libpetri 4.1.0 → 5.1.0

package/dist/{chunk-FD3S4TZM.js → chunk-EL4E6LVO.js}

@@ -220,6 +220,11 @@ function withTimeout(action, timeoutMs, timeoutPlace2, timeoutValue) {
   };
 }
 
+// src/verification/programming-error.ts
+function rethrowIfProgrammingError(e) {
+  if (e instanceof TypeError || e instanceof ReferenceError) throw e;
+}
+
 // src/verification/marking-state.ts
 var MARKING_STATE_KEY = /* @__PURE__ */ Symbol("MarkingState.internal");
 var MarkingState = class _MarkingState {
@@ -252,9 +257,9 @@ var MarkingState = class _MarkingState {
   }
   /** Returns the total number of tokens. */
   totalTokens() {
-    let sum = 0;
-    for (const count of this.tokenCounts.values()) sum += count;
-    return sum;
+    let sum2 = 0;
+    for (const count of this.tokenCounts.values()) sum2 += count;
+    return sum2;
   }
   /** Checks if no tokens exist anywhere. */
   isEmpty() {
@@ -331,6 +336,9 @@ var MarkingStateBuilder = class {
 function deadlockFree() {
   return { type: "deadlock-free" };
 }
+function terminatesAtSink() {
+  return { type: "terminates-at-sink" };
+}
 function mutualExclusion(p1, p2) {
   return { type: "mutual-exclusion", p1, p2 };
 }
@@ -350,6 +358,8 @@ function propertyDescription(prop) {
   switch (prop.type) {
     case "deadlock-free":
       return "Deadlock-freedom";
+    case "terminates-at-sink":
+      return "Terminates at a declared sink";
     case "mutual-exclusion":
       return `Mutual exclusion of ${prop.p1.name} and ${prop.p2.name}`;
     case "place-bound":
@@ -363,6 +373,53 @@ function propertyDescription(prop) {
   }
 }
 
+// src/verification/rest-set.ts
+function strandingExcuses(flatNet, sinkPlaces, conditional) {
+  const P = flatNet.places.length;
+  const excuses = new Array(P);
+  for (let pid = 0; pid < P; pid++) excuses[pid] = [];
+  for (const sink of sinkPlaces) {
+    const pid = flatNet.placeIndex.get(sink.name);
+    if (pid != null) excuses[pid] = null;
+  }
+  for (const { marker, places } of conditional) {
+    const mid = flatNet.placeIndex.get(marker.name);
+    if (mid == null) continue;
+    excuses[mid] = null;
+    for (const place of places) {
+      const pid = flatNet.placeIndex.get(place.name);
+      if (pid == null) continue;
+      const list = excuses[pid];
+      if (list != null && !list.includes(mid)) list.push(mid);
+    }
+  }
+  for (const list of excuses) if (list != null) list.sort((a, b) => a - b);
+  return excuses;
+}
+function strandsToken(m, sinkPlaces, conditional) {
+  const resting = /* @__PURE__ */ new Set();
+  for (const s of sinkPlaces) resting.add(s.name);
+  for (const { marker, places } of conditional) {
+    resting.add(marker.name);
+    if (m.hasTokens(marker)) {
+      for (const p of places) resting.add(p.name);
+    }
+  }
+  for (const p of m.placesWithTokens()) {
+    if (!resting.has(p.name)) return true;
+  }
+  return false;
+}
+function describeSinks(sinkPlaces, conditional) {
+  const parts = [];
+  if (sinkPlaces.size > 0) parts.push(`sinks: ${[...sinkPlaces].map((p) => p.name).join(", ")}`);
+  for (const { marker, places } of conditional) {
+    const names = [...places].map((p) => p.name);
+    parts.push(names.length === 0 ? `when ${marker.name}` : `when ${marker.name}: ${names.join(", ")}`);
+  }
+  return parts.length === 0 ? null : parts.join("; ");
+}
+
 // src/verification/encoding/flat-transition.ts
 function flatTransition(name, source, branchIndex, preVector, postVector, inhibitorPlaces, readPlaces, resetPlaces, consumeAll) {
   return {
@@ -821,6 +878,8 @@ function strengthenWithSemiflows(invariants, semiflows) {
   }
   return { invariants: strengthened, added };
 }
+var MAX_SEMIFLOW_ROWS = 8192;
+var MAX_SEMIFLOW_CANDIDATES = 65536;
 function computePSemiflows(matrix, flatNet, initialMarking) {
   const np = matrix.numPlaces();
   const nt = matrix.numTransitions();
@@ -838,19 +897,21 @@ function computePSemiflows(matrix, flatNet, initialMarking) {
     const next = rows.filter((r) => r.sig[t] === 0);
     const pos = rows.filter((r) => r.sig[t] > 0);
     const neg = rows.filter((r) => r.sig[t] < 0);
-    for (const rp of pos) {
-      for (const rn of neg) {
-        const cp = -rn.sig[t];
-        const cn = rp.sig[t];
-        const sig = combineRow(cp, rp.sig, cn, rn.sig);
-        const weight = combineRow(cp, rp.weight, cn, rn.weight);
-        if (sig === null || weight === null) continue;
-        reduceGcd(sig, weight);
-        next.push({ sig, weight });
+    outer:
+      for (const rp of pos) {
+        for (const rn of neg) {
+          if (next.length >= MAX_SEMIFLOW_CANDIDATES) break outer;
+          const cp = -rn.sig[t];
+          const cn = rp.sig[t];
+          const sig = combineRow(cp, rp.sig, cn, rn.sig);
+          const weight = combineRow(cp, rp.weight, cn, rn.weight);
+          if (sig === null || weight === null) continue;
+          reduceGcd(sig, weight);
+          next.push({ sig, weight });
+        }
       }
-    }
     rows = keepSupportMinimal(next);
-    if (rows.length > 8192) rows.length = 8192;
+    if (rows.length > MAX_SEMIFLOW_ROWS) rows.length = MAX_SEMIFLOW_ROWS;
   }
   const semiflows = [];
   for (const { weight } of rows) {
@@ -887,17 +948,43 @@ function reduceGcd(sig, weight) {
   }
 }
 function keepSupportMinimal(rows) {
-  const supports = rows.map((r) => {
-    const s = [];
-    for (let i = 0; i < r.weight.length; i++) if (r.weight[i] !== 0) s.push(i);
-    return s;
-  });
-  const keep = new Array(rows.length).fill(true);
-  for (let i = 0; i < rows.length; i++) {
-    if (!keep[i]) continue;
-    for (let j = 0; j < rows.length; j++) {
-      if (i === j || !keep[j]) continue;
-      if (supports[j].length < supports[i].length && supports[j].every((p) => supports[i].includes(p))) {
+  const n = rows.length;
+  if (n < 2) return rows;
+  const words = rows[0].weight.length + 31 >>> 5 || 1;
+  const bits = new Uint32Array(n * words);
+  const sizes = new Int32Array(n);
+  for (let i = 0; i < n; i++) {
+    const w = rows[i].weight;
+    let size = 0;
+    for (let p = 0; p < w.length; p++) {
+      if (w[p] !== 0) {
+        const idx = i * words + (p >>> 5);
+        bits[idx] = bits[idx] | 1 << (p & 31);
+        size++;
+      }
+    }
+    sizes[i] = size;
+  }
+  const order = new Int32Array(n);
+  for (let i = 0; i < n; i++) order[i] = i;
+  order.sort((a, b) => sizes[a] - sizes[b]);
+  const keep = new Array(n).fill(true);
+  for (let oi = 0; oi < n; oi++) {
+    const i = order[oi];
+    const base = i * words;
+    for (let oj = 0; oj < oi; oj++) {
+      const j = order[oj];
+      if (sizes[j] >= sizes[i]) break;
+      const jbase = j * words;
+      let subset = true;
+      for (let w = 0; w < words; w++) {
+        const jb = bits[jbase + w];
+        if ((jb & ~bits[base + w]) !== 0) {
+          subset = false;
+          break;
+        }
+      }
+      if (subset) {
         keep[i] = false;
         break;
       }
@@ -1236,7 +1323,8 @@ function locateZ3(program, env = process.env) {
   const isFile = (p) => {
     try {
       return existsSync(p) && statSync(p).isFile();
-    } catch {
+    } catch (e) {
+      rethrowIfProgrammingError(e);
       return false;
     }
   };
@@ -1247,9 +1335,9 @@ function locateZ3(program, env = process.env) {
   const windows = process.platform === "win32";
   for (const dir of searchPath.split(path.delimiter)) {
     if (dir === "") continue;
-    const candidate2 = path.join(dir, program);
-    if (isFile(candidate2)) return candidate2;
-    if (windows && isFile(candidate2 + ".exe")) return candidate2 + ".exe";
+    const candidate = path.join(dir, program);
+    if (isFile(candidate)) return candidate;
+    if (windows && isFile(candidate + ".exe")) return candidate + ".exe";
   }
   return null;
 }
@@ -1295,7 +1383,8 @@ function z3Available(env = process.env) {
   try {
     resolveZ3(env);
     return true;
-  } catch {
+  } catch (e) {
+    rethrowIfProgrammingError(e);
     return false;
   }
 }
@@ -1368,6 +1457,7 @@ async function runZ3Spacer(solver, timeoutMs, smt2, phase) {
   try {
     reply = await runZ3Text(solver, smt2, phase, timeoutMs, ["fp.engine=spacer"]);
   } catch (e) {
+    rethrowIfProgrammingError(e);
     return { type: "unknown", reason: String(e?.message ?? e) };
   }
   const stdout = reply.stdout.trim();
@@ -1386,36 +1476,50 @@ async function runZ3Spacer(solver, timeoutMs, smt2, phase) {
 }
 
 // src/verification/z3/smt-encoder.ts
-function encode(flatNet, initialMarking, property, invariants, sinkPlaces = /* @__PURE__ */ new Set(), produceProofs = false) {
+function encode(flatNet, initialMarking, property, invariants, sinkPlaces = /* @__PURE__ */ new Set(), produceProofs = false, conditionalSinks = []) {
+  return encodeNet(flatNet, initialMarking, property, invariants, { sinkPlaces, produceProofs, conditionalSinks });
+}
+function encodeNet(flatNet, initialMarking, property, invariants, options = {}) {
+  const sinkPlaces = options.sinkPlaces ?? /* @__PURE__ */ new Set();
+  const produceProofs = options.produceProofs ?? false;
+  const conditionalSinks = options.conditionalSinks ?? [];
   const P = flatNet.places.length;
+  const T = options.stateEquation ? flatNet.transitions.length : 0;
   const lines = [];
   const envInject = resolveEnvInjection(flatNet);
   if (produceProofs) lines.push("(set-option :produce-proofs true)");
   lines.push("(set-logic HORN)");
   lines.push("");
-  lines.push(`(declare-fun Reachable (${ints(P).join(" ")}) Bool)`);
+  lines.push(`(declare-fun Reachable (${ints(P + T).join(" ")}) Bool)`);
   lines.push("(declare-fun Error () Bool)");
   lines.push("");
   const mVars = vars(P, "");
   const mpVars = vars(P, "p");
+  const nVars = counterVars(T, "");
+  const npVars = counterVars(T, "p");
   const m0 = [];
   for (let i = 0; i < P; i++) m0.push(String(initialMarking.tokens(flatNet.places[i])));
+  for (let k = 0; k < T; k++) m0.push("0");
   lines.push(`(assert (Reachable ${m0.join(" ")}))`);
   lines.push("");
-  for (const ft of flatNet.transitions) {
-    lines.push(encodeTransitionRule(flatNet, ft, mVars, mpVars, invariants));
+  const equation = T > 0 ? stateEquationConditions(flatNet, initialMarking, npVars) : [];
+  for (let k = 0; k < flatNet.transitions.length; k++) {
+    const ft = flatNet.transitions[k];
+    const strengthening = [...invariantConditions(invariants, mpVars)];
+    if (T > 0) strengthening.push(...counterConditions(k, nVars, npVars), ...equation);
+    lines.push(encodeTransitionRule(flatNet, ft, mVars, mpVars, nVars, npVars, strengthening));
   }
   for (const inj of envInject) {
-    lines.push(encodeInjectionRule(P, inj.pid, inj.bound, mVars, mpVars));
+    lines.push(encodeInjectionRule(P, inj.pid, inj.bound, mVars, mpVars, nVars, npVars));
   }
   lines.push("");
-  lines.push(encodeErrorRule(flatNet, property, mVars, sinkPlaces, envInject));
+  lines.push(encodeErrorRule(flatNet, property, mVars, nVars, sinkPlaces, envInject, conditionalSinks));
   lines.push("");
   lines.push("(assert (not Error))");
   lines.push("(check-sat)");
   if (produceProofs) lines.push("(get-proof)");
   lines.push("(get-model)");
-  return { smt2: lines.join("\n"), placeCount: P };
+  return { smt2: lines.join("\n"), placeCount: P, counterCount: T };
 }
 function resolveEnvInjection(flatNet) {
   const out = [];
@@ -1443,9 +1547,44 @@ function vars(P, suffix) {
   for (let i = 0; i < P; i++) out.push(`m${i}${suffix}`);
   return out;
 }
+function counterVars(T, suffix) {
+  const out = [];
+  for (let k = 0; k < T; k++) out.push(`n${k}${suffix}`);
+  return out;
+}
 function quantified(names) {
   return names.map((v) => `(${v} Int)`).join(" ");
 }
+function equationPlaces(flatNet) {
+  const excluded = new Set(nonlinearPlaces(flatNet));
+  for (const inj of resolveEnvInjection(flatNet)) excluded.add(inj.pid);
+  const out = [];
+  for (let p = 0; p < flatNet.places.length; p++) if (!excluded.has(p)) out.push(p);
+  return out;
+}
+function counterConditions(fired, nVars, npVars) {
+  const conditions = [];
+  for (let k = 0; k < nVars.length; k++) {
+    conditions.push(k === fired ? `(= ${npVars[k]} (+ ${nVars[k]} 1))` : `(= ${npVars[k]} ${nVars[k]})`);
+  }
+  for (let k = 0; k < npVars.length; k++) conditions.push(`(>= ${npVars[k]} 0)`);
+  return conditions;
+}
+function stateEquationConditions(flatNet, initialMarking, nVars, mVars = vars(flatNet.places.length, "p")) {
+  const conditions = [];
+  for (const p of equationPlaces(flatNet)) {
+    const terms = [];
+    for (let t = 0; t < flatNet.transitions.length; t++) {
+      const ft = flatNet.transitions[t];
+      const c = ft.postVector[p] - ft.preVector[p];
+      if (c === 0) continue;
+      terms.push(c === 1 ? nVars[t] : c === -1 ? `(- ${nVars[t]})` : c > 0 ? `(* ${c} ${nVars[t]})` : `(* (- ${-c}) ${nVars[t]})`);
+    }
+    const m0 = initialMarking.tokens(flatNet.places[p]);
+    conditions.push(terms.length === 0 ? `(= ${mVars[p]} ${m0})` : `(= ${mVars[p]} (+ ${m0} ${terms.join(" ")}))`);
+  }
+  return conditions;
+}
 function firingConditions(flatNet, ft, mVars, mpVars) {
   const P = flatNet.places.length;
   const conditions = [];
@@ -1472,8 +1611,8 @@ function invariantConditions(invariants, names) {
   for (const inv of invariants) {
     const terms = [...inv.support].sort((a, b) => a - b).map((i) => `(* ${inv.weights[i]} ${names[i]})`);
     if (terms.length === 0) continue;
-    const sum = terms.length === 1 ? terms[0] : `(+ ${terms.join(" ")})`;
-    conditions.push(`(= ${sum} ${inv.constant})`);
+    const sum2 = terms.length === 1 ? terms[0] : `(+ ${terms.join(" ")})`;
+    conditions.push(`(= ${sum2} ${inv.constant})`);
   }
   return conditions;
 }
@@ -1489,50 +1628,61 @@ function injectionConditions(P, pid, bound, mVars, mpVars) {
   }
   return conditions;
 }
-function encodeTransitionRule(flatNet, ft, mVars, mpVars, invariants) {
-  const conditions = [`(Reachable ${mVars.join(" ")})`];
+function encodeTransitionRule(flatNet, ft, mVars, mpVars, nVars, npVars, strengthening) {
+  const conditions = [`(Reachable ${[...mVars, ...nVars].join(" ")})`];
   conditions.push(...firingConditions(flatNet, ft, mVars, mpVars));
-  conditions.push(...invariantConditions(invariants, mpVars));
+  conditions.push(...strengthening);
   conditions.push(...envBoundConditions(flatNet, mpVars));
   const body = `(and ${conditions.join("\n            ")})`;
-  return `(assert (forall (${quantified([...mVars, ...mpVars])})
+  const quantifiedVars = quantified([...mVars, ...mpVars, ...nVars, ...npVars]);
+  return `(assert (forall (${quantifiedVars})
   (=> ${body}
-      (Reachable ${mpVars.join(" ")}))))`;
+      (Reachable ${[...mpVars, ...npVars].join(" ")}))))`;
 }
-function encodeInjectionRule(P, pid, bound, mVars, mpVars) {
-  const conditions = [`(Reachable ${mVars.join(" ")})`];
+function encodeInjectionRule(P, pid, bound, mVars, mpVars, nVars, npVars) {
+  const conditions = [`(Reachable ${[...mVars, ...nVars].join(" ")})`];
   conditions.push(...injectionConditions(P, pid, bound, mVars, mpVars));
+  if (nVars.length > 0) conditions.push(...counterConditions(-1, nVars, npVars));
   const body = `(and ${conditions.join("\n            ")})`;
-  return `(assert (forall (${quantified([...mVars, ...mpVars])})
+  const quantifiedVars = quantified([...mVars, ...mpVars, ...nVars, ...npVars]);
+  return `(assert (forall (${quantifiedVars})
   (=> ${body}
-      (Reachable ${mpVars.join(" ")}))))`;
+      (Reachable ${[...mpVars, ...npVars].join(" ")}))))`;
 }
 function conjoin(conditions) {
   if (conditions.length === 0) return "true";
   if (conditions.length === 1) return conditions[0];
   return `(and ${conditions.join(" ")})`;
 }
-function encodeStepRelationSmt2(flatNet) {
+function encodeStepRelationSmt2(flatNet, stateEquation = false) {
   const P = flatNet.places.length;
+  const T = stateEquation ? flatNet.transitions.length : 0;
   const mVars = vars(P, "");
   const mpVars = vars(P, "p");
+  const nVars = counterVars(T, "");
+  const npVars = counterVars(T, "p");
   const disjuncts = [];
-  for (const ft of flatNet.transitions) {
+  for (let k = 0; k < flatNet.transitions.length; k++) {
+    const ft = flatNet.transitions[k];
     const conditions = firingConditions(flatNet, ft, mVars, mpVars);
+    if (T > 0) conditions.push(...counterConditions(k, nVars, npVars));
     conditions.push(...envBoundConditions(flatNet, mpVars));
     disjuncts.push(conjoin(conditions));
   }
   for (const inj of resolveEnvInjection(flatNet)) {
-    disjuncts.push(conjoin(injectionConditions(P, inj.pid, inj.bound, mVars, mpVars)));
+    const conditions = injectionConditions(P, inj.pid, inj.bound, mVars, mpVars);
+    if (T > 0) conditions.push(...counterConditions(-1, nVars, npVars));
+    disjuncts.push(conjoin(conditions));
   }
   if (disjuncts.length === 0) return "false";
   if (disjuncts.length === 1) return disjuncts[0];
   return `(or ${disjuncts.join("\n    ")})`;
 }
-function encodeErrorRule(flatNet, property, mVars, sinkPlaces, envInject) {
-  const violation = encodePropertyViolation(flatNet, property, mVars, sinkPlaces, envInject);
-  return `(assert (forall (${quantified(mVars)})
-  (=> (and (Reachable ${mVars.join(" ")}) ${violation})
+function encodeErrorRule(flatNet, property, mVars, nVars, sinkPlaces, envInject, conditionalSinks) {
+  const violation = encodePropertyViolation(flatNet, property, mVars, sinkPlaces, envInject, conditionalSinks);
+  const state = [...mVars, ...nVars];
+  return `(assert (forall (${quantified(state)})
+  (=> (and (Reachable ${state.join(" ")}) ${violation})
       Error)))`;
 }
 function indexOrdered(flatNet, places) {
@@ -1543,10 +1693,30 @@ function indexOrdered(flatNet, places) {
   }
   return [...idx].sort((a, b) => a - b);
 }
-function encodePropertyViolation(flatNet, property, mVars, sinkPlaces, envInject) {
+function encodePropertyViolation(flatNet, property, mVars, sinkPlaces, envInject, conditionalSinks = []) {
   switch (property.type) {
-    case "deadlock-free":
-      return encodeDeadlock(flatNet, mVars, sinkPlaces, envInject);
+    // DeadlockFree (VER-002): a quiescent marking that STRANDS a token — holds one
+    // in a place where resting is not permitted. The empty marking strands nothing
+    // and is therefore not a violation (AC4). A conditional sink (VER-014) is
+    // stranded only while every marker that would excuse it is unmarked.
+    case "deadlock-free": {
+      const conditions = encodeQuiescent(flatNet, mVars, envInject);
+      if (conditions == null) return "false";
+      const stranded = strandedConditions(strandingExcuses(flatNet, sinkPlaces, conditionalSinks), mVars);
+      if (stranded.length === 0) return "false";
+      conditions.push(`(or ${stranded.join(" ")})`);
+      return joinConditions(conditions);
+    }
+    // TerminatesAtSink (VER-002): a quiescent marking that reached NO declared sink.
+    // This is the predicate DeadlockFree carried before the VER-002 split, unchanged.
+    case "terminates-at-sink": {
+      const conditions = encodeQuiescent(flatNet, mVars, envInject);
+      if (conditions == null) return "false";
+      for (const pid of indexOrdered(flatNet, sinkPlaces)) {
+        conditions.push(`(= ${mVars[pid]} 0)`);
+      }
+      return joinConditions(conditions);
+    }
     case "mutual-exclusion": {
       const conditions = indexOrdered(flatNet, [property.p1, property.p2]).map((i) => `(>= ${mVars[i]} 1)`);
       return conditions.length === 0 ? "false" : `(and ${conditions.join(" ")})`;
@@ -1560,14 +1730,36 @@ function encodePropertyViolation(flatNet, property, mVars, sinkPlaces, envInject
       const conditions = indexOrdered(flatNet, property.places).map((i) => `(>= ${mVars[i]} 1)`);
       return conditions.length === 0 ? "false" : `(and ${conditions.join(" ")})`;
     }
+    // JoinedOrDeadLettered (NU-040 AC4): a quiescent state that still holds a
+    // `pending` token is a stranded correlation group. Carries NO sink clause — a
+    // declared sink must not excuse a stranded group.
     case "joined-or-dead-lettered": {
-      const deadlock = encodeDeadlock(flatNet, mVars, sinkPlaces, envInject);
       const pid = flatNet.placeIndex.get(property.pending.name);
-      return pid == null ? "false" : `(and ${deadlock} (>= ${mVars[pid]} 1))`;
+      if (pid == null) return "false";
+      const conditions = encodeQuiescent(flatNet, mVars, envInject);
+      if (conditions == null) return "false";
+      conditions.push(`(>= ${mVars[pid]} 1)`);
+      return joinConditions(conditions);
+    }
+  }
+}
+function strandedConditions(excuses, counts) {
+  const stranded = [];
+  for (let pid = 0; pid < excuses.length; pid++) {
+    const markers = excuses[pid];
+    if (markers == null) continue;
+    if (markers.length === 0) {
+      stranded.push(`(>= ${counts[pid]} 1)`);
+    } else {
+      stranded.push(`(and (>= ${counts[pid]} 1) ${markers.map((k) => `(= ${counts[k]} 0)`).join(" ")})`);
     }
   }
+  return stranded;
 }
-function encodeDeadlock(flatNet, mVars, sinkPlaces, envInject) {
+function joinConditions(conditions) {
+  return conditions.length === 0 ? "true" : `(and ${conditions.join("\n         ")})`;
+}
+function encodeQuiescent(flatNet, mVars, envInject) {
   const envBound = /* @__PURE__ */ new Map();
   for (const inj of envInject) envBound.set(inj.pid, inj.bound);
   const disabledConditions = [];
@@ -1597,13 +1789,13 @@ function encodeDeadlock(flatNet, mVars, sinkPlaces, envInject) {
       disabledConditions.push("true");
       continue;
     }
-    if (disableReasons.length === 0) return "false";
+    if (disableReasons.length === 0) return null;
     disabledConditions.push(`(or ${disableReasons.join(" ")})`);
   }
-  for (const pid of indexOrdered(flatNet, sinkPlaces)) {
-    disabledConditions.push(`(= ${mVars[pid]} 0)`);
-  }
-  return disabledConditions.length === 0 ? "true" : `(and ${disabledConditions.join("\n         ")})`;
+  return disabledConditions;
+}
+function quiescenceUnreachable(flatNet, envInject) {
+  return encodeQuiescent(flatNet, vars(flatNet.places.length, ""), envInject) === null;
 }
 function injectionMap(flatNet) {
   const out = /* @__PURE__ */ new Map();
@@ -1613,7 +1805,7 @@ function injectionMap(flatNet) {
 
 // src/verification/z3/certificate-checker.ts
 var VC_LABELS = ["initiation (VC1)", "consecution (VC2)", "safety (VC3)"];
-async function checkCertificate(certificate, flatNet, initialMarking, property, invariants, sinkPlaces, solver, timeoutMs) {
+async function checkCertificate(certificate, flatNet, initialMarking, property, invariants, sinkPlaces, solver, timeoutMs, conditionalSinks = [], stateEquation = false) {
   if (certificate == null) {
     return {
       type: "unavailable",
@@ -1626,11 +1818,12 @@ async function checkCertificate(certificate, flatNet, initialMarking, property,
   if (!certificate.includes("(define-fun Reachable ") && !certificate.includes("(define-fun |Reachable| ")) {
     return { type: "unavailable", reason: "certificate does not define Reachable", invariant: certificate };
   }
-  const vcs = buildVerificationConditions(certificate, flatNet, initialMarking, property, sinkPlaces, invariants);
+  const vcs = buildVerificationConditions(certificate, flatNet, initialMarking, property, sinkPlaces, invariants, conditionalSinks, stateEquation);
   let results;
   try {
     results = await runVcScript(script(vcs), timeoutMs, solver);
   } catch (e) {
+    rethrowIfProgrammingError(e);
     return { type: "unavailable", reason: String(e?.message ?? e), invariant: certificate };
   }
   for (let i = 0; i < results.length; i++) {
@@ -1641,8 +1834,8 @@ async function checkCertificate(certificate, flatNet, initialMarking, property,
   }
   return { type: "passed", invariant: certificate };
 }
-function vcScript(certificate, flatNet, initialMarking, property, sinkPlaces, invariants) {
-  return script(buildVerificationConditions(certificate, flatNet, initialMarking, property, sinkPlaces, invariants));
+function vcScript(certificate, flatNet, initialMarking, property, sinkPlaces, invariants, conditionalSinks = [], stateEquation = false) {
+  return script(buildVerificationConditions(certificate, flatNet, initialMarking, property, sinkPlaces, invariants, conditionalSinks, stateEquation));
 }
 function shapeFailure(flatNet, invariants) {
   const P = flatNet.places.length;
@@ -1686,14 +1879,29 @@ function parseVcResults(stdout) {
   }
   return results;
 }
-function buildVerificationConditions(certificate, flatNet, initialMarking, property, sinkPlaces, invariants) {
+function buildVerificationConditions(certificate, flatNet, initialMarking, property, sinkPlaces, invariants, conditionalSinks, stateEquation) {
   const P = flatNet.places.length;
+  const T = stateEquation ? flatNet.transitions.length : 0;
   const mVars = [];
   const mpVars = [];
   for (let i = 0; i < P; i++) {
     mVars.push(`m${i}`);
     mpVars.push(`m${i}p`);
   }
+  const nVars = [];
+  const npVars = [];
+  for (let k = 0; k < T; k++) {
+    nVars.push(`n${k}`);
+    npVars.push(`n${k}p`);
+  }
+  const candidateOf = (m, n) => {
+    const parts = [`(Reachable ${[...m, ...n].join(" ")})`, ...invariantConditions(invariants, m)];
+    if (T > 0) {
+      for (const v of n) parts.push(`(>= ${v} 0)`);
+      parts.push(...stateEquationConditions(flatNet, initialMarking, n, m));
+    }
+    return conjoin(parts);
+  };
   const prelude = [
     "; IC3/PDR certificate check (plain SMT-LIB2, not HORN):",
     "; each VC below must be unsat for the certificate to stand.",
@@ -1702,19 +1910,22 @@ function buildVerificationConditions(certificate, flatNet, initialMarking, prope
   ];
   for (const v of mVars) prelude.push(`(declare-const ${v} Int)`);
   for (const v of mpVars) prelude.push(`(declare-const ${v} Int)`);
+  for (const v of nVars) prelude.push(`(declare-const ${v} Int)`);
+  for (const v of npVars) prelude.push(`(declare-const ${v} Int)`);
   const m0 = [];
   for (let i = 0; i < P; i++) m0.push(String(initialMarking.tokens(flatNet.places[i])));
-  const vc1 = [`(assert (not ${candidate(m0, invariants)}))`];
-  const nonNegative = mVars.map((v) => `(assert (>= ${v} 0))`);
-  const step = encodeStepRelationSmt2(flatNet);
+  const n0 = new Array(T).fill("0");
+  const vc1 = [`(assert (not ${candidateOf(m0, n0)}))`];
+  const nonNegative = [...mVars, ...nVars].map((v) => `(assert (>= ${v} 0))`);
+  const step = encodeStepRelationSmt2(flatNet, stateEquation);
   const vc2 = [
     ...nonNegative,
-    `(assert ${candidate(mVars, invariants)})`,
+    `(assert ${candidateOf(mVars, nVars)})`,
     `(assert ${step})`,
-    `(assert (not ${candidate(mpVars, invariants)}))`
+    `(assert (not ${candidateOf(mpVars, npVars)}))`
   ];
-  const bad = encodePropertyViolation(flatNet, property, mVars, sinkPlaces, resolveEnvInjection(flatNet));
-  const vc3 = [...nonNegative, `(assert ${candidate(mVars, invariants)})`, `(assert ${bad})`];
+  const bad = encodePropertyViolation(flatNet, property, mVars, sinkPlaces, resolveEnvInjection(flatNet), conditionalSinks);
+  const vc3 = [...nonNegative, `(assert ${candidateOf(mVars, nVars)})`, `(assert ${bad})`];
   return { prelude, asserts: [vc1, vc2, vc3] };
 }
 function script(vcs) {
@@ -1778,8 +1989,190 @@ function reasonUnknown(reply) {
   reason = reason.trim();
   return reason === "" ? null : reason;
 }
-function candidate(names, invariants) {
-  return conjoin([`(Reachable ${names.join(" ")})`, ...invariantConditions(invariants, names)]);
+
+// src/verification/z3/linear-bound.ts
+function violationDemand(flatNet, property) {
+  const demand = /* @__PURE__ */ new Map();
+  switch (property.type) {
+    case "unreachable":
+      for (const p of property.places) {
+        const pid = flatNet.placeIndex.get(p.name);
+        if (pid != null) demand.set(pid, 1);
+      }
+      break;
+    case "mutual-exclusion": {
+      for (const p of [property.p1, property.p2]) {
+        const pid = flatNet.placeIndex.get(p.name);
+        if (pid != null) demand.set(pid, 1);
+      }
+      break;
+    }
+    case "place-bound":
+    case "branch-place-bound": {
+      const pid = flatNet.placeIndex.get(property.place.name);
+      if (pid != null) demand.set(pid, property.bound + 1);
+      break;
+    }
+    case "deadlock-free":
+    case "terminates-at-sink":
+    case "joined-or-dead-lettered":
+      return null;
+  }
+  return demand.size === 0 ? null : demand;
+}
+function zeroWeightPlaces(flatNet) {
+  const zero = new Set(nonlinearPlaces(flatNet));
+  for (const inj of resolveEnvInjection(flatNet)) zero.add(inj.pid);
+  return zero;
+}
+function encodeLinearBound(flatNet, initialMarking, property) {
+  const demand = violationDemand(flatNet, property);
+  if (demand == null) return null;
+  const P = flatNet.places.length;
+  const zero = zeroWeightPlaces(flatNet);
+  const lines = [];
+  lines.push("; Linear state-equation bound (VER-015): y >= 0 with y.C <= 0 on every");
+  lines.push("; transition gives y.M <= y.M0 for every reachable M; sat = the violating");
+  lines.push("; markings' demand exceeds that bound, so none is reachable.");
+  lines.push("(set-logic QF_LIA)");
+  for (let p = 0; p < P; p++) lines.push(`(declare-const y${p} Int)`);
+  for (let p = 0; p < P; p++) lines.push(`(assert (>= y${p} 0))`);
+  for (const p of [...zero].sort((a, b) => a - b)) lines.push(`(assert (= y${p} 0))`);
+  for (const ft of flatNet.transitions) {
+    const terms = [];
+    for (let p = 0; p < P; p++) {
+      const c = ft.postVector[p] - ft.preVector[p];
+      if (c !== 0) terms.push(term(c, `y${p}`));
+    }
+    if (terms.length > 0) lines.push(`(assert (<= ${sum(terms)} 0))`);
+  }
+  const demandTerms = [];
+  for (const p of [...demand.keys()].sort((a, b) => a - b)) demandTerms.push(term(demand.get(p), `y${p}`));
+  const initTerms = ["1"];
+  for (let p = 0; p < P; p++) {
+    const m0 = initialMarking.tokens(flatNet.places[p]);
+    if (m0 > 0) initTerms.push(term(m0, `y${p}`));
+  }
+  lines.push(`(assert (>= ${sum(demandTerms)} ${sum(initTerms)}))`);
+  lines.push("(check-sat)");
+  lines.push("(get-model)");
+  return lines.join("\n");
+}
+function term(c, v) {
+  if (c === 1) return v;
+  if (c === -1) return `(- ${v})`;
+  return c > 0 ? `(* ${c} ${v})` : `(* (- ${-c}) ${v})`;
+}
+function sum(terms) {
+  return terms.length === 1 ? terms[0] : `(+ ${terms.join(" ")})`;
+}
+function decodeLinearBound(stdout, placeCount) {
+  const y = new Array(placeCount).fill(0n);
+  let seen = false;
+  for (const def of extractDefineFuns(stdout)) {
+    const m = /^\(define-fun\s+y(\d+)\s+\(\)\s+Int\s+(\(-\s*(\d+)\s*\)|(\d+))\s*\)$/s.exec(def.trim());
+    if (m == null) continue;
+    const pid = Number(m[1]);
+    if (pid >= placeCount) continue;
+    y[pid] = m[3] != null ? -BigInt(m[3]) : BigInt(m[4]);
+    seen = true;
+  }
+  return seen ? y : null;
+}
+function checkLinearBoundExact(flatNet, initialMarking, property, y) {
+  const demand = violationDemand(flatNet, property);
+  if (demand == null) return null;
+  const P = flatNet.places.length;
+  if (y.length !== P) return null;
+  const zero = zeroWeightPlaces(flatNet);
+  for (let p = 0; p < P; p++) {
+    if (y[p] < 0n) return null;
+    if (zero.has(p) && y[p] !== 0n) return null;
+  }
+  for (const ft of flatNet.transitions) {
+    let delta = 0n;
+    for (let p = 0; p < P; p++) {
+      if (y[p] === 0n) continue;
+      delta += y[p] * BigInt(ft.postVector[p] - ft.preVector[p]);
+    }
+    if (delta > 0n) return null;
+  }
+  let constant = 0n;
+  for (let p = 0; p < P; p++) {
+    if (y[p] !== 0n) constant += y[p] * BigInt(initialMarking.tokens(flatNet.places[p]));
+  }
+  let demandValue = 0n;
+  for (const [p, d] of demand) demandValue += y[p] * BigInt(d);
+  if (demandValue < constant + 1n) return null;
+  return { weights: y, constant, demandValue };
+}
+function formatLinearBound(flatNet, bound) {
+  const parts = [];
+  for (let p = 0; p < bound.weights.length; p++) {
+    const w = bound.weights[p];
+    if (w === 0n) continue;
+    parts.push(w === 1n ? flatNet.places[p].name : `${w}*${flatNet.places[p].name}`);
+  }
+  return `${parts.length === 0 ? "0" : parts.join(" + ")} <= ${bound.constant}`;
+}
+function formatLinearDemand(flatNet, property, bound) {
+  const demand = violationDemand(flatNet, property) ?? /* @__PURE__ */ new Map();
+  const parts = [];
+  for (const p of [...demand.keys()].sort((a, b) => a - b)) {
+    const w = bound.weights[p] * BigInt(demand.get(p));
+    if (w === 0n) continue;
+    parts.push(w === 1n ? flatNet.places[p].name : `${w}*${flatNet.places[p].name}`);
+  }
+  return `${parts.length === 0 ? "0" : parts.join(" + ")} >= ${bound.demandValue}`;
+}
+
+// src/verification/graph-decision.ts
+function decideOverClasses(view, property, sinkPlaces, conditionalSinks = []) {
+  const firstWhere = (pred) => {
+    for (let i = 0; i < view.count; i++) {
+      if (pred(i)) return i;
+    }
+    return -1;
+  };
+  switch (property.type) {
+    case "place-bound":
+    case "branch-place-bound":
+      return firstWhere((i) => view.markingOf(i).tokens(property.place) > property.bound);
+    case "unreachable":
+      return firstWhere((i) => {
+        const m = view.markingOf(i);
+        for (const p of property.places) {
+          if (!m.hasTokens(p)) return false;
+        }
+        return true;
+      });
+    case "mutual-exclusion":
+      return firstWhere((i) => {
+        const m = view.markingOf(i);
+        return m.hasTokens(property.p1) && m.hasTokens(property.p2);
+      });
+    // DeadlockFree (VER-002): a quiescent class that strands a token — some marked
+    // place is not where resting is permitted, the conditional sinks of VER-014
+    // included. The empty marking strands nothing (AC4).
+    case "deadlock-free":
+      return firstWhere((i) => view.isQuiescent(i) && strandsToken(view.markingOf(i), sinkPlaces, conditionalSinks));
+    // TerminatesAtSink (VER-002): a quiescent class that marks NO declared sink.
+    // Inverts with DeadlockFree on the empty marking, by design.
+    case "terminates-at-sink":
+      return firstWhere((i) => view.isQuiescent(i) && !anySinkMarked(view.markingOf(i), sinkPlaces));
+    // JoinedOrDeadLettered (NU-040 AC4): a quiescent class still holding a pending
+    // token. No sink clause.
+    case "joined-or-dead-lettered":
+      return firstWhere((i) => view.isQuiescent(i) && view.markingOf(i).hasTokens(property.pending));
+  }
+}
+function anySinkMarked(m, sinks) {
+  const sinkNames = /* @__PURE__ */ new Set();
+  for (const s of sinks) sinkNames.add(s.name);
+  for (const p of m.placesWithTokens()) {
+    if (sinkNames.has(p.name)) return true;
+  }
+  return false;
 }
 
 // src/verification/analysis/dbm.ts
@@ -1888,6 +2281,35 @@ var DBM = class _DBM {
     allNames.push(...newClockNames);
     return new _DBM(newBounds, newDim, allNames, false).canonicalize();
   }
+  /**
+   * The same zone with its clocks reordered: clock `k` of the result is clock
+   * `order[k]` of this DBM. `order` must be a permutation of `0..clockCount()-1`.
+   *
+   * The state-class graph applies this to put every class's clocks in the one
+   * canonical order (VER-010), so two arrivals at the same marking and zone whose
+   * transitions became enabled in a different sequence share a key instead of
+   * being counted as two classes. The reference row and column stay put; the
+   * matrix is copied once, O(dim²) against the O(dim³) canonicalisation every
+   * successor already pays.
+   */
+  permuted(order) {
+    if (this._empty) return this;
+    const n = this.clockNames.length;
+    const dim = this.dim;
+    const out = new Float64Array(dim * dim);
+    out[0] = 0;
+    const names = new Array(n);
+    for (let i = 0; i < n; i++) {
+      const oi = order[i] + 1;
+      names[i] = this.clockNames[order[i]];
+      out[(i + 1) * dim] = this.bounds[oi * dim];
+      out[i + 1] = this.bounds[oi];
+      for (let j = 0; j < n; j++) {
+        out[(i + 1) * dim + (j + 1)] = this.bounds[oi * dim + (order[j] + 1)];
+      }
+    }
+    return new _DBM(out, dim, names, false);
+  }
   /** Lets time pass: set all lower bounds to 0. */
   letTimePass() {
     if (this._empty) return this;
@@ -1919,6 +2341,24 @@ var DBM = class _DBM {
     }
     return true;
   }
+  /**
+   * The zone's identity for state-class dedup: the clock names and the FULL
+   * canonical matrix, every difference bound included.
+   *
+   * {@link toString} prints only the per-clock projections `[lo, hi]`, and two
+   * zones can agree on every projection while disagreeing on a difference
+   * constraint `θi - θj <= c` — the class where one transition must fire no later
+   * than another versus the class where either may go first. Keying on the
+   * projections merges those, and since the graph explores only the first
+   * arrival's successors, a marking reachable only from the second is lost: a
+   * false `proven`. This key is what {@link equals} compares, rendered.
+   */
+  zoneKey() {
+    if (this._empty) return "DBM[empty]";
+    const parts = [this.clockNames.join(",")];
+    for (let i = 0; i < this.bounds.length; i++) parts.push(formatBound(this.bounds[i]));
+    return parts.join("|");
+  }
   toString() {
     if (this._empty) return "DBM[empty]";
     const parts = [];
@@ -2167,10 +2607,35 @@ var StateClassGraph = class _StateClassGraph {
   }
 };
 function classKey(sc) {
-  return `${sc.marking.toString()}|${sc.firingDomain.toString()}`;
+  return `${sc.marking.toString()}|${sc.firingDomain.zoneKey()}`;
+}
+function canonicalOrder(transitions) {
+  let sorted = true;
+  for (let i = 1; i < transitions.length; i++) {
+    if (transitions[i].name < transitions[i - 1].name) {
+      sorted = false;
+      break;
+    }
+  }
+  if (sorted) return null;
+  const order = new Array(transitions.length);
+  for (let i = 0; i < order.length; i++) order[i] = i;
+  order.sort((a, b) => {
+    const na = transitions[a].name;
+    const nb = transitions[b].name;
+    return na < nb ? -1 : na > nb ? 1 : a - b;
+  });
+  return order;
+}
+function permute(items, order) {
+  const out = new Array(items.length);
+  for (let i = 0; i < order.length; i++) out[i] = items[order[i]];
+  return out;
 }
 function initialStateClass(net, initialMarking, envPlaces, envMode) {
-  const enabledTransitions = findEnabledTransitions(net, initialMarking, envPlaces, envMode);
+  const found = findEnabledTransitions(net, initialMarking, envPlaces, envMode);
+  const order = canonicalOrder(found);
+  const enabledTransitions = order === null ? found : permute(found, order);
   const clockNames = enabledTransitions.map((t) => t.name);
   const lowerBounds = enabledTransitions.map((t) => earliest(t.timing) / 1e3);
   const upperBounds = enabledTransitions.map((t) => latest(t.timing) / 1e3);
@@ -2215,14 +2680,19 @@ function computeSuccessor(net, current, fired, environmentPlaces, environmentMod
   const newClockNames = newlyEnabled.map((t) => t.name);
   const newLowerBounds = newlyEnabled.map((t) => earliest(t.timing) / 1e3);
   const newUpperBounds = newlyEnabled.map((t) => latest(t.timing) / 1e3);
-  const firedDBM = current.firingDomain.fireTransition(
+  let firedDBM = current.firingDomain.fireTransition(
     firedIdx,
     newClockNames,
     newLowerBounds,
     newUpperBounds,
     persistentIndices
   );
-  const allEnabled = [...persistent, ...newlyEnabled];
+  let allEnabled = [...persistent, ...newlyEnabled];
+  const order = canonicalOrder(allEnabled);
+  if (order !== null) {
+    allEnabled = permute(allEnabled, order);
+    firedDBM = firedDBM.permuted(order);
+  }
   const readyEarliest = allEnabled.map((_, k) => firedDBM.getLowerBound(k));
   const newDBM = firedDBM.letTimePass();
   return new StateClass(newMarking, newDBM, allEnabled, readyEarliest);
@@ -2294,10 +2764,7 @@ function fireTransition(marking, transition, outputPlaces, environmentPlaces, en
     consumeFromPlace(builder, spec.place, toConsume, environmentPlaces, environmentMode);
   }
   for (const arc of transition.resets) {
-    const current = marking.tokens(arc.place);
-    if (current > 0) {
-      builder.removeTokens(arc.place, current);
-    }
+    builder.tokens(arc.place, 0);
   }
   for (const place of outputPlaces) {
     builder.addTokens(place, 1);
@@ -2314,12 +2781,72 @@ function consumeFromPlace(builder, place, count, environmentPlaces, environmentM
   }
 }
 
+// src/verification/scg-verifier.ts
+function isUntimed(net) {
+  for (const t of net.transitions) {
+    if (t.timing.type !== "immediate") return false;
+  }
+  return true;
+}
+var NOTE_ENUMERATED = "\nNote: decided by bounded state-space enumeration \u2014 the state-class graph closed, so the verdict is sound AND complete: a `violated` is a real firing sequence, not a possibly-spurious over-approximation. The net is untimed, so this is the same claim the encoders make (VER-017).\n";
+function verifyViaStateClassGraph(net, initial, property, sinkPlaces, maxClasses, conditionalSinks = []) {
+  const graph = StateClassGraph.build(net, initial, maxClasses);
+  const classes = graph.stateClasses();
+  if (!graph.isComplete()) return { kind: "truncated", classCount: classes.length };
+  const violating = decideOverClasses(
+    {
+      count: classes.length,
+      markingOf: (i) => classes[i].marking,
+      isQuiescent: (i) => graph.successors(classes[i]).size === 0
+    },
+    property,
+    sinkPlaces,
+    conditionalSinks
+  );
+  if (violating >= 0) {
+    const [trace, transitions] = counterexamplePath(graph, classes[violating]);
+    return { kind: "decided", verdict: { type: "violated" }, trace, transitions, classCount: classes.length };
+  }
+  return {
+    kind: "decided",
+    verdict: { type: "proven", method: "state-space enumeration (VER-017)", inductiveInvariant: null },
+    trace: [],
+    transitions: [],
+    classCount: classes.length
+  };
+}
+function counterexamplePath(graph, target) {
+  const parent = /* @__PURE__ */ new Map();
+  const via = /* @__PURE__ */ new Map();
+  const seen = /* @__PURE__ */ new Set([graph.initialClass]);
+  const queue = [graph.initialClass];
+  while (queue.length > 0) {
+    const current = queue.shift();
+    if (current === target) break;
+    for (const [transition, edges] of graph.outgoingBranchEdges(current)) {
+      for (const edge of edges) {
+        if (seen.has(edge.target)) continue;
+        seen.add(edge.target);
+        parent.set(edge.target, current);
+        via.set(edge.target, transition.name);
+        queue.push(edge.target);
+      }
+    }
+  }
+  const chain = [];
+  for (let cur = target; cur != null; cur = parent.get(cur)) {
+    chain.push(cur);
+  }
+  chain.reverse();
+  return [chain.map((sc) => sc.marking), chain.slice(1).map((sc) => via.get(sc))];
+}
+
 // src/verification/z3/counterexample-decoder.ts
-function decode(answer, flatNet) {
-  const states = decodeStateSet(answer, flatNet);
+function decode(answer, flatNet, counterCount = 0) {
+  const states = decodeStateSet(answer, flatNet, counterCount);
   return { states, note: states.size === 0 ? "no ground Reachable states in the z3 proof" : null };
 }
-function decodeStateSet(answer, flatNet) {
+function decodeStateSet(answer, flatNet, counterCount = 0) {
   const byKey = /* @__PURE__ */ new Map();
   const P = flatNet.places.length;
   for (const head of ["(Reachable", "(|Reachable|"]) {
@@ -2336,8 +2863,8 @@ function decodeStateSet(answer, flatNet) {
       if (end < 0) break;
       const inner = answer.slice(start + head.length, end - 1);
       const args = parseGroundIntArgs(inner);
-      if (args != null && args.length === P) {
-        const marking = toMarking(args, flatNet);
+      if (args != null && args.length === P + counterCount) {
+        const marking = toMarking(counterCount === 0 ? args : args.slice(0, P), flatNet);
         const key = marking.toString();
         if (!byKey.has(key)) byKey.set(key, marking);
       }
@@ -2511,20 +3038,41 @@ function enabledRelaxEnv(state, ft, envInj) {
   }
   return true;
 }
-function isDeadlockA(index, state) {
+function isQuiescent(index, state) {
   for (const ft of index.flatNet.transitions) {
     if (enabledRelaxEnv(state, ft, index.envInj)) return false;
   }
   return true;
 }
-function satisfiesBadIndexed(index, state, property, sinkPlaces) {
+function sinkIndices(flatNet, sinkPlaces) {
+  const idx = /* @__PURE__ */ new Set();
+  for (const sink of sinkPlaces) {
+    const i = flatNetIndexOf(flatNet, sink);
+    if (i >= 0) idx.add(i);
+  }
+  return idx;
+}
+function satisfiesBadIndexed(index, state, property, sinkPlaces, conditionalSinks) {
   const flatNet = index.flatNet;
   switch (property.type) {
+    // DeadlockFree (VER-002): quiescent AND some marked place is not where resting
+    // is permitted — a conditional sink (VER-014) counts only while every marker
+    // that would excuse it is unmarked. Mirrors the encoder's `stranded` disjunction.
     case "deadlock-free": {
-      if (!isDeadlockA(index, state)) return false;
-      for (const sink of sinkPlaces) {
-        const idx = flatNetIndexOf(flatNet, sink);
-        if (idx >= 0 && state[idx] > 0) return false;
+      if (!isQuiescent(index, state)) return false;
+      const excuses = strandingExcuses(flatNet, sinkPlaces, conditionalSinks);
+      for (let pid = 0; pid < flatNet.places.length; pid++) {
+        const markers = excuses[pid];
+        if (markers == null || state[pid] < 1) continue;
+        if (markers.every((k) => state[k] === 0)) return true;
+      }
+      return false;
+    }
+    // TerminatesAtSink (VER-002): quiescent AND no declared sink marked.
+    case "terminates-at-sink": {
+      if (!isQuiescent(index, state)) return false;
+      for (const pid of sinkIndices(flatNet, sinkPlaces)) {
+        if (state[pid] !== 0) return false;
       }
       return true;
     }
@@ -2540,10 +3088,12 @@ function satisfiesBadIndexed(index, state, property, sinkPlaces) {
       if (idx < 0) return false;
       return state[idx] > property.bound;
     }
+    // JoinedOrDeadLettered (NU-040 AC4): quiescent AND `pending` marked. No sink
+    // clause — a marked sink must not excuse a stranded group.
     case "joined-or-dead-lettered": {
       const idx = flatNetIndexOf(flatNet, property.pending);
       if (idx < 0) return false;
-      return isDeadlockA(index, state) && state[idx] >= 1;
+      return isQuiescent(index, state) && state[idx] >= 1;
     }
     case "unreachable": {
       let resolved = 0;
@@ -2557,7 +3107,7 @@ function satisfiesBadIndexed(index, state, property, sinkPlaces) {
     }
   }
 }
-function replayCounterexample(flatNet, initial, decodedStates, property, sinkPlaces, options = {}) {
+function replayCounterexample(flatNet, initial, decodedStates, property, sinkPlaces, options = {}, conditionalSinks = []) {
   const segmentBudget = options.segmentBudget ?? 3;
   const nodeBudget = options.nodeBudget ?? 1e4;
   const anchors = /* @__PURE__ */ new Set();
@@ -2574,7 +3124,7 @@ function replayCounterexample(flatNet, initial, decodedStates, property, sinkPla
     };
   }
   const index = buildIndex(flatNet);
-  if (satisfiesBadIndexed(index, initial, property, sinkPlaces)) {
+  if (satisfiesBadIndexed(index, initial, property, sinkPlaces, conditionalSinks)) {
     return { kind: "confirmed", states: [initial], steps: [], nodesExplored: 1 };
   }
   const nodes = [{ state: initial, step: null, parent: -1, segment: 0 }];
@@ -2603,7 +3153,7 @@ function replayCounterexample(flatNet, initial, decodedStates, property, sinkPla
       }
       nodes.push({ state: succ.state, step: succ.step, parent: idx, segment });
       const childIdx = nodes.length - 1;
-      if (satisfiesBadIndexed(index, succ.state, property, sinkPlaces)) {
+      if (satisfiesBadIndexed(index, succ.state, property, sinkPlaces, conditionalSinks)) {
         const chain = reconstruct(nodes, childIdx);
         return { kind: "confirmed", ...chain, nodesExplored: nodes.length };
       }
@@ -2751,7 +3301,7 @@ function buildLayout(plan, P) {
 function quantified2(names) {
   return names.map((v) => `(${v} Int)`).join(" ");
 }
-function encodeColoured(plan, flat, initial, property, invariants, sinkPlaces) {
+function encodeColoured(plan, flat, initial, property, invariants, sinkPlaces, conditionalSinks = []) {
   const P = flat.places.length;
   const k = plan.k;
   const lay = buildLayout(plan, P);
@@ -2820,13 +3370,13 @@ function encodeColoured(plan, flat, initial, property, invariants, sinkPlaces) {
     }
   }
   lines.push("");
-  const error = encodeError(plan, lay, flat, property, sinkPlaces, injectionMap(flat));
+  const error = encodeError(plan, lay, flat, property, sinkPlaces, injectionMap(flat), conditionalSinks);
   if (error == null) return null;
   lines.push(error);
   lines.push("");
   lines.push("(assert (not Error))");
   lines.push("(check-sat)");
-  return { smt2: lines.join("\n"), placeCount: P };
+  return { smt2: lines.join("\n"), placeCount: P, counterCount: 0 };
 }
 function encodeRule(plan, lay, invariants, fill) {
   const enab = [];
@@ -2888,17 +3438,17 @@ function liftedInvariant(inv, plan, lay, names) {
     terms.push(w === 1 ? agg : `(* ${w} ${agg})`);
   }
   if (terms.length === 0) return null;
-  const sum = terms.length === 1 ? terms[0] : `(+ ${terms.join(" ")})`;
-  return `(= ${sum} ${inv.constant})`;
+  const sum2 = terms.length === 1 ? terms[0] : `(+ ${terms.join(" ")})`;
+  return `(= ${sum2} ${inv.constant})`;
 }
-function encodeError(plan, lay, flat, property, sinkPlaces, envInj) {
-  const violation = encodeViolation(plan, lay, flat, property, sinkPlaces, envInj);
+function encodeError(plan, lay, flat, property, sinkPlaces, envInj, conditionalSinks) {
+  const violation = encodeViolation(plan, lay, flat, property, sinkPlaces, envInj, conditionalSinks);
   if (violation == null) return null;
   return `(assert (forall (${quantified2(lay.cur)})
   (=> (and (Reachable ${lay.cur.join(" ")}) ${violation})
       Error)))`;
 }
-function encodeViolation(plan, lay, flat, property, sinkPlaces, envInj) {
+function encodeViolation(plan, lay, flat, property, sinkPlaces, envInj, conditionalSinks) {
   const anyPlacePresent = (places) => {
     const conds = indexOrdered(flat, places).map((pid) => `(>= ${aggregate(plan, lay, pid, lay.cur)} 1)`);
     return conds.length === 0 ? "false" : `(and ${conds.join(" ")})`;
@@ -2914,13 +3464,37 @@ function encodeViolation(plan, lay, flat, property, sinkPlaces, envInj) {
       return anyPlacePresent([property.p1, property.p2]);
     case "unreachable":
       return anyPlacePresent(property.places);
-    case "deadlock-free":
-      return encodeColouredDeadlock(plan, lay, flat, sinkPlaces, envInj);
+    // DeadlockFree (VER-002): quiescent AND some marked place is not where resting
+    // is permitted (VER-014). Mirrors the flat encoder's `stranded` disjunction over
+    // the aggregate (all-colour) count of each place.
+    case "deadlock-free": {
+      const conds = encodeColouredQuiescent(plan, lay, flat, envInj);
+      if (conds == null) return "false";
+      const counts = [];
+      for (let pid = 0; pid < flat.places.length; pid++) counts.push(aggregate(plan, lay, pid, lay.cur));
+      const stranded = strandedConditions(strandingExcuses(flat, sinkPlaces, conditionalSinks), counts);
+      if (stranded.length === 0) return "false";
+      conds.push(`(or ${stranded.join(" ")})`);
+      return joinColoured(conds);
+    }
+    // TerminatesAtSink (VER-002): quiescent AND no declared sink marked.
+    case "terminates-at-sink": {
+      const conds = encodeColouredQuiescent(plan, lay, flat, envInj);
+      if (conds == null) return "false";
+      for (const pid of indexOrdered(flat, sinkPlaces)) {
+        conds.push(`(= ${aggregate(plan, lay, pid, lay.cur)} 0)`);
+      }
+      return joinColoured(conds);
+    }
+    // JoinedOrDeadLettered (NU-040 AC4): quiescent AND `pending` marked, with NO
+    // sink clause.
     case "joined-or-dead-lettered": {
       const pid = flat.placeIndex.get(property.pending.name);
       if (pid == null) return null;
-      const deadlock = encodeColouredDeadlock(plan, lay, flat, sinkPlaces, envInj);
-      return `(and ${deadlock} (>= ${aggregate(plan, lay, pid, lay.cur)} 1))`;
+      const conds = encodeColouredQuiescent(plan, lay, flat, envInj);
+      if (conds == null) return "false";
+      conds.push(`(>= ${aggregate(plan, lay, pid, lay.cur)} 1)`);
+      return joinColoured(conds);
     }
   }
 }
@@ -2978,7 +3552,10 @@ function colouredDisabledTerm(cls, plan, lay) {
     }
   }
 }
-function encodeColouredDeadlock(plan, lay, flat, sinkPlaces, envInj) {
+function joinColoured(conds) {
+  return conds.length === 0 ? "true" : `(and ${conds.join(" ")})`;
+}
+function encodeColouredQuiescent(plan, lay, flat, envInj) {
   const disabledConditions = [];
   for (let ti = 0; ti < plan.classes.length; ti++) {
     const cls = plan.classes[ti];
@@ -2989,15 +3566,12 @@ function encodeColouredDeadlock(plan, lay, flat, sinkPlaces, envInj) {
       disabledConditions.push("true");
       continue;
     }
-    const term = colouredDisabledTerm(cls, plan, lay);
-    if (term != null) reasons.push(term);
-    if (reasons.length === 0) return "false";
+    const term2 = colouredDisabledTerm(cls, plan, lay);
+    if (term2 != null) reasons.push(term2);
+    if (reasons.length === 0) return null;
     disabledConditions.push(reasons.length === 1 ? reasons[0] : `(or ${reasons.join(" ")})`);
   }
-  for (const pid of indexOrdered(flat, sinkPlaces)) {
-    disabledConditions.push(`(= ${aggregate(plan, lay, pid, lay.cur)} 0)`);
-  }
-  return disabledConditions.length === 0 ? "true" : `(and ${disabledConditions.join(" ")})`;
+  return disabledConditions;
 }
 
 // src/verification/analysis/name-fragment.ts
@@ -3189,7 +3763,7 @@ var NameStateClass = class {
   }
 };
 function baseKeyOf(base) {
-  return `${base.marking.toString()}|${base.firingDomain.toString()}`;
+  return `${base.marking.toString()}|${base.firingDomain.zoneKey()}`;
 }
 
 // src/verification/analysis/name-state-class-graph.ts
@@ -3420,7 +3994,7 @@ function enablingSymbols(names, colouredIn) {
 
 // src/verification/nu-scg-verifier.ts
 var NOTE_EXACT = "\nNote: \u03BD-join correlation decided exactly via the state-class-graph name-partition quotient \u2014 the symbolic graph closed, so the verdict is sound AND complete (no spurious different-name counterexample; quiescence is name-aware), beyond the bounded-budget fragment (NU-050, Route B).\n";
-function verifyViaNameScg(net, initial, property, sinkPlaces, environmentPlaces, environmentMode, maxClasses, fragmentMode, carrierPlaces, prioritySemantics) {
+function verifyViaNameScg(net, initial, property, sinkPlaces, environmentPlaces, environmentMode, maxClasses, fragmentMode, carrierPlaces, prioritySemantics, conditionalSinks = []) {
   const fragment = classify(net, fragmentMode, carrierPlaces);
   if (fragment === null) return null;
   for (const p of initial.placesWithTokens()) {
@@ -3447,9 +4021,9 @@ function verifyViaNameScg(net, initial, property, sinkPlaces, environmentPlaces,
       classCount: scg.classCount()
     };
   }
-  const violating = decide(scg, property, sinkPlaces);
+  const violating = decide(scg, property, sinkPlaces, conditionalSinks);
   if (violating >= 0) {
-    const [trace, transitions] = counterexamplePath(scg, violating);
+    const [trace, transitions] = counterexamplePath2(scg, violating);
     return { verdict: { type: "violated" }, trace, transitions, note: NOTE_EXACT, classCount: scg.classCount() };
   }
   return {
@@ -3460,45 +4034,19 @@ function verifyViaNameScg(net, initial, property, sinkPlaces, environmentPlaces,
     classCount: scg.classCount()
   };
 }
-function decide(scg, property, sinkPlaces) {
-  const firstWhere = (pred) => {
-    for (let i = 0; i < scg.classCount(); i++) {
-      if (pred(i)) return i;
-    }
-    return -1;
-  };
-  switch (property.type) {
-    case "place-bound":
-    case "branch-place-bound":
-      return firstWhere((i) => scg.markingOf(i).tokens(property.place) > property.bound);
-    case "unreachable":
-      return firstWhere((i) => {
-        const m = scg.markingOf(i);
-        for (const p of property.places) {
-          if (!m.hasTokens(p)) return false;
-        }
-        return true;
-      });
-    case "mutual-exclusion":
-      return firstWhere((i) => {
-        const m = scg.markingOf(i);
-        return m.hasTokens(property.p1) && m.hasTokens(property.p2);
-      });
-    case "deadlock-free":
-      return firstWhere((i) => scg.successorsOf(i).length === 0 && !allTokensInSinks(scg.markingOf(i), sinkPlaces));
-    case "joined-or-dead-lettered":
-      return firstWhere((i) => scg.successorsOf(i).length === 0 && scg.markingOf(i).hasTokens(property.pending));
-  }
-}
-function allTokensInSinks(m, sinks) {
-  const sinkNames = /* @__PURE__ */ new Set();
-  for (const s of sinks) sinkNames.add(s.name);
-  for (const p of m.placesWithTokens()) {
-    if (!sinkNames.has(p.name)) return false;
-  }
-  return true;
+function decide(scg, property, sinkPlaces, conditionalSinks) {
+  return decideOverClasses(
+    {
+      count: scg.classCount(),
+      markingOf: (i) => scg.markingOf(i),
+      isQuiescent: (i) => scg.successorsOf(i).length === 0
+    },
+    property,
+    sinkPlaces,
+    conditionalSinks
+  );
 }
-function counterexamplePath(scg, target) {
+function counterexamplePath2(scg, target) {
   const n = scg.classCount();
   const parent = new Array(n).fill(-1);
   const via = new Array(n).fill("");
@@ -3538,13 +4086,17 @@ var SmtVerifier = class _SmtVerifier {
   _property = deadlockFree();
   _environmentPlaces = /* @__PURE__ */ new Set();
   _sinkPlaces = /* @__PURE__ */ new Set();
+  _conditionalSinks = [];
   _budgetPlaces = /* @__PURE__ */ new Set();
   _environmentMode = alwaysAvailable();
   _timeoutMs = 6e4;
   _certificateCheck = true;
   _counterexampleReplay = true;
   _semiflowInvariants = false;
+  _stateEquation = false;
+  _linearBound = true;
   _nuMaxClasses = 1e5;
+  _enumerationMaxClasses = 5e4;
   _fragmentMode = "base";
   _carrierPlaces = /* @__PURE__ */ new Set();
   _prioritySemantics = "none";
@@ -3574,13 +4126,47 @@ var SmtVerifier = class _SmtVerifier {
     return this;
   }
   /**
-   * Declares expected sink (terminal) places for deadlock-freedom analysis.
-   * Markings where any sink place has a token are not considered deadlocks.
+   * Declares expected sink (terminal) places for deadlock-freedom analysis
+   * (VER-002): a token resting in one is never stranded, and `TerminatesAtSink`
+   * asks whether one of them was reached.
    */
   sinkPlaces(...places) {
     for (const p of places) this._sinkPlaces.add(p);
     return this;
   }
+  /**
+   * Declares places where a token may rest **while `marker` holds a token**
+   * (VER-014) — a designed terminal such as a halt or pause marker, under which
+   * the work it interrupted legitimately stays where it was delivered.
+   *
+   * `DeadlockFree` then reads a quiescent marking against the union of the
+   * declared sinks, the markers, and every conditional set whose marker is marked:
+   * a token in `p` is stranded only when none of those excuse it. The marker
+   * itself is at rest whenever it is marked, so `sinkPlacesWhen(halt)` with no
+   * further places excuses exactly the halt token. Repeated calls for one marker
+   * accumulate; declarations for several markers union. `TerminatesAtSink` is
+   * unaffected and reads only {@link sinkPlaces}.
+   *
+   * ```ts
+   * SmtVerifier.forNet(net)
+   *   .property(deadlockFree())
+   *   .sinkPlaces(done)                       // may always rest
+   *   .sinkPlacesWhen(halt, inbox, pending)   // may rest once the run halted
+   *   .sinkPlacesWhen(pause, inbox)           // may rest while paused
+   * ```
+   *
+   * An unresolved marker or place contributes nothing, as an unresolved sink
+   * does: a mistyped marker makes the property stricter, never laxer.
+   */
+  sinkPlacesWhen(marker, ...places) {
+    let entry = this._conditionalSinks.find((c) => c.marker.name === marker.name);
+    if (entry == null) {
+      entry = { marker, places: /* @__PURE__ */ new Set() };
+      this._conditionalSinks.push(entry);
+    }
+    for (const p of places) entry.places.add(p);
+    return this;
+  }
   /**
    * Declares ν-net budget places (NU-040): places whose token count bounds the
    * live correlation pool (they gate fresh-name minting). Declaring at least one
@@ -3658,10 +4244,67 @@ var SmtVerifier = class _SmtVerifier {
    * `Certificate check: not applicable (name-coloured encoding)`. Off by default so
    * reports stay byte-equal.
    */
+  /**
+   * `'auto'` decides whether the semiflows would add **information to the
+   * encoding**, which is not the same question as whether they would appear in
+   * {@link SmtVerificationResult.invariants} for a caller who reads them.
+   *
+   * A complete basis spans every conservation law of the net, so a semiflow it
+   * spans constrains nothing further and IC3 gains nothing from it — that is why
+   * `'auto'` skips the enumeration there. But the basis is the *signed*
+   * null-space, and a law it spans need not appear in it in **non-negative**
+   * form; only the Farkas enumeration produces that. A caller inspecting the
+   * invariant list for a law of a given shape — "a non-negative law weighting the
+   * budget place and every running place positively" — can therefore find nothing
+   * on a net that plainly has one. Such a caller should ask for the union
+   * explicitly: `'auto'` is the setting to prefer for verification, not for
+   * harvesting.
+   */
   semiflowInvariants(enabled) {
     this._semiflowInvariants = enabled;
     return this;
   }
+  /**
+   * Enables/disables the linear state-equation bound phase (VER-015; default:
+   * enabled). A reachability-safety property whose violating markings exceed some
+   * `y·M <= y·M0` with `y >= 0`, `y·C <= 0` is then proven structurally, from one
+   * linear query re-checked in exact integer arithmetic, before any fixpoint search.
+   * Disable it to force the IC3/PDR path — for its certificate, or to exercise the
+   * fixpoint engine itself.
+   */
+  linearBound(enabled) {
+    this._linearBound = enabled;
+    return this;
+  }
+  /**
+   * Encodes the **state equation** with firing counters (VER-016; default:
+   * disabled — the encoding then carries places only).
+   *
+   * The flat encoding gains one counter `n_t` per flat transition and every
+   * transition rule conjoins the marking equation `M' = M0 + C·n'` for each place
+   * whose column is exact (no consume-all / reset arc, not injected). Every linear
+   * consequence of the marking equation — the equality laws of VER-005/VER-007
+   * **and** the inequality laws `y·M ≤ y·M0` (`y ≥ 0, y·C ≤ 0`) and their mixed-sign
+   * kin, which are what an *ordering* argument ("both join slots armed means every
+   * upstream stage has run, so nothing can still halt") looks like in linear
+   * arithmetic — is then available to Spacer as a fact rather than a lemma it has to
+   * invent. On a 50-place agent-dispatch workflow, proper completion under conditional
+   * sinks went from `unknown` after 120 s to `proven` in 1.5 s with this as the only
+   * change; a 53-place pipeline stage before a join, `unknown` at 300 s, proves in
+   * under a second.
+   *
+   * The cost is a larger state (places + transitions) and a slower witness search
+   * on genuinely violated properties (about 1.5× on the nets above), so it is opt-in.
+   * Soundness is unchanged: the counters are exact bookkeeping, the equation holds
+   * on every reachable state by construction (`Strengthening.lean`, the same shape
+   * as the equality laws), and the certificate check re-proves it against the raw
+   * step relation, whose only counter knowledge is the increment. Not applied to the
+   * name-coloured encoding or Route B, which the report says when it applies.
+   */
+  stateEquation(enabled) {
+    this._stateEquation = enabled;
+    return this;
+  }
   /**
    * Sets the class-count cap for the ν-aware state-class-graph analysis (NU-050,
    * Route B). When the symbolic name-aware graph would exceed this, the analysis
@@ -3672,6 +4315,29 @@ var SmtVerifier = class _SmtVerifier {
     this._nuMaxClasses = max;
     return this;
   }
+  /**
+   * Sets the class budget for the bounded state-space enumeration route
+   * (VER-017; default 50 000). `0` disables the route, so every query goes to
+   * the SMT pipeline.
+   *
+   * When the state-class graph closes within the budget the property is decided
+   * exactly — sound and complete over the timed semantics — and no solver runs.
+   * This is what makes a long pipeline tractable: IC3 needs a frame per stage and
+   * its cost climbs with the cube of the length, while enumeration is linear in
+   * the reachable state space. A forty-node chain (370 places, 1 967 classes)
+   * takes 410 s on the fixpoint path and 0.11 s here.
+   *
+   * The route declines when the graph exceeds the budget, and the SMT pipeline
+   * then runs unchanged — it can only add verdicts, never remove them. It is
+   * skipped for ν-nets, which have their own exact route (NU-050, Route B), for
+   * nets with environment places, whose injection the graph does not model, and
+   * for **timed** nets, where its verdict would be the weaker timed claim rather
+   * than the untimed one the encoders make (VER-004).
+   */
+  enumerationMaxClasses(max) {
+    this._enumerationMaxClasses = max;
+    return this;
+  }
   /**
    * Selects the ν-net coloured-place fragment for Route B (NU-051). `base`
    * (default) admits the shipped mint → matched-join fragment only; `extended`
@@ -3754,7 +4420,8 @@ var SmtVerifier = class _SmtVerifier {
         this._initialMarking,
         this._property,
         invariants,
-        this._sinkPlaces
+        this._sinkPlaces,
+        this._conditionalSinks
       )
     };
   }
@@ -3771,35 +4438,45 @@ var SmtVerifier = class _SmtVerifier {
     requireOutputProducingActions(this.net);
     const flatNet = flatten(this.net, this._environmentPlaces, this._environmentMode);
     const matrix = IncidenceMatrix.from(flatNet);
-    const { valid: basis } = validateInvariantsExact(
+    const { valid: basis, dropped: basisDropped } = validateInvariantsExact(
       matrix,
       computePInvariants(matrix, flatNet, this._initialMarking),
       flatNet,
       this._initialMarking
     );
-    const { valid: semiflows } = validateInvariantsExact(
+    const autoUnion = this._semiflowInvariants === "auto" && basisDropped.some((d) => d.reason.includes("Strengthening.lean H1"));
+    const scriptsHasMatch = [...this.net.transitions].some((t) => t.matchSpec !== null);
+    const { valid: semiflows } = this._semiflowInvariants === true || autoUnion || scriptsHasMatch && this._budgetPlaces.size > 0 ? validateInvariantsExact(
       matrix,
       computePSemiflows(matrix, flatNet, this._initialMarking),
       flatNet,
       this._initialMarking
-    );
+    ) : { valid: [] };
     let invariants = basis;
-    if (this._semiflowInvariants) invariants = strengthenWithSemiflows(basis, semiflows).invariants;
+    if (this._semiflowInvariants === true || autoUnion) invariants = strengthenWithSemiflows(basis, semiflows).invariants;
     invariants = canonicalInvariantOrder(invariants);
     const attempt = this.colouredAttempt(flatNet, invariants, semiflows);
+    const bound = attempt.plan == null && this._linearBound && !(this._environmentPlaces.size > 0 && this._environmentMode.type === "ignore") ? encodeLinearBound(flatNet, this._initialMarking, this._property) : null;
     if (attempt.encoding != null) {
-      return { horn: attempt.encoding.smt2, certificate: null, coloured: true };
+      return { horn: attempt.encoding.smt2, certificate: null, coloured: true, bound };
     }
-    const horn = encode(flatNet, this._initialMarking, this._property, invariants, this._sinkPlaces, this._counterexampleReplay).smt2;
+    const flat = encodeNet(flatNet, this._initialMarking, this._property, invariants, {
+      sinkPlaces: this._sinkPlaces,
+      produceProofs: this._counterexampleReplay,
+      conditionalSinks: this._conditionalSinks,
+      stateEquation: this._stateEquation
+    });
     const certificate = vcScript(
-      placeholderCertificate(flatNet.places.length),
+      placeholderCertificate(flatNet.places.length + flat.counterCount),
       flatNet,
       this._initialMarking,
       this._property,
       this._sinkPlaces,
-      invariants
+      invariants,
+      this._conditionalSinks,
+      this._stateEquation
     );
-    return { horn, certificate, coloured: false };
+    return { horn: flat.smt2, certificate, coloured: false, bound };
   }
   /**
    * Runs the verification pipeline.
@@ -3812,10 +4489,34 @@ var SmtVerifier = class _SmtVerifier {
     const report = [];
     report.push("=== IC3/PDR SAFETY VERIFICATION ===\n");
     report.push(`Net: ${this.net.name}`);
-    const propDesc = this._sinkPlaces.size === 0 ? propertyDescription(this._property) : `${propertyDescription(this._property)} (sinks: ${[...this._sinkPlaces].map((p) => p.name).join(", ")})`;
+    const sinkDesc = describeSinks(this._sinkPlaces, this._conditionalSinks);
+    const propDesc = sinkDesc === null ? propertyDescription(this._property) : `${propertyDescription(this._property)} (${sinkDesc})`;
     report.push(`Property: ${propDesc}`);
     report.push(`Timeout: ${(this._timeoutMs / 1e3).toFixed(0)}s
 `);
+    const absent = unresolvedPropertyPlaceInNet(this.net, this._property);
+    if (absent != null) {
+      const reason = `property names a place that does not resolve in the net ('${absent}'); refusing to certify (the encoding would be vacuously proven)`;
+      report.push("=== RESULT ===\n");
+      report.push(`UNKNOWN: ${reason}`);
+      return buildResult(
+        { type: "unknown", reason },
+        report.join("\n"),
+        [],
+        [],
+        [],
+        [],
+        performance.now() - start,
+        {
+          places: [...this.net.places].length,
+          transitions: [...this.net.transitions].length,
+          invariantsFound: 0,
+          structuralResult: "n/a (unresolved property place)"
+        },
+        null,
+        "unavailable"
+      );
+    }
     const hasMatch = [...this.net.transitions].some((t) => t.matchSpec !== null);
     const nuBounded = this._budgetPlaces.size > 0;
     if (hasMatch && (!isReachabilitySafety(this._property) || !nuBounded)) {
@@ -3829,7 +4530,8 @@ var SmtVerifier = class _SmtVerifier {
         this._nuMaxClasses,
         this._fragmentMode,
         this._carrierPlaces,
-        this._prioritySemantics
+        this._prioritySemantics,
+        this._conditionalSinks
       );
       const deferToRouteA = outcome !== null && outcome.verdict.type === "unknown" && !isReachabilitySafety(this._property) && nuBounded;
       if (outcome !== null && !deferToRouteA) {
@@ -3857,7 +4559,9 @@ var SmtVerifier = class _SmtVerifier {
             transitions: [...this.net.transitions].length,
             invariantsFound: 0,
             structuralResult: "n/a (\u03BD name-partition SCG)"
-          }
+          },
+          null,
+          "nu-scg"
         );
       } else if (deferToRouteA) {
         report.push(
@@ -3870,6 +4574,47 @@ var SmtVerifier = class _SmtVerifier {
         );
       }
     }
+    if (!hasMatch && this._environmentPlaces.size === 0 && this._enumerationMaxClasses > 0 && isUntimed(this.net)) {
+      const enumerated = verifyViaStateClassGraph(
+        this.net,
+        this._initialMarking,
+        this._property,
+        this._sinkPlaces,
+        this._enumerationMaxClasses,
+        this._conditionalSinks
+      );
+      if (enumerated.kind === "decided") {
+        report.push("=== Bounded state-space enumeration (VER-017) ===");
+        report.push(`  State classes: ${enumerated.classCount}`);
+        report.push("  P-invariants: not computed (no encoding is built on this route)");
+        report.push(NOTE_ENUMERATED);
+        if (enumerated.transitions.length > 0) {
+          report.push(`  Counterexample trace: ${enumerated.trace.length} states, ${enumerated.transitions.length} transitions`);
+        }
+        return buildResult(
+          enumerated.verdict,
+          report.join("\n"),
+          [],
+          [],
+          enumerated.trace,
+          enumerated.transitions,
+          performance.now() - start,
+          {
+            places: [...this.net.places].length,
+            transitions: [...this.net.transitions].length,
+            invariantsFound: 0,
+            structuralResult: "n/a (state-space enumeration)"
+          },
+          // The graph path IS a firing sequence, so a violation is ordered and
+          // confirmed by construction; there is nothing left to replay.
+          enumerated.verdict.type === "violated" ? true : null,
+          "enumeration"
+        );
+      }
+      report.push(
+        `Bounded state-space enumeration truncated at ${this._enumerationMaxClasses} classes (VER-017); verifying via the SMT pipeline.`
+      );
+    }
     report.push("Phase 1: Flattening net...");
     const flatNet = flatten(this.net, this._environmentPlaces, this._environmentMode);
     report.push(`  Places: ${flatNet.places.length}`);
@@ -3894,7 +4639,7 @@ var SmtVerifier = class _SmtVerifier {
     }
     report.push(`  Result: ${structResultStr}
 `);
-    if (this._property.type === "deadlock-free" && !hasMatch && this._sinkPlaces.size === 0 && structResult.type === "no-potential-deadlock" && this._environmentPlaces.size === 0) {
+    if (this._property.type === "deadlock-free" && !hasMatch && commonerApplies(flatNet) && this._sinkPlaces.size === 0 && this._conditionalSinks.length === 0 && structResult.type === "no-potential-deadlock" && this._environmentPlaces.size === 0) {
       report.push("=== RESULT ===\n");
       report.push("PROVEN (structural): Deadlock-freedom verified by Commoner's theorem.");
       report.push("  All siphons contain initially marked traps.");
@@ -3907,7 +4652,9 @@ var SmtVerifier = class _SmtVerifier {
         [],
         [],
         performance.now() - start,
-        { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: 0, structuralResult: structResultStr }
+        { places: flatNet.places.length, transitions: flatNet.transitions.length, invariantsFound: 0, structuralResult: structResultStr },
+        null,
+        "structural"
       );
     }
     report.push("Phase 3: Computing P-invariants...");
@@ -3918,15 +4665,21 @@ var SmtVerifier = class _SmtVerifier {
       flatNet,
       this._initialMarking
     );
-    const { valid: semiflows, dropped: droppedSemiflows } = validateInvariantsExact(
+    const basisLostALaw = droppedInvariants.some((d) => d.reason.includes("Strengthening.lean H1"));
+    const semiflowsWanted = this._semiflowInvariants === true || this._semiflowInvariants === "auto" && basisLostALaw || hasMatch && nuBounded;
+    const { valid: semiflows, dropped: droppedSemiflows } = semiflowsWanted ? validateInvariantsExact(
       matrix,
       computePSemiflows(matrix, flatNet, this._initialMarking),
       flatNet,
       this._initialMarking
-    );
+    ) : { valid: [], dropped: [] };
     report.push(`  Found: ${basisInvariants.length} P-invariant(s)`);
+    if (this._semiflowInvariants === "auto") {
+      report.push(basisLostALaw ? "  Semiflow union: ON (auto \u2014 the basis lost a law to the H1 guard)" : "  Semiflow union: off (auto \u2014 the basis is complete, so the semiflows would add no constraint the encoding does not already have; they may still differ in FORM)");
+    }
+    const unionWanted = this._semiflowInvariants === true || this._semiflowInvariants === "auto" && basisLostALaw;
     let invariants = basisInvariants;
-    if (this._semiflowInvariants) {
+    if (unionWanted) {
       const { invariants: strengthened, added } = strengthenWithSemiflows(basisInvariants, semiflows);
       invariants = strengthened;
       report.push(`  Semiflows encoded as invariants: ${added}`);
@@ -3950,6 +4703,11 @@ var SmtVerifier = class _SmtVerifier {
       report.push(`  Dropped: ${droppedSemiflows.length} semiflow(s) failed the exact re-check`);
     }
     report.push("");
+    if (!isReachabilitySafety(this._property) && quiescenceUnreachable(flatNet, resolveEnvInjection(flatNet))) {
+      report.push(
+        "  NOTE: no marking of this net can be quiescent \u2014 a transition is enabled in every marking (an environment-gated one under modelled injection, VER-006). Every quiescence property is therefore vacuously true here, and a `proven` says nothing about the net."
+      );
+    }
     report.push("Phase 4: IC3/PDR verification via Z3 Spacer...");
     const stats = {
       places: flatNet.places.length,
@@ -3961,6 +4719,7 @@ var SmtVerifier = class _SmtVerifier {
     try {
       solver = resolveZ3();
     } catch (e) {
+      rethrowIfProgrammingError(e);
       const reason = e instanceof Z3Unavailable ? e.message : String(e?.message ?? e);
       report.push(`  Solver: z3 unavailable (${reason})`);
       report.push(`  Status: UNKNOWN (${reason})
@@ -3968,11 +4727,35 @@ var SmtVerifier = class _SmtVerifier {
       report.push("=== RESULT ===\n");
       report.push(`UNKNOWN: Could not determine ${propDesc}`);
       report.push(`  Reason: ${reason}`);
-      return buildResult({ type: "unknown", reason }, report.join("\n"), invariants, [], [], [], performance.now() - start, stats);
+      return buildResult({ type: "unknown", reason }, report.join("\n"), invariants, [], [], [], performance.now() - start, stats, null, "unavailable");
     }
     report.push(`  Solver: z3 ${formatZ3Version(solver.version)}`);
     const colouredAttempt = this.colouredAttempt(flatNet, invariants, semiflows);
     const colouredPlan = colouredAttempt.plan;
+    if (this._linearBound && colouredPlan == null && isReachabilitySafety(this._property) && !(this._environmentPlaces.size > 0 && this._environmentMode.type === "ignore")) {
+      const proof = await this.linearBoundProof(flatNet, solver, report);
+      if (proof != null) {
+        report.push("  Certificate check: not applicable (structural proof)");
+        report.push("");
+        report.push("=== RESULT ===\n");
+        report.push(`PROVEN (structural): ${propDesc}`);
+        report.push("  Linear state-equation bound: y >= 0 with y.C <= 0 gives y.M <= y.M0 on every");
+        report.push("  reachable marking, and the violating markings exceed it (VER-015).");
+        report.push(`  ${proof}`);
+        return this.applyNuGuard(buildResult(
+          { type: "proven", method: "structural", inductiveInvariant: null },
+          report.join("\n"),
+          invariants,
+          [],
+          [],
+          [],
+          performance.now() - start,
+          stats,
+          null,
+          "structural"
+        ), hasMatch, nuBounded, false);
+      }
+    }
     let encoding;
     if (colouredPlan != null) {
       report.push(
@@ -3984,7 +4767,7 @@ var SmtVerifier = class _SmtVerifier {
         report.push("  Status: UNKNOWN (unresolved property place)\n");
         report.push("=== RESULT ===\n");
         report.push(`UNKNOWN: ${reason}`);
-        return buildResult({ type: "unknown", reason }, report.join("\n"), invariants, [], [], [], performance.now() - start, stats);
+        return buildResult({ type: "unknown", reason }, report.join("\n"), invariants, [], [], [], performance.now() - start, stats, null, "unavailable");
       }
       encoding = coloured;
     } else {
@@ -3994,9 +4777,20 @@ var SmtVerifier = class _SmtVerifier {
         report.push("  Status: UNKNOWN (unresolved property place)\n");
         report.push("=== RESULT ===\n");
         report.push(`UNKNOWN: ${reason}`);
-        return buildResult({ type: "unknown", reason }, report.join("\n"), invariants, [], [], [], performance.now() - start, stats);
+        return buildResult({ type: "unknown", reason }, report.join("\n"), invariants, [], [], [], performance.now() - start, stats, null, "unavailable");
       }
-      encoding = encode(flatNet, this._initialMarking, this._property, invariants, this._sinkPlaces, this._counterexampleReplay);
+      encoding = encodeNet(flatNet, this._initialMarking, this._property, invariants, {
+        sinkPlaces: this._sinkPlaces,
+        produceProofs: this._counterexampleReplay,
+        conditionalSinks: this._conditionalSinks,
+        stateEquation: this._stateEquation
+      });
+      if (this._stateEquation) {
+        report.push(`  State equation: encoded over ${encoding.counterCount} firing counters (VER-016)`);
+      }
+    }
+    if (this._stateEquation && colouredPlan != null) {
+      report.push("  State equation: not applied (name-coloured encoding)");
     }
     const queryResult = await runZ3Spacer(
       solver,
@@ -4028,7 +4822,9 @@ var SmtVerifier = class _SmtVerifier {
             invariants,
             this._sinkPlaces,
             solver,
-            this._timeoutMs
+            this._timeoutMs,
+            this._conditionalSinks,
+            this._stateEquation
           );
           const reason = certificateDowngradeReason(certificate);
           if (reason != null) {
@@ -4072,7 +4868,7 @@ var SmtVerifier = class _SmtVerifier {
       }
       case "violated": {
         report.push("  Status: SAT (counterexample found)\n");
-        const decoded = decode(queryResult.answer, flatNet);
+        const decoded = decode(queryResult.answer, flatNet, encoding.counterCount);
         if (decoded.note != null) report.push(`  Counterexample decoding: ${decoded.note}`);
         let confirmed = null;
         let trace = [...decoded.states];
@@ -4084,7 +4880,8 @@ var SmtVerifier = class _SmtVerifier {
             this._initialMarking,
             decoded.states,
             this._property,
-            this._sinkPlaces
+            this._sinkPlaces,
+            this._conditionalSinks
           );
           if (assessment.kind === "confirmed") {
             confirmed = true;
@@ -4157,6 +4954,49 @@ var SmtVerifier = class _SmtVerifier {
       }
     }
   }
+  /**
+   * Runs the linear state-equation bound query (VER-015) and re-checks its answer in
+   * exact integer arithmetic. Returns the bound as the report prints it when one
+   * separates the violation, `null` otherwise (no bound, solver inconclusive, or a
+   * model that failed the re-check — each named in the report). Never the last word:
+   * `null` hands over to the fixpoint query.
+   */
+  async linearBoundProof(flatNet, solver, report) {
+    const script2 = encodeLinearBound(flatNet, this._initialMarking, this._property);
+    if (script2 == null) return null;
+    let reply;
+    try {
+      reply = await runZ3Text(solver, script2, "bound", this._timeoutMs, []);
+    } catch (e) {
+      rethrowIfProgrammingError(e);
+      report.push(`  Linear state-equation bound: inconclusive (${String(e?.message ?? e)})`);
+      return null;
+    }
+    const stdout = reply.stdout.trim();
+    switch (classifyFirstLine(stdout)) {
+      case "sat": {
+        const y = decodeLinearBound(stdout, flatNet.places.length);
+        const bound = y == null ? null : checkLinearBoundExact(flatNet, this._initialMarking, this._property, y);
+        if (bound == null) {
+          report.push("  Linear state-equation bound: inconclusive (solver model failed the exact re-check)");
+          return null;
+        }
+        const rendered = `${formatLinearBound(flatNet, bound)}; violation needs ${formatLinearDemand(flatNet, this._property, bound)}`;
+        report.push(`  Linear state-equation bound: ${rendered}`);
+        report.push("  Status: bound excludes every violating marking (re-checked in exact integer arithmetic)");
+        return rendered;
+      }
+      case "unsat":
+        report.push("  Linear state-equation bound: none separates the violation");
+        return null;
+      case "unknown":
+        report.push("  Linear state-equation bound: inconclusive (Z3 answered unknown)");
+        return null;
+      default:
+        report.push(`  Linear state-equation bound: inconclusive (${failureReason(reply, timeoutBudget(this._timeoutMs))})`);
+        return null;
+    }
+  }
   /**
    * ν-net soundness guard (NU-040, NU-050). Applied only when the net contains
    * match (ν-join) transitions, and only to a proven/violated verdict (an
@@ -4206,11 +5046,12 @@ function isReachabilitySafety(property) {
     case "unreachable":
       return true;
     case "deadlock-free":
+    case "terminates-at-sink":
     case "joined-or-dead-lettered":
       return false;
   }
 }
-function assessCounterexample(flatNet, initialMarking, decodedStates, property, sinkPlaces) {
+function assessCounterexample(flatNet, initialMarking, decodedStates, property, sinkPlaces, conditionalSinks = []) {
   if (decodedStates.size === 0) {
     return {
       kind: "unconfirmed",
@@ -4224,9 +5065,12 @@ function assessCounterexample(flatNet, initialMarking, decodedStates, property,
       vectorize(initialMarking, flatNet),
       [...decodedStates].map((m) => vectorize(m, flatNet)),
       property,
-      sinkPlaces
+      sinkPlaces,
+      {},
+      conditionalSinks
     );
   } catch (e) {
+    rethrowIfProgrammingError(e);
     outcome = { kind: "exhausted", reason: `replay threw: ${e?.message ?? e}`, nodesExplored: 0 };
   }
   switch (outcome.kind) {
@@ -4277,11 +5121,47 @@ Downgraded to UNKNOWN: ${reason}
 function truncate(s, max) {
   return s.length <= max ? s : `${s.slice(0, max)}\u2026 (${s.length - max} chars truncated)`;
 }
+function unresolvedPropertyPlaceInNet(net, property) {
+  const declared = /* @__PURE__ */ new Set();
+  for (const p of net.places) declared.add(p.name);
+  for (const place of propertyPlaces(property)) {
+    if (!declared.has(place.name)) return place.name;
+  }
+  return null;
+}
+function commonerApplies(flatNet) {
+  for (const ft of flatNet.transitions) {
+    if (ft.readPlaces.length > 0 || ft.inhibitorPlaces.length > 0 || ft.resetPlaces.length > 0) return false;
+    if (ft.consumeAll.some(Boolean)) return false;
+    if (ft.preVector.some((w) => w > 1)) return false;
+  }
+  return true;
+}
+function propertyPlaces(property) {
+  switch (property.type) {
+    case "deadlock-free":
+      return [];
+    case "terminates-at-sink":
+      return [];
+    case "mutual-exclusion":
+      return [property.p1, property.p2];
+    case "place-bound":
+      return [property.place];
+    case "branch-place-bound":
+      return [property.place];
+    case "unreachable":
+      return [...property.places];
+    case "joined-or-dead-lettered":
+      return [property.pending];
+  }
+}
 function unresolvedPropertyPlace(flatNet, property) {
   const named = (() => {
     switch (property.type) {
       case "deadlock-free":
         return [];
+      case "terminates-at-sink":
+        return [];
       case "mutual-exclusion":
         return [property.p1, property.p2];
       case "place-bound":
@@ -4310,8 +5190,8 @@ function formatInvariant(inv, flatNet) {
   }
   return `${parts.length === 0 ? "0" : parts.join(" + ")} = ${inv.constant}`;
 }
-function buildResult(verdict, report, invariants, discoveredInvariants, trace, transitions, elapsedMs, statistics, counterexampleConfirmed = null) {
-  return { verdict, report, invariants, discoveredInvariants, counterexampleTrace: trace, counterexampleTransitions: transitions, counterexampleConfirmed, elapsedMs, statistics };
+function buildResult(verdict, report, invariants, discoveredInvariants, trace, transitions, elapsedMs, statistics, counterexampleConfirmed = null, route = "smt") {
+  return { verdict, route, report, invariants, discoveredInvariants, counterexampleTrace: trace, counterexampleTransitions: transitions, counterexampleConfirmed, elapsedMs, statistics };
 }
 
 // src/verification/smt-verification-result.ts
@@ -4347,15 +5227,20 @@ export {
   transformAsync,
   produce,
   withTimeout,
+  rethrowIfProgrammingError,
   MarkingState,
   MarkingStateBuilder,
   deadlockFree,
+  terminatesAtSink,
   mutualExclusion,
   placeBound,
   unreachable,
   branchPlaceBound,
   joinedOrDeadLettered,
   propertyDescription,
+  strandingExcuses,
+  strandsToken,
+  describeSinks,
   flatTransition,
   alwaysAvailable,
   bounded,
@@ -4385,13 +5270,24 @@ export {
   runZ3Text,
   runZ3Spacer,
   encode,
+  encodeNet,
   encodeStepRelationSmt2,
   checkCertificate,
   vcScript,
+  violationDemand,
+  encodeLinearBound,
+  decodeLinearBound,
+  checkLinearBoundExact,
+  formatLinearBound,
+  formatLinearDemand,
+  decideOverClasses,
   DBM,
   StateClass,
   requireOutputProducingActions,
   StateClassGraph,
+  isUntimed,
+  NOTE_ENUMERATED,
+  verifyViaStateClassGraph,
   decode,
   decodeStateSet,
   flatNetPlaceCount,
@@ -4403,4 +5299,4 @@ export {
   isProven,
   isViolated
 };
-//# sourceMappingURL=chunk-FD3S4TZM.js.map
+//# sourceMappingURL=chunk-EL4E6LVO.js.map