libpetri 4.0.0 → 5.0.0

package/dist/{chunk-KO6TSB47.js → chunk-4HMFNYTH.js}

@@ -762,7 +762,7 @@ function stripClusterEdgeAttrs(line) {
 }
 
 // src/viewer/version.ts
-var VERSION = true ? "4.0.0" : "0.0.0-dev";
+var VERSION = true ? "5.0.0" : "0.0.0-dev";
 
 // src/viewer/index.ts
 async function mount(dotSource, container, opts = {}) {
@@ -1013,4 +1013,4 @@ export {
   VERSION,
   mount
 };
-//# sourceMappingURL=chunk-KO6TSB47.js.map
+//# sourceMappingURL=chunk-4HMFNYTH.js.map

package/dist/{chunk-WYCGGQAW.js → chunk-75KEJQGC.js}

@@ -331,6 +331,9 @@ var MarkingStateBuilder = class {
 function deadlockFree() {
   return { type: "deadlock-free" };
 }
+function terminatesAtSink() {
+  return { type: "terminates-at-sink" };
+}
 function mutualExclusion(p1, p2) {
   return { type: "mutual-exclusion", p1, p2 };
 }
@@ -350,6 +353,8 @@ function propertyDescription(prop) {
   switch (prop.type) {
     case "deadlock-free":
       return "Deadlock-freedom";
+    case "terminates-at-sink":
+      return "Terminates at a declared sink";
     case "mutual-exclusion":
       return `Mutual exclusion of ${prop.p1.name} and ${prop.p2.name}`;
     case "place-bound":
@@ -1545,8 +1550,31 @@ function indexOrdered(flatNet, places) {
 }
 function encodePropertyViolation(flatNet, property, mVars, sinkPlaces, envInject) {
   switch (property.type) {
-    case "deadlock-free":
-      return encodeDeadlock(flatNet, mVars, sinkPlaces, envInject);
+    // DeadlockFree (VER-002): a quiescent marking that STRANDS a token — holds one
+    // in a place that is not a declared sink. The empty marking strands nothing and
+    // is therefore not a violation (AC4).
+    case "deadlock-free": {
+      const conditions = encodeQuiescent(flatNet, mVars, envInject);
+      if (conditions == null) return "false";
+      const sinks = new Set(indexOrdered(flatNet, sinkPlaces));
+      const stranded = [];
+      for (let pid = 0; pid < flatNet.places.length; pid++) {
+        if (!sinks.has(pid)) stranded.push(`(>= ${mVars[pid]} 1)`);
+      }
+      if (stranded.length === 0) return "false";
+      conditions.push(`(or ${stranded.join(" ")})`);
+      return joinConditions(conditions);
+    }
+    // TerminatesAtSink (VER-002): a quiescent marking that reached NO declared sink.
+    // This is the predicate DeadlockFree carried before the VER-002 split, unchanged.
+    case "terminates-at-sink": {
+      const conditions = encodeQuiescent(flatNet, mVars, envInject);
+      if (conditions == null) return "false";
+      for (const pid of indexOrdered(flatNet, sinkPlaces)) {
+        conditions.push(`(= ${mVars[pid]} 0)`);
+      }
+      return joinConditions(conditions);
+    }
     case "mutual-exclusion": {
       const conditions = indexOrdered(flatNet, [property.p1, property.p2]).map((i) => `(>= ${mVars[i]} 1)`);
       return conditions.length === 0 ? "false" : `(and ${conditions.join(" ")})`;
@@ -1560,14 +1588,23 @@ function encodePropertyViolation(flatNet, property, mVars, sinkPlaces, envInject
       const conditions = indexOrdered(flatNet, property.places).map((i) => `(>= ${mVars[i]} 1)`);
       return conditions.length === 0 ? "false" : `(and ${conditions.join(" ")})`;
     }
+    // JoinedOrDeadLettered (NU-040 AC4): a quiescent state that still holds a
+    // `pending` token is a stranded correlation group. Carries NO sink clause — a
+    // declared sink must not excuse a stranded group.
     case "joined-or-dead-lettered": {
-      const deadlock = encodeDeadlock(flatNet, mVars, sinkPlaces, envInject);
       const pid = flatNet.placeIndex.get(property.pending.name);
-      return pid == null ? "false" : `(and ${deadlock} (>= ${mVars[pid]} 1))`;
+      if (pid == null) return "false";
+      const conditions = encodeQuiescent(flatNet, mVars, envInject);
+      if (conditions == null) return "false";
+      conditions.push(`(>= ${mVars[pid]} 1)`);
+      return joinConditions(conditions);
     }
   }
 }
-function encodeDeadlock(flatNet, mVars, sinkPlaces, envInject) {
+function joinConditions(conditions) {
+  return conditions.length === 0 ? "true" : `(and ${conditions.join("\n         ")})`;
+}
+function encodeQuiescent(flatNet, mVars, envInject) {
   const envBound = /* @__PURE__ */ new Map();
   for (const inj of envInject) envBound.set(inj.pid, inj.bound);
   const disabledConditions = [];
@@ -1597,13 +1634,10 @@ function encodeDeadlock(flatNet, mVars, sinkPlaces, envInject) {
       disabledConditions.push("true");
       continue;
     }
-    if (disableReasons.length === 0) return "false";
+    if (disableReasons.length === 0) return null;
     disabledConditions.push(`(or ${disableReasons.join(" ")})`);
   }
-  for (const pid of indexOrdered(flatNet, sinkPlaces)) {
-    disabledConditions.push(`(= ${mVars[pid]} 0)`);
-  }
-  return disabledConditions.length === 0 ? "true" : `(and ${disabledConditions.join("\n         ")})`;
+  return disabledConditions;
 }
 function injectionMap(flatNet) {
   const out = /* @__PURE__ */ new Map();
@@ -2511,20 +2545,38 @@ function enabledRelaxEnv(state, ft, envInj) {
   }
   return true;
 }
-function isDeadlockA(index, state) {
+function isQuiescent(index, state) {
   for (const ft of index.flatNet.transitions) {
     if (enabledRelaxEnv(state, ft, index.envInj)) return false;
   }
   return true;
 }
+function sinkIndices(flatNet, sinkPlaces) {
+  const idx = /* @__PURE__ */ new Set();
+  for (const sink of sinkPlaces) {
+    const i = flatNetIndexOf(flatNet, sink);
+    if (i >= 0) idx.add(i);
+  }
+  return idx;
+}
 function satisfiesBadIndexed(index, state, property, sinkPlaces) {
   const flatNet = index.flatNet;
   switch (property.type) {
+    // DeadlockFree (VER-002): quiescent AND some marked place is not a declared
+    // sink. Mirrors the encoder's `stranded` disjunction.
     case "deadlock-free": {
-      if (!isDeadlockA(index, state)) return false;
-      for (const sink of sinkPlaces) {
-        const idx = flatNetIndexOf(flatNet, sink);
-        if (idx >= 0 && state[idx] > 0) return false;
+      if (!isQuiescent(index, state)) return false;
+      const sinks = sinkIndices(flatNet, sinkPlaces);
+      for (let pid = 0; pid < flatNet.places.length; pid++) {
+        if (!sinks.has(pid) && state[pid] >= 1) return true;
+      }
+      return false;
+    }
+    // TerminatesAtSink (VER-002): quiescent AND no declared sink marked.
+    case "terminates-at-sink": {
+      if (!isQuiescent(index, state)) return false;
+      for (const pid of sinkIndices(flatNet, sinkPlaces)) {
+        if (state[pid] !== 0) return false;
       }
       return true;
     }
@@ -2540,10 +2592,12 @@ function satisfiesBadIndexed(index, state, property, sinkPlaces) {
       if (idx < 0) return false;
       return state[idx] > property.bound;
     }
+    // JoinedOrDeadLettered (NU-040 AC4): quiescent AND `pending` marked. No sink
+    // clause — a marked sink must not excuse a stranded group.
     case "joined-or-dead-lettered": {
       const idx = flatNetIndexOf(flatNet, property.pending);
       if (idx < 0) return false;
-      return isDeadlockA(index, state) && state[idx] >= 1;
+      return isQuiescent(index, state) && state[idx] >= 1;
     }
     case "unreachable": {
       let resolved = 0;
@@ -2914,13 +2968,38 @@ function encodeViolation(plan, lay, flat, property, sinkPlaces, envInj) {
       return anyPlacePresent([property.p1, property.p2]);
     case "unreachable":
       return anyPlacePresent(property.places);
-    case "deadlock-free":
-      return encodeColouredDeadlock(plan, lay, flat, sinkPlaces, envInj);
+    // DeadlockFree (VER-002): quiescent AND some marked place is not a declared
+    // sink. Mirrors the flat encoder's `stranded` disjunction.
+    case "deadlock-free": {
+      const conds = encodeColouredQuiescent(plan, lay, flat, envInj);
+      if (conds == null) return "false";
+      const sinks = new Set(indexOrdered(flat, sinkPlaces));
+      const stranded = [];
+      for (let pid = 0; pid < flat.places.length; pid++) {
+        if (!sinks.has(pid)) stranded.push(`(>= ${aggregate(plan, lay, pid, lay.cur)} 1)`);
+      }
+      if (stranded.length === 0) return "false";
+      conds.push(`(or ${stranded.join(" ")})`);
+      return joinColoured(conds);
+    }
+    // TerminatesAtSink (VER-002): quiescent AND no declared sink marked.
+    case "terminates-at-sink": {
+      const conds = encodeColouredQuiescent(plan, lay, flat, envInj);
+      if (conds == null) return "false";
+      for (const pid of indexOrdered(flat, sinkPlaces)) {
+        conds.push(`(= ${aggregate(plan, lay, pid, lay.cur)} 0)`);
+      }
+      return joinColoured(conds);
+    }
+    // JoinedOrDeadLettered (NU-040 AC4): quiescent AND `pending` marked, with NO
+    // sink clause.
     case "joined-or-dead-lettered": {
       const pid = flat.placeIndex.get(property.pending.name);
       if (pid == null) return null;
-      const deadlock = encodeColouredDeadlock(plan, lay, flat, sinkPlaces, envInj);
-      return `(and ${deadlock} (>= ${aggregate(plan, lay, pid, lay.cur)} 1))`;
+      const conds = encodeColouredQuiescent(plan, lay, flat, envInj);
+      if (conds == null) return "false";
+      conds.push(`(>= ${aggregate(plan, lay, pid, lay.cur)} 1)`);
+      return joinColoured(conds);
     }
   }
 }
@@ -2978,7 +3057,10 @@ function colouredDisabledTerm(cls, plan, lay) {
     }
   }
 }
-function encodeColouredDeadlock(plan, lay, flat, sinkPlaces, envInj) {
+function joinColoured(conds) {
+  return conds.length === 0 ? "true" : `(and ${conds.join(" ")})`;
+}
+function encodeColouredQuiescent(plan, lay, flat, envInj) {
   const disabledConditions = [];
   for (let ti = 0; ti < plan.classes.length; ti++) {
     const cls = plan.classes[ti];
@@ -2991,13 +3073,10 @@ function encodeColouredDeadlock(plan, lay, flat, sinkPlaces, envInj) {
     }
     const term = colouredDisabledTerm(cls, plan, lay);
     if (term != null) reasons.push(term);
-    if (reasons.length === 0) return "false";
+    if (reasons.length === 0) return null;
     disabledConditions.push(reasons.length === 1 ? reasons[0] : `(or ${reasons.join(" ")})`);
   }
-  for (const pid of indexOrdered(flat, sinkPlaces)) {
-    disabledConditions.push(`(= ${aggregate(plan, lay, pid, lay.cur)} 0)`);
-  }
-  return disabledConditions.length === 0 ? "true" : `(and ${disabledConditions.join(" ")})`;
+  return disabledConditions;
 }
 
 // src/verification/analysis/name-fragment.ts
@@ -3484,8 +3563,16 @@ function decide(scg, property, sinkPlaces) {
         const m = scg.markingOf(i);
         return m.hasTokens(property.p1) && m.hasTokens(property.p2);
       });
+    // DeadlockFree (VER-002): a quiescent class that strands a token — some marked
+    // place is not a declared sink. The empty marking strands nothing (AC4).
     case "deadlock-free":
       return firstWhere((i) => scg.successorsOf(i).length === 0 && !allTokensInSinks(scg.markingOf(i), sinkPlaces));
+    // TerminatesAtSink (VER-002): a quiescent class that marks NO declared sink.
+    // Inverts with DeadlockFree on the empty marking, by design.
+    case "terminates-at-sink":
+      return firstWhere((i) => scg.successorsOf(i).length === 0 && !anySinkMarked(scg.markingOf(i), sinkPlaces));
+    // JoinedOrDeadLettered (NU-040 AC4): a quiescent class still holding a pending
+    // token. No sink clause.
     case "joined-or-dead-lettered":
       return firstWhere((i) => scg.successorsOf(i).length === 0 && scg.markingOf(i).hasTokens(property.pending));
   }
@@ -3498,6 +3585,14 @@ function allTokensInSinks(m, sinks) {
   }
   return true;
 }
+function anySinkMarked(m, sinks) {
+  const sinkNames = /* @__PURE__ */ new Set();
+  for (const s of sinks) sinkNames.add(s.name);
+  for (const p of m.placesWithTokens()) {
+    if (sinkNames.has(p.name)) return true;
+  }
+  return false;
+}
 function counterexamplePath(scg, target) {
   const n = scg.classCount();
   const parent = new Array(n).fill(-1);
@@ -3528,6 +3623,7 @@ function counterexamplePath(scg, target) {
 }
 
 // src/verification/smt-verifier.ts
+var IGNORE_MODE_VACUITY_REASON = "environment places present but not modeled (mode=ignore); a proof would be vacuous \u2014 use alwaysAvailable() or bounded(k) to model external injection";
 var SmtVerifier = class _SmtVerifier {
   constructor(net) {
     this.net = net;
@@ -3636,13 +3732,26 @@ var SmtVerifier = class _SmtVerifier {
    * into a chain whose other combinations avoid it (dropped by the H1 guard). On a
    * net with a few reset arcs that can lose every law of the chains those arcs
    * touch, and without them IC3 has to rediscover the conservation of each chain —
-   * on a ~100-place net it does not within any practical budget. With the semiflows
-   * in, the same reachability-safety queries close in about a second.
+   * on a ~100-place net it does not within any practical budget.
+   *
+   * **Turn this on if the net has any `all()` / `atLeast(n)` or reset arc on a busy
+   * place** — draining an input queue is the everyday case. Every basis row whose
+   * support touches such a place fails the H1 guard and is dropped, so the encoders
+   * run on a deficient invariant set and nothing in the report says a law is missing
+   * beyond the `Dropped` lines.
+   *
+   * This reaches the **name-coloured** encoder (NU-050) as well as the flat one, and
+   * it matters most there. On a 113-place ν-net, whole-net deadlock-freedom went from
+   * `unknown` after 50 minutes to `proven` in about 15 seconds with this option as the
+   * only change; on the flat path, reachability-safety queries that timed out at 120 s
+   * close in about a second.
    *
    * Soundness is unchanged: the semiflows pass the same exact re-validation as the
    * basis rows, the union is pure strengthening (`Semiflow.lean`,
    * `semiflow_union_sound`), and the certificate check re-proves the strengthened
-   * invariant. Off by default so reports stay byte-equal.
+   * invariant — that check is flat-path only, so a coloured `proven` reports
+   * `Certificate check: not applicable (name-coloured encoding)`. Off by default so
+   * reports stay byte-equal.
    */
   semiflowInvariants(enabled) {
     this._semiflowInvariants = enabled;
@@ -3702,6 +3811,48 @@ var SmtVerifier = class _SmtVerifier {
     this._prioritySemantics = semantics;
     return this;
   }
+  /**
+   * The name-coloured plan and its encoding, or a null plan when the net is outside
+   * the fragment (NU-050) and a null encoding when the property names a place the net
+   * does not resolve.
+   *
+   * {@link verify} and {@link encodeScripts} share this deliberately. They used to
+   * invoke `buildColouredPlan` and `encodeColoured` separately, so handing the encoder
+   * the wrong one of the two lists changed only one of them — and the script-parity
+   * goldens are generated from `encodeScripts`. Unifying the invocation closes that. It
+   * does not make the two paths identical: each still computes its own invariant and
+   * semiflow lists, so they can still drift through the arguments rather than the call.
+   *
+   * `invariants` is what the encoder conjoins into every rule body (the null-space
+   * basis, unioned with the semiflows when VER-007 is enabled); `semiflows` sets the
+   * colour-slot bound k (NU-053). They are not the same list.
+   */
+  colouredAttempt(flatNet, invariants, semiflows) {
+    const hasMatch = [...this.net.transitions].some((t) => t.matchSpec !== null);
+    const nuBounded = this._budgetPlaces.size > 0;
+    if (!hasMatch || !nuBounded) return { plan: null, encoding: null };
+    const plan = buildColouredPlan(
+      this.net,
+      flatNet,
+      this._initialMarking,
+      this._budgetPlaces,
+      this._fragmentMode,
+      this._carrierPlaces,
+      semiflows
+    );
+    if (plan == null) return { plan: null, encoding: null };
+    return {
+      plan,
+      encoding: encodeColoured(
+        plan,
+        flatNet,
+        this._initialMarking,
+        this._property,
+        invariants,
+        this._sinkPlaces
+      )
+    };
+  }
   /**
    * The SMT-LIB2 scripts {@link verify} would send to z3 for this configuration,
    * without running a solver (VER-013 AC1): the HORN query (flat, or name-coloured
@@ -3713,8 +3864,6 @@ var SmtVerifier = class _SmtVerifier {
    */
   encodeScripts() {
     requireOutputProducingActions(this.net);
-    const hasMatch = [...this.net.transitions].some((t) => t.matchSpec !== null);
-    const nuBounded = this._budgetPlaces.size > 0;
     const flatNet = flatten(this.net, this._environmentPlaces, this._environmentMode);
     const matrix = IncidenceMatrix.from(flatNet);
     const { valid: basis } = validateInvariantsExact(
@@ -3732,20 +3881,9 @@ var SmtVerifier = class _SmtVerifier {
     let invariants = basis;
     if (this._semiflowInvariants) invariants = strengthenWithSemiflows(basis, semiflows).invariants;
     invariants = canonicalInvariantOrder(invariants);
-    if (hasMatch && nuBounded) {
-      const plan = buildColouredPlan(
-        this.net,
-        flatNet,
-        this._initialMarking,
-        this._budgetPlaces,
-        this._fragmentMode,
-        this._carrierPlaces,
-        semiflows
-      );
-      if (plan != null) {
-        const coloured = encodeColoured(plan, flatNet, this._initialMarking, this._property, invariants, this._sinkPlaces);
-        if (coloured != null) return { horn: coloured.smt2, certificate: null, coloured: true };
-      }
+    const attempt = this.colouredAttempt(flatNet, invariants, semiflows);
+    if (attempt.encoding != null) {
+      return { horn: attempt.encoding.smt2, certificate: null, coloured: true };
     }
     const horn = encode(flatNet, this._initialMarking, this._property, invariants, this._sinkPlaces, this._counterexampleReplay).smt2;
     const certificate = vcScript(
@@ -3796,8 +3934,13 @@ var SmtVerifier = class _SmtVerifier {
         if (outcome.transitions.length > 0) {
           report.push(`  Counterexample trace: ${outcome.trace.length} states, ${outcome.transitions.length} transitions`);
         }
+        let routeBVerdict = outcome.verdict;
+        if (routeBVerdict.type === "proven" && this._environmentPlaces.size > 0 && this._environmentMode.type === "ignore") {
+          report.push(`  Downgraded to UNKNOWN: ${IGNORE_MODE_VACUITY_REASON}`);
+          routeBVerdict = { type: "unknown", reason: IGNORE_MODE_VACUITY_REASON };
+        }
         return buildResult(
-          outcome.verdict,
+          routeBVerdict,
           report.join("\n"),
           [],
           [],
@@ -3903,15 +4046,6 @@ var SmtVerifier = class _SmtVerifier {
     }
     report.push("");
     report.push("Phase 4: IC3/PDR verification via Z3 Spacer...");
-    const colouredPlan = hasMatch && nuBounded ? buildColouredPlan(
-      this.net,
-      flatNet,
-      this._initialMarking,
-      this._budgetPlaces,
-      this._fragmentMode,
-      this._carrierPlaces,
-      semiflows
-    ) : null;
     const stats = {
       places: flatNet.places.length,
       transitions: flatNet.transitions.length,
@@ -3932,12 +4066,14 @@ var SmtVerifier = class _SmtVerifier {
       return buildResult({ type: "unknown", reason }, report.join("\n"), invariants, [], [], [], performance.now() - start, stats);
     }
     report.push(`  Solver: z3 ${formatZ3Version(solver.version)}`);
+    const colouredAttempt = this.colouredAttempt(flatNet, invariants, semiflows);
+    const colouredPlan = colouredAttempt.plan;
     let encoding;
     if (colouredPlan != null) {
       report.push(
         `  \u03BD-encoding: name-coloured (exact within budget k=${colouredPlan.k}; ${colouredPlan.coloured.length} coloured place(s))`
       );
-      const coloured = encodeColoured(colouredPlan, flatNet, this._initialMarking, this._property, invariants, this._sinkPlaces);
+      const coloured = colouredAttempt.encoding;
       if (coloured == null) {
         const reason = "property names a place that does not resolve in the net; refusing to certify (the encoding would be vacuously proven)";
         report.push("  Status: UNKNOWN (unresolved property place)\n");
@@ -3966,7 +4102,7 @@ var SmtVerifier = class _SmtVerifier {
     switch (queryResult.type) {
       case "proven": {
         if (this._environmentPlaces.size > 0 && this._environmentMode.type === "ignore") {
-          const reason = "environment places present but not modeled (mode=ignore); a proof would be vacuous \u2014 use alwaysAvailable() or bounded(k) to model external injection";
+          const reason = IGNORE_MODE_VACUITY_REASON;
           report.push(`  Status: UNSAT, but vacuous under ignore mode
 `);
           report.push("=== RESULT ===\n");
@@ -4165,6 +4301,7 @@ function isReachabilitySafety(property) {
     case "unreachable":
       return true;
     case "deadlock-free":
+    case "terminates-at-sink":
     case "joined-or-dead-lettered":
       return false;
   }
@@ -4241,6 +4378,8 @@ function unresolvedPropertyPlace(flatNet, property) {
     switch (property.type) {
       case "deadlock-free":
         return [];
+      case "terminates-at-sink":
+        return [];
       case "mutual-exclusion":
         return [property.p1, property.p2];
       case "place-bound":
@@ -4309,6 +4448,7 @@ export {
   MarkingState,
   MarkingStateBuilder,
   deadlockFree,
+  terminatesAtSink,
   mutualExclusion,
   placeBound,
   unreachable,
@@ -4362,4 +4502,4 @@ export {
   isProven,
   isViolated
 };
-//# sourceMappingURL=chunk-WYCGGQAW.js.map
+//# sourceMappingURL=chunk-75KEJQGC.js.map