vj-codegen 0.1.0

//! Expression lowering: exhaustive dispatch over the P0 subset
//! (`IntegerLiteral` / `NamedValue` / `BinaryOp` for AND/OR/XOR/ADD/DIV/SHL),
//! falling through to a `LoweringError` (never a panic, never a silent
//! no-op) for anything outside that subset.
use crate::types::TypeWidth;
use std::collections::HashMap;
use sv_sim_sim::symid::SymbolUid;

use inkwell::AddressSpace;
use inkwell::IntPredicate;
use inkwell::builder::Builder;
use inkwell::context::Context;
use inkwell::module::{Linkage, Module};
use inkwell::values::{IntValue, PointerValue};

use crate::accessor::AccessorFns;

// Corrected vs. plan: `ExpressionKind::Binary` does not exist -- the real
// discriminant (verified against sv-lang's own doctest on
// `Expression::kind`) is `ExpressionKind::BinaryOp`. And `BinaryOp` (the
// *operator* enum: Add, BinaryAnd, ...) is not re-exported from
// `sv_lang::kinds` alongside the AST-node `*Kind` enums -- it lives at the
// `sv-lang` crate's own top level (`sv_lang::BinaryOp`), so it needs its own
// `use`.
use sv_lang::BinaryOp;
use sv_lang::KnownSystemName;
use sv_lang::MethodFlags;
use sv_lang::UnaryOp;
use sv_lang::kinds::ExpressionKind;
use sv_sim_runtime::file_io::{
    SV_RT_FEOF_SYMBOL, SV_RT_FOPEN_MCD_SYMBOL, SV_RT_FOPEN_SYMBOL, SV_RT_FSEEK_SYMBOL,
    SV_RT_SYSTEM_SYMBOL,
};
use sv_sim_runtime::plusargs::{SV_RT_PLUSARGS_TEST_SYMBOL, SV_RT_PLUSARGS_VALUE_SYMBOL};

use crate::error::LoweringError;
use crate::ops::{OpBuilder, is_definitely_false, is_definitely_true, ternary_is_definitely_true};
use crate::types::{LoweredType, int_type, lower_type};
use crate::value::{AnyValue, PackedValue, RealValue, ValueRepr, WideValueRef};

// Task 8 (CG-037): `lower_expr` now produces either an integral
// `PackedValue` or a floating `RealValue` -- a real `Conversion` node
// (int->real / real->int) can only be lowered by `lower_expr` itself (it is
// one `ExpressionKind::Conversion` match arm among the others below), so the
// whole function's return type must be able to carry either kind rather
// than only ever a `PackedValue`. Every existing arm is unaffected in
// substance, just wrapped in `LoweredValue::Packed`; every existing
// recursive call site unwraps via `into_packed` (all of this crate's other
// operators are integral-only, so an operand that turns out to be a real
// value at one of those sites is itself a loud `LoweringError`, never a
// panic).
// Review fix r2 (CG-016/CG-019/CG-129, blocking finding): `lower_expr`'s
// only two production constant-lowering call sites (the `IntegerLiteral`
// arm below and the CG-042 constant-fold `Call` arm) used to call
// `const_svint` directly, which `panic!`s past `WIDE_THRESHOLD` -- so
// `OpBuilder::lower_const_any` (Task 15's actual narrow/wide dispatch
// point) had zero callers in the real `lower_function`/`lower_expr` path,
// and a legal >128-bit SV literal crashed the compiler process instead of
// producing a diagnosable error. `LoweredValue` gains a third `Wide`
// variant so both call sites can route through `lower_const_any` and
// return `AnyValue::Wide` losslessly instead of either panicking or lying
// about the result being narrow. Full wide-value *consumption* (arithmetic
// ops, `return`-by-value ABI) is Task 16+ scope (no wide arithmetic exists
// yet for a `Wide` value to feed into) -- every existing consumer of
// `LoweredValue` (`into_packed`/`into_real`/`func.rs`'s `Return` lowering)
// treats `Wide` the same way it already treats a `Real` value at an
// integral-only site: a loud, named `LoweringError`, never a panic, never a
// silent truncation to narrow.
#[derive(Clone, Copy)]
pub enum LoweredValue<'ctx> {
    Packed(PackedValue<'ctx>),
    Real(RealValue<'ctx>),
    Wide(WideValueRef<'ctx>),
    /// An SV `string` (`crate::strings`).
    Str(crate::strings::StrValue<'ctx>),
    /// A vector wider than `WIDE_THRESHOLD` bits: a memory image
    /// (`crate::huge`), not an LLVM integer.
    Huge(crate::huge::HugeValue<'ctx>),
}

impl<'ctx> LoweredValue<'ctx> {
    pub fn into_packed(
        self,
        what: &str,
        sym: &sv_lang::Symbol,
    ) -> Result<PackedValue<'ctx>, LoweringError> {
        match self {
            LoweredValue::Packed(p) => Ok(p),
            LoweredValue::Real(_) | LoweredValue::Wide(_) | LoweredValue::Str(_) => {
                Err(LoweringError::unsupported_at(what, sym))
            }
            LoweredValue::Huge(h) => Err(LoweringError::unsupported_at(
                &format!(
                    "{what} -- the operand is a {}-bit vector, wider than the wide-value \
                     threshold (LRM 1800-2023 6.9.1), which this construct does not support",
                    h.width
                ),
                sym,
            )),
        }
    }

    pub fn into_real(
        self,
        what: &str,
        sym: &sv_lang::Symbol,
    ) -> Result<RealValue<'ctx>, LoweringError> {
        match self {
            LoweredValue::Real(r) => Ok(r),
            LoweredValue::Packed(_)
            | LoweredValue::Wide(_)
            | LoweredValue::Str(_)
            | LoweredValue::Huge(_) => Err(LoweringError::unsupported_at(what, sym)),
        }
    }
}

// --- Task 7 (CG-034, CG-035, CG-036, CG-038, CG-075): Conversion node
// dispatch classification.

/// The number of `ConversionKind` ordinals this crate's `conversion_kind()`
/// dispatch is pinned against, verified directly against the vendored
/// `sv-lang` 0.1.9 C++ source (`include/slang/ast/Expression.h`'s
/// `CK(x)` enum-generator macro): `Implicit`=0, `Propagated`=1,
/// `StreamingConcat`=2, `Explicit`=3, `BitstreamCast`=4 -- five variants,
/// not the three the plan originally enumerated. CG-075: a `sv-lang`
/// version bump that renumbers or adds a `ConversionKind` variant must show
/// up here as a visible diff (this constant, and `classify_conversion_kind`
/// below, are the single place that range is consulted), never as a silent
/// mis-lowering.
pub const CONVERSION_KIND_COUNT: u32 = 5;

/// What `lower_expr`'s `Conversion` arm does with a given `conversion_kind()`
/// ordinal. Kept as a free function over a raw `u32` (rather than inlined
/// into `lower_expr`'s match) so CG-075's "never panics on an out-of-range
/// value" guarantee is directly unit-testable without needing a live
/// `sv_lang::Expression` that produces one -- real `sv-lang` never emits a
/// value outside `0..CONVERSION_KIND_COUNT` today, so the only way to
/// exercise the catch-all arm is to call this function directly with a
/// synthetic out-of-range ordinal.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum ConversionAction {
    /// `Implicit`(0) / `Propagated`(1) / `Explicit`(3): an ordinary value
    /// conversion (width extend/truncate, 4-state->2-state flatten, sign
    /// reinterpretation) -- this task's own lowering.
    Value,
    /// `StreamingConcat`(2): a streaming concatenation assigned to its
    /// target type (`crate::stream::lower_stream_conversion`).
    Stream,
    /// `BitstreamCast`(4): a bit-stream cast between types of equal
    /// bit-stream width (`crate::stream::lower_bitstream_cast`).
    BitstreamCast,
}

pub fn classify_conversion_kind(kind: u32) -> Result<ConversionAction, String> {
    match kind {
        0 | 1 | 3 => Ok(ConversionAction::Value),
        2 => Ok(ConversionAction::Stream),
        4 => Ok(ConversionAction::BitstreamCast),
        other => Err(format!(
            "conversion_kind {other} is outside the pinned 0..{CONVERSION_KIND_COUNT} range \
             (Implicit=0/Propagated=1/StreamingConcat=2/Explicit=3/BitstreamCast=4) -- vendored \
             sv-lang may have added or renumbered a ConversionKind variant"
        )),
    }
}

// Task 17 (CG-022): `RangeSelect`'s `range_selection_kind()` ordinal
// dispatch, same pinned-count-plus-exhaustive-fallthrough shape as
// `CONVERSION_KIND_COUNT`/`classify_conversion_kind` above -- verified
// against the vendored sv-lang 0.1.9 C++ source (`include/slang/ast/
// SemanticFacts.h`'s `RANGE(x)` enum-generator macro:
// `x(Simple) x(IndexedUp) x(IndexedDown)`, so `Simple`=0, `IndexedUp`=1,
// `IndexedDown`=2 -- matches the Rust binding's own doc comment on
// `Expression::range_selection_kind`). A future sv-lang version that adds a
// fourth `RangeSelectionKind` variant must show up here as a visible diff,
// never as a silent mis-lowering of an out-of-range ordinal.
pub const RANGE_SELECTION_KIND_COUNT: u32 = 3;

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum RangeSelectionKindClass {
    /// `v[l:r]`, both bounds compile-time constant.
    Simple,
    /// `v[base +: w]`: low end is `base` itself, `w` compile-time constant.
    IndexedUp,
    /// `v[base -: w]`: low end is `base - (w - 1)`, `w` compile-time constant.
    IndexedDown,
}

pub fn classify_range_selection_kind(kind: u32) -> Result<RangeSelectionKindClass, String> {
    match kind {
        0 => Ok(RangeSelectionKindClass::Simple),
        1 => Ok(RangeSelectionKindClass::IndexedUp),
        2 => Ok(RangeSelectionKindClass::IndexedDown),
        other => Err(format!(
            "range_selection_kind {other} is outside the pinned 0..{RANGE_SELECTION_KIND_COUNT} \
             range (Simple=0/IndexedUp=1/IndexedDown=2) -- vendored sv-lang may have added or \
             renumbered a RangeSelectionKind variant"
        )),
    }
}

/// Reads a compile-time-constant integral expression's value as an `i64`
/// (`constant_value()` -> `as_integer()` -> `as_i64()`, the same chain the
/// `BinaryOp::Power` const-exponent path already uses), or a named
/// `LoweringError` if the expression is not one -- both simple part-select
/// bounds and every indexed part-select/replication WIDTH are required by
/// the LRM to be compile-time constants (slang itself already enforces
/// this during elaboration, so a failure here means either a genuinely
/// dynamic-width source slang would have rejected, or a >64-bit/X-Z-
/// containing constant `as_i64()` itself already refuses to represent).
pub(crate) fn require_const_i64<'d>(
    e: sv_lang::Expression<'d>,
    what: &str,
    sym: &sv_lang::Symbol<'d>,
) -> Result<i64, LoweringError> {
    e.constant_value()
        .as_ref()
        .and_then(sv_lang::ConstantValue::as_integer)
        .and_then(sv_lang::SVInt::as_i64)
        .ok_or_else(|| LoweringError::unsupported_at(what, sym))
}

// Deviation from plan (discovered running Task 8, not covered by the
// preflight corrections): a single `'ctx` on `LowerCtx` forces the sv-lang
// `Design`/`Symbol` lifetime to unify with the unrelated LLVM `Context`
// lifetime the moment a real caller with two independently-scoped locals
// (`Context` and `Design`) constructs one -- `fn_sym: Symbol<'ctx>` makes
// that unification a hard struct-field constraint. It went undetected in
// Task 7 because that task's own test never actually builds a `LowerCtx`.
// Give sv-lang handles their own lifetime, `'d`, independent of `'ctx`.
// Task 12 (CG-134/135/136/137), deviation from plan: `LowerCtx` grows a third
// lifetime `'m` and a `module: &'m Module<'ctx>` field -- `BinaryOp::Power`'s
// runtime-exponent path (`pow4_call`) needs to declare/reuse the shared
// `sv_ipow_{u,s}N` helper IN THE MODULE BEING LOWERED, and nothing before
// this task threaded a `Module` reference through `LowerCtx` (every earlier
// task's `Module` access was confined to `func.rs`'s `lower_function`, which
// never needed to hand it down into expression lowering). `'m` is kept
// independent of `'ctx`/`'d` for the same reason `'d` was split from `'ctx`
// in Task 8: the caller's `Module` local need not live exactly as long as
// the `Context` or `Design` locals.
pub struct LowerCtx<'ctx, 'd, 'm> {
    pub ctx: &'ctx Context,
    pub b: Builder<'ctx>,
    pub repr: ValueRepr,
    pub locals: HashMap<sv_sim_sim::symid::SymbolId, (PointerValue<'ctx>, u32, bool)>,
    /// The enclosing function/task symbol, cited via `hierarchical_path()` in
    /// every `LoweringError` fallthrough so a diagnosable location is never
    /// lost to the `"<expr>"` placeholder (ARCHITECTURE.md §6.1, "Exhaustive
    /// dispatch").
    pub fn_sym: sv_lang::Symbol<'d>,
    /// The LLVM `Module` this expression is being lowered into -- needed
    /// only by `BinaryOp::Power`'s runtime-exponent path so far (Task 12),
    /// but threaded through generally since any future op needing a shared
    /// cross-call helper (Task 21's `EntityTag::Helper` machinery) will need
    /// the same access.
    pub module: &'m Module<'ctx>,
    /// R-run Task 13 (ST-009/ST-024/ST-114): every `SignalSlotClass::Memory`
    /// (fixed-size unpacked array) symbol this expression tree might
    /// reference, by [`sv_sim_sim::symid::SymbolId`] -- consulted by the
    /// `ElementSelect`/`Assignment` arms below to recognize a dynamically
    /// (or constant) indexed memory access (`mem[i]`) and route it through
    /// [`MemAccessorCtx`]/`accessor::build_get_mem_word`/`build_set_mem_word`
    /// instead of the ordinary `locals`-keyed scalar/bit-select path (a
    /// memory has no single value `locals` could ever hold). Empty for every
    /// caller with no external memories in scope (`func.rs`'s own local
    /// subroutine-compilation pipeline, every test that builds no `Memory`
    /// signal) -- deliberately NOT keyed together with `locals` in one map,
    /// since a `Memory` symbol is never validly read/written as a whole
    /// value the way every `locals` entry is.
    pub mem_signals: HashMap<sv_sim_sim::symid::SymbolId, MemorySignalInfo>,
    /// The `(handle, accessor fns)` pair needed to actually emit a
    /// `build_get_mem_word`/`build_set_mem_word` call -- `None` whenever
    /// `mem_signals` is empty (no external memory can be referenced, so no
    /// accessor context is ever needed); `Some` at every `process_lower.rs`
    /// call site that built a nonempty `mem_signals`.
    pub mem_accessor: Option<MemAccessorCtx<'ctx, 'm>>,
    /// The current value of a compound assignment's target (`a += b` is
    /// elaborated as `a = <LValueReference> + b`), read by the
    /// `LValueReference` arm. Set only while lowering that assignment's RHS.
    pub lvalue_ref: std::cell::Cell<Option<LoweredValue<'ctx>>>,
    /// While a deferred immediate assertion's action is lowered (LRM 16.4.1):
    /// the `i64` slot holding where the action's captured output starts, or
    /// `u64::MAX` before the action's first printing call has evaluated its
    /// arguments. The arguments are evaluated when the assertion fails, so
    /// what they print (a function called in them) is not part of the
    /// deferred report; `crate::process_lower::mark_deferred_args_done` moves
    /// the start past it.
    pub deferred_start: std::cell::Cell<Option<PointerValue<'ctx>>>,
    /// The value of `$` (`q[$]`, `q[1:$]`): the last index of the queue
    /// whose selector is being lowered (`crate::collections`).
    pub unbounded: std::cell::Cell<Option<IntValue<'ctx>>>,
    /// The shadow copy of a queue / dynamic-array element while a write into
    /// PART of it (`d[i][j] = v`, `q[i].f = v`, `d[i][3] = b`) resolves: the
    /// partial target's root is this temporary, which [`store_to_releasing`]
    /// writes back to the element (LRM 7.4.5, 7.5, 7.10).
    pub coll_temp: std::cell::Cell<Option<inkwell::values::PointerValue<'ctx>>>,
    /// The iterator variables of the array methods whose `with` clauses
    /// are being lowered (`item` in `q.find(item) with (item > 3)`), each
    /// with its current element and index (`item.index`), innermost last
    /// (`crate::array_methods`).
    #[allow(clippy::type_complexity)]
    pub iter: std::cell::RefCell<
        Vec<(
            sv_sim_sim::symid::SymbolId,
            LoweredValue<'ctx>,
            LoweredValue<'ctx>,
        )>,
    >,
    /// The enclosing loops' `continue` and `break` targets, innermost last
    /// (loops lowered straight-line: every loop of a function, and a
    /// suspend-free `repeat` in a process -- a process's other loops are
    /// `process::cfg` blocks, whose `break`/`continue` are CFG jumps).
    pub loop_exits: Vec<(
        inkwell::basic_block::BasicBlock<'ctx>,
        inkwell::basic_block::BasicBlock<'ctx>,
    )>,
    /// The enclosing named blocks a `disable <block>;` can leave (LRM
    /// 1800-2023 §9.6.2), innermost last, each with its exit block. Only a
    /// subroutine body fills this: a process's `disable` is a CFG jump.
    pub block_exits: Vec<(String, inkwell::basic_block::BasicBlock<'ctx>)>,
    /// Set for a process kernel's segments: every blocking write to a
    /// module signal's shadow copy is also committed to STATE on the spot
    /// (see [`WriteThrough`]). `None` for functions and continuous assigns.
    pub write_through: Option<WriteThrough<'ctx, 'm>>,
    /// The variables a process shares with its fork branches: each one's
    /// cell pointer (an `i64` `alloca`) and its size in bytes, keyed like
    /// `locals` (whose entry is the value's working copy).
    pub cells: HashMap<sv_sim_sim::symid::SymbolId, (PointerValue<'ctx>, u32)>,
    /// A static subroutine's `output`/`inout`/`ref` formals: (its signal
    /// copy, the caller's temporary, size in bytes) -- copied back before every
    /// return.
    pub copy_out: Vec<(PointerValue<'ctx>, PointerValue<'ctx>, IntValue<'ctx>)>,
    /// The `ref` formals bound to a queue / dynamic-array element, keyed by
    /// the formal's frame local (LRM 1800-2023 13.5.2): every read of the
    /// local first refreshes it from the element and every write is put back
    /// (`crate::collections::elem_ref_refresh` / `elem_ref_flush`). Empty
    /// unless a process inlines such a call.
    pub elem_refs: HashMap<PointerValue<'ctx>, crate::collections::ElemRefSlot<'ctx>>,
    /// Classes plan Task 5 (review fix r2): while [`crate::classes::
    /// lower_new_class`] is lowering ONE OF ITS OWN property initializers
    /// (LRM 1800-2023 §8.7), this holds the handle of the object JUST
    /// ALLOCATED -- so [`crate::classes::try_read_bare_field`]/
    /// [`crate::classes::try_write_field`]'s bare-field resolution (an
    /// `int b = a + 1;` initializer referencing an earlier sibling
    /// property by bare name) reads/writes THAT object, never whatever
    /// `this` happens to be lexically ambient at the `new` expression's own
    /// call site. A `Cell`, not a `cx.locals` entry, because every
    /// expression-lowering call site threads `cx` by shared reference
    /// (`&LowerCtx`, never `&mut`) -- this is the same scoped-override-
    /// through-interior-mutability shape `lvalue_ref`/`unbounded` above
    /// already use, not a new pattern. `None` at every other call site (an
    /// ordinary method body, a continuous assign, ...), where bare-field
    /// resolution falls through unchanged to `current_this_var`/
    /// `cx.locals`. Save/restored (never unconditionally cleared) around
    /// each property's own initializer, so a `new` nested inside one
    /// property's initializer unwinds back to the OUTER object's handle,
    /// not to `None`, before that outer object's own next field is lowered.
    pub ctor_this: std::cell::Cell<Option<IntValue<'ctx>>>,
    /// The `(unit, precision)` exponents of the inlined subroutine whose body the statement being
    /// lowered was written in, when that is not the process's own scope: a delay in it is in the
    /// declaring scope's time unit (LRM 3.14.2.1), see [`crate::timescale::lower_delay_ticks`].
    pub decl_scale: std::cell::Cell<Option<(i32, i32)>>,
    /// The `this` of the class-method task inlined at the segment being
    /// lowered (`process::cfg::BasicBlock::this_var`), for a process that is
    /// not itself a method: what [`crate::classes::current_this_var`] falls
    /// back to.
    pub inline_this: Option<sv_lang::Symbol<'d>>,
    /// Inside an assertion leaf: the 0/1 flag of each end-point application
    /// (`s.triggered`) in its expression, by the instance's source offset
    /// (`sva::emit`'s `prime_end_flags`); empty everywhere else.
    pub end_flags: std::cell::RefCell<HashMap<u64, PointerValue<'ctx>>>,
    /// Task 4b (`docs/superpowers/plans/2026-10-03-sdf.md`): a specify-path
    /// VARIABLE destination's own staging-cell foreign [`crate::
    /// process_lower::SignalSlot`] (`ProcessLoweringPlan::
    /// specify_dest_redirect`, carried over unchanged) -- consulted ONLY by
    /// [`crate::select::resolve_lvalue`]'s `RootMode::Signal` branch and
    /// [`crate::process_lower::lower_nonblocking_assignment`]'s own fast-
    /// path exclusion, both keyed off a NONBLOCKING write's own lvalue
    /// symbol; never read by any other `LowerCtx` consumer. Empty at every
    /// construction site that does not build a module-level process kernel
    /// from a real `ProcessLoweringPlan` (a function/task body, a DPI
    /// thunk, a continuous assign) -- none of those can ever name a
    /// specify-path destination (LRM 30.4.1 restricts one to a module
    /// member written by a procedural block), so this field is a true
    /// no-op there, not a narrowed/unsupported case.
    pub specify_dest: HashMap<sv_sim_sim::symid::SymbolId, crate::process_lower::SignalSlot>,
}

/// Blocking writes to module signals in a process are committed to STATE
/// immediately (not only at segment end), so a same-timestep pulse such as
/// `rst = 1; rst = 0;` is a real pair of value changes other processes'
/// `@(rst)`/`$monitor` observe (LRM 1800-2023 §4.9.3/§10.4.1). The shadow
/// copy keeps serving this segment's reads.
#[derive(Clone)]
pub struct WriteThrough<'ctx, 'a> {
    pub handle: PointerValue<'ctx>,
    pub fns: &'a AccessorFns<'ctx>,
    /// A module signal's shadow `alloca` -> (region-biased slot, width,
    /// wide?).
    pub signals: HashMap<PointerValue<'ctx>, (u32, u32, bool)>,
    /// The one shared re-read block of this function's statement probes
    /// (see [`crate::vpi_dyn::SharedReload`]).
    pub reload: std::cell::RefCell<Option<crate::vpi_dyn::SharedReload<'ctx>>>,
}

/// Commits the shadow copy at `ptr` to STATE if `cx` writes through and
/// `ptr` is a module signal's shadow (see [`WriteThrough`]).
///
/// A huge shadow is committed from its dirty window only: this entry point
/// first marks the whole signal dirty (the caller wrote it anywhere); a caller
/// that knows the window it wrote marks that itself and uses
/// [`write_through_commit`].
pub(crate) fn write_through_store<'ctx>(cx: &LowerCtx<'ctx, '_, '_>, ptr: PointerValue<'ctx>) {
    crate::collections::elem_ref_flush(cx, ptr);
    if let Some(wt) = &cx.write_through
        && let Some(&(slot, width, _)) = wt.signals.get(&ptr)
        && crate::huge::is_huge_width(width)
    {
        let i64t = cx.ctx.i64_type();
        crate::huge::rt_mark(
            cx,
            wt.handle,
            slot,
            width,
            i64t.const_zero(),
            i64t.const_int(u64::from(width), false),
        );
    }
    write_through_commit(cx, ptr);
}

/// [`write_through_store`] for a huge shadow whose written window the caller
/// has already marked (`crate::huge`).
pub(crate) fn write_through_commit<'ctx>(cx: &LowerCtx<'ctx, '_, '_>, ptr: PointerValue<'ctx>) {
    let Some(wt) = &cx.write_through else {
        return;
    };
    commit_shadow(cx, wt, ptr);
}

/// Commits the shadow copy at `ptr` to STATE through `wt` (a huge one from
/// its marked windows).
pub(crate) fn commit_shadow<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    wt: &WriteThrough<'ctx, '_>,
    ptr: PointerValue<'ctx>,
) {
    let Some(&(slot, width, wide)) = wt.signals.get(&ptr) else {
        return;
    };
    if crate::huge::is_huge_width(width) {
        crate::huge::rt_commit(cx, wt.handle, slot, width);
    } else {
        let cur =
            cx.b.build_load(int_type(cx.ctx, width * 2), ptr, "wt_ld")
                .unwrap()
                .into_int_value();
        if wide {
            crate::accessor::build_set_wide(cx, wt.fns, wt.handle, slot, cur, width);
        } else {
            crate::accessor::build_set_scalar(cx, wt.fns, wt.handle, slot, cur, width);
        }
    }
    // A forced signal ignores the write (`crate::force`): the copy follows
    // STATE, not the assignment.
    if crate::force::reload_after_write() {
        reload_from_state(cx, wt, ptr);
    }
}

/// Re-reads the module signal whose shadow copy is `ptr` from STATE.
pub(crate) fn reload_from_state<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    wt: &WriteThrough<'ctx, '_>,
    ptr: PointerValue<'ctx>,
) {
    let Some(&(slot, width, wide)) = wt.signals.get(&ptr) else {
        return;
    };
    if crate::huge::is_huge_width(width) {
        // The shadow keeps its address: this only re-reads it from STATE.
        crate::huge::rt_prime(cx, wt.handle, slot, width, true);
        return;
    }
    let v = if wide {
        crate::accessor::build_get_wide(cx, wt.fns, wt.handle, slot, width)
    } else {
        crate::accessor::build_get_scalar(cx, wt.fns, wt.handle, slot, width)
    };
    cx.b.build_store(ptr, v).unwrap();
}

/// R-run Task 13: one `SignalSlotClass::Memory` signal's accessor-ABI
/// address -- the `expr.rs`-local mirror of `sv-sim-codegen::process_lower::
/// SignalSlot` restricted to the `Memory` case (kept as its own small type,
/// not a re-export of `SignalSlot` itself, since `process_lower.rs` is this
/// crate's own consumer of `expr.rs`, not the other way around, and
/// `SignalSlot`'s `class` field would otherwise have to be re-matched at
/// every `ElementSelect`/`Assignment` call site instead of narrowed once
/// where `LowerCtx::mem_signals` is built).
#[derive(Clone, Copy, Debug)]
pub struct MemorySignalInfo {
    pub slot: u32,
    /// The per-ROW element bit width (never the unpacked-array `Type`'s own
    /// `bit_width() == 0`).
    pub elem_width: u32,
    pub signed: bool,
    pub num_rows: u32,
    /// The declared unpacked range's lower bound (SV index of storage row 0).
    pub lower_index: i64,
}

/// R-run Task 13: the `(handle, accessor fns)` pair [`LowerCtx::
/// mem_accessor`] carries. A small `Copy` bundle (never the whole private
/// [`AccessorFns`]) so `expr.rs`'s `ElementSelect`/`Assignment` arms can
/// reach `accessor::build_get_mem_word`/`build_set_mem_word` without this
/// module owning any accessor-declaration logic itself.
#[derive(Clone, Copy)]
pub struct MemAccessorCtx<'ctx, 'a> {
    pub handle: PointerValue<'ctx>,
    pub fns: &'a AccessorFns<'ctx>,
}

// Task 13 (CG-042): the exact set of `KnownSystemName` variants this crate
// treats as a "pure/static system function ($bits, $size, type queries)" --
// LRM 1800-2023 SS20.6.1 ($bits) and SS20.7 (the array-query family: $low/
// $high/$left/$right/$size/$increment/$dimensions/$unpacked_dimensions).
// Deliberately NOT a wildcard/catch-all over "anything with a cached
// constant": see the `ExpressionKind::Call` arm's doc comment for why
// `$rtoi`/`$itor`/`$clog2`/etc. must stay excluded even though they too can
// sometimes be compile-time constant. Not one of this crate's three
// Kind::COUNT-pinned exhaustive-dispatch enums (`KnownSystemName` is a much
// larger, slower-moving registry, not an AST node-kind discriminant), so
// this is an explicit allowlist with a `false` default, not a fallthrough
// error -- callers that fail the allowlist get a named, specific
// `LoweringError` from the `Call` arm itself, never a silent no-op here.
fn is_cg042_type_query(name: KnownSystemName) -> bool {
    matches!(
        name,
        KnownSystemName::Bits
            | KnownSystemName::Size
            | KnownSystemName::Low
            | KnownSystemName::High
            | KnownSystemName::Left
            | KnownSystemName::Right
            | KnownSystemName::Increment
            | KnownSystemName::Dimensions
            | KnownSystemName::UnpackedDimensions
            // LRM 20.6.2 `$isunbounded`: an elaboration-time query too
            // (`$typename` folds to a string: `strings::lower_string_expr`).
            | KnownSystemName::IsUnbounded
    )
}

// --- Task F2 (RT-043 partial): `$time` / `$stime` / `$realtime` ----------

/// The frozen ABI symbol name for this task's own new runtime entry point --
/// `extern "C" fn() -> i64`, returning the scheduler's current tick count.
/// Declared here (the one place a `$time`/`$stime`/`$realtime` call needs
/// it) and referenced by full path from `pipeline.rs` (`RealBindings`'s
/// `time` field / `bind_or_skip`) exactly the way `crate::process_lower::
/// SV_RT_FINISH_SYMBOL` already is for `$finish` -- see
/// [`fetch_or_declare_sv_rt_time`]'s own doc comment for why this symbol
/// deliberately carries no `SimHandle` parameter, unlike the plan's literal
/// `sv_rt_time(state: SimHandle) -> u64` sketch.
pub const SV_RT_TIME_SYMBOL: &str = "sv_rt_time";

/// Declares (or fetches, if some earlier `$time`/`$stime`/`$realtime` call
/// in this same `Module` already did) `extern "C" fn sv_rt_time() -> i64`
/// (`SV_RT_TIME_SYMBOL`) -- mirrors `process_lower::declare_rt_finish`'s
/// "declared, never defined, in this crate" shape: a real caller
/// (`sv-sim-bin::run`) binds the real production body
/// (`sv_sim_sim::sched::kernel_adapter::real_sv_rt_time`) via
/// `Jit::add_global_mapping`, and a test supplies whatever stub it needs the
/// same way `tests/display_lowering.rs`/`tests/process_kernel_abi.rs`
/// already establish for `nba_enqueue`/`sv_rt_finish`.
///
/// **Deviation from the plan's literal `sv_rt_time(state: SimHandle) -> u64`
/// signature:** `lower_expr`/`LowerCtx` have no `SimHandle`-carrying
/// `PointerValue` in scope at an arbitrary expression-lowering call site
/// (unlike `$finish`'s STATEMENT-level lowering, which `lower_system_call_
/// statement` receives a `handle: PointerValue` argument for specifically to
/// pass through) -- threading one into `LowerCtx`/`lower_expr`'s signature
/// would touch every one of this file's ~20 recursive `lower_expr` call
/// sites and every test that hand-builds a `LowerCtx` for a reason entirely
/// unrelated to this task. It would also be dead weight: the real
/// production body reads the scheduler's current time through the same
/// `CURRENT_OPS` thread-local bridge `real_nba_enqueue`/`real_sv_rt_finish`
/// already use (`sv_sim_sim::sched::kernel_adapter`'s own doc comment), NOT
/// through `SimHandle` -- which, exactly as those two functions' own doc
/// comments already record, resolves only to STATE's arena, never to a
/// scheduler-ops handle. `real_sv_rt_finish` itself already ignores the
/// `SimHandle` its own ABI-pinned signature carries for the same reason.
/// The return type is a plain `i64` (never `u128`/packed): `$time`'s tick
/// count is never itself 4-state (a tick count is always fully known), so
/// the packing into `PackedValue`'s `i(2N)` convention (with an all-zero
/// unknown lane) happens once, at [`lower_time_system_call`]'s own call
/// site, not inside the runtime.
pub(crate) fn fetch_or_declare_sv_rt_time<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
) -> inkwell::values::FunctionValue<'ctx> {
    module.get_function(SV_RT_TIME_SYMBOL).unwrap_or_else(|| {
        let fn_ty = ctx.i64_type().fn_type(&[], false);
        module.add_function(SV_RT_TIME_SYMBOL, fn_ty, Some(Linkage::External))
    })
}

// --- Named events ---------------------------------------------------------

/// A named `event`'s cell (`sv_sim_sim::state::EVENT_CELL_WIDTH` = 128 bits,
/// 2-state): the low 64 bits count triggers, the high 64 hold `tick + 1` of
/// the most recent trigger (0 = never triggered). Returns the event's shadow
/// pointer from `cx.locals` after checking its width.
pub(crate) fn event_cell_ptr<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    target: sv_lang::Expression<'d>,
    what: &str,
) -> Result<PointerValue<'ctx>, LoweringError> {
    if !sv_sim_sim::symid::is_value_name(target.kind()) {
        return Err(LoweringError::unsupported_at(
            &format!(
                "{what}: the event operand ({:?}) must be a plain named event (event \
                 handles held in variables / hierarchical events are not supported)",
                target.kind()
            ),
            &cx.fn_sym,
        ));
    }
    let sym = target.referenced_symbol().ok_or_else(|| {
        LoweringError::unsupported_at(&format!("{what}: unresolved event name"), &cx.fn_sym)
    })?;
    if let Some(hier) = sv_sim_sim::state::event_pool::hierarchical_pool_event(&target) {
        return Err(LoweringError::unsupported_at(
            &format!(
                "{what}: the hierarchical event `{}` belongs to an instance that keeps its \
                 events in an event pool (it assigns, compares or passes an event, LRM \
                 1800-2023 15.5); another instance's access to its legacy cell would be \
                 silently lost",
                hier.name()
            ),
            &cx.fn_sym,
        ));
    }
    let (ptr, width, _) = *cx.locals.get(&sym.uid()).ok_or_else(|| {
        LoweringError::unsupported_at(
            &format!("{what}: the event is not a module-level signal of this process's scope"),
            &sym,
        )
    })?;
    if width != sv_sim_sim::state::EVENT_CELL_WIDTH {
        return Err(LoweringError::unsupported_at(
            &format!(
                "{what}: operand is a {width}-bit signal, not a named event's \
                 {}-bit cell",
                sv_sim_sim::state::EVENT_CELL_WIDTH
            ),
            &sym,
        ));
    }
    Ok(ptr)
}

/// `-> e`: increments the trigger count and stamps `tick + 1` into the high
/// half (see [`event_cell_ptr`]). Stored through the event's shadow copy;
/// the segment flushes it (`process_lower::external_refs_in_segment` records
/// an `EventTrigger` target as written).
pub(crate) fn lower_event_trigger<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    target: sv_lang::Expression<'d>,
) -> Result<(), LoweringError> {
    if crate::class_events::lower_trigger(cx, target)? {
        return Ok(());
    }
    if sv_sim_sim::netlist::vif::is_member_access(&target) {
        return crate::vif::event_trigger(cx, target);
    }
    if let Some(r) = crate::vif::event_elem_trigger(cx, target) {
        return r;
    }
    // An element of an event array (`-> ea[i]`): one row of its memory,
    // rewritten through the memory accessor; an index that is unknown or
    // out of range triggers nothing (LRM 1800-2023 7.4.6, 15.5).
    if let Some(el) = crate::arrays::resolve_event_element(cx, target)? {
        return crate::arrays::when_valid(cx, el.valid, || {
            let cur = crate::arrays::load_event_elem(cx, &el)?;
            let triggered = event_triggered_value(cx, cur);
            crate::arrays::store_event_elem(cx, &el, triggered)
        });
    }
    let ptr = event_cell_ptr(cx, target, "-> (event trigger)")?;
    let w = sv_sim_sim::state::EVENT_CELL_WIDTH;
    let packed_ty = int_type(cx.ctx, w * 2);
    let cur =
        cx.b.build_load(packed_ty, ptr, "event_cur")
            .unwrap()
            .into_int_value();
    let packed = event_triggered_value(cx, cur);
    cx.b.build_store(ptr, packed).unwrap();
    write_through_store(cx, ptr);
    Ok(())
}

/// The cell value of an event whose cell now holds `cur` (packed, see
/// [`event_cell_ptr`]) after one more trigger: the count plus one, stamped
/// with `tick + 1`.
pub(crate) fn event_triggered_value<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    cur: IntValue<'ctx>,
) -> IntValue<'ctx> {
    let w = sv_sim_sim::state::EVENT_CELL_WIDTH;
    let packed_ty = int_type(cx.ctx, w * 2);
    let val_ty = int_type(cx.ctx, w);
    let i64_ty = cx.ctx.i64_type();
    let count = cx.b.build_int_truncate(cur, i64_ty, "event_count").unwrap();
    let count =
        cx.b.build_int_add(count, i64_ty.const_int(1, false), "event_count_inc")
            .unwrap();
    let rt_time = fetch_or_declare_sv_rt_time(cx.ctx, cx.module);
    let now =
        cx.b.build_call(rt_time, &[], "event_now")
            .unwrap()
            .try_as_basic_value()
            .unwrap_basic()
            .into_int_value();
    let stamp =
        cx.b.build_int_add(now, i64_ty.const_int(1, false), "event_stamp")
            .unwrap();
    let lo = cx.b.build_int_z_extend(count, val_ty, "event_lo").unwrap();
    let hi = cx.b.build_int_z_extend(stamp, val_ty, "event_hi").unwrap();
    let hi =
        cx.b.build_left_shift(hi, val_ty.const_int(64, false), "event_hi_sh")
            .unwrap();
    let val = cx.b.build_or(lo, hi, "event_val").unwrap();
    // UNK plane (the high `w` bits of the packed value) stays 0: 2-state.
    cx.b.build_int_z_extend(val, packed_ty, "event_packed")
        .unwrap()
}

/// The packed value of watcher cell `id` (`sv_sim_sim::sva::endpoint`) read
/// through the instance handle, in a subroutine lowered on its own: the cell is
/// not one of its arguments, and the state holds the stamp the engine wrote.
fn watcher_cell_through_handle<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    id: &sv_sim_sim::symid::SymbolId,
) -> Result<IntValue<'ctx>, LoweringError> {
    let accessor = cx.mem_accessor.ok_or_else(|| {
        LoweringError::unsupported_at(
            "a sequence end-point method (`.triggered`, 16.9.11) read where no instance \
             handle is available",
            &cx.fn_sym,
        )
    })?;
    let body = sv_sim_sim::netlist::enclosing_instance_body(&cx.fn_sym).ok_or_else(|| {
        LoweringError::unsupported_at(
            "a sequence end-point method (`.triggered`, 16.9.11) read outside any instance",
            &cx.fn_sym,
        )
    })?;
    let slots = crate::module::signal_slots_of(&body)?;
    let slot = slots.get(id).ok_or_else(|| {
        LoweringError::unsupported_at(
            "a sequence end-point method (`.triggered`, 16.9.11) read in a subroutine whose \
             instance is not watched (called from no procedural block of its instance)",
            &cx.fn_sym,
        )
    })?;
    Ok(crate::accessor::build_get_wide(
        cx,
        accessor.fns,
        accessor.handle,
        slot.slot,
        slot.width,
    ))
}

/// `e.triggered` (LRM 1800-2023 §15.5.3): 1 iff `e` was triggered in the
/// current time step, i.e. its stamped `tick + 1` equals `$time + 1`.
fn lower_event_triggered<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let operands = e.operands();
    let target = *operands.first().ok_or_else(|| {
        LoweringError::unsupported_at(".triggered with no event operand", &cx.fn_sym)
    })?;
    if let Some(v) = crate::class_events::lower_triggered(cx, target)? {
        return Ok(v);
    }
    if sv_sim_sim::netlist::vif::is_member_access(&target) {
        let hit = crate::vif::event_triggered(cx, target)?;
        let op = OpBuilder {
            ctx: cx.ctx,
            b: &cx.b,
        };
        return Ok(LoweredValue::Packed(op.pack(
            hit,
            cx.ctx.bool_type().const_zero(),
            1,
            cx.repr,
            false,
        )));
    }
    if let Some(hit) = crate::vif::event_elem_triggered(cx, target) {
        let op = OpBuilder {
            ctx: cx.ctx,
            b: &cx.b,
        };
        return Ok(LoweredValue::Packed(op.pack(
            hit?,
            cx.ctx.bool_type().const_zero(),
            1,
            cx.repr,
            false,
        )));
    }
    if target.kind() == ExpressionKind::AssertionInstance
        && let Some(&slot) = cx
            .end_flags
            .borrow()
            .get(&target.source_range().start.offset)
    {
        // Inside an assertion leaf: the flag the end-point edge stored.
        let bit =
            cx.b.build_load(cx.ctx.bool_type(), slot, "end_flag")
                .unwrap()
                .into_int_value();
        let op = OpBuilder {
            ctx: cx.ctx,
            b: &cx.b,
        };
        return Ok(LoweredValue::Packed(op.pack(
            bit,
            cx.ctx.bool_type().const_zero(),
            1,
            cx.repr,
            false,
        )));
    }
    let ptr = if target.kind() == ExpressionKind::AssertionInstance {
        // A procedure reading a sequence instance's end point (16.9.11): its
        // watcher's cell (`sv_sim_sim::sva::endpoint`), stamped like a named
        // event's by the engine in the Observed region.
        let id = sv_sim_sim::sva::endpoint::watcher_id(&cx.fn_sym.uid(), &target);
        match cx.locals.get(&id) {
            Some(&(p, _, _)) => p,
            // Read in a called subroutine, which owns the watcher (the cell is
            // then read through the instance handle).
            None => {
                let cur = watcher_cell_through_handle(cx, &id)?;
                let hit = event_stamped_now(cx, cur);
                let op = OpBuilder {
                    ctx: cx.ctx,
                    b: &cx.b,
                };
                return Ok(LoweredValue::Packed(op.pack(
                    hit,
                    cx.ctx.bool_type().const_zero(),
                    1,
                    cx.repr,
                    false,
                )));
            }
        }
    } else if let Some(el) = crate::arrays::resolve_event_element(cx, target)? {
        // `ea[i].triggered`: false for an index that is unknown or out of
        // range (LRM 1800-2023 7.4.6).
        let cur = crate::arrays::load_event_elem(cx, &el)?;
        let hit = event_stamped_now(cx, cur);
        let hit =
            cx.b.build_and(hit, el.valid, "event_elem_triggered")
                .unwrap();
        let op = OpBuilder {
            ctx: cx.ctx,
            b: &cx.b,
        };
        return Ok(LoweredValue::Packed(op.pack(
            hit,
            cx.ctx.bool_type().const_zero(),
            1,
            cx.repr,
            false,
        )));
    } else {
        event_cell_ptr(cx, target, ".triggered")?
    };
    let w = sv_sim_sim::state::EVENT_CELL_WIDTH;
    let packed_ty = int_type(cx.ctx, w * 2);
    let cur =
        cx.b.build_load(packed_ty, ptr, "event_cur")
            .unwrap()
            .into_int_value();
    let hit = event_stamped_now(cx, cur);
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    Ok(LoweredValue::Packed(op.pack(
        hit,
        cx.ctx.bool_type().const_zero(),
        1,
        cx.repr,
        false,
    )))
}

/// Whether the event cell value `cur` (packed) was stamped in the current
/// time step: its high half equals `$time + 1`.
pub(crate) fn event_stamped_now<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    cur: IntValue<'ctx>,
) -> IntValue<'ctx> {
    let packed_ty = cur.get_type();
    let i64_ty = cx.ctx.i64_type();
    let hi =
        cx.b.build_right_shift(cur, packed_ty.const_int(64, false), false, "event_hi")
            .unwrap();
    let hi = cx.b.build_int_truncate(hi, i64_ty, "event_stamp").unwrap();
    let rt_time = fetch_or_declare_sv_rt_time(cx.ctx, cx.module);
    let now =
        cx.b.build_call(rt_time, &[], "event_now")
            .unwrap()
            .try_as_basic_value()
            .unwrap_basic()
            .into_int_value();
    let now1 =
        cx.b.build_int_add(now, i64_ty.const_int(1, false), "event_now1")
            .unwrap();
    cx.b.build_int_compare(IntPredicate::EQ, hi, now1, "event_triggered")
        .unwrap()
}

// --- B-runtime Task 6 (RT-078..RT-082): `$random` / `$urandom` /
// `$urandom_range` -------------------------------------------------------

/// The frozen ABI symbol name for `$random`'s real runtime entry point --
/// `extern "C" fn() -> i32`. Zero-arg by construction, exactly like
/// [`SV_RT_TIME_SYMBOL`] above and for the identical reason: no per-process
/// seed pointer exists anywhere reachable from `lower_expr`'s call site today
/// (`process::ActivationRecord` has no such field yet -- `B-core`'s `CG-176`,
/// concurrently in progress, not this track's file to add it to). The real
/// production body (`sv_sim_runtime::random_sink::real_sv_rt_random`) owns a
/// thread-local seed cell internally and is the seam that becomes a plain
/// forwarder onto a real per-process field the day `CG-176` lands -- see that
/// module's own doc comment.
pub const SV_RT_RANDOM_SYMBOL: &str = "sv_rt_random";
/// Ditto, for `$urandom`.
pub const SV_RT_URANDOM_SYMBOL: &str = "sv_rt_urandom";
/// Ditto, for `$urandom_range(hi, lo)` -- `extern "C" fn(i32, i32) -> i32`.
pub const SV_RT_URANDOM_RANGE_SYMBOL: &str = "sv_rt_urandom_range";
/// Review fix r2 (blocking finding, RT-078/079): `$random(seed)`'s LRM-legal
/// optional inout `seed` argument (IEEE 1800-2023 SS20.15.1) -- a genuinely
/// DIFFERENT ABI symbol from [`SV_RT_RANDOM_SYMBOL`] (`extern "C" fn(*mut
/// i32) -> i32`, never zero-arg), since this call form reseeds purely from
/// the passed-in variable's own current value rather than any ambient
/// per-process stream -- see `sv_sim_runtime::random::sv_rt_random_reseed`'s
/// own doc comment for the full semantics and the real-`iverilog`-verified
/// behavior it matches structurally.
pub const SV_RT_RANDOM_RESEED_SYMBOL: &str = "sv_rt_random_reseed";
/// Ditto, for `$urandom(seed)` -- `sv_sim_runtime::random::
/// sv_rt_urandom_reseed`.
pub const SV_RT_URANDOM_RESEED_SYMBOL: &str = "sv_rt_urandom_reseed";

fn fetch_or_declare_sv_rt_random<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
) -> inkwell::values::FunctionValue<'ctx> {
    module.get_function(SV_RT_RANDOM_SYMBOL).unwrap_or_else(|| {
        let fn_ty = ctx.i32_type().fn_type(&[], false);
        module.add_function(SV_RT_RANDOM_SYMBOL, fn_ty, Some(Linkage::External))
    })
}

fn fetch_or_declare_sv_rt_urandom<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
) -> inkwell::values::FunctionValue<'ctx> {
    module
        .get_function(SV_RT_URANDOM_SYMBOL)
        .unwrap_or_else(|| {
            let fn_ty = ctx.i32_type().fn_type(&[], false);
            module.add_function(SV_RT_URANDOM_SYMBOL, fn_ty, Some(Linkage::External))
        })
}

fn fetch_or_declare_sv_rt_urandom_range<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
) -> inkwell::values::FunctionValue<'ctx> {
    module
        .get_function(SV_RT_URANDOM_RANGE_SYMBOL)
        .unwrap_or_else(|| {
            let i32_ty = ctx.i32_type();
            let fn_ty = i32_ty.fn_type(&[i32_ty.into(), i32_ty.into()], false);
            module.add_function(SV_RT_URANDOM_RANGE_SYMBOL, fn_ty, Some(Linkage::External))
        })
}

fn fetch_or_declare_sv_rt_random_reseed<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
) -> inkwell::values::FunctionValue<'ctx> {
    module
        .get_function(SV_RT_RANDOM_RESEED_SYMBOL)
        .unwrap_or_else(|| {
            let i32_ty = ctx.i32_type();
            let ptr_ty = ctx.ptr_type(AddressSpace::default());
            let fn_ty = i32_ty.fn_type(&[ptr_ty.into()], false);
            module.add_function(SV_RT_RANDOM_RESEED_SYMBOL, fn_ty, Some(Linkage::External))
        })
}

fn fetch_or_declare_sv_rt_urandom_reseed<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
) -> inkwell::values::FunctionValue<'ctx> {
    module
        .get_function(SV_RT_URANDOM_RESEED_SYMBOL)
        .unwrap_or_else(|| {
            let i32_ty = ctx.i32_type();
            let ptr_ty = ctx.ptr_type(AddressSpace::default());
            let fn_ty = i32_ty.fn_type(&[ptr_ty.into()], false);
            module.add_function(SV_RT_URANDOM_RESEED_SYMBOL, fn_ty, Some(Linkage::External))
        })
}

/// Adjusts `pv` to a plain (unknown-lane-dropped), exactly-32-bit `IntValue`
/// suitable as an `i32` runtime-call argument -- `$urandom_range`'s `hi`/`lo`
/// arguments are ordinary SV integral expressions of whatever declared width
/// the source uses (`int`, a narrower `bit [3:0]`, ...), and the frozen
/// `sv_rt_urandom_range` ABI fixes both at `i32` regardless. Never branches on
/// anything but `pv.width` (CG-044's own "branch on shape, not position/
/// content" discipline, restated for this call site).
/// B-runtime Task 7 (`process_lower.rs`'s own `$fclose`/`$fflush` fd
/// marshaling reuses this verbatim, the same "one truncate/extend-to-i32
/// helper, never a second divergent one" discipline `$urandom_range`'s own
/// call sites already establish here) -- widened from `fn` to `pub(crate)
/// fn`, no other change.
pub(crate) fn packed_to_plain_i32<'ctx>(
    op: &crate::ops::OpBuilder<'_, 'ctx>,
    pv: PackedValue<'ctx>,
) -> inkwell::values::IntValue<'ctx> {
    let at_width = match pv.width.cmp(&32) {
        std::cmp::Ordering::Less => op.extend4(pv, 32, pv.signed),
        std::cmp::Ordering::Greater => op.truncate4(pv, 32),
        std::cmp::Ordering::Equal => pv,
    };
    op.lane_val(at_width)
}

/// Review fix r2 (blocking finding, RT-078/079/080): resolves `$random`/
/// `$urandom`'s optional inout `seed` argument to its local storage slot --
/// the SAME "plain `NamedValue` lvalue, loud typed error on anything else"
/// scope restriction this crate already applies to assignment/increment-
/// decrement lvalues elsewhere (the `Assignment`/pre-post-increment arms,
/// below/above) -- a bit-select/concat/non-local seed argument is real,
/// unimplemented scope, never silently accepted or misreads garbage memory.
///
/// sv-lang wraps a plain variable passed as a system-call argument in one or
/// more `ExpressionKind::Conversion` nodes (its own call-site argument-type
/// view, e.g. `integer` -> the argument's self-determined type) even when
/// the variable itself is the real, unconverted lvalue underneath -- verified
/// directly (`$random(seed)` on an `integer seed;` lowers `seed_expr.kind()`
/// as `Conversion`, not `NamedValue`, until unwrapped). This function peels
/// through every such wrapper via `conversion_operand()` before checking for
/// `NamedValue`, deliberately WITHOUT consulting the conversion node's own
/// `to_ty`/`conversion_kind()` at all: this function only ever hands back a
/// pointer to the real variable's OWN storage, at the REAL variable's own
/// declared `(width, signed)` (from `cx.locals`, not from any conversion
/// node's type view) -- [`load_seed_as_plain_i32`]/[`store_seed_from_plain_i32`]
/// already do their own correct width/sign marshaling against that real
/// declared type independently, so the outer conversion's type view is
/// simply irrelevant to this operation, never silently trusted for
/// correctness.
fn resolve_seed_lvalue<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    seed_expr: sv_lang::Expression<'d>,
    which_name: &str,
) -> Result<(PointerValue<'ctx>, u32, bool), LoweringError> {
    let mut seed_expr = seed_expr;
    // An inout seed passed to `$dist_*` arrives wrapped in an implicit
    // `Assignment` (the argument is written back); its left side is the
    // variable.
    if seed_expr.kind() == ExpressionKind::Assignment {
        seed_expr = seed_expr.left().ok_or_else(|| {
            LoweringError::unsupported_at(
                &format!("{which_name}'s seed argument assignment has no lvalue"),
                &cx.fn_sym,
            )
        })?;
    }
    while seed_expr.kind() == ExpressionKind::Conversion {
        seed_expr = seed_expr.conversion_operand().ok_or_else(|| {
            LoweringError::unsupported_at(
                &format!("{which_name}'s seed argument conversion missing operand"),
                &cx.fn_sym,
            )
        })?;
    }
    if !sv_sim_sim::symid::is_value_name(seed_expr.kind()) {
        return Err(LoweringError::unsupported_at(
            &format!(
                "{which_name}'s optional seed argument must be a plain variable (inout) lvalue, \
                 got {:?}",
                seed_expr.kind()
            ),
            &cx.fn_sym,
        ));
    }
    let sym = seed_expr.referenced_symbol().ok_or_else(|| {
        LoweringError::unsupported_at(
            &format!("{which_name}'s seed argument unresolved name"),
            &cx.fn_sym,
        )
    })?;
    cx.locals.get(&sym.uid()).copied().ok_or_else(|| {
        LoweringError::unsupported_at(
            &format!("{which_name}'s seed argument is not a local"),
            &sym,
        )
    })
}

/// Loads `seed`'s current stored value out of `slot` (`width`/`signed`/
/// `cx.repr` exactly as `cx.locals` recorded it for this variable) and
/// marshals it down to a plain, unknown-lane-dropped `i32` via
/// [`packed_to_plain_i32`] -- the SAME marshaling operation
/// `$urandom_range`'s `hi`/`lo` arguments already use, reused here rather
/// than re-derived, per this crate's own "one evaluator" discipline.
fn load_seed_as_plain_i32<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    op: &OpBuilder<'_, 'ctx>,
    slot: PointerValue<'ctx>,
    width: u32,
    signed: bool,
) -> inkwell::values::IntValue<'ctx> {
    let ty = if cx.repr == ValueRepr::FourState {
        op.i_n(width * 2)
    } else {
        op.i_n(width)
    };
    let cur_llvm =
        cx.b.build_load(ty, slot, "seed_ld")
            .unwrap()
            .into_int_value();
    let cur_pv = PackedValue {
        llvm: cur_llvm,
        width,
        repr: cx.repr,
        signed,
    };
    packed_to_plain_i32(op, cur_pv)
}

/// The inverse of [`load_seed_as_plain_i32`]: resizes the runtime call's
/// plain `i32` updated-seed result back to `width` (`result_signed`: `true`
/// for `$random`'s signed convention, `false` for `$urandom`'s unsigned one
/// -- the same per-call convention the ordinary no-seed return-value packing
/// elsewhere in this function already uses) and stores it into `slot` in
/// `cx.repr`'s own packed representation, with an all-known (never X/Z)
/// unknown lane -- the PRNG's own output is always a fully-determined value,
/// never a source of new X/Z bits.
fn store_seed_from_plain_i32<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    op: &OpBuilder<'_, 'ctx>,
    slot: PointerValue<'ctx>,
    width: u32,
    updated_i32: inkwell::values::IntValue<'ctx>,
    result_signed: bool,
) {
    // `updated_i32` is a plain integer of any width (32 for the PRNG seed
    // paths, 64 for `$value$plusargs`).
    let src_w = updated_i32.get_type().get_bit_width();
    let pv32 = op.pack(
        updated_i32,
        updated_i32.get_type().const_zero(),
        src_w,
        cx.repr,
        result_signed,
    );
    let resized = match width.cmp(&src_w) {
        std::cmp::Ordering::Less => op.truncate4(pv32, width),
        std::cmp::Ordering::Greater => op.extend4(pv32, width, result_signed),
        std::cmp::Ordering::Equal => pv32,
    };
    cx.b.build_store(slot, resized.llvm).unwrap();
    // A module variable's shadow copy is committed to STATE at once.
    write_through_store(cx, slot);
}

/// Where an inout PRNG seed argument lives: a local slot (a process or
/// function variable, or a module variable's shadow copy), or any other
/// lvalue (a class property, a struct field, a collection element ...) read
/// and written through the ordinary expression/store paths.
enum SeedPlace<'ctx, 'd> {
    Slot(PointerValue<'ctx>, u32, bool),
    Lvalue(sv_lang::Expression<'d>),
}

/// [`resolve_seed_lvalue`] extended to every lvalue (LRM 1800-2023 20.15.1:
/// the seed is an inout integral variable, e.g. a class property).
fn resolve_seed_place<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    seed_expr: sv_lang::Expression<'d>,
    which_name: &str,
) -> Result<SeedPlace<'ctx, 'd>, LoweringError> {
    let mut peeled = seed_expr;
    if peeled.kind() == ExpressionKind::Assignment {
        peeled = peeled.left().ok_or_else(|| {
            LoweringError::unsupported_at(
                &format!("{which_name}'s seed argument assignment has no lvalue"),
                &cx.fn_sym,
            )
        })?;
    }
    while peeled.kind() == ExpressionKind::Conversion {
        peeled = peeled.conversion_operand().ok_or_else(|| {
            LoweringError::unsupported_at(
                &format!("{which_name}'s seed argument conversion missing operand"),
                &cx.fn_sym,
            )
        })?;
    }
    let is_local = sv_sim_sim::symid::is_value_name(peeled.kind())
        && peeled
            .referenced_symbol()
            .is_some_and(|sym| cx.locals.contains_key(&sym.uid()));
    if is_local {
        let (slot, width, signed) = resolve_seed_lvalue(cx, seed_expr, which_name)?;
        return Ok(SeedPlace::Slot(slot, width, signed));
    }
    if !peeled.expr_type().is_some_and(|t| t.is_integral()) {
        return Err(LoweringError::unsupported_at(
            &format!("{which_name}'s seed argument must be an integral variable"),
            &cx.fn_sym,
        ));
    }
    Ok(SeedPlace::Lvalue(peeled))
}

fn load_seed_place<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    op: &OpBuilder<'_, 'ctx>,
    place: &SeedPlace<'ctx, 'd>,
) -> Result<inkwell::values::IntValue<'ctx>, LoweringError> {
    match *place {
        SeedPlace::Slot(slot, width, signed) => {
            Ok(load_seed_as_plain_i32(cx, op, slot, width, signed))
        }
        SeedPlace::Lvalue(lv) => {
            let pv = lower_expr(cx, lv)?
                .into_packed("a PRNG seed argument must be an integral value", &cx.fn_sym)?;
            Ok(packed_to_plain_i32(op, pv))
        }
    }
}

fn store_seed_place<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    op: &OpBuilder<'_, 'ctx>,
    place: &SeedPlace<'ctx, 'd>,
    updated_i32: inkwell::values::IntValue<'ctx>,
    result_signed: bool,
) -> Result<(), LoweringError> {
    match *place {
        SeedPlace::Slot(slot, width, _) => {
            store_seed_from_plain_i32(cx, op, slot, width, updated_i32, result_signed);
        }
        SeedPlace::Lvalue(lv) => {
            let width = lv.expr_type().map_or(32, |t| t.value_width());
            let pv32 = op.pack(
                updated_i32,
                updated_i32.get_type().const_zero(),
                32,
                cx.repr,
                result_signed,
            );
            let resized = match width.cmp(&32) {
                std::cmp::Ordering::Less => op.truncate4(pv32, width),
                std::cmp::Ordering::Greater => op.extend4(pv32, width, result_signed),
                std::cmp::Ordering::Equal => pv32,
            };
            store_to(cx, lv, LoweredValue::Packed(resized))?;
        }
    }
    Ok(())
}

/// `$random`/`$urandom`/`$urandom_range` (LRM 1800-2023 §20.15.1): lowers to
/// a real runtime call against [`fetch_or_declare_sv_rt_random`]/
/// [`fetch_or_declare_sv_rt_urandom`]/[`fetch_or_declare_sv_rt_urandom_range`]
/// -- NEVER a compile-time fold (unlike CG-042's type queries; each call must
/// genuinely execute the runtime PRNG, or two `$display($urandom)` calls in
/// the same process would print the same folded value forever). RT-082's own
/// negative requirement means this function's numeric OUTPUT is never
/// compared against any other simulator anywhere in this crate's own tests --
/// only same-seed same-sv-sim-run reproducibility is (see
/// `sv_sim_runtime::random`'s own module doc, and
/// `crates/sv-sim-harness/tests/random_e2e.rs`).
///
/// Review fix r2 (blocking finding): `$random`/`$urandom` also accept an
/// LRM-legal optional inout `seed` argument (IEEE 1800-2023 §20.15.1) that
/// was previously silently discarded regardless of whether the source passed
/// one -- both arms below now inspect `e.children()` and, when a seed
/// argument is present, lower a genuinely different call against
/// [`fetch_or_declare_sv_rt_random_reseed`]/
/// [`fetch_or_declare_sv_rt_urandom_reseed`] instead, via
/// [`resolve_seed_lvalue`]/[`load_seed_as_plain_i32`]/
/// [`store_seed_from_plain_i32`]. `$urandom_range` has no such argument in
/// the LRM and is unaffected.
fn lower_random_system_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    which: KnownSystemName,
    e: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    match which {
        KnownSystemName::Random => {
            if let Some(seed_node) = e.children().first() {
                let seed_expr = seed_node.as_expression().ok_or_else(|| {
                    LoweringError::unsupported_at(
                        "$random's seed argument is not an expression",
                        &cx.fn_sym,
                    )
                })?;
                let place = resolve_seed_place(cx, seed_expr, "$random")?;
                let seed_i32 = load_seed_place(cx, &op, &place)?;
                let scratch =
                    crate::types::entry_alloca_in(&cx.b, cx.ctx.i32_type(), "random_seed_scratch");
                cx.b.build_store(scratch, seed_i32).unwrap();
                let rt_fn = fetch_or_declare_sv_rt_random_reseed(cx.ctx, cx.module);
                let raw =
                    cx.b.build_call(rt_fn, &[scratch.into()], "rt_random_reseed_call")
                        .unwrap()
                        .try_as_basic_value()
                        .unwrap_basic()
                        .into_int_value();
                let updated_i32 =
                    cx.b.build_load(cx.ctx.i32_type(), scratch, "random_seed_after")
                        .unwrap()
                        .into_int_value();
                store_seed_place(cx, &op, &place, updated_i32, true)?;
                return Ok(LoweredValue::Packed(op.pack(
                    raw,
                    cx.ctx.i32_type().const_zero(),
                    32,
                    cx.repr,
                    true,
                )));
            }
            let rt_fn = fetch_or_declare_sv_rt_random(cx.ctx, cx.module);
            let raw =
                cx.b.build_call(rt_fn, &[], "rt_random_call")
                    .unwrap()
                    .try_as_basic_value()
                    .unwrap_basic()
                    .into_int_value();
            Ok(LoweredValue::Packed(op.pack(
                raw,
                cx.ctx.i32_type().const_zero(),
                32,
                cx.repr,
                true,
            )))
        }
        KnownSystemName::URandom => {
            if let Some(seed_node) = e.children().first() {
                let seed_expr = seed_node.as_expression().ok_or_else(|| {
                    LoweringError::unsupported_at(
                        "$urandom's seed argument is not an expression",
                        &cx.fn_sym,
                    )
                })?;
                // LRM 18.13.1: `$urandom (int seed)` takes an ordinary integral
                // expression (`$urandom(254)`); only a plain variable is also
                // written back with the advanced seed (the existing inout view).
                let mut peeled = seed_expr;
                while peeled.kind() == ExpressionKind::Conversion {
                    match peeled.conversion_operand() {
                        Some(o) => peeled = o,
                        None => break,
                    }
                }
                let seed_var = if sv_sim_sim::symid::is_value_name(peeled.kind())
                    && peeled
                        .referenced_symbol()
                        .is_some_and(|sym| cx.locals.contains_key(&sym.uid()))
                {
                    Some(resolve_seed_lvalue(cx, seed_expr, "$urandom")?)
                } else {
                    None
                };
                let seed_i32 = match seed_var {
                    Some((slot, width, signed)) => {
                        load_seed_as_plain_i32(cx, &op, slot, width, signed)
                    }
                    None => match lower_expr(cx, seed_expr)? {
                        LoweredValue::Packed(pv) => packed_to_plain_i32(&op, pv),
                        _ => {
                            return Err(LoweringError::unsupported_at(
                                "$urandom's seed expression wider than a packed value",
                                &cx.fn_sym,
                            ));
                        }
                    },
                };
                let scratch =
                    crate::types::entry_alloca_in(&cx.b, cx.ctx.i32_type(), "urandom_seed_scratch");
                cx.b.build_store(scratch, seed_i32).unwrap();
                let rt_fn = fetch_or_declare_sv_rt_urandom_reseed(cx.ctx, cx.module);
                let raw =
                    cx.b.build_call(rt_fn, &[scratch.into()], "rt_urandom_reseed_call")
                        .unwrap()
                        .try_as_basic_value()
                        .unwrap_basic()
                        .into_int_value();
                let updated_i32 =
                    cx.b.build_load(cx.ctx.i32_type(), scratch, "urandom_seed_after")
                        .unwrap()
                        .into_int_value();
                if let Some((slot, width, _)) = seed_var {
                    store_seed_from_plain_i32(cx, &op, slot, width, updated_i32, false);
                }
                return Ok(LoweredValue::Packed(op.pack(
                    raw,
                    cx.ctx.i32_type().const_zero(),
                    32,
                    cx.repr,
                    false,
                )));
            }
            let rt_fn = fetch_or_declare_sv_rt_urandom(cx.ctx, cx.module);
            let raw =
                cx.b.build_call(rt_fn, &[], "rt_urandom_call")
                    .unwrap()
                    .try_as_basic_value()
                    .unwrap_basic()
                    .into_int_value();
            Ok(LoweredValue::Packed(op.pack(
                raw,
                cx.ctx.i32_type().const_zero(),
                32,
                cx.repr,
                false,
            )))
        }
        KnownSystemName::URandomRange => {
            let children = e.children();
            let (hi_node, rest) = children.split_first().ok_or_else(|| {
                LoweringError::unsupported_at(
                    "$urandom_range call has no arguments (needs at least `hi`)",
                    &cx.fn_sym,
                )
            })?;
            let hi_expr = hi_node.as_expression().ok_or_else(|| {
                LoweringError::unsupported_at(
                    "$urandom_range's `hi` argument is not an expression",
                    &cx.fn_sym,
                )
            })?;
            let hi_pv = lower_expr(cx, hi_expr)?.into_packed(
                "$urandom_range's `hi` argument must be an integral value",
                &cx.fn_sym,
            )?;
            let hi_i32 = packed_to_plain_i32(&op, hi_pv);
            let lo_i32 = if let Some(lo_node) = rest.first() {
                let lo_expr = lo_node.as_expression().ok_or_else(|| {
                    LoweringError::unsupported_at(
                        "$urandom_range's `lo` argument is not an expression",
                        &cx.fn_sym,
                    )
                })?;
                let lo_pv = lower_expr(cx, lo_expr)?.into_packed(
                    "$urandom_range's `lo` argument must be an integral value",
                    &cx.fn_sym,
                )?;
                packed_to_plain_i32(&op, lo_pv)
            } else {
                // LRM: `lo` defaults to 0 when omitted.
                cx.ctx.i32_type().const_zero()
            };
            let rt_fn = fetch_or_declare_sv_rt_urandom_range(cx.ctx, cx.module);
            let raw =
                cx.b.build_call(
                    rt_fn,
                    &[hi_i32.into(), lo_i32.into()],
                    "rt_urandom_range_call",
                )
                .unwrap()
                .try_as_basic_value()
                .unwrap_basic()
                .into_int_value();
            Ok(LoweredValue::Packed(op.pack(
                raw,
                cx.ctx.i32_type().const_zero(),
                32,
                cx.repr,
                false,
            )))
        }
        other => unreachable!(
            "lower_random_system_call is only ever invoked (by lower_expr's Call arm, above) for \
             KnownSystemName::{{Random,URandom,URandomRange}} -- got {other:?}"
        ),
    }
}

/// The frozen ABI symbol for every `$dist_*` function -- one entry point
/// selected by `kind` (the `sv_sim_runtime::random::DIST_*` constants):
/// `extern "C" fn(kind: i32, seed: *mut i32, a: i32, b: i32) -> i32`.
pub const SV_RT_DIST_SYMBOL: &str = "sv_rt_dist";

/// Maps a `$dist_*` system function name to `(kind, parameter count)`.
fn dist_kind(name: &str) -> Option<(i32, usize)> {
    use sv_sim_runtime::random as r;
    Some(match name.trim_start_matches('$') {
        "dist_uniform" => (r::DIST_UNIFORM, 2),
        "dist_normal" => (r::DIST_NORMAL, 2),
        "dist_exponential" => (r::DIST_EXPONENTIAL, 1),
        "dist_poisson" => (r::DIST_POISSON, 1),
        "dist_chi_square" => (r::DIST_CHI_SQUARE, 1),
        "dist_t" => (r::DIST_T, 1),
        "dist_erlang" => (r::DIST_ERLANG, 2),
        _ => return None,
    })
}

/// `$dist_uniform/normal/exponential/poisson/chi_square/t/erlang(seed, ...)`
/// (LRM 1800-2023 20.15.2): the inout `seed` goes through the same
/// load / scratch / store-back marshaling as `$random(seed)`; the result is
/// a signed 32-bit `integer`. Never compile-time folded.
fn lower_dist_system_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    (kind, nparams): (i32, usize),
    name: &str,
    e: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let children = e.children();
    if children.len() != nparams + 1 {
        return Err(LoweringError::unsupported_at(
            &format!("{name} takes a seed and {nparams} parameter(s)"),
            &cx.fn_sym,
        ));
    }
    let i32_ty = cx.ctx.i32_type();
    let mut params = Vec::new();
    for node in &children[1..] {
        let ex = node.as_expression().ok_or_else(|| {
            LoweringError::unsupported_at(
                &format!("{name}'s argument is not an expression"),
                &cx.fn_sym,
            )
        })?;
        let pv = lower_expr(cx, ex)?.into_packed(
            &format!("{name}'s arguments must be integral values"),
            &cx.fn_sym,
        )?;
        params.push(packed_to_plain_i32(&op, pv));
    }
    params.resize(2, i32_ty.const_zero());
    let seed_expr = children[0].as_expression().ok_or_else(|| {
        LoweringError::unsupported_at(
            &format!("{name}'s seed argument is not an expression"),
            &cx.fn_sym,
        )
    })?;
    let place = resolve_seed_place(cx, seed_expr, name)?;
    let seed_i32 = load_seed_place(cx, &op, &place)?;
    let scratch = crate::types::entry_alloca_in(&cx.b, i32_ty, "dist_seed_scratch");
    cx.b.build_store(scratch, seed_i32).unwrap();
    let rt_fn = fetch_or_declare_sv_rt_dist(cx.ctx, cx.module);
    let raw =
        cx.b.build_call(
            rt_fn,
            &[
                i32_ty.const_int(kind as u64, false).into(),
                scratch.into(),
                params[0].into(),
                params[1].into(),
            ],
            "rt_dist_call",
        )
        .unwrap()
        .try_as_basic_value()
        .unwrap_basic()
        .into_int_value();
    let updated =
        cx.b.build_load(i32_ty, scratch, "dist_seed_after")
            .unwrap()
            .into_int_value();
    store_seed_place(cx, &op, &place, updated, true)?;
    Ok(LoweredValue::Packed(op.pack(
        raw,
        i32_ty.const_zero(),
        32,
        cx.repr,
        true,
    )))
}

fn fetch_or_declare_sv_rt_dist<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
) -> inkwell::values::FunctionValue<'ctx> {
    module.get_function(SV_RT_DIST_SYMBOL).unwrap_or_else(|| {
        let i32_ty = ctx.i32_type();
        let ptr_ty = ctx.ptr_type(AddressSpace::default());
        let fn_ty = i32_ty.fn_type(
            &[i32_ty.into(), ptr_ty.into(), i32_ty.into(), i32_ty.into()],
            false,
        );
        module.add_function(SV_RT_DIST_SYMBOL, fn_ty, Some(Linkage::External))
    })
}

// --- B-runtime Task 7 (RT-050/RT-051): `$fopen(path, mode)` -------------

/// Fetches (or, on first use in this `Module`, declares) the `extern "C"`
/// shim function for `$fopen` -- `int32_t sv_rt_fopen(const char *path,
/// const char *mode)`, matching `sv_sim_runtime::file_io::sv_rt_fopen`'s real
/// production symbol exactly. Mirrors [`fetch_or_declare_sv_rt_random`]'s
/// identical fetch-or-declare discipline just above.
fn fetch_or_declare_sv_rt_fopen<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
) -> inkwell::values::FunctionValue<'ctx> {
    module.get_function(SV_RT_FOPEN_SYMBOL).unwrap_or_else(|| {
        let ptr_ty = ctx.ptr_type(AddressSpace::default());
        let i32_ty = ctx.i32_type();
        let fn_ty = i32_ty.fn_type(&[ptr_ty.into(), ptr_ty.into()], false);
        module.add_function(SV_RT_FOPEN_SYMBOL, fn_ty, Some(Linkage::External))
    })
}

/// Fetch-or-declare `int32_t sv_rt_fopen_mcd(const char *path)`, the
/// single-argument (multichannel descriptor) form of `$fopen`.
fn fetch_or_declare_sv_rt_fopen_mcd<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
) -> inkwell::values::FunctionValue<'ctx> {
    module
        .get_function(SV_RT_FOPEN_MCD_SYMBOL)
        .unwrap_or_else(|| {
            let ptr_ty = ctx.ptr_type(AddressSpace::default());
            let i32_ty = ctx.i32_type();
            let fn_ty = i32_ty.fn_type(&[ptr_ty.into()], false);
            module.add_function(SV_RT_FOPEN_MCD_SYMBOL, fn_ty, Some(Linkage::External))
        })
}

/// `$fopen(path, mode)` (RT-050/RT-051): both arguments must be
/// string-literal constants in this crate's own scope -- forwarded through
/// `crate::systask`'s already-tested [`crate::systask::lower_format_expr`]
/// (never a second, divergent string-literal-lowering implementation for
/// the same purpose; that function already implements exactly the needed
/// "constant string-literal argument, named loud error otherwise" contract,
/// CG-046's own literal-only scope note applied here identically -- a
/// dynamic, non-literal `$fopen` path/mode is out of this task's scope, the
/// same restriction `$dumpfile`'s own path argument already has).
///
/// LRM 21.3.1 has two forms with two different return kinds: `$fopen(path,
/// mode)` returns an fd (bit 31 set) and `$fopen(path)` returns a
/// multichannel descriptor (one bit per open file, opened for writing). They
/// call two distinct runtime symbols so each keeps its own table; any other
/// arity is a named, loud `LoweringError`.
fn lower_fopen_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let operands = e.operands();
    let call = match operands.len() {
        1 => {
            let path_ptr = crate::systask::lower_format_expr(cx, operands[0])?;
            let rt_fn = fetch_or_declare_sv_rt_fopen_mcd(cx.ctx, cx.module);
            cx.b.build_call(rt_fn, &[path_ptr.into()], "rt_fopen_mcd_call")
                .unwrap()
        }
        2 => {
            let path_ptr = crate::systask::lower_format_expr(cx, operands[0])?;
            let mode_ptr = crate::systask::lower_format_expr(cx, operands[1])?;
            let rt_fn = fetch_or_declare_sv_rt_fopen(cx.ctx, cx.module);
            cx.b.build_call(rt_fn, &[path_ptr.into(), mode_ptr.into()], "rt_fopen_call")
                .unwrap()
        }
        n => {
            return Err(LoweringError::unsupported_at(
                &format!(
                    "$fopen takes (path) for a multichannel descriptor or (path, mode) for a file \
                     descriptor (LRM 21.3.1), got {n} arguments"
                ),
                &cx.fn_sym,
            ));
        }
    };
    let raw = call.try_as_basic_value().unwrap_basic().into_int_value();
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    Ok(LoweredValue::Packed(op.pack(
        raw,
        cx.ctx.i32_type().const_zero(),
        32,
        cx.repr,
        true,
    )))
}

/// `$system(["cmd"])` (LRM 20.17): runs the command through the host shell and
/// yields the C `system()` result as an `int`. The command must be a string
/// literal (like `$fopen`'s path); `$system()` with no argument is
/// `system(NULL)`, i.e. "is a shell available".
fn lower_system_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let operands = e.operands();
    let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
    let cmd_ptr = match operands.len() {
        0 => ptr_ty.const_null(),
        1 => crate::systask::lower_format_expr(cx, operands[0])?,
        n => {
            return Err(LoweringError::unsupported_at(
                &format!("$system takes at most one argument (LRM 20.17), got {n}"),
                &cx.fn_sym,
            ));
        }
    };
    let rt_fn = cx
        .module
        .get_function(SV_RT_SYSTEM_SYMBOL)
        .unwrap_or_else(|| {
            let fn_ty = cx.ctx.i32_type().fn_type(&[ptr_ty.into()], false);
            cx.module
                .add_function(SV_RT_SYSTEM_SYMBOL, fn_ty, Some(Linkage::External))
        });
    let call =
        cx.b.build_call(rt_fn, &[cmd_ptr.into()], "rt_system_call")
            .unwrap();
    let raw = call.try_as_basic_value().unwrap_basic().into_int_value();
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    Ok(LoweredValue::Packed(op.pack(
        raw,
        cx.ctx.i32_type().const_zero(),
        32,
        cx.repr,
        true,
    )))
}

// --- B-runtime Task 9 (RT-061/RT-063): `$fseek`/`$feof` ------------------
//
// **Scope note (documented, not silent):** these two are the ONLY read-side
// system calls this task wires all the way through codegen/the real JIT
// pipeline -- see `sv_sim_runtime::file_io::read`'s own module doc for why
// `$fgets`/`$fscanf`/`$sscanf`/`$ferror`/`$fread`/`$rewind` are NOT (each
// needs either a raw output-buffer pointer marshaled from an actual SV
// variable, a capability that does not exist anywhere in this pipeline
// today, or -- `$rewind` alone -- reconciling a genuinely void ABI with
// `sv-lang`'s own function-call grammar for no functional gain over
// `$fseek(fd, 0, 0)`, already covered by the `$fseek` path below).
// `$fseek(fd, offset, operation)` and `$feof(fd)` take/return only plain
// scalars, exactly like `$fopen(path, mode)` above, so they follow that same
// "system FUNCTION, dispatched from `expr.rs`'s `lower_expr`" pattern
// mechanically.

/// Fetches (or declares) `int32_t sv_rt_fseek(int32_t fd, int64_t offset,
/// int32_t whence)`, matching `sv_sim_runtime::file_io::read::sv_rt_fseek`'s
/// real production symbol exactly.
fn fetch_or_declare_sv_rt_fseek<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
) -> inkwell::values::FunctionValue<'ctx> {
    module.get_function(SV_RT_FSEEK_SYMBOL).unwrap_or_else(|| {
        let i32_ty = ctx.i32_type();
        let i64_ty = ctx.i64_type();
        let fn_ty = i32_ty.fn_type(&[i32_ty.into(), i64_ty.into(), i32_ty.into()], false);
        module.add_function(SV_RT_FSEEK_SYMBOL, fn_ty, Some(Linkage::External))
    })
}

/// `$fseek(fd, offset, operation)` (RT-061): all three arguments are
/// ordinary dynamic integral expressions (never required to be compile-time
/// constants, unlike `$fopen`'s string-literal-only path/mode) -- LRM's own
/// `offset`/`operation` are plain `integer` (32-bit), so both lower through
/// the same `packed_to_plain_i32` helper `$fclose`/`$fflush`'s fd argument
/// already uses (`process_lower.rs::lower_file_io_void_call`); `offset` is
/// then sign-extended to the frozen ABI's own wider `i64` (this crate's own
/// choice, RT-061's own doc note: files larger than 2^31 bytes are a real,
/// if unusual, case the narrower LRM type would otherwise truncate).
fn lower_fseek_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let operands = e.operands();
    if operands.len() != 3 {
        return Err(LoweringError::unsupported_at(
            "$fseek requires exactly three arguments (fd, offset, operation)",
            &cx.fn_sym,
        ));
    }
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let fd_pv = lower_expr(cx, operands[0])?
        .into_packed("$fseek's fd argument must be an integral value", &cx.fn_sym)?;
    let fd_i32 = packed_to_plain_i32(&op, fd_pv);
    let offset_pv = lower_expr(cx, operands[1])?.into_packed(
        "$fseek's offset argument must be an integral value",
        &cx.fn_sym,
    )?;
    let offset_i32 = packed_to_plain_i32(&op, offset_pv);
    let offset_i64 =
        cx.b.build_int_s_extend(offset_i32, cx.ctx.i64_type(), "fseek_offset_sext")
            .unwrap();
    let whence_pv = lower_expr(cx, operands[2])?.into_packed(
        "$fseek's operation argument must be an integral value",
        &cx.fn_sym,
    )?;
    let whence_i32 = packed_to_plain_i32(&op, whence_pv);

    let rt_fn = fetch_or_declare_sv_rt_fseek(cx.ctx, cx.module);
    let raw =
        cx.b.build_call(
            rt_fn,
            &[fd_i32.into(), offset_i64.into(), whence_i32.into()],
            "rt_fseek_call",
        )
        .unwrap()
        .try_as_basic_value()
        .unwrap_basic()
        .into_int_value();
    Ok(LoweredValue::Packed(op.pack(
        raw,
        cx.ctx.i32_type().const_zero(),
        32,
        cx.repr,
        true,
    )))
}

/// Fetches (or declares) `int8_t sv_rt_feof(int32_t fd)` -- `int8_t`, not
/// `i1`, matching `bool`'s real Rust `extern "C"` ABI representation exactly
/// (`process_lower.rs::compile_iff_guard`'s own doc comment already
/// establishes this convention for `PredicateFn`'s identical `-> bool`
/// shape: "`bool`'s Rust `extern "C"` ABI representation is `i8`").
fn fetch_or_declare_sv_rt_feof<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
) -> inkwell::values::FunctionValue<'ctx> {
    module.get_function(SV_RT_FEOF_SYMBOL).unwrap_or_else(|| {
        let i32_ty = ctx.i32_type();
        let i8_ty = ctx.i8_type();
        let fn_ty = i8_ty.fn_type(&[i32_ty.into()], false);
        module.add_function(SV_RT_FEOF_SYMBOL, fn_ty, Some(Linkage::External))
    })
}

/// `$feof(fd)` (RT-063): a single dynamic fd argument, result widened from
/// `sv_rt_feof`'s `i8` (0/1) return into a plain 32-bit unsigned `RtArg`-free
/// packed value (this crate's own established "system call returning an
/// LRM `integer`" convention, `$fopen`/`$fseek` above).
fn lower_feof_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let operands = e.operands();
    if operands.len() != 1 {
        return Err(LoweringError::unsupported_at(
            "$feof requires exactly one argument (fd)",
            &cx.fn_sym,
        ));
    }
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let fd_pv = lower_expr(cx, operands[0])?
        .into_packed("$feof's fd argument must be an integral value", &cx.fn_sym)?;
    let fd_i32 = packed_to_plain_i32(&op, fd_pv);

    let rt_fn = fetch_or_declare_sv_rt_feof(cx.ctx, cx.module);
    let raw8 =
        cx.b.build_call(rt_fn, &[fd_i32.into()], "rt_feof_call")
            .unwrap()
            .try_as_basic_value()
            .unwrap_basic()
            .into_int_value();
    let raw32 =
        cx.b.build_int_z_extend(raw8, cx.ctx.i32_type(), "feof_zext")
            .unwrap();
    Ok(LoweredValue::Packed(op.pack(
        raw32,
        cx.ctx.i32_type().const_zero(),
        32,
        cx.repr,
        false,
    )))
}

// --- B-runtime Task 11 (RT-074/RT-075/RT-076/RT-077): `$test$plusargs`/
// `$value$plusargs` -----------------------------------------------------

/// Fetches (or, on first use in this `Module`, declares) the `extern "C"`
/// shim function for `$test$plusargs` -- `bool sv_rt_plusargs_test(const
/// char *name)`, matching `sv_sim_runtime::plusargs::sv_rt_plusargs_test`'s
/// real production symbol exactly (`bool`'s Rust `extern "C"` ABI
/// representation is `i8`, the same convention `lower_feof_call`'s own doc
/// comment already establishes for this crate).
fn fetch_or_declare_sv_rt_plusargs_test<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
) -> inkwell::values::FunctionValue<'ctx> {
    module
        .get_function(SV_RT_PLUSARGS_TEST_SYMBOL)
        .unwrap_or_else(|| {
            let ptr_ty = ctx.ptr_type(AddressSpace::default());
            let i8_ty = ctx.i8_type();
            let fn_ty = i8_ty.fn_type(&[ptr_ty.into()], false);
            module.add_function(SV_RT_PLUSARGS_TEST_SYMBOL, fn_ty, Some(Linkage::External))
        })
}

/// `$test$plusargs(name)` (RT-074/RT-075, LRM 21.6): `name` is a string
/// literal or a run-time string value (`string`, or a `reg` holding
/// characters); the call always
/// reaches the real runtime (never folded), returning a plain LRM `integer`
/// (0/1) widened from `sv_rt_plusargs_test`'s `i8` result.
fn lower_test_plusargs_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let operands = e.operands();
    if operands.len() != 1 {
        return Err(LoweringError::unsupported_at(
            "$test$plusargs requires exactly one argument (name)",
            &cx.fn_sym,
        ));
    }
    let name_ptr = crate::systask::lower_format_expr(cx, operands[0])?;

    let rt_fn = fetch_or_declare_sv_rt_plusargs_test(cx.ctx, cx.module);
    let raw8 =
        cx.b.build_call(rt_fn, &[name_ptr.into()], "rt_plusargs_test_call")
            .unwrap()
            .try_as_basic_value()
            .unwrap_basic()
            .into_int_value();
    let raw32 =
        cx.b.build_int_z_extend(raw8, cx.ctx.i32_type(), "plusargs_test_zext")
            .unwrap();
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    Ok(LoweredValue::Packed(op.pack(
        raw32,
        cx.ctx.i32_type().const_zero(),
        32,
        cx.repr,
        false,
    )))
}

/// Fetches (or declares) `bool sv_rt_plusargs_value(const char *fmt,
/// RtArg *out)`, matching `sv_sim_runtime::plusargs::sv_rt_plusargs_value`'s
/// real production symbol exactly. `out` is a plain pointer to one
/// `crate::systask::rtarg_llvm_type` element -- the exact same frozen
/// `RtArg` LLVM struct shape `$display`-family marshaling already builds
/// (`crate::systask`'s own doc comment: "size/alignment must match RtArg's
/// own exactly"), reused here as a scalar out-parameter rather than an
/// array element.
fn fetch_or_declare_sv_rt_plusargs_value<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
) -> inkwell::values::FunctionValue<'ctx> {
    module
        .get_function(SV_RT_PLUSARGS_VALUE_SYMBOL)
        .unwrap_or_else(|| {
            let ptr_ty = ctx.ptr_type(AddressSpace::default());
            let i8_ty = ctx.i8_type();
            let fn_ty = i8_ty.fn_type(&[ptr_ty.into(), ptr_ty.into()], false);
            module.add_function(SV_RT_PLUSARGS_VALUE_SYMBOL, fn_ty, Some(Linkage::External))
        })
}

/// The output variable of `$value$plusargs`'s second argument: sv-lang wraps
/// an OUTPUT-direction system-function argument in an implicit `Assignment`
/// node (`var = <formal>`), and an implicit `Conversion` may sit over the
/// variable; peel both.
fn value_plusargs_target<'d>(
    cx: &LowerCtx<'_, 'd, '_>,
    var_expr: sv_lang::Expression<'d>,
) -> Result<sv_lang::Expression<'d>, LoweringError> {
    let mut var_expr = if var_expr.kind() == ExpressionKind::Assignment {
        var_expr.left().ok_or_else(|| {
            LoweringError::unsupported_at(
                "$value$plusargs's variable argument's implicit assignment has no lvalue",
                &cx.fn_sym,
            )
        })?
    } else {
        var_expr
    };
    while var_expr.kind() == ExpressionKind::Conversion {
        var_expr = var_expr.conversion_operand().ok_or_else(|| {
            LoweringError::unsupported_at(
                "$value$plusargs's variable argument conversion missing operand",
                &cx.fn_sym,
            )
        })?;
    }
    Ok(var_expr)
}

/// `$q_initialize`, `$q_add`, `$q_remove`, `$q_full`, `$q_exam` (LRM 1800-2023
/// 20.15): one call of the runtime's multiplexed `sv_rt_stoch_q`
/// (`sv_sim_runtime::stoch_queue`). The inputs travel as (value, unknown)
/// i64 pairs and the output variables are stored from the runtime's result
/// words (an output that is not integral or is wider than 64 bits is refused
/// by name). `$q_full` returns the runtime's answer as its `integer` result;
/// the tasks yield a discarded zero.
fn lower_stoch_queue_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
    which: KnownSystemName,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    use sv_sim_runtime::stoch_queue::{ARG_WORDS, OUT_WORDS, SV_RT_STOCH_Q_SYMBOL, StochOp};
    let name = match which {
        KnownSystemName::QInitialize => "$q_initialize",
        KnownSystemName::QAdd => "$q_add",
        KnownSystemName::QRemove => "$q_remove",
        KnownSystemName::QFull => "$q_full",
        _ => "$q_exam",
    };
    // (op, arity, input operand indices, outputs as (operand, value word,
    // unknown word)).
    type Outs = &'static [(usize, usize, Option<usize>)];
    let (op, arity, inputs, outputs): (StochOp, usize, &[usize], Outs) = match which {
        KnownSystemName::QInitialize => (StochOp::Initialize, 4, &[0, 1, 2], &[(3, 0, None)]),
        KnownSystemName::QAdd => (StochOp::Add, 4, &[0, 1, 2], &[(3, 0, None)]),
        KnownSystemName::QRemove => (
            StochOp::Remove,
            4,
            &[0],
            &[(1, 1, Some(2)), (2, 3, Some(4)), (3, 0, None)],
        ),
        KnownSystemName::QFull => (StochOp::Full, 2, &[0], &[(1, 0, None)]),
        _ => (StochOp::Exam, 4, &[0, 1], &[(2, 1, Some(2)), (3, 0, None)]),
    };
    let operands = e.operands();
    if operands.len() != arity {
        return Err(LoweringError::unsupported_at(
            &format!("{name} with {} arguments (expects {arity})", operands.len()),
            &cx.fn_sym,
        ));
    }
    let i64t = cx.ctx.i64_type();
    let i32t = cx.ctx.i32_type();
    let opb = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let to64 = |v: IntValue<'ctx>, width: u32| -> IntValue<'ctx> {
        if width < 64 {
            cx.b.build_int_z_extend(v, i64t, "stoch_zext").unwrap()
        } else if width > 64 {
            cx.b.build_int_truncate(v, i64t, "stoch_trunc").unwrap()
        } else {
            v
        }
    };
    let args =
        crate::types::entry_alloca_in(&cx.b, i64t.array_type(ARG_WORDS as u32), "stoch_args");
    let outs = crate::types::entry_alloca_in(&cx.b, i64t.array_type(OUT_WORDS as u32), "stoch_out");
    let slot = |base: PointerValue<'ctx>, i: usize| -> PointerValue<'ctx> {
        // SAFETY: `i` is below the array length of both allocas.
        unsafe {
            cx.b.build_in_bounds_gep(i64t, base, &[i64t.const_int(i as u64, false)], "stoch_slot")
                .unwrap()
        }
    };
    let mut words = [i64t.const_zero(); ARG_WORDS];
    for (pair, &idx) in inputs.iter().enumerate() {
        let v = lower_expr(cx, operands[idx])?
            .into_packed(&format!("{name}'s argument {}", idx + 1), &cx.fn_sym)?;
        words[pair * 2] = to64(opb.lane_val(v), v.width);
        words[pair * 2 + 1] = to64(opb.lane_unk(v), v.width);
    }
    let scope = e.system_call_scope().unwrap_or(cx.fn_sym);
    let tick = crate::timescale::tick_exp(cx.ctx, cx.module, &scope);
    words[6] = i64t.const_int(crate::timescale::ticks_per_unit(&scope, tick), false);
    if op == StochOp::Exam {
        let ty = value_plusargs_target(cx, operands[2])?
            .expr_type()
            .ok_or_else(|| {
                LoweringError::unsupported_at(
                    &format!("{name}'s value variable has no type"),
                    &cx.fn_sym,
                )
            })?;
        words[7] = i64t.const_int(u64::from(ty.value_width()), false);
        words[8] = i64t.const_int(u64::from(ty.is_signed()), false);
    }
    for (i, w) in words.iter().enumerate() {
        cx.b.build_store(slot(args, i), *w).unwrap();
    }
    let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
    let rt_fn = cx
        .module
        .get_function(SV_RT_STOCH_Q_SYMBOL)
        .unwrap_or_else(|| {
            cx.module.add_function(
                SV_RT_STOCH_Q_SYMBOL,
                cx.ctx
                    .void_type()
                    .fn_type(&[i32t.into(), ptr_ty.into(), ptr_ty.into()], false),
                Some(inkwell::module::Linkage::External),
            )
        });
    cx.b.build_call(
        rt_fn,
        &[
            i32t.const_int(op as u32 as u64, false).into(),
            args.into(),
            outs.into(),
        ],
        "rt_stoch_q_call",
    )
    .unwrap();
    let load = |i: usize| -> IntValue<'ctx> {
        cx.b.build_load(i64t, slot(outs, i), "stoch_out_word")
            .unwrap()
            .into_int_value()
    };
    let from64 = |w: IntValue<'ctx>, width: u32| -> IntValue<'ctx> {
        if width < 64 {
            cx.b.build_int_truncate(w, opb.i_n(width), "stoch_fit")
                .unwrap()
        } else {
            w
        }
    };
    for &(operand, vword, uword) in outputs {
        let target = value_plusargs_target(cx, operands[operand])?;
        let ty = target.expr_type().ok_or_else(|| {
            LoweringError::unsupported_at(
                &format!("{name}'s output variable has no type"),
                &cx.fn_sym,
            )
        })?;
        if !ty.is_integral() || ty.value_width() > 64 {
            return Err(LoweringError::unsupported_at(
                &format!("{name}'s output variable is not an integral value of at most 64 bits"),
                &cx.fn_sym,
            ));
        }
        let width = ty.value_width().max(1);
        let unk = match uword {
            Some(u) => from64(load(u), width),
            None => opb.i_n(width).const_zero(),
        };
        let pv = opb.pack(
            from64(load(vword), width),
            unk,
            width,
            cx.repr,
            ty.is_signed(),
        );
        crate::expr::store_to(cx, target, LoweredValue::Packed(pv))?;
    }
    if which == KnownSystemName::QFull {
        return Ok(LoweredValue::Packed(opb.pack(
            from64(load(1), 32),
            from64(load(2), 32),
            32,
            cx.repr,
            true,
        )));
    }
    Ok(LoweredValue::Packed(opb.pack(
        i32t.const_zero(),
        i32t.const_zero(),
        32,
        cx.repr,
        false,
    )))
}

/// `$countdrivers(net [, net_is_forced, number_of_01x_drivers, number_of_0_drivers,
/// number_of_1_drivers, number_of_x_drivers])` (LRM 1800-2023 D.2, Table D.1):
/// one call of the runtime's `sv_rt_net_drivers` for the scalar net or constant
/// bit-select, then each supplied output variable stored. Returns 1 when the
/// net has more than one driver at 0, 1 or x (contention), else 0. Any other
/// first argument is refused by name.
fn lower_countdrivers_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let bad =
        |why: &str| LoweringError::unsupported_at(&format!("$countdrivers {why}"), &cx.fn_sym);
    let operands = e.operands();
    if operands.is_empty() || operands.len() > 6 {
        return Err(bad("with no net argument or more than six arguments"));
    }
    let mut net = operands[0];
    while net.kind() == ExpressionKind::Conversion {
        match net.conversion_operand() {
            Some(inner) => net = inner,
            None => break,
        }
    }
    let (key, off) = crate::systask::net_strength_key(net)
        .ok_or_else(|| bad("of something other than a net or a constant bit-select of one"))?;
    let mut base = net;
    while matches!(
        base.kind(),
        ExpressionKind::ElementSelect | ExpressionKind::RangeSelect
    ) {
        base = base
            .select_value()
            .ok_or_else(|| bad("of a malformed select"))?;
    }
    let sym = base
        .referenced_symbol()
        .ok_or_else(|| bad("of an unresolved name"))?;
    let wt = cx
        .write_through
        .as_ref()
        .ok_or_else(|| bad("outside a process (it reads the net's live state)"))?;
    let slot = cx
        .locals
        .get(&sym.uid())
        .and_then(|(ptr, _, _)| wt.signals.get(ptr))
        .map(|e| e.0)
        .ok_or_else(|| bad("of a net this process does not read"))?;
    let i64t = cx.ctx.i64_type();
    let i32t = cx.ctx.i32_type();
    let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
    let opb = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let outs = crate::types::entry_alloca_in(&cx.b, i32t.array_type(5), "countdrivers_out");
    let rt_fn = cx
        .module
        .get_function("sv_rt_net_drivers")
        .unwrap_or_else(|| {
            cx.module.add_function(
                "sv_rt_net_drivers",
                cx.ctx.void_type().fn_type(
                    &[
                        ptr_ty.into(),
                        i32t.into(),
                        i64t.into(),
                        i32t.into(),
                        ptr_ty.into(),
                    ],
                    false,
                ),
                Some(inkwell::module::Linkage::External),
            )
        });
    cx.b.build_call(
        rt_fn,
        &[
            wt.handle.into(),
            i32t.const_int(u64::from(slot), false).into(),
            i64t.const_int(key, false).into(),
            i32t.const_int(u64::from(off), false).into(),
            outs.into(),
        ],
        "rt_net_drivers_call",
    )
    .unwrap();
    let load = |i: u64| -> IntValue<'ctx> {
        // SAFETY: `i` is below the array length of `outs`.
        let p = unsafe {
            cx.b.build_in_bounds_gep(i32t, outs, &[i64t.const_int(i, false)], "countdrivers_slot")
                .unwrap()
        };
        cx.b.build_load(i32t, p, "countdrivers_word")
            .unwrap()
            .into_int_value()
    };
    // Table D.1's outputs: net_is_forced, then the 01x, 0, 1 and x counts.
    for (k, &operand) in operands.iter().enumerate().skip(1) {
        let target = value_plusargs_target(cx, operand)?;
        let ty = target
            .expr_type()
            .ok_or_else(|| bad("with an untyped output variable"))?;
        if !ty.is_integral() || ty.value_width() > 64 {
            return Err(bad(
                "with an output variable that is not integral or exceeds 64 bits",
            ));
        }
        let width = ty.value_width().max(1);
        let w = load(k as u64 - 1);
        let v = match width.cmp(&32) {
            std::cmp::Ordering::Less => {
                cx.b.build_int_truncate(w, opb.i_n(width), "cd_fit")
                    .unwrap()
            }
            std::cmp::Ordering::Equal => w,
            std::cmp::Ordering::Greater => {
                cx.b.build_int_z_extend(w, opb.i_n(width), "cd_ext")
                    .unwrap()
            }
        };
        let pv = opb.pack(
            v,
            opb.i_n(width).const_zero(),
            width,
            cx.repr,
            ty.is_signed(),
        );
        crate::expr::store_to(cx, target, LoweredValue::Packed(pv))?;
    }
    let multi =
        cx.b.build_int_compare(
            IntPredicate::UGT,
            load(1),
            i32t.const_int(1, false),
            "cd_multi",
        )
        .unwrap();
    let multi = cx.b.build_int_z_extend(multi, i32t, "cd_multi32").unwrap();
    Ok(LoweredValue::Packed(opb.pack(
        multi,
        i32t.const_zero(),
        32,
        cx.repr,
        true,
    )))
}

/// What kind of variable `$value$plusargs` writes (decides the `out` RtArg shape).
#[derive(Clone, Copy, PartialEq, Eq)]
enum PlusArgsClass {
    Int,
    Real,
    Str,
}

/// `$value$plusargs(fmt, variable)` (RT-074/RT-076, LRM 21.6): `fmt` is a
/// string literal or a run-time string value (`string`, or a `reg` holding
/// characters); the runtime parses its `name=%<spec>` and converts the
/// plusarg text to the TARGET's shape, which this call site hands over in the
/// `out` RtArg (`kind` = integral/real/string, `bit_width`): integral targets
/// of any width get the exact 4-state pattern (x/z digits, `_`, negatives,
/// all-X for text that is not a number), real targets the converted `f64`,
/// `string` targets the raw text. A LITERAL format is also checked here
/// (malformed, unknown specifier, or a non-`%s` one into a `string` target are
/// named `LoweringError`s). `variable` is any assignable lvalue (the store
/// goes through [`store_to`]).
///
/// The runtime call's own `bool` result (whether a matching plusarg was
/// found at all) becomes `$value$plusargs`'s own LRM return value (0/1);
/// `variable` is conditionally stored ONLY when the call reports `true` --
/// LRM: "If the plusarg is not found... the variable is left unchanged" --
/// via a genuine runtime conditional branch, never an unconditional store.
fn lower_value_plusargs_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let operands = e.operands();
    if operands.len() != 2 {
        return Err(LoweringError::unsupported_at(
            "$value$plusargs requires exactly two arguments (format, variable)",
            &cx.fn_sym,
        ));
    }
    let target = value_plusargs_target(cx, operands[1])?;
    let target_ty = target.expr_type().ok_or_else(|| {
        LoweringError::unsupported_at("$value$plusargs's variable has no type", &cx.fn_sym)
    })?;
    let class = if target_ty.is_string() {
        PlusArgsClass::Str
    } else if target_ty.is_floating() {
        PlusArgsClass::Real
    } else if target_ty.is_integral() {
        PlusArgsClass::Int
    } else {
        return Err(LoweringError::unsupported_at(
            "$value$plusargs into a variable that is not integral, real or string",
            &cx.fn_sym,
        ));
    };
    // A literal format is checked here, at compile time, against the target
    // (a malformed one is a loud error, never a run-time silent `0`); a
    // run-time format string (LRM 21.6 `string format`) is parsed by the
    // runtime on every call, which reports a bad one as "not found".
    let mut fmt_lit = operands[0];
    while fmt_lit.kind() == ExpressionKind::Conversion {
        fmt_lit = fmt_lit.conversion_operand().unwrap_or(fmt_lit);
    }
    if fmt_lit.kind() == ExpressionKind::StringLiteral {
        let fmt_text = fmt_lit.string_literal_value().unwrap_or_default();
        let (_, spec) = sv_sim_runtime::plusargs::split_value_format(&fmt_text).map_err(|err| {
            LoweringError::unsupported_at(
                &format!("$value$plusargs format string `{fmt_text}` is invalid: {err}"),
                &cx.fn_sym,
            )
        })?;
        if !matches!(spec, 'd' | 'h' | 'x' | 'o' | 'b' | 's' | 'e' | 'f' | 'g') {
            return Err(LoweringError::unsupported_at(
                &format!("$value$plusargs format specifier '%{spec}' (LRM 21.6)"),
                &cx.fn_sym,
            ));
        }
        if class == PlusArgsClass::Str && spec != 's' {
            return Err(LoweringError::unsupported_at(
                &format!(
                    "$value$plusargs with '%{spec}' into a `string` variable (only %s is defined)"
                ),
                &cx.fn_sym,
            ));
        }
    }
    let fmt_ptr = crate::systask::lower_format_expr(cx, operands[0])?;
    let target_width = target_ty.value_width();

    let rtarg_ty = crate::systask::rtarg_llvm_type(cx.ctx);
    let out_alloca = crate::types::entry_alloca_in(&cx.b, rtarg_ty, "plusargs_value_out");
    // The module's generic DataLayout gives `i128` only 8-byte alignment,
    // but `RtArg` is 16-aligned (see `systask.rs`'s `rtargs` alloca): the
    // runtime writes the whole struct through `out`.
    if let Some(instr) = out_alloca.as_instruction() {
        instr
            .set_alignment(16)
            .expect("alloca instruction accepts an explicit alignment");
    }
    // The call site's INPUTS to the runtime: the target's class (`kind`)
    // and, for an integral one, its width -- the runtime converts the
    // plusarg text to exactly that shape, whatever the (possibly run-time)
    // format's conversion character is.
    let kind_p =
        cx.b.build_struct_gep(rtarg_ty, out_alloca, 0, "plusargs_value_kind_p")
            .unwrap();
    let kind_tag = match class {
        PlusArgsClass::Int => 0,
        PlusArgsClass::Str => 2,
        PlusArgsClass::Real => 3,
    };
    cx.b.build_store(kind_p, cx.ctx.i32_type().const_int(kind_tag, false))
        .unwrap();
    let width_p =
        cx.b.build_struct_gep(rtarg_ty, out_alloca, 1, "plusargs_value_width_p")
            .unwrap();
    cx.b.build_store(
        width_p,
        cx.ctx.i32_type().const_int(u64::from(target_width), false),
    )
    .unwrap();
    let rt_fn = fetch_or_declare_sv_rt_plusargs_value(cx.ctx, cx.module);
    let found8 =
        cx.b.build_call(
            rt_fn,
            &[fmt_ptr.into(), out_alloca.into()],
            "rt_plusargs_value_call",
        )
        .unwrap()
        .try_as_basic_value()
        .unwrap_basic()
        .into_int_value();

    let entry_block = cx.b.get_insert_block().ok_or_else(|| {
        LoweringError::unsupported_at("$value$plusargs lowered outside a basic block", &cx.fn_sym)
    })?;
    let f = entry_block.get_parent().ok_or_else(|| {
        LoweringError::unsupported_at("$value$plusargs block has no parent function", &cx.fn_sym)
    })?;
    let found_block = cx.ctx.append_basic_block(f, "plusargs_value_found");
    let merge_block = cx.ctx.append_basic_block(f, "plusargs_value_merge");
    let found_bool =
        cx.b.build_int_compare(
            IntPredicate::NE,
            found8,
            cx.ctx.i8_type().const_zero(),
            "plusargs_value_found_bool",
        )
        .unwrap();
    cx.b.build_conditional_branch(found_bool, found_block, merge_block)
        .unwrap();

    cx.b.position_at_end(found_block);
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    // `crate::systask::rtarg_llvm_type`'s own documented field order: kind,
    // bit_width, is_signed, narrow (3), real, wide_aval, wide_bval,
    // wide_words, str_ptr (8), str_len (9).
    if class == PlusArgsClass::Str {
        let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
        let ptr_field =
            cx.b.build_struct_gep(rtarg_ty, out_alloca, 8, "plusargs_value_str_ptr_p")
                .unwrap();
        let str_ptr =
            cx.b.build_load(ptr_ty, ptr_field, "plusargs_value_str_ptr")
                .unwrap()
                .into_pointer_value();
        let len_field =
            cx.b.build_struct_gep(rtarg_ty, out_alloca, 9, "plusargs_value_str_len_p")
                .unwrap();
        let len32 =
            cx.b.build_load(cx.ctx.i32_type(), len_field, "plusargs_value_str_len")
                .unwrap()
                .into_int_value();
        let len64 =
            cx.b.build_int_z_extend(len32, cx.ctx.i64_type(), "plusargs_value_str_len64")
                .unwrap();
        let s = crate::strings::intern_bytes(cx, str_ptr, len64);
        crate::fileio::store_output(cx, target, LoweredValue::Str(s))?;
    } else if class == PlusArgsClass::Real {
        let real_ptr =
            cx.b.build_struct_gep(rtarg_ty, out_alloca, 4, "plusargs_value_real_p")
                .unwrap();
        let real =
            cx.b.build_load(cx.ctx.f64_type(), real_ptr, "plusargs_value_real")
                .unwrap()
                .into_float_value();
        crate::expr::store_to(cx, target, LoweredValue::Real(RealValue { llvm: real }))?;
    } else {
        // Wide4State: `wide_aval`/`wide_bval` point at ceil(width/64)
        // little-endian words in the ABI's (aval, bval) encoding; the
        // value/unknown lanes are `aval ^ bval` / `bval`.
        let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
        let width = target_width.max(1);
        let words = u64::from(width).div_ceil(64);
        let lane_ty = op.i_n((words * 64) as u32);
        let mut lanes = Vec::new();
        for (field, name) in [(5u32, "aval"), (6u32, "bval")] {
            let slot =
                cx.b.build_struct_gep(rtarg_ty, out_alloca, field, "plusargs_value_words_p")
                    .unwrap();
            let words_ptr =
                cx.b.build_load(ptr_ty, slot, "plusargs_value_words")
                    .unwrap()
                    .into_pointer_value();
            let raw =
                cx.b.build_load(lane_ty, words_ptr, &format!("plusargs_value_{name}"))
                    .unwrap();
            inkwell::values::BasicValue::as_instruction_value(&raw)
                .expect("a load is an instruction")
                .set_alignment(8)
                .expect("load accepts an explicit alignment");
            let mut raw = raw.into_int_value();
            if width != (words * 64) as u32 {
                raw =
                    cx.b.build_int_truncate(raw, op.i_n(width), "plusargs_value_fit")
                        .unwrap();
            }
            lanes.push(raw);
        }
        let val =
            cx.b.build_xor(lanes[0], lanes[1], "plusargs_value_val")
                .unwrap();
        let pv = op.pack(val, lanes[1], width, cx.repr, false);
        crate::expr::store_to(cx, target, LoweredValue::Packed(pv))?;
    }
    cx.b.build_unconditional_branch(merge_block).unwrap();

    cx.b.position_at_end(merge_block);
    let found32 =
        cx.b.build_int_z_extend(found8, cx.ctx.i32_type(), "plusargs_value_found_zext")
            .unwrap();
    Ok(LoweredValue::Packed(op.pack(
        found32,
        cx.ctx.i32_type().const_zero(),
        32,
        cx.repr,
        false,
    )))
}

/// `$timeunit`/`$timeprecision` (LRM 1800-2023 §20.4.1) as a constant `int`.
pub(crate) fn lower_timescale_query<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
    name: &str,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    // LRM 20.4.1: the scale of the named module / `$unit`, else of the
    // enclosing scope. A `` `timescale `` directive lands on the module
    // declared after it, so the lookup starts at the symbol itself.
    let target = match e.operands().first() {
        Some(a) => a.arbitrary_symbol().ok_or_else(|| {
            LoweringError::unsupported_at(
                "$timeunit/$timeprecision argument must name a module, instance or $unit",
                &cx.fn_sym,
            )
        })?,
        None => e.system_call_scope().unwrap_or(cx.fn_sym),
    };
    let (unit, prec) = crate::timescale::unit_and_precision(&target);
    let v = if name == "$timeunit" { unit } else { prec };
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    Ok(LoweredValue::Packed(op.pack(
        cx.ctx.i32_type().const_int(i64::from(v) as u64, true),
        cx.ctx.i32_type().const_zero(),
        32,
        cx.repr,
        true,
    )))
}

/// `$time`/`$stime`/`$realtime` (LRM 1800-2023 §20.3): the scheduler's
/// tick count (`sv_rt_time()`, never a compile-time fold) in the calling
/// scope's time unit -- `$time`/`$stime` rounded to an integer, `$realtime`
/// as a real (`crate::timescale`).
pub(crate) fn lower_time_system_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    which: KnownSystemName,
    _name: &str,
    scope: &sv_lang::Symbol<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let tick = crate::timescale::tick_exp(cx.ctx, cx.module, scope);
    let per_unit = crate::timescale::ticks_per_unit(scope, tick);
    let rt_fn = fetch_or_declare_sv_rt_time(cx.ctx, cx.module);
    let raw64 =
        cx.b.build_call(rt_fn, &[], "rt_time_call")
            .unwrap()
            .try_as_basic_value()
            .unwrap_basic()
            .into_int_value();

    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let i64t = cx.ctx.i64_type();
    let ticks = raw64;
    // Ticks to whole units, rounding half up.
    let raw64 = if per_unit > 1 && which != KnownSystemName::RealTime {
        let half =
            cx.b.build_int_add(ticks, i64t.const_int(per_unit / 2, false), "time_round")
                .unwrap();
        cx.b.build_int_unsigned_div(half, i64t.const_int(per_unit, false), "time_units")
            .unwrap()
    } else {
        ticks
    };
    match which {
        KnownSystemName::Time => Ok(LoweredValue::Packed(op.pack(
            raw64,
            cx.ctx.i64_type().const_zero(),
            64,
            cx.repr,
            false,
        ))),
        KnownSystemName::STime => {
            let raw32 =
                cx.b.build_int_truncate(raw64, cx.ctx.i32_type(), "stime_trunc")
                    .unwrap();
            Ok(LoweredValue::Packed(op.pack(
                raw32,
                cx.ctx.i32_type().const_zero(),
                32,
                cx.repr,
                false,
            )))
        }
        KnownSystemName::RealTime => {
            let f =
                cx.b.build_unsigned_int_to_float(ticks, cx.ctx.f64_type(), "realtime_uitofp")
                    .unwrap();
            let f = if per_unit > 1 {
                cx.b.build_float_div(
                    f,
                    cx.ctx.f64_type().const_float(per_unit as f64),
                    "realtime_units",
                )
                .unwrap()
            } else {
                f
            };
            Ok(LoweredValue::Real(RealValue { llvm: f }))
        }
        other => unreachable!(
            "lower_time_system_call is only ever invoked (by lower_expr's Call arm, above) for \
             KnownSystemName::{{Time,STime,RealTime}} -- got {other:?}"
        ),
    }
}

/// R-run Task 13: resizes a memory row-index `PackedValue`'s VALUE plane
/// (`OpBuilder::lane_val`, unsigned -- the same "resize_unsigned" convention
/// `ops.rs`'s own `bit_select4`/`indexed_up_lo4` already use for an index
/// operand) to the accessor ABI's own `i64` `row_index` type.
///
/// **Documented scope limitation:** an index with any unknown (X/Z) bit is
/// read as whatever its VALUE-plane bits happen to be (never propagated into
/// an all-X *result* the way `bit_select4`'s closed-form arithmetic can) --
/// the accessor ABI's `row_index: u64` is a concrete address with no
/// "unknown index" representation, and turning an unknown/out-of-range index
/// into a real all-X read would need a runtime conditional around the
/// `sv_get_mem_word` call this slice does not build. Neither probe-corpus
/// memory fixture (`unpacked_array.sv`) exercises an unknown index.
pub(crate) fn mem_row_index_i64<'ctx>(
    op: &OpBuilder<'_, 'ctx>,
    cx: &LowerCtx<'ctx, '_, '_>,
    idx: PackedValue<'ctx>,
) -> IntValue<'ctx> {
    let val = op.lane_val(idx);
    let src_bits = val.get_type().get_bit_width();
    let i64_ty = cx.ctx.i64_type();
    if src_bits == 64 {
        val
    } else if src_bits < 64 && idx.signed {
        // A signed index keeps its sign (`mem[-2]` on a `[-2:1]` memory;
        // a signed 8'shC8 is -56, out of range -- iverilog-verified).
        cx.b.build_int_s_extend(val, i64_ty, "mem_row_index_sext")
            .unwrap()
    } else if src_bits < 64 {
        cx.b.build_int_z_extend(val, i64_ty, "mem_row_index_zext")
            .unwrap()
    } else {
        cx.b.build_int_truncate(val, i64_ty, "mem_row_index_trunc")
            .unwrap()
    }
}

/// Whether `e` is an unsized based literal (`'bx`, `'dz`, `'h?f`) whose
/// leftmost bit is X or Z: LRM 5.7.1 extends such a literal with that X/Z
/// to the width of the expression containing it, where a plain widening
/// would zero-fill (slang keeps the literal at its own 32-bit width).
fn unsized_literal_leads_unknown(e: sv_lang::Expression<'_>) -> bool {
    e.kind() == ExpressionKind::IntegerLiteral
        && e.is_declared_unsized() == Some(true)
        && e.integer_literal_value()
            .and_then(|cv| {
                let iv = cv.as_integer()?;
                iv.bit(iv.bit_width() as usize - 1).map(|b| b.is_unknown())
            })
            .unwrap_or(false)
}

/// A folded integer constant (`iv`, the value of `e` when given) as a
/// value; a named error, never a guess, when its bits cannot be read.
pub(crate) fn lower_constant<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    iv: &sv_lang::SVInt,
    e: Option<sv_lang::Expression<'_>>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    // A vector past the huge threshold is a memory image, never an LLVM
    // integer (`crate::huge`).
    if let Some(ex) = e
        && let Some(h) = crate::huge::lower_constant(cx, ex)?
    {
        return Ok(h);
    }
    if e.is_none() && crate::huge::is_huge_width(iv.bit_width()) {
        return Err(LoweringError::unsupported_at(
            "a constant wider than 65535 bits with no expression to lower it from",
            &cx.fn_sym,
        ));
    }
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    match op.lower_const_any(iv, cx.repr) {
        Some(AnyValue::Narrow(p)) => Ok(LoweredValue::Packed(p)),
        Some(AnyValue::Wide(w)) => Ok(LoweredValue::Wide(w)),
        None => Err(LoweringError::unsupported_at(
            &format!(
                "a {}-bit constant whose bits sv-lang does not expose",
                iv.bit_width()
            ),
            &cx.fn_sym,
        )),
    }
}

/// Whether `type(a) <op> type(b)` holds, for an equality operator whose two
/// operands are both type references (LRM 1800-2023 6.23: types compare
/// equal exactly when they match, 6.22.1); `None` for any other expression.
pub(crate) fn type_reference_equality(e: sv_lang::Expression<'_>, bop: BinaryOp) -> Option<bool> {
    let negate = match bop {
        BinaryOp::Equality | BinaryOp::CaseEquality => false,
        BinaryOp::Inequality | BinaryOp::CaseInequality => true,
        _ => return None,
    };
    let l = e.left()?.type_reference_target()?;
    let r = e.right()?.type_reference_target()?;
    Some(l.is_matching(&r) != negate)
}

/// The current value of the target of a read-modify-write (`x++`, `x op= y`).
/// A nonexistent associative-array element is allocated with its default
/// first (LRM 1800-2023 7.8.7), so reading it for the update is not the
/// invalid read that warns (7.8.6).
pub(crate) fn read_modify_target<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    target: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    if target.kind() == ExpressionKind::ElementSelect
        && let Some(r) = crate::collections::read_element(cx, target)
    {
        return r;
    }
    lower_expr(cx, target)
}

/// Lowers `e` to a value every caller can consume: a vector wider than the
/// huge threshold but within `WIDE_THRESHOLD` is bridged to a [`PackedValue`]
/// (one load of the memory image), so a consumer that has no memory-image
/// path of its own keeps working. A huge-aware consumer calls
/// [`lower_expr_h`] to keep the image.
pub fn lower_expr<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let v = lower_expr_h(cx, e)?;
    Ok(crate::huge::bridge(cx, v))
}

/// The expression a modport port with an explicit expression (`.x(r[3:0])`,
/// LRM 1800-2023 25.5.4) stands for, when `e` names such a port.
pub(crate) fn modport_expr_target<'d>(
    e: &sv_lang::Expression<'d>,
) -> Option<sv_lang::Expression<'d>> {
    if !matches!(
        e.kind(),
        ExpressionKind::NamedValue | ExpressionKind::HierarchicalValue
    ) {
        return None;
    }
    let sym = e.referenced_symbol()?;
    if sym.kind() != sv_lang::kinds::SymbolKind::ModportPort {
        return None;
    }
    sym.modport_port_explicit_connection()
}

/// [`lower_expr`] that keeps a vector wider than the huge threshold as a
/// memory-image [`LoweredValue::Huge`] (`crate::huge`).
pub fn lower_expr_h<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    // A modport port with an expression (`input .x(r[3:0])`, LRM 25.5.4) reads
    // as that expression of the interface instance.
    if let Some(inner) = modport_expr_target(&e) {
        return lower_expr_h(cx, inner);
    }
    // A select index evaluated once ahead of a per-candidate lowering
    // (`crate::vif::hoisted`).
    if let Some(v) = crate::vif::hoisted(&e) {
        return Ok(v);
    }
    // A vector wider than the huge threshold (or an operator reading one) is
    // a memory image: `crate::huge`.
    if let Some(v) = crate::huge::try_lower(cx, e)? {
        return Ok(v);
    }
    lower_expr_regular(cx, e)
}

/// The ordinary (non-memory-image) lowering of `e`: what [`lower_expr_h`]
/// does when `crate::huge` does not take the expression, and what
/// `crate::huge` falls back to for an operation it has no native form of.
pub(crate) fn lower_expr_regular<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    // A by-value actual of a subroutine call attached to a sequence (16.11): the
    // value sampled at the end point, primed by the assertion's kernel.
    if crate::sva::proc::call_args_active()
        && let Some((slot, width, signed)) = {
            let key = crate::sva::proc::call_arg_key(&e);
            // The value of a task spawned from a match item (16.11) is read from the
            // assertion inputs the spawn hands the process.
            cx.locals.get(&key).copied().or_else(|| {
                crate::sva::proc::spawn_arg_input(&key).map(|(k, width, signed)| {
                    (
                        crate::process_lower::assert_input_slot(cx, k, width),
                        width,
                        signed,
                    )
                })
            })
        }
    {
        let op = OpBuilder {
            ctx: cx.ctx,
            b: &cx.b,
        };
        let ty = if cx.repr == ValueRepr::FourState {
            op.i_n(width * 2)
        } else {
            op.i_n(width)
        };
        let v =
            cx.b.build_load(ty, slot, "ld_call_arg")
                .unwrap()
                .into_int_value();
        return Ok(LoweredValue::Packed(PackedValue {
            llvm: v,
            width,
            repr: cx.repr,
            signed,
        }));
    }
    // A `string`-typed expression: the string-only kinds (conversions to
    // string, concatenation, ...) lower in `crate::strings`; any other kind
    // (a variable, a call, an assignment) yields the string's 64-bit id.
    if e.expr_type().is_some_and(|t| t.is_string()) {
        if let Some(s) = crate::strings::lower_string_expr(cx, e)? {
            return Ok(LoweredValue::Str(s));
        }
        let v = lower_expr_node(cx, e)?;
        return Ok(if let LoweredValue::Packed(pv) = v {
            LoweredValue::Str(crate::strings::from_storage(cx, pv))
        } else {
            v
        });
    }
    // A new queue / dynamic / associative array (`{q, x}`, `'{1, 2}`,
    // `new[n]`, `q[1:$]`): `crate::collections`.
    if let Some(r) = crate::collections::lower_constructor(cx, e) {
        return r;
    }
    let v = lower_expr_node(cx, e)?;
    // A `real`/`shortreal` read that yields its stored IEEE bits (an
    // element of a real array) is the real value.
    if let LoweredValue::Packed(pv) = v
        && e.expr_type().is_some_and(|t| t.is_floating())
    {
        return Ok(LoweredValue::Real(crate::real::bits_to_real(cx, pv)));
    }
    // An integral value's signedness is its expression type's (slang applies
    // the LRM's rules: a select is unsigned, a signed struct member or
    // element is signed, ...), whatever the node's own lowering assumed.
    if let LoweredValue::Packed(pv) = v
        && let Some(t) = e.expr_type()
        && t.is_integral()
        && t.value_width() == pv.width
    {
        return Ok(LoweredValue::Packed(PackedValue {
            signed: t.is_signed(),
            ..pv
        }));
    }
    Ok(v)
}

/// A read of the specparam `sym` whose compile-time value is `base`: the value an SDF `LABEL`
/// annotated at run time (`sv_sim_runtime::specparam`), else `base` (LRM 32.4.3, SD-C / T28).
///
/// The annotation is a real number in the module's time unit. A `real` specparam reads it
/// whole; an integral one reads it rounded to an integer (LRM 6.12.1: a real converted to an
/// integer type rounds to nearest, ties away from zero) at the specparam's own width and
/// signedness -- implementation-defined: the LRM does not say what type an annotated specparam
/// has. A delay that is just the specparam skips this and keeps the fraction
/// (`timescale::lower_delay_ticks`). A specparam wider than the packed-value limit keeps its
/// source value (the SDF host reports it as not annotated rather than annotating it silently).
fn annotated_specparam_read<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    op: &OpBuilder<'_, 'ctx>,
    sym: &sv_lang::Symbol<'_>,
    base: LoweredValue<'ctx>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let annotated = crate::timescale::lower_specparam_read(cx, sym)?;
    let f64t = cx.ctx.f64_type();
    let none =
        cx.b.build_float_compare(
            inkwell::FloatPredicate::UNO,
            annotated,
            annotated,
            "sp_none",
        )
        .unwrap();
    match base {
        LoweredValue::Real(r) => Ok(LoweredValue::Real(RealValue {
            llvm: cx
                .b
                .build_select(none, r.llvm, annotated, "sp_real")
                .unwrap()
                .into_float_value(),
        })),
        LoweredValue::Packed(pv) => {
            // The rounding of a NaN is poison in LLVM; the select below discards that arm, but
            // feed it a harmless zero so no poison is ever formed.
            let safe =
                cx.b.build_select(none, f64t.const_zero(), annotated, "sp_safe")
                    .unwrap()
                    .into_float_value();
            let rounded = op.round_real_to_int(RealValue { llvm: safe }, pv.width, pv.signed);
            let annotated_pv = op.pack(
                rounded,
                op.i_n(pv.width).const_zero(),
                pv.width,
                pv.repr,
                pv.signed,
            );
            Ok(LoweredValue::Packed(PackedValue {
                llvm: cx
                    .b
                    .build_select(none, pv.llvm, annotated_pv.llvm, "sp_int")
                    .unwrap()
                    .into_int_value(),
                ..pv
            }))
        }
        wide @ (LoweredValue::Wide(_) | LoweredValue::Str(_) | LoweredValue::Huge(_)) => Ok(wide),
    }
}

fn lower_expr_node<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    match e.kind() {
        // A string literal in an integral context (`w = "AB"`, `"a" < "b"`):
        // its bytes as a packed value (LRM 5.9), like an integer literal. An
        // unbased unsized literal (`'1`, `'x`) folds to its context's width.
        //
        // Review fix (r2), Task 6 finding 2: each of these three literal
        // kinds has its OWN cache-independent value accessor
        // (`integer_literal_value`/`string_literal_int_value`/
        // `unbased_unsized_literal_value`) -- the value is set once at
        // construction, never lazily folded, so each is "always available"
        // per its own doc comment. `Expression::constant_value()` instead
        // reads slang's PREFOLD-SWEEP CACHE (`FreezeReport`'s own doc: "if
        // this expression has one cached") -- populated, once, for every
        // literal reachable from the frozen `Design`'s AST at
        // `Compilation::compile()` time. A node slang synthesizes LATER,
        // on first access well after that freeze (e.g. `extends Base(7)`'s
        // own implicit `Call`, built by `Type::class_base_constructor_
        // call()` -- `classes.rs::chain_to_base`), was never visited by
        // that sweep and so is never cached, even though its own value is
        // exactly as intrinsically known as any other literal's. Confirmed
        // live: `class derived extends base(7);` failed "non-const
        // literal" on exactly this node before this fix; the identical `7`
        // written as an explicit `super.new(7)` statement already worked,
        // because THAT literal is part of the ordinary, frozen-at-compile-
        // time AST the prefold sweep did visit.
        ExpressionKind::IntegerLiteral
        | ExpressionKind::StringLiteral
        | ExpressionKind::UnbasedUnsizedIntegerLiteral => {
            let cv = match e.kind() {
                ExpressionKind::IntegerLiteral => e.integer_literal_value(),
                ExpressionKind::StringLiteral => e.string_literal_int_value(),
                ExpressionKind::UnbasedUnsizedIntegerLiteral => e.unbased_unsized_literal_value(),
                _ => unreachable!(
                    "filtered by the outer match arm above, which already restricts \
                     `e.kind()` to exactly these three -- `kind()` is a pure read with no \
                     side effects between the two calls"
                ),
            }
            .ok_or_else(|| LoweringError::unsupported_at("non-const literal", &cx.fn_sym))?;
            let iv = cv
                .as_integer()
                .ok_or_else(|| LoweringError::unsupported_at("non-integer literal", &cx.fn_sym))?;
            // Review fix r2: route through `lower_const_any` (Task 15's
            // narrow/wide dispatch point) instead of calling `const_svint`
            // directly, so a >WIDE_THRESHOLD-bit literal produces
            // `LoweredValue::Wide` instead of panicking inside
            // `const_svint`'s `assert!`.
            lower_constant(cx, iv, Some(e))
        }
        // Task 8 (CG-037): a `real` literal's own natural type is always
        // `real` (f64) per LRM 5.7.1 -- narrowing it to `shortreal` (f32) is
        // a separate `Conversion` node slang inserts around it, out of
        // CG-037's int<->real scope (see the Conversion arm's `(true,
        // true)` case below).
        ExpressionKind::RealLiteral => {
            let val = e.real_literal_value().ok_or_else(|| {
                LoweringError::unsupported_at("real literal missing value", &cx.fn_sym)
            })?;
            Ok(LoweredValue::Real(RealValue {
                llvm: cx.ctx.f64_type().const_float(val),
            }))
        }
        // A time literal (LRM 1800-2023 §5.8) is a realtime value in the
        // scope's time unit -- slang has already scaled it -- rounded to the
        // scope's precision.
        ExpressionKind::TimeLiteral => {
            let val = e.time_literal_value().ok_or_else(|| {
                LoweringError::unsupported_at("time literal missing value", &cx.fn_sym)
            })?;
            let val = match e.time_literal_scale() {
                Some(ts) => {
                    let steps = 10f64.powi(
                        crate::timescale::exp_of(ts.base) - crate::timescale::exp_of(ts.precision),
                    );
                    (val * steps).round() / steps
                }
                None => val,
            };
            Ok(LoweredValue::Real(RealValue {
                llvm: cx.ctx.f64_type().const_float(val),
            }))
        }
        // A variable or net named where slang's system-task signature takes a
        // scope or object (`$dumpports(top, fname)`'s file name) arrives as an
        // `ArbitrarySymbol`; as a value it reads like a `NamedValue`.
        ExpressionKind::NamedValue
        | ExpressionKind::HierarchicalValue
        | ExpressionKind::ArbitrarySymbol => {
            if e.kind() == ExpressionKind::ArbitrarySymbol
                && !e.referenced_symbol().is_some_and(|s| {
                    matches!(
                        s.kind(),
                        sv_lang::kinds::SymbolKind::Variable | sv_lang::kinds::SymbolKind::Net
                    )
                })
            {
                // An interface instance named as a value (`vif = bus`): its
                // virtual interface id (`crate::vif`).
                return e
                    .referenced_symbol()
                    .and_then(|s| crate::vif::instance_value(cx, &s))
                    .ok_or_else(|| {
                        LoweringError::unsupported_at(
                            "a symbol used as a value that is not an interface instance",
                            &cx.fn_sym,
                        )
                    });
            }
            // Corrected vs. plan: `Expression::as_symbol()` does not exist.
            // The real accessor for "what symbol does this expression
            // reference" is `referenced_symbol()` (verified against
            // sv-lang's own doctest on it, which uses exactly this
            // NamedValue-lookup case).
            let sym = e
                .referenced_symbol()
                .ok_or_else(|| LoweringError::unsupported_at("unresolved name", &cx.fn_sym))?;
            // An array method's iterator (`item`): the current element.
            if let Some(v) = crate::array_methods::iterator_value(cx, &sym) {
                return Ok(v);
            }
            // Classes plan Task 5 (§1.4 step 4): a bare reference to a
            // non-static class property, inside a method body (implicit
            // `this.field`) -- a `ClassProperty` is never a `cx.locals`
            // entry (its storage is the object heap, not an LLVM alloca/
            // STATE signal), so this is tried BEFORE the `cx.locals` lookup
            // just below, not after it.
            if let Some(v) = crate::classes::try_read_bare_field(cx, &sym)? {
                return Ok(v);
            }
            if let Some((slot, width, signed)) = cx.locals.get(&sym.uid()).copied() {
                crate::collections::elem_ref_refresh(cx, slot);
                let ty = if cx.repr == ValueRepr::FourState {
                    op.i_n(width * 2)
                } else {
                    op.i_n(width)
                };
                let v = cx.b.build_load(ty, slot, "ld").unwrap().into_int_value();
                let pv = PackedValue {
                    llvm: v,
                    width,
                    repr: cx.repr,
                    signed,
                };
                // A real variable's cell holds its IEEE bits.
                if sym.value_type().is_some_and(|t| t.is_floating()) {
                    return Ok(LoweredValue::Real(crate::real::bits_to_real(cx, pv)));
                }
                return Ok(LoweredValue::Packed(pv));
            }
            // R-run Task 15: found writing `enum_struct.sv`'s own fixture
            // (this task's plan text assumed "s, the enum ... should
            // already work" but never anticipated an ENUM CONSTANT
            // reference, e.g. `s = BLUE;` -- `BLUE`'s own `NamedValue` node
            // resolves to the `EnumValue` symbol, which is never primed
            // into `cx.locals` at all (it has no runtime storage of its
            // own -- it is a compile-time constant, the same category as a
            // `parameter`/`genvar`). The pre-existing code unconditionally
            // treated ANY `cx.locals` miss as "read of non-local", which is
            // correct for a genuinely-unwired signal but wrong for this
            // case. Falls back to the exact same constant-folding chain
            // the `IntegerLiteral` arm above already uses
            // (`constant_value()` -> `as_integer()` -> `lower_const_any`)
            // rather than inventing a second, divergent way to build a
            // constant `PackedValue`/`AnyValue::Wide`.
            // A specparam read inside a procedural body carries no folded value of its own
            // on the expression; the symbol's frozen constant is its source value.
            let cv = e
                .constant_value()
                .or_else(|| {
                    // A hierarchical reference into another instance's (or a
                    // generate block's, or an enum's) constant (`u1.WA`,
                    // `g.VALUE`, `e_t.A`, LRM 23.6) folds to no value on the
                    // expression itself; the target symbol's value is exact.
                    matches!(
                        sym.kind(),
                        sv_lang::kinds::SymbolKind::Specparam
                            | sv_lang::kinds::SymbolKind::Parameter
                            | sv_lang::kinds::SymbolKind::EnumValue
                    )
                    .then(|| sym.constant_value())
                    .flatten()
                })
                .ok_or_else(|| LoweringError::unsupported_at("read of non-local", &sym))?;
            let base = match &cv {
                sv_lang::ConstantValue::Real(f) => LoweredValue::Real(RealValue {
                    llvm: cx.ctx.f64_type().const_float(*f),
                }),
                // A `string` parameter/localparam: its text, as a string literal.
                sv_lang::ConstantValue::String(text) => {
                    LoweredValue::Str(crate::strings::literal(cx, text.as_bytes()))
                }
                // A class-handle parameter/localparam (LRM 6.20.2, 8.4): the only
                // constant handle is `null`, lowered like the `null` literal.
                sv_lang::ConstantValue::Null => {
                    let op = OpBuilder {
                        ctx: cx.ctx,
                        b: &cx.b,
                    };
                    LoweredValue::Packed(op.pack(
                        op.i_n(64).const_zero(),
                        op.i_n(64).const_zero(),
                        64,
                        cx.repr,
                        false,
                    ))
                }
                // An unpacked-struct parameter/localparam (LRM 6.20.2, 7.2): its fields'
                // stored bits, the same form an unpacked struct variable holds.
                sv_lang::ConstantValue::Array(_)
                    if e.expr_type().is_some_and(|t| t.is_unpacked_struct()) =>
                {
                    let ty = e.expr_type().expect("checked above");
                    let mut strs = Vec::new();
                    let bits = const_stored_bits_strs(&ty, &cv, 0, &mut strs)
                        .filter(|b| !b.is_empty() && b.len() as u32 <= crate::value::WIDE_THRESHOLD)
                        .ok_or_else(|| {
                            LoweringError::unsupported_at(
                                "an unpacked-struct named constant with a field that is not \
                                 integral, real or string (or wider than the wide-value threshold)",
                                &sym,
                            )
                        })?;
                    let mut pv = crate::value::const_bits(cx.ctx, &bits, false, cx.repr);
                    // Each string field's slot is the run-time interned id of its text.
                    for (off, text) in &strs {
                        let id = crate::strings::literal(cx, text).llvm;
                        let wide = pv.llvm.get_type();
                        let ext = cx.b.build_int_z_extend(id, wide, "sid").unwrap();
                        let sh = cx
                            .b
                            .build_left_shift(ext, wide.const_int(*off as u64, false), "sid_sh")
                            .unwrap();
                        pv.llvm = cx.b.build_or(pv.llvm, sh, "sid_or").unwrap();
                    }
                    LoweredValue::Packed(pv)
                }
                _ => {
                    let iv = cv.as_integer().ok_or_else(|| {
                        LoweringError::unsupported_at(
                            "named constant is neither an integer, a real nor a string \
                             (an unpacked-array, struct or class-handle named constant \
                             read is out of scope)",
                            &sym,
                        )
                    })?;
                    lower_constant(cx, iv, Some(e))?
                }
            };
            // SD-C / T28 (LRM 32.4.3): a specparam an SDF `LABEL` annotated reads as the
            // annotated value, not the one folded at compile time.
            if sym.kind() == sv_lang::kinds::SymbolKind::Specparam {
                return annotated_specparam_read(cx, &op, &sym, base);
            }
            Ok(base)
        }
        ExpressionKind::UnaryOp => {
            let operand_expr = e.operand().ok_or_else(|| {
                LoweringError::unsupported_at("unary op missing operand", &cx.fn_sym)
            })?;
            let uop = e.unary_op().ok_or_else(|| {
                LoweringError::unsupported_at("unary op missing operator", &cx.fn_sym)
            })?;
            // Task 26 (CG-121) support code: `++`/`--` (pre/post) need to
            // WRITE BACK into the operand's `locals` slot, unlike every
            // other unary operator here (which only reads its operand's
            // already-lowered VALUE) -- so this is a genuinely separate
            // lvalue path, intercepted before the generic `lower_expr`
            // operand evaluation below, mirroring `Assignment`'s own
            // "resolve lvalue -> locals slot" shape (same scope
            // restriction: only a plain `NamedValue` lvalue, never a
            // bit-select/concat/non-local, which is a loud `LoweringError`
            // rather than a silent no-op). Added because Task 26's `for`
            // loop step expressions (`for (...; ...; i++)`) are the most
            // common real-world site for this operator; `func.rs`'s
            // `ForLoop` arm is `lower_expr`'s only caller that needs it
            // today, but this is ordinary expression-value lowering, not
            // loop-specific, so it belongs here, not in `func.rs`.
            if matches!(
                uop,
                UnaryOp::Preincrement
                    | UnaryOp::Predecrement
                    | UnaryOp::Postincrement
                    | UnaryOp::Postdecrement
            ) {
                // Any target `select.rs` can resolve: read it as an rvalue,
                // add/subtract one at its own width, write it back.
                let old = read_modify_target(cx, operand_expr)?;
                if let LoweredValue::Real(rv) = old {
                    // `r++` on a real adds 1.0 (LRM §11.4.2).
                    let one = cx.ctx.f64_type().const_float(1.0);
                    let f = crate::real::as_f64(cx, rv.llvm);
                    let new = match uop {
                        UnaryOp::Preincrement | UnaryOp::Postincrement => {
                            cx.b.build_float_add(f, one, "real_inc").unwrap()
                        }
                        _ => cx.b.build_float_sub(f, one, "real_dec").unwrap(),
                    };
                    let new = LoweredValue::Real(RealValue { llvm: new });
                    store_to(cx, operand_expr, new)?;
                    return Ok(match uop {
                        UnaryOp::Preincrement | UnaryOp::Predecrement => new,
                        _ => old,
                    });
                }
                let old_pv =
                    old.into_packed("increment/decrement of a >128-bit target", &cx.fn_sym)?;
                let width = old_pv.width;
                let one_pv = op.pack(
                    op.i_n(width).const_int(1, false),
                    op.i_n(width).const_zero(),
                    width,
                    cx.repr,
                    old_pv.signed,
                );
                let new_pv = match uop {
                    UnaryOp::Preincrement | UnaryOp::Postincrement => op.add4(old_pv, one_pv),
                    UnaryOp::Predecrement | UnaryOp::Postdecrement => op.sub4(old_pv, one_pv),
                    _ => unreachable!("filtered by the outer matches! above"),
                };
                // Through `store_to`: the target may be an element of a
                // queue or associative array.
                store_to(cx, operand_expr, LoweredValue::Packed(new_pv))?;
                let result_pv = match uop {
                    UnaryOp::Preincrement | UnaryOp::Predecrement => new_pv,
                    UnaryOp::Postincrement | UnaryOp::Postdecrement => old_pv,
                    _ => unreachable!("filtered by the outer matches! above"),
                };
                return Ok(LoweredValue::Packed(result_pv));
            }
            if uop == UnaryOp::LogicalNot
                && let Some(non_null) = crate::events::lower_event_condition(cx, operand_expr)?
            {
                // `!e` of an event: true iff it is `null` (15.5.5.3).
                let is_null = cx.b.build_not(non_null, "ev_isnull").unwrap();
                return Ok(LoweredValue::Packed(op.pack(
                    is_null,
                    cx.ctx.bool_type().const_zero(),
                    1,
                    cx.repr,
                    false,
                )));
            }
            let operand_lv = lower_expr(cx, operand_expr)?;
            match operand_lv {
                LoweredValue::Str(_) => Err(LoweringError::unsupported_at(
                    &format!("unary op {uop:?} on a string operand"),
                    &cx.fn_sym,
                )),
                // Task 8 (CG-037) plumbing note: a negative real LITERAL
                // (e.g. `-3.9`) is not its own literal node -- slang parses
                // it as `UnaryOp::Minus` over the positive `RealLiteral`
                // `3.9` (confirmed by running the BINDING CORRECTION 2
                // regression tests against real SV source), so real->int
                // rounding's own negative-value test cases are unreachable
                // from compiled source without this arm. Only `Minus`
                // (real negation, LRM 6.12) is meaningful on a real
                // operand; every other unary operator is a loud error.
                LoweredValue::Real(rv) => match uop {
                    UnaryOp::Minus => Ok(LoweredValue::Real(RealValue {
                        llvm: cx.b.build_float_neg(rv.llvm, "fneg").unwrap(),
                    })),
                    UnaryOp::Plus => Ok(LoweredValue::Real(rv)),
                    UnaryOp::LogicalNot => {
                        let t = crate::real::real_truth(cx, rv);
                        let not = cx.b.build_not(t, "real_lnot").unwrap();
                        Ok(LoweredValue::Packed(op.pack(
                            not,
                            cx.ctx.bool_type().const_zero(),
                            1,
                            cx.repr,
                            false,
                        )))
                    }
                    other => Err(LoweringError::unsupported_at(
                        &format!("unary op {other:?} on a real operand"),
                        &cx.fn_sym,
                    )),
                },
                LoweredValue::Packed(a) => Ok(LoweredValue::Packed(match uop {
                    UnaryOp::BitwiseNot => op.not4(a),
                    UnaryOp::BitwiseAnd => op.redand4(a),
                    UnaryOp::BitwiseOr => op.redor4(a),
                    UnaryOp::BitwiseXor => op.redxor4(a),
                    // LRM 11.4.9 reduction `~&`, `~|`, `~^`/`^~`: the
                    // 1-bit reduction inverted bitwise (an X result stays X).
                    UnaryOp::BitwiseNand => op.not4(op.redand4(a)),
                    UnaryOp::BitwiseNor => op.not4(op.redor4(a)),
                    UnaryOp::BitwiseXnor => op.not4(op.redxor4(a)),
                    UnaryOp::Minus => op.neg4(a),
                    // LRM 11.4.3 unary `+` is the identity on its operand.
                    UnaryOp::Plus => a,
                    // Task F1 (CG-026): `!` (logical NOT, LRM SS11.4.7) --
                    // always a 1-bit unsigned result, reusing the
                    // reduction-OR helper (see `OpBuilder::lnot4`).
                    UnaryOp::LogicalNot => op.lnot4(a),
                    other => {
                        return Err(LoweringError::unsupported_at(
                            &format!("unary op {other:?}"),
                            &cx.fn_sym,
                        ));
                    }
                })),
                // Review fix r2: no wide-value unary arithmetic exists yet
                // (Task 16+ scope, same as every other wide-value consumer
                // in this file) -- a loud, named `LoweringError`, never a
                // panic (e.g. `a.llvm` on a `WideValueRef`, which has no
                // such field) and never a silent narrow reinterpretation.
                // Unary `+` (LRM 11.4.3) is the identity at any width.
                v @ (LoweredValue::Wide(_) | LoweredValue::Huge(_)) if uop == UnaryOp::Plus => {
                    Ok(v)
                }
                LoweredValue::Wide(_) | LoweredValue::Huge(_) => {
                    Err(LoweringError::unsupported_at(
                        &format!("unary op {uop:?} on a wide (>WIDE_THRESHOLD-bit) operand"),
                        &cx.fn_sym,
                    ))
                }
            }
        }
        ExpressionKind::BinaryOp => {
            let bop = e.binary_op().ok_or_else(|| {
                LoweringError::unsupported_at("binary op missing operator", &cx.fn_sym)
            })?;
            // `type(a) == type(b)` (LRM 1800-2023 6.23): decided at compile
            // time by type matching (6.22.1).
            if let Some(eq) = type_reference_equality(e, bop) {
                let bit = if eq {
                    sv_lang::Bit::One
                } else {
                    sv_lang::Bit::Zero
                };
                return Ok(LoweredValue::Packed(crate::value::const_bits(
                    cx.ctx,
                    &[bit],
                    false,
                    cx.repr,
                )));
            }
            // `==`/`!=` of events (LRM 1800-2023 15.5.5.2, 15.5.5.3).
            if matches!(
                bop,
                BinaryOp::Equality
                    | BinaryOp::Inequality
                    | BinaryOp::CaseEquality
                    | BinaryOp::CaseInequality
            ) && let Some(v) = crate::events::lower_event_equality(
                cx,
                e,
                matches!(bop, BinaryOp::Inequality | BinaryOp::CaseInequality),
            )? {
                return Ok(v);
            }
            // `==`/`!=` of two queues, dynamic or associative arrays.
            if matches!(
                bop,
                BinaryOp::Equality
                    | BinaryOp::Inequality
                    | BinaryOp::CaseEquality
                    | BinaryOp::CaseInequality
            ) && let Some(r) = crate::collections::lower_equality(
                cx,
                e,
                matches!(bop, BinaryOp::Inequality | BinaryOp::CaseInequality),
            ) {
                return r;
            }
            // Task 9 (CG-090, CG-007): `&&`/`||` are short-circuit control
            // flow (LRM 1800-2023 §11.4.7's own evaluation-order rule), NOT
            // a bitwise combination of two eagerly-lowered operands --
            // routed to a dedicated lowering BEFORE the generic
            // eager-lower-both-operands path below, which every other
            // binary operator in this match still uses unchanged.
            // Review fix (r1): this generic `BinaryOp` dispatch arm is the
            // "ordinary value" consumption site (an assignment RHS, a
            // sub-expression of a larger expression, ...), NOT a direct
            // if/while/wait/case condition -- that site is
            // `lower_condition` below, which alone is permitted to collapse
            // an ambiguous result to a crisp false per §12.4.
            // `lower_short_circuit_logical_value` instead preserves the
            // operand's own tri-state ambiguity per LRM SS11.4.7 Table
            // 11-4 (CG-021: every operator's value result must be
            // LRM-correct against its truth table, and this is the only
            // place `LogicalAnd`/`LogicalOr` value-lowering exists in this
            // crate).
            let is_real_operand = |x: Option<sv_lang::Expression<'d>>| {
                x.and_then(|x| x.expr_type())
                    .is_some_and(|t| t.is_floating())
            };
            if (is_real_operand(e.left()) || is_real_operand(e.right()))
                && !matches!(
                    bop,
                    BinaryOp::LogicalImplication | BinaryOp::LogicalEquivalence
                )
            {
                return lower_real_binary_expr(cx, e, bop);
            }
            let is_string_operand = |x: Option<sv_lang::Expression<'d>>| {
                x.and_then(|x| x.expr_type()).is_some_and(|t| t.is_string())
            };
            if (is_string_operand(e.left()) || is_string_operand(e.right()))
                && let Some(v) = crate::strings::lower_string_binary(cx, e, bop)?
            {
                return Ok(v);
            }
            if e.left()
                .and_then(|x| x.expr_type())
                .is_some_and(|t| t.is_unpacked_array())
            {
                return crate::arrays::compare_arrays(cx, e, bop).map(LoweredValue::Packed);
            }
            if matches!(bop, BinaryOp::LogicalAnd | BinaryOp::LogicalOr) {
                if let Some(v) = fold_constant_logical(cx, e)? {
                    return Ok(v);
                }
                return lower_short_circuit_logical_value(
                    cx,
                    e,
                    bop == BinaryOp::LogicalAnd,
                    false,
                );
            }
            // `a -> b` is `!a || b` (LRM 11.4.7): the right operand is only
            // evaluated when the left is not definitely false.
            if bop == BinaryOp::LogicalImplication {
                return lower_short_circuit_logical_value(cx, e, false, true);
            }
            // `a <-> b` evaluates both operands: `(a -> b) && (b -> a)`,
            // i.e. the 1-bit XNOR of the two tri-state truths (LRM 11.4.7).
            if bop == BinaryOp::LogicalEquivalence {
                return lower_logical_equivalence(cx, e);
            }
            // Task 12 (CG-134, CG-135, CG-136, CG-137): power (`**`) is
            // routed BEFORE the generic eager-lower-both-operands path below
            // for the same reason `&&`/`||` are -- its two paths need
            // genuinely different treatment of the right operand, not a
            // uniform `PackedValue`. Per docs/design/codegen.md §2 / the
            // plan: try `e.right().constant_value()` first (a compile-time-
            // constant exponent unrolls via `pow4_const`, CG-134, with ZERO
            // IR built for the exponent operand itself -- not even a lowered
            // constant, so `const_exponent_unrolls_no_call_instruction`'s
            // "only muls" assertion can never be muddied by an unrelated
            // unused-constant instruction); else fall to the runtime
            // `pow4_call` helper (CG-135/CG-136).
            //
            // `iv.as_i64()` (not `iv.has_unknown()`/a raw bit read) is the
            // right query here: it already returns `None` whenever the
            // constant contains any X/Z bit or doesn't fit in 64 bits
            // (verified against the vendored sv-lang 0.1.9 source,
            // `rust/sv-lang/src/constant.rs`'s `SVInt::as_i64` doc comment:
            // "or `None` if it has unknown bits or does not fit") -- exactly
            // the two cases where compile-time-unrolling is impossible, so
            // both correctly fall through to the runtime path instead of
            // this task inventing its own separate has-unknown check.
            if bop == BinaryOp::Power {
                let base = lower_expr(
                    cx,
                    e.left().ok_or_else(|| {
                        LoweringError::unsupported_at("power missing base operand", &cx.fn_sym)
                    })?,
                )?
                .into_packed("power on a non-integral (real) base operand", &cx.fn_sym)?;
                let exp_expr = e.right().ok_or_else(|| {
                    LoweringError::unsupported_at("power missing exponent operand", &cx.fn_sym)
                })?;
                let const_exp: Option<i64> = exp_expr
                    .constant_value()
                    .as_ref()
                    .and_then(sv_lang::ConstantValue::as_integer)
                    .and_then(sv_lang::SVInt::as_i64);
                return Ok(LoweredValue::Packed(match const_exp {
                    Some(exp) => op.pow4_const(base, exp),
                    None => {
                        let exp_pv = lower_expr(cx, exp_expr)?.into_packed(
                            "power on a non-integral (real) exponent operand",
                            &cx.fn_sym,
                        )?;
                        // A runtime exponent wider than 64 bits (LRM 11.4.3:
                        // self-determined) goes to the `_e{width}` helper
                        // variant, which scans only the exponent bits that
                        // can matter. The unrolled scan is `min(exp, base)`
                        // steps of base-width multiplies, so an absurdly
                        // wide pair is refused by name, never lowered into
                        // a multi-million-multiply function.
                        if exp_pv.width > 64
                            && u64::from(exp_pv.width.min(base.width)) * u64::from(base.width)
                                > 4_000_000
                        {
                            return Err(LoweringError::unsupported_at(
                                "'**' with a runtime exponent wider than 64 bits \
                                 on a base this wide (the unrolled square-and-\
                                 multiply scan would exceed the size limit)",
                                &cx.fn_sym,
                            ));
                        }
                        // BINDING/design note: per the "only ever consult
                        // the left/base operand's own `signed`" discipline
                        // this crate already applies to every other
                        // signed-sensitive op (`div4`/`mod4`/the relational
                        // pair), `pow4_call`'s `signed` selects the
                        // `sv_ipow_{u,s}N` variant by the BASE's own
                        // signedness (whether the LRM `-1` special case is
                        // even checkable) -- see `pow4_call`'s doc comment
                        // for how the exponent's OWN, independent
                        // signedness (it is self-determined per LRM
                        // 1800-2023, so it need not match the base's) is
                        // still handled correctly despite this crate's
                        // single `signed: bool` parameter.
                        op.pow4_call(cx.module, base, exp_pv, base.signed)
                    }
                }));
            }
            let l = lower_expr(
                cx,
                e.left().ok_or_else(|| {
                    LoweringError::unsupported_at("binary op missing left operand", &cx.fn_sym)
                })?,
            )?
            .into_packed(
                "binary op on a non-integral (real) left operand",
                &cx.fn_sym,
            )?;
            let r = lower_expr(
                cx,
                e.right().ok_or_else(|| {
                    LoweringError::unsupported_at("binary op missing right operand", &cx.fn_sym)
                })?,
            )?
            .into_packed(
                "binary op on a non-integral (real) right operand",
                &cx.fn_sym,
            )?;
            Ok(LoweredValue::Packed(match bop {
                BinaryOp::BinaryAnd => op.and4(l, r),
                BinaryOp::BinaryOr => op.or4(l, r),
                BinaryOp::BinaryXor => op.xor4(l, r),
                // LRM 11.4.8 binary `~^`/`^~`: the bitwise XOR inverted
                // (an X bit stays X).
                BinaryOp::BinaryXnor => op.not4(op.xor4(l, r)),
                BinaryOp::Add => op.add4(l, r),
                BinaryOp::Subtract => op.sub4(l, r),
                BinaryOp::Multiply => op.mul4(l, r),
                BinaryOp::Divide => op.div4(l, r),
                BinaryOp::Mod => op.mod4(l, r),
                BinaryOp::LogicalShiftLeft | BinaryOp::ArithmeticShiftLeft => op.shl4(l, r),
                BinaryOp::LogicalShiftRight => op.lshr4(l, r),
                // ashr4 itself dispatches on `l.signed` (LRM SS11.4.10:
                // `>>>` on an unsigned operand is defined as `>>`, and
                // slang's AST does not already distinguish the two cases at
                // this BinaryOp variant -- see ashr4's doc comment).
                BinaryOp::ArithmeticShiftRight => op.ashr4(l, r),
                // CG-130: `===`/`!==` are pure bitwise identity over both
                // planes, always known -- `!==` is a plain boolean NOT of
                // `===`'s result (`not4` on a result whose own unk lane is
                // always 0 reduces to exactly that, no separate formula
                // needed).
                BinaryOp::CaseEquality => op.caseeq4(l, r),
                BinaryOp::CaseInequality => op.not4(op.caseeq4(l, r)),
                // CG-131: `==?`/`!=?` are the shared wildcard-match
                // primitive with `treat_x_as_wildcard: true` -- ASYMMETRIC
                // per IEEE 1800-2023 SS11.4.6: only `r`'s (the right-hand
                // operand's) X/Z bits are wildcards, so unlike `caseeq4`
                // this result can itself be X (see `wildcard_match`'s doc
                // comment). `!=?` mirrors `!==`'s NOT-of-the-positive-form
                // lowering; `not4` correctly propagates the X here, unlike
                // `caseeq4`'s always-known result.
                BinaryOp::WildcardEquality => op.wildeq4(l, r),
                BinaryOp::WildcardInequality => op.not4(op.wildeq4(l, r)),
                // Task 11 (CG-021): loose `==`/`!=` -- any-operand-unknown
                // anywhere -> X, distinct from `===`/`!==`'s always-known
                // bitwise-identity formula above (see `OpBuilder::eq4`'s
                // doc comment).
                BinaryOp::Equality => op.eq4(l, r),
                BinaryOp::Inequality => op.neq4(l, r),
                // Task 11 (CG-021): relational operators. Per ARCHITECTURE.md's
                // Codegen note (the same "only ever consult `l`" discipline
                // `div4`/`mod4` already follow for `signed`), dispatch to the
                // signed or unsigned word-compare pair based solely on the
                // left operand's own `signed` -- slang's inserted `Conversion`
                // nodes have already equalized `l`/`r`'s signedness before a
                // binary op lowers.
                BinaryOp::LessThan => {
                    if l.signed {
                        op.slt4(l, r)
                    } else {
                        op.ult4(l, r)
                    }
                }
                BinaryOp::LessThanEqual => {
                    if l.signed {
                        op.sle4(l, r)
                    } else {
                        op.ule4(l, r)
                    }
                }
                BinaryOp::GreaterThan => {
                    if l.signed {
                        op.sgt4(l, r)
                    } else {
                        op.ugt4(l, r)
                    }
                }
                BinaryOp::GreaterThanEqual => {
                    if l.signed {
                        op.sge4(l, r)
                    } else {
                        op.uge4(l, r)
                    }
                }
                other => {
                    return Err(LoweringError::unsupported_at(
                        &format!("binary op {other:?}"),
                        &cx.fn_sym,
                    ));
                }
            }))
        }
        // Task 10 (CG-039, CG-040, CG-041, CG-008): ternary `?:` -- see
        // `lower_ternary` below for the full formula.
        ExpressionKind::ConditionalOp => lower_ternary(cx, e),
        // CG-132/CG-133: `x inside {c0, c1, ...}` -- each candidate is
        // either a plain value (wildcard-matched against `x`, CG-132's
        // "plain element" case) or a `ValueRange` (`[lo:hi]`, an
        // X-propagating `>=`/`<=` pair, CG-132's "range" case). Every
        // candidate's contribution is already a genuinely 3-valued (0/1/X)
        // single bit (see `OpBuilder::inside_plain_candidate4`/
        // `inside_range_candidate4`'s doc comments), so OR-reducing them
        // via the existing 4-state `or4` implements CG-133's "any matched
        // wins, else X if any was ambiguous, else 0" formula directly.
        //
        // `x dist {...}` (16.14.2): "when a property with biasing is used
        // within an assert or cover assertion statement, the dist operator is
        // equivalent to the inside operator, and the weight specification is
        // ignored". Simulation of an assertion never draws values, so a
        // `dist` lowers exactly as the `inside` over the same items.
        ExpressionKind::Inside | ExpressionKind::Dist => {
            let is_dist = e.kind() == ExpressionKind::Dist;
            let left_expr = if is_dist {
                e.dist_left()
            } else {
                e.inside_left()
            };
            let left_expr = left_expr.ok_or_else(|| {
                LoweringError::unsupported_at("inside missing left operand", &cx.fn_sym)
            })?;
            let candidates = if is_dist {
                e.dist_items().iter().map(|item| item.value()).collect()
            } else {
                e.inside_range_list()
            };
            // LRM 11.4.13: a string left operand is compared by `==` (a
            // range by the string relational operators, 6.16).
            if left_expr.expr_type().is_some_and(|t| t.is_string()) {
                return crate::strings::lower_string_inside(cx, left_expr, candidates);
            }
            let left = match lower_expr(cx, left_expr)? {
                LoweredValue::Real(r) => {
                    return crate::real::lower_real_inside(cx, r, candidates);
                }
                other => other.into_packed("inside on a non-integral left operand", &cx.fn_sym)?,
            };
            if candidates.is_empty() {
                return Err(LoweringError::unsupported_at(
                    "inside with an empty candidate list",
                    &cx.fn_sym,
                ));
            }
            let mut acc: Option<PackedValue<'ctx>> = None;
            for cand in candidates {
                let contrib = inside_candidate(cx, left, cand)?;
                acc = Some(match acc {
                    None => contrib,
                    Some(prev) => op.or4(prev, contrib),
                });
            }
            Ok(LoweredValue::Packed(
                acc.expect("candidates non-empty, checked above"),
            ))
        }
        // Task 17 (CG-022): bit-select (`v[i]`) -- closed-form shift+
        // truncate over both lanes (`OpBuilder::bit_select4`), never a
        // per-bit loop. `select_value()`/`selector()` give the base vector
        // and the (possibly dynamic, possibly X/Z-containing, possibly
        // out-of-range) index expression respectively; every LRM SS11.5.1
        // failure mode (unknown index, out-of-range index) is folded into
        // `bit_select4`'s own closed-form formula, not special-cased here.
        //
        // Scope note (documented limitation, consistent with this crate's
        // existing width model -- `types.rs::lower_type` already treats
        // every integral `Type` as a flat `bit_width()`-wide value with no
        // declared-bound-direction concept anywhere else in this crate
        // either): the index is read here as a direct PHYSICAL bit offset
        // from the value's own LSB (bit 0), which is only correct for the
        // common canonical `[N-1:0]`-declared vector. A non-canonical
        // ascending declared range (`logic [0:7] x; x[3]`) would need the
        // declared lower bound threaded through from `sv_lang::Type` to
        // remap the logical index to a physical offset -- genuinely out of
        // this task's scope (no other operator in this crate consults
        // declared-bound direction either).
        ExpressionKind::ElementSelect => {
            // An element of a queue, dynamic or associative array.
            if let Some(r) = crate::collections::read_element_warning(cx, e) {
                return r;
            }
            if let Some(r) = crate::collections::read_fixed_in_coll(cx, e) {
                return r;
            }
            let base_expr = e.select_value().ok_or_else(|| {
                LoweringError::unsupported_at("bit-select missing base value", &cx.fn_sym)
            })?;
            // `s[i]` on a string: its i-th character.
            if base_expr.expr_type().is_some_and(|t| t.is_string()) {
                let idx = e.selector().ok_or_else(|| {
                    LoweringError::unsupported_at("string index missing", &cx.fn_sym)
                })?;
                return crate::strings::lower_getc(cx, base_expr, idx);
            }
            // `vif.a[i]` (`crate::vif`).
            if let Some(v) = crate::vif::read_element(cx, e) {
                return v;
            }
            // An element of a named constant `string` or `real` array.
            if let Some(v) = crate::arrays::read_constant_unpacked_element(cx, e)? {
                return Ok(v);
            }
            // An unpacked-array element (`mem[i]`, `a[i][j]`, a local
            // array's element): `crate::arrays`, never a bit-select.
            if let Some(r) = crate::arrays::resolve_element(cx, e)? {
                return Ok(LoweredValue::Packed(crate::arrays::read_element(cx, &r)?));
            }
            let base = lower_expr(cx, base_expr)?
                .into_packed("bit-select on a non-integral (real) base value", &cx.fn_sym)?;
            // Declared-range-aware (`select.rs`): `v[i]` on `logic [8:1] v`,
            // `logic [0:7] v`, or a packed 2-D `logic [3:0][7:0] v` (an
            // 8-bit element) all address the right physical bits.
            let geom = crate::select::geom_of(base_expr.expr_type(), base.width);
            let window = crate::select::select_window(cx, e, base.width, geom)?;
            let mut out = crate::select::read_window(&op, base, window);
            out.signed = e.expr_type().is_some_and(|t| t.is_signed());
            Ok(LoweredValue::Packed(crate::select::two_state_result(
                &op, e, out,
            )))
        }
        // Task 17 (CG-022): part-select -- `v[l:r]` (Simple, both bounds
        // compile-time constant), `v[base +: w]` (IndexedUp), `v[base -: w]`
        // (IndexedDown, `w` compile-time constant in both indexed forms).
        // All three modes route through the single shared closed-form
        // `OpBuilder::part_select4` window-extraction primitive; only the
        // (constant vs. dynamic) `lo`/`lo_unknown` computation differs per
        // mode, delegated to `OpBuilder::{indexed_up_lo4,indexed_down_lo4}`
        // for the two dynamic-base forms. Same physical-offset scope note
        // as `ElementSelect` above.
        ExpressionKind::RangeSelect => {
            let base_expr = e.select_value().ok_or_else(|| {
                LoweringError::unsupported_at("part-select missing base value", &cx.fn_sym)
            })?;
            let base = lower_expr(cx, base_expr)?.into_packed(
                "part-select on a non-integral (real) base value",
                &cx.fn_sym,
            )?;
            // Declared-range-aware window (`select.rs`); a constant
            // out-of-range simple select reads X.
            let geom = crate::select::geom_of(base_expr.expr_type(), base.width);
            let window = crate::select::select_window(cx, e, base.width, geom)?;
            let out = crate::select::read_window(&op, base, window);
            Ok(LoweredValue::Packed(crate::select::two_state_result(
                &op, e, out,
            )))
        }
        // Task 17 (CG-022): concatenation `{a, b, ...}` -- closed-form
        // shift+or assembly over each operand's own already-lowered val/unk
        // lanes (`OpBuilder::concat4`), MSB-operand-first per SV ordering
        // (`Expression::operands()` already yields the operand list in
        // slang's own source order, which for `{a, b}` is `[a, b]` with `a`
        // as the MSB-most operand -- verified against the vendored sv-lang
        // 0.1.9 C++ source, `ConcatenationExpression::operands()`). A loop
        // over the (small, compile-time-fixed) OPERAND COUNT here is not
        // the "runtime loop over bit width" CG-022 forbids -- each operand
        // becomes exactly one shift+or pair in the emitted IR regardless of
        // how wide that operand's own type is (see
        // `closed_form_no_bitwidth_loop_in_emitted_ir`, tests/
        // select_concat.rs).
        ExpressionKind::Concatenation => {
            let operand_exprs = e.operands();
            if operand_exprs.is_empty() {
                return Err(LoweringError::unsupported_at(
                    "concatenation with no operands (e.g. an empty queue `{}`) is out of scope",
                    &cx.fn_sym,
                ));
            }
            // A zero-count replication operand contributes nothing (LRM
            // 1800-2023 §11.4.12.1); slang requires a positive-size sibling.
            // The dropped operand's own side effects still run (`{0{f()}}`
            // calls `f` once, matching iverilog and ivtest concat3/concat4),
            // in source order; its value is discarded.
            let mut kept = Vec::with_capacity(operand_exprs.len());
            for o in operand_exprs {
                if is_zero_replication(&o) {
                    if let Some(inner) = o.replication_concat() {
                        let _ = lower_expr(cx, inner)?;
                    }
                } else {
                    kept.push(o);
                }
            }
            let operand_exprs = kept;
            let mut operands = Vec::with_capacity(operand_exprs.len());
            for oe in operand_exprs {
                operands.push(lower_expr(cx, oe)?.into_packed(
                    "concatenation operand must itself lower to an integral value",
                    &cx.fn_sym,
                )?);
            }
            Ok(LoweredValue::Packed(op.concat4(&operands)))
        }
        // Task 17 (CG-022): replication `{n{x}}` -- LRM 1800-2023 SS11.4.12
        // requires `n` to be a compile-time constant (slang's own
        // elaboration already enforces this -- `ReplicationExpression`'s
        // `count()` is only ever reachable here already const-folded, same
        // discipline as `BinaryOp::Power`'s const-exponent fast path
        // above). `replication_concat()` is itself always an
        // `ExpressionKind::Concatenation` node (verified against the
        // vendored sv-lang 0.1.9 C++ source,
        // `ReplicationExpression::fromSyntax`: the syntax grammar's
        // multiplier-brace body is always a nested `{...}` concatenation,
        // even for a single element like `{3{2'b01}}`), so lowering it
        // through the ordinary `Concatenation` arm above via recursive
        // `lower_expr` already produces the correctly-assembled "unit" to
        // repeat -- `OpBuilder::replicate4` is then just `concat4` of that
        // unit repeated `n` times, closed-form over the (compile-time-
        // fixed) `n`, never a per-bit loop.
        //
        // A count of 0 is only legal per LRM when NESTED inside another
        // concatenation (`{a, {0{b}}}`, contributing zero width), and the
        // `Concatenation` arm drops such operands ([`is_zero_replication`]).
        // A standalone `{0{x}}` is already a hard compile-time error
        // upstream (slang's own `ReplicationZeroOutsideConcat` diagnostic),
        // so this arm's own `count <= 0` check below is a defense-in-depth
        // backstop -- a loud `LoweringError`, never a silent zero-width or
        // negative-width result.
        ExpressionKind::Replication => {
            let count_expr = e.replication_count().ok_or_else(|| {
                LoweringError::unsupported_at("replication missing count", &cx.fn_sym)
            })?;
            let count_i64 = require_const_i64(
                count_expr,
                "replication count must be a compile-time constant",
                &cx.fn_sym,
            )?;
            if count_i64 <= 0 {
                return Err(LoweringError::unsupported_at(
                    "replication with a non-positive count (a nested zero-count \
                     replication contributing zero width to an enclosing \
                     concatenation is out of scope)",
                    &cx.fn_sym,
                ));
            }
            let unit_expr = e.replication_concat().ok_or_else(|| {
                LoweringError::unsupported_at("replication missing concat operand", &cx.fn_sym)
            })?;
            let unit = lower_expr(cx, unit_expr)?.into_packed(
                "replication operand must itself lower to an integral value",
                &cx.fn_sym,
            )?;
            Ok(LoweredValue::Packed(op.replicate4(unit, count_i64 as u32)))
        }
        // Task 7 (CG-034, CG-035, CG-036, CG-038, CG-075): every operand
        // slang has resized/reinterpreted (assignment/return coercion,
        // operand equalization, explicit `signed'()`/`8'()`-style casts)
        // arrives wrapped in one of these -- CG-038: this arm trusts the
        // node's own `expr_type()`/`conversion_operand()` verbatim and
        // never re-derives a width/sign rule of its own from the raw
        // operand type.
        ExpressionKind::Conversion => {
            // A `const'(expr)` of a procedural concurrent assertion (16.14.6):
            // the value the process captured when it reached the assertion,
            // primed under the cast's synthetic key by the assertion's host.
            if e.conversion_is_const_cast() == Some(true)
                && let Some((slot, width, signed)) = cx
                    .locals
                    .get(&crate::sva::proc::const_cast_key(&e))
                    .copied()
            {
                let ty = if cx.repr == ValueRepr::FourState {
                    op.i_n(width * 2)
                } else {
                    op.i_n(width)
                };
                let v =
                    cx.b.build_load(ty, slot, "ld_const")
                        .unwrap()
                        .into_int_value();
                return Ok(LoweredValue::Packed(PackedValue {
                    llvm: v,
                    width,
                    repr: cx.repr,
                    signed,
                }));
            }
            let operand_expr = e.conversion_operand().ok_or_else(|| {
                LoweringError::unsupported_at("conversion missing operand", &cx.fn_sym)
            })?;
            if let Some(v) = crate::events::lower_event_truth(cx, e)? {
                return Ok(v);
            }
            // A string converted to an integral type: its bytes (LRM 6.16).
            if operand_expr.expr_type().is_some_and(|t| t.is_string())
                && let Some(to) = e.expr_type()
                && to.is_integral()
            {
                let s = crate::strings::to_string(cx, lower_expr_h(cx, operand_expr)?)?;
                return Ok(LoweredValue::Packed(crate::strings::to_bits(
                    cx,
                    s,
                    to.value_width(),
                    to.is_signed(),
                )?));
            }
            let kind = e.conversion_kind().ok_or_else(|| {
                LoweringError::unsupported_at("conversion missing conversion_kind", &cx.fn_sym)
            })?;
            match classify_conversion_kind(kind) {
                Ok(ConversionAction::Value) => {}
                Ok(ConversionAction::Stream) => {
                    return crate::stream::lower_stream_conversion(cx, e);
                }
                Ok(ConversionAction::BitstreamCast) => {
                    return crate::stream::lower_bitstream_cast(cx, e);
                }
                Err(msg) => return Err(LoweringError::unsupported_at(&msg, &cx.fn_sym)),
            }

            let to_ty = e.expr_type().ok_or_else(|| {
                LoweringError::unsupported_at("conversion missing result type", &cx.fn_sym)
            })?;
            let from_ty = operand_expr.expr_type().ok_or_else(|| {
                LoweringError::unsupported_at("conversion operand missing type", &cx.fn_sym)
            })?;

            // Task 8 (CG-037): dispatch on the (from, to) floating-ness
            // pair BEFORE the int<->int path below, exactly like CG-038's
            // discipline of trusting only this node's own `expr_type()`/
            // `conversion_operand()` -- never re-deriving a rule from the
            // raw operand.
            match (from_ty.is_floating(), to_ty.is_floating()) {
                (false, true) => {
                    // IntToFloat (CG-037): `sitofp`/`uitofp` per the
                    // OPERAND's own signedness (mirrors CG-035's "the value
                    // being converted decides", not the target) -- a real
                    // LLVM float-conversion instruction, never a bitcast
                    // (int_to_real_cast_uses_float_conversion_instruction,
                    // tests/real.rs).
                    if !from_ty.is_integral() {
                        return Err(LoweringError::unsupported_at(
                            &format!(
                                "conversion from non-integral, non-floating type {} to real",
                                from_ty.to_sv_string()
                            ),
                            &cx.fn_sym,
                        ));
                    }
                    let from_pv = lower_expr(cx, operand_expr)?.into_packed(
                        "int-to-real conversion operand must itself lower to an integral value",
                        &cx.fn_sym,
                    )?;
                    let float_ty = match lower_type(cx.ctx, &to_ty, cx.repr)? {
                        LoweredType::Float(t) => t,
                        LoweredType::Int(_) => {
                            unreachable!("to_ty.is_floating() was just checked true")
                        }
                    };
                    // CG-034-style flatten: real has no unknown plane, so
                    // any X/Z bit in the operand must resolve to a
                    // definite 0 (mask-then-truncate) before the float
                    // conversion, never survive as a spurious bit pattern.
                    let flat = op.to_2state4(from_pv);
                    let raw = op.lane_val(flat);
                    let float_v = if from_pv.signed {
                        cx.b.build_signed_int_to_float(raw, float_ty, "sitofp")
                            .unwrap()
                    } else {
                        cx.b.build_unsigned_int_to_float(raw, float_ty, "uitofp")
                            .unwrap()
                    };
                    // Every computed real is an f64 (`crate::real`).
                    Ok(LoweredValue::Real(RealValue {
                        llvm: crate::real::as_f64(cx, float_v),
                    }))
                }
                (true, false) => {
                    // FloatToInt (CG-037, BINDING CORRECTION 2): the
                    // IMPLICIT real->int Conversion node ROUNDS to nearest,
                    // ties away from zero -- NEVER truncates (`$rtoi`'s
                    // rule; see `rtoi_is_a_distinct_unimplemented_path_
                    // not_the_conversion_node`, tests/real.rs, which
                    // guards this exact node reusing `$rtoi`'s -- currently
                    // nonexistent -- lowering).
                    if !to_ty.is_integral() {
                        return Err(LoweringError::unsupported_at(
                            &format!(
                                "conversion from real to non-integral, non-floating type {}",
                                to_ty.to_sv_string()
                            ),
                            &cx.fn_sym,
                        ));
                    }
                    let from_rv = lower_expr(cx, operand_expr)?.into_real(
                        "real-to-int conversion operand must itself lower to a real value",
                        &cx.fn_sym,
                    )?;
                    let to_width = to_ty.value_width();
                    // A NaN or infinite real has no integer value: a 4-state
                    // destination takes all-x (the established simulator
                    // behaviour, ivtest cast_int; LRM 6.12.2 leaves it
                    // unspecified), a 2-state one 0. `v - v` is NaN exactly
                    // for NaN/inf; the operand is zeroed first so no LLVM
                    // poison is ever formed.
                    let fty = from_rv.llvm.get_type();
                    let diff =
                        cx.b.build_float_sub(from_rv.llvm, from_rv.llvm, "rti_vmv")
                            .unwrap();
                    let bad = cx
                        .b
                        .build_float_compare(inkwell::FloatPredicate::UNO, diff, diff, "rti_bad")
                        .unwrap();
                    let safe =
                        cx.b.build_select(bad, fty.const_zero(), from_rv.llvm, "rti_safe")
                            .unwrap()
                            .into_float_value();
                    let rounded =
                        op.round_real_to_int(RealValue { llvm: safe }, to_width, to_ty.is_signed());
                    let wty = op.i_n(to_width);
                    let unk = if to_ty.is_four_state() {
                        cx.b.build_select(bad, wty.const_all_ones(), wty.const_zero(), "rti_unk")
                            .unwrap()
                            .into_int_value()
                    } else {
                        wty.const_zero()
                    };
                    Ok(LoweredValue::Packed(op.pack(
                        rounded,
                        unk,
                        to_width,
                        cx.repr,
                        to_ty.is_signed(),
                    )))
                }
                (true, true) => {
                    // real <-> shortreal: rounded to the target's precision
                    // (kept as an f64, `crate::real`).
                    let rv = lower_expr(cx, operand_expr)?
                        .into_real("real conversion of a non-real value", &cx.fn_sym)?;
                    let f = crate::real::as_f64(cx, rv.llvm);
                    Ok(LoweredValue::Real(RealValue {
                        llvm: if to_ty.bit_width() == 32 {
                            crate::real::round_to_short(cx, f)
                        } else {
                            f
                        },
                    }))
                }
                (false, false) => {
                    let from = lower_expr(cx, operand_expr)?.into_packed(
                        "int<->int conversion operand must itself lower to an integral value",
                        &cx.fn_sym,
                    )?;

                    // CG-034: flatten 4-state -> 2-state (mask-then-truncate,
                    // `known_val = val & ~unk`) BEFORE any width adjustment,
                    // exactly when the target is 2-state and the source is
                    // 4-state (a same-width `logic`->`bit` cast is the minimal
                    // case; slang emits this as its own single-step Conversion
                    // node, verified against the vendored sv-lang 0.1.9 -- a
                    // combined width-change-and-flatten source expression instead
                    // decomposes into a nested pair of Conversion nodes, which
                    // `lower_expr`'s ordinary recursion into `conversion_operand()`
                    // already composes correctly with no special-casing needed
                    // here).
                    let flattened = if from_ty.is_four_state() && !to_ty.is_four_state() {
                        op.to_2state4(from)
                    } else {
                        from
                    };

                    // CG-035 (BINDING CORRECTION 1): width-adjust using the
                    // OPERAND's OWN signedness for the extension fill (LRM
                    // 11.6.1 -- sign- vs zero-extension depends on the value
                    // being extended, not the target). CG-038: `to_width` comes
                    // only from the Conversion node's own `expr_type()`.
                    let to_width = to_ty.value_width();
                    let from_width = from_ty.value_width();
                    let width_adjusted = match to_width.cmp(&from_width) {
                        std::cmp::Ordering::Greater => {
                            // A `Propagated` conversion (kind 1) is the
                            // operand of a context-determined operator
                            // being widened to the operator's type: LRM
                            // 11.8.2 sign-extends it only if THAT type is
                            // signed, so a signed operand of a mixed-sign
                            // (hence unsigned) expression is zero-extended.
                            let fill = if kind == 1 {
                                to_ty.is_signed()
                            } else {
                                flattened.signed
                            } || unsized_literal_leads_unknown(operand_expr);
                            op.extend4(flattened, to_width, fill)
                        }
                        std::cmp::Ordering::Less => op.truncate4(flattened, to_width),
                        std::cmp::Ordering::Equal => flattened,
                    };

                    // CG-036: sign conversion changes only the interpretation used
                    // by later arithmetic/relational lowering -- every bit above
                    // is already final; relabel `signed` to the Conversion node's
                    // own result type without touching the `IntValue`.
                    Ok(LoweredValue::Packed(PackedValue {
                        signed: to_ty.is_signed(),
                        ..width_adjusted
                    }))
                }
            }
        }
        // Task 13 (CG-042): constant-fold pure/static system functions
        // ($bits, $size, type queries) entirely at compile time. sv-lang's
        // own prefold sweep (`Options::with_prefold`, which defaults to
        // `true` -- `Compilation::new`/`frontend::compile_source` never
        // override it) already evaluates every statically-foldable
        // expression during elaboration and caches the result, so this arm
        // does not re-implement $bits'/$size's own type-query semantics: it
        // only has to recognize a `Call` node that IS a system call, whose
        // `known_name_id()` names one of CG-042's own type-query subset
        // (`is_cg042_type_query`, below -- the "same `known_name_id()`
        // system-call dispatch point Task 30 later extends for
        // `$display`"), AND already carries a cached `constant_value()`,
        // and emit that constant directly via the same `constant_value()`
        // -> `as_integer()` -> `const_svint()` path the `IntegerLiteral` arm
        // above already uses -- zero runtime call instruction, the exact
        // CG-042 acceptance.
        //
        // Deliberately NOT dispatched here, restricted by the explicit
        // `is_cg042_type_query` allowlist rather than "any system call that
        // happens to have a cached constant": `$rtoi`/`$itor`/`$clog2`/the
        // real<->bits reinterpretation family/the math-library functions
        // are all *sometimes* compile-time-constant too (e.g. `$rtoi(3.9)`
        // on a literal argument) but are NOT "type queries" -- CG-042's
        // ledger requirement names only `$bits`, `$size`, and "type
        // queries" (LRM 1800-2023 SS20.6.1/SS20.7's array-query family:
        // `$low`/`$high`/`$left`/`$right`/`$increment`/`$dimensions`/
        // `$unpacked_dimensions`). Folding those other, unrelated
        // system-function families here would be scope creep AND would
        // silently break `rtoi_is_a_distinct_unimplemented_path_not_the_
        // conversion_node` (tests/real.rs, pinned by BINDING CORRECTION 2:
        // `$rtoi` must stay a distinct, not-yet-implemented path even
        // though it can be constant). Every other case -- a user-defined
        // subroutine call, a system call outside the allowlist, or an
        // allowlisted call that genuinely isn't constant (a dynamic `$size`
        // on a dynamic array) -- is a loud, named `LoweringError`, never a
        // silent fallback or a panic; the "not constant" and "not in
        // CG-042's allowlist" cases are deliberately distinct messages so a
        // failure is diagnosable rather than lumped into one generic
        // "unsupported call" bucket.
        // R-run Task 10 (`docs/superpowers/plans/2026-09-27-run-wiring.md`;
        // CG-061 reused, CG-042 deliberately untouched): a `Call` expression
        // that is NOT a system call used to be an unconditional rejection
        // here ("user subroutine calls are out of Task 13's/CG-042's
        // scope") -- generalized to resolve an ordinary (non-DPI) SV
        // `function`/`task` call via `lower_user_subroutine_call`, below.
        // See that function's own doc comment for the DPI-import-vs-
        // genuinely-unsupported split and the automatic/non-suspending
        // scope restriction (CG-154).
        ExpressionKind::Call => {
            if e.is_system_call() != Some(true) {
                return lower_user_subroutine_call(cx, e);
            }
            let sub = e.system_subroutine().ok_or_else(|| {
                LoweringError::unsupported_at(
                    "system call missing its SystemMethod handle",
                    &cx.fn_sym,
                )
            })?;
            let name = sub.name();
            if sub.known_name_id() == KnownSystemName::Cast {
                return crate::sysfunc::lower_cast(cx, e);
            }
            // A system task or function a VPI library registered (36.3).
            if let Some(v) = crate::vpi_systf::lower_call(cx, e, &name)? {
                return Ok(v);
            }
            // Coverage (19.9, 20.13): `$get_coverage` and friends.
            if matches!(
                sub.known_name_id(),
                KnownSystemName::CoverageControl
                    | KnownSystemName::CoverageGetMax
                    | KnownSystemName::CoverageGet
                    | KnownSystemName::CoverageMerge
                    | KnownSystemName::CoverageSave
                    | KnownSystemName::GetCoverage
                    | KnownSystemName::SetCoverageDbName
                    | KnownSystemName::LoadCoverageDb
            ) {
                let args: Vec<sv_lang::Expression<'d>> = e
                    .children()
                    .into_iter()
                    .filter_map(|n| n.as_expression())
                    .collect();
                if let Some(v) = crate::covergroup::lower_system_call(cx, &name, &args)? {
                    return Ok(v);
                }
            }
            // `randomize` takes a collection as its first argument without
            // being a collection method: dispatch it before the collection
            // methods below claim it (`std::randomize(q)` is then refused by
            // name in `scope_randomize`).
            if sub.known_name_id() == KnownSystemName::Randomize {
                return crate::classes_randomize::lower_randomize_call(cx, e);
            }
            // An array manipulation method (`sum`, `find`, `sort`, ...) or
            // an iterator's `index`.
            if let Some(r) = crate::array_methods::lower(cx, sub.known_name_id(), e) {
                return r;
            }
            // A queue / dynamic / associative array method or `$size`.
            if let Some(r) = crate::collections::lower_method(cx, sub.known_name_id(), e) {
                return r;
            }
            if sub.known_name_id() == KnownSystemName::CountDrivers {
                return lower_countdrivers_call(cx, e);
            }
            // LRM 20.15 stochastic analysis tasks and `$q_full`.
            if matches!(
                sub.known_name_id(),
                KnownSystemName::QInitialize
                    | KnownSystemName::QAdd
                    | KnownSystemName::QRemove
                    | KnownSystemName::QFull
                    | KnownSystemName::QExam
            ) {
                return lower_stoch_queue_call(cx, e, sub.known_name_id());
            }
            // Task F2 (RT-043 partial): `$time`/`$stime`/`$realtime` are
            // system FUNCTIONS (so they belong at this `expr.rs` call site,
            // like CG-042's type queries below), but -- unlike every one of
            // those -- their value is never compile-time constant (it is the
            // live scheduler tick count), so they must be dispatched BEFORE
            // the `is_cg042_type_query` allowlist / `constant_value()` check
            // rather than routed through either: they always lower to a real
            // runtime CALL, never a fold.
            if matches!(
                sub.known_name_id(),
                KnownSystemName::Time | KnownSystemName::STime | KnownSystemName::RealTime
            ) {
                let scope = e.system_call_scope().unwrap_or(cx.fn_sym);
                return lower_time_system_call(cx, sub.known_name_id(), &name, &scope);
            }
            // LRM 20.4.1 `$timeunit`/`$timeprecision`: the scale is static, so
            // the call is a signed 32-bit constant (the exponent, `-9` for 1ns).
            if name == "$timeunit" || name == "$timeprecision" {
                return lower_timescale_query(cx, e, &name);
            }
            // LRM 20.15.2 `$dist_*`: a runtime call, never a fold.
            if let Some(kind) = dist_kind(&name) {
                return lower_dist_system_call(cx, kind, &name, e);
            }
            // B-runtime Task 6 (RT-078..RT-082): `$random`/`$urandom`/
            // `$urandom_range` are, like `$time` above, system FUNCTIONS
            // whose value is never compile-time constant (every call must
            // genuinely draw from the runtime PRNG) -- dispatched here,
            // before the CG-042 type-query allowlist / `constant_value()`
            // check, for the identical reason `$time` is.
            if matches!(
                sub.known_name_id(),
                KnownSystemName::Random | KnownSystemName::URandom | KnownSystemName::URandomRange
            ) {
                return lower_random_system_call(cx, sub.known_name_id(), e);
            }
            // B-runtime Task 7 (RT-050/RT-051): `$fopen(path, mode)` is,
            // like `$time`/`$random` above, a system FUNCTION whose value
            // can never be compile-time-folded (every call must reach the
            // real, mutable MCD table) -- dispatched here, before the
            // CG-042 type-query allowlist, for the identical reason those
            // two are.
            if sub.known_name_id() == KnownSystemName::FOpen {
                return lower_fopen_call(cx, e);
            }
            if sub.known_name_id() == KnownSystemName::System {
                return lower_system_call(cx, e);
            }
            // B-runtime Task 9 (RT-061/RT-063): `$fseek`/`$feof`, the same
            // "system FUNCTION, never compile-time-foldable" dispatch as
            // `$fopen` immediately above (see `lower_fseek_call`'s own doc
            // comment for the scope note on why these two, and only these
            // two, of this task's read-side calls are wired here).
            if sub.known_name_id() == KnownSystemName::FSeek {
                return lower_fseek_call(cx, e);
            }
            if sub.known_name_id() == KnownSystemName::FEof {
                return lower_feof_call(cx, e);
            }
            // `$inferred_disable` in a checker's assertion expression (17.4).
            if let Some(r) = crate::sva::emit::lower_inferred_disable(cx, sub.known_name_id()) {
                return r;
            }
            // Sampled value functions ($sampled/$rose/$past/..., 16.9.3).
            if let Some(r) = crate::sampled::lower_sampled_call(cx, sub.known_name_id(), e) {
                return r;
            }
            if sub.known_name_id() == KnownSystemName::Triggered {
                return lower_event_triggered(cx, e);
            }
            if let Some(r) = crate::fileio::lower_file_read_sysfunc(cx, sub.known_name_id(), e) {
                return r;
            }
            if let Some(r) = crate::real::lower_real_sysfunc(cx, sub.known_name_id(), e) {
                return r;
            }
            if let Some(r) = crate::strings::lower_string_sysfunc(cx, sub.known_name_id(), e) {
                return r;
            }
            if let Some(r) = crate::sysfunc::lower_bit_sysfunc(cx, sub.known_name_id(), e) {
                return r;
            }
            if let Some(r) = crate::sysfunc::lower_enum_method(cx, sub.known_name_id(), e) {
                return r;
            }
            // B-runtime Task 11 (RT-074/RT-075/RT-076/RT-077):
            // `$test$plusargs`/`$value$plusargs` are, like `$fopen`/
            // `$fseek`/`$feof` above, system FUNCTIONS whose value can
            // never be compile-time-folded (every call must reach the real
            // process argv) -- dispatched here, before the CG-042
            // type-query allowlist, for the identical reason.
            if sub.known_name_id() == KnownSystemName::TestPlusArgs {
                return lower_test_plusargs_call(cx, e);
            }
            if sub.known_name_id() == KnownSystemName::ValuePlusArgs {
                return lower_value_plusargs_call(cx, e);
            }
            // Constraints plan C3.5: `obj.randomize()` is a system call that
            // is never constant-foldable; it dispatches through the object's
            // dynamic class to the constraint solver.
            if sub.known_name_id() == KnownSystemName::Randomize {
                return crate::classes_randomize::lower_randomize_call(cx, e);
            }
            // The built-in randomization-control methods (LRM 18.8, 18.9),
            // constraints plan C20: `obj.v.rand_mode(..)`, `obj.c.constraint_mode(..)`.
            if sub.known_name_id() == KnownSystemName::RandMode {
                return crate::rand_mode::lower_rand_mode_call(cx, e);
            }
            if sub.known_name_id() == KnownSystemName::ConstraintMode {
                return crate::rand_mode::lower_constraint_mode_call(cx, e);
            }
            if !is_cg042_type_query(sub.known_name_id()) {
                return Err(LoweringError::unsupported_at(
                    &format!(
                        "system call {name} is not one of CG-042's constant- \
                         foldable type-query functions ($bits/$size/$low/ \
                         $high/$left/$right/$increment/$dimensions/ \
                         $unpacked_dimensions) -- a runtime-behavior system \
                         call (e.g. $display/$random) is CG-043's scope, and \
                         a different constant-sometimes-foldable family (e.g. \
                         $rtoi/$itor/$clog2) is a separate, not-yet- \
                         implemented path, not Task 13's"
                    ),
                    &cx.fn_sym,
                ));
            }
            // `$bits(u1.A)`: slang folds no value through a hierarchical
            // reference, but the argument's type is elaborated, so a
            // fixed-size data type has an exact bit count (LRM 20.6.2).
            if e.constant_value().is_none()
                && sub.known_name_id() == KnownSystemName::Bits
                && let Some(arg) = e.children().into_iter().find_map(|n| n.as_expression())
                && let Some(t) = arg.expr_type()
                && t.is_fixed_size()
                && t.bitstream_width() > 0
                && t.bitstream_width() <= u32::MAX as u64
            {
                let w = t.bitstream_width() as u32;
                let bits: Vec<sv_lang::Bit> = (0..32)
                    .map(|i| {
                        if (w >> i) & 1 == 1 {
                            sv_lang::Bit::One
                        } else {
                            sv_lang::Bit::Zero
                        }
                    })
                    .collect();
                return Ok(LoweredValue::Packed(crate::value::const_bits(
                    cx.ctx, &bits, false, cx.repr,
                )));
            }
            let cv = e.constant_value().ok_or_else(|| {
                LoweringError::unsupported_at(
                    &format!(
                        "type-query system call {name} is not a compile-time \
                         constant here (e.g. $size on a genuinely dynamic \
                         array) -- CG-042 only constant-folds statically- \
                         foldable calls"
                    ),
                    &cx.fn_sym,
                )
            })?;
            let iv = cv.as_integer().ok_or_else(|| {
                LoweringError::unsupported_at(
                    &format!("system call {name}'s folded constant is not an integer"),
                    &cx.fn_sym,
                )
            })?;
            // Review fix r2: same `lower_const_any` dispatch as the
            // `IntegerLiteral` arm above -- this is CG-042's own constant-
            // folding path, and its folded constant is just as capable of
            // being a >WIDE_THRESHOLD-bit `SVInt` (e.g. `$bits` on a wide
            // packed type) as a literal is.
            lower_constant(cx, iv, Some(e))
        }
        // Task 9 test-support: minimal scalar `=` assignment-to-local
        // lowering. Not itself a CG-090/CG-091/CG-007 requirement, but
        // necessary infrastructure this task's own tests need to observe a
        // runtime side effect (per the plan's own fallback: "substitute an
        // assignment-to-local as the side effect" for the &&/|| short-
        // circuit regressions, since task/system calls (Task 12/26) don't
        // exist yet -- see this crate's Task 9 deviations). Deliberately
        // narrow and loud about anything outside that scope: a compound
        // assignment (`+=`, ...), a nonblocking assignment (`<=`), or a
        // non-plain-variable lvalue (bit-select, concat, ...) is a typed
        // `LoweringError`, never silently accepted or mishandled.
        ExpressionKind::Assignment => {
            // `a op= b`: slang elaborates the RHS as `<LValueReference> op
            // b`; the reference reads the target's current value.
            if e.is_compound_assignment() == Some(true) {
                let lhs_expr = e.left().ok_or_else(|| {
                    LoweringError::unsupported_at("assignment missing lvalue", &cx.fn_sym)
                })?;
                let rhs_expr = e.right().ok_or_else(|| {
                    LoweringError::unsupported_at("assignment missing rvalue", &cx.fn_sym)
                })?;
                // An integral unpacked-array element target resolves ONCE
                // (LRM 11.4.1: `a op= b` is `a = a op b` with `a` evaluated
                // once, so `x[i++] += 2` bumps `i` a single time).
                if lhs_expr.kind() == ExpressionKind::ElementSelect
                    && lhs_expr.expr_type().is_some_and(|t| t.is_integral())
                    && let Some(r) = crate::arrays::resolve_element(cx, lhs_expr)?
                {
                    let current = LoweredValue::Packed(crate::arrays::read_element(cx, &r)?);
                    let saved = cx.lvalue_ref.replace(Some(current));
                    let rhs = lower_expr(cx, rhs_expr);
                    cx.lvalue_ref.set(saved);
                    let rhs_pv = rhs?.into_packed(
                        "compound assignment of a non-integral value to an array element",
                        &cx.fn_sym,
                    )?;
                    let rhs_pv = crate::select::fit_width(&op, rhs_pv, r.width);
                    crate::arrays::write_element(cx, &r, rhs_pv)?;
                    return Ok(LoweredValue::Packed(rhs_pv));
                }
                // A packed select / field target with a side-effecting index
                // (`x[i++] += 1`): one resolution, as above.
                if crate::classes::has_side_effects(lhs_expr)
                    && lhs_expr.expr_type().is_some_and(|t| t.is_integral())
                    && let Some(v) = crate::select::lower_modify_target(cx, lhs_expr, &mut |old| {
                        let saved = cx.lvalue_ref.replace(Some(LoweredValue::Packed(old)));
                        let rhs = lower_expr(cx, rhs_expr);
                        cx.lvalue_ref.set(saved);
                        rhs?.into_packed("compound assignment of a non-integral value", &cx.fn_sym)
                    })?
                {
                    return Ok(LoweredValue::Packed(v));
                }
                let current = read_modify_target(cx, lhs_expr)?;
                let saved = cx.lvalue_ref.replace(Some(current));
                let rhs = lower_expr(cx, rhs_expr);
                cx.lvalue_ref.set(saved);
                return store_to(cx, lhs_expr, rhs?);
            }
            if e.is_nonblocking() == Some(true) {
                return crate::func::lower_subroutine_nba(cx, e);
            }
            let lhs_expr = e.left().ok_or_else(|| {
                LoweringError::unsupported_at("assignment missing lvalue", &cx.fn_sym)
            })?;
            // A modport port with an expression writes that expression
            // (LRM 25.5.4).
            let lhs_expr = modport_expr_target(&lhs_expr).unwrap_or(lhs_expr);
            // `e1 = e2`, `e = null` of events (LRM 1800-2023 15.5.5.1).
            if lhs_expr.expr_type().is_some_and(|t| t.is_event()) {
                let rhs_expr = e.right().ok_or_else(|| {
                    LoweringError::unsupported_at("assignment missing rvalue", &cx.fn_sym)
                })?;
                return crate::events::lower_event_assignment(cx, lhs_expr, rhs_expr);
            }
            // `{<<n{a, b}} = q`: a queue, dynamic array or string source
            // has a runtime length (LRM 1800-2023 11.4.14.3).
            if lhs_expr.kind() == ExpressionKind::Streaming
                && let Some(rhs_expr) = e.right()
                && (crate::stream::source_needs_runtime(rhs_expr)
                    || crate::stream::target_needs_runtime(lhs_expr))
            {
                crate::stream::unpack_runtime_source(
                    cx,
                    lhs_expr,
                    rhs_expr,
                    &mut |operand, with, bits| {
                        if let Some(w) = with {
                            return crate::stream_with::unpack(cx, operand, w, bits);
                        }
                        store_to(cx, operand, LoweredValue::Packed(bits)).map(|_| ())
                    },
                    None,
                    None,
                )?;
                return Ok(LoweredValue::Packed(op.pack(
                    cx.ctx.bool_type().const_zero(),
                    cx.ctx.bool_type().const_zero(),
                    1,
                    cx.repr,
                    false,
                )));
            }
            // Classes plan Task 5 (§1.4 step 4): `obj.field = v` or a bare,
            // implicit-`this` `field = v` -- this arm's own blocking-
            // assignment path has its OWN plain-`NamedValue`-to-`cx.locals`
            // shortcut further down (never reached via `store_to`, unlike
            // every call site below this one), so the SAME class-field
            // intercept `store_to` itself carries is repeated here too.
            if crate::classes::is_class_field_lvalue(lhs_expr) {
                let rhs_expr = e.right().ok_or_else(|| {
                    LoweringError::unsupported_at("assignment missing rvalue", &cx.fn_sym)
                })?;
                let rhs = crate::collections::owned(cx, rhs_expr)?;
                let v = crate::classes::try_assign_field(cx, lhs_expr, rhs)?.ok_or_else(|| {
                    LoweringError::unsupported_at(
                        "internal: is_class_field_lvalue/try_write_field disagreed",
                        &cx.fn_sym,
                    )
                })?;
                return Ok(v);
            }
            // A slice of a queue or dynamic array (`q[1:2] = '{..}`, LRM 7.6).
            if let Some(rhs_expr) = e.right()
                && let Some(done) = crate::arrays::assign_coll_slice(cx, lhs_expr, rhs_expr)
            {
                done?;
                return Ok(LoweredValue::Packed(op.pack(
                    cx.ctx.bool_type().const_zero(),
                    cx.ctx.bool_type().const_zero(),
                    1,
                    cx.repr,
                    false,
                )));
            }
            // A whole queue, dynamic or associative array: a copy.
            if crate::collections::coll_of_expr(&lhs_expr).is_some() {
                let rhs_expr = e.right().ok_or_else(|| {
                    LoweringError::unsupported_at("assignment missing rvalue", &cx.fn_sym)
                })?;
                return crate::collections::assign_whole(cx, lhs_expr, rhs_expr);
            }
            // `vif.a = rhs`, `vif.b[1] = row` (`crate::vif`).
            if let Some(rhs_expr) = e.right()
                && let Some(done) = crate::vif::assign_array(cx, lhs_expr, rhs_expr)
            {
                done?;
                return Ok(LoweredValue::Packed(op.pack(
                    cx.ctx.bool_type().const_zero(),
                    cx.ctx.bool_type().const_zero(),
                    1,
                    cx.repr,
                    false,
                )));
            }
            // An unpacked array, whole or part (`a = '{1, 2}`, `a = b`,
            // `m[1] = row`, `a[0:1] = b[2:3]`).
            if let Some((dst, shape)) = crate::arrays::array_target(cx, lhs_expr)? {
                let rhs_expr = e.right().ok_or_else(|| {
                    LoweringError::unsupported_at("assignment missing rvalue", &cx.fn_sym)
                })?;
                crate::arrays::assign_array(cx, dst, &shape, rhs_expr)?;
                // The value of an array assignment expression is never used
                // as a packed value (slang rejects that); a statement
                // discards this.
                return Ok(LoweredValue::Packed(op.pack(
                    cx.ctx.bool_type().const_zero(),
                    cx.ctx.bool_type().const_zero(),
                    1,
                    cx.repr,
                    false,
                )));
            }
            // An unpacked-array element write (`mem[i] = rhs`, `a[i][j] =
            // rhs`, a local array's element): `crate::arrays`. A real/string
            // element is stored as its bits.
            if let Some(r) = crate::arrays::resolve_element(cx, lhs_expr)? {
                let rhs_expr = e.right().ok_or_else(|| {
                    LoweringError::unsupported_at("assignment missing rvalue", &cx.fn_sym)
                })?;
                let rhs = crate::collections::owned(cx, rhs_expr)?;
                // `r` is the element's one resolution (LRM 11.4.2: `a[i++] =
                // h` increments `i` once); the old handle is read from it
                // rather than by lowering `lhs_expr` a second time.
                if let Some(t) = lhs_expr.expr_type() {
                    crate::collections::release_element(cx, &t, &r)?;
                }
                let rhs_pv = crate::real::to_storage(
                    cx,
                    rhs,
                    r.width,
                    "assignment of a >128-bit value to an array element",
                )?;
                let rhs_pv = crate::select::fit_width(&op, rhs_pv, r.width);
                crate::arrays::write_element(cx, &r, rhs_pv)?;
                return Ok(LoweredValue::Packed(rhs_pv));
            }
            // Bit/part/indexed selects, struct fields, `mem[i][j]` and
            // concatenation targets: a read-modify-write of the storage
            // root (`select.rs`).
            if !sv_sim_sim::symid::is_value_name(lhs_expr.kind()) {
                let rhs_expr = e.right().ok_or_else(|| {
                    LoweringError::unsupported_at("assignment missing rvalue", &cx.fn_sym)
                })?;
                let rhs = crate::collections::owned(cx, rhs_expr)?;
                return crate::collections::store_releasing(cx, lhs_expr, rhs);
            }
            let sym = lhs_expr.referenced_symbol().ok_or_else(|| {
                LoweringError::unsupported_at("assignment lvalue unresolved name", &cx.fn_sym)
            })?;
            let (slot, width, signed) = *cx
                .locals
                .get(&sym.uid())
                .ok_or_else(|| LoweringError::unsupported_at("assignment to a non-local", &sym))?;
            let rhs_expr = e.right().ok_or_else(|| {
                LoweringError::unsupported_at("assignment missing rvalue", &cx.fn_sym)
            })?;
            let rhs = crate::collections::owned(cx, rhs_expr)?;
            crate::collections::release_old(cx, lhs_expr)?;
            let rhs_pv = crate::real::to_storage(
                cx,
                rhs,
                width,
                "assignment of a >128-bit value to a local",
            )?;
            cx.b.build_store(slot, rhs_pv.llvm).unwrap();
            write_through_store(cx, slot);
            // SV's own assignment-as-expression semantics: the expression's
            // value is the assigned value (here always discarded by the
            // caller -- `func.rs`'s `ExpressionStatement` arm -- but
            // returned properly regardless, matching every other producing
            // arm in this match).
            Ok(LoweredValue::Packed(PackedValue {
                llvm: rhs_pv.llvm,
                width,
                repr: cx.repr,
                signed,
            }))
        }
        // R-run Task 15 (`docs/superpowers/plans/2026-09-27-run-wiring.md`
        // Task 15; the "no ledger ID covers enum/struct member access"
        // gap that task's own text flags): `p.field` on a packed
        // struct/union -- a compile-time-constant bit-offset/width slice
        // of the base's own already-lowered packed value. Reuses the same
        // `part_select4` window-extraction primitive `ElementSelect`/
        // `RangeSelect` above already use for exactly this "shift+
        // truncate a known window out of a wider packed value" shape.
        // Unlike `ElementSelect`'s dynamic `idx`, a struct field's offset
        // and width are both struct-SHAPE facts fixed at elaboration
        // (`Symbol::field_bit_offset()`/`Type::bit_width()` on the member
        // symbol), never runtime-computed, so `lo` is always a compile-
        // time LLVM constant and `lo_unknown` is always `false` -- no
        // dynamic out-of-range case exists the way an `ElementSelect`
        // index can be.
        //
        // An `enum` value itself (`s`, `s_t s;`) needs NO handling here at
        // all: it is a plain `NamedValue` read of a variable whose
        // underlying representation is its own declared integral base
        // type (`logic [N:0]`) -- it already round-trips through the
        // ordinary `NamedValue` arm above, exactly as this task's own
        // plan text says.
        ExpressionKind::MemberAccess => {
            // `vif.m` (`crate::vif`).
            if let Some(v) = crate::vif::read(cx, e) {
                return v;
            }
            // A covergroup's `option.x` / `type_option.x` (19.7).
            if let Some(v) = crate::covergroup::lower_option_read(cx, e)? {
                return Ok(v);
            }
            let base_expr = e.operand().ok_or_else(|| {
                LoweringError::unsupported_at("member access missing base value", &cx.fn_sym)
            })?;
            // Classes plan Task 5 (§1.4 step 4): `obj.field` -- a non-
            // static class property read through the object heap, never a
            // bit-packed slice of `base`'s own value the way every other
            // arm below this one is. Tried before `base_expr` is even
            // lowered as an ordinary packed value (a class handle's
            // PACKED form IS just its 64-bit reference, so `into_packed`
            // below would not itself reject it -- this check is about
            // ROUTING the READ, not about `into_packed` failing).
            //
            // Gated on the base being a class AT ALL (not also on `member`
            // being a non-static instance field): a class base with
            // anything else through this syntax (a static property via
            // instance syntax; a method symbol, unreachable here since a
            // method reference alone is never a plain `MemberAccess`
            // VALUE) must get a named, loud rejection here too, never fall
            // through to the packed-struct-field fallback below, which
            // would otherwise silently reinterpret the HANDLE's own raw
            // bits as if they were field storage (`select::field_window`'s
            // own defensive `is_class()` guard closes the identical gap for
            // the write side, `store_to`/`resolve_lvalue`).
            //
            // A `static` property (8.9), spelled `obj.count` here or
            // `Class::count` (8.23's class-scope `::`, a `NamedValue`, see
            // that arm), lives in its specialization's heap singleton
            // (`classes::read_static`, classes plan Task 9 -- Task 4 gave
            // STATE a per-template segment but never wired codegen access
            // to it). The receiver is NOT evaluated: there is exactly one
            // `count` for the whole specialization, whatever `obj` is
            // (including a null handle, which LRM 8.9 allows for a static).
            if base_expr.expr_type().is_some_and(|t| t.is_class()) {
                let member = e.member_symbol().ok_or_else(|| {
                    LoweringError::unsupported_at(
                        "member access on a class value missing its member symbol",
                        &cx.fn_sym,
                    )
                })?;
                if crate::classes::is_static_field(&member) {
                    return crate::classes::read_static(cx, &member);
                }
                // `obj.P` for a class parameter / localparam (LRM 8.25): a
                // constant of the handle's specialization, so the receiver
                // is not evaluated (as for a static property above).
                if matches!(member.kind(), sv_lang::kinds::SymbolKind::Parameter)
                    && let Some(cv) = member.constant_value()
                    && let Some(iv) = cv.as_integer()
                {
                    return lower_constant(cx, iv, None);
                }
                if !crate::classes::is_instance_field(&member) {
                    return Err(LoweringError::unsupported_at(
                        "a class member access that is neither a static nor a non-static \
                         property read",
                        &cx.fn_sym,
                    ));
                }
                let h = crate::classes::receiver_handle(cx, base_expr)?;
                return crate::classes::read_field_checked(cx, h, &member, e.source_range().start);
            }
            // `tagged_union.M` (11.9): the member, after the run-time tag
            // check.
            if let Some(v) = crate::tagged::read_member(cx, e, base_expr)? {
                return Ok(v);
            }
            let base = lower_expr(cx, base_expr)?.into_packed(
                "member access on a non-integral (real) base value is out of scope",
                &cx.fn_sym,
            )?;
            let member = e.member_symbol().ok_or_else(|| {
                LoweringError::unsupported_at("member access missing member symbol", &cx.fn_sym)
            })?;
            let field_ty = member.value_type().ok_or_else(|| {
                LoweringError::unsupported_at("member access field missing a type", &cx.fn_sym)
            })?;
            // A field of an unpacked struct/union: a slice of the base's
            // flat stored bits, read back as the field's own kind of value.
            if let Some(base_ty) = base_expr.expr_type()
                && sv_sim_sim::state::storage::is_unpacked_aggregate(&base_ty)
            {
                let (off, fw) = crate::select::field_window(Some(base_ty), &member)
                    .filter(|(off, fw)| *fw > 0 && off + fw <= u64::from(base.width))
                    .ok_or_else(|| {
                        LoweringError::unsupported_at(
                            "unpacked struct/union field outside its base's stored bits",
                            &cx.fn_sym,
                        )
                    })?;
                let lo = op.i_n(base.width).const_int(off, false);
                let bits = PackedValue {
                    signed: field_ty.is_signed(),
                    ..op.part_select4(base, lo, cx.ctx.bool_type().const_zero(), fw as u32)
                };
                return Ok(if field_ty.is_floating() {
                    LoweredValue::Real(crate::real::bits_to_real(cx, bits))
                } else if field_ty.is_string() {
                    LoweredValue::Str(crate::strings::from_storage(cx, bits))
                } else {
                    LoweredValue::Packed(bits)
                });
            }
            // Mirrors `layout.rs`'s own `!ty.is_integral()` gate for
            // exactly the same reason: a `real`/`string`/class-handle/...
            // field has no packed-bit representation this crate can slice
            // out of `base`'s val/unk lanes. A loud, named `LoweringError`,
            // never a panic reading a nonexistent bit window and never a
            // silent reinterpretation of the field's raw bits as an
            // integer.
            if !field_ty.is_integral() {
                return Err(LoweringError::unsupported_at(
                    "member access on a non-integral struct/union field \
                     (real/string/class-handle/...) is out of scope",
                    &cx.fn_sym,
                ));
            }
            let field_width_u64 = field_ty.bit_width();
            let offset_u64 = member.field_bit_offset();
            // Bounds-checked BEFORE any cast to `u32`: proves both
            // `field_width_u64` and `offset_u64` individually fit in
            // `base.width` (itself already a real `u32`), so the casts
            // below are total, never a silent truncation of an
            // out-of-range value -- the same "check first, cast after"
            // discipline `layout.rs::checked_bit_width_u16` documents.
            if field_width_u64 == 0
                || field_width_u64 > base.width as u64
                || offset_u64 > (base.width as u64) - field_width_u64
            {
                return Err(LoweringError::unsupported_at(
                    "member access field offset/width does not fit within its \
                     base struct/union's own already-lowered width",
                    &cx.fn_sym,
                ));
            }
            let field_width = field_width_u64 as u32;
            let offset = offset_u64 as u32;
            let lo = op.i_n(base.width).const_int(offset as u64, false);
            let lo_unknown = cx.ctx.bool_type().const_zero();
            // The field keeps its own signedness (`logic signed [7:0] x`
            // reads as signed, LRM 1800-2023 §7.2.1).
            Ok(LoweredValue::Packed(PackedValue {
                signed: field_ty.is_signed(),
                ..op.part_select4(base, lo, lo_unknown, field_width)
            }))
        }
        // `null` (a chandle's): the 64-bit zero pointer value.
        // `$` in a queue index or slice (`q[$]`, `q[1:$]`).
        // Classes plan Task 5 (§1.4 step 2): `new(args)`/`new` -- object
        // allocation, property initialization, and the explicit
        // constructor call (`crate::classes`).
        ExpressionKind::NewClass => crate::classes::lower_new_class(cx, e),
        ExpressionKind::NewCovergroup => crate::covergroup::lower_new(cx, e),
        // Classes plan Task 10 (LRM 8.12): `new src` -- shallow copy.
        ExpressionKind::CopyClass => crate::classes::lower_copy_class(cx, e),
        ExpressionKind::UnboundedLiteral => crate::collections::lower_unbounded(cx)
            .ok_or_else(|| LoweringError::unsupported_at("`$` outside a queue index", &cx.fn_sym)),
        ExpressionKind::NullLiteral => {
            let op = OpBuilder {
                ctx: cx.ctx,
                b: &cx.b,
            };
            Ok(LoweredValue::Packed(op.pack(
                op.i_n(64).const_zero(),
                op.i_n(64).const_zero(),
                64,
                cx.repr,
                false,
            )))
        }
        // An output argument's `actual = Conversion(<formal>)` (LRM 13.5):
        // the formal's value, set by `func::copy_back_outputs`.
        ExpressionKind::LValueReference | ExpressionKind::EmptyArgument => {
            cx.lvalue_ref.get().ok_or_else(|| {
                LoweringError::unsupported_at(
                    "lvalue reference outside a compound assignment",
                    &cx.fn_sym,
                )
            })
        }
        // A packed assignment pattern: a packed struct (`'{a: 1, b: 2}`,
        // `'{default: 0}`) or packed array (`'{8'h1, 8'h2}`, `'{4{2'b01}}`)
        // value. An unpacked-array pattern is an array value, handled by
        // `crate::arrays` where arrays are assigned or compared.
        ExpressionKind::SimpleAssignmentPattern
        | ExpressionKind::StructuredAssignmentPattern
        | ExpressionKind::ReplicatedAssignmentPattern => lower_packed_pattern(cx, e),
        ExpressionKind::TaggedUnion => crate::tagged::lower_tagged_expr(cx, e),
        // `min:typ:max` (LRM 1800-2023 11.11): the tool picks one operand per
        // run; this simulator always takes the typical value (the default
        // delay-selection of 30.4.1) and lowers only it.
        ExpressionKind::MinTypMax => {
            let typ = e
                .children()
                .into_iter()
                .filter_map(|n| n.as_expression())
                .nth(1)
                .ok_or_else(|| {
                    LoweringError::unsupported_at(
                        "a min:typ:max expression with no typical operand",
                        &cx.fn_sym,
                    )
                })?;
            lower_expr(cx, typ)
        }
        // A bare fixed-width stream as the source of a stream unpack
        // (`{>>{x}} = {<<byte{x}}`, LRM 1800-2023 11.4.14.3): its bits.
        // A runtime-length stream is handled by the assignment arm.
        // (Written as a guarded catch-all so the supported-constructs scan
        // does not list the conditional arm as a lowered kind.)
        kind if kind == ExpressionKind::Streaming && !crate::stream::source_needs_runtime(e) => {
            Ok(LoweredValue::Packed(crate::stream::lower_streaming(cx, e)?))
        }
        other => Err(LoweringError::unsupported_at(
            &format!("expression kind {other:?}"),
            &cx.fn_sym,
        )),
    }
}

/// The stored bits (LSB first) of the constant `cv` of type `ty`, in the form
/// a variable of that type holds: an integral value as is, a real as its IEEE
/// bits, an unpacked struct as its fields (first field most significant), a
/// fixed-size unpacked array with its lowest index least significant
/// (`sv_sim_sim::state::storage`). `None` for anything else (a string, a
/// collection, a class handle, a union).
pub(crate) fn const_stored_bits(
    ty: &sv_lang::Type<'_>,
    cv: &sv_lang::ConstantValue,
) -> Option<Vec<sv_lang::Bit>> {
    let mut strs = Vec::new();
    let bits = const_stored_bits_strs(ty, cv, 0, &mut strs)?;
    // A string field's stored form is a run-time interned id: no constant bits.
    strs.is_empty().then_some(bits)
}

/// [`const_stored_bits`] that also reports each `string` field it met as
/// `(bit offset in the result, text)`, leaving that field's 64-bit slot zero
/// for the caller to fill with the run-time interned id (LRM 6.20.2: an
/// unpacked-struct named constant may hold a string).
pub(crate) fn const_stored_bits_strs(
    ty: &sv_lang::Type<'_>,
    cv: &sv_lang::ConstantValue,
    base: usize,
    strs: &mut Vec<(usize, Vec<u8>)>,
) -> Option<Vec<sv_lang::Bit>> {
    use sv_lang::{Bit, ConstantValue};
    use sv_sim_sim::state::storage;
    if ty.is_string() {
        let ConstantValue::String(text) = cv else {
            return None;
        };
        strs.push((base, text.as_bytes().to_vec()));
        return Some(vec![Bit::Zero; storage::storage_width(ty)? as usize]);
    }
    // A class-handle constant is only ever `null` (LRM 6.20.2, 8.4): the zero handle.
    if matches!(cv, ConstantValue::Null) {
        return Some(vec![Bit::Zero; storage::storage_width(ty)? as usize]);
    }
    if ty.is_floating() {
        let ConstantValue::Real(f) = cv else {
            return None;
        };
        let w = ty.bit_width() as usize;
        let raw = if w == 32 {
            u64::from((*f as f32).to_bits())
        } else {
            f.to_bits()
        };
        return Some(
            (0..w)
                .map(|i| {
                    if raw >> i & 1 == 1 {
                        Bit::One
                    } else {
                        Bit::Zero
                    }
                })
                .collect(),
        );
    }
    if ty.is_integral() {
        let v = cv.as_integer()?;
        let mut bits = sv_sim_sim::state::svint_bits(v)?.into_owned();
        let pad = if v.is_signed() {
            bits.last().copied().unwrap_or(Bit::Zero)
        } else {
            Bit::Zero
        };
        bits.resize(ty.bit_width() as usize, pad);
        return Some(bits);
    }
    let ConstantValue::Array(elems) = cv else {
        return None;
    };
    let total = storage::storage_width(ty)? as usize;
    let mut out = vec![Bit::Zero; total];
    if ty.is_unpacked_struct() {
        for (i, f) in ty.fields().enumerate() {
            let (lo, w) = storage::field_slice(ty, i as u32)?;
            let sub =
                const_stored_bits_strs(&f.value_type()?, elems.get(i)?, base + lo as usize, strs)?;
            if sub.len() as u64 != w {
                return None;
            }
            out[lo as usize..(lo + w) as usize].copy_from_slice(&sub);
        }
        return Some(out);
    }
    if ty.is_unpacked_array() && !ty.is_dynamically_sized_array() {
        let elem = ty.element_type()?;
        let ew = storage::storage_width(&elem)? as usize;
        let n = elems.len();
        let ascending =
            ty.fixed_unpacked_array_range().left < ty.fixed_unpacked_array_range().right;
        for (p, el) in elems.iter().enumerate() {
            let slot = if ascending { p } else { n - 1 - p };
            let sub = const_stored_bits_strs(&elem, el, base + slot * ew, strs)?;
            if sub.len() != ew || (slot + 1) * ew > total {
                return None;
            }
            out[slot * ew..(slot + 1) * ew].copy_from_slice(&sub);
        }
        return Some(out);
    }
    None
}

/// Refuses a tolerance range (`[a +/- b]`, `[a +%- b]`, LRM 1800-2023
/// 11.4.13), which slang parses only as 1800-2023 and whose `left`/`right`
/// are the centre and the tolerance, not the bounds: lowered as `[lo:hi]` it
/// would be a silent wrong answer. The semantic node does not keep the
/// operator, so it is read from the syntax (a no-op outside a
/// [`crate::classes::DesignSyntaxScope`], where no tree is available).
pub(crate) fn refuse_tolerance_range(
    cand: sv_lang::Expression<'_>,
    sym: &sv_lang::Symbol,
) -> Result<(), LoweringError> {
    use sv_lang::AstNode;
    use sv_lang::nodes::ValueRangeExpressionSyntax;

    let op = crate::classes::with_design_trees(|trees| {
        trees.iter().find_map(|tree| {
            let node = cand.syntax(tree)?;
            let op = ValueRangeExpressionSyntax::cast(node)?.op()?;
            Some(op.text().to_string())
        })
    });
    match op.as_deref() {
        None | Some(":") => Ok(()),
        Some(op) => Err(LoweringError::unsupported_at(
            &format!("an `inside` tolerance range (`[a {op} b]`, LRM 11.4.13)"),
            sym,
        )),
    }
}

/// `Some(relative)` when `cand` is a tolerance range (`+%-` is relative),
/// read from the syntax like [`refuse_tolerance_range`].
pub(crate) fn tolerance_op(cand: sv_lang::Expression<'_>) -> Option<bool> {
    use sv_lang::AstNode;
    use sv_lang::nodes::ValueRangeExpressionSyntax;
    crate::classes::with_design_trees(|trees| {
        trees.iter().find_map(|tree| {
            let node = cand.syntax(tree)?;
            let op = ValueRangeExpressionSyntax::cast(node)?.op()?;
            match op.text() {
                "+/-" => Some(false),
                "+%-" => Some(true),
                _ => None,
            }
        })
    })
}

/// Whether a range bound is `$` (LRM 1800-2023 11.4.13), looking through
/// implicit conversions; LRM 6.20.7: a parameter assigned `$` is usable
/// wherever `$` is, so a named constant folding to the unbounded value
/// opens the range the same way.
pub(crate) fn is_open_bound(x: Option<sv_lang::Expression<'_>>) -> bool {
    let mut x = x;
    while let Some(c) = x.filter(|c| c.kind() == ExpressionKind::Conversion) {
        x = c.conversion_operand();
    }
    x.is_some_and(|x| {
        x.kind() == ExpressionKind::UnboundedLiteral
            || matches!(x.constant_value(), Some(sv_lang::ConstantValue::Unbounded))
    })
}

/// Whether `left` matches one `inside` candidate (LRM 1800-2023 §11.4.13):
/// a range `[lo:hi]` (`lo <= left <= hi`) or a value (`left ==? value`).
/// Shared by the `inside` operator and `case ... inside` items.
pub(crate) fn inside_candidate<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    left: PackedValue<'ctx>,
    cand: sv_lang::Expression<'d>,
) -> Result<PackedValue<'ctx>, LoweringError> {
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let bound = |x: Option<sv_lang::Expression<'d>>, which: &str| {
        let x = x.ok_or_else(|| {
            LoweringError::unsupported_at(
                &format!("inside range missing {which} bound"),
                &cx.fn_sym,
            )
        })?;
        lower_expr(cx, x)?.into_packed(
            &format!("inside range with a non-integral (real) {which} bound"),
            &cx.fn_sym,
        )
    };
    if cand.kind() == ExpressionKind::ValueRange {
        if let Some(relative) = tolerance_op(cand) {
            // LRM 11.4.13: `[a +/- b]` / `[a +%- b]`; `left`/`right` are the
            // centre and the tolerance.
            let a = bound(cand.left(), "centre")?;
            let b = bound(cand.right(), "tolerance")?;
            return Ok(op.inside_tolerance_candidate4(left, a, b, relative));
        }
        // `$` as a bound is the minimum / maximum of the left operand's type
        // (LRM 1800-2023 11.4.13): that side always holds, so the operand
        // itself stands in for it (keeping an X operand X).
        let open = is_open_bound;
        let lo = if open(cand.left()) {
            left
        } else {
            bound(cand.left(), "low")?
        };
        let hi = if open(cand.right()) {
            left
        } else {
            bound(cand.right(), "high")?
        };
        return Ok(op.inside_range_candidate4(left, lo, hi));
    }
    // A queue or dynamic array of integral elements: its size is only known
    // at run time, so scan it with a loop (LRM 1800-2023 11.4.13).
    if let Some(c) = crate::collections::coll_of_expr(&cand) {
        if c.assoc || !c.elem.is_integral() {
            return Err(LoweringError::unsupported_at(
                "inside over an associative array or a collection of non-integral elements",
                &cx.fn_sym,
            ));
        }
        return inside_collection_scan(cx, left, cand, &c);
    }
    // An unpacked array in the set stands for every one of its elements
    // (LRM 1800-2023 11.4.13: "if an expression in the set is an array, each
    // of its elements is a member"); a fixed-size array is unrolled over its
    // rows, an element that is X/Z matches by the plain-item rule.
    if cand
        .expr_type()
        .is_some_and(|t| t.is_unpacked_array() && !sv_sim_sim::state::storage::is_collection(&t))
    {
        // A class property or unpacked-struct field array has no row storage
        // of its own: read a snapshot of it (`spill_member_array`); an
        // array-valued call reads its returned temporary.
        let target = match crate::arrays::array_target(cx, cand)? {
            Some(t) => Some(t),
            None => match crate::arrays::spill_member_array(cx, cand)? {
                Some(t) => Some(t),
                None => crate::arrays::array_call_value(cx, cand)?,
            },
        };
        let Some((r, shape)) = target else {
            return Err(LoweringError::unsupported_at(
                "inside over an unpacked array that is not a variable, memory, member or call",
                &cx.fn_sym,
            ));
        };
        let i64t = cx.ctx.i64_type();
        let mut acc: Option<PackedValue<'ctx>> = None;
        for k in 0..shape.rows() {
            let el = crate::arrays::ElemRef {
                backing: r.backing,
                row: cx
                    .b
                    .build_int_add(r.base, i64t.const_int(k, false), "inside_row")
                    .unwrap(),
                valid: r.valid,
                width: shape.elem.value_width(),
                signed: shape.elem.is_signed(),
                default: crate::arrays::default_value(cx, &shape.elem),
            };
            let item = crate::arrays::read_element(cx, &el)?;
            let c = op.inside_plain_candidate4(left, item);
            acc = Some(match acc {
                None => c,
                Some(prev) => op.or4(prev, c),
            });
        }
        return acc.ok_or_else(|| {
            LoweringError::unsupported_at("inside over a zero-element array", &cx.fn_sym)
        });
    }
    let item = lower_expr(cx, cand)?
        .into_packed("inside with a non-integral (real) candidate", &cx.fn_sym)?;
    Ok(op.inside_plain_candidate4(left, item))
}

/// `left inside {coll}` for a queue or dynamic array `cand`: OR of the
/// plain-item match of `left` against each element, accumulated in a loop
/// over the run-time size (LRM 1800-2023 11.4.13; an empty collection
/// matches nothing).
fn inside_collection_scan<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    left: PackedValue<'ctx>,
    cand: sv_lang::Expression<'d>,
    c: &crate::collections::Coll<'d>,
) -> Result<PackedValue<'ctx>, LoweringError> {
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let i64t = cx.ctx.i64_type();
    let h = crate::collections::handle_of(cx, cand)?;
    let n = crate::collections::size_of_handle(cx, c, h);
    let f =
        cx.b.get_insert_block()
            .and_then(|bb| bb.get_parent())
            .expect("lowering happens inside a function");
    // The accumulator is a 1-bit four-state flag, zero (known 0) to start.
    let shape = PackedValue {
        llvm: op.packed_type(1, cx.repr).const_zero(),
        width: 1,
        repr: cx.repr,
        signed: false,
    };
    let acc_ty = shape.llvm.get_type();
    let acc_slot = entry_alloca(cx, acc_ty, "inside_scan_acc");
    cx.b.build_store(acc_slot, shape.llvm).unwrap();
    let i_slot = entry_alloca(cx, i64t, "inside_scan_i");
    cx.b.build_store(i_slot, i64t.const_zero()).unwrap();
    let head = cx.ctx.append_basic_block(f, "inside_scan_head");
    let body = cx.ctx.append_basic_block(f, "inside_scan_body");
    let done = cx.ctx.append_basic_block(f, "inside_scan_done");
    cx.b.build_unconditional_branch(head).unwrap();
    cx.b.position_at_end(head);
    let i = cx.b.build_load(i64t, i_slot, "i").unwrap().into_int_value();
    let more =
        cx.b.build_int_compare(inkwell::IntPredicate::SLT, i, n, "more")
            .unwrap();
    cx.b.build_conditional_branch(more, body, done).unwrap();
    cx.b.position_at_end(body);
    let LoweredValue::Packed(item) = crate::collections::read_at_coll(cx, c, h, i) else {
        return Err(LoweringError::unsupported_at(
            "an `inside` collection element that is not a packed value",
            &cx.fn_sym,
        ));
    };
    let m = op.inside_plain_candidate4(left, item);
    let load = |name: &str| PackedValue {
        llvm: cx
            .b
            .build_load(acc_ty, acc_slot, name)
            .unwrap()
            .into_int_value(),
        ..shape
    };
    let next = op.or4(load("acc"), m);
    cx.b.build_store(acc_slot, next.llvm).unwrap();
    let inc =
        cx.b.build_int_add(i, i64t.const_int(1, false), "i_next")
            .unwrap();
    cx.b.build_store(i_slot, inc).unwrap();
    cx.b.build_unconditional_branch(head).unwrap();
    cx.b.position_at_end(done);
    Ok(load("inside_scan_res"))
}

/// A packed assignment pattern's value: its elements (slang has already
/// resolved member/index/default setters into one per member or element,
/// in declaration order), concatenated most significant first (LRM
/// 1800-2023 §10.9.2).
fn lower_packed_pattern<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    e: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let ty = e.expr_type().ok_or_else(|| {
        LoweringError::unsupported_at("assignment pattern has no type", &cx.fn_sym)
    })?;
    // An unpacked struct's stored form is its fields' stored bits, first
    // field most significant -- the same concatenation. A fixed-size
    // unpacked array reaching here is held as bits too (a struct field,
    // `sv_sim_sim::state::storage`): lowest index least significant, so an
    // ascending one's elements concatenate in reverse.
    let bits_array = ty.is_unpacked_array() && !ty.is_dynamically_sized_array();
    if !ty.is_integral() && !ty.is_unpacked_struct() && !bits_array {
        return Err(LoweringError::unsupported_at(
            "an unpacked assignment pattern (an array value) outside an array assignment, \
             initializer or comparison",
            &cx.fn_sym,
        ));
    }
    let mut elems = e.pattern_elements();
    if e.kind() == ExpressionKind::ReplicatedAssignmentPattern {
        let n = e
            .replicated_pattern_count()
            .and_then(|c| c.constant_value())
            .and_then(|c| c.as_i64())
            .ok_or_else(|| {
                LoweringError::unsupported_at(
                    "a replicated assignment pattern with a non-constant count",
                    &cx.fn_sym,
                )
            })?;
        elems = (0..n).flat_map(|_| elems.iter().copied()).collect();
    }
    if bits_array {
        let range = ty.fixed_unpacked_array_range();
        if range.left < range.right {
            elems.reverse();
        }
    }
    let mut parts = Vec::with_capacity(elems.len());
    for el in elems {
        // A collection element or field: a copy (`crate::collections`).
        let v = crate::real::to_storage(
            cx,
            crate::collections::owned(cx, el)?,
            el.expr_type().map(|t| t.value_width()).unwrap_or(0),
            "an assignment pattern element wider than 128 bits",
        )?;
        let w = el
            .expr_type()
            .map(|t| t.value_width())
            .filter(|w| *w > 0)
            .unwrap_or(v.width);
        parts.push(crate::select::fit_width(&op, v, w));
    }
    if parts.is_empty() {
        return Err(LoweringError::unsupported_at(
            "an empty assignment pattern",
            &cx.fn_sym,
        ));
    }
    let v = op.concat4(&parts);
    let width = ty.value_width();
    if v.width != width {
        return Err(LoweringError::unsupported_at(
            &format!(
                "a packed assignment pattern's elements total {} bits for a {width}-bit type",
                v.width
            ),
            &cx.fn_sym,
        ));
    }
    Ok(LoweredValue::Packed(PackedValue {
        signed: ty.is_signed(),
        ..v
    }))
}

/// R-run Task 10 (CG-061 reused, CG-042 untouched): a `Call` expression this
/// crate's own frontend classifies as NOT a system call
/// (`Expression::is_system_call() != Some(true)`) -- an ordinary SV
/// `function`/`task` call used in EXPRESSION position (e.g. `x = sq(7)`, or,
/// nested, `show(sq(7))`'s inner `sq(7)`). Distinguishes two genuinely
/// different "outside CG-042's allowlist" cases the pre-Task-10 code lumped
/// into one unconditional rejection:
///
/// - a DPI import call: a direct C call ([`crate::dpi::lower_dpi_import_call`]).
/// - an ordinary (non-DPI) subroutine call resolving to a real
///   `SubroutineSymbol`: lowered via [`crate::func::resolve_callee_fn`] --
///   the SAME same-module/mangled/cross-module resolution
///   `func.rs::lower_task_call` (a bare, statement-position call) already
///   uses, so this call site never has to know or care whether the callee
///   sits in the same LLVM `Module` this pipeline already lowered it into
///   or genuinely lives in a different one (CG-061).
///
/// Scope restriction (named, not silent): only an AUTOMATIC, NON-SUSPENDING
/// function call reaches here successfully. A task whose OWN body contains a
/// suspend point (a `#delay`/`@event`/`wait(expr)` statement) fails inside
/// `func::lower_function`'s own `lower_stmt` dispatch (the `Timed`/`Wait`
/// arms, CG-154) the first time this pipeline tries to lower that task's
/// body at all -- long before any call site like this one is ever reached; a
/// task call used as an EXPRESSION value is in any case not legal SV (only a
/// `function` call can appear in expression position at all), so this
/// function's own real-world callees are always `function`s, never `task`s.
/// A real-typed return value is likewise out of scope, mirroring
/// `lower_function`'s own real-typed-ARGUMENT restriction (CG-037 covers the
/// `Conversion` node, not real-typed function-call plumbing).
fn lower_user_subroutine_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    call: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    // Classes plan Task 5 (§1.4 step 2): `obj.method(args)` used as a
    // value -- `call_this_class()` gives the receiver expression directly
    // whenever this is a method call at all, tried before every other
    // call-site resolution below (none of which know how to find a class
    // method's own mangled name/receiver). Deviation (found running this
    // task's own fixtures): `call_this_class()` is ALSO `Some` for a
    // virtual-interface modport function call -- `vif::call_targets` is
    // checked first and excludes that case, matching `func::
    // lower_task_call`'s own identical guard.
    // A covergroup's predefined methods (19.8).
    if let Some(v) = crate::covergroup::lower_call(cx, call)? {
        return Ok(v);
    }
    // The built-in `process` class (Task 13) has no SV bodies: its calls
    // (`p.status()`, `process::self()`) go straight to the runtime.
    match crate::classes::lower_std_process_call(cx, call)? {
        crate::classes::ProcessCall::Lowered(Some(v)) => return Ok(v),
        crate::classes::ProcessCall::Lowered(None) => {
            return Err(LoweringError::unsupported_at(
                "a void method call cannot be used as an expression value",
                &cx.fn_sym,
            ));
        }
        crate::classes::ProcessCall::NotProcess => {}
    }
    let not_vif_call = sv_sim_sim::netlist::vif::call_targets(&call).is_none();
    // A function or method whose body spawns processes (LRM 1800-2023
    // 13.4.4) is inlined into the calling process ahead of the statement
    // (`CfgBuilder::hoist_suspending_function_calls`): the call's value is
    // its result variable, a local of the process.
    // (Two calls of one function in a statement, and a virtual method, park
    // the value in a temporary of the call's own: `ArgBinding::CallResult`.)
    if let Some(callee) = call.call_subroutine()
        && callee.subroutine_kind() == Some(sv_lang::SubroutineKind::Function)
        && let Some(rv) = callee.subroutine_return_val_var()
        && let Some((slot, width, signed)) = cx
            .locals
            .get(&sv_sim_sim::process::cfg::call_result_key(&call))
            .or_else(|| cx.locals.get(&rv.uid()))
            .copied()
        && sv_sim_sim::process::cfg::subroutine_can_suspend(&callee)
    {
        let op = OpBuilder {
            ctx: cx.ctx,
            b: &cx.b,
        };
        let ty = if cx.repr == ValueRepr::FourState {
            op.i_n(width * 2)
        } else {
            op.i_n(width)
        };
        let v =
            cx.b.build_load(ty, slot, "ld_ret")
                .unwrap()
                .into_int_value();
        let pv = PackedValue {
            llvm: v,
            width,
            repr: cx.repr,
            signed,
        };
        if rv.value_type().is_some_and(|t| t.is_floating()) {
            return Ok(LoweredValue::Real(crate::real::bits_to_real(cx, pv)));
        }
        return Ok(LoweredValue::Packed(pv));
    }
    if not_vif_call && let Some(recv) = call.call_this_class() {
        return crate::classes::lower_method_call(cx, Some(recv), call);
    }
    // Review fix (r2), Task 6 finding 1: `super.method(...)` returning a
    // VALUE (e.g. `return super.val();`) and a bare, implicit-`this`
    // sibling-method call used as a value -- see `func::lower_task_call`'s
    // identical fallback (and `classes::resolve_implicit_this_instance_
    // method`'s own doc comment) for why `call_this_class()` is `None`
    // here despite there being a live, current-object receiver.
    if not_vif_call
        && let Some(callee) = call.call_subroutine()
        && crate::classes::resolve_implicit_this_instance_method(callee)?.is_some()
    {
        return crate::classes::lower_method_call(cx, None, call);
    }
    let callee = call.call_subroutine().ok_or_else(|| {
        LoweringError::unsupported_at(
            "non-system call missing its callee subroutine symbol",
            &cx.fn_sym,
        )
    })?;
    // Through a virtual interface: the selected instance's own function
    // (`crate::vif::call_arms`); `null` gives the return type's default.
    if crate::vif::call_arms_apply(&call) {
        let ret = callee
            .subroutine_return_type()
            .filter(|t| !t.is_void())
            .ok_or_else(|| {
                LoweringError::unsupported_at(
                    "a void function/task call cannot be used as an expression value",
                    &cx.fn_sym,
                )
            })?;
        let (slot, is_real) = if ret.is_floating() {
            let slot = entry_alloca(cx, cx.ctx.f64_type(), "vif_ret");
            cx.b.build_store(slot, cx.ctx.f64_type().const_zero())
                .unwrap();
            (slot, true)
        } else {
            let op = OpBuilder {
                ctx: cx.ctx,
                b: &cx.b,
            };
            let ty = op.packed_type(ret.value_width(), cx.repr);
            let slot = entry_alloca(cx, ty, "vif_ret");
            cx.b.build_store(slot, crate::arrays::default_value(cx, &ret))
                .unwrap();
            (slot, false)
        };
        let (arms, merge) = crate::vif::call_arms(cx, call).expect("checked")?;
        for (callee, bb) in arms {
            cx.b.position_at_end(bb);
            match lower_user_subroutine_call_of(cx, callee, call)? {
                LoweredValue::Real(r) => {
                    cx.b.build_store(slot, r.llvm).unwrap();
                }
                LoweredValue::Packed(p) => {
                    cx.b.build_store(slot, p.llvm).unwrap();
                }
                _ => {
                    return Err(LoweringError::unsupported_at(
                        "a string or wide function result through a virtual interface",
                        &cx.fn_sym,
                    ));
                }
            }
            cx.b.build_unconditional_branch(merge).unwrap();
        }
        cx.b.position_at_end(merge);
        return Ok(if is_real {
            let f =
                cx.b.build_load(cx.ctx.f64_type(), slot, "vif_ret_ld")
                    .unwrap()
                    .into_float_value();
            LoweredValue::Real(RealValue { llvm: f })
        } else {
            let op = OpBuilder {
                ctx: cx.ctx,
                b: &cx.b,
            };
            let ty = op.packed_type(ret.value_width(), cx.repr);
            let v =
                cx.b.build_load(ty, slot, "vif_ret_ld")
                    .unwrap()
                    .into_int_value();
            LoweredValue::Packed(PackedValue {
                llvm: v,
                width: ret.value_width(),
                repr: cx.repr,
                signed: ret.is_signed(),
            })
        });
    }
    // An interface `extern` function (LRM 25.7): the module's definition.
    let callee = sv_sim_sim::netlist::itf::call_target(&call).unwrap_or(callee);
    lower_user_subroutine_call_of(cx, callee, call)
}

/// [`lower_user_subroutine_call`] of `call` to `callee`.
fn lower_user_subroutine_call_of<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    callee: sv_lang::Symbol<'d>,
    call: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    if callee.subroutine_flags().contains(MethodFlags::DPI_IMPORT) {
        let v = crate::dpi::lower_dpi_import_call(cx, &callee, call)?.ok_or_else(|| {
            LoweringError::unsupported_at(
                "a void DPI import cannot be used as an expression value",
                &cx.fn_sym,
            )
        })?;
        crate::stmt_shared::leave_if_aborted(cx)?;
        return Ok(v);
    }
    // A void `task`'s `subroutine_return_type()` is `Some(<void Type>)`,
    // never `None` (`Type::is_void()` is the real signal -- see
    // `func::lower_function`'s own `is_void_return` for the identical
    // correction) -- checked explicitly here rather than via `.ok_or_else`
    // on `None`, which a void callee could never actually trigger.
    let ret_sv = callee.subroutine_return_type();
    if ret_sv.as_ref().is_none_or(sv_lang::Type::is_void) {
        return Err(LoweringError::unsupported_at(
            "a void function/task call cannot be used as an expression value",
            &cx.fn_sym,
        ));
    }
    let ret_sv = ret_sv.unwrap();
    let width = ret_sv.value_width();
    let signed = ret_sv.is_signed();
    let returns_real = ret_sv.is_floating();

    let callee_fn = crate::func::resolve_callee_fn(cx, callee)?;
    let (mut llvm_args, copy_backs) = crate::func::lower_call_args(cx, &callee, call)?;
    // A result wider than an LLVM integer comes back as an image the caller
    // owns (the last argument).
    let image = if crate::huge::is_image_width(width) && ret_sv.is_integral() {
        let img = crate::huge::result_image(cx, width)?;
        llvm_args.push(img.into());
        Some(img)
    } else {
        None
    };
    if llvm_args.len() != callee_fn.count_params() as usize {
        return Err(LoweringError::unsupported_at(
            "user function call argument count does not match the callee's \
             declared parameter count",
            &cx.fn_sym,
        ));
    }
    let call_site =
        cx.b.build_call(callee_fn, &llvm_args, "user_fn_call")
            .unwrap();
    if sv_sim_sim::process::cfg::subroutine_can_abort(&callee) {
        crate::stmt_shared::leave_if_aborted(cx)?;
    }
    crate::func::commit_callee_writes(cx, &callee);
    if crate::dpi::reaches_context_import(&callee) {
        crate::dpi::reload_shadows(cx);
    }
    crate::func::copy_back_outputs(cx, copy_backs)?;
    if let Some(ptr) = image {
        return Ok(LoweredValue::Huge(crate::huge::HugeValue {
            ptr,
            width,
            signed,
        }));
    }
    let ret_v = call_site.try_as_basic_value().basic().ok_or_else(|| {
        LoweringError::unsupported_at(
            "user function call produced no return value at the LLVM \
                 level despite a non-void SV return type",
            &cx.fn_sym,
        )
    })?;
    if returns_real {
        let f = crate::real::as_f64(cx, ret_v.into_float_value());
        return Ok(LoweredValue::Real(RealValue { llvm: f }));
    }
    Ok(LoweredValue::Packed(PackedValue {
        llvm: ret_v.into_int_value(),
        width,
        repr: cx.repr,
        signed,
    }))
}

// Task 9 (CG-090, CG-007), review fix (r1): `lower_condition` is the ONE
// entry point every direct if/while/wait/case branch-condition site must
// call (currently only `func.rs`'s `Conditional`/`if` arm exists). When
// `expr` is itself a direct `&&`/`||` BinaryOp, this is CG-090's actual
// short-circuit-condition site -- routed to
// `lower_short_circuit_logical_condition`, the ARCHITECTURE.md-cited §12.4
// "ambiguous -> false" collapse (also skipping the right operand's
// evaluation whenever the left ALONE is not provably true/false, since a
// branch decision alone never needs to distinguish "definitely false" from
// "ambiguous" -- both take the else path). Every other expression kind
// (including a `&&`/`||` nested inside a larger condition, e.g. `(a && b)
// && c`'s outer `&&`) instead goes through the ordinary value-preserving
// `lower_expr`, followed by `is_definitely_true` on the fully-reduced
// result -- behaviorally equivalent for the branch DECISION itself (any
// ambiguity anywhere still collapses to false), never a per-bit merge
// (CG-091: that is the ternary `?:`'s own, distinct job).
/// LRM 20.6.2 / 11.4.7: a `&&`/`||` the front end already folded to an integer
/// (`!$isunbounded(P) && P == 0`, whose right operand is never evaluated when `P` is `$`)
/// lowers as that constant: lowering the unevaluated operand would read the `$` parameter,
/// which has no integer value.
fn fold_constant_logical<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
) -> Result<Option<LoweredValue<'ctx>>, LoweringError> {
    match e.constant_value().and_then(|cv| cv.as_integer().cloned()) {
        Some(iv) => lower_constant(cx, &iv, Some(e)).map(Some),
        None => Ok(None),
    }
}

pub fn lower_condition<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    expr: sv_lang::Expression<'d>,
) -> Result<inkwell::values::IntValue<'ctx>, LoweringError> {
    // An event as a condition: true iff it is not `null` (15.5.5.3).
    if let Some(v) = crate::events::lower_event_condition(cx, expr)? {
        return Ok(v);
    }
    if expr.kind() == ExpressionKind::BinaryOp
        && let Some(bop) = expr.binary_op()
        && matches!(bop, BinaryOp::LogicalAnd | BinaryOp::LogicalOr)
    {
        let lv = match fold_constant_logical(cx, expr)? {
            Some(v) => v,
            None => lower_short_circuit_logical_condition(cx, expr, bop == BinaryOp::LogicalAnd)?,
        };
        // `lower_short_circuit_logical_condition` already produces a
        // crisp (unk=0) boolean, so this `is_definitely_true` is a
        // pass-through -- kept for a single, uniform "the condition
        // site always ends in `is_definitely_true`" shape rather
        // than a special-cased early return of a raw bit.
        let pv = lv.into_packed("condition must be an integral (non-real) value", &cx.fn_sym)?;
        return Ok(is_definitely_true(cx.ctx, &cx.b, pv));
    }
    let pv = match lower_expr_h(cx, expr)? {
        LoweredValue::Real(rv) => return Ok(crate::real::real_truth(cx, rv)),
        other => crate::huge::truth_packed(
            cx,
            other,
            crate::huge::TruthMode::Strict,
            "condition of a >128-bit value",
        )?,
    };
    Ok(is_definitely_true(cx.ctx, &cx.b, pv))
}

/// [`lower_condition`] for the condition `!expr`: 1 exactly where the logical
/// negation of `expr` is KNOWN true (LRM 11.4.7), that is where `expr` is a
/// fully known zero. Not `!lower_condition(expr)`: an `x`/`z` expression is not
/// true but its negation `!x` is `x`, which a condition collapses to false too,
/// so both `expr` and `!expr` fail on it. `expr` is lowered by `lower_expr`
/// even when it is a `&&`/`||`, because the crisp collapse of
/// `lower_short_circuit_logical_condition` would turn an ambiguous `a && b`
/// into a known 0 and its negation into a spurious true.
pub fn lower_negated_condition<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    expr: sv_lang::Expression<'d>,
) -> Result<inkwell::values::IntValue<'ctx>, LoweringError> {
    let pv = match lower_expr_h(cx, expr)? {
        LoweredValue::Real(rv) => {
            // A real is never ambiguous: `!r` is true exactly for 0.0.
            let truth = crate::real::real_truth(cx, rv);
            return Ok(cx.b.build_not(truth, "real_not").unwrap());
        }
        // A huge value is read as the one-bit truth proxy (`WideOp::Truth`).
        other => crate::huge::truth_packed(
            cx,
            other,
            crate::huge::TruthMode::Strict,
            "condition of a >128-bit value",
        )?,
    };
    Ok(is_definitely_false(cx.ctx, &cx.b, pv))
}

/// Stores `value` into the target expression `lhs` (a real value becomes
/// the real target's stored bits) and returns it as the assignment's value.
pub(crate) fn store_to<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    lhs: sv_lang::Expression<'d>,
    value: LoweredValue<'ctx>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    store_to_releasing(cx, lhs, value, None)
}

/// [`store_to`] for a target that holds reference-counted handles, with the
/// target resolved once: `release` (when given) receives the stored value the
/// target held, just before `value` replaces it (`select::
/// lower_assign_releasing`). Class properties and collection elements
/// release their own old value in their store and never call `release`.
pub(crate) fn store_to_releasing<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    lhs: sv_lang::Expression<'d>,
    value: LoweredValue<'ctx>,
    release: Option<&mut dyn FnMut(PackedValue<'ctx>)>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    // Classes plan Task 5 (§1.4 step 4): `obj.field = v` or, inside a
    // method body, a bare implicit-`this` `field = v` -- written through
    // the object heap, before every other lvalue shape below (none of
    // which have any storage root a class property could ever be).
    // A whole class property wider than `WIDE_THRESHOLD` is an image copy.
    if matches!(value, LoweredValue::Huge(_))
        && crate::huge::class_prop_root(lhs)
        && crate::huge::try_store(cx, lhs, value)?.is_some()
    {
        return Ok(value);
    }
    if let Some(v) = crate::classes::try_write_field(cx, lhs, value)? {
        return Ok(v);
    }
    // A covergroup's `option.x = v` / `type_option.x = v` (19.7).
    if let Some(v) = crate::covergroup::lower_option_write(cx, lhs, value)? {
        return Ok(v);
    }
    // A vector wider than `WIDE_THRESHOLD` (a whole variable or a select of
    // one): `crate::huge`.
    if crate::huge::try_store(cx, lhs, value)?.is_some() {
        return Ok(value);
    }
    // One collection of a fixed array of them inside such an element.
    if let Some(r) = crate::collections::write_fixed_in_coll(cx, lhs, value) {
        r?;
        return Ok(value);
    }
    // An element of a queue, dynamic or associative array.
    if let Some(r) = crate::collections::write_element(cx, lhs, value) {
        r?;
        return Ok(value);
    }
    // A write into part of a queue / dynamic-array element
    // (`d[i][j] = v`, `q[i].f = v`): a read-modify-write of the element.
    if let Some(elem) = crate::collections::partial_element_target(lhs) {
        return store_partial_element(cx, lhs, elem, value, release);
    }
    // A stream target (`{<<8{a, b}} = v`) unpacks the source at its own
    // width (`crate::stream::unpack_stream`).
    let stream_width = match value {
        LoweredValue::Packed(p) if lhs.kind() == ExpressionKind::Streaming => Some(p.width),
        _ => None,
    };
    let width = stream_width
        .or_else(|| lhs.expr_type().map(|t| t.value_width()).filter(|w| *w > 0))
        .ok_or_else(|| {
            LoweringError::unsupported_at("assignment target has no width", &cx.fn_sym)
        })?;
    let bits = crate::real::to_storage(cx, value, width, "assignment of a >128-bit value")?;
    match release {
        Some(release) => crate::select::lower_assign_releasing(cx, lhs, bits, release)?,
        None => crate::select::lower_assign_to(cx, lhs, bits)?,
    }
    Ok(value)
}

/// A binary operator with at least one real operand: arithmetic and
/// comparisons on two reals (slang converts both sides), or `&&`/`||`
/// (self-determined operands, so one side may be integral).
fn lower_real_binary_expr<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    e: sv_lang::Expression<'d>,
    bop: BinaryOp,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let left = e.left().ok_or_else(|| {
        LoweringError::unsupported_at("binary op missing left operand", &cx.fn_sym)
    })?;
    let right = e.right().ok_or_else(|| {
        LoweringError::unsupported_at("binary op missing right operand", &cx.fn_sym)
    })?;
    let l = lower_expr_h(cx, left)?;
    let r = lower_expr_h(cx, right)?;
    if matches!(bop, BinaryOp::LogicalAnd | BinaryOp::LogicalOr) {
        let truth = |v: LoweredValue<'ctx>| -> Result<IntValue<'ctx>, LoweringError> {
            Ok(match v {
                LoweredValue::Real(rv) => crate::real::real_truth(cx, rv),
                other => is_definitely_true(
                    cx.ctx,
                    &cx.b,
                    crate::huge::truth_packed(
                        cx,
                        other,
                        crate::huge::TruthMode::Strict,
                        "logical operand of a >128-bit value",
                    )?,
                ),
            })
        };
        let (a, b) = (truth(l)?, truth(r)?);
        let bit = if bop == BinaryOp::LogicalAnd {
            cx.b.build_and(a, b, "real_land").unwrap()
        } else {
            cx.b.build_or(a, b, "real_lor").unwrap()
        };
        let op = OpBuilder {
            ctx: cx.ctx,
            b: &cx.b,
        };
        return Ok(LoweredValue::Packed(op.pack(
            bit,
            cx.ctx.bool_type().const_zero(),
            1,
            cx.repr,
            false,
        )));
    }
    let (LoweredValue::Real(lr), LoweredValue::Real(rr)) = (l, r) else {
        return Err(LoweringError::unsupported_at(
            &format!("binary op {bop:?} between a real and a non-real operand"),
            &cx.fn_sym,
        ));
    };
    crate::real::real_binary(cx, bop, lr, rr).ok_or_else(|| {
        LoweringError::unsupported_at(
            &format!("operator {bop:?} is not defined on real operands"),
            &cx.fn_sym,
        )
    })
}

// Task 9 (CG-090, CG-007): `&&`/`||` genuine short-circuit lowering, for the
// direct if/while/wait/case branch-CONDITION site only (reached solely via
// `lower_condition` above, never from the generic `BinaryOp` dispatch) --
// `is_definitely_true` (CG-007's "X-as-false", not the ternary's per-bit
// X-merge -- CG-091) reduces each operand to a boolean BEFORE combining, and
// the right operand is only ever lowered inside a conditionally-taken basic
// block, so a right operand with a side effect (an assignment, a future
// task/void-function call) genuinely does not execute at runtime when the
// left operand alone already determines the result: `false && rhs`
// short-circuits to `false` without evaluating `rhs`; `true || rhs`
// short-circuits to `true` without evaluating `rhs`. The result is always a
// plain, fully-known boolean (`unk` lane forced to 0) -- per CG-007's
// decision record, `&&`/`||` never produce an X result the way the
// ternary's bitwise merge can. This crisp collapse is spec-correct ONLY
// for this direct-condition context (LRM §12.4); `&&`/`||` used as an
// ordinary value (e.g. an assignment RHS) must instead preserve Table
// 11-4's genuine ambiguity -- see `lower_short_circuit_logical_value`
// below, which is what `lower_expr`'s generic `BinaryOp` arm actually
// calls.
//
// Review fix (r2): "the left operand alone already determines the result"
// above is, per IEEE 1800-2023 §11.4.7, DEFINITELY-FALSE for `&&` (not
// merely "not definitely true") and DEFINITELY-TRUE for `||` -- an
// ambiguous (X/Z-containing) left is not, by itself, sufficient to
// determine either operator's result, so the right operand's side effects
// still execute in that case for both operators. See
// `lower_short_circuit_logical_condition`'s own body comments for the
// exact skip predicates and the resulting merge-value fix this implies for
// `&&`.
fn lower_short_circuit_logical_condition<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
    is_and: bool,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let left_expr = e.left().ok_or_else(|| {
        LoweringError::unsupported_at("logical &&/|| missing left operand", &cx.fn_sym)
    })?;
    let right_expr = e.right().ok_or_else(|| {
        LoweringError::unsupported_at("logical &&/|| missing right operand", &cx.fn_sym)
    })?;

    let left_pv = crate::huge::truth_packed(
        cx,
        lower_expr_h(cx, left_expr)?,
        crate::huge::TruthMode::Strict,
        "logical &&/|| on a non-integral (real) left operand",
    )?;
    let left_true = is_definitely_true(cx.ctx, &cx.b, left_pv);

    let entry_block = cx.b.get_insert_block().ok_or_else(|| {
        LoweringError::unsupported_at("logical &&/|| lowered outside a basic block", &cx.fn_sym)
    })?;
    let f = entry_block.get_parent().ok_or_else(|| {
        LoweringError::unsupported_at("logical &&/|| block has no parent function", &cx.fn_sym)
    })?;

    let (eval_name, merge_name) = if is_and {
        ("land_rhs", "land_merge")
    } else {
        ("lor_rhs", "lor_merge")
    };
    let rhs_block = cx.ctx.append_basic_block(f, eval_name);
    let merge_block = cx.ctx.append_basic_block(f, merge_name);

    // Review fix (r2), CG-090/CG-007/CG-091 blocking finding: IEEE
    // 1800-2023 SS11.4.7 only permits skipping the right operand's
    // evaluation when the LEFT operand ALONE is sufficient to determine the
    // *value* result -- for `&&` that is exactly "left is DEFINITELY 0",
    // never merely "left is not definitely true". `is_definitely_true`
    // being false fires on BOTH a definitely-false left AND an ambiguous
    // (X/Z-containing) left (e.g. `x && bump()` with `x` all-X: the result
    // is genuinely X, not determined by the left alone, so `bump()`'s side
    // effect must still run -- verified against iverilog, the project's
    // golden reference, which prints the side effect). So the `&&` arm must
    // branch on a dedicated "left is definitely false" predicate, not on
    // `left_true`/`is_definitely_true(left)`. Mirrors
    // `lower_short_circuit_logical_value`'s `land_known_false` computation
    // (`!left_val && !left_unk`), but computed over `redor4`'s Kleene-OR
    // reduction of `left_pv` first so a dominant known-1 bit amid unknown
    // bits still correctly reads as "not definitely false" (matching the
    // value path's own reduce-before-test structure exactly).
    //
    // The `||` arm's existing `left_true` skip condition is UNCHANGED and
    // already correct: `||`'s right operand is only skippable when the left
    // ALONE is sufficient, i.e. when it is DEFINITELY 1 -- exactly what
    // `is_definitely_true` tests.
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let left_reduced = op.redor4(left_pv);
    let left_reduced_val = op.lane_val(left_reduced);
    let left_reduced_unk = op.lane_unk(left_reduced);
    let land_not_val =
        cx.b.build_not(left_reduced_val, "land_cond_not_val")
            .unwrap();
    let land_not_unk =
        cx.b.build_not(left_reduced_unk, "land_cond_not_unk")
            .unwrap();
    let left_definitely_false =
        cx.b.build_and(land_not_val, land_not_unk, "land_cond_known_false")
            .unwrap();

    // `&&`: skip straight to `merge_block` (short-circuit to false) only
    // when the left operand is DEFINITELY FALSE; a definitely-true OR an
    // ambiguous left both require evaluating the right operand, since only
    // a definitely-false left is sufficient to determine the AND result.
    // `||`: only reach `rhs_block` when the left operand is NOT definitely
    // true (a definitely-true left already determines a true result).
    if is_and {
        cx.b.build_conditional_branch(left_definitely_false, merge_block, rhs_block)
            .unwrap();
    } else {
        cx.b.build_conditional_branch(left_true, merge_block, rhs_block)
            .unwrap();
    }
    let short_circuit_pred = entry_block;

    cx.b.position_at_end(rhs_block);
    let right_pv = crate::huge::truth_packed(
        cx,
        lower_expr_h(cx, right_expr)?,
        crate::huge::TruthMode::Strict,
        "logical &&/|| on a non-integral (real) right operand",
    )?;
    let right_true = is_definitely_true(cx.ctx, &cx.b, right_pv);
    // `&&`'s rhs_block is now reachable with an AMBIGUOUS left (not only a
    // definitely-true one, per the gating fix above), so the merge value
    // reached via this block can no longer be `right_true` alone: unlike
    // `||` (where a definitely-true right always dominates a not-definitely-
    // true left under Kleene OR, so `right_true` alone happens to already be
    // exactly correct), `&&`'s Kleene AND has no such dominance from a
    // known-1 -- `X && 1 == X`, not `1`. So this arm's merge value must be
    // `is_definitely_true` of the genuine Kleene-AND combination of the
    // (redor4-reduced) left and right operands, matching
    // `lower_short_circuit_logical_value`'s own `and4` use. This is what
    // keeps `logical_and_with_x_operand_uses_is_definitely_true_not_bitwise_and`
    // (`4'bxxxx && 1'b1` -> else/222, since the AND is ambiguous, not
    // definitely true) correct now that this block is reached on that exact
    // ambiguous-left case.
    let and_merge_true = if is_and {
        let right_reduced = op.redor4(right_pv);
        let and_combined = op.and4(left_reduced, right_reduced);
        is_definitely_true(cx.ctx, &cx.b, and_combined)
    } else {
        right_true
    };
    // Re-fetch the insertion block (not `rhs_block` itself): lowering the
    // right operand may have opened/closed further blocks of its own (e.g.
    // a nested if/&&/||), so the phi's real predecessor is wherever the
    // builder ended up, exactly like the analogous re-fetch after lowering
    // each arm of an eventual ternary.
    let rhs_pred = cx.b.get_insert_block().ok_or_else(|| {
        LoweringError::unsupported_at(
            "logical &&/|| right operand left no open basic block",
            &cx.fn_sym,
        )
    })?;
    cx.b.build_unconditional_branch(merge_block).unwrap();

    cx.b.position_at_end(merge_block);
    let bool_ty = cx.ctx.bool_type();
    let phi = cx.b.build_phi(bool_ty, "logical_result").unwrap();
    let short_circuit_val = if is_and {
        bool_ty.const_zero()
    } else {
        bool_ty.const_int(1, false)
    };
    phi.add_incoming(&[
        (&short_circuit_val, short_circuit_pred),
        (&and_merge_true, rhs_pred),
    ]);
    let result_i1 = phi.as_basic_value().into_int_value();

    Ok(LoweredValue::Packed(op.pack(
        result_i1,
        bool_ty.const_zero(),
        1,
        cx.repr,
        false,
    )))
}

// Review fix (r1), CG-021: `&&`/`||` used as an ORDINARY value (e.g. an
// assignment RHS -- exactly what `logical_and_short_circuits_second_operand`
// /`logical_or_short_circuits_second_operand`, tests/branch_reduction.rs,
// already exercise) is not a branch-condition site, so LRM §12.4's
// "ambiguous -> false" collapse does NOT apply -- LRM SS11.4.7's own Table
// 11-4 does instead: a definite operand combined with an ambiguous one can
// legitimately produce an ambiguous (X) RESULT (`1 && x = x`, `0 && x = 0`),
// not always a definite boolean.
//
// Table 11-4 is exactly Kleene 3-valued AND/OR applied to each operand's own
// truthiness reduction: `redor4` (the same "any known-1 bit dominates, else
// X if any bit is unknown, else 0" reduction `if`'s condition already uses)
// reduces each side to a single tri-state bit, and `and4`/`or4` (this
// crate's existing bitwise 4-state AND/OR, CG-analogous to `if`'s own
// operators) already implement that exact Kleene table on a single bit:
// `0 AND4 x = 0`, `1 AND4 x = x`, `x AND4 x = x` (and the OR mirror) --
// verified directly against the LRM's own Table 11-4 entries.
//
// Genuine short-circuiting is still preserved, but its TRIGGER differs from
// the crisp condition-only lowering above: the right operand's side effects
// must still not execute whenever the LEFT operand ALONE already pins down
// the combined result with zero remaining ambiguity -- for `&&` that means a
// left operand that is DEFINITELY 0 (an ambiguous left is NOT enough: `x &&
// 0` is 0 but `x && 1` is `x`, so the exact result genuinely depends on the
// right operand and it must be evaluated); for `||`, a left operand that is
// DEFINITELY 1.
fn lower_short_circuit_logical_value<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
    is_and: bool,
    negate_left: bool,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let left_expr = e.left().ok_or_else(|| {
        LoweringError::unsupported_at("logical &&/|| missing left operand", &cx.fn_sym)
    })?;
    let right_expr = e.right().ok_or_else(|| {
        LoweringError::unsupported_at("logical &&/|| missing right operand", &cx.fn_sym)
    })?;

    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };

    let left_pv = crate::huge::truth_packed(
        cx,
        lower_expr_h(cx, left_expr)?,
        crate::huge::TruthMode::Ternary,
        "logical &&/|| on a non-integral (real) left operand",
    )?;
    // Reduce (not collapse): a width-1 tri-state PackedValue -- 1 if any bit
    // of the left operand is known-1, X if ambiguous, else 0. Never forced
    // to a crisp i1 the way the condition-site lowering does.
    let mut left_reduced = op.redor4(left_pv);
    // `->` is `!left || right` (LRM 11.4.7): negate the tri-state truth.
    if negate_left {
        left_reduced = op.not4(left_reduced);
    }
    let left_val = op.lane_val(left_reduced);
    let left_unk = op.lane_unk(left_reduced);

    let entry_block = cx.b.get_insert_block().ok_or_else(|| {
        LoweringError::unsupported_at("logical &&/|| lowered outside a basic block", &cx.fn_sym)
    })?;
    let f = entry_block.get_parent().ok_or_else(|| {
        LoweringError::unsupported_at("logical &&/|| block has no parent function", &cx.fn_sym)
    })?;

    // `&&`: skip the right operand only when the left is DEFINITELY 0 --
    // `!left_val && !left_unk` (an ambiguous left, `left_unk=1`, must NOT
    // skip: the exact result still depends on the right operand).
    // `||`: skip the right operand only when the left is DEFINITELY 1 --
    // `left_val` alone suffices, since `redor4`'s own `pack()` guarantees
    // `unk=0` whenever `val=1` (a dominant known-1 bit always wins over any
    // other unknown bit in the reduction).
    let skip_rhs = if is_and {
        let not_val = cx.b.build_not(left_val, "land_not_val").unwrap();
        let not_unk = cx.b.build_not(left_unk, "land_not_unk").unwrap();
        cx.b.build_and(not_val, not_unk, "land_known_false")
            .unwrap()
    } else {
        left_val
    };

    let (eval_name, merge_name) = if is_and {
        ("land_rhs_v", "land_merge_v")
    } else {
        ("lor_rhs_v", "lor_merge_v")
    };
    let rhs_block = cx.ctx.append_basic_block(f, eval_name);
    let merge_block = cx.ctx.append_basic_block(f, merge_name);
    // Skip straight to the merge block (short-circuit, result = the left
    // operand's own reduced value/unk unchanged) when `skip_rhs` holds;
    // otherwise evaluate the right operand in `rhs_block`.
    cx.b.build_conditional_branch(skip_rhs, merge_block, rhs_block)
        .unwrap();
    let short_circuit_pred = entry_block;

    cx.b.position_at_end(rhs_block);
    let right_pv = crate::huge::truth_packed(
        cx,
        lower_expr_h(cx, right_expr)?,
        crate::huge::TruthMode::Ternary,
        "logical &&/|| on a non-integral (real) right operand",
    )?;
    let right_reduced = op.redor4(right_pv);
    let combined = if is_and {
        op.and4(left_reduced, right_reduced)
    } else {
        op.or4(left_reduced, right_reduced)
    };
    let combined_val = op.lane_val(combined);
    let combined_unk = op.lane_unk(combined);
    // Re-fetch the insertion block, not `rhs_block` itself, for the same
    // reason as the condition-site lowering above: lowering the right
    // operand may have opened/closed further blocks of its own.
    let rhs_pred = cx.b.get_insert_block().ok_or_else(|| {
        LoweringError::unsupported_at(
            "logical &&/|| right operand left no open basic block",
            &cx.fn_sym,
        )
    })?;
    cx.b.build_unconditional_branch(merge_block).unwrap();

    cx.b.position_at_end(merge_block);
    let bool_ty = cx.ctx.bool_type();
    let val_phi = cx.b.build_phi(bool_ty, "logical_val").unwrap();
    val_phi.add_incoming(&[(&left_val, short_circuit_pred), (&combined_val, rhs_pred)]);
    let unk_phi = cx.b.build_phi(bool_ty, "logical_unk").unwrap();
    unk_phi.add_incoming(&[(&left_unk, short_circuit_pred), (&combined_unk, rhs_pred)]);

    Ok(LoweredValue::Packed(op.pack(
        val_phi.as_basic_value().into_int_value(),
        unk_phi.as_basic_value().into_int_value(),
        1,
        cx.repr,
        false,
    )))
}

/// `a <-> b` (LRM 11.4.7): both operands are evaluated, each reduced to its
/// tri-state truth; the result is their 1-bit XNOR (x if either is ambiguous).
fn lower_logical_equivalence<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let (Some(le), Some(re)) = (e.left(), e.right()) else {
        return Err(LoweringError::unsupported_at(
            "logical <-> missing operand",
            &cx.fn_sym,
        ));
    };
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let side = |x: sv_lang::Expression<'d>| -> Result<PackedValue<'ctx>, LoweringError> {
        let pv = crate::huge::truth_packed(
            cx,
            lower_expr_h(cx, x)?,
            crate::huge::TruthMode::Ternary,
            "logical <-> on a non-integral (real) operand",
        )?;
        Ok(op.redor4(pv))
    };
    let l = side(le)?;
    let r = side(re)?;
    Ok(LoweredValue::Packed(op.not4(op.xor4(l, r))))
}

// Task 10 (CG-040): the side-effect-purity check that gates the ternary's
// `select`-only fast path (CG-041). A PURELY SYNTACTIC recursive walk over
// an expression's own semantic children (`Expression::children()`), with no
// dependency on process-lowering or state (per CG-040's own "lives inside
// sv-sim-codegen, no cross-subsystem dependency" requirement) -- it never
// evaluates or lowers anything, only inspects the AST shape.
//
// Deviation from the plan text (which describes this as "private"): CG-040's
// own acceptance calls for direct unit tests on this function
// ("purity_check_rejects_call_expression" et al., independent of any
// process/state dependency), and this crate's existing precedent for a
// function whose own tests live in an external `tests/*.rs` integration
// file (which can only see a crate's PUBLIC API) is to make that function
// `pub` with a doc comment explaining why -- see `classify_conversion_kind`
// in this same file (Task 7/CG-075) for the identical shape of this exact
// tension. `pub` here, not `pub(crate)`: `tests/ternary.rs` is an external
// crate like any other integration test.
///
/// True if `e` -- and every expression nested inside it -- is free of
/// side-effecting `ExpressionKind`s. This is a FAST-PATH GATE (CG-041):
/// getting a genuinely-pure kind wrong in the conservative direction (i.e.
/// classifying it impure) only costs the eager `select` optimization and
/// falls back to the always-correct `br`+`phi` general path in
/// `lower_ternary`; getting an impure kind wrong in the other direction
/// (classifying it pure) is a real correctness bug -- it would run that
/// side effect unconditionally via the eager `select` path even when the
/// ternary's actual chosen arm doesn't execute it. So every arm below is
/// listed explicitly and the default (both the trailing wildcard, forced by
/// `ExpressionKind` being `#[non_exhaustive]` -- see `sv-lang-kinds`'s
/// `ast_kind.rs`, so no literal match on this enum can itself be closed --
/// and every kind this crate does not otherwise reason about, e.g.
/// `NewArray`/`NewClass`/`NewCovergroup`/`CopyClass`, which genuinely run
/// constructor/initializer code) is IMPURE, never pure.
///
/// Explicitly pure (leaf literals/reads, or composite/structural nodes
/// whose own evaluation has no effect beyond combining already-lowered
/// children -- purity of the whole recurses into those children below):
/// `IntegerLiteral`, `RealLiteral`, `TimeLiteral`,
/// `UnbasedUnsizedIntegerLiteral`, `NullLiteral`, `UnboundedLiteral`,
/// `StringLiteral`, `NamedValue`, `HierarchicalValue`, `BinaryOp`,
/// `ConditionalOp`, `Inside`, `Concatenation`, `Replication`,
/// `ElementSelect`, `RangeSelect`, `MemberAccess`, `Conversion`,
/// `DataType`, `TypeReference`, `LValueReference`,
/// `SimpleAssignmentPattern`, `StructuredAssignmentPattern`,
/// `ReplicatedAssignmentPattern`, `EmptyArgument`, `ValueRange`,
/// `MinTypMax`, `ClockingEvent`, `TaggedUnion`.
///
/// `UnaryOp` is pure except for pre/post increment-or-decrement.
///
/// Explicitly impure: `Call` (system or user -- either could itself contain
/// further side effects and this crate has no purity annotation to
/// distinguish them), `Assignment` (blocking/nonblocking), `NewArray`,
/// `NewClass`, `NewCovergroup`, `CopyClass` (object/covergroup construction
/// and copy-construction run constructor code -- the exact kinds this
/// review flagged a prior `_ => true` catch-all silently mis-classified as
/// pure).
///
/// Conservatively impure (this crate's P0 subset has no lowering for these
/// today and/or their purity is not obviously safe -- `Invalid`,
/// `Streaming`, `ArbitrarySymbol`, `Dist`, `AssertionInstance`): each is
/// listed explicitly below and returns `Ok(false)`.
///
/// Review-fix (r3): ARCHITECTURE.md SS7 item 9 is binding -- "every match on
/// .../`ExpressionKind`/... (in codegen and analysis) must end its wildcard
/// arm in a Barrier/hard-`LoweringError` default, never a silent no-op" --
/// so the trailing wildcard (forced by `ExpressionKind` being
/// `#[non_exhaustive]`, catching only a FUTURE vendored `sv-lang` kind bump)
/// is a hard `LoweringError`, matching this file's own `classify_conversion_
/// kind` precedent, NOT a silently-returned `false`. `false` was safe in the
/// sense that it only cost the CG-041 fast-path optimization, but SS7 item 9
/// bars a silent default on the letter, not just the correctness spirit --
/// a future kind-count bump must fail loudly here, not slip through
/// undiagnosed.
///
/// Task 28 (CG-157): the "Conservatively impure" arm below is this crate's
/// one real conservative/best-effort branch -- classifying `Invalid`/
/// `Streaming`/`ArbitrarySymbol`/`Dist`/`AssertionInstance` as impure is a
/// safe default (costs only the CG-041 fast path, never a correctness bug),
/// not a proven-correct classification, since this crate has no lowering
/// (and in most cases no purity reasoning at all) for any of them. `sink`
/// gets a `record_fallback` call there, naming the exact kind matched, so
/// an attached harness can observe every time this function took the
/// conservative branch instead of a fully-reasoned one.
pub fn is_side_effect_free(
    e: &sv_lang::Expression,
    fn_sym: &sv_lang::Symbol,
    sink: &dyn crate::coverage::CoverageSink,
) -> Result<bool, LoweringError> {
    let self_pure = match e.kind() {
        // --- Pure leaves and pure structural/composite nodes. ---
        ExpressionKind::IntegerLiteral
        | ExpressionKind::RealLiteral
        | ExpressionKind::TimeLiteral
        | ExpressionKind::UnbasedUnsizedIntegerLiteral
        | ExpressionKind::NullLiteral
        | ExpressionKind::UnboundedLiteral
        | ExpressionKind::StringLiteral
        | ExpressionKind::NamedValue
        | ExpressionKind::HierarchicalValue
        | ExpressionKind::BinaryOp
        | ExpressionKind::Inside
        | ExpressionKind::Concatenation
        | ExpressionKind::Replication
        | ExpressionKind::RangeSelect
        | ExpressionKind::Conversion
        | ExpressionKind::DataType
        | ExpressionKind::TypeReference
        | ExpressionKind::LValueReference
        | ExpressionKind::SimpleAssignmentPattern
        | ExpressionKind::StructuredAssignmentPattern
        | ExpressionKind::ReplicatedAssignmentPattern
        | ExpressionKind::EmptyArgument
        | ExpressionKind::ValueRange
        | ExpressionKind::MinTypMax
        | ExpressionKind::ClockingEvent
        | ExpressionKind::TaggedUnion => true,

        // --- Conditionally pure. ---
        // `v.M` of a tagged union checks `v`'s tag at run time and reports
        // an error (11.9); an `e matches p ? a : b` binds its pattern's
        // variables (12.6.3).
        // `h.m` on a class handle reports a null-handle error when `h` is
        // null (8.4), which an unselected ?: arm must never do (11.4.11).
        ExpressionKind::MemberAccess => !e
            .operand()
            .and_then(|b| b.expr_type())
            .is_some_and(|t| t.is_tagged_union() || t.is_class()),
        // `a[k]` of an associative array warns when `k` is nonexistent or
        // invalid (7.8.6), which an unselected ?: arm must never do.
        ExpressionKind::ElementSelect => !e
            .select_value()
            .and_then(|b| b.expr_type())
            .is_some_and(|t| t.is_associative_array()),
        ExpressionKind::ConditionalOp => !e.conditions().iter().any(|c| c.pattern().is_some()),
        ExpressionKind::UnaryOp => !matches!(
            e.unary_op(),
            Some(
                UnaryOp::Preincrement
                    | UnaryOp::Predecrement
                    | UnaryOp::Postincrement
                    | UnaryOp::Postdecrement
            )
        ),

        // --- Explicitly, unconditionally impure. ---
        ExpressionKind::Call
        | ExpressionKind::Assignment
        | ExpressionKind::NewArray
        | ExpressionKind::NewClass
        | ExpressionKind::NewCovergroup
        | ExpressionKind::CopyClass => false,

        // --- Conservatively impure: not obviously safe, and/or outside
        // this crate's currently-supported subset. ---
        ExpressionKind::Invalid
        | ExpressionKind::Streaming
        | ExpressionKind::ArbitrarySymbol
        | ExpressionKind::Dist
        | ExpressionKind::AssertionInstance => {
            // CG-157: this is the conservative/best-effort branch itself --
            // report it before returning the safe-default `false`.
            sink.record_fallback(
                crate::coverage::construct_id_for_expression_kind(e.kind()),
                crate::coverage::loc_for_expr(e),
            );
            false
        }

        // `ExpressionKind` is `#[non_exhaustive]`: a future vendored
        // `sv-lang` bump that adds a variant this match has never seen must
        // NOT silently fall through as either pure or (the pre-r3 shape)
        // a plain `false` -- ARCHITECTURE.md SS7 item 9 requires a hard,
        // diagnosable error so the gap is caught at run time, not silently
        // mis-optimized.
        _ => {
            return Err(LoweringError::unsupported_at(
                &format!(
                    "is_side_effect_free: unrecognized ExpressionKind {:?} \
                     (sv-lang's ExpressionKind::COUNT likely grew past this \
                     match -- ARCHITECTURE.md SS7 item 9: no silent \
                     no-op default)",
                    e.kind()
                ),
                fn_sym,
            ));
        }
    };
    if !self_pure {
        return Ok(false);
    }
    for c in e.children().iter() {
        if let Some(ce) = c.as_expression()
            && !is_side_effect_free(&ce, fn_sym, sink)?
        {
            return Ok(false);
        }
    }
    Ok(true)
}

// Task 10 (CG-039, CG-040, CG-041, CG-008): ternary `?:` (`ExpressionKind::
// ConditionalOp`) -- formula per docs/design/codegen.md §2 / the plan:
//
// - The condition is always evaluated exactly once, regardless of the arms'
//   purity.
// - CG-041 fast path: when BOTH arms are `is_side_effect_free` (CG-040),
//   eagerly lower both (safe -- neither has an effect to duplicate) and
//   combine entirely via `OpBuilder::select` (the whole packed val+unk
//   value in one LLVM `select` instruction, see its own doc comment) --
//   NO new basic blocks, so a pure-armed ternary costs nothing beyond one
//   extra `select` over the general shape below. The ambiguous-condition
//   merge (CG-008, `ternary_merge4`) is still computed unconditionally here
//   (cheap, branch-free) and selected in only when neither `cond_true` nor
//   `cond_false` holds.
// - General path (CG-039): a determinate condition evaluates ONLY the
//   chosen arm -- genuine `br`+`phi` control flow across three blocks
//   (then-only / else-only / both-arms-evaluated-and-merged), so the
//   unchosen arm's side effects never execute for a determinate condition,
//   fixing the "evaluates both arms" bug. An ambiguous condition takes the
//   third block, which evaluates BOTH arms (their side effects both occur,
//   intentionally -- `ternary_ambiguous_condition_evaluates_both_arms`,
//   tests/ternary.rs, proves this is spec-correct per CG-008's own merge
//   semantics, not a regression) and merges via `ternary_merge4`.
/// [`lower_ternary`] with a real or string result.
fn lower_nonintegral_ternary<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    cond_true: IntValue<'ctx>,
    cond_false: IntValue<'ctx>,
    then_expr: sv_lang::Expression<'d>,
    else_expr: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    // An arm as a real (`f64`) or a string id (`i64`).
    let arm = |e: sv_lang::Expression<'d>| -> Result<inkwell::values::BasicValueEnum<'ctx>, LoweringError> {
        match lower_expr(cx, e)? {
            LoweredValue::Real(r) => Ok(crate::real::as_f64(cx, r.llvm).into()),
            LoweredValue::Str(st) => Ok(st.llvm.into()),
            _ => Err(LoweringError::unsupported_at(
                "a conditional operator arm of a real or string result is neither",
                &cx.fn_sym,
            )),
        }
    };
    let f = cx
        .b
        .get_insert_block()
        .and_then(|bb| bb.get_parent())
        .ok_or_else(|| LoweringError::unsupported_at("ternary outside a function", &cx.fn_sym))?;
    // Each arm is lowered exactly once (a chain of nested conditionals in an arm would
    // otherwise double per level): `then_block` runs unless the condition is definitely
    // false, `else_block` unless it is definitely true, and an ambiguous condition falls
    // from the first into the second so both arms run.
    let then_block = cx.ctx.append_basic_block(f, "tern_then");
    let else_block = cx.ctx.append_basic_block(f, "tern_else");
    let merge_block = cx.ctx.append_basic_block(f, "tern_merge");
    let entry_pred = cx.b.get_insert_block().expect("positioned");
    cx.b.build_conditional_branch(cond_false, else_block, then_block)
        .unwrap();

    cx.b.position_at_end(then_block);
    let then_v = arm(then_expr)?;
    let then_pred = cx.b.get_insert_block().expect("positioned");
    cx.b.build_conditional_branch(cond_true, merge_block, else_block)
        .unwrap();

    cx.b.position_at_end(else_block);
    let then_seen = cx.b.build_phi(then_v.get_type(), "tern_then_seen").unwrap();
    let zero: inkwell::values::BasicValueEnum<'ctx> = if then_v.is_float_value() {
        cx.ctx.f64_type().const_zero().into()
    } else {
        then_v.get_type().into_int_type().const_zero().into()
    };
    then_seen.add_incoming(&[(&zero, entry_pred), (&then_v, then_pred)]);
    let a = then_seen.as_basic_value();
    let b = arm(else_expr)?;
    let is_real = a.is_float_value();
    if is_real != b.is_float_value() {
        return Err(LoweringError::unsupported_at(
            "conditional operator arms of different types",
            &cx.fn_sym,
        ));
    }
    let merged: inkwell::values::BasicValueEnum<'ctx> = if is_real {
        let (a, b) = (a.into_float_value(), b.into_float_value());
        let same =
            cx.b.build_float_compare(inkwell::FloatPredicate::OEQ, a, b, "tern_same")
                .unwrap();
        cx.b.build_select(same, a, cx.ctx.f64_type().const_zero(), "tern_real")
            .unwrap()
    } else {
        let (a, b) = (a.into_int_value(), b.into_int_value());
        let same =
            cx.b.build_int_compare(inkwell::IntPredicate::EQ, a, b, "tern_same")
                .unwrap();
        let empty = crate::strings::literal(cx, b"").llvm;
        cx.b.build_select(same, a, empty, "tern_str").unwrap()
    };
    let else_val =
        cx.b.build_select(cond_false, b, merged, "tern_else_val")
            .unwrap();
    let else_pred = cx.b.get_insert_block().expect("positioned");
    cx.b.build_unconditional_branch(merge_block).unwrap();

    cx.b.position_at_end(merge_block);
    let phi = cx.b.build_phi(then_v.get_type(), "tern_result").unwrap();
    phi.add_incoming(&[(&then_v, then_pred), (&else_val, else_pred)]);
    let v = phi.as_basic_value();
    Ok(if is_real {
        LoweredValue::Real(RealValue {
            llvm: v.into_float_value(),
        })
    } else {
        LoweredValue::Str(crate::strings::StrValue {
            llvm: v.into_int_value(),
        })
    })
}

fn lower_ternary<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let conds = e.conditions();
    if conds.len() != 1 || conds[0].pattern().is_some() {
        return crate::tagged::lower_pattern_ternary(cx, e);
    }
    let cond_expr = conds[0].expr();
    let then_expr = e.true_value().ok_or_else(|| {
        LoweringError::unsupported_at("ternary missing true-value arm", &cx.fn_sym)
    })?;
    let else_expr = e.false_value().ok_or_else(|| {
        LoweringError::unsupported_at("ternary missing false-value arm", &cx.fn_sym)
    })?;

    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let cond_pv = crate::huge::truth_packed(
        cx,
        lower_expr_h(cx, cond_expr)?,
        crate::huge::TruthMode::Ternary,
        "ternary condition must be an integral (non-real) value",
    )?;
    // Task 10 review-fix (r3): the ternary's own condition-truth primitive,
    // NOT `is_definitely_true` (that one is CG-007's stricter if/while/&&/||
    // rule -- requires the WHOLE condition known -- which spuriously routed
    // a condition like `4'b1xxx` (a known-1 bit plus unrelated X bits) onto
    // the ambiguous `ternary_merge4` path instead of cleanly selecting the
    // then-arm; see `ternary_is_definitely_true`'s doc comment).
    let cond_true = ternary_is_definitely_true(cx.ctx, &cx.b, cond_pv);
    let cond_false = is_definitely_false(cx.ctx, &cx.b, cond_pv);

    // A real or string result (LRM 1800-2023 §11.4.11): the chosen arm; for
    // an ambiguous condition both arms, their value if they are equal, else
    // the type's default (Table 7-1: 0.0, "").
    if e.expr_type()
        .is_some_and(|t| t.is_floating() || t.is_string())
    {
        return lower_nonintegral_ternary(cx, cond_true, cond_false, then_expr, else_expr);
    }

    // CG-159 scope note: no `sv-sim-harness` crate exists anywhere in this
    // workspace yet to attach a real `CoverageSink` to (see
    // `coverage.rs`'s module doc comment), and `LowerCtx` carries no sink
    // field of its own -- threading one through every `LowerCtx`
    // construction site across this crate is a wider change than this
    // task's scope, so the production lowering pipeline uses
    // `NoopCoverageSink` here. The real call-site wiring this task
    // delivers (CG-157) is exercised directly against
    // `is_side_effect_free`, not through this production path -- see
    // `tests/coverage_sink.rs::record_fallback_called_on_every_
    // conservative_path`.
    if is_side_effect_free(&then_expr, &cx.fn_sym, &crate::coverage::NoopCoverageSink)?
        && is_side_effect_free(&else_expr, &cx.fn_sym, &crate::coverage::NoopCoverageSink)?
    {
        let then_pv = lower_expr(cx, then_expr)?.into_packed(
            "ternary then-arm must be an integral (non-real) value",
            &cx.fn_sym,
        )?;
        let else_pv = lower_expr(cx, else_expr)?.into_packed(
            "ternary else-arm must be an integral (non-real) value",
            &cx.fn_sym,
        )?;
        if then_pv.width != else_pv.width {
            return Err(LoweringError::unsupported_at(
                "ternary then/else arms have mismatched widths (expected \
                 slang's own inserted Conversion nodes to have already \
                 equalized them)",
                &cx.fn_sym,
            ));
        }
        let merged = op.ternary_merge4(then_pv, else_pv);
        let inner = op.select(cond_false, else_pv, merged);
        let result = op.select(cond_true, then_pv, inner);
        return Ok(LoweredValue::Packed(result));
    }

    let entry_block = cx.b.get_insert_block().ok_or_else(|| {
        LoweringError::unsupported_at("ternary lowered outside a basic block", &cx.fn_sym)
    })?;
    let f = entry_block.get_parent().ok_or_else(|| {
        LoweringError::unsupported_at("ternary block has no parent function", &cx.fn_sym)
    })?;

    // Each arm is lowered exactly once (nested conditionals in an arm would otherwise
    // double the emitted code per level, CG-039): `then_block` runs unless the condition
    // is definitely false, `else_block` unless it is definitely true; an ambiguous
    // condition falls from the first into the second so both arms run and merge (CG-008).
    let then_block = cx.ctx.append_basic_block(f, "tern_then");
    let else_block = cx.ctx.append_basic_block(f, "tern_else");
    let merge_block = cx.ctx.append_basic_block(f, "tern_merge");
    cx.b.build_conditional_branch(cond_false, else_block, then_block)
        .unwrap();

    cx.b.position_at_end(then_block);
    let then_pv = lower_expr(cx, then_expr)?.into_packed(
        "ternary then-arm must be an integral (non-real) value",
        &cx.fn_sym,
    )?;
    let then_pred = cx.b.get_insert_block().ok_or_else(|| {
        LoweringError::unsupported_at("ternary then-arm left no open basic block", &cx.fn_sym)
    })?;
    cx.b.build_conditional_branch(cond_true, merge_block, else_block)
        .unwrap();

    cx.b.position_at_end(else_block);
    let seen =
        cx.b.build_phi(then_pv.llvm.get_type(), "tern_then_seen")
            .unwrap();
    let zero = then_pv.llvm.get_type().const_zero();
    seen.add_incoming(&[(&zero, entry_block), (&then_pv.llvm, then_pred)]);
    let seen_pv = PackedValue {
        llvm: seen.as_basic_value().into_int_value(),
        ..then_pv
    };
    let else_pv = lower_expr(cx, else_expr)?.into_packed(
        "ternary else-arm must be an integral (non-real) value",
        &cx.fn_sym,
    )?;
    if then_pv.width != else_pv.width {
        return Err(LoweringError::unsupported_at(
            "ternary then/else arms have mismatched widths (expected \
             slang's own inserted Conversion nodes to have already \
             equalized them)",
            &cx.fn_sym,
        ));
    }
    let merged_pv = op.ternary_merge4(seen_pv, else_pv);
    let else_val = op.select(cond_false, else_pv, merged_pv);
    let else_pred = cx.b.get_insert_block().ok_or_else(|| {
        LoweringError::unsupported_at("ternary else-arm left no open basic block", &cx.fn_sym)
    })?;
    cx.b.build_unconditional_branch(merge_block).unwrap();

    cx.b.position_at_end(merge_block);
    let phi =
        cx.b.build_phi(then_pv.llvm.get_type(), "tern_result")
            .unwrap();
    phi.add_incoming(&[(&then_pv.llvm, then_pred), (&else_val.llvm, else_pred)]);
    Ok(LoweredValue::Packed(PackedValue {
        llvm: phi.as_basic_value().into_int_value(),
        width: then_pv.width,
        repr: cx.repr,
        signed: then_pv.signed,
    }))
}

/// An `alloca` in the current function's entry block: a call inside an SV
/// loop is a back-edge within one activation, so a call-site `alloca` would
/// grow the stack on every iteration.
pub(crate) fn entry_alloca<'ctx, T: inkwell::types::BasicType<'ctx>>(
    cx: &crate::expr::LowerCtx<'ctx, '_, '_>,
    ty: T,
    name: &str,
) -> PointerValue<'ctx> {
    crate::types::entry_alloca_in(&cx.b, ty, name)
}

/// Whether `e` is a replication with a constant count of zero (`{0{x}}`),
/// which as a concatenation operand contributes no bits (LRM 1800-2023
/// §11.4.12.1).
pub(crate) fn is_zero_replication(e: &sv_lang::Expression<'_>) -> bool {
    e.kind() == ExpressionKind::Replication
        && e.replication_count()
            .and_then(|c| c.constant_value())
            .is_some_and(|v| v.as_integer().and_then(|i| i.as_u64()) == Some(0))
}

/// `lhs = value` where `lhs` selects into PART of a queue or dynamic-array
/// element (`d[i][j]`, `q[i].f`, `d[i][3]`; `elem` is the `c[i]` it bottoms
/// out at): the element is read into a shadow temporary, `lhs` is written
/// into that through the ordinary lvalue path ([`LowerCtx::coll_temp`]), and
/// the temporary is stored back with `c[i] = temp`, so an out-of-range `i`
/// stays a no-op (LRM 7.5.6, 7.10.2). A collection element holds no handle,
/// so there is nothing for a releasing store to release.
fn store_partial_element<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    lhs: sv_lang::Expression<'d>,
    elem: sv_lang::Expression<'d>,
    value: LoweredValue<'ctx>,
    _release: Option<&mut dyn FnMut(PackedValue<'ctx>)>,
) -> Result<LoweredValue<'ctx>, LoweringError> {
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let cur = crate::collections::read_element(cx, elem)
        .ok_or_else(|| LoweringError::unsupported_at("a non-collection element", &cx.fn_sym))??
        .into_packed("a collection element written in part", &cx.fn_sym)?;
    let ptr = entry_alloca(cx, op.packed_type(cur.width, cx.repr), "coll_part");
    cx.b.build_store(ptr, cur.llvm).unwrap();
    let width = lhs
        .expr_type()
        .map(|t| t.value_width())
        .filter(|w| *w > 0)
        .ok_or_else(|| {
            LoweringError::unsupported_at("assignment target has no width", &cx.fn_sym)
        })?;
    let bits = crate::real::to_storage(cx, value, width, "assignment of a >128-bit value")?;
    let saved = cx.coll_temp.replace(Some(ptr));
    let r = crate::select::lower_assign_to(cx, lhs, bits);
    cx.coll_temp.set(saved);
    r?;
    let new = PackedValue {
        llvm: cx
            .b
            .build_load(op.packed_type(cur.width, cx.repr), ptr, "coll_part_new")
            .unwrap()
            .into_int_value(),
        ..cur
    };
    let store = || {
        crate::collections::write_element(cx, elem, LoweredValue::Packed(new)).unwrap_or_else(
            || {
                Err(LoweringError::unsupported_at(
                    "a non-collection element",
                    &cx.fn_sym,
                ))
            },
        )
    };
    // An associative array's store would create the key even when the select
    // chain was out of range (and so wrote nothing into the temporary).
    let assoc = elem
        .select_value()
        .and_then(|b| crate::collections::coll_of_expr(&b))
        .is_some_and(|c| c.assoc);
    if assoc {
        let ok = crate::collections::chain_in_range(cx, lhs, elem)?;
        crate::collections::guarded_by(cx, ok, store)?;
    } else {
        store()?;
    }
    Ok(value)
}

#[cfg(test)]
mod tests {
    use super::*;

    /// `mem_row_index_i64` widens an SV index to `i64` following the index
    /// expression's OWN signedness: an unsigned 8-bit `0xC8` is 200, a
    /// signed one is -56 (out of range for a `[0:255]` memory -- iverilog
    /// reads X for exactly that). `mem_row_index` then subtracts the
    /// declared lower bound, so negative ranges (`[-2:1]`) work too. Uses an
    /// index with its top bit set, where the two extensions differ, so a
    /// mutant swapping either one is caught. (Earlier this test asserted
    /// zero-extension regardless of signedness -- correct only while the
    /// raw index WAS the storage row.)
    #[test]
    fn mem_row_index_i64_extends_a_narrow_index_by_its_own_signedness() {
        let design = crate::frontend::compile_source("module m; endmodule\n").unwrap();
        let body = design
            .top_instances()
            .next()
            .unwrap()
            .instance_body()
            .unwrap();

        let llvm_ctx = Context::create();
        let module = llvm_ctx.create_module("test_mem_row_index_i64");
        let i8_ty = llvm_ctx.i8_type();
        let i64_ty = llvm_ctx.i64_type();
        let fn_ty = i64_ty.fn_type(&[i8_ty.into()], false);
        let f = module.add_function("test_fn", fn_ty, None);
        let entry = llvm_ctx.append_basic_block(f, "entry");
        let b = llvm_ctx.create_builder();
        b.position_at_end(entry);
        let param = f.get_nth_param(0).unwrap().into_int_value();

        let cx = LowerCtx {
            ctx: &llvm_ctx,
            b,
            repr: ValueRepr::FourState,
            locals: HashMap::new(),
            fn_sym: body,
            module: &module,
            mem_signals: HashMap::new(),
            mem_accessor: None,
            lvalue_ref: Default::default(),
            unbounded: Default::default(),
            coll_temp: Default::default(),
            iter: Default::default(),
            loop_exits: Default::default(),
            write_through: None,
            cells: Default::default(),
            copy_out: Default::default(),
            ctor_this: Default::default(),
            decl_scale: Default::default(),
            inline_this: Default::default(),
            end_flags: Default::default(),
            specify_dest: Default::default(),
            elem_refs: Default::default(),
            block_exits: Default::default(),
            deferred_start: Default::default(),
        };
        let op = OpBuilder {
            ctx: cx.ctx,
            b: &cx.b,
        };

        // `param` is a genuine (non-constant) SSA value, so the builder
        // cannot constant-fold the extend away -- a real `zext`/`sext`
        // instruction is guaranteed to appear in the emitted IR either way.
        let idx = PackedValue {
            llvm: param,
            width: 8,
            repr: ValueRepr::TwoState,
            signed: false,
        };
        let row_index = mem_row_index_i64(&op, &cx, idx);
        cx.b.build_return(Some(&row_index)).unwrap();

        // The same index, typed signed.
        let fs = module.add_function("test_fn_signed", fn_ty, None);
        let entry_s = llvm_ctx.append_basic_block(fs, "entry");
        cx.b.position_at_end(entry_s);
        let idx_s = PackedValue {
            llvm: fs.get_nth_param(0).unwrap().into_int_value(),
            width: 8,
            repr: ValueRepr::TwoState,
            signed: true,
        };
        let row_index_s = mem_row_index_i64(&op, &cx, idx_s);
        cx.b.build_return(Some(&row_index_s)).unwrap();

        assert!(
            f.verify(true) && fs.verify(true),
            "the emitted IR must pass LLVM's own verifier"
        );

        let jit = crate::jit::Jit::from_module(module).expect("JIT engine construction failed");
        let raw = jit
            .get_raw("test_fn")
            .expect("test_fn must be a real symbol in the JIT'd module");
        // SAFETY: `test_fn` was declared and defined above as a genuine
        // `extern "C" fn(i8) -> i64` inside this same JIT'd module, and
        // `f.verify(true)` already confirmed the emitted IR is well-formed
        // before this call.
        let callable: extern "C" fn(i8) -> i64 =
            unsafe { std::mem::transmute::<*const (), extern "C" fn(i8) -> i64>(raw) };

        // 0xC8 == 200u8 == -56i8.
        let result = callable(-56i8);
        assert_eq!(
            result, 200,
            "an UNSIGNED 8-bit index 0xC8 must zero-extend to 200"
        );

        let raw_s = jit
            .get_raw("test_fn_signed")
            .expect("test_fn_signed must be a real symbol in the JIT'd module");
        // SAFETY: same as `callable` above -- `test_fn_signed` has the
        // identical `extern "C" fn(i8) -> i64` signature and verified.
        let callable_s: extern "C" fn(i8) -> i64 =
            unsafe { std::mem::transmute::<*const (), extern "C" fn(i8) -> i64>(raw_s) };
        assert_eq!(
            callable_s(-56i8),
            -56,
            "a SIGNED 8-bit index 0xC8 is -56 and must sign-extend"
        );
    }
}