libpetri 3.0.1 → 4.1.0

package/dist/{chunk-JZIEWVAV.js → chunk-FD3S4TZM.js}

@@ -409,7 +409,7 @@ function flatten(net, environmentPlaces = /* @__PURE__ */ new Set(), environment
     for (const arc of t.reads) allPlacesSet.set(arc.place.name, arc.place);
     for (const arc of t.resets) allPlacesSet.set(arc.place.name, arc.place);
   }
-  const places = [...allPlacesSet.values()].sort((a, b) => a.name.localeCompare(b.name));
+  const places = [...allPlacesSet.values()].sort((a, b) => compareCodePoints(a.name, b.name));
   const placeIndex = /* @__PURE__ */ new Map();
   for (let i = 0; i < places.length; i++) {
     placeIndex.set(places[i].name, i);
@@ -497,6 +497,20 @@ function enumerateOutputBranches(t) {
   }
   return [/* @__PURE__ */ new Set()];
 }
+function compareCodePoints(a, b) {
+  const ia = a[Symbol.iterator]();
+  const ib = b[Symbol.iterator]();
+  for (; ; ) {
+    const na = ia.next();
+    const nb = ib.next();
+    if (na.done && nb.done) return 0;
+    if (na.done) return -1;
+    if (nb.done) return 1;
+    const ca = na.value.codePointAt(0);
+    const cb = nb.value.codePointAt(0);
+    if (ca !== cb) return ca - cb;
+  }
+}
 
 // src/verification/encoding/incidence-matrix.ts
 var IncidenceMatrix = class _IncidenceMatrix {
@@ -666,41 +680,16 @@ function computePInvariants(matrix, flatNet, initialMarking) {
       continue;
     }
     const weights = new Array(P);
-    let allNonNegative = true;
     let hasPositive = false;
+    let hasNegative = false;
     for (let i = 0; i < P; i++) {
       weights[i] = augmented[row][T + i];
-      if (weights[i] < 0) {
-        allNonNegative = false;
-        break;
-      }
       if (weights[i] > 0) hasPositive = true;
+      if (weights[i] < 0) hasNegative = true;
     }
-    if (!allNonNegative) {
-      let allNonPositive = true;
-      for (let i = 0; i < P; i++) {
-        if (augmented[row][T + i] > 0) {
-          allNonPositive = false;
-          break;
-        }
-      }
-      if (allNonPositive) {
-        for (let i = 0; i < P; i++) {
-          weights[i] = -augmented[row][T + i];
-        }
-        hasPositive = true;
-        allNonNegative = true;
-      }
-    }
-    if (!allNonNegative || !hasPositive) continue;
-    let g = 0;
-    for (const w of weights) {
-      if (w > 0) g = gcd(g, w);
-    }
-    if (g > 1) {
-      for (let i = 0; i < P; i++) {
-        weights[i] = weights[i] / g;
-      }
+    if (!hasPositive && !hasNegative) continue;
+    if (!hasPositive) {
+      for (let i = 0; i < P; i++) weights[i] = -weights[i];
     }
     const support = /* @__PURE__ */ new Set();
     let constant = 0;
@@ -814,6 +803,24 @@ function columnName(flatNet, t) {
   const ft = flatNet.transitions[t];
   return ft != null ? `transition '${ft.name}'` : `env-injector column ${t - flatNet.transitions.length}`;
 }
+function sameInvariant(a, b) {
+  if (a.constant !== b.constant || a.weights.length !== b.weights.length) return false;
+  for (let i = 0; i < a.weights.length; i++) {
+    if (a.weights[i] !== b.weights[i]) return false;
+  }
+  return true;
+}
+function strengthenWithSemiflows(invariants, semiflows) {
+  const strengthened = [...invariants];
+  let added = 0;
+  for (const sf of semiflows) {
+    if (!strengthened.some((inv) => sameInvariant(inv, sf))) {
+      strengthened.push(sf);
+      added++;
+    }
+  }
+  return { invariants: strengthened, added };
+}
 function computePSemiflows(matrix, flatNet, initialMarking) {
   const np = matrix.numPlaces();
   const nt = matrix.numTransitions();
@@ -901,6 +908,7 @@ function keepSupportMinimal(rows) {
 function isCoveredByInvariants(invariants, numPlaces) {
   const covered = new Array(numPlaces).fill(false);
   for (const inv of invariants) {
+    if (inv.weights.some((w) => w < 0)) continue;
     for (const idx of inv.support) {
       if (idx < numPlaces) covered[idx] = true;
     }
@@ -928,6 +936,19 @@ function gcd(a, b) {
   }
   return a;
 }
+function canonicalInvariantOrder(invariants) {
+  const lex = (a, b) => {
+    const n = Math.min(a.length, b.length);
+    for (let i = 0; i < n; i++) {
+      if (a[i] !== b[i]) return a[i] - b[i];
+    }
+    return a.length - b.length;
+  };
+  const support = (inv) => [...inv.support].sort((x, y) => x - y);
+  return [...invariants].sort(
+    (a, b) => lex(support(a), support(b)) || lex(a.weights, b.weights) || a.constant - b.constant
+  );
+}
 
 // src/verification/invariant/structural-check.ts
 var MAX_PLACES_FOR_SIPHON_ANALYSIS = 50;
@@ -1090,544 +1111,675 @@ function isSubsetOf(sub, sup) {
   return true;
 }
 
-// src/verification/z3/spacer-runner.ts
-import { init } from "z3-solver";
-async function createSpacerRunner(timeoutMs) {
-  const { Context } = await init();
-  const ctx = new Context("main");
-  const fp = new ctx.Fixedpoint();
-  fp.set("engine", "spacer");
-  if (timeoutMs > 0) {
-    fp.set("timeout", Math.min(timeoutMs, 2147483647));
-  }
-  async function query(errorExpr, reachableDecl) {
-    try {
-      const status = await fp.query(errorExpr);
-      if (status === "unsat") {
-        let invariantFormula = null;
-        let provenAnswer = null;
-        const levelInvariants = [];
-        try {
-          const answer = fp.getAnswer();
-          if (answer != null) {
-            invariantFormula = answer.toString();
-            provenAnswer = answer;
-          }
-        } catch {
-        }
-        if (reachableDecl != null) {
-          try {
-            const levels = fp.getNumLevels(reachableDecl);
-            for (let i = 0; i < levels; i++) {
-              const cover = fp.getCoverDelta(i, reachableDecl);
-              if (cover != null && !ctx.isTrue(cover)) {
-                levelInvariants.push(`Level ${i}: ${cover.toString()}`);
-              }
-            }
-          } catch {
-          }
-        }
-        return { type: "proven", invariantFormula, levelInvariants, answer: provenAnswer };
-      }
-      if (status === "sat") {
-        let answer = null;
-        try {
-          answer = fp.getAnswer();
-        } catch {
-        }
-        return { type: "violated", answer };
-      }
-      return { type: "unknown", reason: fp.getReasonUnknown() };
-    } catch (e) {
-      return { type: "unknown", reason: `Z3 exception: ${e.message ?? e}` };
-    }
-  }
-  function dispose() {
-    try {
-      fp.release();
-    } catch {
-    }
+// src/verification/z3/z3-process.ts
+import { spawn, spawnSync } from "child_process";
+import { existsSync, mkdirSync, statSync, writeFileSync } from "fs";
+import * as path from "path";
+
+// src/verification/z3/smt-text.ts
+function classifyFirstLine(stdout) {
+  for (const raw of stdout.split("\n")) {
+    const line = raw.trim();
+    if (line === "sat" || line === "unsat" || line === "unknown") return line;
   }
-  return {
-    ctx,
-    fp,
-    query,
-    dispose
-  };
+  return null;
 }
-
-// src/verification/encoding/flat-net.ts
-function flatNetPlaceCount(net) {
-  return net.places.length;
+function timeoutLine(stdout) {
+  return stdout.split("\n").some((l) => l.trim() === "timeout");
 }
-function flatNetTransitionCount(net) {
-  return net.transitions.length;
+function errorLine(text) {
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (line.startsWith("(error")) return line;
+  }
+  return null;
 }
-function flatNetIndexOf(net, place) {
-  return net.placeIndex.get(place.name) ?? -1;
+function sexprEnd(s, start) {
+  let depth = 0;
+  let inString = false;
+  let inSymbol = false;
+  for (let i = start; i < s.length; i++) {
+    const c = s[i];
+    if (inString) {
+      if (c === '"') inString = false;
+    } else if (inSymbol) {
+      if (c === "|") inSymbol = false;
+    } else if (c === '"') {
+      inString = true;
+    } else if (c === "|") {
+      inSymbol = true;
+    } else if (c === "(") {
+      depth++;
+    } else if (c === ")") {
+      depth--;
+      if (depth === 0) return i + 1;
+    }
+  }
+  return -1;
+}
+function extractDefineFuns(output) {
+  const defs = [];
+  let from = 0;
+  for (; ; ) {
+    const pos = output.indexOf("(define-fun", from);
+    if (pos < 0) break;
+    const end = sexprEnd(output, pos);
+    if (end < 0) break;
+    defs.push(output.slice(pos, end));
+    from = end;
+  }
+  return defs;
+}
+function extractInvariant(output) {
+  const defs = extractDefineFuns(output);
+  return defs.length === 0 ? null : defs.join("\n");
 }
 
-// src/verification/z3/smt-encoder.ts
-function encode(ctx, fp, flatNet, initialMarking, property, invariants, sinkPlaces = /* @__PURE__ */ new Set()) {
-  const P = flatNet.places.length;
-  const Int = ctx.Int;
-  const Bool_ = ctx.Bool;
-  const intSort = Int.sort();
-  const boolSort = Bool_.sort();
-  const markingSorts = new Array(P).fill(intSort);
-  const reachable = ctx.Function.declare("Reachable", ...markingSorts, boolSort);
-  fp.registerRelation(reachable);
-  const error = ctx.Function.declare("Error", boolSort);
-  fp.registerRelation(error);
-  const m0Args = [];
-  for (let i = 0; i < P; i++) {
-    const tokens = initialMarking.tokens(flatNet.places[i]);
-    m0Args.push(Int.val(tokens));
+// src/verification/z3/z3-process.ts
+var Z3_ENV = "LIBPETRI_Z3";
+var DUMP_ENV = "LIBPETRI_SMT_DUMP";
+var GRACE_MS = 1e3;
+var VERSION_PROBE_MS = 5e3;
+var MIN_Z3_VERSION = { major: 4, minor: 8, patch: 0 };
+function parseZ3Version(text) {
+  const m = /Z3 version (\d+)\.(\d+)(?:\.(\d+))?/.exec(text);
+  if (m == null) return null;
+  return { major: Number(m[1]), minor: Number(m[2]), patch: m[3] == null ? 0 : Number(m[3]) };
+}
+function formatZ3Version(v) {
+  return `${v.major}.${v.minor}.${v.patch}`;
+}
+function compareZ3Version(a, b) {
+  return a.major - b.major || a.minor - b.minor || a.patch - b.patch;
+}
+var Z3Unavailable = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "Z3Unavailable";
   }
-  const initFact = reachable.call(...m0Args);
-  fp.addRule(initFact, "init");
-  for (let t = 0; t < flatNet.transitions.length; t++) {
-    const ft = flatNet.transitions[t];
-    encodeTransitionRule(ctx, fp, reachable, ft, flatNet, invariants, P);
-  }
-  for (const [name, bound] of flatNet.environmentInjection) {
-    const idx = flatNet.placeIndex.get(name);
-    if (idx == null) continue;
-    encodeInjectionRule(ctx, fp, reachable, idx, bound, P);
+};
+var Z3ProcessError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "Z3ProcessError";
   }
-  encodeErrorRule(ctx, fp, reachable, error, flatNet, property, sinkPlaces, P);
-  return {
-    errorExpr: error.call(),
-    reachableDecl: reachable
-  };
+};
+function replySucceeded(reply) {
+  return reply.exit.kind === "exited" && reply.exit.code === 0;
 }
-function encodeTransitionRule(ctx, fp, reachable, ft, flatNet, invariants, P) {
-  const Int = ctx.Int;
-  const mVars = [];
-  const mPrimeVars = [];
-  for (let i = 0; i < P; i++) {
-    mVars.push(Int.const(`m${i}`));
-    mPrimeVars.push(Int.const(`mp${i}`));
-  }
-  const reachBody = reachable.call(...mVars);
-  const enabled = encodeEnabled(ctx, ft, flatNet, mVars, P);
-  const fireRelation = encodeFire(ctx, ft, flatNet, mVars, mPrimeVars, P);
-  const nonNeg = encodeNonNegativity(ctx, mPrimeVars, P);
-  const invConstraints = encodeInvariantConstraints(ctx, invariants, mPrimeVars, P);
-  const envBounds = encodeEnvBounds(ctx, flatNet, mPrimeVars);
-  const body = ctx.And(reachBody, enabled, fireRelation, nonNeg, invConstraints, envBounds);
-  const head = reachable.call(...mPrimeVars);
-  const allVars = [...mVars, ...mPrimeVars];
-  const rule = ctx.Implies(body, head);
-  const qRule = ctx.ForAll(allVars, rule);
-  fp.addRule(qRule, `t_${ft.name}`);
-}
-function encodeInjectionRule(ctx, fp, reachable, idx, bound, P) {
-  const Int = ctx.Int;
-  const mVars = [];
-  const mPrimeVars = [];
-  for (let i = 0; i < P; i++) {
-    mVars.push(Int.const(`m${i}`));
-    mPrimeVars.push(Int.const(`mp${i}`));
-  }
-  const reachBody = reachable.call(...mVars);
-  const fire = encodeInjectionFire(ctx, idx, mVars, mPrimeVars, P);
-  const guard = encodeInjectionGuard(ctx, idx, bound, mVars);
-  const body = ctx.And(reachBody, guard, fire);
-  const head = reachable.call(...mPrimeVars);
-  const qRule = ctx.ForAll([...mVars, ...mPrimeVars], ctx.Implies(body, head));
-  fp.addRule(qRule, `env_inject_${idx}`);
-}
-function encodeNonNegativity(ctx, vars, P) {
-  let result = ctx.Bool.val(true);
-  for (let i = 0; i < P; i++) {
-    result = ctx.And(result, vars[i].ge(0));
+function argsFor(timeoutMs) {
+  return ["-smt2", "-in", `-t:${timeoutMs}`, `-T:${hardTimeoutSecs(timeoutMs)}`];
+}
+function hardTimeoutSecs(timeoutMs) {
+  return Math.max(1, Math.ceil((timeoutMs + GRACE_MS) / 1e3));
+}
+function watchdogMs(timeoutMs) {
+  return timeoutMs + 2 * GRACE_MS;
+}
+function timeoutBudget(timeoutMs) {
+  return Math.max(1, Math.floor(Number.isFinite(timeoutMs) ? timeoutMs : 1));
+}
+function failureReason(reply, timeoutMs) {
+  if (timeoutLine(reply.stdout)) {
+    return `z3 hard timeout after ${hardTimeoutSecs(timeoutMs)}s`;
   }
-  return result;
+  if (reply.exit.kind === "killed") {
+    return `z3 did not exit within ${watchdogMs(timeoutMs)} ms and was killed`;
+  }
+  const err = errorLine(reply.stdout) ?? errorLine(reply.stderr);
+  if (err != null) return `Z3 error: ${err}`;
+  const stderr = reply.stderr.trim();
+  if (stderr !== "") return `Z3 error: ${stderr}`;
+  return `Unexpected Z3 output: ${reply.stdout.trim()}`;
 }
-function encodeEnvBounds(ctx, flatNet, vars) {
-  let result = ctx.Bool.val(true);
-  for (const [name, bound] of flatNet.environmentBounds) {
-    const idx = flatNet.placeIndex.get(name);
-    if (idx != null) {
-      result = ctx.And(result, vars[idx].le(bound));
+function locateZ3(program, env = process.env) {
+  const isFile = (p) => {
+    try {
+      return existsSync(p) && statSync(p).isFile();
+    } catch {
+      return false;
     }
+  };
+  if (program.includes("/") || program.includes(path.sep) || path.isAbsolute(program)) {
+    return isFile(program) ? program : null;
   }
-  return result;
+  const searchPath = env["PATH"] ?? "";
+  const windows = process.platform === "win32";
+  for (const dir of searchPath.split(path.delimiter)) {
+    if (dir === "") continue;
+    const candidate2 = path.join(dir, program);
+    if (isFile(candidate2)) return candidate2;
+    if (windows && isFile(candidate2 + ".exe")) return candidate2 + ".exe";
+  }
+  return null;
 }
-function encodeInjectionFire(ctx, idx, mVars, mPrimeVars, P) {
-  let fire = ctx.Bool.val(true);
-  for (let i = 0; i < P; i++) {
-    if (i === idx) {
-      fire = ctx.And(fire, mPrimeVars[i].eq(mVars[i].add(1)));
-    } else {
-      fire = ctx.And(fire, mPrimeVars[i].eq(mVars[i]));
+function z3SolverAt(program, env = process.env) {
+  const located = locateZ3(program, env);
+  if (located == null) {
+    throw new Z3Unavailable(
+      `z3 binary not found: ${program}; install z3 >= ${formatZ3Version(MIN_Z3_VERSION)} or set ${Z3_ENV}`
+    );
+  }
+  const probe = spawnSync(located, ["--version"], {
+    encoding: "utf8",
+    timeout: VERSION_PROBE_MS,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (probe.error != null) {
+    if (probe.error.code === "ETIMEDOUT") {
+      throw new Z3Unavailable(`${program} --version did not answer within ${VERSION_PROBE_MS} ms`);
     }
+    throw new Z3Unavailable(`failed to spawn ${program}: ${probe.error.message}`);
+  }
+  const version = parseZ3Version(probe.stdout ?? "");
+  if (version == null) {
+    const line = `${probe.stdout ?? ""}
+${probe.stderr ?? ""}`.split("\n").map((l) => l.trim()).find((l) => l !== "") ?? "";
+    throw new Z3Unavailable(`z3 --version did not report a version: ${line}`);
+  }
+  if (compareZ3Version(version, MIN_Z3_VERSION) < 0) {
+    throw new Z3Unavailable(
+      `z3 ${formatZ3Version(version)} is older than the minimum ${formatZ3Version(MIN_Z3_VERSION)}`
+    );
+  }
+  return { program: located, version, dumpDir: null };
+}
+function resolveZ3(env = process.env) {
+  const configured = env[Z3_ENV];
+  const program = configured == null || configured.trim() === "" ? "z3" : configured;
+  const dump = env[DUMP_ENV];
+  const solver = z3SolverAt(program, env);
+  return { ...solver, dumpDir: dump == null || dump.trim() === "" ? null : dump };
+}
+function z3Available(env = process.env) {
+  try {
+    resolveZ3(env);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var dumpCounter = 0;
+function dumpSlot(solver, phase, script2) {
+  if (solver.dumpDir == null) return null;
+  dumpCounter += 1;
+  try {
+    mkdirSync(solver.dumpDir, { recursive: true });
+    const base = path.join(solver.dumpDir, `${String(dumpCounter).padStart(3, "0")}-${phase}`);
+    writeFileSync(`${base}.smt2`, script2);
+    return base;
+  } catch {
+    return null;
   }
-  return fire;
 }
-function encodeInjectionGuard(ctx, idx, bound, mVars) {
-  return bound === null ? ctx.Bool.val(true) : mVars[idx].lt(bound);
+function dumpWrite(file, text) {
+  try {
+    writeFileSync(file, text);
+  } catch {
+  }
+}
+function runZ3Text(solver, script2, phase, timeoutMs, extraArgs = []) {
+  const budget = timeoutBudget(timeoutMs);
+  const base = dumpSlot(solver, phase, script2);
+  return new Promise((resolve, reject) => {
+    const child = spawn(solver.program, [...argsFor(budget), ...extraArgs], {
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const out = [];
+    const err = [];
+    let killed = false;
+    let settled = false;
+    child.stdout.on("data", (chunk) => out.push(chunk));
+    child.stderr.on("data", (chunk) => err.push(chunk));
+    child.stdin.on("error", () => {
+    });
+    const watchdog = setTimeout(() => {
+      killed = true;
+      child.kill("SIGKILL");
+    }, watchdogMs(budget));
+    child.on("error", (e) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(watchdog);
+      reject(new Z3ProcessError(`failed to spawn ${solver.program}: ${e.message}`));
+    });
+    child.on("close", (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(watchdog);
+      const reply = {
+        stdout: Buffer.concat(out).toString("utf8"),
+        stderr: Buffer.concat(err).toString("utf8"),
+        exit: killed ? { kind: "killed" } : { kind: "exited", code }
+      };
+      if (base != null) {
+        dumpWrite(`${base}.out`, reply.stdout);
+        if (reply.stderr.trim() !== "") dumpWrite(`${base}.err`, reply.stderr);
+      }
+      resolve(reply);
+    });
+    child.stdin.end(script2);
+  });
+}
+
+// src/verification/z3/spacer-runner.ts
+async function runZ3Spacer(solver, timeoutMs, smt2, phase) {
+  let reply;
+  try {
+    reply = await runZ3Text(solver, smt2, phase, timeoutMs, ["fp.engine=spacer"]);
+  } catch (e) {
+    return { type: "unknown", reason: String(e?.message ?? e) };
+  }
+  const stdout = reply.stdout.trim();
+  switch (classifyFirstLine(stdout)) {
+    // unsat => no inductive invariant excludes the bad state => VIOLATED.
+    case "unsat":
+      return { type: "violated", answer: stdout };
+    // sat => an inductive invariant exists => PROVEN.
+    case "sat":
+      return { type: "proven", invariantFormula: extractInvariant(stdout) };
+    case "unknown":
+      return { type: "unknown", reason: "Z3 answered unknown" };
+    default:
+      return { type: "unknown", reason: failureReason(reply, timeoutBudget(timeoutMs)) };
+  }
 }
-function encodeStepRelation(ctx, flatNet, mVars, mPrimeVars) {
+
+// src/verification/z3/smt-encoder.ts
+function encode(flatNet, initialMarking, property, invariants, sinkPlaces = /* @__PURE__ */ new Set(), produceProofs = false) {
   const P = flatNet.places.length;
-  const disjuncts = [];
+  const lines = [];
+  const envInject = resolveEnvInjection(flatNet);
+  if (produceProofs) lines.push("(set-option :produce-proofs true)");
+  lines.push("(set-logic HORN)");
+  lines.push("");
+  lines.push(`(declare-fun Reachable (${ints(P).join(" ")}) Bool)`);
+  lines.push("(declare-fun Error () Bool)");
+  lines.push("");
+  const mVars = vars(P, "");
+  const mpVars = vars(P, "p");
+  const m0 = [];
+  for (let i = 0; i < P; i++) m0.push(String(initialMarking.tokens(flatNet.places[i])));
+  lines.push(`(assert (Reachable ${m0.join(" ")}))`);
+  lines.push("");
   for (const ft of flatNet.transitions) {
-    const enabled = encodeEnabled(ctx, ft, flatNet, mVars, P);
-    const fire = encodeFire(ctx, ft, flatNet, mVars, mPrimeVars, P);
-    const nonNeg = encodeNonNegativity(ctx, mPrimeVars, P);
-    const envBounds = encodeEnvBounds(ctx, flatNet, mPrimeVars);
-    disjuncts.push(ctx.And(enabled, fire, nonNeg, envBounds));
+    lines.push(encodeTransitionRule(flatNet, ft, mVars, mpVars, invariants));
   }
-  for (const [name, bound] of flatNet.environmentInjection) {
-    const idx = flatNet.placeIndex.get(name);
-    if (idx == null) continue;
-    disjuncts.push(ctx.And(
-      encodeInjectionGuard(ctx, idx, bound, mVars),
-      encodeInjectionFire(ctx, idx, mVars, mPrimeVars, P)
-    ));
+  for (const inj of envInject) {
+    lines.push(encodeInjectionRule(P, inj.pid, inj.bound, mVars, mpVars));
   }
-  if (disjuncts.length === 0) return ctx.Bool.val(false);
-  return ctx.Or(...disjuncts);
+  lines.push("");
+  lines.push(encodeErrorRule(flatNet, property, mVars, sinkPlaces, envInject));
+  lines.push("");
+  lines.push("(assert (not Error))");
+  lines.push("(check-sat)");
+  if (produceProofs) lines.push("(get-proof)");
+  lines.push("(get-model)");
+  return { smt2: lines.join("\n"), placeCount: P };
 }
-function injectedEnvIndices(flatNet) {
-  const out = /* @__PURE__ */ new Map();
+function resolveEnvInjection(flatNet) {
+  const out = [];
   for (const [name, bound] of flatNet.environmentInjection) {
-    const idx = flatNet.placeIndex.get(name);
-    if (idx != null) out.set(idx, bound);
+    const pid = flatNet.placeIndex.get(name);
+    if (pid != null) out.push({ pid, bound });
   }
+  out.sort((a, b) => a.pid - b.pid);
   return out;
 }
-function encodeEnabled(ctx, ft, flatNet, mVars, P, relaxEnv = false) {
-  let result = ctx.Bool.val(true);
-  const envInj = relaxEnv ? injectedEnvIndices(flatNet) : void 0;
-  for (let p = 0; p < P; p++) {
-    const pre = ft.preVector[p];
-    if (pre <= 0) continue;
-    if (envInj?.has(p)) {
-      const bound = envInj.get(p);
-      if (bound !== null && pre > bound) return ctx.Bool.val(false);
-      continue;
-    }
-    result = ctx.And(result, mVars[p].ge(pre));
-  }
-  for (const p of ft.readPlaces) {
-    if (envInj?.has(p)) {
-      const bound = envInj.get(p);
-      if (bound !== null && bound < 1) return ctx.Bool.val(false);
-      continue;
-    }
-    result = ctx.And(result, mVars[p].ge(1));
-  }
-  for (const p of ft.inhibitorPlaces) {
-    result = ctx.And(result, mVars[p].eq(0));
-  }
-  for (let p = 0; p < P; p++) {
-    result = ctx.And(result, mVars[p].ge(0));
+function envBounds(flatNet) {
+  const out = [];
+  for (const [name, max] of flatNet.environmentBounds) {
+    const pid = flatNet.placeIndex.get(name);
+    if (pid != null) out.push([pid, max]);
   }
-  return result;
+  out.sort((a, b) => a[0] - b[0]);
+  return out;
 }
-function encodeFire(ctx, ft, _flatNet, mVars, mPrimeVars, P) {
-  let result = ctx.Bool.val(true);
-  for (let p = 0; p < P; p++) {
-    const isReset = ft.resetPlaces.includes(p);
-    if (isReset || ft.consumeAll[p]) {
-      result = ctx.And(result, mPrimeVars[p].eq(ft.postVector[p]));
+function ints(n) {
+  return new Array(n).fill("Int");
+}
+function vars(P, suffix) {
+  const out = [];
+  for (let i = 0; i < P; i++) out.push(`m${i}${suffix}`);
+  return out;
+}
+function quantified(names) {
+  return names.map((v) => `(${v} Int)`).join(" ");
+}
+function firingConditions(flatNet, ft, mVars, mpVars) {
+  const P = flatNet.places.length;
+  const conditions = [];
+  for (let i = 0; i < P; i++) {
+    if (ft.preVector[i] > 0) conditions.push(`(>= ${mVars[i]} ${ft.preVector[i]})`);
+  }
+  for (const inh of ft.inhibitorPlaces) conditions.push(`(= ${mVars[inh]} 0)`);
+  for (const rd of ft.readPlaces) conditions.push(`(>= ${mVars[rd]} 1)`);
+  for (let i = 0; i < P; i++) {
+    if (ft.resetPlaces.includes(i) || ft.consumeAll[i]) {
+      conditions.push(`(= ${mpVars[i]} ${ft.postVector[i]})`);
     } else {
-      const delta = ft.postVector[p] - ft.preVector[p];
-      if (delta === 0) {
-        result = ctx.And(result, mPrimeVars[p].eq(mVars[p]));
-      } else {
-        result = ctx.And(result, mPrimeVars[p].eq(mVars[p].add(delta)));
-      }
+      const delta = ft.postVector[i] - ft.preVector[i];
+      if (delta > 0) conditions.push(`(= ${mpVars[i]} (+ ${mVars[i]} ${delta}))`);
+      else if (delta < 0) conditions.push(`(= ${mpVars[i]} (- ${mVars[i]} ${-delta}))`);
+      else conditions.push(`(= ${mpVars[i]} ${mVars[i]})`);
     }
   }
-  return result;
+  for (let i = 0; i < P; i++) conditions.push(`(>= ${mpVars[i]} 0)`);
+  return conditions;
 }
-function encodeErrorRule(ctx, fp, reachable, error, flatNet, property, sinkPlaces, P) {
-  const Int = ctx.Int;
-  const mVars = [];
+function invariantConditions(invariants, names) {
+  const conditions = [];
+  for (const inv of invariants) {
+    const terms = [...inv.support].sort((a, b) => a - b).map((i) => `(* ${inv.weights[i]} ${names[i]})`);
+    if (terms.length === 0) continue;
+    const sum = terms.length === 1 ? terms[0] : `(+ ${terms.join(" ")})`;
+    conditions.push(`(= ${sum} ${inv.constant})`);
+  }
+  return conditions;
+}
+function envBoundConditions(flatNet, mpVars) {
+  return envBounds(flatNet).map(([pid, max]) => `(<= ${mpVars[pid]} ${max})`);
+}
+function injectionConditions(P, pid, bound, mVars, mpVars) {
+  const conditions = [];
+  if (bound != null) conditions.push(`(< ${mVars[pid]} ${bound})`);
   for (let i = 0; i < P; i++) {
-    mVars.push(Int.const(`em${i}`));
+    if (i === pid) conditions.push(`(= ${mpVars[i]} (+ ${mVars[i]} 1))`);
+    else conditions.push(`(= ${mpVars[i]} ${mVars[i]})`);
+  }
+  return conditions;
+}
+function encodeTransitionRule(flatNet, ft, mVars, mpVars, invariants) {
+  const conditions = [`(Reachable ${mVars.join(" ")})`];
+  conditions.push(...firingConditions(flatNet, ft, mVars, mpVars));
+  conditions.push(...invariantConditions(invariants, mpVars));
+  conditions.push(...envBoundConditions(flatNet, mpVars));
+  const body = `(and ${conditions.join("\n            ")})`;
+  return `(assert (forall (${quantified([...mVars, ...mpVars])})
+  (=> ${body}
+      (Reachable ${mpVars.join(" ")}))))`;
+}
+function encodeInjectionRule(P, pid, bound, mVars, mpVars) {
+  const conditions = [`(Reachable ${mVars.join(" ")})`];
+  conditions.push(...injectionConditions(P, pid, bound, mVars, mpVars));
+  const body = `(and ${conditions.join("\n            ")})`;
+  return `(assert (forall (${quantified([...mVars, ...mpVars])})
+  (=> ${body}
+      (Reachable ${mpVars.join(" ")}))))`;
+}
+function conjoin(conditions) {
+  if (conditions.length === 0) return "true";
+  if (conditions.length === 1) return conditions[0];
+  return `(and ${conditions.join(" ")})`;
+}
+function encodeStepRelationSmt2(flatNet) {
+  const P = flatNet.places.length;
+  const mVars = vars(P, "");
+  const mpVars = vars(P, "p");
+  const disjuncts = [];
+  for (const ft of flatNet.transitions) {
+    const conditions = firingConditions(flatNet, ft, mVars, mpVars);
+    conditions.push(...envBoundConditions(flatNet, mpVars));
+    disjuncts.push(conjoin(conditions));
+  }
+  for (const inj of resolveEnvInjection(flatNet)) {
+    disjuncts.push(conjoin(injectionConditions(P, inj.pid, inj.bound, mVars, mpVars)));
+  }
+  if (disjuncts.length === 0) return "false";
+  if (disjuncts.length === 1) return disjuncts[0];
+  return `(or ${disjuncts.join("\n    ")})`;
+}
+function encodeErrorRule(flatNet, property, mVars, sinkPlaces, envInject) {
+  const violation = encodePropertyViolation(flatNet, property, mVars, sinkPlaces, envInject);
+  return `(assert (forall (${quantified(mVars)})
+  (=> (and (Reachable ${mVars.join(" ")}) ${violation})
+      Error)))`;
+}
+function indexOrdered(flatNet, places) {
+  const idx = /* @__PURE__ */ new Set();
+  for (const place of places) {
+    const i = flatNet.placeIndex.get(place.name);
+    if (i != null) idx.add(i);
   }
-  const reachBody = reachable.call(...mVars);
-  const violation = encodePropertyViolation(ctx, flatNet, property, sinkPlaces, mVars, P);
-  const head = error.call();
-  const body = ctx.And(reachBody, violation);
-  const rule = ctx.Implies(body, head);
-  const qRule = ctx.ForAll(mVars, rule);
-  fp.addRule(qRule, `error_${property.type}`);
+  return [...idx].sort((a, b) => a - b);
 }
-function encodePropertyViolation(ctx, flatNet, property, sinkPlaces, mVars, P) {
+function encodePropertyViolation(flatNet, property, mVars, sinkPlaces, envInject) {
   switch (property.type) {
-    case "deadlock-free": {
-      const deadlock = encodeDeadlock(ctx, flatNet, mVars, P);
-      if (sinkPlaces.size > 0) {
-        let notAtSink = ctx.Bool.val(true);
-        for (const sink of sinkPlaces) {
-          const idx = flatNetIndexOf(flatNet, sink);
-          if (idx >= 0) {
-            notAtSink = ctx.And(notAtSink, mVars[idx].eq(0));
-          }
-        }
-        return ctx.And(deadlock, notAtSink);
-      }
-      return deadlock;
-    }
+    case "deadlock-free":
+      return encodeDeadlock(flatNet, mVars, sinkPlaces, envInject);
     case "mutual-exclusion": {
-      const idx1 = flatNetIndexOf(flatNet, property.p1);
-      const idx2 = flatNetIndexOf(flatNet, property.p2);
-      if (idx1 < 0) throw new Error(`MutualExclusion references unknown place: ${property.p1.name}`);
-      if (idx2 < 0) throw new Error(`MutualExclusion references unknown place: ${property.p2.name}`);
-      return ctx.And(mVars[idx1].ge(1), mVars[idx2].ge(1));
-    }
-    case "place-bound": {
-      const idx = flatNetIndexOf(flatNet, property.place);
-      if (idx < 0) throw new Error(`PlaceBound references unknown place: ${property.place.name}`);
-      return mVars[idx].gt(property.bound);
+      const conditions = indexOrdered(flatNet, [property.p1, property.p2]).map((i) => `(>= ${mVars[i]} 1)`);
+      return conditions.length === 0 ? "false" : `(and ${conditions.join(" ")})`;
     }
+    case "place-bound":
     case "branch-place-bound": {
-      const idx = flatNetIndexOf(flatNet, property.place);
-      if (idx < 0) throw new Error(`BranchPlaceBound references unknown place: ${property.place.name}`);
-      return mVars[idx].gt(property.bound);
-    }
-    case "joined-or-dead-lettered": {
-      const idx = flatNetIndexOf(flatNet, property.pending);
-      if (idx < 0) return ctx.Bool.val(false);
-      const deadlock = encodeDeadlock(ctx, flatNet, mVars, P);
-      return ctx.And(deadlock, mVars[idx].ge(1));
+      const pid = flatNet.placeIndex.get(property.place.name);
+      return pid == null ? "false" : `(> ${mVars[pid]} ${property.bound})`;
     }
     case "unreachable": {
-      let allMarked = ctx.Bool.val(true);
-      for (const place of property.places) {
-        const idx = flatNetIndexOf(flatNet, place);
-        if (idx >= 0) {
-          allMarked = ctx.And(allMarked, mVars[idx].ge(1));
-        }
-      }
-      return allMarked;
+      const conditions = indexOrdered(flatNet, property.places).map((i) => `(>= ${mVars[i]} 1)`);
+      return conditions.length === 0 ? "false" : `(and ${conditions.join(" ")})`;
+    }
+    case "joined-or-dead-lettered": {
+      const deadlock = encodeDeadlock(flatNet, mVars, sinkPlaces, envInject);
+      const pid = flatNet.placeIndex.get(property.pending.name);
+      return pid == null ? "false" : `(and ${deadlock} (>= ${mVars[pid]} 1))`;
     }
   }
 }
-function encodeDeadlock(ctx, flatNet, mVars, P) {
-  let deadlock = ctx.Bool.val(true);
+function encodeDeadlock(flatNet, mVars, sinkPlaces, envInject) {
+  const envBound = /* @__PURE__ */ new Map();
+  for (const inj of envInject) envBound.set(inj.pid, inj.bound);
+  const disabledConditions = [];
   for (const ft of flatNet.transitions) {
-    const enabled = encodeEnabled(
-      ctx,
-      ft,
-      flatNet,
-      mVars,
-      P,
-      /* relaxEnv */
-      true
-    );
-    deadlock = ctx.And(deadlock, ctx.Not(enabled));
-  }
-  return deadlock;
-}
-function encodeInvariantConstraints(ctx, invariants, mVars, P) {
-  let result = ctx.Bool.val(true);
-  for (const inv of invariants) {
-    let sum = ctx.Int.val(0);
-    for (const idx of inv.support) {
-      if (idx < P) {
-        sum = sum.add(mVars[idx].mul(inv.weights[idx]));
+    const disableReasons = [];
+    let permanentlyDisabled = false;
+    for (let i = 0; i < flatNet.places.length; i++) {
+      if (ft.preVector[i] > 0) {
+        if (envBound.has(i)) {
+          const k = envBound.get(i);
+          if (k != null && ft.preVector[i] > k) permanentlyDisabled = true;
+          continue;
+        }
+        disableReasons.push(`(< ${mVars[i]} ${ft.preVector[i]})`);
+      }
+    }
+    for (const inh of ft.inhibitorPlaces) disableReasons.push(`(> ${mVars[inh]} 0)`);
+    for (const rd of ft.readPlaces) {
+      if (envBound.has(rd)) {
+        const k = envBound.get(rd);
+        if (k != null && k < 1) permanentlyDisabled = true;
+        continue;
       }
+      disableReasons.push(`(< ${mVars[rd]} 1)`);
+    }
+    if (permanentlyDisabled) {
+      disabledConditions.push("true");
+      continue;
     }
-    result = ctx.And(result, sum.eq(inv.constant));
+    if (disableReasons.length === 0) return "false";
+    disabledConditions.push(`(or ${disableReasons.join(" ")})`);
   }
-  return result;
+  for (const pid of indexOrdered(flatNet, sinkPlaces)) {
+    disabledConditions.push(`(= ${mVars[pid]} 0)`);
+  }
+  return disabledConditions.length === 0 ? "true" : `(and ${disabledConditions.join("\n         ")})`;
+}
+function injectionMap(flatNet) {
+  const out = /* @__PURE__ */ new Map();
+  for (const inj of resolveEnvInjection(flatNet)) out.set(inj.pid, inj.bound);
+  return out;
 }
 
 // src/verification/z3/certificate-checker.ts
-async function checkCertificate(ctx, answer, flatNet, initialMarking, property, invariants, sinkPlaces, timeoutMs) {
-  try {
-    if (answer == null) {
-      return {
-        type: "unavailable",
-        reason: "invariant missing (Z3 produced no inductive-invariant answer)",
-        invariant: null
-      };
-    }
-    const P = flatNet.places.length;
-    const Int = ctx.Int;
-    const mVars = [];
-    const mPrimeVars = [];
-    for (let i = 0; i < P; i++) {
-      mVars.push(Int.const(`m${i}`));
-      mPrimeVars.push(Int.const(`mp${i}`));
-    }
-    const invariant = extractInvariant(ctx, answer, P, mVars);
-    if (invariant == null) {
-      return {
-        type: "unavailable",
-        reason: "invariant unparseable (no Reachable definition recognized in the Z3 answer)",
-        invariant: String(answer)
-      };
-    }
-    const candidate = invariants.length > 0 ? ctx.And(invariant, encodeInvariantConstraints(ctx, invariants, mVars, P)) : invariant;
-    const failure = await validateCandidate(
-      ctx,
-      candidate,
-      flatNet,
-      initialMarking,
-      property,
-      sinkPlaces,
-      timeoutMs,
-      mVars,
-      mPrimeVars
-    );
-    if (failure == null) {
-      return { type: "passed", invariant: String(candidate) };
-    }
-    return { type: "failed", vc: failure.vc, detail: failure.detail, invariant: String(candidate) };
-  } catch (e) {
+var VC_LABELS = ["initiation (VC1)", "consecution (VC2)", "safety (VC3)"];
+async function checkCertificate(certificate, flatNet, initialMarking, property, invariants, sinkPlaces, solver, timeoutMs) {
+  if (certificate == null) {
     return {
       type: "unavailable",
-      reason: `certificate check error: ${e?.message ?? e}`,
+      reason: "no inductive invariant (define-fun block) could be extracted from the z3 model",
       invariant: null
     };
   }
-}
-async function validateCandidate(ctx, candidate, flatNet, initialMarking, property, sinkPlaces, timeoutMs, mVars, mPrimeVars) {
-  const P = flatNet.places.length;
-  const Int = ctx.Int;
-  let nonNegM = ctx.Bool.val(true);
-  for (let i = 0; i < P; i++) {
-    nonNegM = ctx.And(nonNegM, mVars[i].ge(0));
-  }
-  const initPairs = mVars.map((v, i) => [
-    v,
-    Int.val(initialMarking.tokens(flatNet.places[i]))
-  ]);
-  const candidateAtInit = ctx.substitute(candidate, ...initPairs);
-  const vc1 = await checkUnsat(ctx, flatNet, mVars, timeoutMs, "initiation (VC1)", [ctx.Not(candidateAtInit)]);
-  if (vc1 != null) return vc1;
-  const primePairs = mVars.map((v, i) => [v, mPrimeVars[i]]);
-  const candidatePrime = ctx.substitute(candidate, ...primePairs);
-  const step = encodeStepRelation(ctx, flatNet, mVars, mPrimeVars);
-  const vc2 = await checkUnsat(
-    ctx,
-    flatNet,
-    mVars,
-    timeoutMs,
-    "consecution (VC2)",
-    [candidate, nonNegM, step, ctx.Not(candidatePrime)]
-  );
-  if (vc2 != null) return vc2;
-  const bad = encodePropertyViolation(ctx, flatNet, property, sinkPlaces, mVars, P);
-  const vc3 = await checkUnsat(ctx, flatNet, mVars, timeoutMs, "safety (VC3)", [candidate, nonNegM, bad]);
-  if (vc3 != null) return vc3;
-  return null;
-}
-function extractInvariant(ctx, answer, P, mVars) {
-  for (const conjunct of topLevelConjuncts(ctx, answer)) {
-    const invariant = tryExtractDefinition(ctx, conjunct, P, mVars);
-    if (invariant != null) return invariant;
+  const shape = shapeFailure(flatNet, invariants);
+  if (shape != null) return { type: "unavailable", reason: shape, invariant: certificate };
+  if (!certificate.includes("(define-fun Reachable ") && !certificate.includes("(define-fun |Reachable| ")) {
+    return { type: "unavailable", reason: "certificate does not define Reachable", invariant: certificate };
   }
-  return null;
-}
-function topLevelConjuncts(ctx, expr) {
-  if (!ctx.isQuantifier(expr) && ctx.isApp(expr) && String(expr.decl().name()) === "and") {
-    const out = [];
-    const n = expr.numArgs();
-    for (let i = 0; i < n; i++) out.push(expr.arg(i));
-    return out;
-  }
-  return [expr];
-}
-function tryExtractDefinition(ctx, expr, P, mVars) {
-  if (ctx.isQuantifier(expr) && expr.is_forall()) {
-    const q = expr;
-    const parts2 = splitDefinition(ctx, q.body(), P);
-    if (parts2 == null) return null;
-    const numVars = q.num_vars();
-    const to = new Array(numVars);
-    for (let j = 0; j < P; j++) {
-      const arg = parts2.app.arg(j);
-      if (!ctx.isVar(arg)) return null;
-      const idx = ctx.getVarIndex(arg);
-      if (idx >= numVars || to[idx] != null) return null;
-      to[idx] = mVars[j];
-    }
-    for (let i = 0; i < numVars; i++) {
-      if (to[i] == null) to[i] = ctx.Int.const(`certFree${i}`);
-    }
-    return ctx.substituteVars(parts2.phi, ...to);
-  }
-  const parts = splitDefinition(ctx, expr, P);
-  if (parts == null) return null;
-  const pairs = [];
-  for (let j = 0; j < P; j++) {
-    const arg = parts.app.arg(j);
-    if (ctx.isVar(arg)) return null;
-    pairs.push([arg, mVars[j]]);
-  }
-  if (pairs.length === 0) return parts.phi;
-  return ctx.substitute(parts.phi, ...pairs);
-}
-function splitDefinition(ctx, body, P) {
-  if (ctx.isQuantifier(body) || !ctx.isApp(body)) return null;
-  const b = body;
-  const decl = String(b.decl().name());
-  if ((decl === "=" || decl === "iff") && b.numArgs() === 2) {
-    if (isReachableApp(ctx, b.arg(0), P)) return { app: b.arg(0), phi: b.arg(1) };
-    if (isReachableApp(ctx, b.arg(1), P)) return { app: b.arg(1), phi: b.arg(0) };
-    return null;
+  const vcs = buildVerificationConditions(certificate, flatNet, initialMarking, property, sinkPlaces, invariants);
+  let results;
+  try {
+    results = await runVcScript(script(vcs), timeoutMs, solver);
+  } catch (e) {
+    return { type: "unavailable", reason: String(e?.message ?? e), invariant: certificate };
   }
-  if (decl === "=>" && b.numArgs() === 2 && isReachableApp(ctx, b.arg(0), P)) {
-    return { app: b.arg(0), phi: b.arg(1) };
+  for (let i = 0; i < results.length; i++) {
+    if (results[i] !== "unsat") {
+      const detail = await detailFor(vcs, i, results[i], flatNet, timeoutMs, solver);
+      return { type: "failed", vc: VC_LABELS[i], detail, invariant: certificate };
+    }
   }
-  return null;
+  return { type: "passed", invariant: certificate };
 }
-function isReachableApp(ctx, expr, P) {
-  return ctx.isApp(expr) && String(expr.decl().name()) === "Reachable" && expr.numArgs() === P;
+function vcScript(certificate, flatNet, initialMarking, property, sinkPlaces, invariants) {
+  return script(buildVerificationConditions(certificate, flatNet, initialMarking, property, sinkPlaces, invariants));
 }
-async function checkUnsat(ctx, flatNet, mVars, timeoutMs, vc, assertions) {
-  const solver = new ctx.Solver();
-  if (timeoutMs > 0) {
-    solver.set("timeout", Math.min(timeoutMs, 2147483647));
-  }
-  for (const assertion of assertions) {
-    solver.add(assertion);
-  }
-  const status = await solver.check();
-  if (status === "unsat") return null;
-  if (status === "sat") {
-    const witness = describeWitness(solver, flatNet, mVars);
-    return {
-      vc,
-      detail: `solver returned SATISFIABLE${witness == null ? "" : ` (witness: ${witness})`}`
-    };
+function shapeFailure(flatNet, invariants) {
+  const P = flatNet.places.length;
+  for (const inv of invariants) {
+    if (inv.weights.length !== P) {
+      return `P-invariant has ${inv.weights.length} weights for a ${P}-place net`;
+    }
+    for (const pid of inv.support) {
+      if (pid >= P || pid < 0) return `P-invariant support names place index ${pid} in a ${P}-place net`;
+    }
   }
-  let why = null;
+  return null;
+}
+var VcFailure = class extends Error {
+};
+async function runVcScript(text, timeoutMs, solver) {
+  const reply = await runZ3Text(solver, text, "certificate", timeoutMs, []);
+  const budget = timeoutBudget(timeoutMs);
+  const err = errorLine(reply.stderr);
+  if (err != null) throw new VcFailure(`z3 reported an error on stderr: ${err}`);
+  if (timeoutLine(reply.stdout)) {
+    throw new VcFailure(`z3 hard timeout after ${hardTimeoutSecs(budget)}s while checking the certificate`);
+  }
+  if (reply.exit.kind === "killed") {
+    throw new VcFailure(`z3 did not exit within ${watchdogMs(budget)} ms while checking the certificate and was killed`);
+  }
+  const results = parseVcResults(reply.stdout);
+  if (!replySucceeded(reply)) {
+    const status = reply.exit.kind === "exited" ? `exit status: ${reply.exit.code}` : "the watchdog kill";
+    throw new VcFailure(`z3 exited with ${status} after answering [${results.join(", ")}]`);
+  }
+  return results;
+}
+function parseVcResults(stdout) {
+  const err = errorLine(stdout);
+  if (err != null) throw new VcFailure(`z3 error while checking the certificate: ${err}`);
+  if (timeoutLine(stdout)) throw new VcFailure("z3 hard timeout while checking the certificate");
+  const results = stdout.split("\n").map((l) => l.trim()).filter((l) => l === "sat" || l === "unsat" || l === "unknown");
+  if (results.length !== 3) {
+    throw new VcFailure(`expected 3 VC answers from z3, got ${results.length}: [${results.join(", ")}]`);
+  }
+  return results;
+}
+function buildVerificationConditions(certificate, flatNet, initialMarking, property, sinkPlaces, invariants) {
+  const P = flatNet.places.length;
+  const mVars = [];
+  const mpVars = [];
+  for (let i = 0; i < P; i++) {
+    mVars.push(`m${i}`);
+    mpVars.push(`m${i}p`);
+  }
+  const prelude = [
+    "; IC3/PDR certificate check (plain SMT-LIB2, not HORN):",
+    "; each VC below must be unsat for the certificate to stand.",
+    certificate,
+    ""
+  ];
+  for (const v of mVars) prelude.push(`(declare-const ${v} Int)`);
+  for (const v of mpVars) prelude.push(`(declare-const ${v} Int)`);
+  const m0 = [];
+  for (let i = 0; i < P; i++) m0.push(String(initialMarking.tokens(flatNet.places[i])));
+  const vc1 = [`(assert (not ${candidate(m0, invariants)}))`];
+  const nonNegative = mVars.map((v) => `(assert (>= ${v} 0))`);
+  const step = encodeStepRelationSmt2(flatNet);
+  const vc2 = [
+    ...nonNegative,
+    `(assert ${candidate(mVars, invariants)})`,
+    `(assert ${step})`,
+    `(assert (not ${candidate(mpVars, invariants)}))`
+  ];
+  const bad = encodePropertyViolation(flatNet, property, mVars, sinkPlaces, resolveEnvInjection(flatNet));
+  const vc3 = [...nonNegative, `(assert ${candidate(mVars, invariants)})`, `(assert ${bad})`];
+  return { prelude, asserts: [vc1, vc2, vc3] };
+}
+function script(vcs) {
+  const lines = [...vcs.prelude];
+  for (let i = 0; i < vcs.asserts.length; i++) {
+    lines.push("");
+    lines.push(`; VC${i + 1} ${VC_LABELS[i]}`);
+    lines.push("(push)");
+    lines.push(...vcs.asserts[i]);
+    lines.push("(check-sat)");
+    lines.push("(pop)");
+  }
+  return lines.join("\n");
+}
+async function detailFor(vcs, i, answer, flatNet, timeoutMs, solver) {
+  const lines = ["(set-option :produce-models true)", ...vcs.prelude, ...vcs.asserts[i], "(check-sat)"];
+  lines.push(answer === "sat" ? "(get-model)" : "(get-info :reason-unknown)");
+  let reply = "";
   try {
-    why = String(solver.reasonUnknown());
+    reply = (await runZ3Text(solver, lines.join("\n"), "certificate-detail", timeoutMs, [])).stdout;
   } catch {
+    reply = "";
+  }
+  if (answer === "sat") {
+    const w = witness(reply, flatNet);
+    return w == null ? "solver returned SATISFIABLE" : `solver returned SATISFIABLE (witness: ${w})`;
   }
-  return { vc, detail: `solver returned UNKNOWN${why == null || why === "" ? "" : ` (${why})`}` };
+  const r = reasonUnknown(reply);
+  return r == null ? "solver returned UNKNOWN" : `solver returned UNKNOWN (${r})`;
 }
-function describeWitness(solver, flatNet, mVars) {
-  try {
-    const model = solver.model();
-    const parts = [];
-    let length = 0;
-    for (let i = 0; i < mVars.length; i++) {
-      const value = model.eval(mVars[i], false);
-      const text = value == null ? "" : String(value);
-      if (!/^(-?\d+|\(- \d+\))$/.test(text)) continue;
-      const part = `${flatNet.places[i].name}=${text}`;
-      parts.push(part);
-      length += part.length + 2;
-      if (length > 160) {
-        parts.push("...");
-        break;
-      }
+function witness(model, flatNet) {
+  const parts = [];
+  for (let i = 0; i < flatNet.places.length; i++) {
+    const needle = `(define-fun m${i} () Int`;
+    const at = model.indexOf(needle);
+    if (at < 0) continue;
+    const rest = model.slice(at + needle.length).trimStart();
+    let value;
+    if (rest.startsWith("(")) {
+      const end = sexprEnd(rest, 0);
+      if (end < 0) continue;
+      value = rest.slice(1, end - 1).trim().split(/\s+/).join("");
+    } else {
+      let end = 0;
+      while (end < rest.length && !/\s/.test(rest[end]) && rest[end] !== ")") end++;
+      if (end === 0) continue;
+      value = rest.slice(0, end);
     }
-    return parts.length === 0 ? null : parts.join(", ");
-  } catch {
-    return null;
+    parts.push(`${flatNet.places[i].name}=${value}`);
   }
+  return parts.length === 0 ? null : parts.join(", ");
+}
+function reasonUnknown(reply) {
+  const at = reply.indexOf(":reason-unknown");
+  if (at < 0) return null;
+  const rest = reply.slice(at + ":reason-unknown".length).trimStart();
+  const end = rest.indexOf(")");
+  if (end < 0) return null;
+  let reason = rest.slice(0, end).trim();
+  if (reason.startsWith('"') && reason.endsWith('"') && reason.length >= 2) reason = reason.slice(1, -1);
+  reason = reason.trim();
+  return reason === "" ? null : reason;
+}
+function candidate(names, invariants) {
+  return conjoin([`(Reachable ${names.join(" ")})`, ...invariantConditions(invariants, names)]);
 }
 
 // src/verification/analysis/dbm.ts
@@ -2163,90 +2315,89 @@ function consumeFromPlace(builder, place, count, environmentPlaces, environmentM
 }
 
 // src/verification/z3/counterexample-decoder.ts
-function describeDecodeFailure(failure) {
-  if (failure == null) {
-    return "no Reachable applications with concrete arguments found in the derivation";
-  }
-  switch (failure.kind) {
-    case "no-answer":
-      return "Z3 produced no derivation answer";
-    case "traversal-error":
-      return `derivation walk failed: ${failure.message}`;
-    case "non-concrete":
-      return `${failure.skipped} Reachable application(s) had non-concrete arguments`;
-  }
-}
-function decode(ctx, answer, flatNet) {
-  const trace = [];
-  const transitions = [];
-  const stateByKey = /* @__PURE__ */ new Map();
-  if (answer == null) {
-    return { trace, transitions, states: /* @__PURE__ */ new Set(), failure: { kind: "no-answer" } };
-  }
-  const counters = { skipped: 0 };
-  let failure = null;
-  try {
-    extractTrace(ctx, answer, flatNet, trace, transitions, stateByKey, counters);
-  } catch (e) {
-    failure = { kind: "traversal-error", message: String(e?.message ?? e) };
-  }
-  if (failure == null && counters.skipped > 0) {
-    failure = { kind: "non-concrete", skipped: counters.skipped };
-  }
-  return { trace, transitions, states: new Set(stateByKey.values()), failure };
+function decode(answer, flatNet) {
+  const states = decodeStateSet(answer, flatNet);
+  return { states, note: states.size === 0 ? "no ground Reachable states in the z3 proof" : null };
 }
-function extractTrace(ctx, expr, flatNet, trace, transitions, stateByKey, counters) {
-  if (expr == null) return;
-  if (!ctx.isApp(expr)) return;
-  let name;
-  try {
-    const decl = expr.decl();
-    name = String(decl.name());
-  } catch {
-    return;
-  }
+function decodeStateSet(answer, flatNet) {
+  const byKey = /* @__PURE__ */ new Map();
   const P = flatNet.places.length;
-  if (name === "Reachable") {
-    const numArgs = expr.numArgs();
-    if (numArgs === P) {
-      const marking = extractMarking(ctx, expr, flatNet);
-      if (marking != null) {
-        trace.push(marking);
-        const key = marking.toString();
-        if (!stateByKey.has(key)) stateByKey.set(key, marking);
-      } else {
-        counters.skipped++;
+  for (const head of ["(Reachable", "(|Reachable|"]) {
+    let from = 0;
+    for (; ; ) {
+      const start = answer.indexOf(head, from);
+      if (start < 0) break;
+      from = start + head.length;
+      if (head === "(Reachable") {
+        const next = answer[from];
+        if (next == null || !(/\s/.test(next) || next === ")")) continue;
+      }
+      const end = sexprEnd(answer, start);
+      if (end < 0) break;
+      const inner = answer.slice(start + head.length, end - 1);
+      const args = parseGroundIntArgs(inner);
+      if (args != null && args.length === P) {
+        const marking = toMarking(args, flatNet);
+        const key = marking.toString();
+        if (!byKey.has(key)) byKey.set(key, marking);
       }
     }
   }
-  try {
-    const numArgs = expr.numArgs();
-    for (let i = 0; i < numArgs; i++) {
-      const child = expr.arg(i);
-      extractTrace(ctx, child, flatNet, trace, transitions, stateByKey, counters);
-    }
-  } catch {
-  }
-  if (name.startsWith("t_")) {
-    transitions.push(name.substring(2));
-  }
+  return new Set(byKey.values());
 }
-function extractMarking(ctx, reachableApp, flatNet) {
-  const P = flatNet.places.length;
-  if (reachableApp.numArgs() !== P) return null;
+function toMarking(args, flatNet) {
   const builder = MarkingState.builder();
-  for (let i = 0; i < P; i++) {
-    const arg = reachableApp.arg(i);
-    if (ctx.isIntVal(arg)) {
-      const tokens = Number(arg.value());
-      if (tokens > 0) {
-        builder.tokens(flatNet.places[i], tokens);
-      }
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] > 0) builder.tokens(flatNet.places[i], args[i]);
+  }
+  return builder.build();
+}
+function parseGroundIntArgs(inner) {
+  const args = [];
+  let rest = inner.trimStart();
+  while (rest !== "") {
+    if (rest.startsWith("(")) {
+      const stripped = rest.slice(1);
+      const close = stripped.indexOf(")");
+      if (close < 0) return null;
+      const body = stripped.slice(0, close);
+      if (body.includes("(")) return null;
+      const trimmed = body.trim();
+      if (!trimmed.startsWith("-")) return null;
+      const n = parseInt64(trimmed.slice(1).trim());
+      if (n == null) return null;
+      args.push(-n);
+      rest = stripped.slice(close + 1).trimStart();
     } else {
-      return null;
+      let tokenEnd = rest.length;
+      for (let i = 0; i < rest.length; i++) {
+        const c = rest[i];
+        if (/\s/.test(c) || c === "(" || c === ")") {
+          tokenEnd = i;
+          break;
+        }
+      }
+      const n = parseInt64(rest.slice(0, tokenEnd));
+      if (n == null) return null;
+      args.push(n);
+      rest = rest.slice(tokenEnd).trimStart();
     }
   }
-  return builder.build();
+  return args;
+}
+function parseInt64(token) {
+  return /^-?\d+$/.test(token) ? Number(token) : null;
+}
+
+// src/verification/encoding/flat-net.ts
+function flatNetPlaceCount(net) {
+  return net.places.length;
+}
+function flatNetTransitionCount(net) {
+  return net.transitions.length;
+}
+function flatNetIndexOf(net, place) {
+  return net.placeIndex.get(place.name) ?? -1;
 }
 
 // src/verification/z3/abstract-replayer.ts
@@ -2487,25 +2638,29 @@ function colourSlotBound(coloured, semiflows) {
   const isSemiflow = (inv) => inv.weights.every((x) => x >= 0);
   let single = null;
   for (const inv of semiflows) {
-    if (isSemiflow(inv) && inv.constant >= 1 && coloured.every((pid) => w(inv, pid) >= 1)) {
+    if (isSemiflow(inv) && coloured.every((pid) => w(inv, pid) >= 1)) {
       if (single === null || inv.constant < single) single = inv.constant;
     }
   }
   if (single !== null) return single;
-  let sumConst = 0;
   const covered = new Array(coloured.length).fill(false);
   for (const inv of semiflows) {
-    if (!isSemiflow(inv)) continue;
-    let touches = false;
+    if (!isSemiflow(inv) || inv.constant !== 0) continue;
     for (let i = 0; i < coloured.length; i++) {
-      if (w(inv, coloured[i]) >= 1) {
-        covered[i] = true;
-        touches = true;
-      }
+      if (w(inv, coloured[i]) >= 1) covered[i] = true;
+    }
+  }
+  const free = [...covered];
+  let sumConst = 0;
+  for (const inv of semiflows) {
+    if (!isSemiflow(inv) || inv.constant === 0) continue;
+    if (!coloured.some((pid, i) => !free[i] && w(inv, pid) >= 1)) continue;
+    for (let i = 0; i < coloured.length; i++) {
+      if (w(inv, coloured[i]) >= 1) covered[i] = true;
     }
-    if (touches) sumConst += inv.constant;
+    sumConst += inv.constant;
   }
-  if (covered.every((c) => c) && sumConst >= 1) return sumConst;
+  if (covered.every((c) => c)) return sumConst;
   return null;
 }
 function buildColouredPlan(net, flat, initial, budgetNames, fragmentMode, carrierPlaces, semiflows) {
@@ -2535,6 +2690,7 @@ function buildColouredPlan(net, flat, initial, budgetNames, fragmentMode, carrie
   }
   const k = colourSlotBound(coloured, semiflows);
   if (k === null) return null;
+  if (k === 0 && coloured.length === P) return null;
   const budgetIdx = /* @__PURE__ */ new Set();
   for (const n of budgetNames) {
     const i = flat.placeIndex.get(n);
@@ -2570,324 +2726,278 @@ function buildColouredPlan(net, flat, initial, budgetNames, fragmentMode, carrie
   }
   return { coloured, isColoured, k, classes };
 }
-function buildLayout(ctx, plan, P) {
+function buildLayout(plan, P) {
   const colUnc = new Array(P).fill(-1);
   const colCol = Array.from({ length: P }, () => []);
-  let nCols = 0;
+  const cur = [];
+  const nxt = [];
   for (let i = 0; i < P; i++) {
     if (plan.isColoured[i]) {
       const idxs = [];
-      for (let c = 0; c < plan.k; c++) idxs.push(nCols++);
+      for (let c = 0; c < plan.k; c++) {
+        idxs.push(cur.length);
+        cur.push(`m${i}_${c}`);
+        nxt.push(`m${i}_${c}p`);
+      }
       colCol[i] = idxs;
     } else {
-      colUnc[i] = nCols++;
+      colUnc[i] = cur.length;
+      cur.push(`m${i}`);
+      nxt.push(`m${i}p`);
     }
   }
-  const cur = [];
-  const nxt = [];
-  for (let col = 0; col < nCols; col++) {
-    cur.push(ctx.Int.const(`c${col}`));
-    nxt.push(ctx.Int.const(`cp${col}`));
-  }
-  return { colUnc, colCol, nCols, cur, nxt };
+  return { colUnc, colCol, cur, nxt };
 }
-function encodeColoured(ctx, fp, plan, flat, initial, property, invariants, sinkPlaces = /* @__PURE__ */ new Set()) {
+function quantified2(names) {
+  return names.map((v) => `(${v} Int)`).join(" ");
+}
+function encodeColoured(plan, flat, initial, property, invariants, sinkPlaces) {
   const P = flat.places.length;
   const k = plan.k;
-  const lay = buildLayout(ctx, plan, P);
-  const intSort = ctx.Int.sort();
-  const boolSort = ctx.Bool.sort();
-  const markingSorts = new Array(lay.nCols).fill(intSort);
-  const reachable = ctx.Function.declare("Reachable", ...markingSorts, boolSort);
-  fp.registerRelation(reachable);
-  const error = ctx.Function.declare("Error", boolSort);
-  fp.registerRelation(error);
-  const initArgs = new Array(lay.nCols);
+  const lay = buildLayout(plan, P);
+  const nCols = lay.cur.length;
+  const lines = [];
+  lines.push("(set-logic HORN)");
+  lines.push("");
+  lines.push(`(declare-fun Reachable (${new Array(nCols).fill("Int").join(" ")}) Bool)`);
+  lines.push("(declare-fun Error () Bool)");
+  lines.push("");
+  const init = [];
   for (let i = 0; i < P; i++) {
     if (plan.isColoured[i]) {
-      for (let c = 0; c < k; c++) initArgs[lay.colCol[i][c]] = ctx.Int.val(0);
+      for (let c = 0; c < k; c++) init.push("0");
     } else {
-      initArgs[lay.colUnc[i]] = ctx.Int.val(initial.tokens(flat.places[i]));
+      init.push(String(initial.tokens(flat.places[i])));
     }
   }
-  fp.addRule(reachable.call(...initArgs), "init");
+  lines.push(`(assert (Reachable ${init.join(" ")}))`);
+  lines.push("");
   for (let ti = 0; ti < plan.classes.length; ti++) {
     const cls = plan.classes[ti];
     const ft = flat.transitions[ti];
-    if (cls.kind === "untouched") {
-      addRule(
-        ctx,
-        fp,
-        reachable,
-        lay,
-        plan,
-        invariants,
-        `${ft.name}_u`,
-        (enab, upd) => uncolouredIncidence(ctx, lay, plan, ft, enab, upd)
-      );
-    } else if (cls.kind === "mint") {
-      const colouredOut = cls.colouredOut;
-      for (let c = 0; c < k; c++) {
-        const cc = c;
-        addRule(ctx, fp, reachable, lay, plan, invariants, `${ft.name}_mint_${cc}`, (enab, upd) => {
-          uncolouredIncidence(ctx, lay, plan, ft, enab, upd);
-          for (const q of plan.coloured) enab.push(lay.cur[lay.colCol[q][cc]].eq(0));
-          for (const o of colouredOut) {
-            const col = lay.colCol[o][cc];
-            upd.set(col, lay.cur[col].add(1));
-          }
-        });
-      }
-    } else if (cls.kind === "join") {
-      const colouredIn = cls.colouredIn;
-      for (let c = 0; c < k; c++) {
-        const cc = c;
-        addRule(ctx, fp, reachable, lay, plan, invariants, `${ft.name}_join_${cc}`, (enab, upd) => {
-          uncolouredIncidence(ctx, lay, plan, ft, enab, upd);
-          for (const ip of colouredIn) {
-            const col = lay.colCol[ip][cc];
-            enab.push(lay.cur[col].ge(1));
-            upd.set(col, lay.cur[col].add(-1));
-          }
-        });
-      }
-    } else {
-      const inputCol = cls.inputCol;
-      const colouredOut = cls.colouredOut;
-      for (let c = 0; c < k; c++) {
-        const cc = c;
-        addRule(ctx, fp, reachable, lay, plan, invariants, `${ft.name}_consume_${cc}`, (enab, upd) => {
-          uncolouredIncidence(ctx, lay, plan, ft, enab, upd);
-          const icol = lay.colCol[inputCol][cc];
-          enab.push(lay.cur[icol].ge(1));
-          upd.set(icol, lay.cur[icol].add(-1));
-          for (const o of colouredOut) {
-            const ocol = lay.colCol[o][cc];
-            upd.set(ocol, lay.cur[ocol].add(1));
-          }
-        });
-      }
+    switch (cls.kind) {
+      case "untouched":
+        lines.push(encodeRule(plan, lay, invariants, (enab, upd) => uncolouredIncidence(lay, plan, ft, enab, upd)));
+        break;
+      case "mint":
+        for (let c = 0; c < k; c++) {
+          lines.push(encodeRule(plan, lay, invariants, (enab, upd) => {
+            uncolouredIncidence(lay, plan, ft, enab, upd);
+            for (const q of plan.coloured) enab.push(`(= ${lay.cur[lay.colCol[q][c]]} 0)`);
+            for (const o of cls.colouredOut) {
+              const col = lay.colCol[o][c];
+              upd.push({ col, expr: `(+ ${lay.cur[col]} 1)` });
+            }
+          }));
+        }
+        break;
+      case "join":
+        for (let c = 0; c < k; c++) {
+          lines.push(encodeRule(plan, lay, invariants, (enab, upd) => {
+            uncolouredIncidence(lay, plan, ft, enab, upd);
+            for (const ip of cls.colouredIn) {
+              const col = lay.colCol[ip][c];
+              enab.push(`(>= ${lay.cur[col]} 1)`);
+              upd.push({ col, expr: `(- ${lay.cur[col]} 1)` });
+            }
+          }));
+        }
+        break;
+      case "consume":
+        for (let c = 0; c < k; c++) {
+          lines.push(encodeRule(plan, lay, invariants, (enab, upd) => {
+            uncolouredIncidence(lay, plan, ft, enab, upd);
+            const icol = lay.colCol[cls.inputCol][c];
+            enab.push(`(>= ${lay.cur[icol]} 1)`);
+            upd.push({ col: icol, expr: `(- ${lay.cur[icol]} 1)` });
+            for (const o of cls.colouredOut) {
+              const ocol = lay.colCol[o][c];
+              upd.push({ col: ocol, expr: `(+ ${lay.cur[ocol]} 1)` });
+            }
+          }));
+        }
+        break;
     }
   }
-  if (!addErrorRule(ctx, fp, reachable, error, lay, plan, flat, property, sinkPlaces)) {
-    return null;
-  }
-  return {
-    errorExpr: error.call(),
-    reachableDecl: reachable
-  };
+  lines.push("");
+  const error = encodeError(plan, lay, flat, property, sinkPlaces, injectionMap(flat));
+  if (error == null) return null;
+  lines.push(error);
+  lines.push("");
+  lines.push("(assert (not Error))");
+  lines.push("(check-sat)");
+  return { smt2: lines.join("\n"), placeCount: P };
 }
-function addRule(ctx, fp, reachable, lay, plan, invariants, ruleName, fill) {
+function encodeRule(plan, lay, invariants, fill) {
   const enab = [];
-  const upd = /* @__PURE__ */ new Map();
+  const upd = [];
   fill(enab, upd);
-  const conds = [reachable.call(...lay.cur), ...enab];
-  for (let col = 0; col < lay.nCols; col++) {
-    const expr = upd.get(col);
-    if (expr !== void 0) {
-      conds.push(lay.nxt[col].eq(expr), lay.nxt[col].ge(0));
+  const conditions = [`(Reachable ${lay.cur.join(" ")})`, ...enab];
+  const changed = new Array(lay.cur.length).fill(null);
+  for (const u of upd) changed[u.col] = u.expr;
+  for (let col = 0; col < lay.cur.length; col++) {
+    const expr = changed[col];
+    if (expr != null) {
+      conditions.push(`(= ${lay.nxt[col]} ${expr})`);
+      conditions.push(`(>= ${lay.nxt[col]} 0)`);
     } else {
-      conds.push(lay.nxt[col].eq(lay.cur[col]));
+      conditions.push(`(= ${lay.nxt[col]} ${lay.cur[col]})`);
     }
   }
   for (const inv of invariants) {
-    const eq = liftedInvariant(ctx, inv, plan, lay, lay.nxt);
-    if (eq) conds.push(eq);
+    const eq = liftedInvariant(inv, plan, lay, lay.nxt);
+    if (eq != null) conditions.push(eq);
   }
-  const body = ctx.And(...conds);
-  const head = reachable.call(...lay.nxt);
-  const qRule = ctx.ForAll([...lay.cur, ...lay.nxt], ctx.Implies(body, head));
-  fp.addRule(qRule, ruleName);
+  const body = `(and ${conditions.join("\n            ")})`;
+  return `(assert (forall (${quantified2([...lay.cur, ...lay.nxt])})
+  (=> ${body}
+      (Reachable ${lay.nxt.join(" ")}))))`;
 }
-function uncolouredIncidence(ctx, lay, plan, ft, enab, upd) {
+function uncolouredIncidence(lay, plan, ft, enab, upd) {
   const P = ft.preVector.length;
   for (let i = 0; i < P; i++) {
     if (plan.isColoured[i]) continue;
     const col = lay.colUnc[i];
     const pre = ft.preVector[i];
-    if (pre > 0) enab.push(lay.cur[col].ge(pre));
+    if (pre > 0) enab.push(`(>= ${lay.cur[col]} ${pre})`);
     if (ft.resetPlaces.includes(i) || ft.consumeAll[i]) {
-      upd.set(col, ctx.Int.val(ft.postVector[i]));
+      upd.push({ col, expr: String(ft.postVector[i]) });
     } else {
       const delta = ft.postVector[i] - ft.preVector[i];
-      if (delta !== 0) upd.set(col, lay.cur[col].add(delta));
+      if (delta > 0) upd.push({ col, expr: `(+ ${lay.cur[col]} ${delta})` });
+      else if (delta < 0) upd.push({ col, expr: `(- ${lay.cur[col]} ${-delta})` });
     }
   }
-  for (const pid of ft.inhibitorPlaces) enab.push(lay.cur[lay.colUnc[pid]].eq(0));
-  for (const pid of ft.readPlaces) enab.push(lay.cur[lay.colUnc[pid]].ge(1));
+  for (const pid of ft.inhibitorPlaces) enab.push(`(= ${lay.cur[lay.colUnc[pid]]} 0)`);
+  for (const pid of ft.readPlaces) enab.push(`(>= ${lay.cur[lay.colUnc[pid]]} 1)`);
 }
-function aggregate(plan, lay, place, vars) {
+function aggregate(plan, lay, place, names) {
   if (plan.isColoured[place]) {
     const cols = lay.colCol[place];
-    let sum = vars[cols[0]];
-    for (let c = 1; c < cols.length; c++) sum = sum.add(vars[cols[c]]);
-    return sum;
+    if (cols.length === 0) return "0";
+    if (cols.length === 1) return names[cols[0]];
+    return `(+ ${cols.map((c) => names[c]).join(" ")})`;
   }
-  return vars[lay.colUnc[place]];
+  return names[lay.colUnc[place]];
 }
-function liftedInvariant(ctx, inv, plan, lay, vars) {
-  if (inv.support.size === 0) return null;
-  let sum = ctx.Int.val(0);
-  for (const i of inv.support) {
-    const agg = aggregate(plan, lay, i, vars);
+function liftedInvariant(inv, plan, lay, names) {
+  const terms = [];
+  for (const i of [...inv.support].sort((a, b) => a - b)) {
+    const agg = aggregate(plan, lay, i, names);
     const w = inv.weights[i];
-    sum = sum.add(w === 1 ? agg : agg.mul(w));
-  }
-  return sum.eq(inv.constant);
-}
-function addErrorRule(ctx, fp, reachable, error, lay, plan, flat, property, sinkPlaces) {
-  const violation = encodeViolation(ctx, plan, lay, flat, property, lay.cur, sinkPlaces);
-  if (violation === null) return false;
-  const reachBody = reachable.call(...lay.cur);
-  const body = ctx.And(reachBody, violation);
-  const head = error.call();
-  const qRule = ctx.ForAll([...lay.cur], ctx.Implies(body, head));
-  fp.addRule(qRule, "error");
-  return true;
-}
-function encodeViolation(ctx, plan, lay, flat, property, cur, sinkPlaces) {
+    terms.push(w === 1 ? agg : `(* ${w} ${agg})`);
+  }
+  if (terms.length === 0) return null;
+  const sum = terms.length === 1 ? terms[0] : `(+ ${terms.join(" ")})`;
+  return `(= ${sum} ${inv.constant})`;
+}
+function encodeError(plan, lay, flat, property, sinkPlaces, envInj) {
+  const violation = encodeViolation(plan, lay, flat, property, sinkPlaces, envInj);
+  if (violation == null) return null;
+  return `(assert (forall (${quantified2(lay.cur)})
+  (=> (and (Reachable ${lay.cur.join(" ")}) ${violation})
+      Error)))`;
+}
+function encodeViolation(plan, lay, flat, property, sinkPlaces, envInj) {
+  const anyPlacePresent = (places) => {
+    const conds = indexOrdered(flat, places).map((pid) => `(>= ${aggregate(plan, lay, pid, lay.cur)} 1)`);
+    return conds.length === 0 ? "false" : `(and ${conds.join(" ")})`;
+  };
   switch (property.type) {
     case "place-bound":
     case "branch-place-bound": {
-      const idx = flatNetIndexOf(flat, property.place);
-      if (idx < 0) return null;
-      return aggregate(plan, lay, idx, cur).gt(property.bound);
-    }
-    case "mutual-exclusion": {
-      const i1 = flatNetIndexOf(flat, property.p1);
-      const i2 = flatNetIndexOf(flat, property.p2);
-      if (i1 < 0 || i2 < 0) return ctx.Bool.val(false);
-      return ctx.And(aggregate(plan, lay, i1, cur).ge(1), aggregate(plan, lay, i2, cur).ge(1));
-    }
-    case "unreachable": {
-      const conds = [];
-      for (const place of property.places) {
-        const idx = flatNetIndexOf(flat, place);
-        if (idx >= 0) conds.push(aggregate(plan, lay, idx, cur).ge(1));
-      }
-      if (conds.length === 0) return ctx.Bool.val(false);
-      return conds.length === 1 ? conds[0] : ctx.And(...conds);
+      const pid = flat.placeIndex.get(property.place.name);
+      if (pid == null) return null;
+      return `(> ${aggregate(plan, lay, pid, lay.cur)} ${property.bound})`;
     }
+    case "mutual-exclusion":
+      return anyPlacePresent([property.p1, property.p2]);
+    case "unreachable":
+      return anyPlacePresent(property.places);
     case "deadlock-free":
-      return encodeColouredDeadlock(ctx, plan, lay, flat, sinkPlaces);
+      return encodeColouredDeadlock(plan, lay, flat, sinkPlaces, envInj);
     case "joined-or-dead-lettered": {
-      const idx = flatNetIndexOf(flat, property.pending);
-      if (idx < 0) return null;
-      const deadlock = encodeColouredDeadlock(ctx, plan, lay, flat, sinkPlaces);
-      return ctx.And(deadlock, aggregate(plan, lay, idx, cur).ge(1));
+      const pid = flat.placeIndex.get(property.pending.name);
+      if (pid == null) return null;
+      const deadlock = encodeColouredDeadlock(plan, lay, flat, sinkPlaces, envInj);
+      return `(and ${deadlock} (>= ${aggregate(plan, lay, pid, lay.cur)} 1))`;
     }
   }
 }
-function andAll(ctx, xs) {
-  if (xs.length === 0) return ctx.Bool.val(true);
-  let r = xs[0];
-  for (let i = 1; i < xs.length; i++) r = ctx.And(r, xs[i]);
-  return r;
-}
-function orAll(ctx, xs) {
-  if (xs.length === 0) return ctx.Bool.val(false);
-  let r = xs[0];
-  for (let i = 1; i < xs.length; i++) r = ctx.Or(r, xs[i]);
-  return r;
-}
-function injectedEnvIndices2(flat) {
-  const out = /* @__PURE__ */ new Map();
-  for (const [name, bound] of flat.environmentInjection) {
-    const idx = flat.placeIndex.get(name);
-    if (idx != null) out.set(idx, bound);
-  }
-  return out;
-}
-function uncolouredDisable(ft, lay, plan, envInj) {
-  const reasons = [];
+function uncolouredDisable(ft, lay, plan, envInj, reasons) {
   let permanentlyDisabled = false;
   const P = ft.preVector.length;
   for (let i = 0; i < P; i++) {
     if (plan.isColoured[i] || ft.preVector[i] === 0) continue;
     if (envInj.has(i)) {
       const bound = envInj.get(i);
-      if (bound !== null && ft.preVector[i] > bound) permanentlyDisabled = true;
+      if (bound != null && ft.preVector[i] > bound) permanentlyDisabled = true;
       continue;
     }
-    reasons.push(lay.cur[lay.colUnc[i]].lt(ft.preVector[i]));
-  }
-  for (const inh of ft.inhibitorPlaces) {
-    reasons.push(lay.cur[lay.colUnc[inh]].gt(0));
+    reasons.push(`(< ${lay.cur[lay.colUnc[i]]} ${ft.preVector[i]})`);
   }
+  for (const inh of ft.inhibitorPlaces) reasons.push(`(> ${lay.cur[lay.colUnc[inh]]} 0)`);
   for (const rd of ft.readPlaces) {
     if (envInj.has(rd)) {
       const bound = envInj.get(rd);
-      if (bound !== null && bound < 1) permanentlyDisabled = true;
+      if (bound != null && bound < 1) permanentlyDisabled = true;
       continue;
     }
-    reasons.push(lay.cur[lay.colUnc[rd]].lt(1));
+    reasons.push(`(< ${lay.cur[lay.colUnc[rd]]} 1)`);
   }
-  return { reasons, permanentlyDisabled };
+  return permanentlyDisabled;
 }
-function colouredDisabledTerm(ctx, cls, plan, lay) {
+function colouredDisabledTerm(cls, plan, lay) {
   const k = plan.k;
+  if (k === 0) {
+    return cls.kind === "untouched" ? null : "true";
+  }
   switch (cls.kind) {
     case "untouched":
       return null;
     case "mint": {
       const perColour = [];
       for (let c = 0; c < k; c++) {
-        const present = plan.coloured.map((q) => lay.cur[lay.colCol[q][c]].ge(1));
-        perColour.push(orAll(ctx, present));
+        const present = plan.coloured.map((q) => `(>= ${lay.cur[lay.colCol[q][c]]} 1)`);
+        perColour.push(`(or ${present.join(" ")})`);
       }
-      return andAll(ctx, perColour);
+      return `(and ${perColour.join(" ")})`;
     }
     case "join": {
       const perColour = [];
       for (let c = 0; c < k; c++) {
-        const missing = cls.colouredIn.map((i) => lay.cur[lay.colCol[i][c]].eq(0));
-        perColour.push(orAll(ctx, missing));
+        const missing = cls.colouredIn.map((i) => `(= ${lay.cur[lay.colCol[i][c]]} 0)`);
+        perColour.push(`(or ${missing.join(" ")})`);
       }
-      return andAll(ctx, perColour);
+      return `(and ${perColour.join(" ")})`;
     }
     case "consume": {
       const perColour = [];
-      for (let c = 0; c < k; c++) {
-        perColour.push(lay.cur[lay.colCol[cls.inputCol][c]].eq(0));
-      }
-      return andAll(ctx, perColour);
+      for (let c = 0; c < k; c++) perColour.push(`(= ${lay.cur[lay.colCol[cls.inputCol][c]]} 0)`);
+      return `(and ${perColour.join(" ")})`;
     }
   }
 }
-function encodeColouredDeadlock(ctx, plan, lay, flat, sinkPlaces) {
-  const envInj = injectedEnvIndices2(flat);
+function encodeColouredDeadlock(plan, lay, flat, sinkPlaces, envInj) {
   const disabledConditions = [];
   for (let ti = 0; ti < plan.classes.length; ti++) {
     const cls = plan.classes[ti];
     const ft = flat.transitions[ti];
-    const { reasons, permanentlyDisabled } = uncolouredDisable(ft, lay, plan, envInj);
+    const reasons = [];
+    const permanentlyDisabled = uncolouredDisable(ft, lay, plan, envInj, reasons);
     if (permanentlyDisabled) {
-      disabledConditions.push(ctx.Bool.val(true));
+      disabledConditions.push("true");
       continue;
     }
-    const term = colouredDisabledTerm(ctx, cls, plan, lay);
-    if (term !== null) reasons.push(term);
-    if (reasons.length === 0) {
-      return ctx.Bool.val(false);
-    }
-    disabledConditions.push(reasons.length === 1 ? reasons[0] : orAll(ctx, reasons));
-  }
-  const sinkIndices = /* @__PURE__ */ new Set();
-  for (const sink of sinkPlaces) {
-    const idx = flatNetIndexOf(flat, sink);
-    if (idx >= 0) sinkIndices.add(idx);
+    const term = colouredDisabledTerm(cls, plan, lay);
+    if (term != null) reasons.push(term);
+    if (reasons.length === 0) return "false";
+    disabledConditions.push(reasons.length === 1 ? reasons[0] : `(or ${reasons.join(" ")})`);
   }
-  if (sinkIndices.size > 0) {
-    const nonSink = [];
-    for (let pid = 0; pid < flat.places.length; pid++) {
-      if (sinkIndices.has(pid)) continue;
-      nonSink.push(aggregate(plan, lay, pid, lay.cur).ge(1));
-    }
-    if (nonSink.length > 0) {
-      disabledConditions.push(orAll(ctx, nonSink));
-    }
+  for (const pid of indexOrdered(flat, sinkPlaces)) {
+    disabledConditions.push(`(= ${aggregate(plan, lay, pid, lay.cur)} 0)`);
   }
-  return andAll(ctx, disabledConditions);
+  return disabledConditions.length === 0 ? "true" : `(and ${disabledConditions.join(" ")})`;
 }
 
 // src/verification/analysis/name-fragment.ts
@@ -3066,13 +3176,21 @@ function compareNumberArrays(a, b) {
 var NameStateClass = class {
   base;
   names;
-  key;
-  constructor(base, names, colouredOrder) {
+  /** The symmetry-canonical name-partition key (the name layer's intern key). */
+  nameKey;
+  constructor(base, names, colouredOrder, nameKey) {
     this.base = base;
     this.names = names;
-    this.key = `${base.marking.toString()}|${base.firingDomain.toString()}||${names.canonicalKey(colouredOrder)}`;
+    this.nameKey = nameKey ?? names.canonicalKey(colouredOrder);
+  }
+  /** Full dedup key: the base key (marking + DBM zone) joined with the name key. */
+  get key() {
+    return `${baseKeyOf(this.base)}||${this.nameKey}`;
   }
 };
+function baseKeyOf(base) {
+  return `${base.marking.toString()}|${base.firingDomain.toString()}`;
+}
 
 // src/verification/analysis/name-state-class-graph.ts
 var NameStateClassGraph = class _NameStateClassGraph {
@@ -3101,9 +3219,16 @@ var NameStateClassGraph = class _NameStateClassGraph {
     }
     const graph = new _NameStateClassGraph();
     const base0 = initialStateClass(net, initialMarking, envPlaces, envMode);
-    const initial = new NameStateClass(base0, new NameMarking(), fragment.colouredOrder);
+    const baseIntern = /* @__PURE__ */ new Map();
+    const nameIntern = /* @__PURE__ */ new Map();
     const indexOf = /* @__PURE__ */ new Map();
-    graph.pushClass(initial, indexOf);
+    const b0 = internBase(baseIntern, base0);
+    const n0 = internNames(nameIntern, new NameMarking(), fragment.colouredOrder);
+    graph.pushClass(
+      new NameStateClass(b0.base, n0.names, fragment.colouredOrder, n0.nameKey),
+      classId(b0.id, n0.id),
+      indexOf
+    );
     const sym = { next: 0 };
     const queue = [0];
     while (queue.length > 0) {
@@ -3132,12 +3257,18 @@ var NameStateClassGraph = class _NameStateClassGraph {
           const baseSucc = computeSuccessor(net, current.base, vt, envPlaces, envMode);
           if (baseSucc === null || baseSucc.isEmpty()) continue;
           const nameSuccs = nameSuccessors(role, current.names, vt.outputPlaces, fragment, sym);
+          const shared = internBase(baseIntern, baseSucc);
           for (const nm of nameSuccs) {
-            const succ = new NameStateClass(baseSucc, nm, fragment.colouredOrder);
-            let toIdx = indexOf.get(succ.key);
+            const sharedNames = internNames(nameIntern, nm, fragment.colouredOrder);
+            const id = classId(shared.id, sharedNames.id);
+            let toIdx = indexOf.get(id);
             if (toIdx === void 0) {
               toIdx = graph.classes.length;
-              graph.pushClass(succ, indexOf);
+              graph.pushClass(
+                new NameStateClass(shared.base, sharedNames.names, fragment.colouredOrder, sharedNames.nameKey),
+                id,
+                indexOf
+              );
               queue.push(toIdx);
             }
             graph.addEdge(curIdx, toIdx, transition.name);
@@ -3147,17 +3278,38 @@ var NameStateClassGraph = class _NameStateClassGraph {
     }
     return graph;
   }
-  pushClass(c, indexOf) {
+  pushClass(c, id, indexOf) {
     const idx = this.classes.length;
     this.classes.push(c);
     this._successors.push([]);
-    indexOf.set(c.key, idx);
+    indexOf.set(id, idx);
   }
   addEdge(from, to, name) {
     this.edges.push({ from, to, transitionName: name });
     this._successors[from].push(to);
   }
 };
+function classId(baseId, nameId) {
+  return `${baseId}:${nameId}`;
+}
+function internBase(intern, base) {
+  const key = `${baseKeyOf(base)}#${base.readyEarliest.join(",")}`;
+  let entry = intern.get(key);
+  if (entry === void 0) {
+    entry = { id: intern.size, base };
+    intern.set(key, entry);
+  }
+  return entry;
+}
+function internNames(intern, names, colouredOrder) {
+  const nameKey = names.canonicalKey(colouredOrder);
+  let entry = intern.get(nameKey);
+  if (entry === void 0) {
+    entry = { id: intern.size, names, nameKey };
+    intern.set(nameKey, entry);
+  }
+  return entry;
+}
 var READY_EPS = 1e-9;
 function priorityDominated(l, idxL, enabled, readyEarliest, marking, names, fragment) {
   return enabled.some(
@@ -3376,10 +3528,12 @@ function counterexamplePath(scg, target) {
 }
 
 // src/verification/smt-verifier.ts
+var IGNORE_MODE_VACUITY_REASON = "environment places present but not modeled (mode=ignore); a proof would be vacuous \u2014 use alwaysAvailable() or bounded(k) to model external injection";
 var SmtVerifier = class _SmtVerifier {
   constructor(net) {
     this.net = net;
   }
+  net;
   _initialMarking = MarkingState.empty();
   _property = deadlockFree();
   _environmentPlaces = /* @__PURE__ */ new Set();
@@ -3389,6 +3543,7 @@ var SmtVerifier = class _SmtVerifier {
   _timeoutMs = 6e4;
   _certificateCheck = true;
   _counterexampleReplay = true;
+  _semiflowInvariants = false;
   _nuMaxClasses = 1e5;
   _fragmentMode = "base";
   _carrierPlaces = /* @__PURE__ */ new Set();
@@ -3470,6 +3625,43 @@ var SmtVerifier = class _SmtVerifier {
     this._counterexampleReplay = enabled;
     return this;
   }
+  /**
+   * Also hands the validated **P-semiflows** to the encoders as invariants
+   * (VER-007; default: disabled — the encoders then see only the null-space basis).
+   *
+   * Every validated semiflow is a conservation law in its own right (`y >= 0`,
+   * `y·C = 0`, `y·M0` exact, zero weight on every reset / consume-all place), and
+   * the Farkas enumeration returns the *minimal* laws of the net. The null-space
+   * basis the encoders get by default is one basis of many: elimination hands back
+   * mixed-sign rows (discarded as not semi-positive) or rows that fold a reset place
+   * into a chain whose other combinations avoid it (dropped by the H1 guard). On a
+   * net with a few reset arcs that can lose every law of the chains those arcs
+   * touch, and without them IC3 has to rediscover the conservation of each chain —
+   * on a ~100-place net it does not within any practical budget.
+   *
+   * **Turn this on if the net has any `all()` / `atLeast(n)` or reset arc on a busy
+   * place** — draining an input queue is the everyday case. Every basis row whose
+   * support touches such a place fails the H1 guard and is dropped, so the encoders
+   * run on a deficient invariant set and nothing in the report says a law is missing
+   * beyond the `Dropped` lines.
+   *
+   * This reaches the **name-coloured** encoder (NU-050) as well as the flat one, and
+   * it matters most there. On a 113-place ν-net, whole-net deadlock-freedom went from
+   * `unknown` after 50 minutes to `proven` in about 15 seconds with this option as the
+   * only change; on the flat path, reachability-safety queries that timed out at 120 s
+   * close in about a second.
+   *
+   * Soundness is unchanged: the semiflows pass the same exact re-validation as the
+   * basis rows, the union is pure strengthening (`Semiflow.lean`,
+   * `semiflow_union_sound`), and the certificate check re-proves the strengthened
+   * invariant — that check is flat-path only, so a coloured `proven` reports
+   * `Certificate check: not applicable (name-coloured encoding)`. Off by default so
+   * reports stay byte-equal.
+   */
+  semiflowInvariants(enabled) {
+    this._semiflowInvariants = enabled;
+    return this;
+  }
   /**
    * Sets the class-count cap for the ν-aware state-class-graph analysis (NU-050,
    * Route B). When the symbolic name-aware graph would exceed this, the analysis
@@ -3524,6 +3716,91 @@ var SmtVerifier = class _SmtVerifier {
     this._prioritySemantics = semantics;
     return this;
   }
+  /**
+   * The name-coloured plan and its encoding, or a null plan when the net is outside
+   * the fragment (NU-050) and a null encoding when the property names a place the net
+   * does not resolve.
+   *
+   * {@link verify} and {@link encodeScripts} share this deliberately. They used to
+   * invoke `buildColouredPlan` and `encodeColoured` separately, so handing the encoder
+   * the wrong one of the two lists changed only one of them — and the script-parity
+   * goldens are generated from `encodeScripts`. Unifying the invocation closes that. It
+   * does not make the two paths identical: each still computes its own invariant and
+   * semiflow lists, so they can still drift through the arguments rather than the call.
+   *
+   * `invariants` is what the encoder conjoins into every rule body (the null-space
+   * basis, unioned with the semiflows when VER-007 is enabled); `semiflows` sets the
+   * colour-slot bound k (NU-053). They are not the same list.
+   */
+  colouredAttempt(flatNet, invariants, semiflows) {
+    const hasMatch = [...this.net.transitions].some((t) => t.matchSpec !== null);
+    const nuBounded = this._budgetPlaces.size > 0;
+    if (!hasMatch || !nuBounded) return { plan: null, encoding: null };
+    const plan = buildColouredPlan(
+      this.net,
+      flatNet,
+      this._initialMarking,
+      this._budgetPlaces,
+      this._fragmentMode,
+      this._carrierPlaces,
+      semiflows
+    );
+    if (plan == null) return { plan: null, encoding: null };
+    return {
+      plan,
+      encoding: encodeColoured(
+        plan,
+        flatNet,
+        this._initialMarking,
+        this._property,
+        invariants,
+        this._sinkPlaces
+      )
+    };
+  }
+  /**
+   * The SMT-LIB2 scripts {@link verify} would send to z3 for this configuration,
+   * without running a solver (VER-013 AC1): the HORN query (flat, or name-coloured
+   * when a declared budget puts the net on Route A's exact encoding) and, for the
+   * flat encoding, the certificate-check script built around
+   * {@link placeholderCertificate}. This is what the cross-language golden tests diff
+   * byte for byte. Route B, the structural pre-check and the unresolved-place
+   * refusal are bypassed: it is what Route A encodes.
+   */
+  encodeScripts() {
+    requireOutputProducingActions(this.net);
+    const flatNet = flatten(this.net, this._environmentPlaces, this._environmentMode);
+    const matrix = IncidenceMatrix.from(flatNet);
+    const { valid: basis } = validateInvariantsExact(
+      matrix,
+      computePInvariants(matrix, flatNet, this._initialMarking),
+      flatNet,
+      this._initialMarking
+    );
+    const { valid: semiflows } = validateInvariantsExact(
+      matrix,
+      computePSemiflows(matrix, flatNet, this._initialMarking),
+      flatNet,
+      this._initialMarking
+    );
+    let invariants = basis;
+    if (this._semiflowInvariants) invariants = strengthenWithSemiflows(basis, semiflows).invariants;
+    invariants = canonicalInvariantOrder(invariants);
+    const attempt = this.colouredAttempt(flatNet, invariants, semiflows);
+    if (attempt.encoding != null) {
+      return { horn: attempt.encoding.smt2, certificate: null, coloured: true };
+    }
+    const horn = encode(flatNet, this._initialMarking, this._property, invariants, this._sinkPlaces, this._counterexampleReplay).smt2;
+    const certificate = vcScript(
+      placeholderCertificate(flatNet.places.length),
+      flatNet,
+      this._initialMarking,
+      this._property,
+      this._sinkPlaces,
+      invariants
+    );
+    return { horn, certificate, coloured: false };
+  }
   /**
    * Runs the verification pipeline.
    *
@@ -3562,8 +3839,13 @@ var SmtVerifier = class _SmtVerifier {
         if (outcome.transitions.length > 0) {
           report.push(`  Counterexample trace: ${outcome.trace.length} states, ${outcome.transitions.length} transitions`);
         }
+        let routeBVerdict = outcome.verdict;
+        if (routeBVerdict.type === "proven" && this._environmentPlaces.size > 0 && this._environmentMode.type === "ignore") {
+          report.push(`  Downgraded to UNKNOWN: ${IGNORE_MODE_VACUITY_REASON}`);
+          routeBVerdict = { type: "unknown", reason: IGNORE_MODE_VACUITY_REASON };
+        }
         return buildResult(
-          outcome.verdict,
+          routeBVerdict,
           report.join("\n"),
           [],
           [],
@@ -3630,7 +3912,7 @@ var SmtVerifier = class _SmtVerifier {
     }
     report.push("Phase 3: Computing P-invariants...");
     const matrix = IncidenceMatrix.from(flatNet);
-    const { valid: invariants, dropped: droppedInvariants } = validateInvariantsExact(
+    const { valid: basisInvariants, dropped: droppedInvariants } = validateInvariantsExact(
       matrix,
       computePInvariants(matrix, flatNet, this._initialMarking),
       flatNet,
@@ -3642,7 +3924,14 @@ var SmtVerifier = class _SmtVerifier {
       flatNet,
       this._initialMarking
     );
-    report.push(`  Found: ${invariants.length} P-invariant(s)`);
+    report.push(`  Found: ${basisInvariants.length} P-invariant(s)`);
+    let invariants = basisInvariants;
+    if (this._semiflowInvariants) {
+      const { invariants: strengthened, added } = strengthenWithSemiflows(basisInvariants, semiflows);
+      invariants = strengthened;
+      report.push(`  Semiflows encoded as invariants: ${added}`);
+    }
+    invariants = canonicalInvariantOrder(invariants);
     const structurallyBounded = isCoveredByInvariants(invariants, flatNet.places.length);
     report.push(`  Structurally bounded: ${structurallyBounded ? "YES" : "NO"}`);
     for (const inv of invariants) {
@@ -3662,284 +3951,210 @@ var SmtVerifier = class _SmtVerifier {
     }
     report.push("");
     report.push("Phase 4: IC3/PDR verification via Z3 Spacer...");
-    const colouredPlan = hasMatch && nuBounded ? buildColouredPlan(
-      this.net,
-      flatNet,
-      this._initialMarking,
-      this._budgetPlaces,
-      this._fragmentMode,
-      this._carrierPlaces,
-      semiflows
-    ) : null;
-    let runner;
+    const stats = {
+      places: flatNet.places.length,
+      transitions: flatNet.transitions.length,
+      invariantsFound: invariants.length,
+      structuralResult: structResultStr
+    };
+    let solver;
     try {
-      runner = await createSpacerRunner(this._timeoutMs);
+      solver = resolveZ3();
     } catch (e) {
-      report.push(`  ERROR: ${e.message ?? e}
+      const reason = e instanceof Z3Unavailable ? e.message : String(e?.message ?? e);
+      report.push(`  Solver: z3 unavailable (${reason})`);
+      report.push(`  Status: UNKNOWN (${reason})
 `);
       report.push("=== RESULT ===\n");
-      report.push(`UNKNOWN: Z3 initialization error: ${e.message ?? e}`);
-      return buildResult(
-        { type: "unknown", reason: `Z3 init error: ${e.message ?? e}` },
-        report.join("\n"),
-        invariants,
-        [],
-        [],
-        [],
-        performance.now() - start,
-        { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: invariants.length, structuralResult: structResultStr }
+      report.push(`UNKNOWN: Could not determine ${propDesc}`);
+      report.push(`  Reason: ${reason}`);
+      return buildResult({ type: "unknown", reason }, report.join("\n"), invariants, [], [], [], performance.now() - start, stats);
+    }
+    report.push(`  Solver: z3 ${formatZ3Version(solver.version)}`);
+    const colouredAttempt = this.colouredAttempt(flatNet, invariants, semiflows);
+    const colouredPlan = colouredAttempt.plan;
+    let encoding;
+    if (colouredPlan != null) {
+      report.push(
+        `  \u03BD-encoding: name-coloured (exact within budget k=${colouredPlan.k}; ${colouredPlan.coloured.length} coloured place(s))`
       );
+      const coloured = colouredAttempt.encoding;
+      if (coloured == null) {
+        const reason = "property names a place that does not resolve in the net; refusing to certify (the encoding would be vacuously proven)";
+        report.push("  Status: UNKNOWN (unresolved property place)\n");
+        report.push("=== RESULT ===\n");
+        report.push(`UNKNOWN: ${reason}`);
+        return buildResult({ type: "unknown", reason }, report.join("\n"), invariants, [], [], [], performance.now() - start, stats);
+      }
+      encoding = coloured;
+    } else {
+      const unresolved = unresolvedPropertyPlace(flatNet, this._property);
+      if (unresolved != null) {
+        const reason = `property names a place that does not resolve in the net ('${unresolved}'); refusing to certify (the encoding would be vacuously proven)`;
+        report.push("  Status: UNKNOWN (unresolved property place)\n");
+        report.push("=== RESULT ===\n");
+        report.push(`UNKNOWN: ${reason}`);
+        return buildResult({ type: "unknown", reason }, report.join("\n"), invariants, [], [], [], performance.now() - start, stats);
+      }
+      encoding = encode(flatNet, this._initialMarking, this._property, invariants, this._sinkPlaces, this._counterexampleReplay);
     }
-    try {
-      let encoding;
-      if (colouredPlan != null) {
-        report.push(
-          `  \u03BD-encoding: name-coloured (exact within budget k=${colouredPlan.k}; ${colouredPlan.coloured.length} coloured place(s))`
-        );
-        encoding = encodeColoured(runner.ctx, runner.fp, colouredPlan, flatNet, this._initialMarking, this._property, invariants, this._sinkPlaces);
-        if (encoding == null) {
-          const reason = "property names a place that does not resolve in the net; refusing to certify (the encoding would be vacuously proven)";
-          report.push("  Status: UNKNOWN (unresolved property place)\n");
+    const queryResult = await runZ3Spacer(
+      solver,
+      this._timeoutMs,
+      encoding.smt2,
+      colouredPlan != null ? "horn-coloured" : "horn"
+    );
+    switch (queryResult.type) {
+      case "proven": {
+        if (this._environmentPlaces.size > 0 && this._environmentMode.type === "ignore") {
+          const reason = IGNORE_MODE_VACUITY_REASON;
+          report.push(`  Status: UNSAT, but vacuous under ignore mode
+`);
           report.push("=== RESULT ===\n");
           report.push(`UNKNOWN: ${reason}`);
-          return buildResult(
-            { type: "unknown", reason },
-            report.join("\n"),
+          return buildResult({ type: "unknown", reason }, report.join("\n"), invariants, [], [], [], performance.now() - start, stats);
+        }
+        report.push("  Status: UNSAT (property holds)");
+        if (colouredPlan != null) {
+          report.push("  Certificate check: not applicable (name-coloured encoding)");
+        } else if (!this._certificateCheck) {
+          report.push("  Certificate check: not applicable (disabled)");
+        } else {
+          const certificate = await checkCertificate(
+            queryResult.invariantFormula,
+            flatNet,
+            this._initialMarking,
+            this._property,
             invariants,
-            [],
-            [],
-            [],
-            performance.now() - start,
-            { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: invariants.length, structuralResult: structResultStr }
+            this._sinkPlaces,
+            solver,
+            this._timeoutMs
           );
+          const reason = certificateDowngradeReason(certificate);
+          if (reason != null) {
+            report.push("  Certificate check: FAILED");
+            if (certificate.type !== "passed" && certificate.invariant != null) {
+              report.push("  Uncertified invariant:");
+              for (const line of certificate.invariant.split("\n")) report.push(`    ${line}`);
+            }
+            report.push("");
+            report.push("=== RESULT ===\n");
+            report.push(`UNKNOWN: ${reason}`);
+            return buildResult({ type: "unknown", reason }, report.join("\n"), invariants, [], [], [], performance.now() - start, stats);
+          }
+          report.push("  Certificate check: PASSED (init, consecution, safety)");
+        }
+        report.push("");
+        const formula = queryResult.invariantFormula;
+        const discoveredInvariants = formula != null ? [formula] : [];
+        if (formula != null) {
+          report.push("Phase 5: Inductive invariant (discovered by IC3)");
+          report.push("  Spacer synthesized:");
+          for (const line of formula.split("\n")) report.push(`    ${line}`);
+          report.push("  This formula is INDUCTIVE: preserved by all transitions.");
+          report.push("");
         }
-      } else {
-        encoding = encode(runner.ctx, runner.fp, flatNet, this._initialMarking, this._property, invariants, this._sinkPlaces);
+        report.push("=== RESULT ===\n");
+        report.push(`PROVEN (IC3/PDR): ${propDesc}`);
+        report.push("  Z3 Spacer proved no reachable state violates the property.");
+        report.push("  NOTE: Verification ignores timing constraints.");
+        report.push("  An untimed proof is STRONGER than a timed one (timing only restricts behavior).");
+        return this.applyNuGuard(buildResult(
+          { type: "proven", method: "IC3/PDR", inductiveInvariant: formula },
+          report.join("\n"),
+          invariants,
+          discoveredInvariants,
+          [],
+          [],
+          performance.now() - start,
+          stats
+        ), hasMatch, nuBounded, colouredPlan != null);
       }
-      const queryResult = await runner.query(encoding.errorExpr, encoding.reachableDecl);
-      switch (queryResult.type) {
-        case "proven": {
-          if (this._environmentPlaces.size > 0 && this._environmentMode.type === "ignore") {
-            const reason = "environment places present but not modeled (mode=ignore); a proof would be vacuous \u2014 use alwaysAvailable() or bounded(k) to model external injection";
-            report.push(`  Status: UNSAT, but vacuous under ignore mode
-`);
+      case "violated": {
+        report.push("  Status: SAT (counterexample found)\n");
+        const decoded = decode(queryResult.answer, flatNet);
+        if (decoded.note != null) report.push(`  Counterexample decoding: ${decoded.note}`);
+        let confirmed = null;
+        let trace = [...decoded.states];
+        let transitions = [];
+        let replayed = false;
+        if (colouredPlan == null && this._counterexampleReplay) {
+          const assessment = assessCounterexample(
+            flatNet,
+            this._initialMarking,
+            decoded.states,
+            this._property,
+            this._sinkPlaces
+          );
+          if (assessment.kind === "confirmed") {
+            confirmed = true;
+            replayed = true;
+            trace = assessment.trace;
+            transitions = assessment.firings;
+            report.push("  Counterexample replay: CONFIRMED (abstract chain M0 -> bad re-executed)");
+          } else if (assessment.kind === "unconfirmed") {
+            confirmed = false;
+            report.push(`  Counterexample replay: UNCONFIRMED (${assessment.note})`);
+            report.push("  The verdict rests on Spacer's answer.");
+          } else {
+            report.push("  Counterexample replay: FAILED");
+            report.push(`  Decoded states (order-free set, ${decoded.states.size}):`);
+            for (const m of decoded.states) report.push(`    ${m}`);
+            report.push(`  Raw Z3 answer: ${truncate(queryResult.answer, 2e3)}`);
+            report.push("");
             report.push("=== RESULT ===\n");
-            report.push(`UNKNOWN: ${reason}`);
+            report.push(`UNKNOWN: ${assessment.reason}`);
             return buildResult(
-              { type: "unknown", reason },
+              { type: "unknown", reason: assessment.reason },
               report.join("\n"),
               invariants,
               [],
               [],
               [],
               performance.now() - start,
-              { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: invariants.length, structuralResult: structResultStr }
-            );
-          }
-          report.push("  Status: UNSAT (property holds)");
-          if (colouredPlan != null) {
-            report.push("  Certificate check: not applicable (name-coloured encoding)");
-          } else if (!this._certificateCheck) {
-            report.push("  Certificate check: not applicable (disabled)");
-          } else {
-            const certificate = await checkCertificate(
-              runner.ctx,
-              queryResult.answer,
-              flatNet,
-              this._initialMarking,
-              this._property,
-              invariants,
-              this._sinkPlaces,
-              this._timeoutMs
-            );
-            const reason = certificateDowngradeReason(certificate);
-            if (reason != null) {
-              report.push("  Certificate check: FAILED");
-              if (certificate.type !== "passed" && certificate.invariant != null) {
-                report.push(`  Uncertified invariant: ${substituteNames(certificate.invariant, flatNet)}`);
-              }
-              report.push("");
-              report.push("=== RESULT ===\n");
-              report.push(`UNKNOWN: ${reason}`);
-              return buildResult(
-                { type: "unknown", reason },
-                report.join("\n"),
-                invariants,
-                [],
-                [],
-                [],
-                performance.now() - start,
-                { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: invariants.length, structuralResult: structResultStr }
-              );
-            }
-            report.push("  Certificate check: PASSED (init, consecution, safety)");
-          }
-          report.push("");
-          const discoveredInvariants = [];
-          if (queryResult.invariantFormula != null) {
-            discoveredInvariants.push(substituteNames(queryResult.invariantFormula, flatNet));
-          }
-          for (const level of queryResult.levelInvariants) {
-            discoveredInvariants.push(substituteNames(level, flatNet));
-          }
-          if (discoveredInvariants.length > 0) {
-            report.push("Phase 5: Inductive invariant (discovered by IC3)");
-            report.push(`  Spacer synthesized: ${discoveredInvariants[0]}`);
-            report.push("  This formula is INDUCTIVE: preserved by all transitions.");
-            if (discoveredInvariants.length > 1) {
-              report.push("  Per-level clauses:");
-              for (let i = 1; i < discoveredInvariants.length; i++) {
-                report.push(`    ${discoveredInvariants[i]}`);
-              }
-            }
-            report.push("");
-          }
-          report.push("=== RESULT ===\n");
-          report.push(`PROVEN (IC3/PDR): ${propDesc}`);
-          report.push("  Z3 Spacer proved no reachable state violates the property.");
-          report.push("  NOTE: Verification ignores timing constraints.");
-          report.push("  An untimed proof is STRONGER than a timed one (timing only restricts behavior).");
-          return this.applyNuGuard(buildResult(
-            {
-              type: "proven",
-              method: "IC3/PDR",
-              inductiveInvariant: queryResult.invariantFormula != null ? substituteNames(queryResult.invariantFormula, flatNet) : null
-            },
-            report.join("\n"),
-            invariants,
-            discoveredInvariants,
-            [],
-            [],
-            performance.now() - start,
-            { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: invariants.length, structuralResult: structResultStr }
-          ), hasMatch, nuBounded, colouredPlan != null);
-        }
-        case "violated": {
-          report.push("  Status: SAT (counterexample found)\n");
-          const decoded = decode(runner.ctx, queryResult.answer, flatNet);
-          const stats = {
-            places: flatNet.places.length,
-            transitions: flatNet.transitions.length,
-            invariantsFound: invariants.length,
-            structuralResult: structResultStr
-          };
-          let confirmed = null;
-          let trace = decoded.trace;
-          let transitions = decoded.transitions;
-          let replayed = false;
-          if (colouredPlan == null && this._counterexampleReplay) {
-            const assessment = assessCounterexample(
-              flatNet,
-              this._initialMarking,
-              decoded.states,
-              this._property,
-              this._sinkPlaces
+              stats,
+              false
             );
-            if (assessment.kind === "confirmed") {
-              confirmed = true;
-              replayed = true;
-              trace = assessment.trace;
-              transitions = assessment.firings;
-              report.push("  Counterexample replay: CONFIRMED (abstract chain M0 -> bad re-executed)");
-            } else if (assessment.kind === "unconfirmed") {
-              confirmed = false;
-              report.push(`  Counterexample replay: UNCONFIRMED (${assessment.note})`);
-              if (decoded.failure != null) {
-                report.push(`  Decoder degradation: ${describeDecodeFailure(decoded.failure)}`);
-              }
-              report.push("  The verdict rests on Spacer's SAT answer.");
-            } else {
-              report.push("  Counterexample replay: FAILED");
-              report.push(`  Decoded states (order-free set, ${decoded.states.size}):`);
-              for (const m of decoded.states) {
-                report.push(`    ${m}`);
-              }
-              if (decoded.trace.length > 0) {
-                report.push(`  Raw traversal-order trace (${decoded.trace.length} states):`);
-                for (let i = 0; i < decoded.trace.length; i++) {
-                  report.push(`    ${i}: ${decoded.trace[i]}`);
-                }
-              }
-              if (decoded.failure != null) {
-                report.push(`  Decoder degradation: ${describeDecodeFailure(decoded.failure)}`);
-              }
-              report.push(`  Raw Z3 answer: ${truncate(String(queryResult.answer), 2e3)}`);
-              report.push("");
-              report.push("=== RESULT ===\n");
-              report.push(`UNKNOWN: ${assessment.reason}`);
-              return buildResult(
-                { type: "unknown", reason: assessment.reason },
-                report.join("\n"),
-                invariants,
-                [],
-                [],
-                [],
-                performance.now() - start,
-                stats,
-                false
-              );
-            }
-          }
-          report.push("=== RESULT ===\n");
-          report.push(`VIOLATED: ${propDesc}`);
-          if (trace.length > 0) {
-            report.push(`  Counterexample trace (${replayed ? "replay order, " : ""}${trace.length} states):`);
-            for (let i = 0; i < trace.length; i++) {
-              report.push(`    ${i}: ${trace[i]}`);
-            }
-          }
-          if (transitions.length > 0) {
-            report.push(`  Firing sequence: ${transitions.join(" -> ")}`);
           }
-          report.push("\n  WARNING: This counterexample is in UNTIMED semantics.");
-          report.push("  It may be spurious if timing constraints prevent this sequence.");
-          return this.applyNuGuard(buildResult(
-            { type: "violated" },
-            report.join("\n"),
-            invariants,
-            [],
-            trace,
-            transitions,
-            performance.now() - start,
-            stats,
-            confirmed
-          ), hasMatch, nuBounded, colouredPlan != null);
         }
-        case "unknown": {
-          report.push(`  Status: UNKNOWN (${queryResult.reason})
-`);
-          report.push("=== RESULT ===\n");
-          report.push(`UNKNOWN: Could not determine ${propDesc}`);
-          report.push(`  Reason: ${queryResult.reason}`);
-          return buildResult(
-            { type: "unknown", reason: queryResult.reason },
-            report.join("\n"),
-            invariants,
-            [],
-            [],
-            [],
-            performance.now() - start,
-            { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: invariants.length, structuralResult: structResultStr }
-          );
+        report.push("=== RESULT ===\n");
+        report.push(`VIOLATED: ${propDesc}`);
+        if (trace.length > 0) {
+          report.push(`  Counterexample trace (${replayed ? "replay order, " : "proof order, "}${trace.length} states):`);
+          for (let i = 0; i < trace.length; i++) report.push(`    ${i}: ${trace[i]}`);
         }
+        if (transitions.length > 0) report.push(`  Firing sequence: ${transitions.join(" -> ")}`);
+        report.push("\n  WARNING: This counterexample is in UNTIMED semantics.");
+        report.push("  It may be spurious if timing constraints prevent this sequence.");
+        return this.applyNuGuard(buildResult(
+          { type: "violated" },
+          report.join("\n"),
+          invariants,
+          [],
+          trace,
+          transitions,
+          performance.now() - start,
+          stats,
+          confirmed
+        ), hasMatch, nuBounded, colouredPlan != null);
       }
-    } catch (e) {
-      report.push(`  ERROR: ${e.message ?? e}
+      case "unknown": {
+        report.push(`  Status: UNKNOWN (${queryResult.reason})
 `);
-      report.push("=== RESULT ===\n");
-      report.push(`UNKNOWN: Z3 solver error: ${e.message ?? e}`);
-      return buildResult(
-        { type: "unknown", reason: `Z3 error: ${e.message ?? e}` },
-        report.join("\n"),
-        invariants,
-        [],
-        [],
-        [],
-        performance.now() - start,
-        { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: invariants.length, structuralResult: structResultStr }
-      );
-    } finally {
-      runner.dispose();
+        report.push("=== RESULT ===\n");
+        report.push(`UNKNOWN: Could not determine ${propDesc}`);
+        report.push(`  Reason: ${queryResult.reason}`);
+        return buildResult(
+          { type: "unknown", reason: queryResult.reason },
+          report.join("\n"),
+          invariants,
+          [],
+          [],
+          [],
+          performance.now() - start,
+          stats
+        );
+      }
     }
   }
   /**
@@ -4040,6 +4255,12 @@ function certificateDowngradeReason(outcome) {
       return `certificate check could not run: ${outcome.reason}; PROVEN is withheld without an independently validated certificate`;
   }
 }
+function placeholderCertificate(placeCount) {
+  const params = [];
+  for (let i = 0; i < placeCount; i++) params.push(`(x!${i} Int)`);
+  return `(define-fun Reachable (${params.join(" ")}) Bool
+    true)`;
+}
 function downgradeToUnknown(result, reason) {
   return {
     ...result,
@@ -4056,11 +4277,27 @@ Downgraded to UNKNOWN: ${reason}
 function truncate(s, max) {
   return s.length <= max ? s : `${s.slice(0, max)}\u2026 (${s.length - max} chars truncated)`;
 }
-function substituteNames(formula, flatNet) {
-  for (let i = flatNet.places.length - 1; i >= 0; i--) {
-    formula = formula.replace(new RegExp(`\\bm${i}\\b`, "g"), flatNet.places[i].name);
+function unresolvedPropertyPlace(flatNet, property) {
+  const named = (() => {
+    switch (property.type) {
+      case "deadlock-free":
+        return [];
+      case "mutual-exclusion":
+        return [property.p1, property.p2];
+      case "place-bound":
+        return [property.place];
+      case "branch-place-bound":
+        return [property.place];
+      case "unreachable":
+        return [...property.places];
+      case "joined-or-dead-lettered":
+        return [property.pending];
+    }
+  })();
+  for (const place of named) {
+    if (!flatNet.placeIndex.has(place.name)) return place.name;
   }
-  return formula;
+  return null;
 }
 function formatInvariant(inv, flatNet) {
   const parts = [];
@@ -4128,26 +4365,42 @@ export {
   pInvariant,
   pInvariantToString,
   computePInvariants,
+  strengthenWithSemiflows,
   computePSemiflows,
   isCoveredByInvariants,
+  canonicalInvariantOrder,
   structuralCheck,
   findMinimalSiphons,
   findMaximalTrapIn,
-  createSpacerRunner,
-  flatNetPlaceCount,
-  flatNetTransitionCount,
-  flatNetIndexOf,
+  Z3_ENV,
+  DUMP_ENV,
+  MIN_Z3_VERSION,
+  parseZ3Version,
+  formatZ3Version,
+  Z3Unavailable,
+  Z3ProcessError,
+  z3SolverAt,
+  resolveZ3,
+  z3Available,
+  runZ3Text,
+  runZ3Spacer,
   encode,
+  encodeStepRelationSmt2,
   checkCertificate,
+  vcScript,
   DBM,
   StateClass,
   requireOutputProducingActions,
   StateClassGraph,
-  describeDecodeFailure,
   decode,
+  decodeStateSet,
+  flatNetPlaceCount,
+  flatNetTransitionCount,
+  flatNetIndexOf,
   replayCounterexample,
   SmtVerifier,
+  placeholderCertificate,
   isProven,
   isViolated
 };
-//# sourceMappingURL=chunk-JZIEWVAV.js.map
+//# sourceMappingURL=chunk-FD3S4TZM.js.map