whatif

Re-run a stored sim_prompt against the SAME parent it originally ran against — a sibling attempt, never a chain: it never derives from the previous attempt's output, only from the original parent, so rerolling ten times leaves ten independent siblings in lineage rather than a chain of ten. Reuses the original prompt's text and system unless you override them here; a prompt with no requestTemplate (stored before sim_prompt said a stored prompt is readable by anyone with its id) has them withheld from every read, so only its author (its lineage's wasAttributedTo) may reroll it reusing them, and anyone else passes text, and system when it has one, of their own. The parent rides along as sim_prompt sends it, withheld fields left out unless you are its author. The original prompt and its result are left untouched; this stores a new prompt and a new result (model or artifact, same rule as sim_prompt) under Activity sim_reroll, and returns the same fields sim_prompt does: a model's warnings, an artifact's content inline, and modelErrors when the reply was model JSON that failed. When called with neither override and the deployment's LLM provider and model are unchanged since the original ran, the response carries a reproducibility field. If the request template (the instruction and settings sim_prompt sends; a prompt's requestTemplate) is unchanged too, it is checked against every prior result this exact prompt has ever produced (via the same forward "produced" relation sim_edges/sim_neighbors can query directly): "verified" if this result content-matches one of them, "diverged" if it doesn't, "not verified" if there's no prior result on record yet. If the template changed since the original ran, it is "not comparable", and the run is stored under a new promptId. Needs sign-in (opens OAuth the first time). Refused if this deployment has no LLM provider configured. The new prompt is readable as sim_prompt's is: without sign-in, by anyone with its id or a result's.

Returns one scenario result per model that a set of stored Bindings (see sim_bind) touches, run as a composed pipeline (each result's contention split into contended, waitingForWork and neverFired exactly as sim_scenario's is), with the assumptions the composition makes, inTransit (per delayed binding, the source's flow its delay carried past the horizon) and, when the set holds a loop, the loop's reading (loop, pipeline-loop-v1: verdict, claim, components with sweepsNeeded and sweepsRun, sweepsRun, residual). Costs 1 compute token per model run, charged up front, before any model is read, for the most runs the set can take — one per model outside a loop, and a loop's models times the most sweeps it can take — and not refunded when a loop settles in fewer. Defaults: hours 8, seed 1, realizations 0 (one SSA trajectory per model; set it, e.g. 16 as sim_scenario does, since bindings and loops couple means). Caps: hours up to 10000, realizations up to 200, as sim_scenario. Each model runs through its own ordinary scenario in topological order, an output port's trajectory resampled into the target's input-transition schedule, one seed and horizon shared by every model (the discipline sim_compare enforces within one model). A declared conversion is applied exactly as declared: the resampled rate is multiplied by any numeric transform, then by the convert factor. A binding with a delay drives its target that many hours later; before then the target runs on its own declared rate. A loop between models runs only when some binding on it declares a delay. It is solved by sweeps, each running every member once with one delayed binding (cut) driven by the previous sweep, until a sweep reproduces the previous one's schedules bit for bit: verdict fixed-point, whose claim (also assumptions' first line) is that this is the unique fixed point of the coupling over 0 to hours at the seed, followed by its four limits — each model was driven by the other's mean across realizations (mean-field: for joint dynamics build one net with sim_extend), each delay is declared, not measured, before its delay a target ran on its declared rate, and nothing is claimed past the horizon (a fixed point can be a loop that grows; read the series). Verdict stopped means a run hit the step budget or token cap (from sweep 2 on, typically a loop whose gain is above 1, which grows every sweep; in sweep 1, before any feedback has gone round the loop, the model itself at these hours and realizations) and not-settled is a defect to report; neither carries steps, and models after the loop are not run. Refused before anything is charged or read, each refusal naming the value and the bound: more than 64 binding ids; realizations or hours out of range (the text sim_scenario gives); and the set-level refusals, whose tool error starts with its code — a loop with no delayed binding (closes-loop), two bindings into one input (port-taken), more than one binding into a model (segment-cap: each becomes a schedule of up to 61 segments, and a scenario holds at most 100), a loop of more than 4 models (loop-too-large), a loop whose total delay does not exceed one resample interval (hours/60) per binding (loop-lag), one needing more than 24 sweeps (loop-horizon), loops needing more than 48 model runs together (run-cap); loop-lag and loop-horizon name the delay that would run at these hours and the most hours that run at this delay, and sim_system's view of a system holding the loop reports that most as maxHours. Refused after the charge (which pays for reading the models) and before anything runs: any binding that fails the check sim_bind applies (binds-port-v1; v2 for a unit conversion; v3 for a delay; a binding recorded before a check may be refused here by the same text), and a delayed binding whose target declares so many schedule segments before the delay ends that its schedule would pass the cap at these hours (segment-cap, code first as above). Every result names its seams: no model's own fitness gates cover the join, one unit line per binding (units agree; converted, naming the factor; or unchecked where a port declares no port.unit), and that a binding couples means: a driven model ran on its source's mean, so its std_dev is its own spread given that mean, not the joint system's. A driven model's resampled schedule keeps one random stream per realization across its segments, so splitting a run into segments adds nothing where no rate changes; the resampling itself is a piecewise-constant approximation of the source's mean, which smooths anything shorter than one resample window (hours/60). Public: no sign-in; writes nothing.

Run a seeded what-if scenario against a stored model: marking overrides, rate overrides, piecewise rate schedules, and params assignments to the model's declared structural parameters (arc weights, capacities — batch sizes and shelf sizes). Pure read — asking cannot change the model. Returns trajectory, final marking, metrics, depleted, contended, waitingForWork, neverFired (all three described below), caveats and assumptions. "samples" (default 60) is the trajectory's resolution: the number of evenly spaced points from 0 to hours inclusive at which times and every place's series (mean and std_dev per point) are reported — it sizes the answer, not the run, since metrics (throughput, mean, p95, utilization, inFlight) are time-weighted over every firing and do not change with the grid. "summary": true omits the times and series arrays entirely (the keys are absent, not null) and returns just final, finalStdDev, metrics, depleted, contended, waitingForWork, neverFired, caveats and assumptions — the verdict without the chart data, and the right form when nothing will be plotted. finalStdDev, summarized or not, is each place's spread across realizations at the horizon beside final's mean (absent at one realization and on the ode engine). Transitions declaring stages (phase-type durations) run with the declared lower spread — the engine expands them structurally and reports in the model's own vocabulary. A model-declared schedule (the day shape on a transition) is honored by every run; the scenario's own schedule or rate override still wins for that transition. "engine" picks the reading: "ssa" (default, discrete Gillespie — the right choice whenever counts are small enough that variance is the answer, or a schedule is in play) or "ode" (continuous mass-action; refuses a schedule, and refuses outright rather than silently misread a model carrying a read arc, inhibitor, reached capacity, guard or non-kinetic arc — Forecast's caveats name which). See docs/engine-selection.md for the full decision rule, including why an arc weight above 1 gets a genuinely different rate law from each engine, and sim_crosscheck to run both readings side by side. Contention arrives split three ways. contended holds only what the run was short of, something an operator could buy more of: kind conserved (a fixed pool such as staff) or bounded (a shelf with a declared capacity), each entry with fraction (the share of the run, across every realization, in which that place was the only input missing for the transitions under blocking), longest wait first. waitingForWork holds the engine's other entries in the same shape, and neither of its kinds is a shortage: queue (filled only by the model's own flow, such as waiting customers or work in service) means the work had not arrived, a statement about demand; state (a marker of which phase of a cycle the model is in, such as a stoplight's colour) means the model was in another phase. neverFired is one note per entry whose place never held a token in any run and whose transitions never fired, e.g. "work" never fired in any run: its input "q" never held a token. A queue or state entry like that appears only as its note; a conserved or bounded one keeps its contended row as well, since the run was short of it. The run cannot tell why a place stayed empty. Either it starts empty and nothing fills it (check its initial count and what produces it), or its producer was switched off (a rate of 0, or a scenario marking of 0 on it or upstream of it), or what fills it is rarer than this run's hours and realizations can sample (raise either; once the place fills, the note goes). sim_receipt and the HTTP scenario routes return the engine's unsplit contended list instead, each entry with its kind.

Mark an old version of your model as replaced by a newer one. The old id keeps working and its commons dedication (if any) stands — only the listing moves on to the successor. Both models must be yours. It also records a supersededBy edge (old → new), so sim_edges(old) and sim_neighbors(old, "supersededBy") show that the supersession happened. Re-pointing an old model to a different successor keeps the earlier edge too, and these edges carry no timestamp, so their order says nothing about which came last: the current successor is the `current` this tool returns (the model's own supersededBy record), not the edge list. Taxonomic edges on the old model are offered for migration to the current successor (sim_migration_offers, accepted with sim_accept_migration), never moved; structural and tool-written edges stay with it.

Returns a stored System's view ({id}), the models whose ports can bind to one declared port ({model, port, direction?, among?}), or the stored systems that name a model or a binding ({naming}); one form per call. {id}: the system's view, computed now and never stored (system-view-v2): each model (present, superseded), each binding with its binds-port check (v1, or v2 with its convert when it declares a unit conversion, or v3 with its delay when it declares one) and whether the set runs as a pipeline (with its loops and maxHours when it holds one), the isomorphicTo/subnetOf edges among the models with up to 128 witnesses re-checked (past that the view is truncated and the rest read unchecked), and the shape — one-net when one member has every other embedded in it by a direct witnessed edge or a chain of edges of one predicate through any stored model, every hop's witness and the composed map re-checked (net, embeddings: a direct one names edge and witness, a chained one its derivation, which sim_check_witness(derivation=…) re-checks; closure says what the chain search cost; sim_reach then answers on that net), pipeline when it holds bindings (they link rates, not tokens: sim_reach answers unknown), separate otherwise (notOneNet says why; a chain mixing subnetOf and isomorphicTo hops does not count), unknown when the witness bound was reached before any member qualified, or the chain search stopped at its hop, model or work bound (closure-incomplete: not a no). {model, port, direction?, among?}: what can bind to that declared port — every model with a port sim_bind would accept against it without a unit conversion (opposite direction, equal kind, units agreeing where both declare one), ranked units-agree first, then model id and port; each row carries the sim_bind arguments. A port whose declared unit differs is counted under excluded as unit-differs, not listed: it binds only through sim_bind with convertFrom, convertTo and convertFactor (binds-port-v2), and an empty answer means none binds without one. The universe is the visible catalog, or among (a collection's model members, at most 256, or a system's models, where a candidate that would take a bound port or close a loop of undelayed bindings is counted under excluded, never listed, and one that closes a loop already holding a delayed binding is listed with closesLoop: bindable-v3). Every model in the universe is searched (bindable-v2; bindable-v3 among a system), through a port index that keeps each model's ports by direction and kind, read once per content id and synced from the listing on every call (a model another instance stored is searched on the next call). At most 256 models the index does not hold yet are read per call (past it status is truncated with bound fetches and unscanned says how many were left; ask again and it continues), 100000 candidate ports checked and 50 rows listed: past any bound status is truncated, and if a member model cannot be read status is incomplete (listed under unreadable); in both cases the rows are in partialRows. candidates, scanned, unscanned, fromIndex, read and portChecks say exactly how far it searched; the index holds at most 16777216 bytes of ports (of which at most 2097152 for models no catalog-wide search has listed, such as an among search's or the asked model's) and at most 65536 bytes for one model, and a model past any of these is searched but not kept (notKept). The call's token covers its first 64 reads; each further 64 cost one more token, charged before they are read, and when the bucket cannot cover them status is truncated with bound rate. {naming}: every stored system whose models or bindings include that id (as: model or binding), sorted by system id, from an index synced from the store's listing on every call (a system another instance stored is seen on the next read). At most 100 systems listed (past it status is truncated, total says how many) and at most 256 not-yet-read systems fetched per call (past it status is incomplete and unindexed says how many are unread; ask again and it continues); the index holds at most 33554432 bytes of systems, and once full nothing more is indexed on that instance (status incomplete, unindexed says how many, and asking again does not change it); a stored system that cannot be decoded also keeps status incomplete (listed under unreadable), and asking again does not clear it; in every case the rows are in partialSystems. A system cannot be named (systems do not nest) and a collection is refused, naming the remedy; an id no entity holds any more (a deleted model) is answered when a system still names it. Systems are linkable and collectable: sim_link puts one in a collection (hasMember) and relates it with cites, about, broader and related. This is not refines: a system's edges are isomorphicTo and subnetOf (embeds by wiring / is the same coloured net). refines (trace inclusion with transitions matched by id) and preservesInvariant (the object's P-invariants pull back along an embedding) are proved one pair at a time by sim_prove and are never walked by closure, since neither is declared transitive. For "what contains this pattern?" ask sim_query with closure: {"select":["?m"],"where":[{"subject":"<pattern id>","predicate":"subnetOf","object":"?m","mode":"closure"}]} (isomorphicTo for copies; add {"subject":"<collection>","predicate":"hasMember","object":"?m"} to scope it), each row carrying a derivation sim_check_witness re-checks; a subnetOf row claims no behaviour inclusion. For "what does this model refine?" ask sim_query for one hop: {"select":["?m"],"where":[{"subject":"<model id>","predicate":"refines","object":"?m"}]}, each row an edge sim_prove recorded. A loop between models runs only through a binding that declares a delay (sim_bind delay; ROADMAP.md Phase 12j): a system may hold one, of at most 4 models, and its view lists it under pipeline.loops with pipeline.maxHours, the longest horizon sim_run_pipeline runs it at (0 when no horizon of 0.01 h or more does; pipeline.runnable covers only the checks that do not depend on the hours), where it is solved as an exact fixed point over the horizon (pipeline-loop-v1). A loop with no delayed binding is refused when a system is defined and by sim_run_pipeline, and sim_bind refuses a self-binding. A port search with among a system (bindable-v3) lists a candidate that closes a loop already holding a delayed binding, with that loop's models under closesLoop, and counts one that would close a loop of undelayed bindings under excluded as closes-loop (sim_bind with a delay can close it); a catalog or collection search does not consult stored bindings, so sim_create_system or sim_run_pipeline is where such a loop is refused. Public: no sign-in; costs 1 compute token (a port search, 1 more per 64 models read past its first 64); writes nothing.

Verify declared properties of a stored model: a report with one verdict per property, proved, refuted or unknown (unknown is never a pass, and ok is true only when every property is proved), with evidence for a proof and a counterexample for a refutation, plus caveats naming anything the analysis net could not express. Unset properties check bounded and deadlock-free. Every check starts from the model's own initial marking. Each verdict's method says how far it reaches. structural: from the incidence matrix, with no state search. A structural bounded holds for every initial marking (every place is covered by a P-invariant), and so does a structural conserves (the token total is a P-invariant). A structural invariant or mutual-exclusion verdict rests on a P-invariant's value at this initial marking (its evidence names the P-invariant and the value), so it holds from this marking and from any other that gives that P-invariant the same value, not from every marking: two workers sharing one lock token are proved mutually exclusive, and the same net with two lock tokens is refuted. exhaustive: every state reachable from this initial marking. witness: a firing sequence found by targeted search, decisive for this initial marking (a cycle that grows a place without bound). partial: the search was truncated, so only a refutation is sound. To ask about another starting marking, store the model with that marking (sim_extend's set_initial) and verify it. Read the Verification properties section of sim://docs/authoring for each kind's fields. Free (no compute token); writes nothing.