConditions.push(ctx.Bool.val(true));
+      disabledConditions.push("true");
       continue;
     }
-    const term = colouredDisabledTerm(ctx, cls, plan, lay);
-    if (term !== null) reasons.push(term);
-    if (reasons.length === 0) {
-      return ctx.Bool.val(false);
-    }
-    disabledConditions.push(reasons.length === 1 ? reasons[0] : orAll(ctx, reasons));
+    const term = colouredDisabledTerm(cls, plan, lay);
+    if (term != null) reasons.push(term);
+    if (reasons.length === 0) return "false";
+    disabledConditions.push(reasons.length === 1 ? reasons[0] : `(or ${reasons.join(" ")})`);
   }
-  const sinkIndices = /* @__PURE__ */ new Set();
-  for (const sink of sinkPlaces) {
-    const idx = flatNetIndexOf(flat, sink);
-    if (idx >= 0) sinkIndices.add(idx);
-  }
-  if (sinkIndices.size > 0) {
-    const nonSink = [];
-    for (let pid = 0; pid < flat.places.length; pid++) {
-      if (sinkIndices.has(pid)) continue;
-      nonSink.push(aggregate(plan, lay, pid, lay.cur).ge(1));
-    }
-    if (nonSink.length > 0) {
-      disabledConditions.push(orAll(ctx, nonSink));
-    }
+  for (const pid of indexOrdered(flat, sinkPlaces)) {
+    disabledConditions.push(`(= ${aggregate(plan, lay, pid, lay.cur)} 0)`);
   }
-  return andAll(ctx, disabledConditions);
+  return disabledConditions.length === 0 ? "true" : `(and ${disabledConditions.join(" ")})`;
 }
 
 // src/verification/analysis/name-fragment.ts
@@ -2366,9 +3064,9 @@ function classify(net, mode, carrierPlaces) {
     role: (tn) => roles.get(tn) ?? { type: "ordinary" }
   };
 }
-function fixedRequiredCount(t, placeName) {
+function fixedRequiredCount(t, placeName2) {
   for (const spec of t.inputSpecs) {
-    if (spec.place.name === placeName) {
+    if (spec.place.name === placeName2) {
       switch (spec.type) {
         case "one":
           return 1;
@@ -2478,13 +3176,21 @@ function compareNumberArrays(a, b) {
 var NameStateClass = class {
   base;
   names;
-  key;
-  constructor(base, names, colouredOrder) {
+  /** The symmetry-canonical name-partition key (the name layer's intern key). */
+  nameKey;
+  constructor(base, names, colouredOrder, nameKey) {
     this.base = base;
     this.names = names;
-    this.key = `${base.marking.toString()}|${base.firingDomain.toString()}||${names.canonicalKey(colouredOrder)}`;
+    this.nameKey = nameKey ?? names.canonicalKey(colouredOrder);
+  }
+  /** Full dedup key: the base key (marking + DBM zone) joined with the name key. */
+  get key() {
+    return `${baseKeyOf(this.base)}||${this.nameKey}`;
   }
 };
+function baseKeyOf(base) {
+  return `${base.marking.toString()}|${base.firingDomain.toString()}`;
+}
 
 // src/verification/analysis/name-state-class-graph.ts
 var NameStateClassGraph = class _NameStateClassGraph {
@@ -2513,9 +3219,16 @@ var NameStateClassGraph = class _NameStateClassGraph {
     }
     const graph = new _NameStateClassGraph();
     const base0 = initialStateClass(net, initialMarking, envPlaces, envMode);
-    const initial = new NameStateClass(base0, new NameMarking(), fragment.colouredOrder);
+    const baseIntern = /* @__PURE__ */ new Map();
+    const nameIntern = /* @__PURE__ */ new Map();
     const indexOf = /* @__PURE__ */ new Map();
-    graph.pushClass(initial, indexOf);
+    const b0 = internBase(baseIntern, base0);
+    const n0 = internNames(nameIntern, new NameMarking(), fragment.colouredOrder);
+    graph.pushClass(
+      new NameStateClass(b0.base, n0.names, fragment.colouredOrder, n0.nameKey),
+      classId(b0.id, n0.id),
+      indexOf
+    );
     const sym = { next: 0 };
     const queue = [0];
     while (queue.length > 0) {
@@ -2544,12 +3257,18 @@ var NameStateClassGraph = class _NameStateClassGraph {
           const baseSucc = computeSuccessor(net, current.base, vt, envPlaces, envMode);
           if (baseSucc === null || baseSucc.isEmpty()) continue;
           const nameSuccs = nameSuccessors(role, current.names, vt.outputPlaces, fragment, sym);
+          const shared = internBase(baseIntern, baseSucc);
           for (const nm of nameSuccs) {
-            const succ = new NameStateClass(baseSucc, nm, fragment.colouredOrder);
-            let toIdx = indexOf.get(succ.key);
+            const sharedNames = internNames(nameIntern, nm, fragment.colouredOrder);
+            const id = classId(shared.id, sharedNames.id);
+            let toIdx = indexOf.get(id);
             if (toIdx === void 0) {
               toIdx = graph.classes.length;
-              graph.pushClass(succ, indexOf);
+              graph.pushClass(
+                new NameStateClass(shared.base, sharedNames.names, fragment.colouredOrder, sharedNames.nameKey),
+                id,
+                indexOf
+              );
               queue.push(toIdx);
             }
             graph.addEdge(curIdx, toIdx, transition.name);
@@ -2559,17 +3278,38 @@ var NameStateClassGraph = class _NameStateClassGraph {
     }
     return graph;
   }
-  pushClass(c, indexOf) {
+  pushClass(c, id, indexOf) {
     const idx = this.classes.length;
     this.classes.push(c);
     this._successors.push([]);
-    indexOf.set(c.key, idx);
+    indexOf.set(id, idx);
   }
   addEdge(from, to, name) {
     this.edges.push({ from, to, transitionName: name });
     this._successors[from].push(to);
   }
 };
+function classId(baseId, nameId) {
+  return `${baseId}:${nameId}`;
+}
+function internBase(intern, base) {
+  const key = `${baseKeyOf(base)}#${base.readyEarliest.join(",")}`;
+  let entry = intern.get(key);
+  if (entry === void 0) {
+    entry = { id: intern.size, base };
+    intern.set(key, entry);
+  }
+  return entry;
+}
+function internNames(intern, names, colouredOrder) {
+  const nameKey = names.canonicalKey(colouredOrder);
+  let entry = intern.get(nameKey);
+  if (entry === void 0) {
+    entry = { id: intern.size, names, nameKey };
+    intern.set(nameKey, entry);
+  }
+  return entry;
+}
 var READY_EPS = 1e-9;
 function priorityDominated(l, idxL, enabled, readyEarliest, marking, names, fragment) {
   return enabled.some(
@@ -2602,10 +3342,10 @@ function sharesConsumedInput(h, l, marking) {
   }
   return false;
 }
-function consumedDemand(t, placeName) {
+function consumedDemand(t, placeName2) {
   let demand = 0;
   for (const spec of t.inputSpecs) {
-    if (spec.place.name === placeName) demand += inputRequiredCount2(spec);
+    if (spec.place.name === placeName2) demand += inputRequiredCount2(spec);
   }
   return demand;
 }
@@ -2792,6 +3532,7 @@ var SmtVerifier = class _SmtVerifier {
   constructor(net) {
     this.net = net;
   }
+  net;
   _initialMarking = MarkingState.empty();
   _property = deadlockFree();
   _environmentPlaces = /* @__PURE__ */ new Set();
@@ -2799,6 +3540,9 @@ var SmtVerifier = class _SmtVerifier {
   _budgetPlaces = /* @__PURE__ */ new Set();
   _environmentMode = alwaysAvailable();
   _timeoutMs = 6e4;
+  _certificateCheck = true;
+  _counterexampleReplay = true;
+  _semiflowInvariants = false;
   _nuMaxClasses = 1e5;
   _fragmentMode = "base";
   _carrierPlaces = /* @__PURE__ */ new Set();
@@ -2852,6 +3596,58 @@ var SmtVerifier = class _SmtVerifier {
     this._timeoutMs = ms;
     return this;
   }
+  /**
+   * Enables/disables the independent IC3 certificate check (default: enabled).
+   *
+   * When a proven verdict comes from the IC3/Spacer path on the flat count
+   * encoding, the synthesized inductive invariant is re-validated with a plain
+   * solver against the UNSTRENGTHENED step relation — VC1 (init), VC2
+   * (consecution), VC3 (safety) — so a Spacer or encoder defect cannot certify
+   * a false PROVEN. A certificate that fails validation downgrades the verdict
+   * to unknown. Structural proofs and the coloured ν-encoding are unaffected.
+   */
+  certificateCheck(enabled) {
+    this._certificateCheck = enabled;
+    return this;
+  }
+  /**
+   * Enables/disables abstract counterexample replay (default: enabled).
+   *
+   * When a violated verdict comes from the flat count encoding, the decoded
+   * counterexample states (an order-free set — the derivation tree is walked in
+   * traversal order, not firing order) are re-executed TS-side against the
+   * abstract semantics the encoder emits (Lean's `fireA`, Basic.lean), searching
+   * for a firing order from M₀ to a property-violating marking. See
+   * `SmtVerificationResult.counterexampleConfirmed` for how each outcome lands.
+   */
+  counterexampleReplay(enabled) {
+    this._counterexampleReplay = enabled;
+    return this;
+  }
+  /**
+   * Also hands the validated **P-semiflows** to the encoders as invariants
+   * (VER-007; default: disabled — the encoders then see only the null-space basis).
+   *
+   * Every validated semiflow is a conservation law in its own right (`y >= 0`,
+   * `y·C = 0`, `y·M0` exact, zero weight on every reset / consume-all place), and
+   * the Farkas enumeration returns the *minimal* laws of the net. The null-space
+   * basis the encoders get by default is one basis of many: elimination hands back
+   * mixed-sign rows (discarded as not semi-positive) or rows that fold a reset place
+   * into a chain whose other combinations avoid it (dropped by the H1 guard). On a
+   * net with a few reset arcs that can lose every law of the chains those arcs
+   * touch, and without them IC3 has to rediscover the conservation of each chain —
+   * on a ~100-place net it does not within any practical budget. With the semiflows
+   * in, the same reachability-safety queries close in about a second.
+   *
+   * Soundness is unchanged: the semiflows pass the same exact re-validation as the
+   * basis rows, the union is pure strengthening (`Semiflow.lean`,
+   * `semiflow_union_sound`), and the certificate check re-proves the strengthened
+   * invariant. Off by default so reports stay byte-equal.
+   */
+  semiflowInvariants(enabled) {
+    this._semiflowInvariants = enabled;
+    return this;
+  }
   /**
    * Sets the class-count cap for the ν-aware state-class-graph analysis (NU-050,
    * Route B). When the symbolic name-aware graph would exceed this, the analysis
@@ -2906,6 +3702,62 @@ var SmtVerifier = class _SmtVerifier {
     this._prioritySemantics = semantics;
     return this;
   }
+  /**
+   * The SMT-LIB2 scripts {@link verify} would send to z3 for this configuration,
+   * without running a solver (VER-013 AC1): the HORN query (flat, or name-coloured
+   * when a declared budget puts the net on Route A's exact encoding) and, for the
+   * flat encoding, the certificate-check script built around
+   * {@link placeholderCertificate}. This is what the cross-language golden tests diff
+   * byte for byte. Route B, the structural pre-check and the unresolved-place
+   * refusal are bypassed: it is what Route A encodes.
+   */
+  encodeScripts() {
+    requireOutputProducingActions(this.net);
+    const hasMatch = [...this.net.transitions].some((t) => t.matchSpec !== null);
+    const nuBounded = this._budgetPlaces.size > 0;
+    const flatNet = flatten(this.net, this._environmentPlaces, this._environmentMode);
+    const matrix = IncidenceMatrix.from(flatNet);
+    const { valid: basis } = validateInvariantsExact(
+      matrix,
+      computePInvariants(matrix, flatNet, this._initialMarking),
+      flatNet,
+      this._initialMarking
+    );
+    const { valid: semiflows } = validateInvariantsExact(
+      matrix,
+      computePSemiflows(matrix, flatNet, this._initialMarking),
+      flatNet,
+      this._initialMarking
+    );
+    let invariants = basis;
+    if (this._semiflowInvariants) invariants = strengthenWithSemiflows(basis, semiflows).invariants;
+    invariants = canonicalInvariantOrder(invariants);
+    if (hasMatch && nuBounded) {
+      const plan = buildColouredPlan(
+        this.net,
+        flatNet,
+        this._initialMarking,
+        this._budgetPlaces,
+        this._fragmentMode,
+        this._carrierPlaces,
+        semiflows
+      );
+      if (plan != null) {
+        const coloured = encodeColoured(plan, flatNet, this._initialMarking, this._property, invariants, this._sinkPlaces);
+        if (coloured != null) return { horn: coloured.smt2, certificate: null, coloured: true };
+      }
+    }
+    const horn = encode(flatNet, this._initialMarking, this._property, invariants, this._sinkPlaces, this._counterexampleReplay).smt2;
+    const certificate = vcScript(
+      placeholderCertificate(flatNet.places.length),
+      flatNet,
+      this._initialMarking,
+      this._property,
+      this._sinkPlaces,
+      invariants
+    );
+    return { horn, certificate, coloured: false };
+  }
   /**
    * Runs the verification pipeline.
    *
@@ -2998,6 +3850,7 @@ var SmtVerifier = class _SmtVerifier {
       report.push("=== RESULT ===\n");
       report.push("PROVEN (structural): Deadlock-freedom verified by Commoner's theorem.");
       report.push("  All siphons contain initially marked traps.");
+      report.push("  Certificate check: not applicable (structural proof)");
       return buildResult(
         { type: "proven", method: "structural", inductiveInvariant: null },
         report.join("\n"),
@@ -3011,14 +3864,43 @@ var SmtVerifier = class _SmtVerifier {
     }
     report.push("Phase 3: Computing P-invariants...");
     const matrix = IncidenceMatrix.from(flatNet);
-    const invariants = computePInvariants(matrix, flatNet, this._initialMarking);
-    const semiflows = computePSemiflows(matrix, flatNet, this._initialMarking);
-    report.push(`  Found: ${invariants.length} P-invariant(s)`);
+    const { valid: basisInvariants, dropped: droppedInvariants } = validateInvariantsExact(
+      matrix,
+      computePInvariants(matrix, flatNet, this._initialMarking),
+      flatNet,
+      this._initialMarking
+    );
+    const { valid: semiflows, dropped: droppedSemiflows } = validateInvariantsExact(
+      matrix,
+      computePSemiflows(matrix, flatNet, this._initialMarking),
+      flatNet,
+      this._initialMarking
+    );
+    report.push(`  Found: ${basisInvariants.length} P-invariant(s)`);
+    let invariants = basisInvariants;
+    if (this._semiflowInvariants) {
+      const { invariants: strengthened, added } = strengthenWithSemiflows(basisInvariants, semiflows);
+      invariants = strengthened;
+      report.push(`  Semiflows encoded as invariants: ${added}`);
+    }
+    invariants = canonicalInvariantOrder(invariants);
     const structurallyBounded = isCoveredByInvariants(invariants, flatNet.places.length);
     report.push(`  Structurally bounded: ${structurallyBounded ? "YES" : "NO"}`);
     for (const inv of invariants) {
       report.push(`  ${formatInvariant(inv, flatNet)}`);
     }
+    for (const { invariant, reason } of droppedInvariants) {
+      report.push(`  Dropped invariant: ${formatInvariant(invariant, flatNet)} - ${reason}`);
+    }
+    if (droppedInvariants.length > 0) {
+      report.push(`  Dropped: ${droppedInvariants.length} invariant(s) failed the exact re-check`);
+    }
+    for (const { invariant, reason } of droppedSemiflows) {
+      report.push(`  Dropped semiflow: ${formatInvariant(invariant, flatNet)} - ${reason}`);
+    }
+    if (droppedSemiflows.length > 0) {
+      report.push(`  Dropped: ${droppedSemiflows.length} semiflow(s) failed the exact re-check`);
+    }
     report.push("");
     report.push("Phase 4: IC3/PDR verification via Z3 Spacer...");
     const colouredPlan = hasMatch && nuBounded ? buildColouredPlan(
@@ -3030,173 +3912,208 @@ var SmtVerifier = class _SmtVerifier {
       this._carrierPlaces,
       semiflows
     ) : null;
-    let runner;
+    const stats = {
+      places: flatNet.places.length,
+      transitions: flatNet.transitions.length,
+      invariantsFound: invariants.length,
+      structuralResult: structResultStr
+    };
+    let solver;
     try {
-      runner = await createSpacerRunner(this._timeoutMs);
+      solver = resolveZ3();
     } catch (e) {
-      report.push(`  ERROR: ${e.message ?? e}
+      const reason = e instanceof Z3Unavailable ? e.message : String(e?.message ?? e);
+      report.push(`  Solver: z3 unavailable (${reason})`);
+      report.push(`  Status: UNKNOWN (${reason})
 `);
       report.push("=== RESULT ===\n");
-      report.push(`UNKNOWN: Z3 initialization error: ${e.message ?? e}`);
-      return buildResult(
-        { type: "unknown", reason: `Z3 init error: ${e.message ?? e}` },
-        report.join("\n"),
-        invariants,
-        [],
-        [],
-        [],
-        performance.now() - start,
-        { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: invariants.length, structuralResult: structResultStr }
+      report.push(`UNKNOWN: Could not determine ${propDesc}`);
+      report.push(`  Reason: ${reason}`);
+      return buildResult({ type: "unknown", reason }, report.join("\n"), invariants, [], [], [], performance.now() - start, stats);
+    }
+    report.push(`  Solver: z3 ${formatZ3Version(solver.version)}`);
+    let encoding;
+    if (colouredPlan != null) {
+      report.push(
+        `  \u03BD-encoding: name-coloured (exact within budget k=${colouredPlan.k}; ${colouredPlan.coloured.length} coloured place(s))`
       );
+      const coloured = encodeColoured(colouredPlan, flatNet, this._initialMarking, this._property, invariants, this._sinkPlaces);
+      if (coloured == null) {
+        const reason = "property names a place that does not resolve in the net; refusing to certify (the encoding would be vacuously proven)";
+        report.push("  Status: UNKNOWN (unresolved property place)\n");
+        report.push("=== RESULT ===\n");
+        report.push(`UNKNOWN: ${reason}`);
+        return buildResult({ type: "unknown", reason }, report.join("\n"), invariants, [], [], [], performance.now() - start, stats);
+      }
+      encoding = coloured;
+    } else {
+      const unresolved = unresolvedPropertyPlace(flatNet, this._property);
+      if (unresolved != null) {
+        const reason = `property names a place that does not resolve in the net ('${unresolved}'); refusing to certify (the encoding would be vacuously proven)`;
+        report.push("  Status: UNKNOWN (unresolved property place)\n");
+        report.push("=== RESULT ===\n");
+        report.push(`UNKNOWN: ${reason}`);
+        return buildResult({ type: "unknown", reason }, report.join("\n"), invariants, [], [], [], performance.now() - start, stats);
+      }
+      encoding = encode(flatNet, this._initialMarking, this._property, invariants, this._sinkPlaces, this._counterexampleReplay);
     }
-    try {
-      let encoding;
-      if (colouredPlan != null) {
-        report.push(
-          `  \u03BD-encoding: name-coloured (exact within budget k=${colouredPlan.k}; ${colouredPlan.coloured.length} coloured place(s))`
-        );
-        encoding = encodeColoured(runner.ctx, runner.fp, colouredPlan, flatNet, this._initialMarking, this._property, invariants, this._sinkPlaces);
-        if (encoding == null) {
-          const reason = "property names a place that does not resolve in the net; refusing to certify (the encoding would be vacuously proven)";
-          report.push("  Status: UNKNOWN (unresolved property place)\n");
+    const queryResult = await runZ3Spacer(
+      solver,
+      this._timeoutMs,
+      encoding.smt2,
+      colouredPlan != null ? "horn-coloured" : "horn"
+    );
+    switch (queryResult.type) {
+      case "proven": {
+        if (this._environmentPlaces.size > 0 && this._environmentMode.type === "ignore") {
+          const reason = "environment places present but not modeled (mode=ignore); a proof would be vacuous \u2014 use alwaysAvailable() or bounded(k) to model external injection";
+          report.push(`  Status: UNSAT, but vacuous under ignore mode
+`);
           report.push("=== RESULT ===\n");
           report.push(`UNKNOWN: ${reason}`);
-          return buildResult(
-            { type: "unknown", reason },
-            report.join("\n"),
+          return buildResult({ type: "unknown", reason }, report.join("\n"), invariants, [], [], [], performance.now() - start, stats);
+        }
+        report.push("  Status: UNSAT (property holds)");
+        if (colouredPlan != null) {
+          report.push("  Certificate check: not applicable (name-coloured encoding)");
+        } else if (!this._certificateCheck) {
+          report.push("  Certificate check: not applicable (disabled)");
+        } else {
+          const certificate = await checkCertificate(
+            queryResult.invariantFormula,
+            flatNet,
+            this._initialMarking,
+            this._property,
             invariants,
-            [],
-            [],
-            [],
-            performance.now() - start,
-            { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: invariants.length, structuralResult: structResultStr }
+            this._sinkPlaces,
+            solver,
+            this._timeoutMs
           );
-        }
-      } else {
-        encoding = encode(runner.ctx, runner.fp, flatNet, this._initialMarking, this._property, invariants, this._sinkPlaces);
-      }
-      const queryResult = await runner.query(encoding.errorExpr, encoding.reachableDecl);
-      switch (queryResult.type) {
-        case "proven": {
-          if (this._environmentPlaces.size > 0 && this._environmentMode.type === "ignore") {
-            const reason = "environment places present but not modeled (mode=ignore); a proof would be vacuous \u2014 use alwaysAvailable() or bounded(k) to model external injection";
-            report.push(`  Status: UNSAT, but vacuous under ignore mode
-`);
+          const reason = certificateDowngradeReason(certificate);
+          if (reason != null) {
+            report.push("  Certificate check: FAILED");
+            if (certificate.type !== "passed" && certificate.invariant != null) {
+              report.push("  Uncertified invariant:");
+              for (const line of certificate.invariant.split("\n")) report.push(`    ${line}`);
+            }
+            report.push("");
             report.push("=== RESULT ===\n");
             report.push(`UNKNOWN: ${reason}`);
+            return buildResult({ type: "unknown", reason }, report.join("\n"), invariants, [], [], [], performance.now() - start, stats);
+          }
+          report.push("  Certificate check: PASSED (init, consecution, safety)");
+        }
+        report.push("");
+        const formula = queryResult.invariantFormula;
+        const discoveredInvariants = formula != null ? [formula] : [];
+        if (formula != null) {
+          report.push("Phase 5: Inductive invariant (discovered by IC3)");
+          report.push("  Spacer synthesized:");
+          for (const line of formula.split("\n")) report.push(`    ${line}`);
+          report.push("  This formula is INDUCTIVE: preserved by all transitions.");
+          report.push("");
+        }
+        report.push("=== RESULT ===\n");
+        report.push(`PROVEN (IC3/PDR): ${propDesc}`);
+        report.push("  Z3 Spacer proved no reachable state violates the property.");
+        report.push("  NOTE: Verification ignores timing constraints.");
+        report.push("  An untimed proof is STRONGER than a timed one (timing only restricts behavior).");
+        return this.applyNuGuard(buildResult(
+          { type: "proven", method: "IC3/PDR", inductiveInvariant: formula },
+          report.join("\n"),
+          invariants,
+          discoveredInvariants,
+          [],
+          [],
+          performance.now() - start,
+          stats
+        ), hasMatch, nuBounded, colouredPlan != null);
+      }
+      case "violated": {
+        report.push("  Status: SAT (counterexample found)\n");
+        const decoded = decode(queryResult.answer, flatNet);
+        if (decoded.note != null) report.push(`  Counterexample decoding: ${decoded.note}`);
+        let confirmed = null;
+        let trace = [...decoded.states];
+        let transitions = [];
+        let replayed = false;
+        if (colouredPlan == null && this._counterexampleReplay) {
+          const assessment = assessCounterexample(
+            flatNet,
+            this._initialMarking,
+            decoded.states,
+            this._property,
+            this._sinkPlaces
+          );
+          if (assessment.kind === "confirmed") {
+            confirmed = true;
+            replayed = true;
+            trace = assessment.trace;
+            transitions = assessment.firings;
+            report.push("  Counterexample replay: CONFIRMED (abstract chain M0 -> bad re-executed)");
+          } else if (assessment.kind === "unconfirmed") {
+            confirmed = false;
+            report.push(`  Counterexample replay: UNCONFIRMED (${assessment.note})`);
+            report.push("  The verdict rests on Spacer's answer.");
+          } else {
+            report.push("  Counterexample replay: FAILED");
+            report.push(`  Decoded states (order-free set, ${decoded.states.size}):`);
+            for (const m of decoded.states) report.push(`    ${m}`);
+            report.push(`  Raw Z3 answer: ${truncate(queryResult.answer, 2e3)}`);
+            report.push("");
+            report.push("=== RESULT ===\n");
+            report.push(`UNKNOWN: ${assessment.reason}`);
             return buildResult(
-              { type: "unknown", reason },
+              { type: "unknown", reason: assessment.reason },
               report.join("\n"),
               invariants,
               [],
               [],
               [],
               performance.now() - start,
-              { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: invariants.length, structuralResult: structResultStr }
+              stats,
+              false
             );
           }
-          report.push("  Status: UNSAT (property holds)\n");
-          const discoveredInvariants = [];
-          if (queryResult.invariantFormula != null) {
-            discoveredInvariants.push(substituteNames(queryResult.invariantFormula, flatNet));
-          }
-          for (const level of queryResult.levelInvariants) {
-            discoveredInvariants.push(substituteNames(level, flatNet));
-          }
-          if (discoveredInvariants.length > 0) {
-            report.push("Phase 5: Inductive invariant (discovered by IC3)");
-            report.push(`  Spacer synthesized: ${discoveredInvariants[0]}`);
-            report.push("  This formula is INDUCTIVE: preserved by all transitions.");
-            if (discoveredInvariants.length > 1) {
-              report.push("  Per-level clauses:");
-              for (let i = 1; i < discoveredInvariants.length; i++) {
-                report.push(`    ${discoveredInvariants[i]}`);
-              }
-            }
-            report.push("");
-          }
-          report.push("=== RESULT ===\n");
-          report.push(`PROVEN (IC3/PDR): ${propDesc}`);
-          report.push("  Z3 Spacer proved no reachable state violates the property.");
-          report.push("  NOTE: Verification ignores timing constraints.");
-          report.push("  An untimed proof is STRONGER than a timed one (timing only restricts behavior).");
-          return this.applyNuGuard(buildResult(
-            {
-              type: "proven",
-              method: "IC3/PDR",
-              inductiveInvariant: queryResult.invariantFormula != null ? substituteNames(queryResult.invariantFormula, flatNet) : null
-            },
-            report.join("\n"),
-            invariants,
-            discoveredInvariants,
-            [],
-            [],
-            performance.now() - start,
-            { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: invariants.length, structuralResult: structResultStr }
-          ), hasMatch, nuBounded, colouredPlan != null);
-        }
-        case "violated": {
-          report.push("  Status: SAT (counterexample found)\n");
-          const decoded = decode(runner.ctx, queryResult.answer, flatNet);
-          report.push("=== RESULT ===\n");
-          report.push(`VIOLATED: ${propDesc}`);
-          if (decoded.trace.length > 0) {
-            report.push(`  Counterexample trace (${decoded.trace.length} states):`);
-            for (let i = 0; i < decoded.trace.length; i++) {
-              report.push(`    ${i}: ${decoded.trace[i]}`);
-            }
-          }
-          if (decoded.transitions.length > 0) {
-            report.push(`  Firing sequence: ${decoded.transitions.join(" -> ")}`);
-          }
-          report.push("\n  WARNING: This counterexample is in UNTIMED semantics.");
-          report.push("  It may be spurious if timing constraints prevent this sequence.");
-          return this.applyNuGuard(buildResult(
-            { type: "violated" },
-            report.join("\n"),
-            invariants,
-            [],
-            decoded.trace,
-            decoded.transitions,
-            performance.now() - start,
-            { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: invariants.length, structuralResult: structResultStr }
-          ), hasMatch, nuBounded, colouredPlan != null);
         }
-        case "unknown": {
-          report.push(`  Status: UNKNOWN (${queryResult.reason})
-`);
-          report.push("=== RESULT ===\n");
-          report.push(`UNKNOWN: Could not determine ${propDesc}`);
-          report.push(`  Reason: ${queryResult.reason}`);
-          return buildResult(
-            { type: "unknown", reason: queryResult.reason },
-            report.join("\n"),
-            invariants,
-            [],
-            [],
-            [],
-            performance.now() - start,
-            { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: invariants.length, structuralResult: structResultStr }
-          );
+        report.push("=== RESULT ===\n");
+        report.push(`VIOLATED: ${propDesc}`);
+        if (trace.length > 0) {
+          report.push(`  Counterexample trace (${replayed ? "replay order, " : "proof order, "}${trace.length} states):`);
+          for (let i = 0; i < trace.length; i++) report.push(`    ${i}: ${trace[i]}`);
         }
+        if (transitions.length > 0) report.push(`  Firing sequence: ${transitions.join(" -> ")}`);
+        report.push("\n  WARNING: This counterexample is in UNTIMED semantics.");
+        report.push("  It may be spurious if timing constraints prevent this sequence.");
+        return this.applyNuGuard(buildResult(
+          { type: "violated" },
+          report.join("\n"),
+          invariants,
+          [],
+          trace,
+          transitions,
+          performance.now() - start,
+          stats,
+          confirmed
+        ), hasMatch, nuBounded, colouredPlan != null);
       }
-    } catch (e) {
-      report.push(`  ERROR: ${e.message ?? e}
+      case "unknown": {
+        report.push(`  Status: UNKNOWN (${queryResult.reason})
 `);
-      report.push("=== RESULT ===\n");
-      report.push(`UNKNOWN: Z3 solver error: ${e.message ?? e}`);
-      return buildResult(
-        { type: "unknown", reason: `Z3 error: ${e.message ?? e}` },
-        report.join("\n"),
-        invariants,
-        [],
-        [],
-        [],
-        performance.now() - start,
-        { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: invariants.length, structuralResult: structResultStr }
-      );
-    } finally {
-      runner.dispose();
+        report.push("=== RESULT ===\n");
+        report.push(`UNKNOWN: Could not determine ${propDesc}`);
+        report.push(`  Reason: ${queryResult.reason}`);
+        return buildResult(
+          { type: "unknown", reason: queryResult.reason },
+          report.join("\n"),
+          invariants,
+          [],
+          [],
+          [],
+          performance.now() - start,
+          stats
+        );
+      }
     }
   }
   /**
@@ -3252,6 +4169,57 @@ function isReachabilitySafety(property) {
       return false;
   }
 }
+function assessCounterexample(flatNet, initialMarking, decodedStates, property, sinkPlaces) {
+  if (decodedStates.size === 0) {
+    return {
+      kind: "unconfirmed",
+      note: "no counterexample states could be decoded from the Spacer answer, so the abstract replay could not run"
+    };
+  }
+  let outcome;
+  try {
+    outcome = replayCounterexample(
+      flatNet,
+      vectorize(initialMarking, flatNet),
+      [...decodedStates].map((m) => vectorize(m, flatNet)),
+      property,
+      sinkPlaces
+    );
+  } catch (e) {
+    outcome = { kind: "exhausted", reason: `replay threw: ${e?.message ?? e}`, nodesExplored: 0 };
+  }
+  switch (outcome.kind) {
+    case "confirmed":
+      return {
+        kind: "confirmed",
+        trace: outcome.states.map((s) => toMarkingState(s, flatNet)),
+        firings: outcome.steps.map(stepName)
+      };
+    case "exhausted":
+      return { kind: "unconfirmed", note: `abstract replay did not complete: ${outcome.reason}` };
+    case "no-chain":
+      return {
+        kind: "downgraded",
+        reason: "counterexample replay found no firing chain to the violation under the abstract semantics, so VIOLATED is withheld"
+      };
+  }
+}
+function certificateDowngradeReason(outcome) {
+  switch (outcome.type) {
+    case "passed":
+      return null;
+    case "failed":
+      return `certificate check failed: ${outcome.vc} was not UNSAT - ${outcome.detail}; the IC3 certificate could not be independently re-validated against the unstrengthened step relation, so PROVEN is withheld`;
+    case "unavailable":
+      return `certificate check could not run: ${outcome.reason}; PROVEN is withheld without an independently validated certificate`;
+  }
+}
+function placeholderCertificate(placeCount) {
+  const params = [];
+  for (let i = 0; i < placeCount; i++) params.push(`(x!${i} Int)`);
+  return `(define-fun Reachable (${params.join(" ")}) Bool
+    true)`;
+}
 function downgradeToUnknown(result, reason) {
   return {
     ...result,
@@ -3261,14 +4229,34 @@ Downgraded to UNKNOWN: ${reason}
 `,
     discoveredInvariants: [],
     counterexampleTrace: [],
-    counterexampleTransitions: []
+    counterexampleTransitions: [],
+    counterexampleConfirmed: null
   };
 }
-function substituteNames(formula, flatNet) {
-  for (let i = flatNet.places.length - 1; i >= 0; i--) {
-    formula = formula.replace(new RegExp(`\\bm${i}\\b`, "g"), flatNet.places[i].name);
+function truncate(s, max) {
+  return s.length <= max ? s : `${s.slice(0, max)}\u2026 (${s.length - max} chars truncated)`;
+}
+function unresolvedPropertyPlace(flatNet, property) {
+  const named = (() => {
+    switch (property.type) {
+      case "deadlock-free":
+        return [];
+      case "mutual-exclusion":
+        return [property.p1, property.p2];
+      case "place-bound":
+        return [property.place];
+      case "branch-place-bound":
+        return [property.place];
+      case "unreachable":
+        return [...property.places];
+      case "joined-or-dead-lettered":
+        return [property.pending];
+    }
+  })();
+  for (const place of named) {
+    if (!flatNet.placeIndex.has(place.name)) return place.name;
   }
-  return formula;
+  return null;
 }
 function formatInvariant(inv, flatNet) {
   const parts = [];
@@ -3279,10 +4267,10 @@ function formatInvariant(inv, flatNet) {
       parts.push(flatNet.places[idx].name);
     }
   }
-  return `${parts.join(" + ")} = ${inv.constant}`;
+  return `${parts.length === 0 ? "0" : parts.join(" + ")} = ${inv.constant}`;
 }
-function buildResult(verdict, report, invariants, discoveredInvariants, trace, transitions, elapsedMs, statistics) {
-  return { verdict, report, invariants, discoveredInvariants, counterexampleTrace: trace, counterexampleTransitions: transitions, elapsedMs, statistics };
+function buildResult(verdict, report, invariants, discoveredInvariants, trace, transitions, elapsedMs, statistics, counterexampleConfirmed = null) {
+  return { verdict, report, invariants, discoveredInvariants, counterexampleTrace: trace, counterexampleTransitions: transitions, counterexampleConfirmed, elapsedMs, statistics };
 }
 
 // src/verification/smt-verification-result.ts
@@ -3336,23 +4324,42 @@ export {
   pInvariant,
   pInvariantToString,
   computePInvariants,
+  strengthenWithSemiflows,
   computePSemiflows,
   isCoveredByInvariants,
+  canonicalInvariantOrder,
   structuralCheck,
   findMinimalSiphons,
   findMaximalTrapIn,
-  createSpacerRunner,
-  flatNetPlaceCount,
-  flatNetTransitionCount,
-  flatNetIndexOf,
+  Z3_ENV,
+  DUMP_ENV,
+  MIN_Z3_VERSION,
+  parseZ3Version,
+  formatZ3Version,
+  Z3Unavailable,
+  Z3ProcessError,
+  z3SolverAt,
+  resolveZ3,
+  z3Available,
+  runZ3Text,
+  runZ3Spacer,
   encode,
+  encodeStepRelationSmt2,
+  checkCertificate,
+  vcScript,
   DBM,
   StateClass,
   requireOutputProducingActions,
   StateClassGraph,
   decode,
+  decodeStateSet,
+  flatNetPlaceCount,
+  flatNetTransitionCount,
+  flatNetIndexOf,
+  replayCounterexample,
   SmtVerifier,
+  placeholderCertificate,
   isProven,
   isViolated
 };
-//# sourceMappingURL=chunk-5W6SVYPD.js.map
+//# sourceMappingURL=chunk-WYCGGQAW.js.map