libpetri 5.1.0 → 6.0.0

package/dist/{petri-net-6G5r1Wwb.d.ts → petri-net-34SkD5RT.d.ts}

@@ -860,7 +860,7 @@ declare function ignore(): EnvironmentAnalysisMode;
  * violates the property, Spacer finds a counterexample. If no violation
  * is reachable, the property is proven.
  */
-type SmtProperty = DeadlockFree | TerminatesAtSink | MutualExclusion | PlaceBound | Unreachable | BranchPlaceBound | JoinedOrDeadLettered;
+type SmtProperty = DeadlockFree | TerminatesAtSink | MutualExclusion | PlaceBound | Unreachable | BranchPlaceBound | JoinedOrDeadLettered | QuiescentCount;
 /**
  * Deadlock-freedom: no reachable quiescent marking strands a token (VER-002).
  *
@@ -926,6 +926,19 @@ interface JoinedOrDeadLettered {
     readonly type: 'joined-or-dead-lettered';
     readonly pending: Place<any>;
 }
+/**
+ * A token count at quiescence (VER-002): every reachable quiescent marking holds between
+ * `min` and `max` tokens across `places` (`max` may be `Infinity`). The lower bound is
+ * waived while any `waivedBy` place is marked, the upper never: a halted run ([VER-014])
+ * need not refund its budget, but never holds more than there is.
+ */
+interface QuiescentCount {
+    readonly type: 'quiescent-count';
+    readonly places: readonly Place<any>[];
+    readonly min: number;
+    readonly max: number;
+    readonly waivedBy: readonly Place<any>[];
+}
 declare function deadlockFree(): DeadlockFree;
 /** Quiescence reaches a declared sink (VER-002). See {@link TerminatesAtSink}. */
 declare function terminatesAtSink(): TerminatesAtSink;
@@ -936,6 +949,14 @@ declare function unreachable(places: ReadonlySet<Place<any>>): Unreachable;
 declare function branchPlaceBound(place: Place<any>, bound: number): BranchPlaceBound;
 /** Joined-or-dead-lettered at quiescence (NU-040). See {@link JoinedOrDeadLettered}. */
 declare function joinedOrDeadLettered(pending: Place<any>): JoinedOrDeadLettered;
+/**
+ * A token count at quiescence (VER-002). See {@link QuiescentCount}.
+ *
+ * ```ts
+ * quiescentCount([budget], k, k, [halt])   // the budget is back at k whenever the net comes to rest, unless it halted
+ * ```
+ */
+declare function quiescentCount(places: Iterable<Place<any>>, min: number, max: number, waivedBy?: Iterable<Place<any>>): QuiescentCount;
 /** Human-readable description of a property. */
 declare function propertyDescription(prop: SmtProperty): string;
 
@@ -962,6 +983,10 @@ declare class MarkingState {
     totalTokens(): number;
     /** Checks if no tokens exist anywhere. */
     isEmpty(): boolean;
+    /**
+     * The marking as `{name:count, ...}`, places in code-point order of their names, so reports
+     * and witness traces print the same on every host ([VER-013], [VER-022]).
+     */
     toString(): string;
     static empty(): MarkingState;
     static builder(): MarkingStateBuilder;
@@ -1904,4 +1929,4 @@ declare class PetriNetBuilder {
     private buildWithFusion;
 }
 
-export { type VerificationHarness as $, type Arc as A, type Port as B, type Channel as C, type PortDirection as D, type EnvironmentPlace as E, FusionSet as F, SubnetDefBuilder as G, type SubnetInstance as H, type In as I, type Timing as J, type KeyFn as K, type LogFn as L, MAX_DURATION_MS as M, type NameId as N, type Out as O, PetriNet as P, type TimingDeadline as Q, type TimingDelayed as R, SubnetDef as S, type Token as T, type TimingExact as U, type TimingImmediate as V, type TimingWindow as W, TokenInput as X, TokenOutput as Y, type TransitionAction as Z, TransitionBuilder as _, type Place as a, type SmtStatistics as a$, type VerificationResult as a0, all as a1, allPlaces as a2, and as a3, andPlaces as a4, arcPlace as a5, atLeast as a6, consumptionCount as a7, deadline as a8, delayed as a9, requiredCount as aA, resetArc as aB, timeout as aC, timeoutPlace as aD, tokenAt as aE, tokenOf as aF, transform as aG, transformAsync as aH, transformFrom as aI, unitToken as aJ, window as aK, withTimeout as aL, xor as aM, xorPlaces as aN, type EnvironmentAnalysisMode as aO, type PInvariant as aP, MarkingState as aQ, type SmtProperty as aR, type Verdict as aS, MarkingStateBuilder as aT, type SmtVerificationResult as aU, type BranchPlaceBound as aV, type DeadlockFree as aW, type JoinedOrDeadLettered as aX, type MutualExclusion as aY, type PlaceBound as aZ, type Proven as a_, earliest as aa, enumerateBranches as ab, environmentPlace as ac, exact as ad, exactly as ae, fork as af, forwardInput as ag, hasDeadline as ah, immediate as ai, inhibitorArc as aj, inputArc as ak, isPassthrough as al, isUnit as am, keyForPlace as an, latest as ao, matchCorrelates as ap, matchKey as aq, matchSpec as ar, nameId as as, one as at, outPlace as au, outputArc as av, passthrough as aw, place as ax, produce as ay, readArc as az, Transition as b, type TerminatesAtSink as b0, type TokenSupplier as b1, type Unknown as b2, type Unreachable as b3, type VerificationRoute as b4, type Violated as b5, alwaysAvailable as b6, bounded as b7, ignore as b8, branchPlaceBound as b9, deadlockFree as ba, isProven as bb, isViolated as bc, joinedOrDeadLettered as bd, mutualExclusion as be, pInvariant as bf, pInvariantToString as bg, placeBound as bh, propertyDescription as bi, terminatesAtSink as bj, unreachable as bk, TransitionContext as c, type ArcInhibitor as d, type ArcInput as e, type ArcOutput as f, type ArcRead as g, type ArcReset as h, ComposeBindings as i, FusionSetBuilder as j, type InAll as k, type InAtLeast as l, type InExactly as m, type InOne as n, Instance as o, Interface as p, InterfaceBuilder as q, type MatchKey as r, type MatchSpec as s, type OutAnd as t, type OutForwardInput as u, type OutPlace as v, type OutTimeout as w, type OutXor as x, type OutputEntry as y, PetriNetBuilder as z };
+export { type VerificationHarness as $, type Arc as A, type Port as B, type Channel as C, type PortDirection as D, type EnvironmentPlace as E, FusionSet as F, SubnetDefBuilder as G, type SubnetInstance as H, type In as I, type Timing as J, type KeyFn as K, type LogFn as L, MAX_DURATION_MS as M, type NameId as N, type Out as O, PetriNet as P, type TimingDeadline as Q, type TimingDelayed as R, SubnetDef as S, type Token as T, type TimingExact as U, type TimingImmediate as V, type TimingWindow as W, TokenInput as X, TokenOutput as Y, type TransitionAction as Z, TransitionBuilder as _, type Place as a, type QuiescentCount as a$, type VerificationResult as a0, all as a1, allPlaces as a2, and as a3, andPlaces as a4, arcPlace as a5, atLeast as a6, consumptionCount as a7, deadline as a8, delayed as a9, requiredCount as aA, resetArc as aB, timeout as aC, timeoutPlace as aD, tokenAt as aE, tokenOf as aF, transform as aG, transformAsync as aH, transformFrom as aI, unitToken as aJ, window as aK, withTimeout as aL, xor as aM, xorPlaces as aN, type EnvironmentAnalysisMode as aO, type PInvariant as aP, MarkingState as aQ, type SmtProperty as aR, type Verdict as aS, MarkingStateBuilder as aT, type SmtVerificationResult as aU, type BranchPlaceBound as aV, type DeadlockFree as aW, type JoinedOrDeadLettered as aX, type MutualExclusion as aY, type PlaceBound as aZ, type Proven as a_, earliest as aa, enumerateBranches as ab, environmentPlace as ac, exact as ad, exactly as ae, fork as af, forwardInput as ag, hasDeadline as ah, immediate as ai, inhibitorArc as aj, inputArc as ak, isPassthrough as al, isUnit as am, keyForPlace as an, latest as ao, matchCorrelates as ap, matchKey as aq, matchSpec as ar, nameId as as, one as at, outPlace as au, outputArc as av, passthrough as aw, place as ax, produce as ay, readArc as az, Transition as b, type SmtStatistics as b0, type TerminatesAtSink as b1, type TokenSupplier as b2, type Unknown as b3, type Unreachable as b4, type VerificationRoute as b5, type Violated as b6, alwaysAvailable as b7, bounded as b8, ignore as b9, branchPlaceBound as ba, deadlockFree as bb, isProven as bc, isViolated as bd, joinedOrDeadLettered as be, mutualExclusion as bf, pInvariant as bg, pInvariantToString as bh, placeBound as bi, propertyDescription as bj, quiescentCount as bk, terminatesAtSink as bl, unreachable as bm, TransitionContext as c, type ArcInhibitor as d, type ArcInput as e, type ArcOutput as f, type ArcRead as g, type ArcReset as h, ComposeBindings as i, FusionSetBuilder as j, type InAll as k, type InAtLeast as l, type InExactly as m, type InOne as n, Instance as o, Interface as p, InterfaceBuilder as q, type MatchKey as r, type MatchSpec as s, type OutAnd as t, type OutForwardInput as u, type OutPlace as v, type OutTimeout as w, type OutXor as x, type OutputEntry as y, PetriNetBuilder as z };

package/dist/render-dom/index.js

@@ -1,7 +1,7 @@
 import {
   DEFAULT_PANZOOM_OPTS,
   mount
-} from "../chunk-BPGE7GZR.js";
+} from "../chunk-5LE2M5PW.js";
 
 // src/render-dom/index.ts
 async function renderDotToContainer(dotSource, container, opts = {}) {

package/dist/verification/index.d.ts

@@ -1,5 +1,5 @@
-import { b as Transition, a as Place, P as PetriNet, E as EnvironmentPlace, aO as EnvironmentAnalysisMode, aP as PInvariant, aQ as MarkingState, aR as SmtProperty, aS as Verdict, aT as MarkingStateBuilder, aU as SmtVerificationResult } from '../petri-net-6G5r1Wwb.js';
-export { aV as BranchPlaceBound, aW as DeadlockFree, aX as JoinedOrDeadLettered, aY as MutualExclusion, aZ as PlaceBound, a_ as Proven, a$ as SmtStatistics, b0 as TerminatesAtSink, b1 as TokenSupplier, b2 as Unknown, b3 as Unreachable, $ as VerificationHarness, a0 as VerificationResult, b4 as VerificationRoute, b5 as Violated, b6 as alwaysAvailable, b6 as analysisAlwaysAvailable, b7 as analysisBounded, b8 as analysisIgnore, b7 as bounded, b9 as branchPlaceBound, ba as deadlockFree, b8 as ignore, bb as isProven, bc as isViolated, bd as joinedOrDeadLettered, be as mutualExclusion, bf as pInvariant, bg as pInvariantToString, bh as placeBound, bi as propertyDescription, bj as terminatesAtSink, bk as unreachable } from '../petri-net-6G5r1Wwb.js';
+import { b as Transition, a as Place, P as PetriNet, E as EnvironmentPlace, aO as EnvironmentAnalysisMode, aP as PInvariant, aQ as MarkingState, aR as SmtProperty, aS as Verdict, aT as MarkingStateBuilder, aU as SmtVerificationResult } from '../petri-net-34SkD5RT.js';
+export { aV as BranchPlaceBound, aW as DeadlockFree, aX as JoinedOrDeadLettered, aY as MutualExclusion, aZ as PlaceBound, a_ as Proven, a$ as QuiescentCount, b0 as SmtStatistics, b1 as TerminatesAtSink, b2 as TokenSupplier, b3 as Unknown, b4 as Unreachable, $ as VerificationHarness, a0 as VerificationResult, b5 as VerificationRoute, b6 as Violated, b7 as alwaysAvailable, b7 as analysisAlwaysAvailable, b8 as analysisBounded, b9 as analysisIgnore, b8 as bounded, ba as branchPlaceBound, bb as deadlockFree, b9 as ignore, bc as isProven, bd as isViolated, be as joinedOrDeadLettered, bf as mutualExclusion, bg as pInvariant, bh as pInvariantToString, bi as placeBound, bj as propertyDescription, bk as quiescentCount, bl as terminatesAtSink, bm as unreachable } from '../petri-net-34SkD5RT.js';
 
 /**
  * A flattened transition with pre/post vectors for SMT encoding.
@@ -115,7 +115,8 @@ declare class IncidenceMatrix {
  * - `consumeAll[p]`: true for `all`/`at-least` inputs (consume everything)
  * - Index arrays for inhibitor, read, and reset arcs
  *
- * Places are sorted by name for stable, deterministic indexing across runs.
+ * Places are sorted by name, in Unicode code-point order, for stable indexing across
+ * runs, hosts and implementations.
  */
 
 /**
@@ -297,6 +298,11 @@ declare function strandingExcuses(flatNet: FlatNet, sinkPlaces: ReadonlySet<Plac
  * permitted in `m`. The graph-route form of {@link strandingExcuses}.
  */
 declare function strandsToken(m: MarkingState, sinkPlaces: ReadonlySet<Place<any>>, conditional: readonly ConditionalSinks[]): boolean;
+/**
+ * The places of `m` holding a stranded token, in `m`'s own order: empty exactly when
+ * {@link strandsToken} is false. [VER-022] names them in its violations.
+ */
+declare function strandedPlaces(m: MarkingState, sinkPlaces: ReadonlySet<Place<any>>, conditional: readonly ConditionalSinks[]): Place<any>[];
 /**
  * The declarations as the report prints them after the property description:
  * `sinks: a, b; when h: c, d; when p`, or `null` when nothing is declared.
@@ -678,6 +684,8 @@ declare class SmtVerifier {
     private _semiflowInvariants;
     private _stateEquation;
     private _linearBound;
+    private _stateEquationPhase;
+    private _firingBound;
     private _nuMaxClasses;
     private _enumerationMaxClasses;
     private _fragmentMode;
@@ -836,8 +844,45 @@ declare class SmtVerifier {
      * as the equality laws), and the certificate check re-proves it against the raw
      * step relation, whose only counter knowledge is the increment. Not applied to the
      * name-coloured encoding or Route B, which the report says when it applies.
+     *
+     * Not {@link stateEquationPhase}, the VER-018 pre-phase (on by default) that can decide
+     * the property instead of the fixpoint query.
      */
     stateEquation(enabled: boolean): this;
+    /**
+     * Enables/disables the state-equation phase (VER-018; default: enabled).
+     *
+     * Before the fixpoint query, one linear query asks whether a marking the marking
+     * equation (`M = M0 + C·n`, `n ≥ 0`, an upper bound on a cleared place) admits violates
+     * the property; `unsat` proves it. A `sat` candidate is settled cheapest first: a run
+     * within its firing counts that reaches a violation (the counterexample), an initially
+     * marked trap it empties, or an inequality `a·M ≤ b` kept by the exact step relation
+     * that excludes it. The refinement is added and the query asked again.
+     *
+     * The proof `SE ∧ refinements` passes the certificate check before it is reported, and
+     * the report prints each refinement, e.g. `Merge/hasdata <= Merge/ready_0 +
+     * Merge/ready_1` on a workflow join. When nothing settles a candidate, the pipeline
+     * continues unchanged. Flat path only: skipped for a ν-net and under `ignore` with
+     * environment places. Runs within the full {@link timeout}; the certificate check gets
+     * its own.
+     *
+     * Not {@link stateEquation}, which adds firing counters inside the fixpoint encoding.
+     */
+    stateEquationPhase(enabled: boolean): this;
+    /**
+     * Enables/disables the firing-bound phase (VER-019; default: enabled).
+     *
+     * Weights `r ≥ 0` that every firing lowers by at least one bound every run by
+     * `K = r·M0` firings, so a bounded model check to depth `K` decides the property. The
+     * depth doubles from 8, which finds a short counterexample early. Without such weights
+     * the report names the transitions the marking equation lets repeat, and the fixpoint
+     * query runs.
+     *
+     * A proof carries no inductive invariant: the ranking is re-checked in exact integer
+     * arithmetic, and a counterexample is replayed. Runs after the state-equation phase, on
+     * the same nets, within half the {@link timeout}.
+     */
+    firingBound(enabled: boolean): this;
     /**
      * Sets the class-count cap for the ν-aware state-class-graph analysis (NU-050,
      * Route B). When the symbolic name-aware graph would exceed this, the analysis
@@ -936,6 +981,23 @@ declare class SmtVerifier {
      * `null` hands over to the fixpoint query.
      */
     private linearBoundProof;
+    /**
+     * Whether environment places are registered but not modelled ([VER-006] `ignore`). A
+     * proof over a frozen environment is vacuous, so every route that can return `proven`
+     * refuses it. See {@link IGNORE_MODE_VACUITY_REASON}.
+     */
+    private get ignoresEnvironment();
+    /**
+     * Runs the state-equation phase (VER-018). Returns the final result when it decided
+     * the property — a `proven` only once the certificate check passed — and `null` when
+     * it stepped aside, with the reason in the report.
+     */
+    private stateEquationDecision;
+    /**
+     * Runs the firing-bound phase (VER-019). Returns the final result when it decided the
+     * property and `null` when it stepped aside, with the reason in the report.
+     */
+    private firingBoundDecision;
     /**
      * ν-net soundness guard (NU-040, NU-050). Applied only when the net contains
      * match (ν-join) transitions, and only to a proven/violated verdict (an
@@ -970,6 +1032,12 @@ interface EncodedScripts {
      * no linear demand (the quiescence properties).
      */
     readonly bound: string | null;
+    /**
+     * The first query of the state-equation phase (VER-018), before any refinement, or
+     * `null` where the phase does not run (the name-coloured encoding, a ν-net, `ignore`
+     * with environment places, or the phase disabled).
+     */
+    readonly stateEquation: string | null;
 }
 /**
  * `(define-fun Reachable ((x!0 Int) …) Bool true)`: the certificate stand-in the
@@ -1413,6 +1481,15 @@ interface BranchEdge {
     readonly branchIndex: number;
     readonly target: StateClass;
 }
+/** Options for {@link StateClassGraph.build}. */
+interface StateClassGraphOptions {
+    /**
+     * Explore the **untimed** reachable set ([VER-004]): every clock gets `immediate()`'s
+     * `[0, ∞)`, so any enabled transition may fire next and the graph holds exactly the
+     * markings the untimed encoders reason about. No effect on an all-immediate net.
+     */
+    readonly untimed?: boolean;
+}
 /**
  * State Class Graph for Time Petri Net analysis.
  *
@@ -1433,7 +1510,7 @@ declare class StateClassGraph {
      *
      * @throws Error if the net violates CORE-043 — analysis rejects the same nets execution rejects.
      */
-    static build(net: PetriNet, initialMarking: MarkingState, maxClasses: number, environmentPlaces?: Set<EnvironmentPlace<any>>, environmentMode?: EnvironmentAnalysisMode): StateClassGraph;
+    static build(net: PetriNet, initialMarking: MarkingState, maxClasses: number, environmentPlaces?: Set<EnvironmentPlace<any>>, environmentMode?: EnvironmentAnalysisMode, options?: StateClassGraphOptions): StateClassGraph;
     stateClasses(): readonly StateClass[];
     size(): number;
     isComplete(): boolean;
@@ -1519,4 +1596,333 @@ declare class TimePetriNetAnalyzerBuilder {
     build(): TimePetriNetAnalyzer;
 }
 
-export { type AbstractState, EnvironmentAnalysisMode as AnalysisEnvironmentMode, type BranchEdge, type CertificateCheckOutcome, type CertificateVc, type ClassView, type ConditionalSinks, DBM, DUMP_ENV, type DecodedTrace, type EncodeOptions, type EncodedScripts, EnvironmentAnalysisMode, type FlatNet, type FlatTransition, IncidenceMatrix, type LinearBound, type LivenessResult, MIN_Z3_VERSION, MarkingState, MarkingStateBuilder, NOTE_ENUMERATED, PInvariant, type PrioritySemantics, type QueryProven, type QueryResult, type QueryUnknown, type QueryViolated, type ReplayOptions, type ReplayOutcome, type ReplayStep, type ScgOutcome, type SmtEncoding, SmtProperty, SmtVerificationResult, SmtVerifier, StateClass, StateClassGraph, type StructuralCheckResult, TimePetriNetAnalyzer, TimePetriNetAnalyzerBuilder, Verdict, type XorBranchAnalysis, type XorBranchInfo, type Z3Exit, Z3ProcessError, type Z3Reply, type Z3Solver, Z3Unavailable, type Z3Version, Z3_ENV, canonicalInvariantOrder, checkCertificate, checkLinearBoundExact, computePInvariants, computePSemiflows, computeSCCs, decideOverClasses, decode, decodeLinearBound, decodeStateSet, describeSinks, encode, encodeLinearBound, encodeNet, encodeStepRelationSmt2, findMaximalTrapIn, findMinimalSiphons, findTerminalSCCs, flatNetIndexOf, flatNetPlaceCount, flatNetTransitionCount, flatTransition, flatten, formatLinearBound, formatLinearDemand, formatZ3Version, isCoveredByInvariants, isUntimed, parseZ3Version, placeholderCertificate, replayCounterexample, resolveZ3, rethrowIfProgrammingError, runZ3Spacer, runZ3Text, strandingExcuses, strandsToken, strengthenWithSemiflows, structuralCheck, vcScript, verifyViaStateClassGraph, violationDemand, z3Available, z3SolverAt };
+/**
+ * @module open-net/contract
+ *
+ * What a subnet promises when verified on its own, with its ports played by the environment
+ * ([VER-022]).
+ *
+ * The **assumption**: the tokens the subnet holds before anything arrives, and arrival
+ * groups, each delivering between `min` and `max` tokens onto its places at any point of the
+ * run. Every bound is finite: a bound is both the runtime cap and the width of the claim.
+ *
+ * The **guarantee**: at every quiescent marking the count clauses hold, and tokens rest only
+ * on clause, rest or environment places, or where a marked designed terminal excuses them;
+ * every other place is internal and empty. Every run comes to rest unless
+ * {@link OpenNetContractBuilder.requireTermination} is turned off.
+ */
+
+/**
+ * The environment delivers between `min` and `max` tokens in total, each onto one of
+ * `places`, each at any point of the run.
+ */
+interface ArrivalGroup {
+    readonly places: readonly Place<any>[];
+    readonly min: number;
+    readonly max: number;
+}
+/**
+ * At every quiescent marking the tokens across `places` number between `min` and `max`
+ * (`max` may be `Infinity`). A marked designed terminal waives `min`, never `max`: a halt
+ * stops progress, it does not license a token too many.
+ */
+interface CountClause {
+    readonly name: string;
+    readonly places: readonly Place<any>[];
+    readonly min: number;
+    readonly max: number;
+}
+/**
+ * While `marker` holds a token, the clauses' lower bounds are waived and tokens may rest on
+ * `excused`: the places where the work the marker interrupted was delivered. The marker
+ * itself may always rest, as a conditional-sink marker may ([VER-014]).
+ */
+interface DesignedTerminal {
+    readonly marker: Place<any>;
+    readonly excused: readonly Place<any>[];
+}
+/**
+ * A subnet's contract: the environment it assumes and what it guarantees at quiescence
+ * ([VER-022]). Build one with {@link OpenNetContract.builder}; check it with `verifyOpenNet`.
+ *
+ * ```ts
+ * const contract = OpenNetContract.builder()
+ *   .initialMarking(m => m.tokens(idle, 1).tokens(budget, k))
+ *   .arrive(1, inData, inEmpty)          // exactly one arrival on the input edge
+ *   .arriveAtMost(1, halt)               // never or once
+ *   .expect('e3', 1, e3Data, e3Empty)    // one of data / empty per outgoing edge, once it runs
+ *   .expect('idle', 1, idle)
+ *   .expect('budget', k, budget)
+ *   .expect('history', 1, done, skipped)
+ *   .terminal(halt, inData, inEmpty)     // a halted run leaves the arrival where it was delivered
+ *   .terminal(skipped)                   // a skipped run writes no output edge at all
+ *   .build();
+ * ```
+ *
+ * **A node that can skip needs its edge clauses conditional.** `expect('e3', 1, …)` alone
+ * reports a node that rests having skipped the edge. Name the place that marks a skip as a
+ * {@link OpenNetContractBuilder.terminal}: while it is marked the lower bounds are waived, and
+ * the upper bounds still catch an edge written twice.
+ *
+ * **A subnet that asks something of its neighbours needs an environment.** Alone, a node that
+ * sends a request and waits quiesces with the request outstanding. Give the contract the
+ * transitions the neighbours fire; their own places are never counted as stranded.
+ *
+ * ```ts
+ * // A node that runs again on every answer, against an environment that answers twice.
+ * const again = Transition.builder('env/again').inputs(one(request), one(rounds))
+ *   .outputs(outPlace(reply)).build();
+ * const end = Transition.builder('env/end').inputs(one(request)).outputs(outPlace(ended)).build();
+ *
+ * const agent = OpenNetContract.builder()
+ *   .initialMarking(m => m.tokens(rounds, 2))   // the environment's own budget
+ *   .arrive(1, inPlace)
+ *   .expectBetween('done', 0, 1, done)          // it may end without finishing
+ *   .environment(again, end)
+ *   .build();
+ * ```
+ *
+ * An environment transition is never executed, so it needs no action.
+ */
+declare class OpenNetContract {
+    /** Tokens the subnet holds before anything arrives: its own resources and any shared pool it borrows from. */
+    readonly initialMarking: MarkingState;
+    readonly arrivals: readonly ArrivalGroup[];
+    readonly clauses: readonly CountClause[];
+    /** Places that may hold any number of tokens at quiescence. */
+    readonly rest: readonly Place<any>[];
+    readonly terminals: readonly DesignedTerminal[];
+    /** Transitions the environment fires: neighbours that react to what the subnet sends. */
+    readonly environment: readonly Transition[];
+    /** Whether every run must come to rest. */
+    readonly requiresTermination: boolean;
+    /** @internal Use {@link OpenNetContract.builder}. */
+    constructor(key: symbol, initialMarking: MarkingState, arrivals: readonly ArrivalGroup[], clauses: readonly CountClause[], rest: readonly Place<any>[], terminals: readonly DesignedTerminal[], environment: readonly Transition[], requiresTermination: boolean);
+    static builder(): OpenNetContractBuilder;
+    /**
+     * Every place the initial marking, an arrival group, a clause, the rest set or a terminal
+     * marker names, then every place an environment transition touches, in first-mention
+     * order: the places a port trace reports. A terminal's excused places are not included;
+     * `closeOpenNet` adds them to the closed net itself.
+     */
+    places(): Place<any>[];
+    /** The contract as the report prints it, one line per part. */
+    describe(): string[];
+}
+declare class OpenNetContractBuilder {
+    private _initialMarking;
+    private readonly _arrivals;
+    private readonly _clauses;
+    private readonly _rest;
+    private readonly _terminals;
+    private readonly _environment;
+    private _requiresTermination;
+    /** Tokens the subnet holds before anything arrives. */
+    initialMarking(marking: MarkingState): this;
+    initialMarking(configurator: (builder: MarkingStateBuilder) => void): this;
+    /** The environment delivers exactly `count` tokens, each onto one of `places`, at any point of the run. */
+    arrive(count: number, ...places: Place<any>[]): this;
+    /** The environment delivers at most `max` tokens, possibly none. `arriveAtMost(1, halt)` is "never or once". */
+    arriveAtMost(max: number, ...places: Place<any>[]): this;
+    /** The environment delivers between `min` and `max` tokens in total, each onto one of `places`, at any point of the run. */
+    arriveBetween(min: number, max: number, ...places: Place<any>[]): this;
+    /** At every quiescent marking, exactly `count` tokens across `places`. */
+    expect(name: string, count: number, ...places: Place<any>[]): this;
+    /** At every quiescent marking, between `min` and `max` tokens across `places`; `max` may be `Infinity`. */
+    expectBetween(name: string, min: number, max: number, ...places: Place<any>[]): this;
+    /** Places that may hold any number of tokens at quiescence. */
+    rest(...places: Place<any>[]): this;
+    /**
+     * A designed terminal: while `marker` holds a token, lower bounds are waived and tokens may
+     * rest on `excused`. Repeated calls for one marker accumulate.
+     */
+    terminal(marker: Place<any>, ...excused: Place<any>[]): this;
+    /**
+     * Transitions the environment fires: a neighbour that reacts to what the subnet sends, such
+     * as a tool answering a request. An arrival group cannot say that: its tokens do not wait
+     * for a request.
+     *
+     * They join the closed net unchanged and are marked as environment steps in the port trace.
+     * A place only they touch belongs to the environment and may hold tokens at quiescence; a
+     * place they share with the subnet is a port, judged like any other. Their actions never
+     * run, so one that declares outputs may keep `passthrough()`.
+     */
+    environment(...transitions: Transition[]): this;
+    /** Whether every run must come to rest (default `true`). */
+    requireTermination(required: boolean): this;
+    build(): OpenNetContract;
+}
+
+/**
+ * @module open-net/closure
+ *
+ * An open net closed by the environment its contract describes ([VER-022]).
+ *
+ * Each arrival group becomes a source place holding the tokens it must deliver, one
+ * transition per target place moving a token across, and a second source for the optional
+ * part whose tokens may also be declined. The contract's environment transitions join
+ * unchanged. Every interleaving of environment steps with the subnet's firings is a run of
+ * the closed net, which is quiescent only once the environment has delivered what it must
+ * and decided about the rest. Every route then verifies a plain net.
+ *
+ * Ordinary places, not the environment places of [VER-006]: those never run dry, so a net
+ * with one is never quiescent and every quiescence property would hold vacuously.
+ */
+
+/** What an environment transition of the closure does, for the port trace. */
+type EnvironmentStep = {
+    readonly kind: 'arrival';
+    readonly group: number;
+    readonly place: string;
+} | {
+    readonly kind: 'decline';
+    readonly group: number;
+}
+/** One of the contract's own environment transitions. */
+ | {
+    readonly kind: 'transition';
+};
+/** An open net and its environment, as one closed net. */
+interface ClosedNet {
+    readonly net: PetriNet;
+    readonly initialMarking: MarkingState;
+    /** Each environment transition by name, with what it does. */
+    readonly environment: ReadonlyMap<string, EnvironmentStep>;
+    /**
+     * Places only the contract's environment transitions touch: the environment's own state.
+     * A token left on one at quiescence is never stranded.
+     */
+    readonly environmentPlaces: readonly Place<any>[];
+    /**
+     * Places the contract names that no arc touches, in contract order. They join the closed
+     * net as places of their own, so every route resolves them. A clause over a place nothing
+     * writes then counts zero there, which is the finding, not an error.
+     */
+    readonly undeclared: readonly string[];
+}
+/**
+ * Closes `net` with the environment of `contract`: its environment transitions, and for
+ * arrival group `i` a source `env:arrivals[i]` holding `min` tokens and a source
+ * `env:optional[i]` holding `max − min`, with transitions `env:arrive[i]:<place>` /
+ * `env:arrive?[i]:<place>` moving a token onto each of the group's places, and
+ * `env:decline[i]` discarding an optional one.
+ *
+ * @throws when a name the closure would add is already taken in `net`
+ */
+declare function closeOpenNet(net: PetriNet, contract: OpenNetContract): ClosedNet;
+
+/**
+ * @module open-net/result
+ *
+ * What `verifyOpenNet` returns ([VER-022]), and how a witness becomes a port trace.
+ */
+
+/** Which part of the contract a violation breaks. */
+type ContractViolationKind = 
+/** A count clause: too few tokens across its places at quiescence with no terminal marked, or too many. */
+'clause'
+/** A token rests where the contract lets none rest: on an internal place, or on one only an unmarked terminal excuses. */
+ | 'stranded'
+/** A run that never comes to rest: a reachable cycle. */
+ | 'termination';
+/** A token-count change on one contract place. */
+interface PortChange {
+    readonly place: string;
+    readonly delta: number;
+}
+/** A firing that touches the subnet's boundary: an environment step, or a change on a contract place. */
+interface PortStep {
+    /** The firing's position in {@link ContractViolation.transitions}, counting from 1. */
+    readonly step: number;
+    readonly transition: string;
+    /**
+     * Set when the environment fired it: `arrival` or `decline` for an arrival group,
+     * `transition` for one of the contract's environment transitions. `null` for the subnet.
+     */
+    readonly environment: EnvironmentStep['kind'] | null;
+    /** Token changes on the contract's places, in the contract's order. */
+    readonly changes: readonly PortChange[];
+}
+/** One broken part of the contract, with a firing sequence that breaks it. */
+interface ContractViolation {
+    readonly kind: ContractViolationKind;
+    /**
+     * The clause's name, a stranded place's name, or `termination`. The SMT route reports one
+     * stranding for the whole query, naming every stranded place comma-separated.
+     */
+    readonly subject: string;
+    /** What was found, in words. */
+    readonly detail: string;
+    /** The firing sequence from the initial marking, environment transitions included. */
+    readonly transitions: readonly string[];
+    /** The marking before the first firing and after each one, when the route has them in order. */
+    readonly markings: readonly MarkingState[];
+    /** For `termination`, the index into {@link transitions} where the repeating cycle starts. */
+    readonly cycleStart: number | null;
+    /** The firings of {@link transitions} that touch the boundary. */
+    readonly portTrace: readonly PortStep[];
+    /**
+     * Whether {@link transitions} is a real firing sequence in order. Always on the graph
+     * route; on the SMT route it is the counterexample replay's outcome ([VER-003]).
+     */
+    readonly confirmed: boolean;
+}
+/** Which route decided the verdict. */
+type OpenNetRoute = 'enumeration' | 'smt';
+/** The outcome of `verifyOpenNet`. */
+interface OpenNetResult {
+    /** `proven`, `violated` (see {@link violations}), or `unknown` with the reason. */
+    readonly verdict: Verdict;
+    /**
+     * Every broken part found. The graph route lists clauses in contract order, then stranded
+     * places by name, then termination; the SMT route asks for stranding first, so it lists
+     * that, then clauses in contract order, then termination.
+     */
+    readonly violations: readonly ContractViolation[];
+    readonly route: OpenNetRoute;
+    /** Classes the state-class graph explored; `0` when it was skipped. */
+    readonly classCount: number;
+    /** Whether the state-class graph closed within its budget. */
+    readonly graphComplete: boolean;
+    readonly report: string;
+    /** The subnet closed by its environment: what every route verified. */
+    readonly closedNet: PetriNet;
+    readonly closedMarking: MarkingState;
+    readonly elapsedMs: number;
+}
+
+/**
+ * @module open-net/verify-open-net
+ *
+ * A subnet verified on its own against a contract, with its ports played by the environment
+ * ([VER-022]). The closed net's untimed state-class graph decides exactly when it closes; a
+ * violation it finds stands either way, and otherwise the SMT pipeline gets the contract.
+ * Composing the per-subnet proofs into a claim about a whole net is the caller's theorem.
+ */
+
+/** Options for {@link verifyOpenNet}. */
+interface OpenNetOptions {
+    /** Class budget for the state-class graph (default 50 000, as for [VER-017]). `0` skips the graph. */
+    readonly maxClasses?: number;
+    /** Whether to ask the SMT pipeline when the graph does not close (default `true`). */
+    readonly smt?: boolean;
+    /** Configures each `SmtVerifier` the SMT route builds, e.g. `v => v.timeout(120_000).stateEquation(true)`. */
+    readonly configureSmt?: (verifier: SmtVerifier) => SmtVerifier;
+    /** Time for the firing-bound query that decides termination on the SMT route (default 60 s). */
+    readonly terminationTimeoutMs?: number;
+}
+/**
+ * Verifies `net` in isolation against `contract` ([VER-022]).
+ *
+ * `proven` means that, in every run of the environment the contract assumes, every
+ * quiescent marking meets the contract, and (unless termination is waived) every run comes
+ * to rest. The claim is untimed, priority-blind and value-blind, like every route's
+ * ([VER-004]). `violated` lists every broken part with a shortest witness, and
+ * `unknown` says why neither route decided.
+ *
+ * @throws when the net violates CORE-043, as every verifier does, or when the closure's
+ *   names collide with the net's
+ */
+declare function verifyOpenNet(net: PetriNet, contract: OpenNetContract, options?: OpenNetOptions): Promise<OpenNetResult>;
+
+export { type AbstractState, EnvironmentAnalysisMode as AnalysisEnvironmentMode, type ArrivalGroup, type BranchEdge, type CertificateCheckOutcome, type CertificateVc, type ClassView, type ClosedNet, type ConditionalSinks, type ContractViolation, type ContractViolationKind, type CountClause, DBM, DUMP_ENV, type DecodedTrace, type DesignedTerminal, type EncodeOptions, type EncodedScripts, EnvironmentAnalysisMode, type EnvironmentStep, type FlatNet, type FlatTransition, IncidenceMatrix, type LinearBound, type LivenessResult, MIN_Z3_VERSION, MarkingState, MarkingStateBuilder, NOTE_ENUMERATED, OpenNetContract, OpenNetContractBuilder, type OpenNetOptions, type OpenNetResult, type OpenNetRoute, PInvariant, type PortChange, type PortStep, type PrioritySemantics, type QueryProven, type QueryResult, type QueryUnknown, type QueryViolated, type ReplayOptions, type ReplayOutcome, type ReplayStep, type ScgOutcome, type SmtEncoding, SmtProperty, SmtVerificationResult, SmtVerifier, StateClass, StateClassGraph, type StateClassGraphOptions, type StructuralCheckResult, TimePetriNetAnalyzer, TimePetriNetAnalyzerBuilder, Verdict, type XorBranchAnalysis, type XorBranchInfo, type Z3Exit, Z3ProcessError, type Z3Reply, type Z3Solver, Z3Unavailable, type Z3Version, Z3_ENV, canonicalInvariantOrder, checkCertificate, checkLinearBoundExact, closeOpenNet, computePInvariants, computePSemiflows, computeSCCs, decideOverClasses, decode, decodeLinearBound, decodeStateSet, describeSinks, encode, encodeLinearBound, encodeNet, encodeStepRelationSmt2, findMaximalTrapIn, findMinimalSiphons, findTerminalSCCs, flatNetIndexOf, flatNetPlaceCount, flatNetTransitionCount, flatTransition, flatten, formatLinearBound, formatLinearDemand, formatZ3Version, isCoveredByInvariants, isUntimed, parseZ3Version, placeholderCertificate, replayCounterexample, resolveZ3, rethrowIfProgrammingError, runZ3Spacer, runZ3Text, strandedPlaces, strandingExcuses, strandsToken, strengthenWithSemiflows, structuralCheck, vcScript, verifyOpenNet, verifyViaStateClassGraph, violationDemand, z3Available, z3SolverAt };