libpetri 5.1.0 → 6.0.0

package/dist/verification/index.js

@@ -6,9 +6,11 @@ import {
   MarkingState,
   MarkingStateBuilder,
   NOTE_ENUMERATED,
+  PetriNet,
   SmtVerifier,
   StateClass,
   StateClassGraph,
+  Transition,
   Z3ProcessError,
   Z3Unavailable,
   Z3_ENV,
@@ -18,8 +20,12 @@ import {
   canonicalInvariantOrder,
   checkCertificate,
   checkLinearBoundExact,
+  compareCodePoints,
   computePInvariants,
   computePSemiflows,
+  countAcross,
+  countPhrase,
+  countViolation,
   deadlockFree,
   decideOverClasses,
   decode,
@@ -31,6 +37,8 @@ import {
   encodeNet,
   encodeStepRelationSmt2,
   enumerateBranches,
+  failureReason,
+  findFiringBound,
   findMaximalTrapIn,
   findMinimalSiphons,
   flatNetIndexOf,
@@ -38,39 +46,50 @@ import {
   flatNetTransitionCount,
   flatTransition,
   flatten,
+  fork,
   formatLinearBound,
   formatLinearDemand,
+  formatRanking,
   formatZ3Version,
   ignore,
   isCoveredByInvariants,
+  isPassthrough,
   isProven,
   isUntimed,
   isViolated,
   joinedOrDeadLettered,
   mutualExclusion,
+  one,
+  outPlace,
   pInvariant,
   pInvariantToString,
   parseZ3Version,
+  place,
   placeBound,
   placeholderCertificate,
   propertyDescription,
+  quiescentCount,
   replayCounterexample,
   resolveZ3,
   rethrowIfProgrammingError,
   runZ3Spacer,
   runZ3Text,
+  strandedPlaces,
   strandingExcuses,
   strandsToken,
   strengthenWithSemiflows,
   structuralCheck,
   terminatesAtSink,
+  timeoutBudget,
+  tokensAcross,
+  transform,
   unreachable,
   vcScript,
   verifyViaStateClassGraph,
   violationDemand,
   z3Available,
   z3SolverAt
-} from "../chunk-EL4E6LVO.js";
+} from "../chunk-MQZ6IM63.js";
 import "../chunk-ATT7U5H5.js";
 
 // src/verification/analysis/scc-analyzer.ts
@@ -420,6 +439,705 @@ var TimePetriNetAnalyzerBuilder = class {
     );
   }
 };
+
+// src/verification/open-net/contract.ts
+var CONTRACT_KEY = /* @__PURE__ */ Symbol("OpenNetContract.internal");
+var OpenNetContract = class {
+  /** Tokens the subnet holds before anything arrives: its own resources and any shared pool it borrows from. */
+  initialMarking;
+  arrivals;
+  clauses;
+  /** Places that may hold any number of tokens at quiescence. */
+  rest;
+  terminals;
+  /** Transitions the environment fires: neighbours that react to what the subnet sends. */
+  environment;
+  /** Whether every run must come to rest. */
+  requiresTermination;
+  /** @internal Use {@link OpenNetContract.builder}. */
+  constructor(key, initialMarking, arrivals, clauses, rest, terminals, environment, requiresTermination) {
+    if (key !== CONTRACT_KEY) throw new Error("Use OpenNetContract.builder() to create instances");
+    this.initialMarking = initialMarking;
+    this.arrivals = arrivals;
+    this.clauses = clauses;
+    this.rest = rest;
+    this.terminals = terminals;
+    this.environment = environment;
+    this.requiresTermination = requiresTermination;
+  }
+  static builder() {
+    return new OpenNetContractBuilder();
+  }
+  /**
+   * Every place the initial marking, an arrival group, a clause, the rest set or a terminal
+   * marker names, then every place an environment transition touches, in first-mention
+   * order: the places a port trace reports. A terminal's excused places are not included;
+   * `closeOpenNet` adds them to the closed net itself.
+   */
+  places() {
+    const seen = /* @__PURE__ */ new Map();
+    const add = (p) => {
+      if (!seen.has(p.name)) seen.set(p.name, p);
+    };
+    for (const p of this.initialMarking.placesWithTokens()) add(p);
+    for (const g of this.arrivals) g.places.forEach(add);
+    for (const c of this.clauses) c.places.forEach(add);
+    this.rest.forEach(add);
+    for (const t of this.terminals) add(t.marker);
+    for (const t of this.environment) transitionPlaces(t).forEach(add);
+    return [...seen.values()];
+  }
+  /** The contract as the report prints it, one line per part. */
+  describe() {
+    const names = (ps) => ps.map((p) => p.name).join(", ");
+    const lines = [`  Initial marking: ${this.initialMarking.toString()}`];
+    lines.push(this.arrivals.length === 0 ? "  Arrivals: none" : `  Arrivals: ${this.arrivals.map((g) => `${countPhrase(g.min, g.max)} onto {${names(g.places)}}`).join("; ")}`);
+    lines.push(this.clauses.length === 0 ? "  At quiescence: no count clauses" : `  At quiescence: ${this.clauses.map((c) => `${c.name} = ${countPhrase(c.min, c.max)} across {${names(c.places)}}`).join("; ")}`);
+    if (this.rest.length > 0) lines.push(`  Rest: ${names(this.rest)}`);
+    for (const t of this.terminals) {
+      lines.push(t.excused.length === 0 ? `  Terminal: when ${t.marker.name}` : `  Terminal: when ${t.marker.name}: ${names(t.excused)}`);
+    }
+    if (this.environment.length > 0) {
+      lines.push(`  Environment transitions: ${this.environment.map((t) => t.name).join(", ")}`);
+    }
+    lines.push(`  Termination: ${this.requiresTermination ? "every run comes to rest" : "not required"}`);
+    return lines;
+  }
+};
+function transitionPlaces(t) {
+  return [
+    ...t.inputSpecs.map((s) => s.place),
+    ...t.reads.map((a) => a.place),
+    ...t.inhibitors.map((a) => a.place),
+    ...t.resets.map((a) => a.place),
+    ...t.outputPlaces()
+  ];
+}
+var OpenNetContractBuilder = class {
+  _initialMarking = MarkingState.empty();
+  _arrivals = [];
+  _clauses = [];
+  _rest = /* @__PURE__ */ new Map();
+  _terminals = [];
+  _environment = [];
+  _requiresTermination = true;
+  initialMarking(arg) {
+    if (arg instanceof MarkingState) {
+      this._initialMarking = arg;
+    } else {
+      const builder = MarkingState.builder();
+      arg(builder);
+      this._initialMarking = builder.build();
+    }
+    return this;
+  }
+  /** The environment delivers exactly `count` tokens, each onto one of `places`, at any point of the run. */
+  arrive(count, ...places) {
+    return this.arriveBetween(count, count, ...places);
+  }
+  /** The environment delivers at most `max` tokens, possibly none. `arriveAtMost(1, halt)` is "never or once". */
+  arriveAtMost(max, ...places) {
+    return this.arriveBetween(0, max, ...places);
+  }
+  /** The environment delivers between `min` and `max` tokens in total, each onto one of `places`, at any point of the run. */
+  arriveBetween(min, max, ...places) {
+    if (!Number.isInteger(min) || !Number.isInteger(max) || min < 0 || max < min || max < 1) {
+      throw new Error(
+        `OpenNetContract: an arrival group needs whole bounds with 0 <= min <= max and max >= 1, got ${min}..${max}. A bound is both the runtime cap and the width of the claim, so it is finite.`
+      );
+    }
+    this._arrivals.push({ places: distinct(places, "an arrival group"), min, max });
+    return this;
+  }
+  /** At every quiescent marking, exactly `count` tokens across `places`. */
+  expect(name, count, ...places) {
+    return this.expectBetween(name, count, count, ...places);
+  }
+  /** At every quiescent marking, between `min` and `max` tokens across `places`; `max` may be `Infinity`. */
+  expectBetween(name, min, max, ...places) {
+    if (name.length === 0) throw new Error("OpenNetContract: a clause needs a name");
+    if (this._clauses.some((c) => c.name === name)) {
+      throw new Error(`OpenNetContract: duplicate clause name '${name}'`);
+    }
+    if (!Number.isInteger(min) || min < 0 || !(max === Infinity || Number.isInteger(max)) || max < min) {
+      throw new Error(`OpenNetContract: clause '${name}' needs whole bounds with 0 <= min <= max, got ${min}..${max}`);
+    }
+    this._clauses.push({ name, places: distinct(places, `clause '${name}'`), min, max });
+    return this;
+  }
+  /** Places that may hold any number of tokens at quiescence. */
+  rest(...places) {
+    for (const p of places) if (!this._rest.has(p.name)) this._rest.set(p.name, p);
+    return this;
+  }
+  /**
+   * A designed terminal: while `marker` holds a token, lower bounds are waived and tokens may
+   * rest on `excused`. Repeated calls for one marker accumulate.
+   */
+  terminal(marker, ...excused) {
+    let entry = this._terminals.find((t) => t.marker.name === marker.name);
+    if (entry == null) {
+      entry = { marker, excused: /* @__PURE__ */ new Map() };
+      this._terminals.push(entry);
+    }
+    for (const p of excused) if (!entry.excused.has(p.name)) entry.excused.set(p.name, p);
+    return this;
+  }
+  /**
+   * Transitions the environment fires: a neighbour that reacts to what the subnet sends, such
+   * as a tool answering a request. An arrival group cannot say that: its tokens do not wait
+   * for a request.
+   *
+   * They join the closed net unchanged and are marked as environment steps in the port trace.
+   * A place only they touch belongs to the environment and may hold tokens at quiescence; a
+   * place they share with the subnet is a port, judged like any other. Their actions never
+   * run, so one that declares outputs may keep `passthrough()`.
+   */
+  environment(...transitions) {
+    for (const t of transitions) {
+      if (this._environment.some((e) => e.name === t.name)) {
+        throw new Error(`OpenNetContract: duplicate environment transition '${t.name}'`);
+      }
+      this._environment.push(t);
+    }
+    return this;
+  }
+  /** Whether every run must come to rest (default `true`). */
+  requireTermination(required) {
+    this._requiresTermination = required;
+    return this;
+  }
+  build() {
+    return new OpenNetContract(
+      CONTRACT_KEY,
+      this._initialMarking,
+      [...this._arrivals],
+      [...this._clauses],
+      [...this._rest.values()],
+      this._terminals.map((t) => ({ marker: t.marker, excused: [...t.excused.values()] })),
+      [...this._environment],
+      this._requiresTermination
+    );
+  }
+};
+function distinct(places, what) {
+  if (places.length === 0) throw new Error(`OpenNetContract: ${what} names no place`);
+  const byName = /* @__PURE__ */ new Map();
+  for (const p of places) if (!byName.has(p.name)) byName.set(p.name, p);
+  return [...byName.values()];
+}
+
+// src/verification/open-net/closure.ts
+var ENVIRONMENT_ACTION = transform(() => null);
+function closeOpenNet(net, contract) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const p of net.places) if (!byName.has(p.name)) byName.set(p.name, p);
+  const taken = new Set(byName.keys());
+  for (const t of net.transitions) taken.add(t.name);
+  const fresh = (name) => {
+    if (taken.has(name)) {
+      throw new Error(`VER-022: closing the net would add '${name}', which the net already declares`);
+    }
+    taken.add(name);
+    return name;
+  };
+  const environment = /* @__PURE__ */ new Map();
+  const environmentPlaces = /* @__PURE__ */ new Map();
+  for (const t of contract.environment) {
+    environment.set(fresh(t.name), { kind: "transition" });
+    for (const p of transitionPlaces(t)) {
+      if (!byName.has(p.name) && !environmentPlaces.has(p.name)) environmentPlaces.set(p.name, p);
+    }
+  }
+  for (const [name, p] of environmentPlaces) {
+    taken.add(name);
+    byName.set(name, p);
+  }
+  const undeclared = [];
+  const extra = [];
+  const named = [...contract.places(), ...contract.terminals.flatMap((t) => t.excused)];
+  for (const p of named) {
+    if (byName.has(p.name)) continue;
+    undeclared.push(p.name);
+    byName.set(p.name, p);
+    extra.push(p);
+  }
+  const canonical = (p) => byName.get(p.name) ?? p;
+  const envTransitions = [];
+  const marking = MarkingState.builder().copyFrom(contract.initialMarking);
+  const inject = (group, source, target, optional) => {
+    const name = fresh(`env:arrive${optional ? "?" : ""}[${group}]:${target.name}`);
+    envTransitions.push(
+      Transition.builder(name).inputs(one(source)).outputs(outPlace(target)).action(fork()).build()
+    );
+    environment.set(name, { kind: "arrival", group, place: target.name });
+  };
+  contract.arrivals.forEach((group, i) => {
+    if (group.min > 0) {
+      const source = place(fresh(`env:arrivals[${i}]`));
+      marking.tokens(source, group.min);
+      for (const p of group.places) inject(i, source, canonical(p), false);
+    }
+    if (group.max > group.min) {
+      const source = place(fresh(`env:optional[${i}]`));
+      marking.tokens(source, group.max - group.min);
+      for (const p of group.places) inject(i, source, canonical(p), true);
+      const name = fresh(`env:decline[${i}]`);
+      envTransitions.push(Transition.builder(name).inputs(one(source)).build());
+      environment.set(name, { kind: "decline", group: i });
+    }
+  });
+  const placeholder = new Set(contract.environment.filter((t) => t.outputSpec !== null && isPassthrough(t.action)).map((t) => t.name));
+  const closed = PetriNet.builder(`${net.name}+environment`).places(...net.places, ...extra).transitions(...net.transitions, ...contract.environment, ...envTransitions).build().bindActionsWithResolver((name) => placeholder.has(name) ? ENVIRONMENT_ACTION : null);
+  return {
+    net: closed,
+    initialMarking: marking.build(),
+    environment,
+    environmentPlaces: [...environmentPlaces.values()],
+    undeclared
+  };
+}
+
+// src/verification/open-net/predicate.ts
+function restDeclarationOf(contract, closed) {
+  const sinks = /* @__PURE__ */ new Map();
+  for (const c of contract.clauses) for (const p of c.places) if (!sinks.has(p.name)) sinks.set(p.name, p);
+  for (const p of contract.rest) if (!sinks.has(p.name)) sinks.set(p.name, p);
+  for (const p of closed.environmentPlaces) if (!sinks.has(p.name)) sinks.set(p.name, p);
+  return {
+    sinks: new Set(sinks.values()),
+    conditional: contract.terminals.map((t) => ({ marker: t.marker, places: new Set(t.excused) }))
+  };
+}
+function waiverMarkers(contract) {
+  return contract.terminals.map((t) => t.marker);
+}
+function strandedNames(m, rest) {
+  return strandedPlaces(m, rest.sinks, rest.conditional).sort((a, b) => compareCodePoints(a.name, b.name));
+}
+function quiescenceFindings(m, contract, rest) {
+  const findings = [];
+  const markers = waiverMarkers(contract);
+  for (const clause of contract.clauses) {
+    const bound = countViolation(m, clause.places, clause.min, clause.max, markers);
+    if (bound !== null) findings.push({ kind: "clause", clause, count: tokensAcross(m, clause.places), bound });
+  }
+  for (const place2 of strandedNames(m, rest)) {
+    findings.push({ kind: "stranded", place: place2.name, count: m.tokens(place2) });
+  }
+  return findings;
+}
+function subjectOf(f) {
+  return f.kind === "clause" ? f.clause.name : f.place;
+}
+function describeFinding(f) {
+  if (f.kind === "stranded") {
+    return `${f.place} holds ${f.count} at quiescence, and nothing in the contract lets a token rest there`;
+  }
+  const { clause } = f;
+  const expected = countAcross(clause.min, clause.max, clause.places);
+  return f.bound === "upper" ? `${expected} at quiescence, found ${f.count} (an upper bound holds under a terminal too)` : `${expected} at quiescence, found ${f.count}`;
+}
+
+// src/verification/open-net/result.ts
+function contractViolation(closed, tracedPlaces, violation) {
+  const { transitions, markings } = violation;
+  const portTrace = [];
+  if (markings.length === transitions.length + 1) {
+    for (let i = 0; i < transitions.length; i++) {
+      const before = markings[i];
+      const after = markings[i + 1];
+      const changes = [];
+      for (const p of tracedPlaces) {
+        const delta = after.tokens(p) - before.tokens(p);
+        if (delta !== 0) changes.push({ place: p.name, delta });
+      }
+      const env = closed.environment.get(transitions[i]);
+      if (changes.length > 0 || env !== void 0) {
+        portTrace.push({ step: i + 1, transition: transitions[i], environment: env?.kind ?? null, changes });
+      }
+    }
+  }
+  return { ...violation, portTrace };
+}
+
+// src/verification/open-net/graph-route.ts
+function decideOnGraph(closed, contract, maxClasses, tracedPlaces) {
+  const graph = StateClassGraph.build(
+    closed.net,
+    closed.initialMarking,
+    maxClasses,
+    void 0,
+    void 0,
+    { untimed: true }
+  );
+  const classes = graph.stateClasses();
+  const rest = restDeclarationOf(contract, closed);
+  const tree = bfsTree(graph);
+  const first = /* @__PURE__ */ new Map();
+  for (const sc of classes) {
+    if (sc.enabledTransitions.length > 0) continue;
+    for (const finding of quiescenceFindings(sc.marking, contract, rest)) {
+      const key = `${finding.kind}:${subjectOf(finding)}`;
+      if (!first.has(key)) first.set(key, { finding, target: sc });
+    }
+  }
+  const clauseOrder = new Map(contract.clauses.map((c, i) => [c.name, i]));
+  const rank = (f) => f.kind === "clause" ? clauseOrder.get(f.clause.name) : contract.clauses.length;
+  const ordered = [...first.values()].sort((a, b) => rank(a.finding) - rank(b.finding) || compareCodePoints(subjectOf(a.finding), subjectOf(b.finding)));
+  const violations = ordered.map(({ finding, target }) => {
+    const path = pathTo(tree, target);
+    return contractViolation(closed, tracedPlaces, {
+      kind: finding.kind,
+      subject: subjectOf(finding),
+      detail: describeFinding(finding),
+      transitions: path.transitions,
+      markings: path.classes.map((c) => c.marking),
+      cycleStart: null,
+      confirmed: true
+    });
+  });
+  if (contract.requiresTermination) {
+    const cycle = findCycle(graph, tree);
+    if (cycle !== null) violations.push(contractViolation(closed, tracedPlaces, cycle));
+  }
+  return { complete: graph.isComplete(), classCount: classes.length, violations };
+}
+function bfsTree(graph) {
+  const tree = /* @__PURE__ */ new Map();
+  const seen = /* @__PURE__ */ new Set([graph.initialClass]);
+  const queue = [graph.initialClass];
+  for (let head = 0; head < queue.length; head++) {
+    const current = queue[head];
+    for (const [transition, edges] of graph.outgoingBranchEdges(current)) {
+      for (const edge of edges) {
+        if (seen.has(edge.target)) continue;
+        seen.add(edge.target);
+        tree.set(edge.target, { parent: current, via: transition.name });
+        queue.push(edge.target);
+      }
+    }
+  }
+  return tree;
+}
+function pathTo(tree, target) {
+  const classes = [];
+  const transitions = [];
+  for (let cur = target; cur !== void 0; ) {
+    classes.push(cur);
+    const edge = tree.get(cur);
+    if (edge === void 0) break;
+    transitions.push(edge.via);
+    cur = edge.parent;
+  }
+  return { classes: classes.reverse(), transitions: transitions.reverse() };
+}
+function findCycle(graph, tree) {
+  const edgesOf = (sc) => {
+    const out = [];
+    for (const [t, edges] of graph.outgoingBranchEdges(sc)) for (const e of edges) out.push([t.name, e.target]);
+    return out;
+  };
+  const position = /* @__PURE__ */ new Map([[graph.initialClass, 0]]);
+  const stack = [{ node: graph.initialClass, edges: edgesOf(graph.initialClass), next: 0, via: null }];
+  while (stack.length > 0) {
+    const top = stack[stack.length - 1];
+    if (top.next >= top.edges.length) {
+      position.set(top.node, -1);
+      stack.pop();
+      continue;
+    }
+    const [via, target] = top.edges[top.next++];
+    const at = position.get(target);
+    if (at === void 0) {
+      position.set(target, stack.length);
+      stack.push({ node: target, edges: edgesOf(target), next: 0, via });
+    } else if (at >= 0) {
+      const loop = stack.slice(at);
+      const stem = pathTo(tree, target);
+      const cycle = [...loop.slice(1).map((f) => f.via), via];
+      return {
+        kind: "termination",
+        subject: "termination",
+        detail: `a run can repeat ${cycle.join(" \u2192 ")} forever without coming to rest`,
+        transitions: [...stem.transitions, ...cycle],
+        markings: [...stem.classes.map((c) => c.marking), ...loop.slice(1).map((f) => f.node.marking), target.marking],
+        cycleStart: stem.transitions.length,
+        confirmed: true
+      };
+    }
+  }
+  return null;
+}
+
+// src/verification/open-net/report.ts
+function renderReport(input) {
+  const { net, closed, contract, graph, smtLines, verdict, violations } = input;
+  const lines = ["=== OPEN-NET CONTRACT VERIFICATION (VER-022) ===", ""];
+  lines.push(`Net: ${net.name}, closed by ${closed.environment.size} environment transitions over ${contract.arrivals.length} arrival groups`);
+  lines.push("Contract:", ...contract.describe());
+  if (closed.undeclared.length > 0) {
+    lines.push(`Not declared by the net: ${closed.undeclared.join(", ")} (no arc touches them; a clause there counts zero)`);
+  }
+  lines.push("");
+  if (graph === null) {
+    lines.push(`State-class graph: skipped (${input.graphSkipped ?? "class budget 0"})`);
+  } else {
+    lines.push("=== State-class graph (untimed, priority-blind) ===");
+    lines.push(graph.complete ? `  Classes: ${graph.classCount}, closed` : `  Classes: ${graph.classCount}, truncated at the class budget of ${input.maxClasses}`);
+  }
+  if (smtLines !== null) {
+    lines.push("", "=== SMT route ===", ...smtLines);
+  }
+  lines.push("", "=== RESULT ===");
+  switch (verdict.type) {
+    case "proven":
+      lines.push(`PROVEN: every quiescent marking meets the contract${contract.requiresTermination ? " and every run comes to rest" : ""} (${verdict.method})`);
+      break;
+    case "unknown":
+      lines.push(`UNKNOWN: ${verdict.reason}`);
+      break;
+    case "violated":
+      lines.push(`VIOLATED: ${violations.length} ${violations.length === 1 ? "part" : "parts"} of the contract broken`);
+      for (const v of violations) lines.push(...renderViolation(v));
+      break;
+  }
+  return lines.join("\n");
+}
+function renderViolation(v) {
+  const lines = [`  [${v.subject}] ${v.kind}: ${v.detail}`];
+  if (!v.confirmed) lines.push("    (the solver's counterexample did not replay as an ordered firing sequence)");
+  if (v.portTrace.length > 0) {
+    lines.push("    Port trace:");
+    for (const s of v.portTrace) {
+      if (v.cycleStart !== null && s.step === v.cycleStart + 1) lines.push("      -- the cycle starts here --");
+      const env = s.environment === null ? "" : s.environment === "transition" ? " [environment]" : ` [environment ${s.environment}]`;
+      const changes = s.changes.map((c) => `${c.place} ${c.delta > 0 ? "+" : ""}${c.delta}`).join(", ");
+      lines.push(`      ${s.step}. ${s.transition}${env}${changes.length > 0 ? `  ${changes}` : ""}`);
+    }
+  }
+  if (v.cycleStart !== null) {
+    const stem = v.transitions.slice(0, v.cycleStart);
+    const cycle = `then repeating ${v.transitions.slice(v.cycleStart).join(", ")}`;
+    lines.push(`    Firing sequence: ${stem.length === 0 ? cycle : `${stem.join(", ")}, ${cycle}`}`);
+  } else if (v.transitions.length > 0) {
+    lines.push(`    Firing sequence: ${v.transitions.join(", ")}`);
+  }
+  const last = v.markings.at(-1);
+  if (last !== void 0) lines.push(`    ${v.kind === "termination" ? "Marking on the cycle" : "Quiescent marking"}: ${last.toString()}`);
+  return lines;
+}
+
+// src/verification/open-net/smt-route.ts
+async function decideViaSmt(closed, contract, tracedPlaces, configure, terminationTimeoutMs) {
+  const violations = [];
+  const undecided = [];
+  const lines = [];
+  const certificates = [];
+  const net = untimed(closed.net);
+  for (const part of partsFor(closed, contract)) {
+    if (part.kind === "vacuous") {
+      lines.push(`  [${part.subject}] ${part.detail}: proven (no query needed)`);
+      continue;
+    }
+    const q = part.query;
+    let verifier = SmtVerifier.forNet(net).initialMarking(closed.initialMarking).property(q.property).sinkPlaces(...q.sinks).enumerationMaxClasses(0);
+    for (const c of q.conditional) verifier = verifier.sinkPlacesWhen(c.marker, ...c.places);
+    const result = await configure(verifier).verify();
+    const verdict = result.verdict;
+    lines.push(`  [${q.subject}] ${propertyDescription(q.property)}: ${verdict.type}` + (verdict.type === "unknown" ? ` (${verdict.reason})` : ""));
+    if (verdict.type === "unknown") undecided.push(`${q.subject}: ${verdict.reason}`);
+    else if (verdict.type === "violated") violations.push(contractViolation(closed, tracedPlaces, q.onViolated(result)));
+    else if (verdict.inductiveInvariant !== null) {
+      certificates.push({ subject: q.subject, invariant: verdict.inductiveInvariant });
+    }
+  }
+  if (contract.requiresTermination) {
+    const termination = await terminationByRanking(closed, terminationTimeoutMs);
+    if (termination.proven) {
+      lines.push(`  [termination] Firing bound (VER-019): ${termination.detail}`);
+    } else {
+      lines.push(`  [termination] Firing bound (VER-019): undecided (${termination.reason})`);
+      undecided.push(`termination: ${termination.reason}`);
+    }
+  }
+  return { violations, undecided, lines, certificates };
+}
+function untimed(net) {
+  if (isUntimed(net)) return net;
+  const transitions = [...net.transitions].map((t) => {
+    if (t.timing.type === "immediate") return t;
+    const b = Transition.builder(t.name).inputs(...t.inputSpecs).priority(t.priority).action(t.action);
+    if (t.outputSpec !== null) b.outputs(t.outputSpec);
+    for (const arc of t.inhibitors) b.inhibitor(arc.place);
+    for (const arc of t.reads) b.read(arc.place);
+    for (const arc of t.resets) b.reset(arc.place);
+    if (t.matchSpec !== null) b.match(t.matchSpec);
+    return b.build();
+  });
+  return PetriNet.builder(net.name).places(...net.places).transitions(...transitions).build();
+}
+function partsFor(closed, contract) {
+  const rest = restDeclarationOf(contract, closed);
+  const markers = waiverMarkers(contract);
+  const quiescentMarking = (result) => result.counterexampleConfirmed === true ? result.counterexampleTrace.at(-1) : void 0;
+  const witness = (result) => ({
+    transitions: [...result.counterexampleTransitions],
+    markings: [...result.counterexampleTrace],
+    cycleStart: null,
+    confirmed: result.counterexampleConfirmed === true
+  });
+  const stranding = {
+    subject: "stranding",
+    property: deadlockFree(),
+    sinks: [...rest.sinks],
+    conditional: rest.conditional,
+    onViolated: (result) => {
+      const last = quiescentMarking(result);
+      const stranded = last === void 0 ? [] : strandedNames(last, rest).map((p) => p.name);
+      return {
+        kind: "stranded",
+        subject: stranded.length === 0 ? "stranding" : stranded.join(", "),
+        detail: stranded.length === 0 ? "the solver found a reachable quiescent marking that leaves a token where the contract lets none rest" : `${stranded.join(", ")} ${stranded.length === 1 ? "holds" : "hold"} a token at quiescence, and nothing in the contract lets one rest there`,
+        ...witness(result)
+      };
+    }
+  };
+  const parts = [{ kind: "query", query: stranding }];
+  for (const clause of contract.clauses) {
+    const across = countAcross(clause.min, clause.max, clause.places);
+    if (clause.min === 0 && clause.max === Infinity) {
+      parts.push({ kind: "vacuous", subject: clause.name, detail: `${across} at quiescence` });
+      continue;
+    }
+    const query = {
+      subject: clause.name,
+      property: quiescentCount(clause.places, clause.min, clause.max, markers),
+      sinks: [],
+      conditional: [],
+      onViolated: (result) => {
+        const last = quiescentMarking(result);
+        return {
+          kind: "clause",
+          subject: clause.name,
+          detail: last === void 0 ? `${across} at quiescence: the solver found a quiescent marking outside it` : `${across} at quiescence, found ${tokensAcross(last, clause.places)}`,
+          ...witness(result)
+        };
+      }
+    };
+    parts.push({ kind: "query", query });
+  }
+  return parts;
+}
+async function terminationByRanking(closed, timeoutMs) {
+  const flat = flatten(closed.net);
+  const initial = flat.places.map((p) => closed.initialMarking.tokens(p));
+  let solver;
+  try {
+    solver = resolveZ3();
+  } catch (e) {
+    if (e instanceof Z3Unavailable) return { proven: false, reason: e.message };
+    throw e;
+  }
+  const ask = async (script) => {
+    try {
+      const reply = await runZ3Text(solver, script, "ranking", timeoutMs, []);
+      const answer = firstLine(reply.stdout);
+      if (answer === "sat" || answer === "unsat" || answer === "unknown") return reply.stdout;
+      return new Error(failureReason(reply, timeoutBudget(timeoutMs)));
+    } catch (e) {
+      rethrowIfProgrammingError(e);
+      return new Error(String(e?.message ?? e));
+    }
+  };
+  const ranking = await findFiringBound(flat, initial, ask);
+  switch (ranking.kind) {
+    case "bound":
+      return {
+        proven: true,
+        detail: `every run has at most ${ranking.bound.bound} firings (${formatRanking(flat, ranking.bound)} drops on every firing)`
+      };
+    case "unbounded":
+      return {
+        proven: false,
+        reason: ranking.repeatable === null ? "no firing bound: no weights drop on every firing" : `no firing bound: the marking equation lets ${ranking.repeatable.map((t) => flat.transitions[t].name).join(", ")} repeat`
+      };
+    case "rejected":
+      return { proven: false, reason: "the firing-bound ranking failed the exact re-check" };
+    case "unknown":
+      return { proven: false, reason: "the firing-bound query answered unknown" };
+    case "failed":
+      return { proven: false, reason: ranking.reason };
+  }
+}
+function firstLine(stdout) {
+  return stdout.split("\n").find((line) => line.trim() !== "")?.trim() ?? "";
+}
+
+// src/verification/open-net/verify-open-net.ts
+var DEFAULT_MAX_CLASSES = 5e4;
+var METHOD_ENUMERATION = "open-net contract by state-space enumeration (VER-022)";
+var METHOD_SMT = "open-net contract by the SMT pipeline (VER-022)";
+var SKIPPED_BY_BUDGET = "class budget 0";
+var SKIPPED_BY_MATCH = "the closed net declares match (\u03BD-join) transitions, which the graph does not model";
+async function verifyOpenNet(net, contract, options = {}) {
+  const start = performance.now();
+  const closed = closeOpenNet(net, contract);
+  const maxClasses = options.maxClasses ?? DEFAULT_MAX_CLASSES;
+  const useSmt = options.smt ?? true;
+  const tracedPlaces = contract.places();
+  const graphSkipped = [...closed.net.transitions].some((t) => t.matchSpec !== null) ? SKIPPED_BY_MATCH : maxClasses > 0 ? null : SKIPPED_BY_BUDGET;
+  const graph = graphSkipped === null ? decideOnGraph(closed, contract, maxClasses, tracedPlaces) : null;
+  const result = (verdict, route, violations, smtLines) => ({
+    verdict,
+    violations,
+    route,
+    classCount: graph?.classCount ?? 0,
+    graphComplete: graph?.complete ?? false,
+    report: renderReport({ net, closed, contract, maxClasses, graph, graphSkipped, smtLines, verdict, violations }),
+    closedNet: closed.net,
+    closedMarking: closed.initialMarking,
+    elapsedMs: performance.now() - start
+  });
+  if (graph !== null) {
+    if (graph.violations.length > 0) {
+      return result({ type: "violated" }, "enumeration", graph.violations, null);
+    }
+    if (graph.complete) {
+      return result({ type: "proven", method: METHOD_ENUMERATION, inductiveInvariant: null }, "enumeration", [], null);
+    }
+  }
+  const why = graph !== null ? `the state-class graph did not close within ${maxClasses} classes` : graphSkipped === SKIPPED_BY_BUDGET ? "the state-class graph was skipped" : `the state-class graph was skipped: ${graphSkipped}`;
+  if (!useSmt) {
+    return result({ type: "unknown", reason: `${why}, and the SMT route is disabled` }, "enumeration", [], null);
+  }
+  const smt = await decideViaSmt(
+    closed,
+    contract,
+    tracedPlaces,
+    options.configureSmt ?? ((v) => v),
+    options.terminationTimeoutMs ?? 6e4
+  );
+  if (smt.violations.length > 0) return result({ type: "violated" }, "smt", smt.violations, smt.lines);
+  if (smt.undecided.length === 0) {
+    return result(
+      { type: "proven", method: METHOD_SMT, inductiveInvariant: combineCertificates(smt.certificates) },
+      "smt",
+      [],
+      smt.lines
+    );
+  }
+  return result(
+    { type: "unknown", reason: `${why}; left undecided by the SMT route: ${smt.undecided.join("; ")}` },
+    "smt",
+    [],
+    smt.lines
+  );
+}
+function combineCertificates(certificates) {
+  if (certificates.length === 0) return null;
+  return certificates.map((c) => `[${c.subject}] ${c.invariant}`).join("\n");
+}
 export {
   DBM,
   DUMP_ENV,
@@ -428,6 +1146,8 @@ export {
   MarkingState,
   MarkingStateBuilder,
   NOTE_ENUMERATED,
+  OpenNetContract,
+  OpenNetContractBuilder,
   SmtVerifier,
   StateClass,
   StateClassGraph,
@@ -445,6 +1165,7 @@ export {
   canonicalInvariantOrder,
   checkCertificate,
   checkLinearBoundExact,
+  closeOpenNet,
   computePInvariants,
   computePSemiflows,
   computeSCCs,
@@ -482,11 +1203,13 @@ export {
   placeBound,
   placeholderCertificate,
   propertyDescription,
+  quiescentCount,
   replayCounterexample,
   resolveZ3,
   rethrowIfProgrammingError,
   runZ3Spacer,
   runZ3Text,
+  strandedPlaces,
   strandingExcuses,
   strandsToken,
   strengthenWithSemiflows,
@@ -494,6 +1217,7 @@ export {
   terminatesAtSink,
   unreachable,
   vcScript,
+  verifyOpenNet,
   verifyViaStateClassGraph,
   violationDemand,
   z3Available,