libpetri 5.0.0 → 6.0.0

package/dist/index.js

@@ -1,22 +1,32 @@
 import {
-  SmtVerifier,
+  ComposeBindings,
+  FusionSet,
+  FusionSetBuilder,
+  Instance,
+  Interface,
+  InterfaceBuilder,
+  PetriNet,
+  PetriNetBuilder,
+  SubnetDef,
+  SubnetDefBuilder,
+  Transition,
+  TransitionBuilder,
   all,
   allPlaces,
-  alwaysAvailable,
   and,
   andPlaces,
   atLeast,
   consumptionCount,
   enumerateBranches,
+  environmentPlace,
   exactly,
   fork,
   forwardInput,
   isPassthrough,
-  isProven,
-  isViolated,
   one,
   outPlace,
   passthrough,
+  place,
   produce,
   requireOutputProducingActions,
   requiredCount,
@@ -28,11 +38,11 @@ import {
   withTimeout,
   xor,
   xorPlaces
-} from "./chunk-75KEJQGC.js";
+} from "./chunk-MQZ6IM63.js";
 import {
   eventTransitionName,
   isFailureEvent
-} from "./chunk-SXK2Z45Z.js";
+} from "./chunk-H2KAMPGN.js";
 import {
   keyForPlace,
   matchCorrelates,
@@ -69,14 +79,6 @@ function isUnit(token) {
   return token === UNIT_TOKEN;
 }
 
-// src/core/place.ts
-function place(name) {
-  return { name };
-}
-function environmentPlace(name) {
-  return { place: place(name) };
-}
-
 // src/core/arc.ts
 function inputArc(place2) {
   return { type: "input", place: place2 };
@@ -235,2146 +237,211 @@ var TransitionContext = class {
     this.requireInput(actual);
     return this.rawInput.get(actual);
   }
-  /** Returns declared input places (consumed). */
-  inputPlaces() {
-    return this._inputPlaces;
-  }
-  requireInput(place2) {
-    if (!this.allowedInputs.has(place2.name)) {
-      throw new Error(
-        `Place '${place2.name}' not in declared inputs: [${[...this.allowedInputs].join(", ")}]`
-      );
-    }
-  }
-  // ==================== Read Access (not consumed) ====================
-  /** Get read-only context value. Throws if place not declared as read. */
-  read(place2) {
-    const actual = this.resolve(place2);
-    this.requireRead(actual);
-    return this.rawInput.value(actual);
-  }
-  /** Get all read-only context values for a place. */
-  reads(place2) {
-    const actual = this.resolve(place2);
-    this.requireRead(actual);
-    return this.rawInput.values(actual);
-  }
-  /** Returns declared read places (context, not consumed). */
-  readPlaces() {
-    return this._readPlaces;
-  }
-  requireRead(place2) {
-    if (!this.allowedReads.has(place2.name)) {
-      throw new Error(
-        `Place '${place2.name}' not in declared reads: [${[...this.allowedReads].join(", ")}]`
-      );
-    }
-  }
-  // ==================== Output Access ====================
-  /**
-   * Add one or more output values to the same place in a single call.
-   *
-   * Validates the place once, then appends each value to the output
-   * collector. Calling with zero values is a no-op.
-   *
-   * @example
-   *   ctx.output(outPlace, 'a', 'b', 'c');
-   *   ctx.output(outPlace, ...someArray);
-   *
-   * @throws if place not declared as output.
-   */
-  output(place2, ...values) {
-    const actual = this.resolve(place2);
-    this.requireOutput(actual);
-    for (const value of values) {
-      this.writeTarget.add(actual, value);
-    }
-    return this;
-  }
-  /**
-   * Add one or more pre-built output tokens to the same place in a single call.
-   *
-   * Validates the place once, then appends each token. Calling with zero
-   * tokens is a no-op.
-   *
-   * @throws if place not declared as output.
-   */
-  outputToken(place2, ...tokens) {
-    const actual = this.resolve(place2);
-    this.requireOutput(actual);
-    for (const token of tokens) {
-      this.writeTarget.addToken(actual, token);
-    }
-    return this;
-  }
-  /** Returns declared output places. */
-  outputPlaces() {
-    return this._outputPlaces;
-  }
-  requireOutput(place2) {
-    if (!this.allowedOutputs.has(place2.name)) {
-      throw new Error(
-        `Place '${place2.name}' not in declared outputs: [${[...this.allowedOutputs].join(", ")}]`
-      );
-    }
-  }
-  /**
-   * Severs the action's output from the marking, for use when a firing times out.
-   *
-   * After this call the action's `output(...)` writes are dropped, and the executor
-   * harvests a fresh collector the action holds no reference to. Anything the action
-   * wrote *before* the timeout is discarded with it: a partial result merged with the
-   * timeout branch would violate the transition's own output spec.
-   *
-   * This is the only isolation available — libpetri does not own the promise the action
-   * runs on, so it cannot stop the work, only stop the result from landing.
-   *
-   * @internal Executor machinery — must be called by the executor, never by an action.
-   */
-  detachForTimeout() {
-    this.writeTarget.detach();
-    this._rawOutput = new TokenOutput();
-  }
-  /**
-   * Produces into the executor's harvest collector rather than the action's write target.
-   *
-   * Identical to {@link output} before {@link detachForTimeout}; after it, this is the
-   * only route that still reaches the marking. Used by the executor to deposit the
-   * timeout branch.
-   *
-   * @internal Executor machinery — must be called by the executor, never by an action.
-   */
-  outputToHarvest(place2, value) {
-    const actual = this.resolve(place2);
-    this.requireOutput(actual);
-    this._rawOutput.add(actual, value);
-    return this;
-  }
-  // ==================== ν-name minting (NU-010) ====================
-  /**
-   * @internal Installs the ν-name minter. Wired by the executor at firing time
-   * so names minted by {@link freshName} are monotonic across the run and
-   * instance-prefixed (spec NU-010, NU-030).
-   */
-  setFreshNameSupplier(supplier) {
-    this._freshNameSupplier = supplier;
-  }
-  /**
-   * Mints a fresh ν-name (the ν-binder primitive — spec NU-010).
-   *
-   * An action calls this on the fork side to create a correlation id, then
-   * writes it into the sibling output payloads; a later join correlates those
-   * siblings via a {@link import('./match-spec.js').MatchSpec}. Uses the
-   * executor-installed minter when present; otherwise falls back to a
-   * process-global counter prefixed by the transition name.
-   */
-  freshName() {
-    if (this._freshNameSupplier) return this._freshNameSupplier();
-    return nameId(`${this._transitionName}#${GLOBAL_FRESH_NAME_COUNTER++}`);
-  }
-  // ==================== Structure Info ====================
-  /** Returns the transition name. */
-  transitionName() {
-    return this._transitionName;
-  }
-  // ==================== Execution Context ====================
-  /** Retrieves an execution context object by key. */
-  executionContext(key) {
-    return this.executionCtx.get(key);
-  }
-  /** Checks if an execution context object of the given key is present. */
-  hasExecutionContext(key) {
-    return this.executionCtx.has(key);
-  }
-  // ==================== Logging ====================
-  /** Emits a structured log message into the event store. */
-  log(level, message, error) {
-    this._logFn?.(level, message, error);
-  }
-  // ==================== Internal ====================
-  /** @internal Used by BitmapNetExecutor to collect outputs after action completion. */
-  rawOutput() {
-    return this._rawOutput;
-  }
-};
-
-// src/core/token-input.ts
-var TokenInput = class {
-  tokens = /* @__PURE__ */ new Map();
-  /** Add a token (used by executor when firing transition). */
-  add(place2, token) {
-    const existing = this.tokens.get(place2.name);
-    if (existing) {
-      existing.push(token);
-    } else {
-      this.tokens.set(place2.name, [token]);
-    }
-    return this;
-  }
-  /** Get all tokens for a place. */
-  getAll(place2) {
-    return this.tokens.get(place2.name) ?? [];
-  }
-  /** Get the first token for a place. Throws if no tokens. */
-  get(place2) {
-    const list = this.tokens.get(place2.name);
-    if (!list || list.length === 0) {
-      throw new Error(`No token for place: ${place2.name}`);
-    }
-    return list[0];
-  }
-  /** Get the first token's value for a place. Throws if no tokens. */
-  value(place2) {
-    return this.get(place2).value;
-  }
-  /** Get all token values for a place. */
-  values(place2) {
-    return this.getAll(place2).map((t) => t.value);
-  }
-  /** Get token count for a place. */
-  count(place2) {
-    return this.getAll(place2).length;
-  }
-  /** Check if any tokens exist for a place. */
-  has(place2) {
-    return this.count(place2) > 0;
-  }
-};
-
-// src/core/transition.ts
-var TRANSITION_KEY = /* @__PURE__ */ Symbol("Transition.internal");
-var EMPTY_PLACE_ALIAS = /* @__PURE__ */ new Map();
-var Transition = class {
-  name;
-  inputSpecs;
-  outputSpec;
-  inhibitors;
-  reads;
-  resets;
-  timing;
-  actionTimeout;
-  action;
-  priority;
-  /**
-   * ν-net join correlation: a subset of `inputSpecs` that must be correlated by
-   * name equality on firing (spec NU-020). `null` for ordinary transitions.
-   */
-  matchSpec;
-  /**
-   * Per-transition **declared → actual** place correspondence (per
-   * **MOD-031**), keyed by the author-original declared place **name** →
-   * actual composed place. Empty for a hand-written or directly-composed
-   * ([MOD-025]) transition (identity). Populated by the subnet rewriter after
-   * instantiation ([MOD-010]) / port binding ([MOD-020]) so an action that
-   * hardcodes a declared place constant resolves to the composed place via
-   * {@link import('./transition-context.js').TransitionContext}. Consumed only
-   * by the action-facing context I/O — never by enablement, firing, the
-   * verifier, the exporter, or events (so [MOD-023] is unaffected).
-   */
-  placeAlias;
-  _inputPlaces;
-  _readPlaces;
-  _outputPlaces;
-  /** @internal Use {@link Transition.builder} to create instances. */
-  constructor(key, name, inputSpecs, outputSpec, inhibitors, reads, resets, timing, action, priority, placeAlias = EMPTY_PLACE_ALIAS, matchSpec2 = null) {
-    if (key !== TRANSITION_KEY) throw new Error("Use Transition.builder() to create instances");
-    this.name = name;
-    this.inputSpecs = inputSpecs;
-    this.outputSpec = outputSpec;
-    this.inhibitors = inhibitors;
-    this.reads = reads;
-    this.resets = resets;
-    this.timing = timing;
-    this.actionTimeout = findTimeout(outputSpec);
-    this.action = action;
-    this.priority = priority;
-    this.placeAlias = placeAlias.size === 0 ? EMPTY_PLACE_ALIAS : placeAlias;
-    this.matchSpec = matchSpec2;
-    const inputPlaces = /* @__PURE__ */ new Set();
-    for (const spec of inputSpecs) {
-      inputPlaces.add(spec.place);
-    }
-    this._inputPlaces = inputPlaces;
-    const readPlaces = /* @__PURE__ */ new Set();
-    for (const r of reads) {
-      readPlaces.add(r.place);
-    }
-    this._readPlaces = readPlaces;
-    const outputPlaces = /* @__PURE__ */ new Set();
-    if (outputSpec !== null) {
-      for (const p of allPlaces(outputSpec)) {
-        outputPlaces.add(p);
-      }
-    }
-    this._outputPlaces = outputPlaces;
-  }
-  /** Returns set of input places — consumed tokens. */
-  inputPlaces() {
-    return this._inputPlaces;
-  }
-  /** Returns set of read places — context tokens, not consumed. */
-  readPlaces() {
-    return this._readPlaces;
-  }
-  /** Returns set of output places — where tokens are produced. */
-  outputPlaces() {
-    return this._outputPlaces;
-  }
-  /** Returns true if this transition has an action timeout. */
-  hasActionTimeout() {
-    return this.actionTimeout !== null;
-  }
-  toString() {
-    return `Transition[${this.name}]`;
-  }
-  static builder(name) {
-    return new TransitionBuilder(name);
-  }
-};
-var TransitionBuilder = class {
-  _name;
-  _inputSpecs = [];
-  _outputSpec = null;
-  _inhibitors = [];
-  _reads = [];
-  _resets = [];
-  _timing = immediate();
-  _action = passthrough();
-  _priority = 0;
-  _placeAlias = EMPTY_PLACE_ALIAS;
-  _matchSpec = null;
-  constructor(name) {
-    this._name = name;
-  }
-  /** Add input specifications with cardinality. */
-  inputs(...specs) {
-    this._inputSpecs.push(...specs);
-    return this;
-  }
-  /** Set the output specification (composite AND/XOR structure). */
-  outputs(spec) {
-    this._outputSpec = spec;
-    return this;
-  }
-  /** Add inhibitor arc. */
-  inhibitor(place2) {
-    this._inhibitors.push({ type: "inhibitor", place: place2 });
-    return this;
-  }
-  /** Add inhibitor arcs. */
-  inhibitors(...places) {
-    for (const p of places) {
-      this._inhibitors.push({ type: "inhibitor", place: p });
-    }
-    return this;
-  }
-  /** Add read arc. */
-  read(place2) {
-    this._reads.push({ type: "read", place: place2 });
-    return this;
-  }
-  /** Add read arcs. */
-  reads(...places) {
-    for (const p of places) {
-      this._reads.push({ type: "read", place: p });
-    }
-    return this;
-  }
-  /** Add reset arc. */
-  reset(place2) {
-    this._resets.push({ type: "reset", place: place2 });
-    return this;
-  }
-  /** Add reset arcs. */
-  resets(...places) {
-    for (const p of places) {
-      this._resets.push({ type: "reset", place: p });
-    }
-    return this;
-  }
-  /** Set timing specification. */
-  timing(timing) {
-    this._timing = timing;
-    return this;
-  }
-  /** Set the transition action. */
-  action(action) {
-    this._action = action;
-    return this;
-  }
-  /** Set the priority (higher fires first). */
-  priority(priority) {
-    this._priority = priority;
-    return this;
-  }
-  /**
-   * Sets the ν-net join correlation spec: the named input places must be
-   * correlated by name equality on firing (spec NU-020). Every place referenced
-   * by the spec must also be declared as an input.
-   */
-  match(spec) {
-    this._matchSpec = spec;
-    return this;
-  }
-  /**
-   * Sets the per-transition declared→actual place correspondence (per
-   * **MOD-031**). Populated by the subnet rewriter during the compose-time
-   * rewrite; not normally called by hand-written nets, whose correspondence is
-   * the identity (empty map).
-   */
-  placeAlias(alias) {
-    this._placeAlias = alias;
-    return this;
-  }
-  build() {
-    if (this._outputSpec !== null) {
-      const inputPlaceNames = new Set(this._inputSpecs.map((s) => s.place.name));
-      for (const fi of findForwardInputs(this._outputSpec)) {
-        if (!inputPlaceNames.has(fi.from.name)) {
-          throw new Error(
-            `Transition '${this._name}': ForwardInput references non-input place '${fi.from.name}'`
-          );
-        }
-      }
-    }
-    if (this._matchSpec !== null) {
-      const inputPlaceNames = new Set(this._inputSpecs.map((s) => s.place.name));
-      for (const k of this._matchSpec.keys) {
-        if (!inputPlaceNames.has(k.place.name)) {
-          throw new Error(
-            `Transition '${this._name}': MatchSpec correlates non-input place '${k.place.name}'`
-          );
-        }
-      }
-    }
-    return new Transition(
-      TRANSITION_KEY,
-      this._name,
-      [...this._inputSpecs],
-      this._outputSpec,
-      [...this._inhibitors],
-      [...this._reads],
-      [...this._resets],
-      this._timing,
-      this._action,
-      this._priority,
-      this._placeAlias,
-      this._matchSpec
-    );
-  }
-};
-function findTimeout(out) {
-  if (out === null) return null;
-  switch (out.type) {
-    case "timeout":
-      return out;
-    case "and":
-    case "xor":
-      for (const child of out.children) {
-        const found = findTimeout(child);
-        if (found !== null) return found;
-      }
-      return null;
-    case "place":
-    case "forward-input":
-      return null;
-  }
-}
-function findForwardInputs(out) {
-  switch (out.type) {
-    case "forward-input":
-      return [{ from: out.from, to: out.to }];
-    case "and":
-    case "xor":
-      return out.children.flatMap(findForwardInputs);
-    case "timeout":
-      return findForwardInputs(out.child);
-    case "place":
-      return [];
-  }
-}
-
-// src/core/interface.ts
-var INTERFACE_KEY = /* @__PURE__ */ Symbol("Interface.internal");
-var Interface = class {
-  ports;
-  channels;
-  /** @internal Use {@link Interface.builder} to create instances. */
-  constructor(key, ports, channels) {
-    if (key !== INTERFACE_KEY) throw new Error("Use Interface.builder() to create instances");
-    this.ports = ports;
-    this.channels = channels;
-  }
-  /** Looks up a port by name. Returns undefined when absent. */
-  port(name) {
-    return this.ports.get(name);
-  }
-  /** Looks up a channel by name. Returns undefined when absent. */
-  channel(name) {
-    return this.channels.get(name);
-  }
-  /**
-   * Looks up a port by name and returns its underlying place, narrowed to
-   * `Place<T>`. Returns undefined when the port does not exist.
-   *
-   * Note: TypeScript erases generics at runtime, so unlike Java's
-   * `portPlaceAs(name, Class<T>)` this method cannot verify the token type at
-   * runtime — the caller is trusted to supply the correct `T`. Per **MOD-022**,
-   * type compatibility is enforced at compile time only in TypeScript.
-   */
-  placeAs(name) {
-    const p = this.ports.get(name);
-    if (p === void 0) return void 0;
-    return p.place;
-  }
-  static builder() {
-    return new InterfaceBuilder();
-  }
-};
-var InterfaceBuilder = class {
-  _ports = /* @__PURE__ */ new Map();
-  _channels = /* @__PURE__ */ new Map();
-  /** Add a pre-built port (rejects duplicate names). */
-  port(port) {
-    if (this._ports.has(port.name)) {
-      throw new Error(`Duplicate port name: '${port.name}'`);
-    }
-    this._ports.set(port.name, port);
-    return this;
-  }
-  /** Add an input port (advisory direction). */
-  inputPort(name, place2) {
-    return this.port({ name, direction: "input", place: place2 });
-  }
-  /** Add an output port (advisory direction). */
-  outputPort(name, place2) {
-    return this.port({ name, direction: "output", place: place2 });
-  }
-  /** Add an in-out port (advisory direction). */
-  inoutPort(name, place2) {
-    return this.port({ name, direction: "inout", place: place2 });
-  }
-  channel(channelOrName, transition) {
-    const ch = typeof channelOrName === "string" ? { name: channelOrName, transition } : channelOrName;
-    if (this._channels.has(ch.name)) {
-      throw new Error(`Duplicate channel name: '${ch.name}'`);
-    }
-    this._channels.set(ch.name, ch);
-    return this;
-  }
-  /** @internal Bulk-add ports already validated by the caller. */
-  portsAll(ports) {
-    for (const p of ports) this.port(p);
-    return this;
-  }
-  /** @internal Bulk-add channels already validated by the caller. */
-  channelsAll(channels) {
-    for (const c of channels) this.channel(c);
-    return this;
-  }
-  build() {
-    return new Interface(
-      INTERFACE_KEY,
-      new Map(this._ports),
-      new Map(this._channels)
-    );
-  }
-};
-
-// src/core/instance.ts
-var INSTANCE_KEY = /* @__PURE__ */ Symbol("Instance.internal");
-var Instance = class {
-  prefix;
-  def;
-  renamedBody;
-  portHandles;
-  channelHandles;
-  params;
-  /**
-   * @internal Use {@link SubnetDef.instantiate} (or the internal factory
-   * {@link __createInstance}) to create instances.
-   */
-  constructor(key, prefix, def, renamedBody, portHandles, channelHandles, params) {
-    if (key !== INSTANCE_KEY) {
-      throw new Error("Use SubnetDef.instantiate() to create Instance values");
-    }
-    this.prefix = prefix;
-    this.def = def;
-    this.renamedBody = renamedBody;
-    this.portHandles = portHandles;
-    this.channelHandles = channelHandles;
-    this.params = params;
-  }
-  /**
-   * Returns the renamed {@link Place} corresponding to the named port.
-   *
-   * The port name is the **original** (pre-prefix) name as declared in the
-   * subnet's `Interface`. Per **MOD-022**, TypeScript enforces token-type
-   * compatibility at compile time only; this method does not validate `T`
-   * at runtime. A missing name raises an `Error`.
-   *
-   * @throws when the port name is unknown
-   */
-  port(name) {
-    const p = this.portHandles.get(name);
-    if (p === void 0) {
-      throw new Error(`No port named '${name}' in instance '${this.prefix}'`);
-    }
-    return p;
-  }
-  /**
-   * Returns the renamed {@link Transition} corresponding to the named channel.
-   *
-   * @throws when the channel name is unknown
-   */
-  channel(name) {
-    const t = this.channelHandles.get(name);
-    if (t === void 0) {
-      throw new Error(`No channel named '${name}' in instance '${this.prefix}'`);
-    }
-    return t;
-  }
-  /**
-   * Returns the debug-UI descriptor for this instance per **MOD-041**.
-   */
-  descriptor() {
-    const transitions = [];
-    for (const t of this.renamedBody.transitions) transitions.push(t.name);
-    const exposedPlaces = [];
-    for (const p of this.portHandles.values()) exposedPlaces.push(p.name);
-    return {
-      prefix: this.prefix,
-      defName: this.def.name,
-      transitions,
-      exposedPlaces,
-      params: this.params,
-      parentPrefix: null
-    };
-  }
-  /**
-   * Produces a derived instance whose specified transitions (named by their
-   * **original**, pre-prefix names) carry the supplied actions per **MOD-030**.
-   *
-   * For each entry `[originalName, action]`, the renamed body is searched for
-   * the transition whose name equals `prefix + "/" + originalName`. The
-   * resulting instance shares the original `def`, `prefix`, `params`, and
-   * port/channel handle topology — only the renamed body is rebuilt with new
-   * actions. Per **MOD-030**, calling `bindActions` on one instance does NOT
-   * affect the actions held by other instances of the same `def`.
-   *
-   * Unrecognised original names raise an `Error` so typos surface eagerly.
-   */
-  bindActions(actionsByOriginalName) {
-    const prefixedByName = /* @__PURE__ */ new Map();
-    const renamedNames = /* @__PURE__ */ new Set();
-    for (const t of this.renamedBody.transitions) {
-      renamedNames.add(t.name);
-    }
-    for (const originalName of Object.keys(actionsByOriginalName)) {
-      const prefixed = this.prefix + "/" + originalName;
-      if (!renamedNames.has(prefixed)) {
-        throw new Error(
-          `Instance.bindActions: no transition '${originalName}' (resolved as '${prefixed}') in instance '${this.prefix}' of subnet '${this.def.name}'`
-        );
-      }
-      prefixedByName.set(prefixed, actionsByOriginalName[originalName]);
-    }
-    const reboundBody = this.renamedBody.bindActionsWithResolver((name) => {
-      const action = prefixedByName.get(name);
-      if (action !== void 0) return action;
-      for (const t of this.renamedBody.transitions) {
-        if (t.name === name) return t.action;
-      }
-      throw new Error(`Instance.bindActions: resolver invoked with unknown name '${name}'`);
-    });
-    const reboundChannelHandles = /* @__PURE__ */ new Map();
-    if (this.channelHandles.size > 0) {
-      const byName = /* @__PURE__ */ new Map();
-      for (const t of reboundBody.transitions) {
-        byName.set(t.name, t);
-      }
-      for (const [name, oldT] of this.channelHandles) {
-        const refreshed = byName.get(oldT.name);
-        if (refreshed === void 0) {
-          throw new Error(
-            `Instance.bindActions: channel '${name}' transition '${oldT.name}' not found in rebound body`
-          );
-        }
-        reboundChannelHandles.set(name, refreshed);
-      }
-    }
-    return __createInstance(
-      this.prefix,
-      this.def,
-      reboundBody,
-      this.portHandles,
-      reboundChannelHandles,
-      this.params
-    );
-  }
-};
-function __createInstance(prefix, def, renamedBody, portHandles, channelHandles, params) {
-  return new Instance(
-    INSTANCE_KEY,
-    prefix,
-    def,
-    renamedBody,
-    portHandles,
-    channelHandles,
-    params
-  );
-}
-
-// src/core/internal/subnet-rewriter.ts
-function renamePlace(orig, prefix) {
-  return place(prefix + "/" + orig.name);
-}
-function renameNet(body, prefix, placeRemap, transitionRemap) {
-  placeRemap.clear();
-  transitionRemap.clear();
-  for (const orig of body.places) {
-    placeRemap.set(orig.name, renamePlace(orig, prefix));
-  }
-  const builder = PetriNet.builder(prefix + "/" + body.name);
-  for (const renamedPlace of placeRemap.values()) {
-    builder.place(renamedPlace);
-  }
-  for (const t of body.transitions) {
-    const renamed = rewriteTransition(t, prefix, placeRemap);
-    transitionRemap.set(t.name, renamed);
-    builder.transition(renamed);
-  }
-  return builder.build();
-}
-function rewriteTransition(t, prefix, placeRemap) {
-  return rebuildWithName(t, prefix + "/" + t.name, placeRemap);
-}
-function substitutePlaces(t, remap) {
-  return rebuildWithName(t, t.name, remap);
-}
-function rebuildWithName(t, name, remap, normalizeInputs) {
-  const builder = Transition.builder(name).timing(t.timing).priority(t.priority).action(t.action);
-  const alias = buildPlaceAlias(t, remap);
-  if (alias.size > 0) {
-    builder.placeAlias(alias);
-  }
-  if (t.inputSpecs.length > 0) {
-    const rewrittenInputs = new Array(t.inputSpecs.length);
-    for (let i = 0; i < t.inputSpecs.length; i++) {
-      rewrittenInputs[i] = rewriteIn(t.inputSpecs[i], remap);
-    }
-    builder.inputs(...normalizeInputs !== void 0 ? normalizeInputs(rewrittenInputs) : rewrittenInputs);
-  }
-  if (t.outputSpec !== null) {
-    builder.outputs(rewriteOut(t.outputSpec, remap));
-  }
-  for (let i = 0; i < t.inhibitors.length; i++) {
-    builder.inhibitor(rewriteInhibitor(t.inhibitors[i], remap).place);
-  }
-  for (let i = 0; i < t.reads.length; i++) {
-    builder.read(rewriteRead(t.reads[i], remap).place);
-  }
-  for (let i = 0; i < t.resets.length; i++) {
-    builder.reset(rewriteReset(t.resets[i], remap).place);
-  }
-  if (t.matchSpec !== null) {
-    builder.match({
-      keys: t.matchSpec.keys.map((k) => ({
-        place: remap.get(k.place.name) ?? k.place,
-        key: k.key
-      }))
-    });
-  }
-  return builder.build();
-}
-function buildPlaceAlias(t, remap) {
-  const prev = t.placeAlias;
-  if (remap.size === 0 && prev.size === 0) {
-    return EMPTY_ALIAS2;
-  }
-  const alias = /* @__PURE__ */ new Map();
-  if (prev.size > 0) {
-    for (const [declaredName, prevActual] of prev) {
-      const replaced = remap.get(prevActual.name);
-      const finalActual = replaced !== void 0 ? replaced : prevActual;
-      if (finalActual.name !== declaredName) {
-        alias.set(declaredName, finalActual);
-      }
-    }
-    return alias;
-  }
-  const record = (p) => {
-    if (alias.has(p.name)) return;
-    const replaced = remap.get(p.name);
-    if (replaced !== void 0 && replaced.name !== p.name) {
-      alias.set(p.name, replaced);
-    }
-  };
-  for (const spec of t.inputSpecs) record(spec.place);
-  for (const rd of t.reads) record(rd.place);
-  for (const inh of t.inhibitors) record(inh.place);
-  for (const rs of t.resets) record(rs.place);
-  if (t.outputSpec !== null) {
-    for (const p of allPlaces(t.outputSpec)) record(p);
-  }
-  return alias;
-}
-var EMPTY_ALIAS2 = /* @__PURE__ */ new Map();
-function rewriteIn(spec, remap) {
-  switch (spec.type) {
-    case "one":
-      return one(resolve(spec.place, remap));
-    case "exactly":
-      return exactly(spec.count, resolve(spec.place, remap));
-    case "all":
-      return all(resolve(spec.place, remap));
-    case "at-least":
-      return atLeast(spec.minimum, resolve(spec.place, remap));
-  }
-}
-function rewriteOut(out, remap) {
-  switch (out.type) {
-    case "place":
-      return outPlace(resolve(out.place, remap));
-    case "forward-input":
-      return forwardInput(resolve(out.from, remap), resolve(out.to, remap));
-    case "and": {
-      const children = out.children;
-      const rewritten = new Array(children.length);
-      for (let i = 0; i < children.length; i++) {
-        rewritten[i] = rewriteOut(children[i], remap);
-      }
-      return { type: "and", children: rewritten };
-    }
-    case "xor": {
-      const children = out.children;
-      const rewritten = new Array(children.length);
-      for (let i = 0; i < children.length; i++) {
-        rewritten[i] = rewriteOut(children[i], remap);
-      }
-      return { type: "xor", children: rewritten };
-    }
-    case "timeout":
-      return timeout(out.afterMs, rewriteOut(out.child, remap));
-  }
-}
-function rewriteInhibitor(inh, remap) {
-  return { type: "inhibitor", place: resolve(inh.place, remap) };
-}
-function rewriteRead(rd, remap) {
-  return { type: "read", place: resolve(rd.place, remap) };
-}
-function rewriteReset(rs, remap) {
-  return { type: "reset", place: resolve(rs.place, remap) };
-}
-function resolve(p, remap) {
-  const replaced = remap.get(p.name);
-  return replaced !== void 0 ? replaced : p;
-}
-function mergeTransitions(caller, instance, mergedName) {
-  if (mergedName === void 0 || mergedName === null || mergedName.length === 0) {
-    throw new Error("mergeTransitions: mergedName must be a non-empty string");
-  }
-  const mergedTiming = mergeTimings(caller.timing, instance.timing, mergedName);
-  const mergedPriority = pickPriority(caller.priority, instance.priority);
-  const mergedAction = composeActions(caller.action, instance.action);
-  const mergedMatch = mergeMatchSpecs(caller.matchSpec, instance.matchSpec, mergedName);
-  const mergedAlias = mergePlaceAlias(caller.placeAlias, instance.placeAlias, mergedName);
-  const builder = Transition.builder(mergedName).timing(mergedTiming).priority(mergedPriority);
-  if (mergedAction !== void 0) {
-    builder.action(mergedAction);
-  }
-  rejectCrossSideKindConflicts(caller, instance, mergedName);
-  const unionedInputs = normalizeInputArcs(
-    [...caller.inputSpecs, ...instance.inputSpecs],
-    () => `Channel composition '${mergedName}'`
-  );
-  if (unionedInputs.length > 0) {
-    builder.inputs(...unionedInputs);
-  }
-  const mergedOutput = mergeOutputs(caller.outputSpec, instance.outputSpec);
-  if (mergedOutput !== null) {
-    builder.outputs(mergedOutput);
-  }
-  for (const inh of unionArcs(
-    caller.inhibitors,
-    instance.inhibitors,
-    keyOfInhibitor
-  )) {
-    builder.inhibitor(inh.place);
-  }
-  for (const rd of unionArcs(caller.reads, instance.reads, keyOfRead)) {
-    builder.read(rd.place);
-  }
-  for (const rs of unionArcs(caller.resets, instance.resets, keyOfReset)) {
-    builder.reset(rs.place);
-  }
-  if (mergedMatch !== null) {
-    builder.match(mergedMatch);
-  }
-  if (mergedAlias.size > 0) {
-    builder.placeAlias(mergedAlias);
-  }
-  return builder.build();
-}
-function mergeMatchSpecs(caller, instance, channelName) {
-  if (caller === null) return instance;
-  if (instance === null) return caller;
-  throw new Error(
-    `Channel composition '${channelName}': both the caller-side and instance-side transition carry a \u03BD-net match \u2014 refusing to fuse two independent correlations into one transition (NU-060). Resolve explicitly by keeping the match on a single side.`
-  );
-}
-function mergePlaceAlias(caller, instance, channelName) {
-  if (caller.size === 0) return instance;
-  if (instance.size === 0) return caller;
-  const merged = new Map(caller);
-  for (const [declared, actual] of instance) {
-    const existing = merged.get(declared);
-    if (existing !== void 0 && existing.name !== actual.name) {
-      throw new Error(
-        `Channel composition '${channelName}': conflicting declared\u2192actual place alias for declared place '${declared}' \u2014 caller-side maps to '${existing.name}', instance-side to '${actual.name}' (MOD-031). Resolve explicitly.`
-      );
-    }
-    merged.set(declared, actual);
-  }
-  return merged;
-}
-function mergeTimings(caller, instance, channelName) {
-  if (caller.type === "immediate" && instance.type === "immediate") {
-    return { type: "immediate" };
-  }
-  if (caller.type === "immediate") return instance;
-  if (instance.type === "immediate") return caller;
-  if (timingsEqual(caller, instance)) return caller;
-  throw new Error(
-    `Channel composition '${channelName}': conflicting non-Immediate timings \u2014 caller-side ${describeTiming(caller)} vs instance-side ${describeTiming(instance)}. Resolve explicitly by aligning the timings on either side (MOD-021).`
-  );
-}
-function pickPriority(callerPriority, _instancePriority) {
-  return callerPriority;
-}
-function composeActions(caller, instance) {
-  const callerIsPassthrough = caller === void 0 || isPassthrough(caller);
-  const instanceIsPassthrough = instance === void 0 || isPassthrough(instance);
-  if (callerIsPassthrough && instanceIsPassthrough) return void 0;
-  if (callerIsPassthrough) return instance;
-  if (instanceIsPassthrough) return caller;
-  return async (ctx) => {
-    await caller(ctx);
-    await instance(ctx);
-  };
-}
-function mergeOutputs(caller, instance) {
-  if (caller === null && instance === null) return null;
-  if (caller === null) return instance;
-  if (instance === null) return caller;
-  return and(caller, instance);
-}
-function unionArcs(caller, instance, keyOf) {
-  if (caller.length === 0 && instance.length === 0) return [];
-  const seen = /* @__PURE__ */ new Map();
-  for (let i2 = 0; i2 < caller.length; i2++) {
-    const arc = caller[i2];
-    const key = keyOf(arc);
-    if (!seen.has(key)) seen.set(key, arc);
-  }
-  for (let i2 = 0; i2 < instance.length; i2++) {
-    const arc = instance[i2];
-    const key = keyOf(arc);
-    if (!seen.has(key)) seen.set(key, arc);
-  }
-  const result = new Array(seen.size);
-  let i = 0;
-  for (const arc of seen.values()) result[i++] = arc;
-  return result;
-}
-function timingsEqual(a, b) {
-  if (a.type !== b.type) return false;
-  switch (a.type) {
-    case "immediate":
-      return true;
-    case "deadline":
-      return a.byMs === b.byMs;
-    case "delayed":
-      return a.afterMs === b.afterMs;
-    case "window": {
-      const w = b;
-      return a.earliestMs === w.earliestMs && a.latestMs === w.latestMs;
-    }
-    case "exact":
-      return a.atMs === b.atMs;
-  }
-}
-function describeTiming(t) {
-  switch (t.type) {
-    case "immediate":
-      return "Immediate";
-    case "deadline":
-      return `Deadline(byMs=${t.byMs})`;
-    case "delayed":
-      return `Delayed(afterMs=${t.afterMs})`;
-    case "window":
-      return `Window(earliestMs=${t.earliestMs}, latestMs=${t.latestMs})`;
-    case "exact":
-      return `Exact(atMs=${t.atMs})`;
-  }
-}
-function keyOfInhibitor(arc) {
-  return `inh|${arc.place.name}`;
-}
-function keyOfRead(arc) {
-  return `read|${arc.place.name}`;
-}
-function keyOfReset(arc) {
-  return `reset|${arc.place.name}`;
-}
-function normalizeInputArcs(arcs, seamOf) {
-  if (arcs.length < 2) return arcs;
-  const byPlace = /* @__PURE__ */ new Map();
-  let collided = false;
-  for (let i2 = 0; i2 < arcs.length; i2++) {
-    const arc = arcs[i2];
-    const name = arc.place.name;
-    const prior = byPlace.get(name);
-    if (prior === void 0) {
-      byPlace.set(name, arc);
-    } else {
-      collided = true;
-      byPlace.set(name, mergeInPair(prior, arc, seamOf(name)));
-    }
-  }
-  if (!collided) return arcs;
-  const result = new Array(byPlace.size);
-  let i = 0;
-  for (const arc of byPlace.values()) result[i++] = arc;
-  return result;
-}
-function mergeInPair(a, b, seam) {
-  if (a.type === "all" && b.type === "all") return a;
-  if (a.type === "at-least" && b.type === "at-least") {
-    return a.minimum >= b.minimum ? a : b;
-  }
-  const countA = summableCount(a);
-  const countB = summableCount(b);
-  if (countA !== -1 && countB !== -1) {
-    return exactly(countA + countB, a.place);
-  }
-  throw new Error(
-    `${seam}: input arcs ${describeIn(a)} and ${describeIn(b)} collide on place '${a.place.name}' and have no additive merge (MOD-021 rule (c)). Use a single arc with exactly(n) / atLeast(n).`
-  );
-}
-function summableCount(arc) {
-  switch (arc.type) {
-    case "one":
-      return 1;
-    case "exactly":
-      return arc.count;
-    default:
-      return -1;
-  }
-}
-function describeIn(arc) {
-  switch (arc.type) {
-    case "one":
-      return "one()";
-    case "exactly":
-      return `exactly(${arc.count})`;
-    case "all":
-      return "all()";
-    case "at-least":
-      return `atLeast(${arc.minimum})`;
-  }
-}
-function rejectCrossSideKindConflicts(caller, instance, mergedName) {
-  const callerKinds = arcKindsByPlace(caller);
-  if (callerKinds.size === 0) return;
-  for (const [place2, instanceSet] of arcKindsByPlace(instance)) {
-    const callerSet = callerKinds.get(place2);
-    if (callerSet !== void 0 && !sameKindSet(callerSet, instanceSet)) {
-      throw new Error(
-        `Channel composition '${mergedName}': conflicting arc kinds on place '${place2}' \u2014 caller-side ${describeKinds(callerSet)} vs instance-side ${describeKinds(instanceSet)}. Different arc types on one place cannot be merged (MOD-021 rule (d)). Resolve explicitly.`
-      );
-    }
-  }
-}
-function arcKindsByPlace(t) {
-  const kinds = /* @__PURE__ */ new Map();
-  const add = (name, kind) => {
-    let set = kinds.get(name);
-    if (set === void 0) {
-      set = /* @__PURE__ */ new Set();
-      kinds.set(name, set);
-    }
-    set.add(kind);
-  };
-  for (const s of t.inputSpecs) add(s.place.name, "input");
-  for (const a of t.inhibitors) add(a.place.name, "inhibitor");
-  for (const a of t.reads) add(a.place.name, "read");
-  for (const a of t.resets) add(a.place.name, "reset");
-  return kinds;
-}
-function describeKinds(kinds) {
-  return `[${[...kinds].sort().join(", ")}]`;
-}
-function sameKindSet(a, b) {
-  if (a.size !== b.size) return false;
-  for (const k of a) if (!b.has(k)) return false;
-  return true;
-}
-function applyFusion(transitions, fusionMap, seamOf) {
-  const normalizeInputs = (inputs) => normalizeInputArcs(inputs, seamOf);
-  const rewritten = /* @__PURE__ */ new Set();
-  for (const t of transitions) {
-    rewritten.add(rebuildWithName(
-      t,
-      t.name,
-      fusionMap,
-      fusionTouchesInputs(t, fusionMap) ? normalizeInputs : void 0
-    ));
-  }
-  return rewritten;
-}
-function fusionTouchesInputs(t, fusionMap) {
-  if (fusionMap.size === 0) return false;
-  for (let i = 0; i < t.inputSpecs.length; i++) {
-    if (fusionMap.has(t.inputSpecs[i].place.name)) return true;
-  }
-  return false;
-}
-
-// src/verification/verification-harness.ts
-function buildVerificationResult(syntheticNet, perProperty) {
-  const frozen = new Map(perProperty);
-  return {
-    syntheticNet,
-    perProperty: frozen,
-    allProven() {
-      for (const r of frozen.values()) {
-        if (!isProven(r)) return false;
-      }
-      return true;
-    },
-    anyViolated() {
-      for (const r of frozen.values()) {
-        if (isViolated(r)) return true;
-      }
-      return false;
-    }
-  };
-}
-function normaliseGenerators(generators) {
-  if (generators instanceof Map) return new Map(generators);
-  return new Map(Object.entries(generators));
-}
-function normaliseProperties(properties) {
-  if (Array.isArray(properties)) return [...properties];
-  return [...properties];
-}
-
-// src/core/subnet-def.ts
-var SUBNET_DEF_KEY = /* @__PURE__ */ Symbol("SubnetDef.internal");
-var SubnetDef = class _SubnetDef {
-  name;
-  body;
-  iface;
-  /** @internal Use {@link SubnetDef.builder} or {@link SubnetDef.fromNet} to create instances. */
-  constructor(key, name, body, iface) {
-    if (key !== SUBNET_DEF_KEY) {
-      throw new Error("Use SubnetDef.builder() or SubnetDef.fromNet() to create instances");
-    }
-    this.name = name;
-    this.body = body;
-    this.iface = iface;
-  }
-  /**
-   * Produces a renamed module instance per **MOD-010**, **MOD-011**, **MOD-012**,
-   * and **MOD-030**.
-   *
-   * The rename pass walks every place and transition of the body net,
-   * substituting each name with `prefix + "/" + originalName`, and rebuilds
-   * every arc with rewritten place references. Transition timing, priority,
-   * and action are carried through by reference (action sharing per
-   * [MOD-030]). The renamed body is itself a structurally valid `PetriNet`
-   * per [CORE-040]; per-instance state isolation per [MOD-012] is a
-   * structural consequence of distinct prefixed names.
-   *
-   * ## Prefix validation
-   *
-   * The `"/"` character is reserved as the prefix separator (per [MOD-010]).
-   * User-supplied prefixes MUST NOT contain `"/"`; nested instantiation is
-   * performed by the future `PetriNetBuilder.compose(...)` mechanism (per
-   * [MOD-013]). A prefix containing `"/"` raises an `Error`.
-   *
-   * @param prefix the rename prefix (non-empty, must not contain `"/"`)
-   * @param params the parameter value carried through to `Instance.params`
-   *               (may be omitted when `P` is `void`)
-   * @throws when `prefix` is empty or contains `"/"`
-   */
-  instantiate(prefix, params) {
-    validatePrefix(prefix);
-    const placeRemap = /* @__PURE__ */ new Map();
-    const transitionRemap = /* @__PURE__ */ new Map();
-    const renamedBody = renameNet(this.body, prefix, placeRemap, transitionRemap);
-    const portHandles = /* @__PURE__ */ new Map();
-    for (const port of this.iface.ports.values()) {
-      const renamed = placeRemap.get(port.place.name);
-      if (renamed === void 0) {
-        throw new Error(
-          `Port '${port.name}' references place '${port.place.name}' that was not found in the renamed body. This indicates a SubnetDef invariant violation.`
-        );
-      }
-      portHandles.set(port.name, renamed);
-    }
-    const channelHandles = /* @__PURE__ */ new Map();
-    for (const channel of this.iface.channels.values()) {
-      const renamed = transitionRemap.get(channel.transition.name);
-      if (renamed === void 0) {
-        throw new Error(
-          `Channel '${channel.name}' references transition '${channel.transition.name}' that was not found in the renamed body. This indicates a SubnetDef invariant violation.`
-        );
-      }
-      channelHandles.set(channel.name, renamed);
-    }
-    return __createInstance(
-      prefix,
-      this,
-      renamedBody,
-      portHandles,
-      channelHandles,
-      params
-    );
-  }
-  /**
-   * Verifies safety properties of this subnet definition **in isolation** per
-   * **MOD-051**, by wrapping it in a synthetic enclosing net where each input
-   * port is fed by an {@link EnvironmentPlace} (token-source per the harness
-   * generator) and each output port is observed via a synthetic place. The
-   * standard {@link SmtVerifier} (per [MOD-050]) is invoked once per property
-   * declared in the harness; the resulting per-property outcomes are
-   * aggregated into a {@link VerificationResult}.
-   *
-   * ## Synthetic-net construction
-   *
-   * The synthetic enclosing net is built by:
-   * 1. Instantiating this `SubnetDef` with the prefix `"sut"` (system-under-test)
-   *    and `harness.params`.
-   * 2. For each input or in-out port on the interface, looking up the
-   *    harness generator by port name, allocating a synthetic
-   *    {@link Place}`<unknown>` of the same conceptual token type as the
-   *    port, wrapping it in an {@link EnvironmentPlace}, and binding the
-   *    port to that synthetic place via
-   *    {@link import('./petri-net.js').PetriNetBuilder.compose}. The supplier
-   *    is invoked once at construction time to materialize the seed token —
-   *    its presence is what bounds the input behavior under analysis. **If
-   *    the harness map is missing a generator for a required input or in-out
-   *    port, an `Error` is thrown.**
-   * 3. For each output or in-out port, allocating a synthetic observation
-   *    {@link Place}`<unknown>` and binding the port to it via the same
-   *    `compose(...)` call. The verifier inspects this place's reachability
-   *    / marking through the standard property APIs ({@link SmtProperty}).
-   * 4. Building the resulting flat {@link PetriNet} per [MOD-023] (the
-   *    verifier is composition-unaware per [MOD-050]).
-   *
-   * ## Per-property invocation
-   *
-   * Each {@link SmtProperty} in the harness is verified independently against
-   * the same synthetic net. The synthetic environment places are passed
-   * through to the verifier so that places driven by the harness generators
-   * are treated under the verifier's environment-analysis semantics rather
-   * than as ordinary sink places.
-   *
-   * @param harness the verification harness — supplies parameters, input-port
-   *                token generators, and the property set
-   * @returns a {@link VerificationResult} aggregating per-property
-   *          {@link SmtVerificationResult}s
-   * @throws when an input or in-out port is missing a harness generator
-   */
-  async verify(harness, environmentMode = alwaysAvailable()) {
-    if (harness === null || harness === void 0) {
-      throw new Error("SubnetDef.verify: harness must not be null/undefined");
-    }
-    const sut = this.instantiate("sut", harness.params);
-    const generators = normaliseGenerators(harness.portInputGenerators);
-    const properties = normaliseProperties(harness.properties);
-    const envPlaces = [];
-    const portMappings = /* @__PURE__ */ new Map();
-    for (const port of this.iface.ports.values()) {
-      const portName = port.name;
-      switch (port.direction) {
-        case "input": {
-          const generator = generators.get(portName);
-          if (generator === void 0) {
-            throw new Error(
-              `verify: harness is missing an input generator for port '${portName}' on subnet '${this.name}' (MOD-051)`
-            );
-          }
-          const seed = generator();
-          if (seed === null || seed === void 0) {
-            throw new Error(
-              `verify: input generator for port '${portName}' on subnet '${this.name}' produced null/undefined`
-            );
-          }
-          const synth = place(`harness_in_${portName}`);
-          envPlaces.push(environmentPlace(synth.name));
-          portMappings.set(portName, synth);
-          break;
-        }
-        case "output": {
-          const synth = place(`harness_out_${portName}`);
-          portMappings.set(portName, synth);
-          break;
-        }
-        case "inout": {
-          const generator = generators.get(portName);
-          if (generator === void 0) {
-            throw new Error(
-              `verify: harness is missing an input generator for in-out port '${portName}' on subnet '${this.name}' (MOD-051)`
-            );
-          }
-          const seed = generator();
-          if (seed === null || seed === void 0) {
-            throw new Error(
-              `verify: input generator for in-out port '${portName}' on subnet '${this.name}' produced null/undefined`
-            );
-          }
-          const synth = place(`harness_io_${portName}`);
-          envPlaces.push(environmentPlace(synth.name));
-          portMappings.set(portName, synth);
-          break;
-        }
-      }
-    }
-    const syntheticNet = PetriNet.builder("verify_" + this.name).compose(sut, portMappings).build();
-    requireOutputProducingActions(syntheticNet);
-    const perProperty = /* @__PURE__ */ new Map();
-    for (const property of properties) {
-      const verifier = SmtVerifier.forNet(syntheticNet).property(property);
-      if (envPlaces.length > 0) {
-        verifier.environmentPlaces(...envPlaces);
-        verifier.environmentMode(environmentMode);
-      }
-      const result = await verifier.verify();
-      perProperty.set(property, result);
-    }
-    return buildVerificationResult(syntheticNet, perProperty);
-  }
-  // ============================================================
-  //  Static factories
-  // ============================================================
-  static builder(name) {
-    return new SubnetDefBuilder(name);
-  }
-  /**
-   * Retrofit utility per **MOD-014**: wraps an existing closed {@link PetriNet}
-   * plus an {@link Interface} into an unparameterised `SubnetDef<void>`.
-   *
-   * Validation per **MOD-014** / **MOD-006** is enforced before the result is
-   * constructed:
-   * - Every port's underlying `Place` must be present in `net.places`.
-   * - Every channel's underlying `Transition` must be present in `net.transitions`.
-   * - Port and channel name uniqueness is re-validated defensively (the
-   *   `Interface` builder already enforces this; hand-built `Interface`
-   *   values bypass that path).
-   *
-   * The resulting subnet definition is unparameterised (parameter type is `void`).
-   *
-   * @throws when a port place is not in `net.places`, a channel transition is
-   *         not in `net.transitions`, or port/channel names are not unique.
-   */
-  static fromNet(net, iface) {
-    const bodyPlaces = net.places;
-    const bodyTransitions = net.transitions;
-    const seenPortNames = /* @__PURE__ */ new Set();
-    for (const port of iface.ports.values()) {
-      if (seenPortNames.has(port.name)) {
-        throw new Error(
-          `fromNet: duplicate port name '${port.name}' on interface for net '${net.name}' (MOD-006)`
-        );
-      }
-      seenPortNames.add(port.name);
-      if (!bodyPlaces.has(port.place)) {
-        throw new Error(
-          `fromNet: port '${port.name}' references place '${port.place.name}' which is not in net '${net.name}' (MOD-014/MOD-006)`
-        );
-      }
-    }
-    const seenChannelNames = /* @__PURE__ */ new Set();
-    for (const channel of iface.channels.values()) {
-      if (seenChannelNames.has(channel.name)) {
-        throw new Error(
-          `fromNet: duplicate channel name '${channel.name}' on interface for net '${net.name}' (MOD-006)`
-        );
-      }
-      seenChannelNames.add(channel.name);
-      if (!bodyTransitions.has(channel.transition)) {
-        throw new Error(
-          `fromNet: channel '${channel.name}' references transition '${channel.transition.name}' which is not in net '${net.name}' (MOD-014/MOD-006)`
-        );
-      }
-    }
-    return new _SubnetDef(SUBNET_DEF_KEY, net.name, net, iface);
-  }
-};
-var SubnetDefBuilder = class {
-  _name;
-  _bodyBuilder;
-  _ports = [];
-  _channels = [];
-  constructor(name) {
-    this._name = name;
-    this._bodyBuilder = PetriNet.builder(name);
-  }
-  // -------- body construction (delegates to PetriNet.Builder) --------
-  transition(transition) {
-    this._bodyBuilder.transition(transition);
-    return this;
-  }
-  transitions(...transitions) {
-    this._bodyBuilder.transitions(...transitions);
-    return this;
-  }
-  place(place2) {
-    this._bodyBuilder.place(place2);
-    return this;
-  }
-  // -------- interface declarations --------
-  inputPort(name, place2) {
-    this._ports.push({ name, direction: "input", place: place2 });
-    return this;
-  }
-  outputPort(name, place2) {
-    this._ports.push({ name, direction: "output", place: place2 });
-    return this;
-  }
-  inoutPort(name, place2) {
-    this._ports.push({ name, direction: "inout", place: place2 });
-    return this;
-  }
-  channel(name, transition) {
-    this._channels.push({ name, transition });
-    return this;
-  }
-  // -------- build & validate (MOD-006) --------
-  build() {
-    const built = this._bodyBuilder.build();
-    const bodyPlaces = built.places;
-    const bodyTransitions = built.transitions;
-    const portNames = /* @__PURE__ */ new Set();
-    for (const port of this._ports) {
-      if (portNames.has(port.name)) {
-        throw new Error(`Subnet '${this._name}': duplicate port name '${port.name}'`);
-      }
-      portNames.add(port.name);
-      if (!bodyPlaces.has(port.place)) {
-        throw new Error(
-          `Subnet '${this._name}': port '${port.name}' references place '${port.place.name}' which is not in the body`
-        );
-      }
-    }
-    const channelNames = /* @__PURE__ */ new Set();
-    for (const channel of this._channels) {
-      if (channelNames.has(channel.name)) {
-        throw new Error(`Subnet '${this._name}': duplicate channel name '${channel.name}'`);
-      }
-      channelNames.add(channel.name);
-      if (!bodyTransitions.has(channel.transition)) {
-        throw new Error(
-          `Subnet '${this._name}': channel '${channel.name}' references transition '${channel.transition.name}' which is not in the body`
-        );
-      }
-    }
-    const ifaceBuilder = Interface.builder();
-    ifaceBuilder.portsAll(this._ports);
-    ifaceBuilder.channelsAll(this._channels);
-    const iface = ifaceBuilder.build();
-    return new SubnetDef(SUBNET_DEF_KEY, this._name, built, iface);
-  }
-};
-function validatePrefix(prefix) {
-  if (typeof prefix !== "string" || prefix.length === 0) {
-    throw new Error("SubnetDef.instantiate: prefix must be a non-empty string");
-  }
-  if (prefix.indexOf("/") >= 0) {
-    throw new Error(
-      `SubnetDef.instantiate: prefix must not contain '/' (reserved as the prefix separator per MOD-010); use compose(...) for nested instantiation. Got: '${prefix}'`
-    );
-  }
-}
-
-// src/core/compose-bindings.ts
-var COMPOSE_BINDINGS_KEY = /* @__PURE__ */ Symbol("ComposeBindings.internal");
-var ComposeBindings = class {
-  _portBindings = /* @__PURE__ */ new Map();
-  _channelBindings = /* @__PURE__ */ new Map();
-  /**
-   * @internal Use {@link PetriNetBuilder.compose} — instances are produced
-   * by the host builder and supplied to the caller's callback.
-   */
-  constructor(key) {
-    if (key !== COMPOSE_BINDINGS_KEY) {
-      throw new Error(
-        "Use PetriNetBuilder.compose(instance, b => ...) \u2014 ComposeBindings is not directly constructible"
-      );
-    }
-  }
-  /**
-   * Binds the named interface port to the given caller place per **MOD-020**.
-   *
-   * The port name is the **original** (pre-prefix) name declared in the
-   * subnet's `Interface`. The typed `<T>` parameter ensures the caller
-   * place's token type matches the interface port's token type at compile
-   * time per [MOD-022]; TypeScript does not validate the type at runtime
-   * because generics are erased.
-   *
-   * @throws when `portName` is already bound on this builder
-   */
-  bindPort(portName, callerPlace) {
-    if (this._portBindings.has(portName)) {
-      throw new Error(`Port '${portName}' is already bound`);
-    }
-    this._portBindings.set(portName, callerPlace);
-    return this;
-  }
-  /**
-   * Records a synchronous channel binding per **MOD-021**: at compose time,
-   * the instance-side renamed channel transition is merged with
-   * `callerTransition` into a single transition in the resulting flat net.
-   *
-   * **Status**: channel composition is implemented in task #13. Recording a
-   * channel binding here is permitted, but `compose(...)` currently raises
-   * an `Error` when any channel binding is present.
-   *
-   * @throws when `channelName` is already bound on this builder
-   */
-  bindChannel(channelName, callerTransition) {
-    if (this._channelBindings.has(channelName)) {
-      throw new Error(`Channel '${channelName}' is already bound`);
-    }
-    this._channelBindings.set(channelName, callerTransition);
-    return this;
-  }
-  /** Returns an unmodifiable view of the recorded port bindings. */
-  portBindings() {
-    return this._portBindings;
-  }
-  /** Returns an unmodifiable view of the recorded channel bindings. */
-  channelBindings() {
-    return this._channelBindings;
-  }
-};
-function __createComposeBindings() {
-  return new ComposeBindings(COMPOSE_BINDINGS_KEY);
-}
-
-// src/core/fusion-set.ts
-var FUSION_SET_KEY = /* @__PURE__ */ Symbol("FusionSet.internal");
-var FusionSet = class _FusionSet {
-  name;
-  members;
-  /** @internal Use {@link FusionSet.builder} or {@link FusionSet.of} to create instances. */
-  constructor(key, name, members) {
-    if (key !== FUSION_SET_KEY) {
-      throw new Error("Use FusionSet.builder() or FusionSet.of() to create instances");
-    }
-    this.name = name;
-    this.members = members;
-  }
-  /**
-   * Returns the canonical member — by convention, the first declared member.
-   * The canonical place's identity survives into the resulting flat net.
-   */
-  get canonical() {
-    return this.members[0];
-  }
-  /**
-   * Returns all members **except** the canonical member, in declaration order.
-   * These are the places that get substituted away at
-   * {@link import('./petri-net.js').PetriNetBuilder.build} time.
-   *
-   * For a single-member (degenerate) set, returns an empty array.
-   */
-  nonCanonical() {
-    if (this.members.length <= 1) return [];
-    return this.members.slice(1);
-  }
-  toString() {
-    return `FusionSet[${this.name}, canonical=${this.canonical.name}, members=${this.members.length}]`;
-  }
-  // ============================================================
-  //  Static factories
-  // ============================================================
-  /** Returns a fresh {@link FusionSetBuilder} with the given human-readable name. */
-  static builder(name) {
-    return new FusionSetBuilder(name);
-  }
-  /**
-   * Convenience factory: builds a fusion set whose first member is `first`
-   * (the canonical) and whose remaining members are `rest`, all sharing the
-   * type `<T>`.
-   *
-   * The varargs form ensures static-type homogeneity at the call site (the
-   * TypeScript compiler checks every `rest` entry is a `Place<T>`).
-   */
-  static of(name, first, ...rest) {
-    const members = [first];
-    for (const p of rest) members.push(p);
-    return new _FusionSet(FUSION_SET_KEY, name, Object.freeze(members));
-  }
-};
-var FusionSetBuilder = class {
-  _name;
-  _members = [];
-  constructor(name) {
-    if (typeof name !== "string" || name.length === 0) {
-      throw new Error("FusionSet.builder: name must be a non-empty string");
-    }
-    this._name = name;
-  }
-  /**
-   * Appends a member to the fusion set. The first member becomes the canonical
-   * place per the convention documented on {@link FusionSet}.
-   *
-   * The `<T>` parameter is for compile-time guidance only: callers writing
-   * typed code at the same call site benefit from the compiler checking
-   * `Place<T>` at each member.
-   */
-  member(place2) {
-    if (place2 === void 0 || place2 === null) {
-      throw new Error(`FusionSet '${this._name}': member place must not be null`);
-    }
-    this._members.push(place2);
-    return this;
-  }
-  /**
-   * Builds the immutable {@link FusionSet}. Validates that the set has at
-   * least one member; the empty set is rejected as malformed per **MOD-060**.
-   * Single-member sets are accepted as a structurally degenerate no-op.
-   */
-  build() {
-    if (this._members.length === 0) {
-      throw new Error(
-        `FusionSet '${this._name}': must have at least one member (MOD-060)`
-      );
-    }
-    return new FusionSet(FUSION_SET_KEY, this._name, Object.freeze(this._members.slice()));
-  }
-};
-
-// src/core/petri-net.ts
-var PETRI_NET_KEY = /* @__PURE__ */ Symbol("PetriNet.internal");
-var PetriNet = class _PetriNet {
-  name;
-  places;
-  transitions;
-  /**
-   * Subnet-membership metadata per **MOD-026**: maps each node name (place or
-   * transition) contributed by exactly one directly-composed subnet to that
-   * subnet's name. Shared places contributed by two or more subnets, and every
-   * node of a net not built via {@link PetriNetBuilder.compose}`(SubnetDef)`,
-   * are absent. Never null — an empty map when there is no metadata. The DOT
-   * exporter renders `subgraph cluster_*` blocks from this map.
-   *
-   * V8 `Map` is insertion-ordered, preserving compose order so cluster
-   * subgraphs render deterministically (cross-language byte-parity).
-   */
-  subnetMembership;
-  /** @internal Use {@link PetriNet.builder} to create instances. */
-  constructor(key, name, places, transitions, subnetMembership = /* @__PURE__ */ new Map()) {
-    if (key !== PETRI_NET_KEY) throw new Error("Use PetriNet.builder() to create instances");
-    this.name = name;
-    this.places = places;
-    this.transitions = transitions;
-    this.subnetMembership = subnetMembership;
-  }
-  /**
-   * Creates a new PetriNet with actions bound to transitions by name.
-   * Unbound transitions keep passthrough action.
-   */
-  bindActions(actionBindings) {
-    const bindings = actionBindings instanceof Map ? actionBindings : new Map(Object.entries(actionBindings));
-    return this.bindActionsWithResolver(
-      (name) => bindings.get(name) ?? passthrough()
-    );
-  }
-  /**
-   * Creates a new PetriNet with actions bound via a resolver function.
-   *
-   * The resolver is called once per transition with its name. Returning `null`
-   * defers that transition — it keeps whatever action it already carries — which
-   * is what makes staged binding (**MOD-024** AC7) work.
-   */
-  bindActionsWithResolver(actionResolver) {
-    const boundTransitions = /* @__PURE__ */ new Set();
-    for (const t of this.transitions) {
-      const action = actionResolver(t.name);
-      if (action !== null && action !== t.action) {
-        boundTransitions.add(rebuildWithAction(t, action));
-      } else {
-        boundTransitions.add(t);
-      }
-    }
-    return new _PetriNet(
-      PETRI_NET_KEY,
-      this.name,
-      this.places,
-      boundTransitions,
-      this.subnetMembership
-    );
-  }
-  static builder(name) {
-    return new PetriNetBuilder(name);
-  }
-};
-var PetriNetBuilder = class _PetriNetBuilder {
-  _name;
-  _places = /* @__PURE__ */ new Set();
-  _transitions = /* @__PURE__ */ new Set();
-  _fusionSets = [];
-  // MOD-026: node name -> set of subnet names that contributed it via
-  // compose(SubnetDef), in first-contribution order. Resolved to single-owner
-  // membership at build(). V8 Map/Set iterate in insertion order, preserving
-  // compose order for cross-language byte-parity.
-  _subnetContributions = /* @__PURE__ */ new Map();
-  constructor(name) {
-    this._name = name;
-  }
-  /** Add an explicit place. */
-  place(place2) {
-    this._places.add(place2);
-    return this;
-  }
-  /** Add explicit places. */
-  places(...places) {
-    for (const p of places) this._places.add(p);
-    return this;
-  }
-  /** Add a transition (auto-collects places from arcs). */
-  transition(transition) {
-    this._transitions.add(transition);
-    for (const spec of transition.inputSpecs) {
-      this._places.add(spec.place);
-    }
-    for (const p of transition.outputPlaces()) {
-      this._places.add(p);
-    }
-    for (const inh of transition.inhibitors) {
-      this._places.add(inh.place);
-    }
-    for (const r of transition.reads) {
-      this._places.add(r.place);
-    }
-    for (const r of transition.resets) {
-      this._places.add(r.place);
-    }
-    return this;
-  }
-  /** Add transitions (auto-collects places from arcs). */
-  transitions(...transitions) {
-    for (const t of transitions) this.transition(t);
-    return this;
-  }
-  compose(instanceOrDef, arg) {
-    if (instanceOrDef instanceof SubnetDef) {
-      return this.composeDirect(instanceOrDef);
-    }
-    const instance = instanceOrDef;
-    if (arg === void 0) {
-      return this.composeAuto(instance);
-    }
-    if (typeof arg === "function") {
-      const bindings = __createComposeBindings();
-      arg(bindings);
-      return this.composeInternal(instance, bindings.portBindings(), bindings.channelBindings());
-    }
-    const portMappings = arg instanceof Map ? arg : new Map(Object.entries(arg));
-    return this.composeInternal(instance, portMappings, /* @__PURE__ */ new Map());
+  /** Returns declared input places (consumed). */
+  inputPlaces() {
+    return this._inputPlaces;
   }
-  /**
-   * Composes a subnet {@link SubnetDef} **directly** into this builder per
-   * **MOD-025** — **without instantiation**, and without the prefix-renaming
-   * of {@link SubnetDef.instantiate}.
-   *
-   * Every body place and transition is added under its **original**
-   * (un-prefixed) name. Places merge into this builder by name: a body place
-   * whose name equals an enclosing-net place *is* that place in the composed
-   * flat net. This is the mode for wiring a subnet in as a single shared copy.
-   *
-   * Direct composition is **order-independent**: composing the same set of
-   * subnets in any order yields the same flat net, because merging is by
-   * place name and not by a probe of the builder's place set at call time —
-   * contrast the no-interface body-inference branch of {@link composeAuto}
-   * (MOD-024), which is order-sensitive.
-   *
-   * For multiple *independent* copies — each with isolated per-instance state
-   * per [MOD-012] — use {@link SubnetDef.instantiate} + the `compose(instance)`
-   * overload instead.
-   *
-   * Rejections: a body transition whose name already exists in this builder
-   * (use `instantiate(prefix)` for independent copies); a subnet whose
-   * interface declares any channel (direct composition does not bind
-   * channels — use `instantiate` + the channel-binding `compose` overload).
-   *
-   * Token-type conflicts on a same-named place cannot be detected: TS
-   * {@link Place} equality is name-only at runtime (the documented carve-out,
-   * same as MOD-024).
-   *
-   * @throws when the subnet declares channels, or a body transition name
-   *         collides with a transition already in this builder.
-   */
-  composeDirect(def) {
-    const iface = def.iface;
-    if (iface.channels.size > 0) {
-      const channelNames = [];
-      for (const c of iface.channels.values()) channelNames.push(c.name);
-      channelNames.sort();
+  requireInput(place2) {
+    if (!this.allowedInputs.has(place2.name)) {
       throw new Error(
-        `compose(SubnetDef): subnet '${def.name}' declares channels [${channelNames.join(", ")}]; direct composition does not bind channels. Use def.instantiate(prefix) + compose(instance, bind => bind.bindChannel(...)).`
+        `Place '${place2.name}' not in declared inputs: [${[...this.allowedInputs].join(", ")}]`
       );
     }
-    const body = def.body;
-    const hostTransitionNames = /* @__PURE__ */ new Set();
-    for (const t of this._transitions) hostTransitionNames.add(t.name);
-    for (const t of body.transitions) {
-      if (hostTransitionNames.has(t.name)) {
-        throw new Error(
-          `compose(SubnetDef): transition '${t.name}' from subnet '${def.name}' collides with a transition already in net '${this._name}'. Direct composition merges by name; for independent copies use def.instantiate(prefix) + compose(instance).`
-        );
-      }
-    }
-    const hostByName = /* @__PURE__ */ new Map();
-    for (const p of this._places) hostByName.set(p.name, p);
-    const subnetName = def.name.replace(/\//g, "_");
-    const mergeMap = /* @__PURE__ */ new Map();
-    for (const p of body.places) {
-      const host = hostByName.get(p.name);
-      this.place(host ?? p);
-      if (host !== void 0) mergeMap.set(p.name, host);
-      this.recordContribution(p.name, subnetName);
-    }
-    for (const t of body.transitions) {
-      this.transition(substitutePlaces(t, mergeMap));
-      this.recordContribution(t.name, subnetName);
-    }
-    return this;
   }
-  /** @internal MOD-026: records a node as contributed by the named subnet. */
-  recordContribution(nodeName, subnetName) {
-    let owners = this._subnetContributions.get(nodeName);
-    if (owners === void 0) {
-      owners = /* @__PURE__ */ new Set();
-      this._subnetContributions.set(nodeName, owners);
-    }
-    owners.add(subnetName);
+  // ==================== Read Access (not consumed) ====================
+  /** Get read-only context value. Throws if place not declared as read. */
+  read(place2) {
+    const actual = this.resolve(place2);
+    this.requireRead(actual);
+    return this.rawInput.value(actual);
   }
-  /**
-   * Identity-default auto-compose per **MOD-024**.
-   *
-   * Each declared interface port auto-binds to its own `port.place` — the
-   * Place the SubnetDef builder declared via `.inputPort(name, hostPlace)`
-   * (or `outputPort` / `inoutPort`). If the host builder already declares
-   * the equal place, the two merge; if not, the place arrives implicitly
-   * via the rewritten transitions' arcs (same flow as explicit `bindPort`).
-   *
-   * If the subnet declares no interface ports at all, body places are
-   * checked against this builder's place set **by name** (matching the
-   * existing TS Place equality semantics; see [CORE-002] note in
-   * `spec/11-modular-composition.md` MOD-024). Body places that don't match
-   * stay private under their prefixed names per [MOD-010].
-   *
-   * Channels are NOT auto-bound — transition identity is too delicate for
-   * inference. If the subnet declares any channel, this overload throws.
-   */
-  composeAuto(instance) {
-    const iface = instance.def.iface;
-    if (iface.channels.size > 0) {
-      const channelNames = [];
-      for (const c of iface.channels.values()) channelNames.push(c.name);
-      channelNames.sort();
+  /** Get all read-only context values for a place. */
+  reads(place2) {
+    const actual = this.resolve(place2);
+    this.requireRead(actual);
+    return this.rawInput.values(actual);
+  }
+  /** Returns declared read places (context, not consumed). */
+  readPlaces() {
+    return this._readPlaces;
+  }
+  requireRead(place2) {
+    if (!this.allowedReads.has(place2.name)) {
       throw new Error(
-        `compose(Instance): subnet '${instance.def.name}' (instance prefix '${instance.prefix}') declares channels [${channelNames.join(", ")}]; auto-compose does not bind channels. Use compose(instance, bind => bind.bindChannel(...)) with explicit channel bindings.`
+        `Place '${place2.name}' not in declared reads: [${[...this.allowedReads].join(", ")}]`
       );
     }
-    const hostByName = /* @__PURE__ */ new Map();
-    for (const p of this._places) hostByName.set(p.name, p);
-    if (iface.ports.size > 0) {
-      const portMappings = /* @__PURE__ */ new Map();
-      for (const port of iface.ports.values()) {
-        const hostMatch = hostByName.get(port.place.name);
-        portMappings.set(port.name, hostMatch ?? port.place);
-      }
-      return this.composeInternal(instance, portMappings, /* @__PURE__ */ new Map());
-    }
-    const mergeMap = /* @__PURE__ */ new Map();
-    const prefix = instance.prefix + "/";
-    for (const renamed of instance.renamedBody.places) {
-      if (!renamed.name.startsWith(prefix)) continue;
-      const originalName = renamed.name.substring(prefix.length);
-      const hostMatch = hostByName.get(originalName);
-      if (hostMatch !== void 0) {
-        mergeMap.set(renamed.name, hostMatch);
-      }
-    }
-    return this.applyComposition(instance, mergeMap, /* @__PURE__ */ new Map());
   }
+  // ==================== Output Access ====================
   /**
-   * @internal Shared compose implementation: validates port and channel
-   * bindings, builds the place-substitution map, walks every renamed-body
-   * transition through {@link substitutePlaces}, applies channel merges per
-   * [MOD-021], and adds the resulting transitions to this builder.
-   *
-   * ## Channel-merge flow ([MOD-021])
+   * Add one or more output values to the same place in a single call.
    *
-   * 1. Collect rewritten instance transitions into a working `Map<string,
-   *    Transition>` keyed by prefixed transition name (deferred — not yet
-   *    added to the builder's transition set).
-   * 2. For each channel binding, resolve the renamed instance-side
-   *    transition through `instance.channel(channelName)`, then look up its
-   *    rewritten counterpart in the working map by name.
-   * 3. Replace the working-map entry with a {@link mergeTransitions} result
-   *    that fuses caller-side + instance-side; remove the rewritten
-   *    instance-side entry. Also replace (or add) the caller-side
-   *    transition in this builder's transition set with the same merged
-   *    result, indexed under the caller's name slot.
-   * 4. Add the surviving (un-merged) entries to this builder.
+   * Validates the place once, then appends each value to the output
+   * collector. Calling with zero values is a no-op.
    *
-   * The deferral matters: writing the rewritten instance transitions to the
-   * builder eagerly would force a second "remove-then-replace" pass to
-   * apply the channel merges, complicating the place-collection invariants.
-   * Collecting first and merging second keeps the builder's transition set
-   * finalized exactly once.
+   * @example
+   *   ctx.output(outPlace, 'a', 'b', 'c');
+   *   ctx.output(outPlace, ...someArray);
    *
-   * Keying the working map by prefixed transition name (rather than by
-   * Transition reference) is also robust against a prior
-   * {@link Instance.bindActions} call that may have rebuilt the renamed-body
-   * transitions, breaking identity equality between the body and the
-   * channel-handle map — but the prefixed names remain stable.
+   * @throws if place not declared as output.
    */
-  composeInternal(instance, portMappings, channelBindings) {
-    const iface = instance.def.iface;
-    const mergeMap = /* @__PURE__ */ new Map();
-    for (const [portName, callerPlace] of portMappings) {
-      const port = iface.port(portName);
-      if (port === void 0) {
-        const knownPorts = [];
-        for (const p of iface.ports.values()) knownPorts.push(p.name);
-        throw new Error(
-          `compose: no port named '${portName}' on subnet '${instance.def.name}' (instance prefix '${instance.prefix}'). Known ports: [${knownPorts.join(", ")}]`
-        );
-      }
-      const ifacePlace = instance.port(portName);
-      mergeMap.set(ifacePlace.name, callerPlace);
+  output(place2, ...values) {
+    const actual = this.resolve(place2);
+    this.requireOutput(actual);
+    for (const value of values) {
+      this.writeTarget.add(actual, value);
     }
-    return this.applyComposition(instance, mergeMap, channelBindings);
+    return this;
   }
   /**
-   * Shared post-mergeMap pipeline: rewrites renamed-body transitions
-   * through `mergeMap`, applies channel merges per **MOD-021**, and adds
-   * the surviving transitions to the builder.
+   * Add one or more pre-built output tokens to the same place in a single call.
    *
-   * Used by both the explicit-binding path (`composeInternal`) and the
-   * auto-compose path (`composeAuto` per **MOD-024**). The two paths differ
-   * only in how the (renamed Place name → host Place) `mergeMap` is built.
+   * Validates the place once, then appends each token. Calling with zero
+   * tokens is a no-op.
+   *
+   * @throws if place not declared as output.
    */
-  applyComposition(instance, mergeMap, channelBindings) {
-    const iface = instance.def.iface;
-    const rewrittenByName = /* @__PURE__ */ new Map();
-    for (const t of instance.renamedBody.transitions) {
-      rewrittenByName.set(t.name, substitutePlaces(t, mergeMap));
-    }
-    for (const [channelName, callerTrans] of channelBindings) {
-      let instanceRenamedChannel;
-      try {
-        instanceRenamedChannel = instance.channel(channelName);
-      } catch (cause) {
-        const knownChannels = [];
-        for (const c of iface.channels.values()) knownChannels.push(c.name);
-        const err = new Error(
-          `compose: no channel named '${channelName}' on subnet '${instance.def.name}' (instance prefix '${instance.prefix}'). Known channels: [${knownChannels.join(", ")}]`
-        );
-        err.cause = cause;
-        throw err;
-      }
-      const rewrittenInstanceChannel = rewrittenByName.get(instanceRenamedChannel.name);
-      if (rewrittenInstanceChannel === void 0) {
-        throw new Error(
-          `compose: channel '${channelName}' resolved to a transition '${instanceRenamedChannel.name}' that is not present in the renamed body. This indicates a SubnetDef invariant violation.`
-        );
-      }
-      const merged = mergeTransitions(callerTrans, rewrittenInstanceChannel, callerTrans.name);
-      rewrittenByName.delete(instanceRenamedChannel.name);
-      this._transitions.delete(callerTrans);
-      this.transition(merged);
-    }
-    for (const rewritten of rewrittenByName.values()) {
-      this.transition(rewritten);
+  outputToken(place2, ...tokens) {
+    const actual = this.resolve(place2);
+    this.requireOutput(actual);
+    for (const token of tokens) {
+      this.writeTarget.addToken(actual, token);
     }
     return this;
   }
-  fuse(...args) {
-    if (args.length === 1 && typeof args[0] === "function") {
-      const declarer = args[0];
-      const fb = FusionSet.builder(this._name + "-fusion");
-      declarer(fb);
-      this._fusionSets.push(fb.build());
-      return this;
-    }
-    for (const s of args) {
-      if (s === void 0 || s === null) {
-        throw new Error("fuse: fusion set must not be null");
-      }
-      this._fusionSets.push(s);
+  /** Returns declared output places. */
+  outputPlaces() {
+    return this._outputPlaces;
+  }
+  requireOutput(place2) {
+    if (!this.allowedOutputs.has(place2.name)) {
+      throw new Error(
+        `Place '${place2.name}' not in declared outputs: [${[...this.allowedOutputs].join(", ")}]`
+      );
     }
-    return this;
   }
   /**
-   * Builds the immutable {@link PetriNet}, applying fusion resolution (per
-   * **MOD-061**) AFTER all transition/composition accumulation:
+   * Severs the action's output from the marking, for use when a firing times out.
    *
-   * 1. Detect overlapping fusion sets — a single place declared in two sets
-   *    is rejected with an `Error`.
-   * 2. Build the `non-canonical → canonical` substitution map across all
-   *    sets, keyed by non-canonical place name (matching the rewriter's
-   *    Map<string, Place<unknown>> convention — TypeScript Place identity is
-   *    name-based per `runtime/compiled-net.ts`).
-   * 3. Walk every transition through {@link applyFusion} to rewrite arc place
-   *    references; input arcs colliding on a canonical place merge per
-   *    [MOD-021] (additive where summable, rejected otherwise).
-   * 4. Re-derive the place set from the rewritten transitions plus any
-   *    caller-declared standalone places, dropping non-canonical members.
-   *    Caller-declared standalone places that happen to be non-canonical
-   *    members are also dropped.
+   * After this call the action's `output(...)` writes are dropped, and the executor
+   * harvests a fresh collector the action holds no reference to. Anything the action
+   * wrote *before* the timeout is discarded with it: a partial result merged with the
+   * timeout branch would violate the transition's own output spec.
    *
-   * If no fusion sets were registered, the build is the trivial
-   * `new PetriNet(...)` — the fusion machinery has no per-build cost when
-   * unused.
+   * This is the only isolation available — libpetri does not own the promise the action
+   * runs on, so it cannot stop the work, only stop the result from landing.
    *
-   * @throws when two fusion sets share a place
+   * @internal Executor machinery — must be called by the executor, never by an action.
    */
-  build() {
-    const membership = this.resolveSubnetMembership();
-    if (this._fusionSets.length === 0) {
-      return new PetriNet(
-        PETRI_NET_KEY,
-        this._name,
-        this._places,
-        this._transitions,
-        membership
-      );
-    }
-    return this.buildWithFusion(membership);
+  detachForTimeout() {
+    this.writeTarget.detach();
+    this._rawOutput = new TokenOutput();
   }
   /**
-   * @internal Resolves the per-compose contributions recorded by
-   * `composeDirect` into the final node-name → subnet-name membership map per
-   * **MOD-026**. A node contributed by exactly one subnet maps to that subnet;
-   * a place contributed by two or more subnets is a shared rendezvous place
-   * and is omitted (it renders top-level, outside any cluster). Returns an
-   * empty map — the common case — when no subnet was composed directly.
+   * Produces into the executor's harvest collector rather than the action's write target.
+   *
+   * Identical to {@link output} before {@link detachForTimeout}; after it, this is the
+   * only route that still reaches the marking. Used by the executor to deposit the
+   * timeout branch.
+   *
+   * @internal Executor machinery — must be called by the executor, never by an action.
    */
-  resolveSubnetMembership() {
-    const resolved = /* @__PURE__ */ new Map();
-    for (const [nodeName, owners] of this._subnetContributions) {
-      if (owners.size === 1) {
-        resolved.set(nodeName, owners.values().next().value);
-      }
-    }
-    return resolved;
+  outputToHarvest(place2, value) {
+    const actual = this.resolve(place2);
+    this.requireOutput(actual);
+    this._rawOutput.add(actual, value);
+    return this;
   }
+  // ==================== ν-name minting (NU-010) ====================
   /**
-   * @internal Drops membership entries for places removed by fusion: a
-   * non-canonical fused member no longer exists in the net, so its
-   * `node-name → subnet` entry would dangle. The surviving canonical place
-   * keeps its own entry. Per **MOD-026**.
+   * @internal Installs the ν-name minter. Wired by the executor at firing time
+   * so names minted by {@link freshName} are monotonic across the run and
+   * instance-prefixed (spec NU-010, NU-030).
    */
-  static filterFusedMembership(membership, nonCanonicalNames) {
-    if (membership.size === 0 || nonCanonicalNames.size === 0) {
-      return membership;
-    }
-    const filtered = /* @__PURE__ */ new Map();
-    for (const [key, value] of membership) {
-      if (!nonCanonicalNames.has(key)) {
-        filtered.set(key, value);
-      }
-    }
-    return filtered;
+  setFreshNameSupplier(supplier) {
+    this._freshNameSupplier = supplier;
   }
   /**
-   * @internal Fusion-resolution pass per **MOD-061**. Split out from
-   * {@link build} so the no-fusion fast path stays trivial.
+   * Mints a fresh ν-name (the ν-binder primitive — spec NU-010).
+   *
+   * An action calls this on the fork side to create a correlation id, then
+   * writes it into the sibling output payloads; a later join correlates those
+   * siblings via a {@link import('./match-spec.js').MatchSpec}. Uses the
+   * executor-installed minter when present; otherwise falls back to a
+   * process-global counter prefixed by the transition name.
    */
-  buildWithFusion(membership) {
-    const ownership = /* @__PURE__ */ new Map();
-    for (const set of this._fusionSets) {
-      for (const member of set.members) {
-        const prior = ownership.get(member.name);
-        if (prior !== void 0 && prior !== set) {
-          throw new Error(
-            `Fusion overlap: place '${member.name}' appears in two fusion sets ('${prior.name}' and '${set.name}'). A place may appear in at most one fusion set (MOD-060).`
-          );
-        }
-        ownership.set(member.name, set);
-      }
-    }
-    const fusionMap = /* @__PURE__ */ new Map();
-    const nonCanonicalNames = /* @__PURE__ */ new Set();
-    for (const set of this._fusionSets) {
-      const canonical = set.canonical;
-      for (const nc of set.nonCanonical()) {
-        fusionMap.set(nc.name, canonical);
-        nonCanonicalNames.add(nc.name);
-      }
-    }
-    const rewrittenTransitions = applyFusion(this._transitions, fusionMap, (canonicalName) => {
-      const owner = ownership.get(canonicalName);
-      return `Fusion set '${owner !== void 0 ? owner.name : canonicalName}'`;
-    });
-    const rebuiltPlaces = /* @__PURE__ */ new Set();
-    for (const p of this._places) {
-      if (!nonCanonicalNames.has(p.name)) {
-        rebuiltPlaces.add(p);
-      }
-    }
-    for (const t of rewrittenTransitions) {
-      for (const spec of t.inputSpecs) rebuiltPlaces.add(spec.place);
-      for (const p of t.outputPlaces()) rebuiltPlaces.add(p);
-      for (const inh of t.inhibitors) rebuiltPlaces.add(inh.place);
-      for (const r of t.reads) rebuiltPlaces.add(r.place);
-      for (const r of t.resets) rebuiltPlaces.add(r.place);
-    }
-    return new PetriNet(
-      PETRI_NET_KEY,
-      this._name,
-      rebuiltPlaces,
-      rewrittenTransitions,
-      _PetriNetBuilder.filterFusedMembership(membership, nonCanonicalNames)
-    );
+  freshName() {
+    if (this._freshNameSupplier) return this._freshNameSupplier();
+    return nameId(`${this._transitionName}#${GLOBAL_FRESH_NAME_COUNTER++}`);
+  }
+  // ==================== Structure Info ====================
+  /** Returns the transition name. */
+  transitionName() {
+    return this._transitionName;
+  }
+  // ==================== Execution Context ====================
+  /** Retrieves an execution context object by key. */
+  executionContext(key) {
+    return this.executionCtx.get(key);
+  }
+  /** Checks if an execution context object of the given key is present. */
+  hasExecutionContext(key) {
+    return this.executionCtx.has(key);
+  }
+  // ==================== Logging ====================
+  /** Emits a structured log message into the event store. */
+  log(level, message, error) {
+    this._logFn?.(level, message, error);
+  }
+  // ==================== Internal ====================
+  /** @internal Used by BitmapNetExecutor to collect outputs after action completion. */
+  rawOutput() {
+    return this._rawOutput;
   }
 };
-function rebuildWithAction(t, action) {
-  const builder = Transition.builder(t.name).timing(t.timing).priority(t.priority).action(action);
-  if (t.placeAlias.size > 0) {
-    builder.placeAlias(t.placeAlias);
+
+// src/core/token-input.ts
+var TokenInput = class {
+  tokens = /* @__PURE__ */ new Map();
+  /** Add a token (used by executor when firing transition). */
+  add(place2, token) {
+    const existing = this.tokens.get(place2.name);
+    if (existing) {
+      existing.push(token);
+    } else {
+      this.tokens.set(place2.name, [token]);
+    }
+    return this;
   }
-  if (t.inputSpecs.length > 0) {
-    builder.inputs(...t.inputSpecs);
+  /** Get all tokens for a place. */
+  getAll(place2) {
+    return this.tokens.get(place2.name) ?? [];
   }
-  if (t.outputSpec !== null) {
-    builder.outputs(t.outputSpec);
+  /** Get the first token for a place. Throws if no tokens. */
+  get(place2) {
+    const list = this.tokens.get(place2.name);
+    if (!list || list.length === 0) {
+      throw new Error(`No token for place: ${place2.name}`);
+    }
+    return list[0];
   }
-  for (const inh of t.inhibitors) {
-    builder.inhibitor(inh.place);
+  /** Get the first token's value for a place. Throws if no tokens. */
+  value(place2) {
+    return this.get(place2).value;
   }
-  for (const r of t.reads) {
-    builder.read(r.place);
+  /** Get all token values for a place. */
+  values(place2) {
+    return this.getAll(place2).map((t) => t.value);
   }
-  for (const r of t.resets) {
-    builder.reset(r.place);
+  /** Get token count for a place. */
+  count(place2) {
+    return this.getAll(place2).length;
   }
-  if (t.matchSpec !== null) {
-    builder.match(t.matchSpec);
+  /** Check if any tokens exist for a place. */
+  has(place2) {
+    return this.count(place2) > 0;
   }
-  return builder.build();
-}
+};
 
 // src/core/subnet.ts
 function closedSubnet(net) {
@@ -2686,6 +753,35 @@ var CompiledNet = class _CompiledNet {
     return true;
   }
 };
+function restartThresholds(compiled) {
+  const thresholds = new Float64Array(compiled.placeCount);
+  const requirer = new Int32Array(compiled.placeCount).fill(-1);
+  const drained = new Uint8Array(compiled.placeCount);
+  for (let tid = 0; tid < compiled.transitionCount; tid++) {
+    const t = compiled.transition(tid);
+    const requires = (pid) => {
+      requirer[pid] = requirer[pid] === -1 || requirer[pid] === tid ? tid : -2;
+    };
+    for (const spec of t.inputSpecs) {
+      const pid = compiled.placeId(spec.place);
+      thresholds[pid] = Math.max(thresholds[pid], requiredCount(spec));
+      requires(pid);
+    }
+    for (const arc of t.reads) {
+      const pid = compiled.placeId(arc.place);
+      thresholds[pid] = Math.max(thresholds[pid], 1);
+      requires(pid);
+    }
+    for (const arc of t.resets) drained[compiled.placeId(arc.place)] = 1;
+    if (t.matchSpec !== null) {
+      for (const key of t.matchSpec.keys) thresholds[compiled.placeId(key.place)] = Infinity;
+    }
+  }
+  for (let pid = 0; pid < compiled.placeCount; pid++) {
+    if (requirer[pid] !== -2 && !drained[pid]) thresholds[pid] = 0;
+  }
+  return thresholds;
+}
 function setBit(arr, bit) {
   arr[bit >>> WORD_SHIFT] |= 1 << (bit & BIT_MASK);
 }
@@ -3246,14 +1342,23 @@ var BitmapNetExecutor = class {
   wakeUpResolve = null;
   // Pre-allocated buffer for fireReadyTransitions() to avoid per-cycle allocation
   readyBuffer = [];
-  // Pending reset places for clock-restart detection
-  pendingResetPlaces = /* @__PURE__ */ new Set();
+  /**
+   * Per transition, one bit: a firing left it disabled in the intermediate marking while it
+   * was marked enabled (TIME-012), so the next dirty scan that finds it enabled restarts its
+   * clock. Set at fire time, cleared at the end of every scan; `anyRestartPending` lets the
+   * scan skip the clear when nothing was flagged.
+   */
+  restartPendingWords;
+  anyRestartPending = false;
+  /** Per place, the count a firing must leave it at to have disabled nothing through it. */
+  restartThresholds;
   /**
    * Undeclared place names already reported (CORE-072 AC4). Keyed by name — TS
    * Place identity is name-based — so a hot loop warns once, not per token.
    */
   warnedUnknownPlaces = /* @__PURE__ */ new Set();
-  transitionInputPlaceNames;
+  /** Transitions already warned for writing several tokens to a place their spec names once (IO-016 AC4). */
+  warnedMultiplicity = /* @__PURE__ */ new Set();
   running = false;
   draining = false;
   closed = false;
@@ -3278,6 +1383,8 @@ var BitmapNetExecutor = class {
     const dirtyWords = this.compiled.transitionCount + BIT_MASK >>> WORD_SHIFT;
     this.dirtySet = new Uint32Array(dirtyWords);
     this.dirtySnapBuffer = new Uint32Array(dirtyWords);
+    this.restartPendingWords = new Uint32Array(dirtyWords);
+    this.restartThresholds = restartThresholds(this.compiled);
     this.enabledAtMs = new Float64Array(this.compiled.transitionCount);
     this.enabledAtMs.fill(-Infinity);
     this.inFlightFlags = new Uint8Array(this.compiled.transitionCount);
@@ -3302,12 +1409,6 @@ var BitmapNetExecutor = class {
     this.allImmediate = allImm;
     this.allSamePriority = samePrio;
     this.eventStoreEnabled = this.eventStore.isEnabled();
-    this.transitionInputPlaceNames = /* @__PURE__ */ new Map();
-    for (const t of net.transitions) {
-      const names = /* @__PURE__ */ new Set();
-      for (const spec of t.inputSpecs) names.add(spec.place.name);
-      this.transitionInputPlaceNames.set(t, names);
-    }
     for (const [place2, tokens] of initialTokens) {
       if (tokens.length > 0 && this.compiled.tryPlaceId(place2) === void 0) {
         this.warnUnknownPlace(place2, "");
@@ -3465,11 +1566,11 @@ var BitmapNetExecutor = class {
       throw new Error(`Place ${envPlace.place.name} is not registered as an environment place`);
     }
     if (this.closed || this.draining) return false;
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve, reject) => {
       this.externalQueue.push({
         place: envPlace.place,
         token,
-        resolve: resolve2,
+        resolve,
         reject
       });
       this.wakeUp();
@@ -3542,7 +1643,7 @@ var BitmapNetExecutor = class {
           this.enabledFlags[tid] = 0;
           this.enabledTransitionCount--;
           this.enabledAtMs[tid] = -Infinity;
-        } else if (canNow && wasEnabled && this.hasInputFromResetPlace(this.compiled.transition(tid))) {
+        } else if (canNow && wasEnabled && this.anyRestartPending && (this.restartPendingWords[w] & 1 << bit) !== 0) {
           this.enabledAtMs[tid] = nowMs;
           this.emitEvent({
             type: "transition-clock-restarted",
@@ -3552,7 +1653,10 @@ var BitmapNetExecutor = class {
         }
       }
     }
-    this.pendingResetPlaces.clear();
+    if (this.anyRestartPending) {
+      this.restartPendingWords.fill(0);
+      this.anyRestartPending = false;
+    }
   }
   /**
    * Checks all enabled transitions with finite deadlines. If a transition has been
@@ -3606,14 +1710,26 @@ var BitmapNetExecutor = class {
     }
     return true;
   }
-  hasInputFromResetPlace(t) {
-    if (this.pendingResetPlaces.size === 0) return false;
-    const inputNames = this.transitionInputPlaceNames.get(t);
-    if (!inputNames) return false;
-    for (const name of this.pendingResetPlaces) {
-      if (inputNames.has(name)) return true;
+  /**
+   * Flags each other transition that firing `tid` has just disabled through `pid`
+   * (TIME-012). Called from {@link updateBitmapAfterConsumption} on the intermediate marking
+   * M - Pre(t) (inputs consumed and resets drained, outputs not yet deposited), and only for
+   * a place the firing left below its restart threshold. Removing tokens never trips an
+   * inhibitor arc, so the bit tests reject every other kind of neighbour cheaply.
+   */
+  flagIntermediateDisablements(tid, pid) {
+    const affected = this.compiled.affectedTransitions(pid);
+    for (let j = 0; j < affected.length; j++) {
+      const other = affected[j];
+      if (other === tid || !this.enabledFlags[other] || this.inFlightFlags[other]) continue;
+      const w = other >>> WORD_SHIFT;
+      const mask = 1 << (other & BIT_MASK);
+      if ((this.restartPendingWords[w] & mask) !== 0) continue;
+      if (!this.canEnable(other, this.markingBitmap)) {
+        this.restartPendingWords[w] |= mask;
+        this.anyRestartPending = true;
+      }
     }
-    return false;
   }
   // ======================== Firing ========================
   fireReadyTransitions(nowMs) {
@@ -3777,7 +1893,6 @@ var BitmapNetExecutor = class {
     }
     for (const arc of t.resets) {
       const removed = this.marking.removeAll(arc.place);
-      this.pendingResetPlaces.add(arc.place.name);
       for (const token of removed) {
         consumed.push(token);
         this.emitEvent({
@@ -3880,10 +1995,12 @@ var BitmapNetExecutor = class {
     const pids = this.compiled.consumptionPlaceIds(tid);
     for (const pid of pids) {
       const place2 = this.compiled.place(pid);
-      if (!this.marking.hasTokens(place2)) {
+      const left = this.marking.tokenCount(place2);
+      if (left === 0) {
         clearBit(this.markingBitmap, pid);
       }
       this.markDirty(pid);
+      if (left < this.restartThresholds[pid]) this.flagIntermediateDisablements(tid, pid);
     }
   }
   // ======================== Completion Processing ========================
@@ -3913,7 +2030,9 @@ var BitmapNetExecutor = class {
       try {
         const outputs = flight.context.rawOutput();
         if (t.outputSpec !== null) {
-          validateOutSpec(t.name, t.outputSpec, outputs.placesWithTokens());
+          const produced2 = outputs.placesWithTokens();
+          const claim = validateOutSpec(t.name, t.outputSpec, produced2);
+          if (outputs.entries().length > produced2.size) this.warnMultiplicity(t.name, outputs, claim);
         }
         const produced = [];
         for (const entry of outputs.entries()) {
@@ -4020,8 +2139,8 @@ var BitmapNetExecutor = class {
     if (!this.closed) {
       const timerMs = this.millisUntilNextTimedTransition();
       if (timerMs === 0 && promises.length === 0) return;
-      promises.push(new Promise((resolve2) => {
-        this.wakeUpResolve = resolve2;
+      promises.push(new Promise((resolve) => {
+        this.wakeUpResolve = resolve;
       }));
       if (timerMs > 0 && timerMs < Infinity) {
         promises.push(new Promise((r) => setTimeout(r, timerMs)));
@@ -4124,6 +2243,33 @@ var BitmapNetExecutor = class {
       errorMessage: null
     });
   }
+  /**
+   * Reports, once per transition, a firing that wrote more than one token to a place
+   * its output spec names once (IO-016 AC4), as the EVT-013 log-message event. The
+   * tokens are deposited regardless: the diagnostic makes the under-approximation
+   * every branch-enumerating analysis makes of this transition visible.
+   */
+  warnMultiplicity(transitionName, outputs, claim) {
+    if (this.warnedMultiplicity.has(transitionName)) return;
+    const counts = /* @__PURE__ */ new Map();
+    for (const entry of outputs.entries()) {
+      if (claim.has(entry.place.name)) counts.set(entry.place.name, (counts.get(entry.place.name) ?? 0) + 1);
+    }
+    const repeated = [];
+    for (const [name, n] of counts) if (n > 1) repeated.push(`${name}: ${n}`);
+    if (repeated.length === 0) return;
+    this.warnedMultiplicity.add(transitionName);
+    this.emitEvent({
+      type: "log-message",
+      timestamp: Date.now(),
+      transitionName,
+      logger: "libpetri.runtime",
+      level: "WARN",
+      message: `'${transitionName}': wrote more than one token to a place its output spec names once (${repeated.join(", ")}); branch-enumerating analyses model one token per named place, so this firing exceeds what they explore (IO-016)`,
+      error: null,
+      errorMessage: null
+    });
+  }
   emitEvent(event) {
     if (this.eventStoreEnabled) {
       try {
@@ -4201,6 +2347,10 @@ var PrecompiledNet = class _PrecompiledNet {
   simpleOutputPlaceId;
   // ==================== Input Precomputation ====================
   inputPlaceCount;
+  /**
+   * @deprecated Not read by the executor. Kept so the exported shape of `PrecompiledNet`
+   * stays stable; scheduled for removal in the next major release.
+   */
   inputPlaceMaskWords;
   // ==================== Reverse Index ====================
   placeToTransitions;
@@ -4517,6 +2667,8 @@ var PrecompiledNetExecutor = class {
    * materializing a Marking has one to hand.
    */
   unknownPlaceTokens = /* @__PURE__ */ new Map();
+  /** Transitions already warned for writing several tokens to a place their spec names once (IO-016 AC4). */
+  warnedMultiplicity = /* @__PURE__ */ new Set();
   /** Monotonic source for ν-name minting (ctx.freshName(), NU-010). */
   freshNameCounter = 0;
   /**
@@ -4558,9 +2710,17 @@ var PrecompiledNetExecutor = class {
   inFlightResolves;
   inFlightErrors;
   inFlightCount = 0;
-  // ==================== Reset-Clock Detection ====================
-  pendingResetWords;
-  hasPendingResets = false;
+  // ==================== Intermediate-Disablement Clock Restart ====================
+  /**
+   * Per transition, one bit: a firing left it disabled in the intermediate marking while it
+   * was marked enabled (TIME-012), so the next dirty scan that finds it enabled restarts its
+   * clock. Set at fire time, cleared at the end of every scan; `anyRestartPending` lets the
+   * scan skip the clear when nothing was flagged.
+   */
+  restartPendingWords;
+  anyRestartPending = false;
+  /** Per place, the count a firing must leave it at to have disabled nothing through it. */
+  restartThresholds;
   // ==================== Queues ====================
   completionQueue = [];
   externalQueue = [];
@@ -4628,7 +2788,8 @@ var PrecompiledNetExecutor = class {
     this.inFlightStartMs = new Float64Array(tc);
     this.inFlightResolves = new Array(tc).fill(null);
     this.inFlightErrors = new Array(tc).fill(null);
-    this.pendingResetWords = new Uint32Array(wc);
+    this.restartPendingWords = new Uint32Array(this.transitionWords);
+    this.restartThresholds = restartThresholds(prog.compiled);
     this.markingSnapBuffer = new Uint32Array(wc);
     this.firingSnapBuffer = new Uint32Array(wc);
     this.initMatchCaches();
@@ -4802,11 +2963,11 @@ var PrecompiledNetExecutor = class {
       throw new Error(`Place ${envPlace.place.name} is not registered as an environment place`);
     }
     if (this.closed || this.draining) return false;
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve, reject) => {
       this.externalQueue.push({
         place: envPlace.place,
         token,
-        resolve: resolve2,
+        resolve,
         reject
       });
       this.wakeUp();
@@ -4881,7 +3042,7 @@ var PrecompiledNetExecutor = class {
           this.enabledFlags[tid] = 0;
           this.enabledTransitionCount--;
           this.enabledAtMs[tid] = -Infinity;
-        } else if (canNow && wasEnabled && this.hasInputFromResetPlace(tid)) {
+        } else if (canNow && wasEnabled && this.anyRestartPending && (this.restartPendingWords[w] & 1 << bit) !== 0) {
           this.enabledAtMs[tid] = nowMs;
           this.emitEvent({
             type: "transition-clock-restarted",
@@ -4891,9 +3052,9 @@ var PrecompiledNetExecutor = class {
         }
       }
     }
-    if (this.hasPendingResets) {
-      this.pendingResetWords.fill(0);
-      this.hasPendingResets = false;
+    if (this.anyRestartPending) {
+      this.restartPendingWords.fill(0);
+      this.anyRestartPending = false;
     }
   }
   enforceDeadlines(nowMs) {
@@ -4955,13 +3116,25 @@ var PrecompiledNetExecutor = class {
     }
     return null;
   }
-  hasInputFromResetPlace(tid) {
-    if (!this.hasPendingResets) return false;
-    const inputMask = this.program.inputPlaceMaskWords[tid];
-    for (let w = 0; w < inputMask.length; w++) {
-      if ((inputMask[w] & this.pendingResetWords[w]) !== 0) return true;
+  /**
+   * Flags each other transition that firing `tid` has just disabled through `pid`
+   * (TIME-012). Called from {@link updateBitmapAfterConsumption} on the intermediate marking,
+   * only for a place the firing left below its restart threshold. Mirrors the bitmap
+   * executor, which gives the rationale.
+   */
+  flagIntermediateDisablements(tid, pid) {
+    const affected = this.program.placeToTransitions[pid];
+    for (let j = 0; j < affected.length; j++) {
+      const other = affected[j];
+      if (other === tid || !this.enabledFlags[other] || this.inFlightFlags[other]) continue;
+      const w = other >>> WORD_SHIFT;
+      const mask = 1 << (other & BIT_MASK);
+      if ((this.restartPendingWords[w] & mask) !== 0) continue;
+      if (!this.canEnable(other, this.markingBitmap)) {
+        this.restartPendingWords[w] |= mask;
+        this.anyRestartPending = true;
+      }
     }
-    return false;
   }
   // ======================== Firing ========================
   fireReadyTransitions(nowMs) {
@@ -5167,8 +3340,6 @@ var PrecompiledNetExecutor = class {
         const pid = ops[pc++];
         const place2 = prog.places[pid];
         const tokens = this.tokenQueues[pid].splice(0);
-        this.pendingResetWords[pid >>> WORD_SHIFT] |= 1 << (pid & BIT_MASK);
-        this.hasPendingResets = true;
         for (const token of tokens) {
           consumed.push(token);
           this.emitEvent({
@@ -5317,8 +3488,6 @@ var PrecompiledNetExecutor = class {
     for (const arc of t.resets) {
       const pid = prog.compiled.placeId(arc.place);
       const tokens = this.tokenQueues[pid].splice(0);
-      this.pendingResetWords[pid >>> WORD_SHIFT] |= 1 << (pid & BIT_MASK);
-      this.hasPendingResets = true;
       for (const token of tokens) {
         consumed.push(token);
         this.emitEvent({
@@ -5350,10 +3519,12 @@ var PrecompiledNetExecutor = class {
     const pids = this.program.consumptionPlaceIds[tid];
     for (let i = 0; i < pids.length; i++) {
       const pid = pids[i];
-      if (this.tokenQueues[pid].length === 0) {
+      const left = this.tokenQueues[pid].length;
+      if (left === 0) {
         this.clearMarkingBit(pid);
       }
       this.markDirty(pid);
+      if (left < this.restartThresholds[pid]) this.flagIntermediateDisablements(tid, pid);
     }
   }
   // ======================== Completion Processing ========================
@@ -5393,13 +3564,17 @@ var PrecompiledNetExecutor = class {
           const simplePid = prog.simpleOutputPlaceId[tid];
           if (simplePid >= 0) {
             const produced2 = outputs.placesWithTokens();
-            if (!produced2.has(prog.places[simplePid].name)) {
+            const named = prog.places[simplePid].name;
+            if (!produced2.has(named)) {
               throw new OutViolationError(
                 `'${t.name}': output does not match the declared spec - produced {}, which no single branch of the spec claims exactly`
               );
             }
+            if (outputs.entries().length > produced2.size) this.warnMultiplicity(t.name, outputs, /* @__PURE__ */ new Set([named]));
           } else if (simplePid === -1) {
-            validateOutSpec(t.name, t.outputSpec, outputs.placesWithTokens());
+            const produced2 = outputs.placesWithTokens();
+            const claim = validateOutSpec(t.name, t.outputSpec, produced2);
+            if (outputs.entries().length > produced2.size) this.warnMultiplicity(t.name, outputs, claim);
           }
         }
         const produced = [];
@@ -5525,8 +3700,8 @@ var PrecompiledNetExecutor = class {
     if (!this.closed) {
       const timerMs = this.millisUntilNextTimedTransition();
       if (timerMs === 0 && promises.length === 0) return;
-      promises.push(new Promise((resolve2) => {
-        this.wakeUpResolve = resolve2;
+      promises.push(new Promise((resolve) => {
+        this.wakeUpResolve = resolve;
       }));
       if (timerMs > 0 && timerMs < Infinity) {
         promises.push(new Promise((r) => setTimeout(r, timerMs)));
@@ -5619,6 +3794,34 @@ var PrecompiledNetExecutor = class {
     this.wakeUp();
   }
   // ======================== Event Emission ========================
+  /**
+   * Reports, once per transition, a firing that wrote more than one token to a place
+   * its output spec names once (IO-016 AC4), as the EVT-013 log-message event. The
+   * tokens are deposited regardless: the diagnostic makes the under-approximation
+   * every branch-enumerating analysis makes of this transition visible. Mirrors the
+   * bitmap executor word for word.
+   */
+  warnMultiplicity(transitionName, outputs, claim) {
+    if (this.warnedMultiplicity.has(transitionName)) return;
+    const counts = /* @__PURE__ */ new Map();
+    for (const entry of outputs.entries()) {
+      if (claim.has(entry.place.name)) counts.set(entry.place.name, (counts.get(entry.place.name) ?? 0) + 1);
+    }
+    const repeated = [];
+    for (const [name, n] of counts) if (n > 1) repeated.push(`${name}: ${n}`);
+    if (repeated.length === 0) return;
+    this.warnedMultiplicity.add(transitionName);
+    this.emitEvent({
+      type: "log-message",
+      timestamp: Date.now(),
+      transitionName,
+      logger: "libpetri.runtime",
+      level: "WARN",
+      message: `'${transitionName}': wrote more than one token to a place its output spec names once (${repeated.join(", ")}); branch-enumerating analyses model one token per named place, so this firing exceeds what they explore (IO-016)`,
+      error: null,
+      errorMessage: null
+    });
+  }
   emitEvent(event) {
     if (this.eventStoreEnabled) {
       try {