libpetri 4.1.0 → 5.1.0

package/dist/{event-store-B3ppVTpO.d.ts → event-store-CUyHiIH7.d.ts}

@@ -1,4 +1,4 @@
-import { T as Token } from './petri-net-p0ONpSAO.js';
+import { T as Token } from './petri-net-6G5r1Wwb.js';
 
 /**
  * Events emitted during Petri Net execution.

package/dist/export/index.d.ts

@@ -1,4 +1,4 @@
-import { P as PetriNet } from '../petri-net-p0ONpSAO.js';
+import { P as PetriNet } from '../petri-net-6G5r1Wwb.js';
 
 /**
  * Format-agnostic typed graph model.

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { P as PetriNet, S as SubnetDef, a as Place, T as Token, b as Transition, E as EnvironmentPlace, c as TransitionContext, O as Out } from './petri-net-p0ONpSAO.js';
-export { A as Arc, d as ArcInhibitor, e as ArcInput, f as ArcOutput, g as ArcRead, h as ArcReset, C as Channel, i as ComposeBindings, F as FusionSet, j as FusionSetBuilder, I as In, k as InAll, l as InAtLeast, m as InExactly, n as InOne, o as Instance, p as Interface, q as InterfaceBuilder, K as KeyFn, L as LogFn, M as MAX_DURATION_MS, r as MatchKey, s as MatchSpec, N as NameId, t as OutAnd, u as OutForwardInput, v as OutPlace, w as OutTimeout, x as OutXor, y as OutputEntry, z as PetriNetBuilder, B as Port, D as PortDirection, G as SubnetDefBuilder, H as SubnetInstance, J as Timing, Q as TimingDeadline, R as TimingDelayed, U as TimingExact, V as TimingImmediate, W as TimingWindow, X as TokenInput, Y as TokenOutput, Z as TransitionAction, _ as TransitionBuilder, $ as VerificationHarness, a0 as VerificationResult, a1 as all, a2 as allPlaces, a3 as and, a4 as andPlaces, a5 as arcPlace, a6 as atLeast, a7 as consumptionCount, a8 as deadline, a9 as delayed, aa as earliest, ab as enumerateBranches, ac as environmentPlace, ad as exact, ae as exactly, af as fork, ag as forwardInput, ah as hasDeadline, ai as immediate, aj as inhibitorArc, ak as inputArc, al as isPassthrough, am as isUnit, an as keyForPlace, ao as latest, ap as matchCorrelates, aq as matchKey, ar as matchSpec, as as nameId, at as one, au as outPlace, av as outputArc, aw as passthrough, ax as place, ay as produce, az as readArc, aA as requiredCount, aB as resetArc, aC as timeout, aD as timeoutPlace, aE as tokenAt, aF as tokenOf, aG as transform, aH as transformAsync, aI as transformFrom, aJ as unitToken, aK as window, aL as withTimeout, aM as xor, aN as xorPlaces } from './petri-net-p0ONpSAO.js';
-import { E as EventStore } from './event-store-B3ppVTpO.js';
-export { A as ActionTimedOut, a as ExecutionCompleted, b as ExecutionStarted, I as InMemoryEventStore, L as LogMessage, M as MarkingSnapshot, N as NetEvent, T as TokenAdded, c as TokenRemoved, d as TransitionClockRestarted, e as TransitionCompleted, f as TransitionEnabled, g as TransitionFailed, h as TransitionStarted, i as TransitionTimedOut, j as eventTransitionName, k as eventsOfType, l as failures, m as filterEvents, n as inMemoryEventStore, o as isFailureEvent, p as noopEventStore, t as transitionEvents } from './event-store-B3ppVTpO.js';
+import { P as PetriNet, S as SubnetDef, a as Place, T as Token, b as Transition, E as EnvironmentPlace, c as TransitionContext, O as Out } from './petri-net-6G5r1Wwb.js';
+export { A as Arc, d as ArcInhibitor, e as ArcInput, f as ArcOutput, g as ArcRead, h as ArcReset, C as Channel, i as ComposeBindings, F as FusionSet, j as FusionSetBuilder, I as In, k as InAll, l as InAtLeast, m as InExactly, n as InOne, o as Instance, p as Interface, q as InterfaceBuilder, K as KeyFn, L as LogFn, M as MAX_DURATION_MS, r as MatchKey, s as MatchSpec, N as NameId, t as OutAnd, u as OutForwardInput, v as OutPlace, w as OutTimeout, x as OutXor, y as OutputEntry, z as PetriNetBuilder, B as Port, D as PortDirection, G as SubnetDefBuilder, H as SubnetInstance, J as Timing, Q as TimingDeadline, R as TimingDelayed, U as TimingExact, V as TimingImmediate, W as TimingWindow, X as TokenInput, Y as TokenOutput, Z as TransitionAction, _ as TransitionBuilder, $ as VerificationHarness, a0 as VerificationResult, a1 as all, a2 as allPlaces, a3 as and, a4 as andPlaces, a5 as arcPlace, a6 as atLeast, a7 as consumptionCount, a8 as deadline, a9 as delayed, aa as earliest, ab as enumerateBranches, ac as environmentPlace, ad as exact, ae as exactly, af as fork, ag as forwardInput, ah as hasDeadline, ai as immediate, aj as inhibitorArc, ak as inputArc, al as isPassthrough, am as isUnit, an as keyForPlace, ao as latest, ap as matchCorrelates, aq as matchKey, ar as matchSpec, as as nameId, at as one, au as outPlace, av as outputArc, aw as passthrough, ax as place, ay as produce, az as readArc, aA as requiredCount, aB as resetArc, aC as timeout, aD as timeoutPlace, aE as tokenAt, aF as tokenOf, aG as transform, aH as transformAsync, aI as transformFrom, aJ as unitToken, aK as window, aL as withTimeout, aM as xor, aN as xorPlaces } from './petri-net-6G5r1Wwb.js';
+import { E as EventStore } from './event-store-CUyHiIH7.js';
+export { A as ActionTimedOut, a as ExecutionCompleted, b as ExecutionStarted, I as InMemoryEventStore, L as LogMessage, M as MarkingSnapshot, N as NetEvent, T as TokenAdded, c as TokenRemoved, d as TransitionClockRestarted, e as TransitionCompleted, f as TransitionEnabled, g as TransitionFailed, h as TransitionStarted, i as TransitionTimedOut, j as eventTransitionName, k as eventsOfType, l as failures, m as filterEvents, n as inMemoryEventStore, o as isFailureEvent, p as noopEventStore, t as transitionEvents } from './event-store-CUyHiIH7.js';
 
 /**
  * Discriminated sum-type abstraction over Petri nets, distinguishing **closed**
@@ -192,12 +192,30 @@ declare function containsAll(snapshot: Uint32Array, mask: Uint32Array): boolean;
 /** Checks if any bit in mask is set in snapshot. */
 declare function intersects(snapshot: Uint32Array, mask: Uint32Array): boolean;
 
+/**
+ * What to do with the orchestrator loop when `run(timeoutMs)` hits its timeout.
+ *
+ * Mirrors Java's `PetriNetExecutor.RunTimeoutPolicy`.
+ *
+ * - `'abandon'` — reject the returned promise and leave the loop running. The net
+ *   keeps firing transitions and mutating its marking after the caller has given up.
+ *   This is what `run(timeoutMs)` has always done, and it stays the default only for
+ *   compatibility — it is rarely what you want.
+ * - `'close'` — reject the returned promise and `close()` the executor. Queued external
+ *   events are discarded and in-flight actions are allowed to complete, per [ENV-013].
+ */
+type RunTimeoutPolicy = 'abandon' | 'close';
 /**
  * Interface for Petri net executors.
  */
 interface PetriNetExecutor {
-    /** Run the net until quiescence or timeout. */
-    run(timeoutMs?: number): Promise<Marking>;
+    /**
+     * Run the net until quiescence or timeout.
+     *
+     * @param timeoutMs reject after this many milliseconds; omit to run to quiescence
+     * @param onTimeout what happens to the loop when the timeout fires (default `'abandon'`)
+     */
+    run(timeoutMs?: number, onTimeout?: RunTimeoutPolicy): Promise<Marking>;
     /** Inject an external token. Returns true if accepted. */
     inject<T>(place: EnvironmentPlace<T>, token: Token<T>): Promise<boolean>;
     /** Graceful shutdown: reject new inject() calls, process queued events, terminate at quiescence. */
@@ -313,6 +331,8 @@ declare class BitmapNetExecutor implements PetriNetExecutor {
      * Place identity is name-based — so a hot loop warns once, not per token.
      */
     private readonly warnedUnknownPlaces;
+    /** Transitions already warned for writing several tokens to a place their spec names once (IO-016 AC4). */
+    private readonly warnedMultiplicity;
     private readonly transitionInputPlaceNames;
     private running;
     private draining;
@@ -327,7 +347,7 @@ declare class BitmapNetExecutor implements PetriNetExecutor {
     private initMatchCaches;
     /** Mirror a token added to correlated input `pid` into every fast-path matcher. */
     private cacheAddToken;
-    run(timeoutMs?: number): Promise<Marking>;
+    run(timeoutMs?: number, onTimeout?: RunTimeoutPolicy): Promise<Marking>;
     private executeLoop;
     inject<T>(envPlace: EnvironmentPlace<T>, token: Token<T>): Promise<boolean>;
     /** Convenience: inject a raw value (creates token with current timestamp). */
@@ -418,6 +438,13 @@ declare class BitmapNetExecutor implements PetriNetExecutor {
      * initial-marking and injection seams. Retention never depends on this.
      */
     private warnUnknownPlace;
+    /**
+     * Reports, once per transition, a firing that wrote more than one token to a place
+     * its output spec names once (IO-016 AC4), as the EVT-013 log-message event. The
+     * tokens are deposited regardless: the diagnostic makes the under-approximation
+     * every branch-enumerating analysis makes of this transition visible.
+     */
+    private warnMultiplicity;
     private emitEvent;
 }
 
@@ -580,6 +607,8 @@ declare class PrecompiledNetExecutor implements PetriNetExecutor {
      * materializing a Marking has one to hand.
      */
     private readonly unknownPlaceTokens;
+    /** Transitions already warned for writing several tokens to a place their spec names once (IO-016 AC4). */
+    private readonly warnedMultiplicity;
     /** Monotonic source for ν-name minting (ctx.freshName(), NU-010). */
     private freshNameCounter;
     /**
@@ -646,7 +675,7 @@ declare class PrecompiledNetExecutor implements PetriNetExecutor {
     private markDirty;
     private setMarkingBit;
     private clearMarkingBit;
-    run(timeoutMs?: number): Promise<Marking>;
+    run(timeoutMs?: number, onTimeout?: RunTimeoutPolicy): Promise<Marking>;
     private executeLoop;
     inject<T>(envPlace: EnvironmentPlace<T>, token: Token<T>): Promise<boolean>;
     injectValue<T>(envPlace: EnvironmentPlace<T>, value: T): Promise<boolean>;
@@ -727,6 +756,14 @@ declare class PrecompiledNetExecutor implements PetriNetExecutor {
     executionId(): string;
     drain(): void;
     close(): void;
+    /**
+     * Reports, once per transition, a firing that wrote more than one token to a place
+     * its output spec names once (IO-016 AC4), as the EVT-013 log-message event. The
+     * tokens are deposited regardless: the diagnostic makes the under-approximation
+     * every branch-enumerating analysis makes of this transition visible. Mirrors the
+     * bitmap executor word for word.
+     */
+    private warnMultiplicity;
     private emitEvent;
 }
 
@@ -756,12 +793,27 @@ declare class OutViolationError extends Error {
  */
 
 /**
- * Recursively validates that a transition's output satisfies its declared Out spec.
+ * [IO-015] output validation as an **exact-explanation search**.
+ *
+ * An *assignment* picks exactly one child at each `xor` it reaches; subtrees under
+ * an unselected child are never evaluated. Each assignment claims a set of places,
+ * and validation succeeds iff **exactly one** assignment's claim *equals* the
+ * produced set.
+ *
+ * Returns that claim on success and throws `OutViolationError` otherwise — whether
+ * nothing explains the write or two or more branches do.
+ *
+ * Equality — rather than "every obligation was satisfied" — is what makes a token
+ * written to a declared place outside the selected branch a violation instead of a
+ * silent deposit. It also removes the need for a subsumption tie-break:
+ * `xor(and(A,B,C), and(A,B))` with A, B, C produced has exactly one *exact* claim.
  *
- * @returns the set of claimed place names, or null if not satisfied
- * @throws OutViolationError if a structural violation is detected (e.g. XOR with 0 or 2+ branches)
+ * Being a search rather than an eager walk is what makes `and` genuinely unordered
+ * ([IO-015] AC8): the old version short-circuited on its first unsatisfied child and
+ * let an inner `xor` throw before an enclosing one could try a sibling, so the same
+ * write set could pass or fail depending on declaration order.
  */
-declare function validateOutSpec(tName: string, spec: Out, producedPlaceNames: Set<string>): Set<string> | null;
+declare function validateOutSpec(tName: string, spec: Out, producedPlaceNames: Set<string>): Set<string>;
 /**
  * Produces default tokens to the timeout branch's output places when an action
  * exceeds its timeout. Walks the Out spec tree recursively:
@@ -780,4 +832,4 @@ declare function validateOutSpec(tName: string, spec: Out, producedPlaceNames: S
  */
 declare function produceTimeoutOutput(context: TransitionContext, timeoutChild: Out): void;
 
-export { BitmapNetExecutor, type BitmapNetExecutorOptions, type CardinalityCheck, CompiledNet, EnvironmentPlace, EventStore, Marking, Out, OutViolationError, PetriNet, type PetriNetExecutor, Place, PrecompiledNet, PrecompiledNetExecutor, type PrecompiledNetExecutorOptions, type PredicateSpec, type Subnet, SubnetDef, Token, Transition, TransitionContext, clearBit, closedSubnet, containsAll, intersects, openSubnet, produceTimeoutOutput, setBit, testBit, validateOutSpec };
+export { BitmapNetExecutor, type BitmapNetExecutorOptions, type CardinalityCheck, CompiledNet, EnvironmentPlace, EventStore, Marking, Out, OutViolationError, PetriNet, type PetriNetExecutor, Place, PrecompiledNet, PrecompiledNetExecutor, type PrecompiledNetExecutorOptions, type PredicateSpec, type RunTimeoutPolicy, type Subnet, SubnetDef, Token, Transition, TransitionContext, clearBit, closedSubnet, containsAll, intersects, openSubnet, produceTimeoutOutput, setBit, testBit, validateOutSpec };

package/dist/index.js

@@ -28,7 +28,7 @@ import {
   withTimeout,
   xor,
   xorPlaces
-} from "./chunk-FD3S4TZM.js";
+} from "./chunk-EL4E6LVO.js";
 import {
   eventTransitionName,
   isFailureEvent
@@ -3072,51 +3072,104 @@ function swallowEventStoreFailure(when, err) {
 }
 var DEADLINE_TOLERANCE_MS = 5;
 function validateOutSpec(tName, spec, producedPlaceNames) {
+  const named = specNames(spec);
+  let relevant = 0;
+  for (const name of producedPlaceNames) {
+    if (named.has(name)) relevant++;
+  }
+  const exact2 = [];
+  for (const claim of claimsWithin(spec, producedPlaceNames)) {
+    if (claim.size === relevant) {
+      exact2.push(claim);
+      if (exact2.length > 1) break;
+    }
+  }
+  const wrote = [...producedPlaceNames].filter((n) => named.has(n)).sort();
+  if (exact2.length === 0) {
+    throw new OutViolationError(
+      `'${tName}': output does not match the declared spec - produced {${wrote.join(", ")}}, which no single branch of the spec claims exactly`
+    );
+  }
+  if (exact2.length > 1) {
+    throw new OutViolationError(
+      `'${tName}': ambiguous output - {${wrote.join(", ")}} is claimed by more than one branch`
+    );
+  }
+  return exact2[0];
+}
+function capMultiplicity(claims) {
+  if (claims.length < 3) return claims;
+  const seen = /* @__PURE__ */ new Map();
+  const out = [];
+  for (const claim of claims) {
+    const key = [...claim].sort().join("\0");
+    const n = seen.get(key) ?? 0;
+    if (n >= 2) continue;
+    seen.set(key, n + 1);
+    out.push(claim);
+  }
+  return out;
+}
+var specNamesCache = /* @__PURE__ */ new WeakMap();
+function specNames(spec) {
+  const hit = specNamesCache.get(spec);
+  if (hit !== void 0) return hit;
+  const names = /* @__PURE__ */ new Set();
+  const walk = (node) => {
+    switch (node.type) {
+      case "place":
+        names.add(node.place.name);
+        break;
+      case "forward-input":
+        names.add(node.to.name);
+        break;
+      case "timeout":
+        walk(node.child);
+        break;
+      case "xor":
+      case "and":
+        for (const c of node.children) walk(c);
+        break;
+    }
+  };
+  walk(spec);
+  specNamesCache.set(spec, names);
+  return names;
+}
+function claimsWithin(spec, produced) {
   switch (spec.type) {
     case "place":
-      return producedPlaceNames.has(spec.place.name) ? /* @__PURE__ */ new Set([spec.place.name]) : null;
+      return produced.has(spec.place.name) ? [/* @__PURE__ */ new Set([spec.place.name])] : [];
     case "forward-input":
-      return producedPlaceNames.has(spec.to.name) ? /* @__PURE__ */ new Set([spec.to.name]) : null;
-    case "and": {
-      const claimed = /* @__PURE__ */ new Set();
+      return produced.has(spec.to.name) ? [/* @__PURE__ */ new Set([spec.to.name])] : [];
+    case "timeout":
+      return claimsWithin(spec.child, produced);
+    case "xor": {
+      const out = [];
       for (const child of spec.children) {
-        const result = validateOutSpec(tName, child, producedPlaceNames);
-        if (result === null) return null;
-        for (const p of result) claimed.add(p);
+        for (const claim of claimsWithin(child, produced)) out.push(claim);
       }
-      return claimed;
+      return capMultiplicity(out);
     }
-    case "xor": {
-      const satisfied = [];
+    case "and": {
+      let acc = [/* @__PURE__ */ new Set()];
       for (const child of spec.children) {
-        const result = validateOutSpec(tName, child, producedPlaceNames);
-        if (result !== null) satisfied.push(result);
-      }
-      if (satisfied.length === 0) {
-        throw new OutViolationError(
-          `'${tName}': XOR violation - no branch produced (exactly 1 required)`
-        );
-      }
-      if (satisfied.length > 1) {
-        return resolveXorAmbiguity(tName, satisfied);
+        const childClaims = claimsWithin(child, produced);
+        if (childClaims.length === 0) return [];
+        const next = [];
+        for (const partial of acc) {
+          for (const claim of childClaims) {
+            const merged = new Set(partial);
+            for (const name of claim) merged.add(name);
+            next.push(merged);
+          }
+        }
+        acc = capMultiplicity(next);
       }
-      return satisfied[0];
+      return acc;
     }
-    case "timeout":
-      return validateOutSpec(tName, spec.child, producedPlaceNames);
   }
 }
-function resolveXorAmbiguity(tName, satisfied) {
-  const subsuming = satisfied.filter(
-    (candidate) => satisfied.every(
-      (other) => other === candidate || [...other].every((p) => candidate.has(p))
-    )
-  );
-  if (subsuming.length === 1) return subsuming[0];
-  throw new OutViolationError(
-    `'${tName}': XOR violation - multiple branches produced`
-  );
-}
 function produceTimeoutOutput(context, timeoutChild) {
   switch (timeoutChild.type) {
     case "place":
@@ -3200,6 +3253,8 @@ var BitmapNetExecutor = class {
    * Place identity is name-based — so a hot loop warns once, not per token.
    */
   warnedUnknownPlaces = /* @__PURE__ */ new Set();
+  /** Transitions already warned for writing several tokens to a place their spec names once (IO-016 AC4). */
+  warnedMultiplicity = /* @__PURE__ */ new Set();
   transitionInputPlaceNames;
   running = false;
   draining = false;
@@ -3342,19 +3397,27 @@ var BitmapNetExecutor = class {
     }
   }
   // ======================== Execution ========================
-  async run(timeoutMs) {
-    if (timeoutMs !== void 0) {
-      let timer;
-      const timeoutPromise = new Promise((_, reject) => {
-        timer = setTimeout(() => reject(new Error("Execution timed out")), timeoutMs);
-      });
-      try {
-        return await Promise.race([this.executeLoop(), timeoutPromise]);
-      } finally {
-        if (timer !== void 0) clearTimeout(timer);
+  async run(timeoutMs, onTimeout = "abandon") {
+    if (timeoutMs === void 0) return this.executeLoop();
+    let timer;
+    let timedOut = false;
+    const timeoutPromise = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        timedOut = true;
+        reject(new Error("Execution timed out"));
+      }, timeoutMs);
+    });
+    const loop = this.executeLoop();
+    try {
+      return await Promise.race([loop, timeoutPromise]);
+    } finally {
+      if (timer !== void 0) clearTimeout(timer);
+      if (timedOut) {
+        if (onTimeout === "close") this.close();
+        loop.catch(() => {
+        });
       }
     }
-    return this.executeLoop();
   }
   async executeLoop() {
     this.running = true;
@@ -3853,12 +3916,8 @@ var BitmapNetExecutor = class {
         const outputs = flight.context.rawOutput();
         if (t.outputSpec !== null) {
           const produced2 = outputs.placesWithTokens();
-          const result = validateOutSpec(t.name, t.outputSpec, produced2);
-          if (result === null) {
-            throw new OutViolationError(
-              `'${t.name}': output does not satisfy declared spec`
-            );
-          }
+          const claim = validateOutSpec(t.name, t.outputSpec, produced2);
+          if (outputs.entries().length > produced2.size) this.warnMultiplicity(t.name, outputs, claim);
         }
         const produced = [];
         for (const entry of outputs.entries()) {
@@ -4069,6 +4128,33 @@ var BitmapNetExecutor = class {
       errorMessage: null
     });
   }
+  /**
+   * Reports, once per transition, a firing that wrote more than one token to a place
+   * its output spec names once (IO-016 AC4), as the EVT-013 log-message event. The
+   * tokens are deposited regardless: the diagnostic makes the under-approximation
+   * every branch-enumerating analysis makes of this transition visible.
+   */
+  warnMultiplicity(transitionName, outputs, claim) {
+    if (this.warnedMultiplicity.has(transitionName)) return;
+    const counts = /* @__PURE__ */ new Map();
+    for (const entry of outputs.entries()) {
+      if (claim.has(entry.place.name)) counts.set(entry.place.name, (counts.get(entry.place.name) ?? 0) + 1);
+    }
+    const repeated = [];
+    for (const [name, n] of counts) if (n > 1) repeated.push(`${name}: ${n}`);
+    if (repeated.length === 0) return;
+    this.warnedMultiplicity.add(transitionName);
+    this.emitEvent({
+      type: "log-message",
+      timestamp: Date.now(),
+      transitionName,
+      logger: "libpetri.runtime",
+      level: "WARN",
+      message: `'${transitionName}': wrote more than one token to a place its output spec names once (${repeated.join(", ")}); branch-enumerating analyses model one token per named place, so this firing exceeds what they explore (IO-016)`,
+      error: null,
+      errorMessage: null
+    });
+  }
   emitEvent(event) {
     if (this.eventStoreEnabled) {
       try {
@@ -4342,13 +4428,13 @@ var PrecompiledNet = class _PrecompiledNet {
     if (needsIdx === SPARSE_EMPTY) {
     } else if (needsIdx >= 0) {
       const m = this.needsSingleWordMask[tid];
-      if ((snapshot[needsIdx] & m) !== m) return false;
+      if ((snapshot[needsIdx] & m) >>> 0 !== m) return false;
     } else {
       const indices = this.needsSparseIndices[tid];
       const masks = this.needsSparseMasks[tid];
       for (let i = 0; i < indices.length; i++) {
         const m = masks[i];
-        if ((snapshot[indices[i]] & m) !== m) return false;
+        if ((snapshot[indices[i]] & m) >>> 0 !== m) return false;
       }
     }
     const inhIdx = this.inhibitorSingleWordIndex[tid];
@@ -4462,6 +4548,8 @@ var PrecompiledNetExecutor = class {
    * materializing a Marking has one to hand.
    */
   unknownPlaceTokens = /* @__PURE__ */ new Map();
+  /** Transitions already warned for writing several tokens to a place their spec names once (IO-016 AC4). */
+  warnedMultiplicity = /* @__PURE__ */ new Set();
   /** Monotonic source for ν-name minting (ctx.freshName(), NU-010). */
   freshNameCounter = 0;
   /**
@@ -4676,19 +4764,27 @@ var PrecompiledNetExecutor = class {
     this.markingBitmap[pid >>> WORD_SHIFT] &= ~(1 << (pid & BIT_MASK));
   }
   // ======================== Execution ========================
-  async run(timeoutMs) {
-    if (timeoutMs !== void 0) {
-      let timer;
-      const timeoutPromise = new Promise((_, reject) => {
-        timer = setTimeout(() => reject(new Error("Execution timed out")), timeoutMs);
-      });
-      try {
-        return await Promise.race([this.executeLoop(), timeoutPromise]);
-      } finally {
-        if (timer !== void 0) clearTimeout(timer);
+  async run(timeoutMs, onTimeout = "abandon") {
+    if (timeoutMs === void 0) return this.executeLoop();
+    let timer;
+    let timedOut = false;
+    const timeoutPromise = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        timedOut = true;
+        reject(new Error("Execution timed out"));
+      }, timeoutMs);
+    });
+    const loop = this.executeLoop();
+    try {
+      return await Promise.race([loop, timeoutPromise]);
+    } finally {
+      if (timer !== void 0) clearTimeout(timer);
+      if (timedOut) {
+        if (onTimeout === "close") this.close();
+        loop.catch(() => {
+        });
       }
     }
-    return this.executeLoop();
   }
   async executeLoop() {
     this.running = true;
@@ -5330,19 +5426,17 @@ var PrecompiledNetExecutor = class {
           const simplePid = prog.simpleOutputPlaceId[tid];
           if (simplePid >= 0) {
             const produced2 = outputs.placesWithTokens();
-            if (!produced2.has(prog.places[simplePid].name)) {
+            const named = prog.places[simplePid].name;
+            if (!produced2.has(named)) {
               throw new OutViolationError(
-                `'${t.name}': output does not satisfy declared spec`
+                `'${t.name}': output does not match the declared spec - produced {}, which no single branch of the spec claims exactly`
               );
             }
+            if (outputs.entries().length > produced2.size) this.warnMultiplicity(t.name, outputs, /* @__PURE__ */ new Set([named]));
           } else if (simplePid === -1) {
             const produced2 = outputs.placesWithTokens();
-            const result = validateOutSpec(t.name, t.outputSpec, produced2);
-            if (result === null) {
-              throw new OutViolationError(
-                `'${t.name}': output does not satisfy declared spec`
-              );
-            }
+            const claim = validateOutSpec(t.name, t.outputSpec, produced2);
+            if (outputs.entries().length > produced2.size) this.warnMultiplicity(t.name, outputs, claim);
           }
         }
         const produced = [];
@@ -5562,6 +5656,34 @@ var PrecompiledNetExecutor = class {
     this.wakeUp();
   }
   // ======================== Event Emission ========================
+  /**
+   * Reports, once per transition, a firing that wrote more than one token to a place
+   * its output spec names once (IO-016 AC4), as the EVT-013 log-message event. The
+   * tokens are deposited regardless: the diagnostic makes the under-approximation
+   * every branch-enumerating analysis makes of this transition visible. Mirrors the
+   * bitmap executor word for word.
+   */
+  warnMultiplicity(transitionName, outputs, claim) {
+    if (this.warnedMultiplicity.has(transitionName)) return;
+    const counts = /* @__PURE__ */ new Map();
+    for (const entry of outputs.entries()) {
+      if (claim.has(entry.place.name)) counts.set(entry.place.name, (counts.get(entry.place.name) ?? 0) + 1);
+    }
+    const repeated = [];
+    for (const [name, n] of counts) if (n > 1) repeated.push(`${name}: ${n}`);
+    if (repeated.length === 0) return;
+    this.warnedMultiplicity.add(transitionName);
+    this.emitEvent({
+      type: "log-message",
+      timestamp: Date.now(),
+      transitionName,
+      logger: "libpetri.runtime",
+      level: "WARN",
+      message: `'${transitionName}': wrote more than one token to a place its output spec names once (${repeated.join(", ")}); branch-enumerating analyses model one token per named place, so this firing exceeds what they explore (IO-016)`,
+      error: null,
+      errorMessage: null
+    });
+  }
   emitEvent(event) {
     if (this.eventStoreEnabled) {
       try {