vj-codegen 0.1.0

//! T9/T10 (`docs/superpowers/plans/2026-10-03-sva.md`): the automaton builder
//! -- `fn build_automaton`, consuming T3's [`super::ranges`], T4's
//! [`sv_sim_sim::sva::ir`], and T5's leaf shape (a Boolean leaf is identified
//! here and compiled later, by [`super::leaf::compile_leaf`], never
//! re-implemented). LRM 16.7 (Simple sequences, `##` concatenation), 16.9.1
//! (operator precedence/evaluation), 16.9.2 (`boolean_abbrev` repetition) and,
//! from T10, 16.9.2.1 (repetition, concatenation and EMPTY matches).
//!
//! ## Empty matches (T10, LRM 16.9.2.1)
//!
//! A sequence can match over an interval of length 0 (`a[*0]`, the zero
//! branch of `a[*0:2]`). Such an empty match is not a path through the
//! automaton -- every path spends at least the tick it starts on -- so a
//! [`Fragment`] carries it separately: `exits` are the ends of its NONEMPTY
//! matches, `empty` says whether it ALSO admits the empty match, and
//! [`build_automaton`] copies the top-level flag onto
//! [`ir::Automaton::admits_empty`]. [`concat`] is the one place the
//! 16.9.2.1 rules live, implemented over that representation:
//!
//! 1. `empty ##0 seq` and
//! 2. `seq ##0 empty` do not match (a `##0` fusion needs a tick on both
//!    sides, and an empty match has none);
//! 3. `empty ##n seq` (n > 0) is `##(n-1) seq`;
//! 4. `seq ##n empty` (n > 0) is `seq ##(n-1) 1` (`1` is the LRM's
//!    `` `true ``);
//!
//! and, because a delay RANGE or a sequence admitting both kinds of match is
//! the union of its members, each rule applies per member: the LRM's own
//! recipe ("rewrite the sequence as the union of an empty sequence and a
//! nonempty sequence") is what `concat` does -- `(ne ∪ ε) ##d (ne' ∪ ε)` is
//! the union of the four pairings, each wired by its own rule. When BOTH
//! operands are empty the 16.9.2.1 prose does not spell out the result;
//! the rules above, applied repeatedly, give Annex F.5.2's plain word
//! concatenation: `##0` no match, `##1` the empty match, `##n` (n >= 2)
//! `1[*n-1]`. A repetition whose unit itself admits the empty match,
//! `(u)[*m:n]`, is `ne(u)[*0:n]` by the same algebra (each repeat may
//! vanish).
//!
//! A leading delay (`##2 b`, `##[1:3] a ##1 b`) is `1[*m:n] ##1 seq`, i.e.
//! `empty ##[m+1:n+1] seq` (16.9.2.1 rule 3 read right to left; F.3.4.2.2).
//! A plain `( ... )` around a sequence is transparent (see
//! [`ranges::peel_sequence_parens`]).
//!
//! ## Sequence operators (T11, LRM 16.9.5-16.9.10)
//!
//! `and` / `intersect` ([`build_product`]) are a LOCKSTEP PRODUCT of the two
//! operand NFAs, both started on the same tick. A component is a real state,
//! a `Wait` (a `Delay{min,max}` edge it has taken but whose delay has not
//! elapsed) or `Done` (an `and` operand that already matched and now waits
//! for the other). One tick passes only when no side still has a same-tick
//! move and at least one side is a `Wait`. `intersect` ends when both sides
//! end on the same tick; `and` when both have ended (the later end is the
//! match end, 16.9.5). The empty match is a flag on the product: it is
//! admitted when both operands admit it; an `and` whose one operand is empty
//! starts that side already `Done`. `or` ([`build_or`]) is a fresh entry with
//! an epsilon to each operand; `throughout` is `(cond)[*0:$] intersect seq`
//! and `within` is `(1[*0:$] ##1 seq1 ##1 1[*0:$]) intersect seq2`, exactly
//! the LRM's stated rewrites (16.9.9, 16.9.10).
//!
//! The product is built by BFS from the start, so state numbering is
//! deterministic (the `HashMap` is a lookup table only, never iterated), and
//! is capped at [`MAX_PRODUCT_STATES`] with a loud error that names the
//! operator, because the construction is the cross product of its operands.
//! [`trim_dead_product_states`] then cuts edges into states that reach
//! neither an exit nor a `FirstMatchEnd` edge, which keeps nested products
//! (the within-in-within shape) tractable; it KEEPS `FirstMatchEnd` edges
//! even into a dead state, because the earliest end tick of a `first_match`
//! region is recorded whether or not the other operand agrees with it.
//!
//! `first_match(R)` ([`build_first_match`]) wraps R in a
//! `FirstMatchBegin`/`FirstMatchEnd` pair on a fresh group
//! ([`ir::Automaton::first_match_groups`]). The engine contract is a
//! per-attempt table keyed (group, begin tick) holding the earliest end
//! tick: `Begin` stamps the thread, `End` records the tick when absent,
//! takes the edge when equal, and kills the thread when an earlier tick is
//! already recorded. The contract is documented on the IR variants and
//! implemented, for tests, by `sv_sim_sim::sva::trace`. An empty R makes
//! `first_match(R)` the empty match (F.5.2: the earliest match is the empty
//! one). A match-item list on `first_match` (T14) is attached to R INSIDE the
//! `FirstMatchBegin`/`FirstMatchEnd` bracket (`first_match(R, items)` is
//! `first_match((R, items))`, 16.9.8), so a subroutine call fires at every end
//! point of R (16.11) even when `first_match` then discards that match.
//!
//! `prune_unreachable` now runs at the end of every build (BFS renumbering
//! from the start state), so T9/T10 state numbers differ from before; the
//! recognised language does not.
//!
//! ## Named sequence instances (T12, LRM 16.8/16.8.1)
//!
//! A use of a named sequence is an `AssertionInstance` expression operand
//! ([`build_instance`]): its body is expanded in place, once per use (a
//! repeated instance is a fresh copy per repeat, so the automaton is exactly
//! the one the sequence's body written inline would give). slang substitutes a
//! formal that stands for a Boolean or a sequence by the ACTUAL's own
//! expression, so leaves and nested instances need no rewriting here. What it
//! cannot hand over is a formal used as a `##`/`[...]` bound: that is folded
//! by [`ranges`] from syntax, so each instance pushes a
//! [`ranges::FormalFrame`] binding its formals to their actuals (folded in the
//! CALLER's frame first; a typed integral formal casts the value to its type,
//! 16.8.1; `$` is legal only for an untyped formal used as an upper bound).
//!
//! A clocking event inside an instance (`sequence rule; @(posedge c) ...`) is
//! one clock of the assertion ([`LeafTable::intern_clock`]); the root clock the
//! caller stripped is passed to [`build_automaton`] as `root_clock` and is
//! [`ClockId`] 0. Property instances are `build_property`'s (a loud error
//! here) and cyclic instantiation (16.8, by name) is a loud error; the cycle check is the one
//! `named::check_named_sequence_cycles` delegates to slang for, plus the
//! builder's own check on LRM 16.8's declaration graph (below).
//!
//! ## Multiclocked sequences (T28, LRM 16.13.1)
//!
//! Every clocking event the builder meets is interned by structural equality
//! ([`events_equivalent`]), so `@(posedge clk)` written twice is ONE clock and
//! `@(posedge clk1)` / `@(posedge clk2)` are two even if the signals happen to
//! carry equal values (16.16.1: "identical", not "equal"). [`LeafTable::cur`] is
//! the clock a node is built on (the context clock, which a `Clocking` node sets
//! for its body), and each [`Fragment`] carries the [`Span`] of clocks it covers
//! when it contains a clocking event of its own (`None`: it takes the context's,
//! like a Boolean). [`concat_clocked`] joins two fragments: the same clock is the
//! ordinary single-clock concatenation, and a different one is a
//! [`Transition::ClockSync`] edge from every end point of the left operand to the
//! entry of the right (`##1`: first tick of the right clock strictly after, `##0`:
//! at or after). 16.13.1 allows nothing else between differently clocked
//! operands: only `##1`/`##0`, and both maximal singly clocked subsequences must
//! be nonempty. The sequence operators ([`join_clocks`]) and repetition need a
//! singly clocked operand and a clock they all share.
//!
//! ## Local variables (T13, LRM 16.8.2, 16.10, Annex F.5.4)
//!
//! Every local variable (a sequence's declared local, a `local` formal) gets a
//! CANONICAL slot ([`ir::LocalVarId`]) minted when its named sequence instance
//! is expanded, so a repeated instance never shares variables with another
//! copy. A thread's frame is indexed by slot. An instance's initialisation
//! assignments are ONE build-time-ordered action list prefixed to the body's
//! entry: the `input`/`inout` formals first (the actual cast to the formal's
//! type), then the declared initialisers in declaration order, so an
//! initialiser may read a formal (16.8.2). An `output`/`inout` formal is
//! written back to the caller's variable by a [`Transition::LocalVarCopy`]
//! after the body's exits.
//!
//! Legality is the F.5.4 flow algebra ([`flow`]): every fragment carries a
//! `Flow` triple, [`LeafTable::flow_in`] is the set of variables definitely
//! assigned where the node being built starts, and [`LeafTable::push_leaf`]
//! rejects a read of a variable outside it with a "does not flow out" error.
//! `and`/`intersect`/`throughout`/`within` run their operands as parallel
//! threads that each own a copy of the variables (rule (d)): the second operand
//! reads and writes lazily-created shadow slots ([`ShadowCtx`]), initialised by
//! a prefix `LocalVarCopy` and copied back, after the product, for the
//! variables only that operand assigns. Sequence match items (T14, 16.11) are
//! all lowered here: `v = e`, `v op= e`, `v++`/`--v` (a [`ir::Transition::LocalVarStep`]
//! edge) and subroutine calls ([`super::actions`], a [`ir::Transition::SubroutineCall`]
//! edge), in list order, with the nondegeneracy check in `attach_match_items`.
//!
//! Slots hold two-state `i64` values cast through the variable's declared
//! width and signedness ([`ir::LocalVarDecl`]); a leaf that reads a variable
//! records it in [`LeafTable::locals_of`] for the runtime engine (T29), which
//! also has to apply that cast. [`sv_sim_sim::sva::trace::attempt_with_locals`]
//! is the executable specification of the frame semantics.
//!
//! The builder's check walks a dependency chain ([`LeafTable::chain`]), not
//! the expansion stack: an edge X -> Y is "X's declaration instantiates Y" or
//! "an instance of X instantiates Y within an actual argument". slang
//! substitutes the actual for a formal reference, so the actual's instance is
//! met while the callee's body is being expanded; it is expanded under the
//! chain of its CALL SITE plus the instantiated declaration
//! ([`ranges::FormalFrame::origins`]; a forwarded formal keeps the chain of the
//! actual it forwards). `outer(inner(a))` with `outer(w): inner(w) ##1 c` is
//! legal (`outer -> inner`); `s(s(a))` and `s(wrap(a))` with `wrap(w): s(w)`
//! are cycles.
//!
//! ## Deviation from the plan's literal file location
//!
//! Plan §3's T9 text puts this builder at `crates/sv-sim-sim/src/sva/
//! build.rs`. That is not buildable as written: `sv-sim-sim` cannot depend
//! on `sv-sim-codegen` (`sv-sim-codegen`'s own `Cargo.toml` already depends
//! on `sv-sim-sim`, and `sv-sim-sim`'s `Cargo.toml` depends on neither
//! `sv-sim-codegen` nor `inkwell` -- a reverse dependency would be a cycle),
//! yet T9's own "Files" line also says this builder "consum[es] T3's
//! ranges... T5's leaves", both of which live in `sv-sim-codegen` (T3/T5's
//! own, already-committed module-doc text explains why *they* live there:
//! `ranges` casts to `sv-lang` *syntax* node types no `AnalyzedAssertion`
//! accessor exposes, and `leaf::compile_leaf` calls `process_lower::
//! compile_iff_guard`, an `inkwell`-dependent LLVM emitter `sv-sim-sim` has
//! no access to at all). The only way to satisfy "lives in `sv-sim-sim`" AND
//! "consumes `ranges`/`leaf`" simultaneously would be duplicating T3's
//! syntax-casting folder a second time in `sv-sim-sim` -- a real, divergent
//! second implementation of the exact thing this project's own
//! "duplicate pure-function eval diverges" lesson warns against, for no
//! benefit. This module instead lives beside `ranges`/`op`/`leaf` in
//! `sv-sim-codegen::sva` (which already legitimately depends on both
//! `sv-lang` and `sv-sim-sim`), and produces a [`sv_sim_sim::sva::ir::
//! Automaton`] -- the pure, elaboration-independent IR type `ir.rs` itself
//! says must stay `sv-lang`-free -- as its one piece of state that crosses
//! back into `sv-sim-sim`'s own ownership. The companion [`LeafTable`]
//! (mapping each [`LeafId`] back to the `Expression` a later wiring task
//! compiles via [`super::leaf::compile_leaf`]) is this module's own sibling
//! output, deliberately kept OUT of `ir::Automaton` for the same reason.
#![allow(dead_code)]

use std::collections::{BTreeSet, HashMap, HashSet};

use sv_lang::kinds::{AssertionExprKind, ExpressionKind, SymbolKind};
use sv_lang::nodes::{
    IdentifierNameSyntax, ParenthesizedSequenceExprSyntax, SequenceRepetitionSyntax,
    SimpleSequenceExprSyntax,
};
use sv_lang::{
    ArgumentDirection, AssertionExpr, AstNode, Expression, KnownSystemName, Node, SemNode, Symbol,
    UnaryOp,
};

use sv_sim_sim::sva::ir::{self, ClockId, LeafId, LocalVarId, ThreadStateId, Transition};

use super::actions::{self, CallSite};
use super::flow::{Flow, VarSet};
use super::op::{AssertionBinaryOp, Op};
use super::ranges::{self, SequenceRangeValue};
use super::trees::{Trees, key};
use crate::error::LoweringError;

pub mod property;

/// What a Boolean leaf (or a match item's / initializer's value expression)
/// needs from the local-variable frame (T13): which local variables its
/// expression reads and, for a match item's value, which slot an
/// `LValueReference` (the target of a compound assignment, `v += e`) stands for.
/// The slots are PHYSICAL ones (what a thread's frame is indexed by), already
/// resolved through `and`/`intersect` shadow copies (see [`ShadowCtx`]).
#[derive(Clone, Debug, Default, PartialEq, Eq)]
pub struct LeafLocals<'d> {
    /// Every distinct local variable symbol the expression names, in the order
    /// the expression tree reaches them, with the frame slot it reads.
    pub reads: Vec<(Symbol<'d>, LocalVarId)>,
    /// The slot an `LValueReference` node of the expression reads.
    pub lvalue: Option<LocalVarId>,
    /// T15: one slot per end-point application (`inst.triggered`/`inst.matched`)
    /// the expression holds inside a larger expression, in the PRE-ORDER of the
    /// calls in the expression tree (the order [`collect_end_points`] lists them
    /// in; an end-point call's own operand is not descended into). The engine
    /// stores the application's value (`1`/`0`) in the slot before the leaf is
    /// evaluated (a [`ir::Transition::EndPoint`] edge with a `flag`), and an
    /// evaluator reads it where the call stands. Empty for a leaf with none.
    pub end_flags: Vec<LocalVarId>,
}

/// Which 64-bit limb of a wide local variable (LRM 16.10) a value leaf stands
/// for. A variable of more than 64 bits occupies [`ir::LocalVarDecl::slots`]
/// frame slots (its value limbs, then its unknown-plane limbs, see
/// [`sv_sim_sim::sva::wide`]), and one assignment of it is one
/// [`Transition::LocalVarWrite`] per slot: each of those leaves is the SAME
/// expression, and says which word of the four-state value it yields.
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct LimbSel {
    /// The width of the variable the expression is fitted to.
    pub width: u32,
    /// The leaf is a word of the unknown plane (`x`/`z` bits) rather than of
    /// the value plane.
    pub unknown: bool,
    /// The word's index within its plane (bits `64 * index ..`).
    pub index: u32,
    /// The first leaf of the assignment's group of limb leaves. The group shares
    /// one right-hand side, which the code generator lowers ONCE into a
    /// per-group function writing every limb to a buffer (code size linear in
    /// the width); each limb leaf is a small wrapper reading its word.
    pub group: u32,
}

/// The widest local variable the builder mints (the huge-value limit the rest of
/// the simulator supports). An assignment of one is `2 * ceil(width / 64)` limb
/// leaves, but the right-hand side is lowered once ([`LimbSel::group`]).
pub const MAX_LOCAL_VAR_BITS: u32 = 1 << 20;

/// What the builder knows about one end-point application beyond what the IR
/// carries (see [`ir::EndPoint::site`]).
#[derive(Clone, Copy, Debug)]
pub struct EndSite<'d> {
    pub method: ir::EndMethod,
    /// The `AssertionInstance` expression the method is applied to.
    pub instance: Expression<'d>,
    /// The first clocking event met expanding the instance (its own `@(...)`), or
    /// `None` when it has none and so ends on the clock of the context that tests
    /// it. The engine runs the instance's automaton on this clock; for
    /// [`ir::EndMethod::Triggered`] the builder has already proven it equal to the
    /// context's when both are known.
    pub clock: Option<SemNode<'d>>,
}

/// One local variable in scope: a sequence's declared local or a `local`
/// formal, bound to the CANONICAL slot minted for this expansion.
#[derive(Clone, Copy, Debug)]
struct ScopeVar<'d> {
    sym: Symbol<'d>,
    slot: LocalVarId,
}

/// The shadow slots the second operand of an `and`/`intersect`/`throughout`/
/// `within` gets (LRM 16.10 rule (d): the operands are parallel threads, each
/// with its OWN copy of the variables, initialised from the value at the start
/// of the operator). The first operand keeps the shared slot; the second reads
/// and writes a shadow of every variable the first one touched, so neither
/// sees the other's assignments. `made` is in creation order.
#[derive(Debug)]
struct ShadowCtx {
    /// Canonical slots the first operand read or wrote.
    outer_touched: BTreeSet<LocalVarId>,
    /// `(canonical, the slot it resolved to outside this context, its shadow)`.
    made: Vec<(LocalVarId, LocalVarId, LocalVarId)>,
}

/// Maps each [`LeafId`] a built [`ir::Automaton`] references back to the
/// Boolean-leaf [`Expression`] it stands for. Kept outside `ir::Automaton`
/// itself (see this module's own doc comment) -- a later wiring task
/// compiles each entry via [`super::leaf::compile_leaf`] into the real
/// `PredicateFn` the engine invokes; this task only identifies and numbers
/// them.
#[derive(Debug)]
pub struct LeafTable<'d> {
    leaves: Vec<Expression<'d>>,
    /// Parallel to `leaves`: the leaf stands for `!expr` (4-state logical
    /// negation collapsed to a Boolean, so it holds only where `expr` is KNOWN
    /// false), the gap sample of a goto repetition (see [`build_goto`]).
    negated: Vec<bool>,
    /// T13: the local variables each leaf reads, parallel to `leaves`.
    leaf_locals: Vec<LeafLocals<'d>>,
    /// Parallel to `leaves`: the limb of a wide local variable the leaf yields
    /// ([`LimbSel`]); `None` for every other leaf.
    limbs: Vec<Option<LimbSel>>,
    /// T13: the local variables in scope, innermost expansion last (the lookup
    /// scans from the back, so a nearer declaration wins).
    scope: Vec<ScopeVar<'d>>,
    /// T13: the canonical slots definitely assigned at the node being built
    /// (the `X` of F.5.4's `flow(X, R)`); every builder function reads it on
    /// entry and restores it on return.
    flow_in: VarSet,
    /// T13: every canonical slot read or written so far, in order. The first
    /// operand of a shadowing operator is delimited by a mark into this log.
    touched: Vec<LocalVarId>,
    /// T13: the open shadow contexts, outermost first.
    shadows: Vec<ShadowCtx>,
    /// T12: the named-sequence instances being expanded right now (see the
    /// module doc's "Named sequence instances"). Builder state that rides
    /// along with the leaf table because every builder function already
    /// threads it.
    env: ranges::FormalEnv,
    /// LRM 16.8's dependency chain above the node being built: the
    /// declarations whose body (or whose instance's actual argument) the node
    /// sits in, outermost first. Not the expansion stack: an actual argument
    /// is expanded under the chain of its call site (see
    /// [`ranges::FormalFrame::origins`]).
    chain: Vec<ranges::ChainLink>,
    /// How many instance expansions enclose the node being built.
    instance_depth: usize,
    /// T28: the clocks of the assertion, indexed by [`ClockId`]: the clocking
    /// events met, interned by [`events_equivalent`]. Entry 0 is the root clock;
    /// it is `None` only until the first event met binds it, when the caller
    /// stripped no clock (the unit-test convention of [`build_automaton`]).
    clocks: Vec<Option<SemNode<'d>>>,
    /// T28: the context clock of the node being built (see the module doc's
    /// "Multiclocked sequences").
    cur: ClockId,
    /// T31 (16.14.7): the context clock at the entry of each enclosing
    /// named-sequence or property instance, innermost last. A default actual
    /// `$inferred_clock` resolves to the clock the instance was written under.
    inferred: Vec<Option<SemNode<'d>>>,
    /// T31: the root clock is the one the context supplied (a procedural block's
    /// or the default clocking, 16.14.6), not one the assertion wrote. A property
    /// that opens with its own clocking event (a clocked property declaration
    /// instantiated with no clock) replaces it: the default applies only to what
    /// has no clock (14.12).
    root_inferred: bool,
    /// T38 (16.14.7, 17.4): the assertion's `disable iff` is `$inferred_disable`
    /// (the default actual of a checker or property formal), so the condition is the
    /// `default disable iff` of the INSTANTIATION context rather than of the scope
    /// the assertion was declared in.
    disable_inferred: bool,
    /// T14: the subroutine calls attached as match items, indexed by
    /// [`ir::CallId`] (see [`super::actions`]).
    pub(super) calls: Vec<CallSite<'d>>,
    /// T15: every end-point application of the assertion, at every nesting level,
    /// indexed by [`ir::EndPoint::site`].
    end_sites: Vec<EndSite<'d>>,
    /// T18: the assertion uses a global clocking future sampled value
    /// function (16.9.4), so its action block runs at the global tick after
    /// the attempt ends.
    future_gclk: bool,
}

impl<'d> LeafTable<'d> {
    fn new(root_clock: Option<SemNode<'d>>) -> Self {
        LeafTable {
            future_gclk: false,
            calls: Vec::new(),
            end_sites: Vec::new(),
            leaves: Vec::new(),
            negated: Vec::new(),
            leaf_locals: Vec::new(),
            limbs: Vec::new(),
            scope: Vec::new(),
            flow_in: VarSet::new(),
            touched: Vec::new(),
            shadows: Vec::new(),
            env: ranges::FormalEnv::default(),
            chain: Vec::new(),
            instance_depth: 0,
            clocks: vec![root_clock],
            cur: ClockId(0),
            inferred: Vec::new(),
            root_inferred: false,
            disable_inferred: false,
        }
    }

    /// Whether the assertion's `disable iff` condition is `$inferred_disable`
    /// (see [`LeafTable::disable_inferred`]).
    pub fn disable_inferred(&self) -> bool {
        self.disable_inferred
    }

    /// The [`ClockId`] of the clocking event `event`: an equivalent one met
    /// before, or a new clock. When the caller gave no root clock, the first event
    /// met IS the root clock.
    fn intern_clock(&mut self, event: SemNode<'d>) -> ClockId {
        for (i, known) in self.clocks.iter().enumerate() {
            if known.is_some_and(|k| events_equivalent(k, event)) {
                return ClockId(i as u32);
            }
        }
        if self.clocks[0].is_none() {
            self.clocks[0] = Some(event);
            return ClockId(0);
        }
        self.clocks.push(Some(event));
        ClockId(self.clocks.len() as u32 - 1)
    }

    /// T31 (16.14.7): the clock of the clocking event `event` of a `Clocking`
    /// node. An event that is just `$inferred_clock` (the default actual of a
    /// formal, left as a call by slang) is the context clock at the instance
    /// that substituted it ([`LeafTable::inferred`]); any other event is
    /// interned.
    fn resolve_clock(
        &mut self,
        event: SemNode<'d>,
        scope: &Symbol<'d>,
    ) -> Result<ClockId, LoweringError> {
        if is_inferred_clock_event(event) {
            let at = self
                .inferred
                .last()
                .copied()
                .unwrap_or(self.clocks[self.cur.0 as usize]);
            let Some(ev) = at else {
                return Err(LoweringError::unsupported_at(
                    "`$inferred_clock` (LRM 16.14.7) in an assertion whose instantiation \
                     context has no clock (clock inference, 16.14.6, found none)",
                    scope,
                ));
            };
            return Ok(self.intern_clock(ev));
        }
        Ok(self.intern_clock(event))
    }

    /// T31: the outermost clocking event of the property, `event`, replaces an
    /// inferred root clock (see [`LeafTable::root_inferred`]). Called once, by the
    /// `Clocking` node at the very top of the property.
    fn rebind_inferred_root(&mut self, event: SemNode<'d>) {
        if std::mem::take(&mut self.root_inferred)
            && self.cur == ClockId(0)
            && self.clocks.len() == 1
            && !is_inferred_clock_event(event)
        {
            self.clocks[0] = Some(event);
        }
    }

    /// How many distinct clocks the assertion has (T28).
    pub fn clock_count(&self) -> usize {
        self.clocks.len()
    }

    /// The clocking event of `clock` (T28): `None` only for the root clock of an
    /// assertion whose caller gave none and that met no event.
    pub fn clock_event(&self, clock: ClockId) -> Option<SemNode<'d>> {
        self.clocks[clock.0 as usize]
    }

    /// The local variables leaf `id` reads (T13); empty for a leaf that names
    /// none. A leaf that reads any cannot be compiled by
    /// [`super::leaf::compile_leaf`] (a pure function of signals) yet: the
    /// runtime engine (T29) evaluates it against the thread's frame.
    pub fn locals_of(&self, id: LeafId) -> &LeafLocals<'d> {
        &self.leaf_locals[id.0 as usize]
    }

    /// The subroutine call `id` names (T14): its callee expression and how each
    /// argument is passed. Panics if `id` was not minted by this table.
    pub fn call_site(&self, id: ir::CallId) -> &CallSite<'d> {
        &self.calls[id.0 as usize]
    }

    /// Whether the assertion contains a global clocking future sampled value
    /// function (T18, LRM 16.9.4): its attempt ends at the last assertion-clock
    /// tick as usual, but the action block (and the default `$error`) must run
    /// at the next global clock tick, through
    /// `sv_sim_sim::sched::maturation::report_at_global_tick`.
    pub fn uses_future_gclk(&self) -> bool {
        self.future_gclk
    }

    /// How many subroutine calls the automaton attaches as match items.
    pub fn call_count(&self) -> usize {
        self.calls.len()
    }

    /// The subroutine calls the automaton attaches as match items, indexed by
    /// [`ir::CallId`].
    pub fn calls(&self) -> &[CallSite<'d>] {
        &self.calls
    }

    /// The end-point application [`ir::EndPoint::site`] `site` names (T15).
    /// Panics if `site` was not minted by this table.
    pub fn end_site(&self, site: u32) -> &EndSite<'d> {
        &self.end_sites[site as usize]
    }

    /// How many end-point applications the assertion has, at every nesting level.
    pub fn end_site_count(&self) -> usize {
        self.end_sites.len()
    }

    /// Registers `e` as a leaf after checking every local variable it names
    /// against the flow set `self.flow_in` (LRM 16.10, F.5.4): a read of a
    /// variable that is not definitely assigned on every path reaching it is a
    /// loud error. `lvalue` is the canonical slot an `LValueReference` inside
    /// `e` stands for (a compound assignment's own target, which counts as a
    /// read of that variable).
    ///
    /// An end-point application (`s.triggered`/`s.matched`, T15) is refused here:
    /// it needs the [`ir::Transition::EndPoint`] edge that sets its flag, which
    /// only a Boolean leaf of a sequence gets (see [`build_leaf`]), so a value
    /// expression of a match item or a declaration initializer holding one is a
    /// loud error instead of a leaf nothing could evaluate.
    pub(super) fn push_leaf(
        &mut self,
        a: &mut ir::Automaton,
        e: Expression<'d>,
        lvalue: Option<LocalVarId>,
        scope: &Symbol<'d>,
    ) -> Result<LeafId, LoweringError> {
        let mut points = Vec::new();
        collect_end_points(e, &mut points);
        if !points.is_empty() {
            return Err(LoweringError::unsupported_at(
                "a sequence method `.triggered`/`.matched` inside a match item or a local \
                 variable initializer is not implemented (the end point is tested where a \
                 sequence operand stands, LRM 16.9.11/16.13.5; sva T15)",
                scope,
            ));
        }
        self.push_leaf_flags(a, e, lvalue, &[], false, scope)
    }

    /// [`Self::push_leaf`] for a Boolean leaf whose end-point applications have
    /// each been given a flag slot, `flags[i]` for the i-th in pre-order.
    fn push_leaf_flags(
        &mut self,
        a: &mut ir::Automaton,
        e: Expression<'d>,
        lvalue: Option<LocalVarId>,
        flags: &[LocalVarId],
        negated: bool,
        scope: &Symbol<'d>,
    ) -> Result<LeafId, LoweringError> {
        let mut syms = Vec::new();
        let mut reads_lvalue = false;
        collect_local_reads(e.as_sem_node(), &mut syms, &mut reads_lvalue);
        let mut locals = LeafLocals {
            end_flags: flags.to_vec(),
            ..LeafLocals::default()
        };
        for sym in syms {
            let slot = self.resolve(sym, scope)?;
            self.check_flows(sym, slot, scope)?;
            let phys = self.phys_of(a, slot);
            if !locals.reads.iter().any(|(s, _)| *s == sym) {
                locals.reads.push((sym, phys));
            }
        }
        if let Some(target) = lvalue {
            if reads_lvalue {
                let name = self
                    .scope
                    .iter()
                    .rev()
                    .find(|v| v.slot == target)
                    .map(|v| v.sym.name().to_string())
                    .unwrap_or_default();
                if !self.flow_in.contains(&target) {
                    return Err(not_flowing(&name, scope));
                }
            }
            locals.lvalue = Some(self.phys_of(a, target));
        }
        let id = LeafId(self.leaves.len() as u32);
        self.leaves.push(e);
        self.negated.push(negated);
        self.leaf_locals.push(locals);
        self.limbs.push(None);
        Ok(id)
    }

    /// The limb of a wide local variable leaf `id` yields, `None` for a leaf
    /// that is an ordinary value or condition.
    pub fn limb_of(&self, id: LeafId) -> Option<LimbSel> {
        self.limbs[id.0 as usize]
    }

    /// The leaves of a by-value subroutine-call argument `e` (16.11) wider than
    /// 64 bits: one per 64-bit word of its four-state value, value limbs first
    /// and then the unknown-plane limbs ([`LimbSel`], the layout a wide
    /// assertion input has). An argument of at most 64 bits is one plain leaf.
    pub(super) fn push_arg_leaves(
        &mut self,
        a: &mut ir::Automaton,
        e: Expression<'d>,
        width: u32,
        scope: &Symbol<'d>,
    ) -> Result<Vec<LeafId>, LoweringError> {
        if width <= 64 {
            return Ok(vec![self.push_leaf(a, e, None, scope)?]);
        }
        if width > MAX_LOCAL_VAR_BITS {
            return Err(LoweringError::unsupported_at(
                &format!(
                    "a by-value argument of {width} bits in a sequence match-item call (16.11): \
                     at most {MAX_LOCAL_VAR_BITS} bits is implemented"
                ),
                scope,
            ));
        }
        let n = width.div_ceil(64);
        let mut out = Vec::with_capacity(2 * n as usize);
        let mut group = None;
        for slot in 0..2 * n {
            let leaf = self.push_leaf(a, e, None, scope)?;
            self.limbs[leaf.0 as usize] = Some(LimbSel {
                width,
                unknown: slot >= n,
                index: slot % n,
                group: group.get_or_insert(leaf.0).to_owned(),
            });
            out.push(leaf);
        }
        Ok(out)
    }

    /// The `(slot, leaf)` assignments that give the local variable at physical
    /// slot `var` the value of `e` (16.8.2, 16.10): one for a variable of at
    /// most 64 bits, and for a wider one a leaf per slot of it, value limbs
    /// first ([`LimbSel`]). `lvalue` is as for [`Self::push_leaf`].
    ///
    /// The leaves are evaluated one after the other, so a limb leaf that reads
    /// the variable would see the limbs written before it; callers whose
    /// right-hand side can read the target use [`Self::assign_var`].
    pub(super) fn slot_leaves(
        &mut self,
        a: &mut ir::Automaton,
        var: LocalVarId,
        e: Expression<'d>,
        lvalue: Option<LocalVarId>,
        scope: &Symbol<'d>,
    ) -> Result<Vec<(LocalVarId, LeafId)>, LoweringError> {
        let decl = *a.local_var(var);
        if !decl.is_wide() {
            return Ok(vec![(var, self.push_leaf(a, e, lvalue, scope)?)]);
        }
        let n = decl.limbs() as u32;
        let mut out = Vec::with_capacity(2 * n as usize);
        let mut group = None;
        for slot in 0..2 * n {
            let leaf = self.push_leaf(a, e, lvalue, scope)?;
            self.limbs[leaf.0 as usize] = Some(LimbSel {
                width: decl.width,
                unknown: slot >= n,
                index: slot % n,
                group: group.get_or_insert(leaf.0).to_owned(),
            });
            out.push((LocalVarId(var.0 + slot), leaf));
        }
        Ok(out)
    }

    /// The actions of the assignment `target = e` of a match item (16.11):
    /// [`Self::slot_leaves`] as [`Transition::LocalVarWrite`]s. When `e` reads
    /// the target (`w = {w, 1'b0}`, `w += 1`) and the target is wide, the limbs
    /// are written into a fresh variable and copied over by a final
    /// [`Transition::LocalVarCopy`], so that every limb of `e` is computed from
    /// the OLD value of the target.
    pub(super) fn assign_var(
        &mut self,
        a: &mut ir::Automaton,
        canon: LocalVarId,
        phys: LocalVarId,
        e: Expression<'d>,
        scope: &Symbol<'d>,
    ) -> Result<Vec<Transition>, LoweringError> {
        let decl = *a.local_var(phys);
        let mut syms = Vec::new();
        let mut reads_lvalue = false;
        collect_local_reads(e.as_sem_node(), &mut syms, &mut reads_lvalue);
        let reads_target = reads_lvalue
            || syms
                .iter()
                .any(|s| self.resolve(*s, scope).is_ok_and(|c| c == canon));
        let temp =
            (decl.is_wide() && reads_target).then(|| a.new_local_var(decl.width, decl.signed));
        let dst = temp.unwrap_or(phys);
        let mut out: Vec<Transition> = self
            .slot_leaves(a, dst, e, Some(canon), scope)?
            .into_iter()
            .map(|(var, value)| Transition::LocalVarWrite { var, value })
            .collect();
        if let Some(src) = temp {
            out.push(Transition::LocalVarCopy { dst: phys, src });
        }
        Ok(out)
    }

    /// The canonical slot of local variable `sym`: its nearest declaration in
    /// scope. A local variable that no enclosing named sequence declares
    /// (a property-level one, T19/T20's) is a loud error.
    fn resolve(&self, sym: Symbol<'d>, scope: &Symbol<'d>) -> Result<LocalVarId, LoweringError> {
        self.scope
            .iter()
            .rev()
            .find(|v| v.sym == sym)
            .map(|v| v.slot)
            .ok_or_else(|| {
                LoweringError::unsupported_at(
                    &format!(
                        "local variable `{}` is not declared by an enclosing named sequence \
                         (assertion variable declarations of a property or assertion statement \
                         are sva T19/T20's)",
                        sym.name()
                    ),
                    scope,
                )
            })
    }

    /// The F.5.4 read check: `slot` must be in the current flow set.
    fn check_flows(
        &self,
        sym: Symbol<'d>,
        slot: LocalVarId,
        scope: &Symbol<'d>,
    ) -> Result<(), LoweringError> {
        if self.flow_in.contains(&slot) {
            Ok(())
        } else {
            Err(not_flowing(sym.name(), scope))
        }
    }

    /// The physical slot a thread at the current build point reads and writes
    /// for canonical variable `canon`: logs the touch, and (inside the second
    /// operand of a shadowing operator) mints the shadow of a variable the
    /// first operand also touched, outermost context first so a nested context
    /// shadows the slot its parent resolved to.
    fn phys_of(&mut self, a: &mut ir::Automaton, canon: LocalVarId) -> LocalVarId {
        self.touched.push(canon);
        let mut current = canon;
        for ctx in &mut self.shadows {
            if let Some(&(_, _, s)) = ctx.made.iter().find(|(c, _, _)| *c == canon) {
                current = s;
            } else if ctx.outer_touched.contains(&canon) {
                let decl = *a.local_var(canon);
                let shadow = a.new_local_var(decl.width, decl.signed);
                ctx.made.push((canon, current, shadow));
                current = shadow;
            }
        }
        current
    }

    /// Mints the canonical slot of `sym` (a declared local or a formal's body
    /// copy) and brings it into scope.
    fn declare(
        &mut self,
        a: &mut ir::Automaton,
        sym: Symbol<'d>,
        scope: &Symbol<'d>,
    ) -> Result<LocalVarId, LoweringError> {
        // A `real`/`realtime`/`shortreal` local (LRM 16.10) is a slot of its IEEE bits, as a
        // real variable's cell is everywhere else: 64 bits for the first two (`shortreal`
        // keeps its f32 bits in the low 32, see `real::to_storage`).
        //
        // A `string` local (LRM 16.10 "any data type") is the 64-bit id of an interned
        // string (`crate::strings`), so it is a plain unsigned 64-bit slot: a fresh frame
        // holds id 0, the empty string, which is the string default value (6.16). A class
        // handle local (6.14) is likewise the 64-bit object id (0 = `null`, the default).
        //
        // A queue, dynamic array or associative array local (LRM 16.10) is likewise a 64-bit
        // handle (0, the empty collection, in a fresh frame). The row holds an immutable
        // snapshot of each collection the assertion reads (`AssertionSpec::coll_words`), so
        // `q = src` stores the snapshot handle itself: frames, forks and both evaluators
        // share it read-only. Only integral and handle-free struct elements are implemented.
        let ty = sym.declared_type().filter(|t| {
            t.is_integral()
                || t.is_floating()
                || t.is_string()
                || t.is_class()
                || is_stored_aggregate(t)
                || is_integral_collection(t)
        });
        let Some(ty) = ty else {
            if sym
                .declared_type()
                .is_some_and(|t| t.is_dynamically_sized_array())
            {
                return Err(LoweringError::unsupported_at(
                    &format!(
                        "local variable `{}` is a queue, dynamic array or associative array \
                         whose elements are not integral or unpacked structs of integral fields \
                         (they are themselves collections, or hold handles): only collections of \
                         integral or plain-struct elements are implemented as sequence local \
                         variables (LRM 16.10)",
                        sym.name()
                    ),
                    scope,
                ));
            }
            return Err(LoweringError::unsupported_at(
                &format!(
                    "local variable `{}` has a type that is neither integral, real, string, class handle nor unpacked struct nor fixed-size unpacked array of integral elements; only \
                     those local variables are implemented",
                    sym.name()
                ),
                scope,
            ));
        };
        let is_coll = is_integral_collection(&ty);
        let width = if ty.is_string() || ty.is_class() || is_coll {
            64
        } else if let Some(rows) = flat_array_rows(&ty) {
            let shape = crate::arrays::array_shape(&ty).expect("flat_array_rows saw a shape");
            rows * u64::from(crate::types::TypeWidth::value_width(&shape.elem))
        } else if ty.is_floating() || is_stored_aggregate(&ty) {
            u64::from(crate::types::TypeWidth::value_width(&ty))
        } else {
            ty.bit_width()
        };
        if width == 0 || width > u64::from(MAX_LOCAL_VAR_BITS) {
            return Err(LoweringError::unsupported_at(
                &format!(
                    "local variable `{}` is {width} bits wide; a local variable of 1 to \
                     {MAX_LOCAL_VAR_BITS} bits is implemented (a variable wider than 64 bits \
                     takes a frame slot per 64-bit limb of its value and of its unknown bits, \
                     and each assignment of it a leaf per slot)",
                    sym.name()
                ),
                scope,
            ));
        }
        let slot = a.new_local_var(
            width as u32,
            !(ty.is_string() || ty.is_class() || is_coll || is_stored_aggregate(&ty))
                && ty.is_signed(),
        );
        self.scope.push(ScopeVar { sym, slot });
        Ok(slot)
    }

    /// The `Expression` [`LeafId`] `id` was assigned to. Panics if `id`
    /// was not produced by this same table (a builder-internal invariant,
    /// never reachable from untrusted input -- see `ir::Automaton::
    /// add_edge`'s identical note).
    pub fn get(&self, id: LeafId) -> Expression<'d> {
        self.leaves[id.0 as usize]
    }

    /// Whether leaf `id` stands for `!expr` of its [`Self::get`] expression (the
    /// gap sample of a goto/nonconsecutive repetition, 16.9.2) rather than for
    /// the expression itself. The compiled guard is then
    /// [`super::leaf::compile_negated_leaf`]: `!expr` evaluated in 4-state logic,
    /// so an `x`/`z` expression makes it false, exactly as the hand-written
    /// `!b` is. Panics if `id` was not produced by this table.
    pub fn is_negated(&self, id: LeafId) -> bool {
        self.negated[id.0 as usize]
    }

    pub fn len(&self) -> usize {
        self.leaves.len()
    }
}

/// Every local-variable symbol an expression tree names, in the order the walk
/// reaches them (a variable named twice is listed twice), and whether it holds
/// an `LValueReference` (the target of a compound assignment).
///
/// Only `NamedValue` nodes count: slang's `Conversion` nodes report the symbol
/// of their operand too, and would otherwise double every converted read.
pub(super) fn collect_local_reads<'d>(
    n: SemNode<'d>,
    out: &mut Vec<Symbol<'d>>,
    lvalue: &mut bool,
) {
    if let Some(e) = n.as_expression() {
        // The instance an end-point method is applied to is evaluated in a frame
        // of its own (T15), so what it reads is not a read of this expression.
        if end_point_call(e).is_some() {
            return;
        }
        // A deliberate two-kind filter, not a dispatch over every kind: every
        // other expression kind is simply not a local read, so it is compared
        // with `==` rather than matched with a wildcard arm.
        let k = e.kind();
        if k == ExpressionKind::NamedValue {
            if let Some(s) = e
                .referenced_symbol()
                .filter(|s| s.kind() == SymbolKind::LocalAssertionVar)
            {
                out.push(s);
            }
        } else if k == ExpressionKind::LValueReference {
            *lvalue = true;
        }
    }
    for c in n.children() {
        collect_local_reads(c, out, lvalue);
    }
}

/// `e` as the application of a sequence method to a sequence instance
/// (`inst.triggered`, `inst.matched`; LRM 16.9.11, 16.13.5, 16.13.6): the method
/// and the `AssertionInstance` expression it is applied to. `None` for anything
/// else, including `event.triggered`, whose operand is an event (an ordinary
/// value, lowered by the expression lowerer).
fn end_point_call<'d>(e: Expression<'d>) -> Option<(ir::EndMethod, Expression<'d>)> {
    if e.kind() != ExpressionKind::Call {
        return None;
    }
    let name = e.system_subroutine()?.known_name_id();
    // Two names out of every system subroutine: compared, not matched.
    let method = if name == KnownSystemName::Triggered {
        ir::EndMethod::Triggered
    } else if name == KnownSystemName::Matched {
        ir::EndMethod::Matched
    } else {
        return None;
    };
    let operand = *e.operands().first()?;
    (operand.kind() == ExpressionKind::AssertionInstance).then_some((method, operand))
}

/// Every end-point application in `e`, in pre-order (`!(a.triggered && b.matched)`
/// is `[a.triggered, b.matched]`), not descending into an application's own
/// operand (its instance has its own expressions, built as an automaton of their
/// own). The order is the one [`LeafLocals::end_flags`] is indexed by.
pub(crate) fn collect_end_points<'d>(
    e: Expression<'d>,
    out: &mut Vec<(ir::EndMethod, Expression<'d>)>,
) {
    if let Some(p) = end_point_call(e) {
        out.push(p);
        return;
    }
    for c in e.as_sem_node().children() {
        if let Some(c) = c.as_expression() {
            collect_end_points(c, out);
        }
    }
}

/// Whether the match-item call `e` is a built-in method of a queue, dynamic array or
/// associative array that is a sequence local variable (see `attach_match_items`).
fn is_local_collection_method(e: Expression<'_>) -> bool {
    let ops = e.operands();
    e.call_subroutine().is_none()
        && ops.first().is_some_and(|r| {
            crate::collections::coll_of_expr(r).is_some()
                && r.kind() == ExpressionKind::NamedValue
                && r.referenced_symbol()
                    .is_some_and(|s| s.kind() == SymbolKind::LocalAssertionVar)
        })
}

/// The error for a read of local variable `name` that does not flow to it
/// (LRM 16.10, Annex F.5.4).
/// A queue, dynamic array or associative array of integral or unpacked-struct elements
/// holding no handle (a collection element would stay live inside the shared snapshot): a
/// sequence local of that type is a 64-bit collection handle (LRM 16.10).
fn is_integral_collection(t: &sv_lang::Type<'_>) -> bool {
    sv_sim_sim::state::storage::is_collection(t)
        && t.element_type().is_some_and(|e| {
            (e.is_integral()
                || e.is_unpacked_struct()
                || sv_sim_sim::state::storage::is_collection(&e))
                && crate::collections::handle_offsets(&e)
                    .iter()
                    .all(|s| s.kind == crate::collections::HandleKind::Coll && s.guards.is_empty())
                && collection_nest(t).is_some()
        })
}

/// Where the collections inside the elements of the collection type `ty` sit
/// (a queue of queues, a struct element with a queue field; none for a flat
/// collection): the snapshot of a collection read by an assertion copies those
/// inner collections too, so a sequence local assigned from it is a sampled
/// value copy (LRM 16.10, 7.6). `None` for an element holding a class handle.
pub(super) fn collection_nest(ty: &sv_lang::Type<'_>) -> Option<sv_sim_sim::collections::Nest> {
    let elem = ty.element_type()?;
    let mut slots = Vec::new();
    nest_slots(&elem, 0, &mut slots)?;
    Some(sv_sim_sim::collections::Nest { slots })
}

fn nest_slots(
    ty: &sv_lang::Type<'_>,
    base: u32,
    out: &mut Vec<(u32, sv_sim_sim::collections::Nest)>,
) -> Option<()> {
    use sv_sim_sim::state::storage;
    if storage::is_collection(ty) {
        out.push((base, collection_nest(ty)?));
    } else if ty.is_class() {
        return None;
    } else if ty.is_unpacked_struct() {
        for f in ty.fields() {
            let (Some(fty), Some((lo, _))) =
                (f.value_type(), storage::field_slice(ty, f.field_index()))
            else {
                continue;
            };
            nest_slots(&fty, base + lo as u32, out)?;
        }
    } else if ty.is_unpacked_array() {
        let elem = ty.element_type()?;
        let ew = storage::storage_width(&elem)?;
        for i in 0..ty.fixed_unpacked_array_range().width() {
            nest_slots(&elem, base + i * ew as u32, out)?;
        }
    } else if !crate::collections::handle_offsets(ty).is_empty() {
        return None;
    }
    Some(())
}

/// An unpacked struct: a value sv-sim holds as one flat run of stored bits (fields
/// concatenated, `sv_sim_sim::state::storage`), so a sequence local of that type (LRM 16.10)
/// is a slot of that many bits, like any wide integral local, and `s.f` is the usual slice
/// of the base's stored bits. A fixed-size unpacked array is NOT included: an array
/// variable's reads and element selects go through a row buffer (`arrays::Backing::Local`),
/// not the flat bits, so it stays refused by name.
fn is_stored_aggregate(t: &sv_lang::Type<'_>) -> bool {
    t.is_unpacked_struct() || flat_array_rows(t).is_some()
}

/// The row count of a fixed-size unpacked array of integral (or packed/enum) elements small
/// enough to unroll (`arrays::pack_array_value`'s limit), the arrays a sequence local can be
/// (LRM 16.10): the slot holds the array's flat stored bits (row `r` in bits `[r*w +: w]`)
/// and a read primes a row buffer from them (`emit.rs prime_locals`), so element selects use
/// the ordinary local-array path. `None` for any other array (dynamic, queue, associative,
/// real, string or handle elements), which stays refused by name.
fn flat_array_rows(t: &sv_lang::Type<'_>) -> Option<u64> {
    let shape = crate::arrays::array_shape(t)?;
    (!shape.dims.is_empty()
        && shape.rows() <= crate::arrays::MAX_UNROLLED_ROWS
        && shape.elem.is_integral()
        && crate::collections::handle_offsets(&shape.elem).is_empty())
    .then(|| shape.rows())
}

fn not_flowing(name: &str, scope: &Symbol<'_>) -> LoweringError {
    LoweringError::unsupported_at(
        &format!(
            "local variable `{name}` does not flow out to this read: it is not assigned on every \
             path that reaches it, or it is blocked by the parallel threads of an `and`/\
             `intersect` that both assign it (LRM 16.10, Annex F.5.4)"
        ),
        scope,
    )
}

/// One in-progress piece of automaton under construction -- a standard
/// NFA-fragment shape (Thompson construction): a single entry state, and
/// the set of states ("exits") from which the next operand (or, at the top
/// level, [`build_automaton`]'s own `Match` finalization) should continue.
///
/// The fragment's language is the set of paths from `entry` to an `exits`
/// state (its NONEMPTY matches, each spending at least the tick it starts
/// on), plus -- when `empty` -- the empty match (16.9.2.1: zero operands
/// consumed, zero elapsed ticks). `entry` is never itself an exit: the empty
/// match is a flag, not a state, because it contributes no path (see the
/// module doc comment). A fragment with no exits and `empty == false` never
/// matches (`a[*0] ##0 b`).
///
/// `flow` is the F.5.4 triple of the fragment (T13); every combinator composes
/// it with the same operator that composes the states (see [`Flow`]).
struct Fragment {
    entry: ThreadStateId,
    exits: Vec<ThreadStateId>,
    empty: bool,
    flow: Flow,
    /// The clocks the fragment spans (T28); `None` while it has no clocking event
    /// of its own and so takes the context clock of whatever contains it.
    clock: Option<Span>,
}

/// The clocks a sequence fragment spans (16.13.1, T28): the clock its first
/// Boolean operand is evaluated in (`start`), the one its last is (`end`), and
/// whether it changes clock anywhere in between (`multi`, a `##1`/`##0` between
/// differently clocked operands). A singly clocked fragment has
/// `start == end && !multi`.
#[derive(Clone, Copy, PartialEq, Eq, Debug)]
struct Span {
    start: ClockId,
    end: ClockId,
    multi: bool,
}

impl Span {
    fn single(c: ClockId) -> Self {
        Span {
            start: c,
            end: c,
            multi: false,
        }
    }
}

/// Builds a complete automaton for one sequence/property tree rooted at
/// `root` (typically an `AnalyzedAssertion::root()`, with any `Clocking`
/// wrapper already stripped by the caller -- the same convention T6/T7/T8's
/// own tests already use). `tree`/`scope` are used exactly as `ranges`/`op`
/// already use them (syntax lookup, error location).
///
/// `root_clock` is the event expression of the `Clocking` wrapper the caller
/// stripped (its `[event, body]` first child), or `None` when `root` had no
/// clock of its own. It seeds the builder's clocking-event check, so a named
/// sequence instance that carries a DIFFERENT event (`assert property
/// (@(negedge clk) s)` with `sequence s; @(posedge sysclk) ...`) is the loud
/// multiclock error of [`build_clocking`] instead of being built on the
/// instance's clock alone.
///
/// This task's own scope is `AssertionExprKind::{Simple, SequenceConcat,
/// SequenceWithMatch-as-a-bare-repetition-wrapper}` -- see [`build_assertion`]
/// for the full, named list of what is deliberately not yet implemented
/// (every rejection is a [`LoweringError`], never a panic or a silent wrong
/// answer).
///
/// Returns the finished [`ir::Automaton`] (every reachable exit of `root`'s
/// own top-level fragment gets a `Transition::Match { actions: vec![] }`
/// self-loop edge -- T29 onward fills in real actions; the builder's own job
/// stops at the automaton's *shape*, plus [`ir::Automaton::admits_empty`] for
/// the empty match) plus the [`LeafTable`] a later wiring task compiles into
/// real predicates.
pub fn build_automaton<'d>(
    root: AssertionExpr<'d>,
    root_clock: Option<SemNode<'d>>,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<(ir::Automaton, LeafTable<'d>), LoweringError> {
    let mut automaton = blank_automaton();
    let mut leaves = LeafTable::new(root_clock);
    leaves.future_gclk = super::gclk::check(root, scope)?;
    let frag = build_assertion(&mut automaton, &mut leaves, root, tree, scope)?;
    finish_automaton(&mut automaton, frag);
    Ok((automaton, leaves))
}

/// An automaton with no state yet (the builder allocates its own entry).
fn blank_automaton() -> ir::Automaton {
    ir::Automaton {
        states: Vec::new(),
        start: ThreadStateId(0),
        admits_empty: false,
        first_match_groups: 0,
        local_vars: Vec::new(),
        end_points: Vec::new(),
        entry_clock: ClockId(0),
    }
}

/// Closes `a` over its top-level fragment: the fragment's entry is the start,
/// its empty flag the automaton's, and every distinct exit gets its `Match`
/// self-loop. Its entry clock is the clock the fragment starts in.
fn finish_automaton(a: &mut ir::Automaton, frag: Fragment) {
    a.entry_clock = frag.clock.map_or(ClockId(0), |s| s.start);
    a.start = frag.entry;
    a.admits_empty = frag.empty;
    add_match_edges(a, frag.exits);
    // The operators that rebuild their operands (T11's products) leave the
    // operands' own states behind, unreferenced.
    prune_unreachable(a);
}

/// Gives every distinct state of `exits` its `Match` self-loop: the edge that
/// says a match of the fragment ends there.
fn add_match_edges(a: &mut ir::Automaton, exits: Vec<ThreadStateId>) {
    // `seen` is membership-only (never iterated), so the Match edges stay in
    // `exits` order -- deterministic.
    let mut seen = HashSet::new();
    for exit in exits {
        if !seen.insert(exit) {
            continue;
        }
        a.add_edge(
            exit,
            None,
            Transition::Match {
                actions: Vec::new(),
            },
            exit,
        );
    }
}

/// Drops every state not reachable from `a.start` and renumbers the rest in
/// breadth-first order from the start (so `start` becomes state 0), following
/// each state's edges in their stored order: the numbering is a pure function
/// of the graph, never of allocation order or of any hash iteration.
fn prune_unreachable(a: &mut ir::Automaton) {
    prune_from(a, &[a.start]);
}

/// [`prune_unreachable`] for an automaton with several entry points (a property
/// holds one per sequence): keeps what any of `roots` reaches, numbers it
/// breadth-first from the first root, then the next root not yet reached, and so
/// on, and returns the new id of every old state (`None` for a dropped one).
/// `a.start` becomes the first root's new id.
fn prune_from(a: &mut ir::Automaton, roots: &[ThreadStateId]) -> Vec<Option<ThreadStateId>> {
    let mut new_id: Vec<Option<u32>> = vec![None; a.states.len()];
    let mut order: Vec<ThreadStateId> = Vec::new();
    let mut next = 0;
    for &root in roots {
        if new_id[root.0 as usize].is_none() {
            new_id[root.0 as usize] = Some(order.len() as u32);
            order.push(root);
        }
        while next < order.len() {
            let s = order[next];
            next += 1;
            for e in &a.states[s.0 as usize].edges {
                let slot = &mut new_id[e.target.0 as usize];
                if slot.is_none() {
                    *slot = Some(order.len() as u32);
                    order.push(e.target);
                }
            }
        }
    }
    let states = order
        .iter()
        .map(|s| {
            let mut st = a.states[s.0 as usize].clone();
            for e in &mut st.edges {
                // Every target of a reachable state was reached above.
                e.target = ThreadStateId(
                    new_id[e.target.0 as usize].expect("a reachable state's targets are reachable"),
                );
            }
            st
        })
        .collect();
    a.states = states;
    a.start = roots
        .first()
        .and_then(|r| new_id[r.0 as usize])
        .map_or(ThreadStateId(0), ThreadStateId);
    new_id.into_iter().map(|n| n.map(ThreadStateId)).collect()
}

/// Dispatches on `expr.kind()`. The kinds implemented are `Simple`,
/// `SequenceConcat`, `SequenceWithMatch` (T9/T10) and, from T11, the sequence
/// operators `Binary` (`and`/`or`/`intersect`/`throughout`/`within`) and
/// `FirstMatch`; every other kind is a named, loud [`LoweringError`] citing
/// which later task owns it -- never a silent guess (ARCHITECTURE §7 item 9's
/// "every kind match shouts" discipline, applied here since
/// `AssertionExprKind` is a `sv-lang`-mirrored kind enum).
fn build_assertion<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    expr: AssertionExpr<'d>,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    match expr.kind() {
        AssertionExprKind::Simple => build_simple(a, leaves, expr, tree, scope),
        AssertionExprKind::SequenceConcat => build_concat(a, leaves, expr, tree, scope),
        AssertionExprKind::SequenceWithMatch => {
            build_sequence_with_match(a, leaves, expr, tree, scope)
        }
        AssertionExprKind::Binary => build_binary(a, leaves, expr, tree, scope),
        AssertionExprKind::FirstMatch => build_first_match(a, leaves, expr, tree, scope),
        // A clocking event inside a sequence: a named sequence's body carrying the
        // declaration's own `@(...)`, or a clocked operand of a multiclocked
        // sequence (16.13.1); see `build_clocking`. At the root the caller has
        // already stripped the assertion's own clock (T7).
        AssertionExprKind::Clocking => build_clocking(a, leaves, expr, tree, scope),
        other => Err(LoweringError::unsupported_at(
            &format!(
                "sva automaton builder: AssertionExprKind::{other:?} is a property expression, \
                 not a sequence (LRM 16.12.1): a sequence is built from Boolean operands, \
                 `##` concatenation, repetition, match items, first_match and the sequence \
                 operators and/or/intersect/throughout/within; the property operators are \
                 built by `build_property`"
            ),
            scope,
        )),
    }
}

/// Builds the fragment for one generic operand node (an `AssertionExpr`
/// child or a bare `Expression` leaf child -- the same dual shape
/// `sv-sim-codegen::sva::{collect_boolean_leaves, assertion_expr_leaf_
/// children}` already dispatch on). Used by [`build_concat`] for each of a
/// concatenation's operands.
fn build_node<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    node: SemNode<'d>,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    if let Some(e) = node.as_expression() {
        return build_operand(a, leaves, e, tree, scope);
    }
    if let Some(ae) = node.as_assertion_expr() {
        return build_assertion(a, leaves, ae, tree, scope);
    }
    Err(LoweringError::unsupported_at(
        "sva automaton builder: a sequence operand is neither an Expression nor an \
         AssertionExpr (unexpected SemNode kind)",
        scope,
    ))
}

/// 16.9.1's atomic step: one Boolean leaf, sampled over exactly the tick it
/// is evaluated on. Modeled as `entry --[guard=Some(leaf), Epsilon]--> exit`
/// (zero ADDITIONAL elapsed ticks -- see `ir::Edge`'s own doc comment in
/// `sv-sim-sim` for why a leaf's own evaluation never advances a sequence's
/// clock; only a `##`/repetition-link delay does). Never empty (`empty:
/// false`): a real Boolean sample always consumes exactly one real leaf
/// check, which is the LRM's technical definition of non-empty (16.9.2.1).
///
/// A leaf that applies `.triggered`/`.matched` to a sequence instance inside a
/// larger expression (`!s.triggered`, `a && s.matched`, T15) first passes one
/// flag-form [`Transition::EndPoint`] edge per application, in pre-order: each
/// stores whether its instance reached its end point on this tick in a fresh
/// frame slot, which the leaf reads where the application stands (see
/// [`LeafLocals::end_flags`]). Nothing flows out of such an application (16.10:
/// it is not a maximal Boolean expression), so the fragment's flow stays the
/// identity.
///
/// `negated` builds the sample of `!leaf` instead (the gap of a goto repetition,
/// see [`build_goto`]): the guard is a leaf marked [`LeafTable::is_negated`], so
/// nothing else about the fragment changes.
fn build_leaf<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    leaf: Expression<'d>,
    negated: bool,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    let mut points = Vec::new();
    collect_end_points(leaf, &mut points);
    let entry = a.new_state();
    let mut at = entry;
    let mut flags = Vec::with_capacity(points.len());
    for (method, inst) in points {
        let built = build_end_point(a, leaves, method, inst, false, tree, scope)?;
        let flag = a.new_local_var(1, false);
        let next = a.new_state();
        a.add_edge(
            at,
            None,
            Transition::EndPoint {
                point: built.point,
                flag: Some(flag),
            },
            next,
        );
        flags.push(flag);
        at = next;
    }
    let exit = a.new_state();
    // A read of a local variable is checked against what flows in (16.10).
    let id = leaves.push_leaf_flags(a, leaf, None, &flags, negated, scope)?;
    a.add_edge(at, Some(id), Transition::Epsilon, exit);
    Ok(Fragment {
        entry,
        exits: vec![exit],
        empty: false,
        flow: Flow::identity(),
        clock: None,
    })
}

/// The fragment of the sequence that matches only the empty match
/// (`a[*0]`; also the starting point of a leading `##` delay): no exits,
/// `empty`. The entry state is a fresh edgeless state.
fn empty_fragment(a: &mut ir::Automaton) -> Fragment {
    Fragment {
        entry: a.new_state(),
        exits: Vec::new(),
        empty: true,
        flow: Flow::identity(),
        clock: None,
    }
}

/// `AssertionExprKind::Simple` (16.7): one Boolean operand, optionally
/// wrapped in a `[*n:m]`/`[+]`/`[->n:m]`/`[=n:m]` repetition (16.9.2). The
/// repetition bound itself is never a semantic child (T3's own module doc:
/// slang folds it to a plain syntax-level `min`/`max` struct) -- recovered
/// here from `tree.syntax(&expr)` cast to [`SimpleSequenceExprSyntax`],
/// exactly as [`ranges::sequence_range_of`]'s own `Simple` arm does (after
/// peeling any plain parens: `(a[*2])` is a `Simple` whose syntax node is
/// the paren, see [`ranges::peel_sequence_parens`]).
fn build_simple<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    expr: AssertionExpr<'d>,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    let kids = expr.children();
    let [leaf_node] = kids.as_slice() else {
        if kids.is_empty() {
            // slang drops an operand it could not bind (an invalid expression,
            // e.g. an instance whose actual is not cast compatible with a typed
            // formal, 16.8.1 (c), or an event expression bound to a `sequence`
            // formal, 16.8.1 (a)) from the semantic tree but keeps the node.
            return Err(LoweringError::unsupported_at(
                "sva automaton builder: a Boolean operand has no semantic expression -- slang \
                 could not bind it, so the design has an error (check `Design::diagnostics()`; \
                 `named::check_formal_argument_rules` names the LRM 16.8/16.8.1 rule; also the \
                 case of an omitted checker actual (LRM 17.3) whose sequence/property default \
                 names a SIBLING formal of the same checker, e.g. `sequence s = req`, which \
                 slang does not bind -- pass the actual explicitly)",
                scope,
            ));
        }
        return Err(LoweringError::unsupported_at(
            &format!(
                "sva automaton builder: Simple node must have exactly one child (its Boolean \
                 operand), found {}",
                kids.len()
            ),
            scope,
        ));
    };
    let leaf_expr = leaf_node.as_expression().ok_or_else(|| {
        LoweringError::unsupported_at(
            "sva automaton builder: Simple node's own child is not an Expression",
            scope,
        )
    })?;

    let syn = tree.syntax(&expr).ok_or_else(|| {
        LoweringError::unsupported_at(
            "sva automaton builder: Simple node has no syntax node in the given tree",
            scope,
        )
    })?;
    let syn = ranges::peel_sequence_parens(syn);
    let simple_syn = SimpleSequenceExprSyntax::cast(syn).ok_or_else(|| {
        LoweringError::unsupported_at(
            &format!(
                "sva automaton builder: expected SimpleSequenceExprSyntax, found {:?}",
                syn.kind()
            ),
            scope,
        )
    })?;

    match simple_syn.repetition() {
        None => build_operand(a, leaves, leaf_expr, tree, scope),
        Some(rep) => {
            if leaf_expr.kind() == ExpressionKind::AssertionInstance
                && matches!(rep.op().map(|t| t.text()), Some("->") | Some("="))
            {
                // 16.9.2: goto/nonconsecutive repetition is defined on a
                // Boolean expression only (slang's `SeqInstanceRepetition`).
                return Err(LoweringError::unsupported_at(
                    "goto/nonconsecutive repetition (`[->n:m]`/`[=n:m]`) cannot be applied to a \
                     named sequence instance (LRM 16.9.2: only a Boolean expression may carry \
                     it; only `[*...]`/`[+]` may repeat a sequence)",
                    scope,
                ));
            }
            build_repetition(
                a,
                leaves,
                rep,
                scope,
                &mut |a, leaves| build_operand(a, leaves, leaf_expr, tree, scope),
                &mut |a, leaves| build_gap_operand(a, leaves, leaf_expr, tree, scope),
            )
        }
    }
}

/// The deepest chain of nested named-sequence expansions [`build_instance`]
/// follows before giving up. A real cycle is reported by name long before this
/// (the declaration is on [`LeafTable::chain`]); the cap is the
/// backstop for a cycle through an instance that has no formal arguments, which
/// slang already diagnoses (`RecursiveSequence`) but a caller that ignored the
/// diagnostics would otherwise send into unbounded recursion.
const MAX_INSTANCE_DEPTH: usize = 128;

/// One `Expression` operand of a sequence: a named sequence instance
/// (16.8) is expanded in place, anything else is a Boolean leaf (16.9.1).
fn build_operand<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    e: Expression<'d>,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    if e.kind() == ExpressionKind::AssertionInstance {
        build_instance(a, leaves, e, tree, scope)
    } else if let Some((method, inst)) = end_point_call(e) {
        build_end_point_guard(a, leaves, method, inst, tree, scope)
    } else {
        build_leaf(a, leaves, e, false, tree, scope)
    }
}

/// The sample of `!e` for the Boolean operand `e` of a goto/nonconsecutive
/// repetition (16.9.2): one tick on which `e` is false. A `.triggered`/`.matched`
/// application is read in flag form (it is an operand of `!`, so nothing flows
/// out of it, 16.10), which [`build_leaf`] already does for any expression that
/// holds one.
fn build_gap_operand<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    e: Expression<'d>,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    if e.kind() == ExpressionKind::AssertionInstance {
        return Err(LoweringError::unsupported_at(
            "goto/nonconsecutive repetition (`[->n:m]`/`[=n:m]`) cannot be applied to a named \
             sequence instance (LRM 16.9.2: only a Boolean expression may carry it)",
            scope,
        ));
    }
    build_leaf(a, leaves, e, true, tree, scope)
}

/// The maximal application of `.triggered`/`.matched` to `inst` as a whole
/// sequence operand (`... ##1 s.triggered ##1 ...`, T15): one guard-form
/// [`Transition::EndPoint`] edge, taken only on a tick `inst` reached its end
/// point and forking per distinct valuation of the local variables that flow out
/// (LRM 16.10). The fragment's flow assigns exactly those variables, so a later
/// read of one is legal (`seq2a`).
fn build_end_point_guard<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    method: ir::EndMethod,
    inst: Expression<'d>,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    let built = build_end_point(a, leaves, method, inst, true, tree, scope)?;
    let entry = a.new_state();
    let exit = a.new_state();
    a.add_edge(
        entry,
        None,
        Transition::EndPoint {
            point: built.point,
            flag: None,
        },
        exit,
    );
    let mut flow = Flow::identity();
    for v in built.flows_out {
        flow = flow.concat(&Flow::assign(v));
    }
    Ok(Fragment {
        entry,
        exits: vec![exit],
        empty: false,
        flow,
        clock: None,
    })
}

/// What [`build_end_point`] registered.
struct BuiltEndPoint {
    point: ir::EndPointId,
    /// The canonical slots of the caller's local variables that flow out of the
    /// application (empty unless it is maximal).
    flows_out: Vec<LocalVarId>,
}

/// Builds the automaton of the sequence instance `inst`, to which `method` is
/// applied, and registers it on `a` as an end point (T15, LRM 16.9.11, 16.13.5,
/// 16.13.6, 16.10).
///
/// The instance is built as an automaton of its OWN, by [`build_instance`] like
/// any other instance, with the usual rules:
///
/// - nothing is assigned where it starts (`flow_in` is empty): the instance runs
///   from any tick, so what its caller assigned before the application has no
///   relationship to its start (16.10), and a caller local it reads before it
///   assigns it is the usual "does not flow out" error (restriction 2 of 16.10);
/// - it runs in a frame of its own whose slots begin with `a`'s, so a slot id
///   means the same variable on both sides; the thread-local shadows of an
///   enclosing `and`/`intersect` are not applied to it;
/// - an instance with an `input`/`inout` local variable formal is an error
///   (16.8.2: the value is bound at the START of the match, and there is none);
/// - its own clocking event (`@(posedge sysclk)` in its declaration) is the clock
///   it ends on. `.triggered` needs it to be the clock of the context (16.9.11):
///   a different one is an error when both are known. `.matched` accepts any, the
///   whole point of the handoff (16.13.5). An instance with no event of its own
///   ends on the context's clock; whether the clock a `.triggered` context
///   INFERS agrees is the runtime's to check (T29).
///
/// For a `maximal` application the local variables that flow out of the instance
/// end are returned and recorded on the end point with the thread's physical slot
/// each is copied into.
fn build_end_point<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    method: ir::EndMethod,
    inst: Expression<'d>,
    maximal: bool,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<BuiltEndPoint, LoweringError> {
    let what = if method == ir::EndMethod::Triggered {
        "triggered"
    } else {
        "matched"
    };
    for g in inst.assertion_arguments() {
        if !g.port.assertion_port_is_local_var() {
            continue;
        }
        // A `local` formal defaults to `input` (16.8.2).
        let dir = g
            .port
            .assertion_port_direction()
            .unwrap_or(ArgumentDirection::In);
        if dir == ArgumentDirection::In || dir == ArgumentDirection::InOut {
            return Err(LoweringError::unsupported_at(
                &format!(
                    "the sequence method `.{what}` is applied to an instance of a sequence with \
                     the `input`/`inout` local variable formal argument `{}` (LRM 16.8.2: it is \
                     an error to apply `triggered` or `matched` to such an instance)",
                    g.port.name()
                ),
                scope,
            ));
        }
    }

    let prefix = a.local_vars.len() as u32;
    let mut sub = blank_automaton();
    sub.local_vars = a.local_vars.clone();
    let saved_flow = std::mem::take(&mut leaves.flow_in);
    let saved_shadows = std::mem::take(&mut leaves.shadows);
    let touched = leaves.touched.len();
    let built = build_instance(&mut sub, leaves, inst, tree, scope);
    leaves.touched.truncate(touched);
    leaves.shadows = saved_shadows;
    leaves.flow_in = saved_flow;
    let frag = built?;
    // The clocks the instance spans: `None` when it has no clocking event of its
    // own, and then it runs on the context's.
    let span = frag.clock;
    let own_clock = span.and_then(|s| leaves.clock_event(s.start));

    if method == ir::EndMethod::Triggered
        && let Some(s) = span
        && s.end != leaves.cur
    {
        return Err(LoweringError::unsupported_at(
            "the sequence method `.triggered` is applied to an instance that ends on a different \
             clock than the context it appears in (LRM 16.9.11, 16.13.5: the ending clock shall \
             be the same; `.matched` synchronises two clocks)",
            scope,
        ));
    }

    let flowing = frag.flow.flow_out(&VarSet::new());
    finish_automaton(&mut sub, frag);
    sub.entry_clock = span.map_or(leaves.cur, |s| s.start);
    let flows_out: Vec<LocalVarId> = if maximal {
        flowing.into_iter().filter(|v| v.0 < prefix).collect()
    } else {
        Vec::new()
    };
    let flow_out = flows_out
        .iter()
        .map(|&v| (v, leaves.phys_of(a, v)))
        .collect();

    let site = leaves.end_sites.len() as u32;
    leaves.end_sites.push(EndSite {
        method,
        instance: inst,
        clock: own_clock,
    });
    let point = a.new_end_point(ir::EndPoint {
        method,
        site,
        automaton: sub,
        flow_out,
    });
    Ok(BuiltEndPoint { point, flows_out })
}

/// A named sequence instance (16.8), or a reference to a sequence-typed formal
/// (which slang also models as a zero-argument instance wrapping the actual's
/// body): the instance's body is expanded in place -- slang has already
/// substituted nothing, the body is the declaration's, with the formals still
/// symbolic -- with the formals bound on [`LeafTable::env`] so that a `##`/
/// `[...]` bound naming a formal folds to its actual (see [`ranges`]'s
/// "Formal arguments"). Every repeat of the same instance builds its own copy
/// (and its own leaves): the instance's own `Fragment`s are never shared.
///
/// Local variables and `local` formals are handled by
/// [`begin_instance_locals`]/[`finish_instance_locals`] (T13).
///
/// Errors, all loud: a property instance (T19/T20's), a declaration already on the
/// instance's dependency chain (the cyclic dependency 16.8 forbids, including
/// the `s(s(a))`-inside-another-sequence shape slang's own check misses), a
/// sequence declared outside `tree`, and a runaway nesting depth.
fn build_instance<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    inst: Expression<'d>,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    // slang models a reference to a sequence formal as the ACTUAL's own
    // instance expression, placed where the reference is written (its syntax
    // is the formal's identifier). That actual was written at the call site,
    // so under 16.8's dependency graph it hangs off the call site's chain, not
    // off the chain of the body holding the reference: `outer(inner(a))` with
    // `outer(w): inner(w) ##1 c` expands `inner` for the actual while `inner`
    // is already being expanded for `outer`'s body, and that is no cycle.
    let origin = formal_reference_origin(tree.syntax(&inst), &leaves.env).map(<[_]>::to_vec);
    let Some(origin) = origin else {
        return expand_instance(a, leaves, inst, tree, scope);
    };
    let saved = std::mem::replace(&mut leaves.chain, origin);
    let built = expand_instance(a, leaves, inst, tree, scope);
    leaves.chain = saved;
    built
}

/// The dependency chain the actual of formal `name` is expanded under, when
/// `syntax` is an identifier naming a formal of the declaration it is written
/// in (a formal shadows every other name, so the match is unambiguous); `None`
/// for anything else, i.e. a real instance written in a body.
fn formal_reference_origin<'e>(
    syntax: Option<Node<'_>>,
    env: &'e ranges::FormalEnv,
) -> Option<&'e [ranges::ChainLink]> {
    let node = syntax?;
    let ident = IdentifierNameSyntax::cast(node)?.identifier()?;
    env.origin_of(&key(node), ident.value_text())
}

/// [`build_instance`] once `leaves.chain` is the chain `inst` hangs off.
fn expand_instance<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    inst: Expression<'d>,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    if !inst.expr_type().is_some_and(|t| t.is_sequence_type()) {
        return Err(LoweringError::unsupported_at(
            "a property instance stands where a sequence is required (LRM 16.12.1: a property \
             is not a sequence_expr, so it cannot be an operand of a sequence operator, a \
             delay or a repetition; a property is built by `build_property`)",
            scope,
        ));
    }
    let args = inst.assertion_arguments();
    let body = inst
        .as_sem_node()
        .children()
        .into_iter()
        .find_map(|c| c.as_assertion_expr())
        .ok_or_else(|| {
            LoweringError::unsupported_at(
                "sva automaton builder: a sequence instance has no body AssertionExpr",
                scope,
            )
        })?;

    // A sequence declared in a clocking block with no event of its own is
    // clocked by the block's (16.18).
    let block_event = if body.kind() == AssertionExprKind::Clocking {
        None
    } else {
        enclosing_clocking_event(body, tree, scope)?
    };
    let entered = enter_instance(a, leaves, inst, &args, true, tree, scope)?;
    let built = match block_event {
        Some(event) => build_clocked(a, leaves, event, body, tree, scope),
        None => build_assertion(a, leaves, body, tree, scope),
    };
    let locals = leave_instance(leaves, entered);
    match locals {
        None => built,
        Some(l) => finish_instance_locals(a, leaves, l, built?, scope),
    }
}

/// What [`enter_instance`] pushed, for [`leave_instance`] to take back.
struct EnteredInstance<'d> {
    chain_len: usize,
    pushed: bool,
    caller_flow: VarSet,
    locals: Option<InstanceLocals<'d>>,
}

/// The part of expanding a named sequence or property instance that precedes its
/// body (16.8, 16.8.2, 16.12.19): checks the nesting depth, binds the formals to
/// their actuals on [`LeafTable::env`] and the dependency chain, mints the local
/// variable slots and builds the initialisation of the `local input` formals and
/// declared locals in the CALLER's frame and flow set, then makes the body's
/// flow set current and counts the nesting.
///
/// `check_cycle` rejects an instance of a declaration already on the chain,
/// 16.8's cyclic dependency among sequences; a property instance passes `false`
/// because a recursive property (16.12.17) is legal, and `build_property`
/// resolves it itself.
fn enter_instance<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    inst: Expression<'d>,
    args: &[sv_lang::AssertionInstanceArg<'d>],
    check_cycle: bool,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<EnteredInstance<'d>, LoweringError> {
    if leaves.instance_depth >= MAX_INSTANCE_DEPTH {
        return Err(LoweringError::unsupported_at(
            &format!(
                "named sequence or property instances nest more than {MAX_INSTANCE_DEPTH} deep \
                 (a cyclic dependency among named sequences, LRM 16.8, a recursive property \
                 that does not terminate, or an absurd design)"
            ),
            scope,
        ));
    }
    let frame = match args.first() {
        None => None,
        Some(first) => {
            let seq = first.port.parent().ok_or_else(|| {
                LoweringError::unsupported_at(
                    "sva automaton builder: a formal argument has no parent declaration",
                    scope,
                )
            })?;
            let name = seq.name().to_string();
            let decl = key(tree.syntax(&seq).ok_or_else(|| {
                LoweringError::unsupported_at(
                    &format!(
                        "`{name}` has no syntax node in any source file of the compilation, so \
                         its formals cannot be bound (a declaration slang made up)"
                    ),
                    scope,
                )
            })?);
            if check_cycle && leaves.chain.iter().any(|(_, d)| *d == decl) {
                let walk: Vec<String> = leaves
                    .chain
                    .iter()
                    .map(|(n, _)| n.as_str())
                    .chain(std::iter::once(name.as_str()))
                    .map(|n| format!("`{n}`"))
                    .collect();
                return Err(LoweringError::unsupported_at(
                    &format!(
                        "cyclic dependency among named sequences (LRM 16.8): `{name}` is \
                         instantiated while it is already being expanded ({})",
                        walk.join(" -> ")
                    ),
                    scope,
                ));
            }
            // What an instance written as an actual of THIS instance hangs off:
            // this instance's chain plus this declaration (16.8: an instance of
            // X that instantiates Y within an actual argument is an edge X ->
            // Y). An actual that merely forwards a formal of the caller keeps
            // that formal's own chain.
            let mut here = leaves.chain.clone();
            here.push((name.clone(), decl.clone()));
            // Every actual is folded in the CALLER's environment: the frame
            // being built is not pushed yet.
            let mut bindings = Vec::new();
            let mut origins = Vec::new();
            for g in args {
                let actual = actual_syntax(g.actual, tree);
                bindings.push((
                    g.port.name().to_string(),
                    ranges::bind_actual(actual, formal_cast(&g.port), scope, &leaves.env),
                ));
                let origin = formal_reference_origin(actual, &leaves.env)
                    .map_or_else(|| here.clone(), <[_]>::to_vec);
                origins.push((g.port.name().to_string(), origin));
            }
            Some((
                ranges::FormalFrame {
                    name: name.clone(),
                    decl: decl.clone(),
                    bindings,
                    origins,
                },
                (name, decl),
            ))
        }
    };

    // The locals' slots, the actuals of the `local input`/`inout` formals and the
    // declaration initializers are all built in the CALLER's frame and flow set,
    // before the body's own frame is pushed.
    let caller_flow = leaves.flow_in.clone();
    let locals = begin_instance_locals(a, leaves, inst, args, scope)?;
    if let Some(l) = &locals {
        leaves.flow_in = l.x_body.clone();
    }

    let chain_len = leaves.chain.len();
    let pushed = frame.is_some();
    if let Some((f, link)) = frame {
        leaves.env.push(f);
        leaves.chain.push(link);
    }
    leaves.instance_depth += 1;
    leaves.inferred.push(leaves.clocks[leaves.cur.0 as usize]);
    Ok(EnteredInstance {
        chain_len,
        pushed,
        caller_flow,
        locals,
    })
}

/// Undoes [`enter_instance`] once the body is built, handing back the locals
/// the caller finishes (see [`finish_instance_locals`]).
fn leave_instance<'d>(
    leaves: &mut LeafTable<'d>,
    entered: EnteredInstance<'d>,
) -> Option<InstanceLocals<'d>> {
    leaves.instance_depth -= 1;
    leaves.inferred.pop();
    leaves.chain.truncate(entered.chain_len);
    if entered.pushed {
        leaves.env.pop();
    }
    leaves.flow_in = entered.caller_flow;
    entered.locals
}

/// What a named sequence instance with local variables or `local` formals
/// needs around its body (T13, LRM 16.8.2, 16.10).
struct InstanceLocals<'d> {
    /// The local variable symbols of the instance (the `local` formals' body
    /// copies first, then the declared locals) and the canonical slot minted for
    /// each, parallel.
    syms: Vec<Symbol<'d>>,
    slots: Vec<LocalVarId>,
    /// The canonical slots minted for this expansion: they go out of scope with
    /// it, so they leave the instance's flow sets.
    own: VarSet,
    /// The initialisation assignments in the order the LRM requires (16.8.2:
    /// `local input`/`inout` formals first, then the declared locals in
    /// declaration order): `LocalVarWrite` actions run before the body.
    init: Vec<Transition>,
    /// What flows in to the body: the caller's set, the initialised formals and
    /// the declared locals that have an initializer.
    x_body: VarSet,
    /// `(formal slot, the caller's local it writes back to, the formal's name)`
    /// for every `local output`/`inout` formal, in argument order.
    write_back: Vec<(LocalVarId, LocalVarId, String)>,
    /// `leaves.scope.len()` before the locals were declared.
    scope_len: usize,
}

/// The local variable an actual of an `output`/`inout` formal names, looking
/// through the `Conversion` slang wraps a differently typed actual in (the value
/// is cast back to the actual's type at write-back, 16.8.2).
fn local_actual<'d>(actual: SemNode<'d>) -> Option<Symbol<'d>> {
    let mut e = actual.as_expression()?;
    while e.kind() == ExpressionKind::Conversion {
        e = e
            .as_sem_node()
            .children()
            .into_iter()
            .next()?
            .as_expression()?;
    }
    if e.kind() != ExpressionKind::NamedValue {
        return None;
    }
    e.referenced_symbol()
        .filter(|s| s.kind() == SymbolKind::LocalAssertionVar)
}

/// The caller-side half of a named sequence instance's local variables: mints a
/// canonical slot for every local the body declares (the `local` formals' body
/// copies and the declared variables, in that order, as slang lists them),
/// builds the leaves of the initialisation assignments and records them as the
/// ordered action list in [`InstanceLocals::init`]. `None` for an instance that
/// has no local variable at all.
///
/// LRM 16.8.2: the actual of a `local input`/`inout` formal is evaluated in the
/// caller and CAST to the formal's type to give the formal's initial value; an
/// `output` formal starts unassigned. The declared locals' initializers run
/// after (16.10: "assertion_variable_declarations ... in the order they appear"),
/// and may read the formals and the locals declared before them.
fn begin_instance_locals<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    inst: Expression<'d>,
    args: &[sv_lang::AssertionInstanceArg<'d>],
    scope: &Symbol<'d>,
) -> Result<Option<InstanceLocals<'d>>, LoweringError> {
    let syms = inst.assertion_local_vars();
    let local_formals: Vec<_> = args
        .iter()
        .filter(|g| g.port.assertion_port_is_local_var())
        .collect();
    if syms.is_empty() {
        if let Some(g) = local_formals.first() {
            return Err(LoweringError::unsupported_at(
                &format!(
                    "sva automaton builder: `local` formal `{}` has no local variable in the \
                     sequence body",
                    g.port.name()
                ),
                scope,
            ));
        }
        return Ok(None);
    }
    let scope_len = leaves.scope.len();
    let mut own = VarSet::new();
    let mut slots = Vec::with_capacity(syms.len());
    for sym in &syms {
        let slot = leaves.declare(a, *sym, scope)?;
        own.insert(slot);
        slots.push(slot);
    }
    let slot_of = |name: &str| -> Option<LocalVarId> {
        syms.iter().position(|s| s.name() == name).map(|i| slots[i])
    };

    let mut x = leaves.flow_in.clone();
    let mut init = Vec::new();
    let mut write_back = Vec::new();
    let mut bound = BTreeSet::new();
    for g in local_formals {
        let name = g.port.name().to_string();
        let slot = slot_of(&name).ok_or_else(|| {
            LoweringError::unsupported_at(
                &format!(
                    "sva automaton builder: `local` formal `{name}` has no local variable in the \
                     sequence body"
                ),
                scope,
            )
        })?;
        // `local` formals default to `input` (16.8.2).
        let dir = g
            .port
            .assertion_port_direction()
            .unwrap_or(ArgumentDirection::In);
        match dir {
            ArgumentDirection::Ref => {
                return Err(LoweringError::unsupported_at(
                    &format!(
                        "`local` formal `{name}` is a `ref` argument; a local variable formal \
                         argument is `input`, `inout` or `output` (LRM 16.8.2)"
                    ),
                    scope,
                ));
            }
            ArgumentDirection::In | ArgumentDirection::InOut => {
                // The caller evaluates the actual: its own reads must flow.
                leaves.flow_in = x.clone();
                let actual = g.actual.as_expression().ok_or_else(|| {
                    LoweringError::unsupported_at(
                        &format!("the actual of `local` formal `{name}` is not an expression"),
                        scope,
                    )
                })?;
                let phys = leaves.phys_of(a, slot);
                for (var, value) in leaves.slot_leaves(a, phys, actual, None, scope)? {
                    init.push(Transition::LocalVarWrite { var, value });
                }
                x.insert(slot);
            }
            ArgumentDirection::Out => {}
        }
        if matches!(dir, ArgumentDirection::Out | ArgumentDirection::InOut) {
            let target = local_actual(g.actual).ok_or_else(|| {
                LoweringError::unsupported_at(
                    &format!(
                        "the actual of the `{}` formal `{name}` must be a local variable (LRM \
                         16.8.2)",
                        if dir == ArgumentDirection::Out {
                            "output"
                        } else {
                            "inout"
                        }
                    ),
                    scope,
                )
            })?;
            let actual = leaves.resolve(target, scope)?;
            // 16.8.2: the same local bound to two inout/output formals of one
            // instance is an error (the two copies would race on it). A local
            // bound to outputs of two different instances is legal.
            if !bound.insert(actual) {
                return Err(LoweringError::unsupported_at(
                    &format!(
                        "the local variable `{}` is bound to two or more `inout`/`output` \
                         `local` formal arguments of one instance, the second being `{name}` \
                         (LRM 16.8.2)",
                        target.name()
                    ),
                    scope,
                ));
            }
            write_back.push((slot, actual, name));
        }
    }
    for (sym, &slot) in syms.iter().zip(&slots) {
        if let Some(initializer) = sym.initializer() {
            leaves.flow_in = x.clone();
            let phys = leaves.phys_of(a, slot);
            for (var, value) in leaves.slot_leaves(a, phys, initializer, None, scope)? {
                init.push(Transition::LocalVarWrite { var, value });
            }
            x.insert(slot);
        }
    }
    Ok(Some(InstanceLocals {
        syms,
        slots,
        own,
        init,
        x_body: x,
        write_back,
        scope_len,
    }))
}

/// The other half: wraps the built `body` of an instance whose locals
/// [`begin_instance_locals`] set up. Prefixes the initialisation actions to the
/// entry, suffixes the write-back of every `output`/`inout` formal to the exits,
/// and composes the flow: the instance's own slots leave every set, and the
/// caller's locals the formals write back to count as assigned.
///
/// LRM 16.8.2: it is an error if an `inout`/`output` formal is not assigned on
/// every match (F.5.4: it must flow out of the body), and an error to instantiate
/// such a sequence where it admits an empty match (there is no match end to
/// write back at).
fn finish_instance_locals<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    il: InstanceLocals<'d>,
    body: Fragment,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    leaves.scope.truncate(il.scope_len);
    if !il.write_back.is_empty() {
        if body.empty {
            return Err(LoweringError::unsupported_at(
                "a named sequence with a `local` output or inout formal argument admits an \
                 empty match, which has no end to write the formal back at (LRM 16.8.2)",
                scope,
            ));
        }
        let out = body.flow.flow_out(&il.x_body);
        for (formal, _, name) in &il.write_back {
            if !out.contains(formal) {
                return Err(not_flowing(name, scope));
            }
        }
    }
    let mut flow = body.flow.scoped(&il.own);
    let mut copies = Vec::with_capacity(il.write_back.len());
    for &(formal, actual, _) in &il.write_back {
        let dst = leaves.phys_of(a, actual);
        copies.push(Transition::LocalVarCopy { dst, src: formal });
        flow = flow.concat(&Flow::assign(actual));
    }
    let entry = if body.exits.is_empty() {
        body.entry
    } else {
        prefix_actions(a, il.init, body.entry)
    };
    let exits = suffix_actions(a, body.exits, copies);
    Ok(Fragment {
        entry,
        exits,
        empty: body.empty,
        flow,
        clock: body.clock,
    })
}

/// The cast a TYPED integral formal applies to its actual (16.8.1); `None` for
/// an untyped formal and for the sequence/event/property formal types.
fn formal_cast(port: &Symbol<'_>) -> Option<ranges::FormalCast> {
    let ty = port.declared_type()?;
    if !ty.is_integral() || ty.is_untyped_type() {
        return None;
    }
    Some(ranges::FormalCast {
        width: ty.bit_width(),
        signed: ty.is_signed(),
    })
}

/// The syntax of an actual argument as the caller wrote it. slang wraps an
/// actual converted to a typed formal's type in a `Conversion` that has no
/// syntax of its own; the written expression is its operand.
fn actual_syntax<'t>(actual: SemNode<'_>, tree: Trees<'t>) -> Option<Node<'t>> {
    let e = actual.as_expression()?;
    if let Some(s) = tree.syntax(&e) {
        return Some(s);
    }
    if e.kind() == ExpressionKind::Conversion {
        let inner = e.as_sem_node().children().into_iter().next()?;
        return actual_syntax(inner, tree);
    }
    None
}

/// A `Clocking` node inside a sequence (T28): a named sequence's body is
/// `@(event) body` (the declaration's clocking event, 16.8/16.16), and an operand
/// of a multiclocked sequence is `@(event) s` (16.13.1). The event is interned
/// ([`LeafTable::intern_clock`], by [`events_equivalent`] -- the resolved
/// structure, not the text: the declaration's `@(e)` is the same text for every
/// actual) and is the context clock while the body is built, so the body's
/// unclocked operands are evaluated on it. The result is stamped with the clocks
/// the body spans: the body's own when it changed clock inside, else this one.
fn build_clocking<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    expr: AssertionExpr<'d>,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    let ch = super::op::clocking_children(expr, scope)?;
    build_clocked(a, leaves, ch.event, ch.body, tree, scope)
}

/// `body` built with `event` as the context clock (see [`build_clocking`]).
fn build_clocked<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    event: SemNode<'d>,
    body: AssertionExpr<'d>,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    let id = leaves.resolve_clock(event, scope)?;
    let saved = std::mem::replace(&mut leaves.cur, id);
    let built = build_assertion(a, leaves, body, tree, scope);
    leaves.cur = saved;
    let mut frag = built?;
    frag.clock = Some(frag.clock.unwrap_or(Span::single(id)));
    Ok(frag)
}

/// The clocking event of the clocking block a property or sequence is declared
/// in, for the declaration whose body is `body`. LRM 16.18's example makes
/// `a2: assert property (cb_with_input.p1)` equivalent to the clocked `a1`: a
/// property declared in a clocking block (`clocking_item ::= ...
/// assertion_item_declaration`, 14.3) is clocked by that block's event. `None`
/// for a declaration outside any clocking block. An error when the clocking
/// block is not one of the instance `scope` is in (an assertion referring into
/// another instance's clocking block): its symbol is not reachable from here.
pub(super) fn enclosing_clocking_event<'d>(
    body: AssertionExpr<'d>,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<Option<SemNode<'d>>, LoweringError> {
    use sv_lang::kinds::SyntaxKind;
    let declaration_of = |mut node: Node<'_>| -> Option<std::ops::Range<usize>> {
        loop {
            if node.kind() == SyntaxKind::ClockingDeclaration {
                return Some(key(node));
            }
            node = node.parent()?;
        }
    };
    let Some(range) = tree.syntax(&body).and_then(declaration_of) else {
        return Ok(None);
    };
    let inst = sv_sim_sim::netlist::enclosing_instance_body(scope).unwrap_or(*scope);
    // Two instances of one checker are flattened into this one instance, and
    // each contributes a clocking block of the same declaration: the one whose
    // lexical parent encloses the assertion is its own.
    let mut chain = Vec::new();
    let mut up = Some(*scope);
    while let Some(s) = up {
        chain.push(s);
        up = s.parent();
    }
    let candidates: Vec<Symbol<'d>> = sv_sim_sim::netlist::module_items(&inst)
        .into_iter()
        .filter(|m| m.kind() == SymbolKind::ClockingBlock)
        .filter(|cb| {
            tree.syntax(cb)
                .and_then(declaration_of)
                .is_some_and(|r| r == range)
        })
        .collect();
    let cb = candidates
        .iter()
        .find(|cb| cb.parent().is_some_and(|p| chain.contains(&p)))
        .or_else(|| candidates.first())
        .copied();
    let Some(cb) = cb else {
        return Err(LoweringError::unsupported_at(
            "a property or sequence declared in a clocking block of another instance than the \
             assertion's is not executable yet (its clocking event is not reachable from the \
             assertion's scope)",
            scope,
        ));
    };
    cb.clocking_block_event().map(Some).ok_or_else(|| {
        LoweringError::unsupported_at(
            &format!("the clocking block `{}` has no clocking event", cb.name()),
            scope,
        )
    })
}

/// Whether a clocking event is exactly the `$inferred_clock` call (T31): an
/// event control whose only operand is that call, or the call itself.
pub(super) fn is_inferred_clock_event(event: SemNode<'_>) -> bool {
    if let Some(e) = event.as_expression() {
        return e.call_subroutine_name().as_deref() == Some("$inferred_clock");
    }
    match event.children().as_slice() {
        [only] => is_inferred_clock_event(*only),
        _ => false,
    }
}

/// Whether two clocking events are the same event: the same edge of the same
/// expression, with the same `iff` condition. Exact, and conservative in the
/// loud direction -- anything not provably identical is "different", which
/// surfaces as the multiclock error rather than a silently flattened clock.
///
/// Expression operands are compared by slang's own structural equivalence
/// (`Expression::isEquivalentTo`: operator, literal values, select indices,
/// resolved symbols; an expression kind it cannot compare is unequal). The
/// timing-control layers above them (`@(a, b)` lists, `posedge x iff c`) are
/// compared here: kind, edge, then every child in order. Any other node kind
/// is unequal.
pub(super) fn events_equivalent(a: SemNode<'_>, b: SemNode<'_>) -> bool {
    match (a.as_expression(), b.as_expression()) {
        (Some(x), Some(y)) => return x.is_equivalent_to(&y),
        (None, None) => {}
        _ => return false,
    }
    let (Some(x), Some(y)) = (a.as_timing_control(), b.as_timing_control()) else {
        return false;
    };
    if x.kind() != y.kind() || x.edge() != y.edge() {
        return false;
    }
    let (xs, ys) = (a.children(), b.children());
    xs.len() == ys.len() && xs.iter().zip(&ys).all(|(p, q)| events_equivalent(*p, *q))
}

/// `AssertionExprKind::SequenceConcat` (16.7, Syntax 16-4): a `##`-chain.
/// Semantic children are `[first, elem_0, elem_1, ...]` (confirmed live,
/// [`ranges::sequence_range_of`]'s own doc comment), or, when the chain opens
/// with a delay (`##2 b`, `##[1:3] a ##1 b`), just `[elem_0, elem_1, ...]`
/// with no `first` (also confirmed live: `children().len() ==
/// delays.len()`). Per-element delay bounds come from
/// [`ranges::sequence_range_of`]'s `SequenceConcat` arm (one entry per `##`,
/// in order).
///
/// The chain is folded left to right through [`concat`] (`##` is
/// associative, 16.9.2.1 / Annex F). A leading delay `##[m:n] R` is
/// `1[*m:n] ##1 R` = `empty ##[m+1:n+1] R`, so the fold starts from the empty
/// fragment with the first delay widened by one.
fn build_concat<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    expr: AssertionExpr<'d>,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    let kids = expr.children();
    let delays = ranges::sequence_range_of_in(expr, tree, scope, &leaves.env)?;
    let leading = kids.len() == delays.len();
    if !leading && kids.len() != delays.len() + 1 {
        return Err(LoweringError::unsupported_at(
            &format!(
                "sva automaton builder: SequenceConcat has {} semantic children but {} \
                 recovered delay(s) -- expected children.len() == delays.len() (a leading \
                 delay) or delays.len() + 1",
                kids.len(),
                delays.len()
            ),
            scope,
        ));
    }

    // 16.10: each operand starts with what flows out of the ones before it
    // (`flow(flow(X, R1), R2)`, F.5.4), so a local variable a match item
    // assigned in one operand is readable in the next.
    let x0 = leaves.flow_in.clone();
    let (mut frag, first_operand) = if leading {
        (empty_fragment(a), 0)
    } else {
        (build_node(a, leaves, kids[0], tree, scope)?, 1)
    };
    for (i, delay) in delays.iter().enumerate() {
        if delay.max.is_some_and(|max| delay.min > max) {
            return Err(LoweringError::unsupported_at(
                &format!(
                    "sva automaton builder: `##` delay range has min ({}) > max ({})",
                    delay.min,
                    delay.max.unwrap_or_default()
                ),
                scope,
            ));
        }
        let mut d = *delay;
        if leading && i == 0 {
            // `##[m:n] R` = `empty ##[m+1:n+1] R`.
            let widen = |v: u32| {
                v.checked_add(1).ok_or_else(|| {
                    LoweringError::unsupported_at(
                        "sva automaton builder: leading `##` delay bound overflows u32",
                        scope,
                    )
                })
            };
            d = SequenceRangeValue {
                min: widen(d.min)?,
                max: d.max.map(widen).transpose()?,
            };
        }
        leaves.flow_in = frag.flow.flow_out(&x0);
        let next = build_node(a, leaves, kids[i + first_operand], tree, scope)?;
        frag = concat_clocked(a, leaves, frag, d, next, scope)?;
    }
    leaves.flow_in = x0;
    Ok(frag)
}

/// `left ##d right` where the operands may be clocked differently (16.13.1, T28).
///
/// When the clock the left operand ends in is the one the right begins in, this is
/// the plain [`concat`]: the delay counts ticks of that clock. Otherwise the
/// operands are two maximal singly clocked subsequences and the delay must be
/// exactly `##1` or `##0` (16.13.1: "`##1` ... the nearest strictly subsequent
/// tick of the clock of the second operand; `##0` ... the nearest possibly
/// overlapping tick"); a range or a longer delay between them is an error, as is
/// an operand that admits an empty match (16.13.1: a maximal singly clocked
/// subsequence "shall admit only nonempty matches"). The join is one
/// [`Transition::ClockSync`] edge from every exit of the left operand.
///
/// The result's [`Span`] runs from where the left begins to where the right ends,
/// and is `multi` when either operand or this join changes clock; `None` (the
/// context clock throughout) when neither operand names a clock.
fn concat_clocked<'d>(
    a: &mut ir::Automaton,
    leaves: &LeafTable<'d>,
    l: Fragment,
    d: SequenceRangeValue,
    r: Fragment,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    let ls = l.clock.unwrap_or(Span::single(leaves.cur));
    let rs = r.clock.unwrap_or(Span::single(leaves.cur));
    let stamped = if l.clock.is_none() && r.clock.is_none() {
        None
    } else {
        Some(Span {
            start: ls.start,
            end: rs.end,
            multi: ls.multi || rs.multi || ls.end != rs.start,
        })
    };
    if ls.end == rs.start {
        let mut f = concat(a, l, d, r);
        f.clock = stamped;
        return Ok(f);
    }
    let strict = match (d.min, d.max) {
        (0, Some(0)) => false,
        (1, Some(1)) => true,
        _ => {
            return Err(LoweringError::unsupported_at(
                "a `##` delay between differently clocked operands of a multiclocked sequence \
                 must be exactly `##1` or `##0` (LRM 16.13.1: the first synchronises to the \
                 nearest strictly subsequent tick of the second operand's clock, the second to \
                 the nearest possibly overlapping one); a range or a longer delay has no \
                 meaning across a clock change",
                scope,
            ));
        }
    };
    if l.empty || r.empty {
        return Err(LoweringError::unsupported_at(
            "a maximal singly clocked subsequence of a multiclocked sequence admits an empty \
             match (LRM 16.13.1: it shall admit only nonempty matches), e.g. a leading `##n` \
             delay or a `[*0]`/`[*0:n]` repetition next to a clock change",
            scope,
        ));
    }
    let flow = l.flow.concat(&r.flow);
    for &e in &l.exits {
        a.add_edge(
            e,
            None,
            Transition::ClockSync {
                to: rs.start,
                strict,
            },
            r.entry,
        );
    }
    Ok(Fragment {
        entry: l.entry,
        exits: r.exits,
        empty: false,
        flow,
        clock: stamped,
    })
}

/// The one clock of the operands of a sequence operator other than `##` (16.13.1:
/// `and`/`or`/`intersect`/`throughout`/`within`, `first_match` and repetition
/// apply to singly clocked sequences only, on the same clock): the span they all
/// share, resolved against the context clock, as stamped on the result. `None`
/// when no operand names a clock.
fn join_clocks<'d>(
    leaves: &LeafTable<'d>,
    operands: &[&Fragment],
    what: &str,
    scope: &Symbol<'d>,
) -> Result<Option<Span>, LoweringError> {
    if operands.iter().all(|f| f.clock.is_none()) {
        return Ok(None);
    }
    let resolved: Vec<Span> = operands
        .iter()
        .map(|f| f.clock.unwrap_or(Span::single(leaves.cur)))
        .collect();
    let first = resolved[0];
    if resolved.iter().any(|s| s.multi || s.start != first.start) {
        return Err(LoweringError::unsupported_at(
            &format!(
                "the operands of `{what}` are clocked differently or are multiclocked \
                 sequences (LRM 16.13.1: a multiclocked sequence is built only with `##1`/`##0` \
                 between singly clocked subsequences; `{what}` needs its operands on one clock)"
            ),
            scope,
        ));
    }
    Ok(Some(first))
}

/// The one clock of the single operand of `first_match` or a repetition (16.13.1);
/// a multiclocked operand is an error.
fn single_clock(f: &Fragment, what: &str) -> Result<Option<Span>, String> {
    if f.clock.is_some_and(|s| s.multi) {
        return Err(format!(
            "{what} is applied to a multiclocked sequence (LRM 16.13.1: only a singly clocked \
             sequence can be repeated or have its first match selected; the match set of a \
             clock change inside a repeated operand is not defined by Annex F)"
        ));
    }
    Ok(f.clock)
}

/// `left ##d right` over fragments, with 16.9.2.1's empty-match rules (see
/// the module doc comment). `d.min <= d.max` is the caller's invariant.
///
/// Each operand is `ne ∪ ε` (its nonempty matches, plus the empty match when
/// `empty`), so the result is the union of up to four pairings, each wired
/// by its own rule. `k` below is the concrete delay count drawn from `d`:
///
/// - **A** `ne ##k ne'`, `k` in `d` (including `k == 0`, a fusion): every
///   left exit gets a `Delay{d}` edge to the right entry.
/// - **B** `ε ##k ne'`, `k >= 1` (rule 3, and rule 1 for `k == 0`: absent):
///   the right operand starts `k-1` ticks after the start, a `Delay` edge
///   from the (new) start state.
/// - **C** `ne ##k ε`, `k >= 1` (rule 4; rule 2 for `k == 0`: absent): the
///   match ends `k-1` ticks after the left operand did, at a fresh state
///   reached by a `Delay` edge from every left exit.
/// - **D** `ε ##k ε`, `k >= 2` (`k == 1` is the empty match, `k == 0` is
///   absent): `k-1` vacuous ticks from the start, ending at the same fresh
///   state as C.
///
/// The result admits the empty match iff both operands do and `1` is in `d`.
/// When the left operand admits the empty match, a fresh start state holds
/// the epsilon edge into the left operand's own paths (A/C) next to B/D's
/// edges -- both operands' empty matches begin on the same tick.
fn concat(a: &mut ir::Automaton, l: Fragment, d: SequenceRangeValue, r: Fragment) -> Fragment {
    // The F.5.4 triple composes the same way whatever shape the states take
    // (`concat_shape` may hand an operand back unchanged, flow included).
    let flow = l.flow.concat(&r.flow);
    let mut f = concat_shape(a, l, d, r);
    f.flow = flow;
    f
}

/// The states of [`concat`]; its result's `flow` is the caller's to set.
fn concat_shape(
    a: &mut ir::Automaton,
    l: Fragment,
    d: SequenceRangeValue,
    r: Fragment,
) -> Fragment {
    // `empty ##1 R` = R and `L ##1 empty` = L (rules 3 and 4 at n = 1,
    // exactly). Besides being the identity these keep the common
    // `a[*0:3] ##1 b` automaton free of vacuous bridge states.
    if d.min == 1 && d.max == Some(1) {
        if l.empty && l.exits.is_empty() {
            return r;
        }
        if r.empty && r.exits.is_empty() {
            return l;
        }
    }

    let ne_l = !l.exits.is_empty();
    let ne_r = !r.exits.is_empty();
    // The delay counts `k >= 1` / `k >= 2` that `d` admits.
    let k1_min = d.min.max(1);
    let k1_ok = d.max.is_none_or(|m| m >= k1_min);
    let k2_min = d.min.max(2);
    let k2_ok = d.max.is_none_or(|m| m >= k2_min);

    let path_a = ne_l && ne_r;
    let path_b = l.empty && ne_r && k1_ok;
    let path_c = ne_l && r.empty && k1_ok;
    let path_d = l.empty && r.empty && k2_ok;

    let start = if l.empty {
        let s = a.new_state();
        if path_a || path_c {
            a.add_edge(s, None, Transition::Epsilon, l.entry);
        }
        Some(s)
    } else {
        None
    };
    let entry = start.unwrap_or(l.entry);

    if path_a {
        for &e in &l.exits {
            a.add_edge(
                e,
                None,
                Transition::Delay {
                    min: d.min,
                    max: d.max,
                },
                r.entry,
            );
        }
    }
    if path_b {
        let s = start.expect("path_b implies l.empty");
        a.add_edge(
            s,
            None,
            Transition::Delay {
                min: k1_min - 1,
                max: d.max.map(|m| m - 1),
            },
            r.entry,
        );
    }
    let tail = (path_c || path_d).then(|| a.new_state());
    if let Some(t) = tail {
        if path_c {
            for &e in &l.exits {
                a.add_edge(
                    e,
                    None,
                    Transition::Delay {
                        min: k1_min - 1,
                        max: d.max.map(|m| m - 1),
                    },
                    t,
                );
            }
        }
        if path_d {
            let s = start.expect("path_d implies l.empty");
            a.add_edge(
                s,
                None,
                Transition::Delay {
                    min: k2_min - 2,
                    max: d.max.map(|m| m - 2),
                },
                t,
            );
        }
    }

    let mut exits = Vec::new();
    if path_a || path_b {
        exits.extend(r.exits.iter().copied());
    }
    exits.extend(tail);
    Fragment {
        entry,
        exits,
        empty: l.empty && r.empty && d.min <= 1 && d.max.is_none_or(|m| m >= 1),
        flow: Flow::identity(),
        clock: None,
    }
}

/// `AssertionExprKind::SequenceWithMatch` -- slang's one wrapper kind for
/// `( sequence_expr { match_item } ) [ sequence_abbrev ]` (16.7's own
/// grammar for a parenthesized sequence expression), covering THREE
/// distinct source shapes that all bind to this same semantic kind
/// (confirmed live, this task's own investigation): a bare repetition
/// wrapper around a compound sub-sequence with no match items at all
/// (`(a##2b)[*3]`), a match-item-bearing sequence with no repetition
/// (`(a##1b, cnt++)`), or both together. The repetition (if any) and the
/// match-item list (if any) are both purely syntactic here too -- recovered
/// from `tree.syntax(&expr)` cast to [`ParenthesizedSequenceExprSyntax`] (after
/// peeling plain outer parens: `((a##1b)[*2])`), never a semantic child; the
/// semantic children are exactly `[sub_sequence, match_item_expr, ...]`
/// (confirmed live), so the sub-sequence is the one child that casts to
/// `AssertionExpr`.
///
/// Sequence match items (16.10/16.11) are built by [`build_match_items`], once
/// per repeated copy when the unit is repeated (`(a[->1], x += d)[*4]`).
/// `[->]`/`[=]` (goto/nonconsecutive) repetition applied to a sequence that
/// ALSO carries a match item is flatly illegal per 16.9.2/16.10's own worked
/// example (`(b, v=e)[->2]`) -- that specific combination is rejected with
/// its own, specific error.
fn build_sequence_with_match<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    expr: AssertionExpr<'d>,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    let syn = tree.syntax(&expr).ok_or_else(|| {
        LoweringError::unsupported_at(
            "sva automaton builder: SequenceWithMatch node has no syntax node in the given tree",
            scope,
        )
    })?;
    let syn = ranges::peel_sequence_parens(syn);
    let paren = ParenthesizedSequenceExprSyntax::cast(syn).ok_or_else(|| {
        LoweringError::unsupported_at(
            &format!(
                "sva automaton builder: expected ParenthesizedSequenceExprSyntax for a \
                 SequenceWithMatch node, found {:?}",
                syn.kind()
            ),
            scope,
        )
    })?;

    let kids = expr.children();
    let sub_kids: Vec<SemNode<'d>> = kids
        .iter()
        .copied()
        .filter(|c| c.as_assertion_expr().is_some())
        .collect();
    let [sub_node] = sub_kids.as_slice() else {
        return Err(LoweringError::unsupported_at(
            &format!(
                "sva automaton builder: SequenceWithMatch must have exactly one sub-sequence \
                 child, found {}",
                sub_kids.len()
            ),
            scope,
        ));
    };
    let sub = sub_node
        .as_assertion_expr()
        .expect("filtered above to only AssertionExpr-castable nodes");
    let has_match_items = paren.match_list().is_some();
    let items: Vec<SemNode<'d>> = kids
        .iter()
        .copied()
        .filter(|c| c.as_assertion_expr().is_none())
        .collect();

    match paren.repetition() {
        None => {
            if has_match_items {
                return build_match_items(a, leaves, sub, &items, tree, scope);
            }
            build_assertion(a, leaves, sub, tree, scope)
        }
        Some(rep) => {
            let op_text = rep.op().map(|t| t.text());
            if has_match_items && matches!(op_text, Some("->") | Some("=")) {
                return Err(LoweringError::unsupported_at(
                    "goto/nonconsecutive repetition (`[->n:m]`/`[=n:m]`) applied to a sequence \
                     that also carries a match item is illegal (LRM 16.9.2/16.10's own worked \
                     example, `(b, v=e)[->2]`)",
                    scope,
                ));
            }
            // `(seq, items)[*n]` repeats the whole unit, items included
            // (16.10 `rep_v`): every copy is built under the flow set the
            // copies before it leave, which `build_repeated` arranges.
            build_repetition(
                a,
                leaves,
                rep,
                scope,
                &mut |a, leaves| {
                    if has_match_items {
                        build_match_items(a, leaves, sub, &items, tree, scope)
                    } else {
                        build_assertion(a, leaves, sub, tree, scope)
                    }
                },
                // The gap of `(b)[->n]`: 16.9.2 allows the goto forms on a
                // Boolean expression only, so anything else is the error.
                &mut |a, leaves| {
                    // A `Simple` whose own syntax carries a repetition
                    // (`(b[*2])[->2]`) is a sequence, not a Boolean.
                    let plain = tree.syntax(&sub).is_some_and(|syn| {
                        SimpleSequenceExprSyntax::cast(ranges::peel_sequence_parens(syn))
                            .is_some_and(|s| s.repetition().is_none())
                    });
                    let boolean = (sub.kind() == AssertionExprKind::Simple && plain)
                        .then(|| sub.children())
                        .and_then(|kids| match kids.as_slice() {
                            [only] => only.as_expression(),
                            _ => None,
                        });
                    match boolean {
                        Some(e) => build_gap_operand(a, leaves, e, tree, scope),
                        None => Err(LoweringError::unsupported_at(
                            "goto/nonconsecutive repetition (`[->n:m]`/`[=n:m]`) can only be \
                             applied to a Boolean expression, not a compound sequence (LRM \
                             16.9.2)",
                            scope,
                        )),
                    }
                },
            )
        }
    }
}

/// `( sequence_expr { , sequence_match_item } )` (T13/T14, LRM 16.10, 16.11):
/// the match items, run in LIST ORDER on the thread that completes a NONEMPTY
/// match of the sub-sequence (so an empty-admitting sub-sequence is the 16.11
/// error, see [`attach_match_items`]). The items are wired as one shared chain
/// of same-tick edges after every exit of the sub-sequence, the last one's state
/// being the new single exit. A repeated unit (`(seq, items)[*n]`) is built by
/// calling this once per copy.
///
/// Three item shapes:
///
/// - `v = e` and the compound operators (`v += e`, ...): a
///   [`Transition::LocalVarWrite`]. slang gives a compound assignment no syntax
///   of its own: its right-hand side is the operator applied to an
///   `LValueReference` (the target's current value) and `e`, which
///   [`LeafTable::push_leaf`] reads as a read of the target, so `v += e` on a
///   variable that has not flowed in is the "does not flow out" error.
/// - `v++`, `++v`, `v--`, `--v`: a [`Transition::LocalVarStep`]. The variable
///   is read, so the same flow check applies.
/// - a task or void function call: a [`Transition::SubroutineCall`], see
///   [`super::actions`].
///
/// Item `i` is checked against `flow(X, sub)` plus the items before it: an item
/// may read what an earlier item (or the sub-sequence) assigned. The result's
/// flow is `flow(sub) ##0 (1, v1 = e1) ##0 ...` (F.5.4's `(R, v = e)` rule).
fn build_match_items<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    sub: AssertionExpr<'d>,
    items: &[SemNode<'d>],
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    let x0 = leaves.flow_in.clone();
    let frag = build_assertion(a, leaves, sub, tree, scope)?;
    attach_match_items(a, leaves, frag, items, &x0, scope)
}

/// How a match item is lowered (16.11): the three item shapes.
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
enum MatchItemKind {
    /// `v = e` and the compound operators.
    Assignment,
    /// `v++`, `++v`, `v--`, `--v`: the step added to the variable.
    Step(i64),
    /// A task or void function call.
    Call,
}

/// Classifies one match item expression. Decided by `if`s over the three
/// shapes 16.11 allows, so any other kind is the loud error below, never
/// silently skipped.
fn classify_match_item(
    e: Expression<'_>,
    scope: &Symbol<'_>,
) -> Result<MatchItemKind, LoweringError> {
    let ek = e.kind();
    if ek == ExpressionKind::Assignment {
        return Ok(MatchItemKind::Assignment);
    }
    if ek == ExpressionKind::UnaryOp
        && let Some(op) = e.unary_op()
    {
        if matches!(op, UnaryOp::Preincrement | UnaryOp::Postincrement) {
            return Ok(MatchItemKind::Step(1));
        }
        if matches!(op, UnaryOp::Predecrement | UnaryOp::Postdecrement) {
            return Ok(MatchItemKind::Step(-1));
        }
    }
    if actions::is_call(e) {
        return Ok(MatchItemKind::Call);
    }
    Err(LoweringError::unsupported_at(
        &format!(
            "a sequence match item of kind {ek:?} is not a local-variable assignment, an \
             increment/decrement or a subroutine call (LRM 16.11)"
        ),
        scope,
    ))
}

/// The local variable a match item assigns or steps, as its canonical slot: the
/// item's target must be a WHOLE local variable (16.11).
fn match_item_target<'d>(
    leaves: &LeafTable<'d>,
    target: Expression<'d>,
    what: &str,
    scope: &Symbol<'d>,
) -> Result<(Symbol<'d>, LocalVarId), LoweringError> {
    let sym = target
        .referenced_symbol()
        .filter(|s| {
            target.kind() == ExpressionKind::NamedValue && s.kind() == SymbolKind::LocalAssertionVar
        })
        .ok_or_else(|| {
            LoweringError::unsupported_at(
                &format!(
                    "a sequence match item must {what} a whole local variable (LRM 16.11); an \
                     operation on anything else is not a match item"
                ),
                scope,
            )
        })?;
    Ok((sym, leaves.resolve(sym, scope)?))
}

/// Attaches the match `items` of `(sub, items)` to the already built fragment
/// `frag` of `sub`. `x0` is the flow set `sub` started under. Used by
/// [`build_match_items`] and by `first_match(R, items)` (16.9.8: that is
/// `first_match((R, items))`, so the items run on the single survivor).
///
/// The nondegeneracy rule (16.11, T14): "a subsequence with an attached match
/// item shall not admit an empty match", because a match item runs at a tick
/// the match ends on, which an empty match has none of. It is checked here,
/// on the fragment the unit actually built, so it holds for every item kind
/// and every way the subsequence got to admit the empty word (`b[*0:1]`,
/// `first_match` of one, a repetition of one).
fn attach_match_items<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    frag: Fragment,
    items: &[SemNode<'d>],
    x0: &VarSet,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    if frag.empty {
        return Err(LoweringError::unsupported_at(
            "a sequence match item is attached to a sequence that admits an empty match \
             (LRM 16.11: it shall be an error to attach a match item to such a sequence)",
            scope,
        ));
    }
    let mut flow = frag.flow.clone();
    let mut actions = Vec::with_capacity(items.len());
    for item in items {
        let item_expr = item.as_expression().ok_or_else(|| {
            LoweringError::unsupported_at(
                "sva automaton builder: a sequence match item is not an Expression",
                scope,
            )
        })?;
        match classify_match_item(item_expr, scope)? {
            MatchItemKind::Call => {
                // A built-in method of a collection that is itself a sequence local
                // (`q.push_back(x)`, `q.delete()`): the call runs in the Reactive region on a
                // copy of the local, because "if a local variable appears in an actual
                // argument expression, that argument shall be passed by value" and the call
                // "does not wait on or receive data back" (16.11). Nothing it does can reach
                // the attempt's local variable, so the call has no effect to schedule.
                if is_local_collection_method(item_expr) {
                    continue;
                }
                // The by-value arguments are read where the call fires, after
                // the items before it.
                leaves.flow_in = flow.flow_out(x0);
                actions.push(actions::lower_call(a, leaves, item_expr, scope)?);
                continue;
            }
            MatchItemKind::Step(delta) => {
                let kids = item_expr.as_sem_node().children();
                let [operand] = kids.as_slice() else {
                    return Err(LoweringError::unsupported_at(
                        "sva automaton builder: an increment/decrement match item must have \
                         exactly one operand",
                        scope,
                    ));
                };
                let operand = operand.as_expression().ok_or_else(|| {
                    LoweringError::unsupported_at(
                        "sva automaton builder: an increment/decrement operand is not an \
                         Expression",
                        scope,
                    )
                })?;
                let (sym, canon) =
                    match_item_target(leaves, operand, "increment or decrement", scope)?;
                // `x++` reads the variable: it must have been assigned (16.10).
                leaves.flow_in = flow.flow_out(x0);
                leaves.check_flows(sym, canon, scope)?;
                let phys = leaves.phys_of(a, canon);
                actions.push(Transition::LocalVarStep { var: phys, delta });
                flow = flow.concat(&Flow::assign(canon));
                continue;
            }
            MatchItemKind::Assignment => {}
        }
        let kids = item_expr.as_sem_node().children();
        let [lhs, rhs] = kids.as_slice() else {
            return Err(LoweringError::unsupported_at(
                "sva automaton builder: an assignment match item must have a target and a value",
                scope,
            ));
        };
        let (lhs, rhs) = (
            lhs.as_expression().ok_or_else(|| {
                LoweringError::unsupported_at(
                    "sva automaton builder: a match item's target is not an Expression",
                    scope,
                )
            })?,
            rhs.as_expression().ok_or_else(|| {
                LoweringError::unsupported_at(
                    "sva automaton builder: a match item's value is not an Expression",
                    scope,
                )
            })?,
        );
        let (_, canon) = match_item_target(leaves, lhs, "assign", scope)?;
        leaves.flow_in = flow.flow_out(x0);
        let phys = leaves.phys_of(a, canon);
        actions.extend(leaves.assign_var(a, canon, phys, rhs, scope)?);
        flow = flow.concat(&Flow::assign(canon));
    }
    leaves.flow_in = x0.clone();
    let exits = suffix_actions(a, frag.exits, actions);
    Ok(Fragment {
        entry: frag.entry,
        exits,
        empty: false,
        flow,
        clock: frag.clock,
    })
}

/// Dispatches a recovered `[...]` repetition to the right shape (16.9.2):
/// `*`/`+` (consecutive) link `make_unit` copies with exactly `##1`; `->` and
/// `=` are the goto and nonconsecutive forms of 16.9.2, built exactly by
/// [`build_goto`] from `make_unit` (the Boolean's own sample) and `make_gap` (the
/// sample of its negation).
fn build_repetition<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    rep: SequenceRepetitionSyntax<'_>,
    scope: &Symbol<'d>,
    make_unit: &mut dyn FnMut(
        &mut ir::Automaton,
        &mut LeafTable<'d>,
    ) -> Result<Fragment, LoweringError>,
    make_gap: &mut dyn FnMut(
        &mut ir::Automaton,
        &mut LeafTable<'d>,
    ) -> Result<Fragment, LoweringError>,
) -> Result<Fragment, LoweringError> {
    let op_text = rep.op().map(|t| t.text()).ok_or_else(|| {
        LoweringError::unsupported_at(
            "sva automaton builder: `[...]` repetition has no operator token",
            scope,
        )
    })?;
    let range = ranges::repetition_range_in(rep, scope, &leaves.env)?;
    match op_text {
        "*" | "+" => build_repeated(
            a,
            leaves,
            range.min,
            range.max,
            SequenceRangeValue {
                min: 1,
                max: Some(1),
            },
            make_unit,
        ),
        "->" | "=" => build_goto(
            a,
            leaves,
            op_text == "=",
            (range.min, range.max),
            make_unit,
            make_gap,
        ),
        other => Err(LoweringError::unsupported_at(
            &format!("sva automaton builder: unknown sequence repetition operator {other:?}"),
            scope,
        )),
    }
}

/// Goto `b[->n:m]` and nonconsecutive `b[=n:m]` repetition (16.9.2), lowered by
/// their own definitions in terms of consecutive repetition and `##1`:
///
/// - `b[->n:m]` is `(!b[*0:$] ##1 b)[*n:m]`: each repeat waits through any
///   number of ticks where `b` is false (`make_gap`, a [`LeafTable::is_negated`]
///   sample) and ends on the tick `b` is true, so the match ends AT the last
///   true `b`.
/// - `b[=n:m]` is `b[->n:m] ##1 !b[*0:$]`: the same, then any number of further
///   ticks where `b` stays false, so the match may end anywhere after the last
///   true `b` up to (not including) the next one.
///
/// Both go through [`build_repeated`] and [`concat`], so counts of zero, the
/// range and `$` upper bound, the empty match of `[=0]`/`[->0]` and the flow of
/// local variables are decided by the same algebra as every other repetition.
fn build_goto<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    nonconsecutive: bool,
    (min, max): (u32, Option<u32>),
    make_unit: &mut dyn FnMut(
        &mut ir::Automaton,
        &mut LeafTable<'d>,
    ) -> Result<Fragment, LoweringError>,
    make_gap: &mut dyn FnMut(
        &mut ir::Automaton,
        &mut LeafTable<'d>,
    ) -> Result<Fragment, LoweringError>,
) -> Result<Fragment, LoweringError> {
    let one = SequenceRangeValue {
        min: 1,
        max: Some(1),
    };
    let body = {
        // One repeat: `!b[*0:$] ##1 b`.
        let mut repeat = |a: &mut ir::Automaton,
                          leaves: &mut LeafTable<'d>|
         -> Result<Fragment, LoweringError> {
            let gap = build_repeated(a, leaves, 0, None, one, make_gap)?;
            let hit = make_unit(a, leaves)?;
            Ok(concat(a, gap, one, hit))
        };
        build_repeated(a, leaves, min, max, one, &mut repeat)?
    };
    if !nonconsecutive {
        return Ok(body);
    }
    let tail = build_repeated(a, leaves, 0, None, one, make_gap)?;
    Ok(concat(a, body, one, tail))
}

/// Builds `min..=max` (or `min..` when `max` is `None`) repeats of one unit
/// fragment, chained by `link` between consecutive repeats (16.9.2's
/// implicit `##1`, or a wider search window -- see [`build_repetition`]).
///
/// A unit that itself admits the empty match (`(a[*0:1])[*2]`) is handled by
/// the 16.9.2.1 algebra, not special-cased per shape: `u[*k]` is a `##1`-fold
/// of `k` copies of `ne ∪ ε`, and `x ##1 ε = ε ##1 x = x`, so every repeat
/// may vanish and `u[*min:max]` is `ne(u)[*0:max]` (for `max == $`, the same
/// with an open upper bound). The repeats below are therefore built from the
/// unit's NONEMPTY part and `min` drops to 0; the result admits the empty
/// match exactly when that adjusted `min` is 0.
fn build_repeated<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    min: u32,
    max: Option<u32>,
    link: SequenceRangeValue,
    make_unit: &mut dyn FnMut(
        &mut ir::Automaton,
        &mut LeafTable<'d>,
    ) -> Result<Fragment, LoweringError>,
) -> Result<Fragment, LoweringError> {
    if max.is_some_and(|m| min > m) {
        return Err(LoweringError::unsupported(
            &format!(
                "sequence repetition range min ({min}) > max ({})",
                max.unwrap_or_default()
            ),
            "sva::build::build_repeated",
        ));
    }
    if max == Some(0) {
        // `[*0:0]`/`[*0]` -- the degenerate "always empty" repetition. (No
        // unit is built at all: nothing of it is ever sampled.)
        return Ok(empty_fragment(a));
    }

    // The first copy decides whether the unit admits the empty match. Every
    // copy is built under the flow set the copies before it leave (16.10, F.5.4:
    // `u[*n]` is `u ##1 u ...`), `x0` for the first.
    let x0 = leaves.flow_in.clone();
    let first = make_unit(a, leaves)?;
    let min = if first.empty { 0 } else { min };
    // The repeats are all on the unit's clock (a multiclocked unit is an error).
    let clock = single_clock(&first, "a sequence repetition")
        .map_err(|msg| LoweringError::unsupported(&msg, "sva::build::build_repeated"))?;
    if first.exits.is_empty() {
        // The unit has no nonempty match at all (it is `empty`-only, or never
        // matches): `u[*k]` is the empty match for every `k` when `u` admits
        // it, and only `u[*0]` otherwise -- no path either way. The empty
        // match assigns nothing, whatever the unit would have.
        return Ok(Fragment {
            entry: first.entry,
            exits: Vec::new(),
            empty: min == 0,
            flow: Flow::identity(),
            clock,
        });
    }
    let built = match max {
        Some(max) => build_repeated_finite(a, leaves, &x0, first, (min, max), link, make_unit),
        None => build_repeated_unbounded(a, leaves, &x0, first, min, link, make_unit),
    };
    leaves.flow_in = x0;
    built.map(|f| Fragment { clock, ..f })
}

/// Chains an unconditional `link`-delay edge from every state in `from` to
/// `target`.
fn link_all(
    a: &mut ir::Automaton,
    from: &[ThreadStateId],
    link: SequenceRangeValue,
    target: ThreadStateId,
) {
    for &e in from {
        a.add_edge(
            e,
            None,
            Transition::Delay {
                min: link.min,
                max: link.max,
            },
            target,
        );
    }
}

/// `min..=max` repeats (16.9.2's bounded forms, `[*n:m]`/`[=n:m]`/
/// `[->n:m]`/`[*n]`) of a unit with at least one nonempty match (`first` is
/// the unit's first copy, already built by [`build_repeated`]): `max` copies,
/// chained by `link`; the thread may stop after any count `k` in
/// `min..=max` (16.9.2: "the match may stop at any count within the range"),
/// so the fragment's `exits` are the UNION of every copy `k`'s own exits for
/// `k` in that range. The zero-repeat empty match (`min == 0`) is the
/// fragment's `empty` flag, not an exit.
fn build_repeated_finite<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    x0: &VarSet,
    first: Fragment,
    (min, max): (u32, u32),
    link: SequenceRangeValue,
    make_unit: &mut dyn FnMut(
        &mut ir::Automaton,
        &mut LeafTable<'d>,
    ) -> Result<Fragment, LoweringError>,
) -> Result<Fragment, LoweringError> {
    let entry = first.entry;
    let mut prev_exits = first.exits.clone();
    let mut copy_exits: Vec<Vec<ThreadStateId>> = Vec::with_capacity(max as usize);
    copy_exits.push(first.exits);
    // `acc[k - 1]` is the flow of the first `k` copies chained.
    let mut acc: Vec<Flow> = Vec::with_capacity(max as usize);
    acc.push(first.flow);
    for k in 1..max as usize {
        leaves.flow_in = acc[k - 1].flow_out(x0);
        let unit = make_unit(a, leaves)?;
        link_all(a, &prev_exits, link, unit.entry);
        prev_exits = unit.exits.clone();
        copy_exits.push(unit.exits);
        let chained = acc[k - 1].concat(&unit.flow);
        acc.push(chained);
    }

    let mut exits = Vec::new();
    // The match may stop after any count in the range, so only what EVERY
    // count assigns flows out (`or`); a zero count assigns nothing.
    let mut flow: Option<Flow> = (min == 0).then(Flow::identity);
    for k in min.max(1)..=max {
        exits.extend(copy_exits[(k - 1) as usize].iter().copied());
        let f = &acc[(k - 1) as usize];
        flow = Some(match flow {
            None => f.clone(),
            Some(so_far) => so_far.or(f),
        });
    }
    Ok(Fragment {
        entry,
        exits,
        empty: min == 0,
        flow: flow.unwrap_or_default(),
        clock: None,
    })
}

/// `min..` repeats with no upper bound (16.9.2's `$` forms, `[*]`/`[+]`/
/// `[*n:$]`/...) of a unit with at least one nonempty match: `max(min, 1)`
/// mandatory copies chained by `link`, then one more unit (`loop_unit`) wired
/// as a genuine cycle -- its own entry is reachable from the mandatory
/// chain's tail AND from its own exits (so the thread may take the loop any
/// number of times, including zero), modeling the unbounded upper bound
/// without ever building infinitely many states. `min == 0` only sets the
/// `empty` flag (the empty match); it adds no exit.
fn build_repeated_unbounded<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    x0: &VarSet,
    first: Fragment,
    min: u32,
    link: SequenceRangeValue,
    make_unit: &mut dyn FnMut(
        &mut ir::Automaton,
        &mut LeafTable<'d>,
    ) -> Result<Fragment, LoweringError>,
) -> Result<Fragment, LoweringError> {
    let mandatory = min.max(1);
    let entry = first.entry;
    let mut tail_exits = first.exits;
    let mut acc = first.flow;
    for _ in 1..mandatory {
        leaves.flow_in = acc.flow_out(x0);
        let unit = make_unit(a, leaves)?;
        link_all(a, &tail_exits, link, unit.entry);
        tail_exits = unit.exits;
        acc = acc.concat(&unit.flow);
    }

    // Every iteration of the loop starts with at least what the mandatory
    // copies leave: the sets only grow along the chain (`flow0` of a longer
    // chain contains the shorter one's, and its `block` is no larger than the
    // unit's own on top of the shorter one's), so this is a sound entry set for
    // each of the unboundedly many iterations.
    leaves.flow_in = acc.flow_out(x0);
    let loop_unit = make_unit(a, leaves)?;
    link_all(a, &tail_exits, link, loop_unit.entry);
    link_all(a, &loop_unit.exits, link, loop_unit.entry);

    let mut exits = tail_exits;
    exits.extend(loop_unit.exits);
    // The loop may run zero times, so it samples and blocks what the unit does
    // but guarantees no assignment.
    let looped = Flow {
        sample: loop_unit.flow.sample,
        block: loop_unit.flow.block,
        flow0: VarSet::new(),
    };
    let mut flow = acc.concat(&looped);
    if min == 0 {
        flow = flow.or_empty();
    }
    Ok(Fragment {
        entry,
        exits,
        empty: min == 0,
        flow,
        clock: None,
    })
}

// ---------------------------------------------------------------------------
// T11: `and` / `intersect` / `or` / `first_match` / `throughout` / `within`
// (LRM 16.9.5-16.9.10).
// ---------------------------------------------------------------------------

/// The most states one `and`/`intersect` product may allocate before the
/// builder gives up with a named error (a product is the one construction here
/// whose size is a function of the operands' DELAY BOUNDS, e.g. `a ##100000 b
/// intersect c ##100000 d` walks 100000 lockstep ticks; an unbounded budget
/// would turn a typo into an out-of-memory).
const MAX_PRODUCT_STATES: usize = 20_000;

/// The two operators built as a lockstep product of their operands.
#[derive(Clone, Copy, PartialEq, Eq, Debug)]
enum ProductKind {
    /// 16.9.6: both operands match over the same interval.
    Intersect,
    /// 16.9.5: both operands match from the same start; the composite ends
    /// where the later one ends.
    And,
}

impl ProductKind {
    fn name(self) -> &'static str {
        match self {
            ProductKind::Intersect => "intersect",
            ProductKind::And => "and",
        }
    }
}

/// One operand's position inside a product state. An operand is a [`Fragment`]
/// of the shared automaton, which is stepped in lockstep with the other; its
/// `Delay` edges cannot be stepped one tick at a time in place (a `Delay`
/// carries a whole window), so a delay in flight is a `Wait` that counts the
/// window down while the other side keeps moving.
#[derive(Clone, Copy, PartialEq, Eq, Hash, Debug)]
enum Comp {
    /// At this state of the operand, on the current tick.
    Real(ThreadStateId),
    /// A `Delay{min,max}` edge to `target` taken `k` ticks ago short of its
    /// window: it still needs between `lo` and `hi` (`None` = unbounded) more
    /// ticks. `Wait{lo: 0, hi: Some(0)}` is always normalized to `Real` (see
    /// [`Comp::wait`]), so a `Wait` always has at least one tick left to
    /// consume or an eps (`lo == 0`) to resolve.
    Wait {
        target: ThreadStateId,
        lo: u32,
        hi: Option<u32>,
    },
    /// `and` only: this operand has already matched (it ended on an earlier
    /// tick, or is the empty match) and idles while the other one finishes.
    Done,
}

impl Comp {
    fn wait(target: ThreadStateId, lo: u32, hi: Option<u32>) -> Comp {
        if lo == 0 && hi == Some(0) {
            Comp::Real(target)
        } else {
            Comp::Wait { target, lo, hi }
        }
    }

    /// This component after one tick elapses, or `None` if it cannot let a
    /// tick pass (a `Real` state's own continuation is by its edges, which
    /// are either same-tick or a `Delay` that becomes a `Wait`).
    fn tick(self) -> Option<Comp> {
        match self {
            Comp::Real(_) => None,
            // `hi >= 1` here: `wait` turned the only `hi == 0` shape into `Real`.
            Comp::Wait { target, lo, hi } => Some(Comp::wait(
                target,
                lo.saturating_sub(1),
                hi.map(|h| h.saturating_sub(1)),
            )),
            Comp::Done => Some(Comp::Done),
        }
    }
}

/// One edge out of a product state's component, before it is paired with the
/// other component.
struct Move {
    guard: Option<LeafId>,
    label: Transition,
    to: Comp,
}

/// The moves of one component of a product state (see [`Comp`]). `exits` is
/// the operand's exit set: for `and`, a component at an exit may stop
/// (`Done`) on this very tick.
fn comp_moves(
    a: &ir::Automaton,
    c: Comp,
    exits: &HashSet<ThreadStateId>,
    kind: ProductKind,
    scope: &Symbol<'_>,
) -> Result<Vec<Move>, LoweringError> {
    let mut out = Vec::new();
    match c {
        Comp::Done => {}
        Comp::Wait { target, lo, .. } => {
            if lo == 0 {
                out.push(Move {
                    guard: None,
                    label: Transition::Epsilon,
                    to: Comp::Real(target),
                });
            }
        }
        Comp::Real(s) => {
            for e in &a.state(s).edges {
                let (label, to) = match &e.label {
                    Transition::Epsilon => (Transition::Epsilon, Comp::Real(e.target)),
                    // A window with min > max never fires (the builder rejects
                    // those at the source; this keeps the product total).
                    Transition::Delay { min, max } => {
                        if max.is_some_and(|m| *min > m) {
                            continue;
                        }
                        (Transition::Epsilon, Comp::wait(e.target, *min, *max))
                    }
                    // A local-variable action is a same-tick move of the thread
                    // carrying it (T13): the product keeps the action on the edge
                    // and the frame it acts on is the thread's own.
                    Transition::FirstMatchBegin { .. }
                    | Transition::FirstMatchEnd { .. }
                    | Transition::LocalVarWrite { .. }
                    | Transition::LocalVarCopy { .. }
                    | Transition::LocalVarStep { .. } => (e.label.clone(), Comp::Real(e.target)),
                    // Testing an end point is a same-tick move of the thread
                    // too (T15): the runtime asks "did the instance end on this
                    // tick" against the thread's own frame, and a guard-form
                    // edge copies the flowing-out locals into it.
                    Transition::EndPoint { .. } => (e.label.clone(), Comp::Real(e.target)),
                    // A subroutine call fires at every end point of the
                    // sequence it is attached to, even when the sibling operand
                    // then fails (16.11); the product only keeps a thread
                    // whose both components can still finish, so it cannot
                    // promise that. Refused rather than guessed (T29's engine
                    // can lift it).
                    // A clock change (T28) never reaches here: `build_threads`
                    // refuses a multiclocked operand (16.13.1) before the product
                    // is built, so this arm is the same loud backstop.
                    Transition::Match { .. }
                    | Transition::Abort { .. }
                    | Transition::ClockSync { .. }
                    | Transition::SubroutineCall { .. } => {
                        return Err(LoweringError::unsupported_at(
                            &format!(
                                "sva automaton builder: `{}` operand contains a {} edge, which \
                                 the lockstep product does not know how to compose",
                                kind.name(),
                                e.label.kind_name()
                            ),
                            scope,
                        ));
                    }
                };
                out.push(Move {
                    guard: e.guard,
                    label,
                    to,
                });
            }
            if kind == ProductKind::And && exits.contains(&s) {
                out.push(Move {
                    guard: None,
                    label: Transition::Epsilon,
                    to: Comp::Done,
                });
            }
        }
    }
    Ok(out)
}

/// The product state for `key`, allocating (and queueing it) if new.
fn intern_product(
    a: &mut ir::Automaton,
    ids: &mut HashMap<(Comp, Comp), ThreadStateId>,
    order: &mut Vec<(Comp, Comp)>,
    key: (Comp, Comp),
    kind: ProductKind,
    scope: &Symbol<'_>,
) -> Result<ThreadStateId, LoweringError> {
    if let Some(&id) = ids.get(&key) {
        return Ok(id);
    }
    if order.len() >= MAX_PRODUCT_STATES {
        return Err(LoweringError::unsupported_at(
            &format!(
                "sva automaton builder: the `{}` of these operands needs more than \
                 {MAX_PRODUCT_STATES} product states (its operands' delay bounds are too large \
                 to compose in lockstep)",
                kind.name()
            ),
            scope,
        ));
    }
    let id = a.new_state();
    ids.insert(key, id);
    order.push(key);
    Ok(id)
}

/// `l intersect r` (16.9.6) and `l and r` (16.9.5) as a lockstep product of the
/// two operand fragments, which stay in `a` (and become unreachable; see
/// [`prune_unreachable`]).
///
/// A product state is a pair of [`Comp`]s; both operands start on the same
/// tick and every tick advances both together (the one `Delay{1,1}` edge a
/// product state may have), so the product only has a state where both sides
/// are on the SAME tick, and a Boolean leaf's guard is copied onto the product
/// edge unchanged (it samples that tick).
///
/// - `intersect` matches where both operands are at an exit on the same tick:
///   equal length, as 16.9.6 requires.
/// - `and` additionally lets an operand that is at an exit step to `Done` and
///   wait, so the composite ends where the later operand ends, as 16.9.5
///   requires. This is Annex F.3.4.2.4's `((r1 ##1 1[*0:$]) intersect r2) or
///   (r1 intersect (r2 ##1 1[*0:$]))`, with the `1[*0:$]` padding done by
///   idling instead of by extra states.
///
/// Empty matches (16.9.2.1): the composite admits the empty match exactly when
/// both operands do. Under `intersect` an empty operand pairs only with an
/// empty one, so only the flag survives; under `and`, `ε and R` is R's
/// matches (the empty operand is already `Done`).
///
/// First-match markers of the operands are copied through, so each region is
/// still stamped and checked per thread (see [`ir::Transition::FirstMatchEnd`]).
fn build_product<'d>(
    a: &mut ir::Automaton,
    l: Fragment,
    r: Fragment,
    kind: ProductKind,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    let ne_l = !l.exits.is_empty();
    let ne_r = !r.exits.is_empty();
    let empty = l.empty && r.empty;

    let mut routes: Vec<(Comp, Comp)> = Vec::new();
    if ne_l && ne_r {
        routes.push((Comp::Real(l.entry), Comp::Real(r.entry)));
    }
    if kind == ProductKind::And {
        if l.empty && ne_r {
            routes.push((Comp::Done, Comp::Real(r.entry)));
        }
        if r.empty && ne_l {
            routes.push((Comp::Real(l.entry), Comp::Done));
        }
    }

    let exits_l: HashSet<ThreadStateId> = l.exits.iter().copied().collect();
    let exits_r: HashSet<ThreadStateId> = r.exits.iter().copied().collect();
    // Lookup only; `order` is the deterministic creation order.
    let mut ids: HashMap<(Comp, Comp), ThreadStateId> = HashMap::new();
    let mut order: Vec<(Comp, Comp)> = Vec::new();

    let mut route_ids = Vec::new();
    for &route in &routes {
        route_ids.push(intern_product(a, &mut ids, &mut order, route, kind, scope)?);
    }

    let mut next = 0;
    while next < order.len() {
        let key @ (cl, cr) = order[next];
        next += 1;
        let from = ids[&key];
        for m in comp_moves(a, cl, &exits_l, kind, scope)? {
            let to = intern_product(a, &mut ids, &mut order, (m.to, cr), kind, scope)?;
            a.add_edge(from, m.guard, m.label, to);
        }
        for m in comp_moves(a, cr, &exits_r, kind, scope)? {
            let to = intern_product(a, &mut ids, &mut order, (cl, m.to), kind, scope)?;
            a.add_edge(from, m.guard, m.label, to);
        }
        // A tick passes only when neither side has anything left to do on this
        // one -- every side is waiting (or, for `and`, finished) -- and at
        // least one side is genuinely waiting.
        let waiting = |c: Comp| matches!(c, Comp::Wait { .. });
        if let (Some(tl), Some(tr)) = (cl.tick(), cr.tick())
            && (waiting(cl) || waiting(cr))
        {
            let to = intern_product(a, &mut ids, &mut order, (tl, tr), kind, scope)?;
            a.add_edge(
                from,
                None,
                Transition::Delay {
                    min: 1,
                    max: Some(1),
                },
                to,
            );
        }
    }

    let is_exit = |&(cl, cr): &(Comp, Comp)| match (kind, cl, cr) {
        (ProductKind::Intersect, Comp::Real(x), Comp::Real(y)) => {
            exits_l.contains(&x) && exits_r.contains(&y)
        }
        (ProductKind::And, Comp::Done, Comp::Done) => true,
        _ => false,
    };
    let live = trim_dead_product_states(a, &ids, &order, is_exit);
    // One live route is the entry; several need a fresh state that starts
    // them all (and none leaves an entry with no edges: no match).
    let live_routes: Vec<ThreadStateId> = route_ids
        .iter()
        .copied()
        .filter(|id| live.contains(id))
        .collect();
    let entry = match live_routes.as_slice() {
        [only] => *only,
        many => {
            let entry = a.new_state();
            for &id in many {
                a.add_edge(entry, None, Transition::Epsilon, id);
            }
            entry
        }
    };
    let exits = order
        .iter()
        .filter(|key| is_exit(key))
        .map(|key| ids[key])
        .collect();
    Ok(Fragment {
        entry,
        exits,
        empty,
        flow: Flow::identity(),
        clock: None,
    })
}

/// Cuts every edge of the product (the states `order` lists, interned in
/// `ids`) into a state that can neither reach an exit nor a
/// [`Transition::FirstMatchEnd`] edge, and returns the live states. Most
/// lockstep pairs are dead (the operands never line up), and nested operators
/// would otherwise multiply those dead states into the next product.
///
/// A state with a `FirstMatchEnd` edge stays live, and keeps that edge, even
/// when no exit follows: the end tick the edge records is a fact about the
/// region, not about this product (`first_match(R) intersect S` discards R's
/// later matches whether or not S agrees with its earliest one, see the
/// edge's doc).
fn trim_dead_product_states(
    a: &mut ir::Automaton,
    ids: &HashMap<(Comp, Comp), ThreadStateId>,
    order: &[(Comp, Comp)],
    is_exit: impl Fn(&(Comp, Comp)) -> bool,
) -> HashSet<ThreadStateId> {
    let index: HashMap<ThreadStateId, usize> = order
        .iter()
        .enumerate()
        .map(|(i, key)| (ids[key], i))
        .collect();
    let mut preds: Vec<Vec<usize>> = vec![Vec::new(); order.len()];
    let mut live = vec![false; order.len()];
    let mut stack = Vec::new();
    for (i, key) in order.iter().enumerate() {
        let edges = &a.state(ids[key]).edges;
        for e in edges {
            // Every product edge targets another product state.
            preds[index[&e.target]].push(i);
        }
        let ends = edges
            .iter()
            .any(|e| matches!(e.label, Transition::FirstMatchEnd { .. }));
        if ends || is_exit(key) {
            live[i] = true;
            stack.push(i);
        }
    }
    while let Some(i) = stack.pop() {
        for &p in &preds[i] {
            if !live[p] {
                live[p] = true;
                stack.push(p);
            }
        }
    }
    for (i, key) in order.iter().enumerate() {
        let id = ids[key];
        if live[i] {
            // A `FirstMatchEnd` edge stays even into a dead state: crossing it
            // is what records the region's earliest end tick.
            a.states[id.0 as usize].edges.retain(|e| {
                live[index[&e.target]] || matches!(e.label, Transition::FirstMatchEnd { .. })
            });
        } else {
            a.states[id.0 as usize].edges.clear();
        }
    }
    order
        .iter()
        .enumerate()
        .filter(|(i, _)| live[*i])
        .map(|(_, key)| ids[key])
        .collect()
}

/// A fragment matching exactly one tick, unconditionally (the LRM's
/// `` `true ``, `1`): the unit of `1[*0:$]`.
fn true_fragment(a: &mut ir::Automaton) -> Fragment {
    let entry = a.new_state();
    let exit = a.new_state();
    a.add_edge(entry, None, Transition::Epsilon, exit);
    Fragment {
        entry,
        exits: vec![exit],
        empty: false,
        flow: Flow::identity(),
        clock: None,
    }
}

/// `1[*0:$]`: any number of vacuous ticks, the empty run included.
fn true_run(a: &mut ir::Automaton, leaves: &mut LeafTable<'_>) -> Result<Fragment, LoweringError> {
    build_repeated(a, leaves, 0, None, CONSECUTIVE_LINK, &mut |a, _| {
        Ok(true_fragment(a))
    })
}

/// The `##1` that links consecutive repeats (16.9.2).
const CONSECUTIVE_LINK: SequenceRangeValue = SequenceRangeValue {
    min: 1,
    max: Some(1),
};

/// `AssertionExprKind::Binary` as a SEQUENCE operator: `and`, `or`,
/// `intersect`, `throughout`, `within` (16.9.5-16.9.10). The operands are the
/// node's two children, left then right, each built as a sequence by
/// [`build_node`] (so a PROPERTY operand reaches the property operator and
/// is rejected there, by name). The other `BinaryAssertionOperator`s are
/// property operators, T19 onward's: a named error.
fn build_binary<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    expr: AssertionExpr<'d>,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    let op = match Op::of(expr, scope)? {
        Op::Binary(op) => op,
        Op::Unary(op) => {
            return Err(LoweringError::unsupported_at(
                &format!("sva automaton builder: a Binary node carries the unary operator {op:?}"),
                scope,
            ));
        }
    };
    let kids = expr.children();
    let [lhs, rhs] = kids.as_slice() else {
        return Err(LoweringError::unsupported_at(
            &format!(
                "sva automaton builder: a `{op:?}` node must have exactly two operands, found {}",
                kids.len()
            ),
            scope,
        ));
    };
    match op {
        AssertionBinaryOp::And | AssertionBinaryOp::Intersect => {
            let kind = if op == AssertionBinaryOp::And {
                ProductKind::And
            } else {
                ProductKind::Intersect
            };
            build_threads(
                a,
                leaves,
                kind,
                if op == AssertionBinaryOp::And {
                    "and"
                } else {
                    "intersect"
                },
                scope,
                &mut |a, leaves| build_node(a, leaves, *lhs, tree, scope),
                &mut |a, leaves| build_node(a, leaves, *rhs, tree, scope),
            )
        }
        // The two operands of an `or` start from the SAME flow set (16.10: it
        // flows in to each), and each matching thread continues as its own
        // thread with its own frame, so no shadowing is needed.
        AssertionBinaryOp::Or => {
            let l = build_node(a, leaves, *lhs, tree, scope)?;
            let r = build_node(a, leaves, *rhs, tree, scope)?;
            let clock = join_clocks(leaves, &[&l, &r], "or", scope)?;
            Ok(Fragment {
                clock,
                ..build_or(a, l, r)
            })
        }
        // 16.9.9: `exp throughout seq` is `(exp)[*0:$] intersect seq`.
        AssertionBinaryOp::Throughout => {
            let cond = *lhs;
            build_threads(
                a,
                leaves,
                ProductKind::Intersect,
                "throughout",
                scope,
                &mut |a, leaves| {
                    build_repeated(a, leaves, 0, None, CONSECUTIVE_LINK, &mut |a, leaves| {
                        build_node(a, leaves, cond, tree, scope)
                    })
                },
                &mut |a, leaves| build_node(a, leaves, *rhs, tree, scope),
            )
        }
        // 16.9.10: `seq1 within seq2` is `(1[*0:$] ##1 seq1 ##1 1[*0:$])
        // intersect seq2` -- `lhs` is seq1 (the inner one), `rhs` the container.
        AssertionBinaryOp::Within => build_threads(
            a,
            leaves,
            ProductKind::Intersect,
            "within",
            scope,
            &mut |a, leaves| {
                let seq1 = build_node(a, leaves, *lhs, tree, scope)?;
                let clock = single_clock(&seq1, "the inner sequence of `within`")
                    .map_err(|msg| LoweringError::unsupported_at(&msg, scope))?;
                let one = CONSECUTIVE_LINK;
                let before = true_run(a, leaves)?;
                let after = true_run(a, leaves)?;
                let inner = concat(a, before, one, seq1);
                Ok(Fragment {
                    clock,
                    ..concat(a, inner, one, after)
                })
            },
            &mut |a, leaves| build_node(a, leaves, *rhs, tree, scope),
        ),
        AssertionBinaryOp::Iff
        | AssertionBinaryOp::Until
        | AssertionBinaryOp::SUntil
        | AssertionBinaryOp::UntilWith
        | AssertionBinaryOp::SUntilWith
        | AssertionBinaryOp::Implies
        | AssertionBinaryOp::OverlappedImplication
        | AssertionBinaryOp::NonOverlappedImplication
        | AssertionBinaryOp::OverlappedFollowedBy
        | AssertionBinaryOp::NonOverlappedFollowedBy => Err(LoweringError::unsupported_at(
            &format!(
                "sva automaton builder: AssertionExprKind::Binary operator {op:?} is a property \
                 operator (LRM 16.12), not a sequence operator: it is built by \
                 `build_property`, and cannot be an operand of a sequence operator, a delay or \
                 a repetition (16.12.1)"
            ),
            scope,
        )),
    }
}

/// `l or r` (16.9.7): the union of the operands' matches -- a fresh entry
/// that starts both, exits that are both operands' exits. The operands share
/// no state, so nothing needs to be copied. An operand that cannot match
/// nonempty contributes nothing but its `empty` flag.
fn build_or(a: &mut ir::Automaton, l: Fragment, r: Fragment) -> Fragment {
    let entry = a.new_state();
    for f in [&l, &r] {
        if !f.exits.is_empty() {
            a.add_edge(entry, None, Transition::Epsilon, f.entry);
        }
    }
    // F.5.4: only what both branches assign flows out.
    let flow = l.flow.or(&r.flow);
    let mut exits = l.exits;
    exits.extend(r.exits);
    Fragment {
        entry,
        exits,
        empty: l.empty || r.empty,
        flow,
        clock: None,
    }
}

/// A chain of same-tick action edges that leads into `target`, returning the
/// state to enter it from; `target` itself when there is nothing to do.
fn prefix_actions(
    a: &mut ir::Automaton,
    actions: Vec<Transition>,
    target: ThreadStateId,
) -> ThreadStateId {
    let Some((last, init)) = actions.split_last() else {
        return target;
    };
    let entry = a.new_state();
    let mut cur = entry;
    for t in init {
        let next = a.new_state();
        a.add_edge(cur, None, t.clone(), next);
        cur = next;
    }
    a.add_edge(cur, None, last.clone(), target);
    entry
}

/// A chain of same-tick action edges that every state of `exits` leads into,
/// returning the chain's end as the new (single) exit; `exits` itself when
/// there is nothing to do or nothing to continue from.
fn suffix_actions(
    a: &mut ir::Automaton,
    exits: Vec<ThreadStateId>,
    actions: Vec<Transition>,
) -> Vec<ThreadStateId> {
    if actions.is_empty() || exits.is_empty() {
        return exits;
    }
    let head = a.new_state();
    for &e in &exits {
        a.add_edge(e, None, Transition::Epsilon, head);
    }
    let mut cur = head;
    for t in actions {
        let next = a.new_state();
        a.add_edge(cur, None, t, next);
        cur = next;
    }
    vec![cur]
}

/// A two-threaded sequence operator: `and`, `intersect`, and (through their
/// rewrites) `throughout` and `within` (16.9.5, 16.9.6, 16.9.9, 16.9.10). Both
/// operands start from the same flow set (16.10: it flows in to each), and run
/// concurrently, each with its OWN copy of every local variable (rule (d): the
/// two threads are merged into one only at the end). `first` keeps the shared
/// slots; every variable it touched is shadowed in `second` (see
/// [`ShadowCtx`]), the shadows initialised from the shared slot at the start
/// and, for a variable only `second` assigns (the F.5.4 difference), copied back
/// at the end. A variable both assign is blocked (its flow is
/// [`Flow::intersect`]'s business) and so is never copied back.
fn build_threads<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    kind: ProductKind,
    what: &str,
    scope: &Symbol<'d>,
    first: &mut dyn FnMut(
        &mut ir::Automaton,
        &mut LeafTable<'d>,
    ) -> Result<Fragment, LoweringError>,
    second: &mut dyn FnMut(
        &mut ir::Automaton,
        &mut LeafTable<'d>,
    ) -> Result<Fragment, LoweringError>,
) -> Result<Fragment, LoweringError> {
    let mark = leaves.touched.len();
    let l = first(a, leaves)?;
    let outer_touched: BTreeSet<LocalVarId> = leaves.touched[mark..].iter().copied().collect();
    leaves.shadows.push(ShadowCtx {
        outer_touched,
        made: Vec::new(),
    });
    let r = second(a, leaves);
    let ctx = leaves.shadows.pop().expect("pushed above");
    let r = r?;

    let clock = join_clocks(leaves, &[&l, &r], what, scope)?;
    let flow = l.flow.intersect(&r.flow);
    let copy_in: Vec<Transition> = ctx
        .made
        .iter()
        .map(|&(_, outer, shadow)| Transition::LocalVarCopy {
            dst: shadow,
            src: outer,
        })
        .collect();
    let copy_out: Vec<Transition> = ctx
        .made
        .iter()
        .filter(|(canon, _, _)| r.flow.sample.contains(canon) && !l.flow.sample.contains(canon))
        .map(|&(_, outer, shadow)| Transition::LocalVarCopy {
            dst: outer,
            src: shadow,
        })
        .collect();
    let mut p = build_product(a, l, r, kind, scope)?;
    p.entry = prefix_actions(a, copy_in, p.entry);
    p.exits = suffix_actions(a, p.exits, copy_out);
    p.flow = flow;
    p.clock = clock;
    Ok(p)
}

/// `AssertionExprKind::FirstMatch` (16.9.8): only `R`'s matches that end
/// earliest, for a given beginning (Annex F.5.2: `w |= first_match(R)` iff
/// `w |= R` and no proper prefix of `w` -- the empty word included -- satisfies
/// `R`).
///
/// - If `R` admits the empty match, that match is the earliest possible, so
///   the result is the empty match alone.
/// - Otherwise the region is bracketed by a [`Transition::FirstMatchBegin`]
///   from a fresh entry and a [`Transition::FirstMatchEnd`] from every exit of
///   `R` into one fresh exit; the engine's per-attempt table does the rest
///   (see those edges' docs). The group is minted here, one per region.
///
/// Sequence match items (`first_match(R, v = e)`, T14) are
/// `first_match((R, v = e))` (16.9.8): the items belong to the operand, so they
/// are attached to `R` BEFORE the bracket is built (see
/// [`attach_match_items`]) and run at EVERY end point of `R` (16.11: "all
/// subroutine calls attached to a sequence are executed at every end point of
/// the sequence"), including the matches `first_match` then discards. For
/// assignments the position is unobservable (a discarded thread's frame is
/// gone); for calls it is the whole difference. An empty `R` with items is the
/// 16.11 nondegeneracy error. The items are lowered (and so validated) even
/// when `R` can never match.
fn build_first_match<'d>(
    a: &mut ir::Automaton,
    leaves: &mut LeafTable<'d>,
    expr: AssertionExpr<'d>,
    tree: Trees<'_>,
    scope: &Symbol<'d>,
) -> Result<Fragment, LoweringError> {
    let kids = expr.children();
    let Some((seq, items)) = kids.split_first() else {
        return Err(LoweringError::unsupported_at(
            "sva automaton builder: a first_match node has no sequence operand",
            scope,
        ));
    };
    let x0 = leaves.flow_in.clone();
    let r = build_node(a, leaves, *seq, tree, scope)?;
    let clock = single_clock(&r, "`first_match`")
        .map_err(|msg| LoweringError::unsupported_at(&msg, scope))?;
    if r.empty && !items.is_empty() {
        return Err(LoweringError::unsupported_at(
            "a sequence match item is attached to a first_match of a sequence that admits an \
             empty match (LRM 16.11: it shall be an error to attach a match item to such a \
             sequence)",
            scope,
        ));
    }
    if r.empty {
        // F.5.4: `flow(X, first_match(R)) = flow(X, R)`, whichever matches
        // survive.
        let mut f = empty_fragment(a);
        f.flow = r.flow;
        f.clock = clock;
        return Ok(f);
    }
    // `first_match(R, items)` is `first_match((R, items))`: the items run on
    // every end point of R, inside the bracket. Done before the never-matches
    // early-out so the items are validated either way.
    let r = if items.is_empty() {
        r
    } else {
        attach_match_items(a, leaves, r, items, &x0, scope)?
    };
    if r.exits.is_empty() {
        // `R` never matches: neither does first_match(R); nothing to bracket.
        return Ok(r);
    }
    let group = a.new_first_match_group();
    let entry = a.new_state();
    let exit = a.new_state();
    a.add_edge(entry, None, Transition::FirstMatchBegin { group }, r.entry);
    for &e in &r.exits {
        a.add_edge(e, None, Transition::FirstMatchEnd { group }, exit);
    }
    Ok(Fragment {
        entry,
        exits: vec![exit],
        empty: false,
        flow: r.flow,
        clock,
    })
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::collections::{BTreeMap, BTreeSet, HashSet};

    use sv_lang::kinds::ExpressionKind;
    use sv_lang::{AnalysisFlags, Compilation, Session, SyntaxTree};
    use sv_sim_sim::sva::trace;

    /// Compiles `property_body` as a clocked `assert property` inside an
    /// `always_ff` (same shape as this crate's other `sva` test
    /// scaffolding, `ranges.rs`/`op.rs`/`leaf.rs`), builds its automaton via
    /// [`build_automaton`], and hands `(automaton, leaves)` to `f`.
    /// `extra_decls` is for anything the property body references besides
    /// `clk`/`a`/`b`/`c`/`cnt`.
    fn automaton_of<R>(
        extra_decls: &str,
        property_body: &str,
        f: impl FnOnce(ir::Automaton, LeafTable<'_>) -> R,
    ) -> R {
        let src = format!(
            "module m;\n\
             {extra_decls}\n\
             logic clk, a, b, c;\n\
             int cnt;\n\
             always_ff @(posedge clk) begin\n\
               assert property (@(posedge clk) {property_body});\n\
             end\n\
             endmodule\n"
        );
        let session = Session::new();
        let mut comp = Compilation::new(&session).unwrap();
        comp.add_source(&src).unwrap();
        let design = comp.compile().unwrap();
        assert!(
            !design.has_fatal_errors(),
            "fixture failed to compile: {src}"
        );
        let body = design
            .top_instances()
            .next()
            .unwrap()
            .instance_body()
            .unwrap();
        let analysis = design.analyze(AnalysisFlags::NONE, 1).unwrap();
        let proc = analysis.procedures(body).next().unwrap();
        let assertion = analysis.assertions(proc.symbol()).next().unwrap();
        let tree = design.syntax_trees().into_iter().next().unwrap();
        let clocking = assertion.root().as_assertion_expr().unwrap();
        assert_eq!(clocking.kind(), AssertionExprKind::Clocking);
        let root = clocking.children()[1].as_assertion_expr().unwrap();
        let (automaton, leaves) =
            build_automaton(root, Some(clocking.children()[0]), (&tree).into(), &body).unwrap();
        f(automaton, leaves)
    }

    fn automaton_err(extra_decls: &str, property_body: &str) -> LoweringError {
        let src = format!(
            "module m;\n\
             {extra_decls}\n\
             logic clk, a, b, c;\n\
             int cnt;\n\
             always_ff @(posedge clk) begin\n\
               assert property (@(posedge clk) {property_body});\n\
             end\n\
             endmodule\n"
        );
        let session = Session::new();
        let mut comp = Compilation::new(&session).unwrap();
        comp.add_source(&src).unwrap();
        let design = comp.compile().unwrap();
        assert!(
            !design.has_fatal_errors(),
            "fixture failed to compile: {src}"
        );
        let body = design
            .top_instances()
            .next()
            .unwrap()
            .instance_body()
            .unwrap();
        let analysis = design.analyze(AnalysisFlags::NONE, 1).unwrap();
        let proc = analysis.procedures(body).next().unwrap();
        let assertion = analysis.assertions(proc.symbol()).next().unwrap();
        let tree = design.syntax_trees().into_iter().next().unwrap();
        let clocking = assertion.root().as_assertion_expr().unwrap();
        let root = clocking.children()[1].as_assertion_expr().unwrap();
        build_automaton(root, Some(clocking.children()[0]), (&tree).into(), &body)
            .expect_err("expected build_automaton to reject this")
    }

    /// Every elapsed-tick count (from `automaton.start` to a reachable
    /// `Match` edge) within `bound` ticks -- the test-only enumeration this
    /// task's own "assert the SET of accepted linear sequences matches the
    /// LRM's own enumeration" acceptance criterion needs. Bounded DFS over
    /// `(state, ticks)` pairs, deduplicated so a genuine cycle (an unbounded
    /// `[*n:$]` repetition's self-loop) terminates instead of looping
    /// forever -- production code never walks the automaton this way (the
    /// real engine steps one tick at a time per live thread, which
    /// terminates trivially because wall-clock time always advances).
    fn reachable_lengths(automaton: &ir::Automaton, bound: u32) -> BTreeSet<u32> {
        let mut out = BTreeSet::new();
        let mut seen: HashSet<(u32, u32)> = HashSet::new();
        let mut stack = vec![(automaton.start, 0u32)];
        while let Some((state_id, ticks)) = stack.pop() {
            if ticks > bound || !seen.insert((state_id.0, ticks)) {
                continue;
            }
            let state = automaton.state(state_id);
            if state.is_accepting() {
                out.insert(ticks);
            }
            for edge in &state.edges {
                match &edge.label {
                    ir::Transition::Delay { min, max } => {
                        let hi = max.unwrap_or(bound);
                        let mut k = *min;
                        while k <= hi {
                            let t = ticks + k;
                            if t > bound {
                                break;
                            }
                            stack.push((edge.target, t));
                            k += 1;
                        }
                    }
                    ir::Transition::Epsilon => stack.push((edge.target, ticks)),
                    // A local-variable action takes no time: it moves the
                    // thread on in the same tick, exactly like an epsilon, and
                    // this walk measures only elapsed ticks (the VALUES the
                    // actions compute are checked by `sva::trace`).
                    ir::Transition::LocalVarWrite { .. }
                    | ir::Transition::LocalVarCopy { .. }
                    | ir::Transition::LocalVarStep { .. }
                    | ir::Transition::SubroutineCall { .. } => stack.push((edge.target, ticks)),
                    // Whether the end point fires depends on the trace, not on
                    // the path, so this length walk cannot decide it; a test
                    // that wants it uses `sva::trace::attempt_with_clocks`.
                    ir::Transition::EndPoint { .. } => {
                        panic!("a length walk cannot decide an EndPoint edge")
                    }
                    // Which instant is the next tick of another clock is a fact
                    // about a timeline (see `sva::trace::Timeline`), not a path.
                    ir::Transition::ClockSync { .. } => {
                        panic!("a length walk cannot decide a ClockSync edge")
                    }
                    ir::Transition::Match { .. } => {
                        // Already accounted for via `is_accepting` above; a
                        // Match edge self-loops onto the same state (this
                        // module's own `build_automaton` convention), so
                        // following it would just re-push an identical pair.
                    }
                    ir::Transition::Abort { .. }
                    | ir::Transition::FirstMatchBegin { .. }
                    | ir::Transition::FirstMatchEnd { .. } => {
                        // Not produced by any fragment the T9/T10 tests build
                        // (first_match is checked by T11's trace battery, not
                        // by this length walk); nothing to walk.
                    }
                }
            }
        }
        out
    }

    // -- 16.9.2's own worked examples (plan T9 "Tests:" text) -------------

    /// `a[*3]` == `a##1a##1a` (16.9.2's own stated equivalence): both must
    /// produce the identical set of accepted lengths, and that set must be
    /// the LRM-correct `{2}` (`a[*3]` spans ticks i..i+2 inclusive -- 2
    /// ticks of elapsed time, not 3; this is the well-known identity that
    /// only holds if a bare Boolean leaf's own evaluation costs zero
    /// ADDITIONAL ticks, which is exactly what `build_leaf`'s `Epsilon`
    /// choice encodes).
    #[test]
    fn a_star_3_equiv_a_hash1_a_hash1_a() {
        let lhs = automaton_of("", "a[*3]", |au, _| reachable_lengths(&au, 10));
        let rhs = automaton_of("", "a ##1 a ##1 a", |au, _| reachable_lengths(&au, 10));
        assert_eq!(lhs, rhs);
        assert_eq!(lhs, BTreeSet::from([2]));
    }

    /// `(a##2b)[*3]`: one accepted length, the LRM-correct 8 (the explicit
    /// unrolling `a##2b##1a##2b##1a##2b` samples its final `b` 8 ticks
    /// after its first `a`).
    #[test]
    fn parenthesized_concat_repeated_fixed_count() {
        automaton_of("", "(a ##2 b)[*3]", |au, _| {
            assert_eq!(reachable_lengths(&au, 20), BTreeSet::from([8]));
        });
    }

    /// `(a##2b)[*1:5]` enumerated 5-way: `{2, 5, 8, 11, 14}` (one repeat
    /// spans 2 ticks; each additional repeat adds the unit's own 2 ticks
    /// plus the implicit `##1` link between repeats, i.e. +3 per repeat).
    #[test]
    fn parenthesized_concat_repeated_range_enumerates_five_lengths() {
        automaton_of("", "(a ##2 b)[*1:5]", |au, _| {
            assert_eq!(
                reachable_lengths(&au, 20),
                BTreeSet::from([2, 5, 8, 11, 14])
            );
        });
    }

    /// `a[*0:3]##1b##1c` enumerated 4-way per the LRM's own stated
    /// expansion (`(b##1c) or (a##1b##1c) or (a##1a##1b##1c) or
    /// (a##1a##1a##1b##1c)`): final `c` lands at ticks `{1, 2, 3, 4}`. This
    /// is the test that would fail if `build_concat`'s one empty-match rule
    /// (this module's own doc comment on `build_concat`) were removed -- a
    /// naive (non-empty-match-aware) chaining would instead report `{2, 3,
    /// 4}` (collapsing the `min == 0` branch into the `k == 1` branch's own
    /// tick value, which is LRM-wrong for the `k == 0` branch).
    #[test]
    fn simple_repeated_range_zero_to_three_then_concat_enumerates_four_lengths() {
        automaton_of("", "a[*0:3] ##1 b ##1 c", |au, _| {
            assert_eq!(reachable_lengths(&au, 20), BTreeSet::from([1, 2, 3, 4]));
        });
    }

    // -- 16.9.2's illegal goto/nonconsecutive-on-match-item example -------

    /// The LRM's own illegal example (16.9.2/16.10): goto repetition
    /// applied to a sequence that also carries a match item is rejected
    /// with a named error, never a wrong (or silently accepted) answer.
    #[test]
    fn goto_repetition_on_sequence_with_match_item_is_rejected() {
        let err = automaton_err("", "(b, cnt = cnt + 1)[->2]");
        assert!(
            err.message.contains("illegal"),
            "error should name the illegal combination: {err}"
        );
    }

    /// Same illegal combination, nonconsecutive (`[=]`) form.
    #[test]
    fn nonconsecutive_repetition_on_sequence_with_match_item_is_rejected() {
        let err = automaton_err("", "(b, cnt = cnt + 1)[=2]");
        assert!(
            err.message.contains("illegal"),
            "error should name the illegal combination: {err}"
        );
    }

    /// The LEGAL counterpart: consecutive (`[*]`) repetition on a
    /// match-item-bearing sequence is not itself illegal -- here it is
    /// rejected only because `cnt` is a module variable, not a local one
    /// (T14), never as the illegal-combination error.
    #[test]
    fn consecutive_repetition_on_sequence_with_match_item_is_not_the_illegal_case() {
        let err = automaton_err("", "(b, cnt = cnt + 1)[*2]");
        assert!(
            !err.message.contains("illegal"),
            "consecutive repetition + match item is LRM-legal (lowered; see the probe fixture \
             sva_match_item_assignments): only the module-variable target is refused: {err}"
        );
        assert!(err.message.contains("match item"), "error was: {err}");
    }

    // -- bare repetition shapes (sanity beyond the plan's named examples) -

    #[test]
    fn bare_leaf_has_single_tick_zero_length() {
        automaton_of("", "a", |au, _| {
            assert_eq!(reachable_lengths(&au, 5), BTreeSet::from([0]));
        });
    }

    #[test]
    fn consecutive_range_two_to_seven() {
        automaton_of("", "a[*2:7]", |au, _| {
            // k consecutive samples span (k-1) ticks; k in 2..=7 -> 1..=6.
            assert_eq!(
                reachable_lengths(&au, 10),
                BTreeSet::from([1, 2, 3, 4, 5, 6])
            );
        });
    }

    /// Goto repetition on a bare Boolean operand (legal, no match item):
    /// unlike consecutive repetition, a gap between the two matching ticks
    /// must be reachable. (What the gap may hold is pinned exactly by the
    /// `goto_*`/`nonconsecutive_*` tests below.)
    #[test]
    fn goto_repetition_on_bare_leaf_allows_a_gap_between_matches() {
        automaton_of("", "a[->2]", |au, _| {
            let lengths = reachable_lengths(&au, 6);
            // Exactly 1 tick apart (no gap) must still be reachable...
            assert!(lengths.contains(&1), "lengths were: {lengths:?}");
            // ...and so must a true gap (>=2 ticks between matches), which
            // would NOT be reachable under consecutive (`[*2]`) repetition
            // -- that is the entire point of `->`'s wider link window.
            assert!(
                lengths.iter().any(|&t| t >= 3),
                "a true multi-tick gap must be reachable via goto repetition: {lengths:?}"
            );
        });
    }

    /// 16.9.2: `b[->n]` is `(!b[*0:$] ##1 b)[*n]`. Pinned word by word, not
    /// only against the rewrite: `b` is false on every tick before a hit that is
    /// not itself a hit, and the match ends AT the last hit, so the first tick is
    /// either a hit or a `!b` (never an unconstrained one).
    #[test]
    fn goto_repetition_is_exact() {
        let (a, na) = ("a", "!a");
        assert_eq!(
            lang_of("a[->1]", 2),
            Lang::from([
                word(&[&[a]]),
                word(&[&[na], &[a]]),
                word(&[&[na], &[na], &[a]]),
            ])
        );
        assert_eq!(
            lang_of("a[->2]", 3),
            Lang::from([
                word(&[&[a], &[a]]),
                word(&[&[a], &[na], &[a]]),
                word(&[&[na], &[a], &[a]]),
                word(&[&[a], &[na], &[na], &[a]]),
                word(&[&[na], &[a], &[na], &[a]]),
                word(&[&[na], &[na], &[a], &[a]]),
            ])
        );
        // The empty match (16.9.2.1) of `[->0]`; `[->0:1]` adds the one-hit forms.
        assert_eq!(lang_of("a[->0]", 3), Lang::from([Word::new()]));
        // The rewrite, for counts, ranges and an open upper bound.
        for (goto, rewrite) in [
            ("a[->1]", "(!a[*0:$] ##1 a)[*1]"),
            ("a[->3]", "(!a[*0:$] ##1 a)[*3]"),
            ("a[->1:2]", "(!a[*0:$] ##1 a)[*1:2]"),
            ("a[->2:3]", "(!a[*0:$] ##1 a)[*2:3]"),
            ("a[->0:2]", "(!a[*0:$] ##1 a)[*0:2]"),
            ("a[->2:$]", "(!a[*0:$] ##1 a)[*2:$]"),
        ] {
            assert_eq!(lang_of(goto, 5), lang_of(rewrite, 5), "`{goto}`");
        }
    }

    /// 16.9.2: `b[=n]` is `b[->n] ##1 !b[*0:$]`: the goto match followed by any
    /// number of further `!b` ticks, so it may end anywhere before the next hit.
    #[test]
    fn nonconsecutive_repetition_is_exact() {
        let (a, na) = ("a", "!a");
        assert_eq!(
            lang_of("a[=1]", 2),
            Lang::from([
                word(&[&[a]]),
                word(&[&[a], &[na]]),
                word(&[&[na], &[a]]),
                word(&[&[a], &[na], &[na]]),
                word(&[&[na], &[a], &[na]]),
                word(&[&[na], &[na], &[a]]),
            ])
        );
        assert_eq!(
            lang_of("a[=2]", 2),
            Lang::from([
                word(&[&[a], &[a]]),
                word(&[&[a], &[a], &[na]]),
                word(&[&[a], &[na], &[a]]),
                word(&[&[na], &[a], &[a]]),
            ])
        );
        for (nonconsecutive, rewrite) in [
            ("a[=1]", "a[->1] ##1 !a[*0:$]"),
            ("a[=2]", "a[->2] ##1 !a[*0:$]"),
            ("a[=1:2]", "a[->1:2] ##1 !a[*0:$]"),
            ("a[=2:$]", "a[->2:$] ##1 !a[*0:$]"),
        ] {
            assert_eq!(
                lang_of(nonconsecutive, 5),
                lang_of(rewrite, 5),
                "`{nonconsecutive}`"
            );
        }
        // `[=0]` is any run of `!b` ticks, the empty match included.
        assert_eq!(lang_of("a[=0]", 4), lang_of("!a[*0:$]", 4));
        // It differs from the goto form exactly by the trailing ticks.
        assert_ne!(lang_of("a[=2]", 4), lang_of("a[->2]", 4));
    }

    /// The gap of a goto repetition is the NEGATED sample of the same leaf, one
    /// [`LeafTable::is_negated`] guard each, so the interpreter takes it only
    /// where the Boolean is false: `a[->2]` over concrete traces.
    #[test]
    fn goto_repetition_runs_on_traces() {
        // (trace of a, end ticks of the matches that START at tick 0)
        for (bits, want) in [
            ("1100", set(&[1])),
            ("0101", set(&[3])),
            ("1001", set(&[3])),
            // A third hit is not part of `a[->2]`.
            ("1111", set(&[1])),
            ("0001", set(&[])),
            ("0000", set(&[])),
        ] {
            let tr = Trace::new(&[("a", bits)]);
            assert_eq!(ends_at("a[->2]", &tr, 0), want, "a[->2] on {bits}");
        }
        // `a[=2]` also ends on every `!a` tick after the second hit.
        for (bits, want) in [
            ("1100", set(&[1, 2, 3])),
            ("0101", set(&[3])),
            ("1011", set(&[2])),
            ("1010", set(&[2, 3])),
            ("0001", set(&[])),
        ] {
            let tr = Trace::new(&[("a", bits)]);
            assert_eq!(ends_at("a[=2]", &tr, 0), want, "a[=2] on {bits}");
        }
    }

    /// 16.9.2 on 4-state traces: the gap of `b[->n]` is the sample `!b`, and
    /// `!x` is `x` (11.4.7), which a Boolean context makes false -- so a tick
    /// where `b` is `x` is neither a hit nor a gap, and the match cannot cross
    /// it. The goto form must agree with its hand-written definition on every
    /// trace, `x` included.
    #[test]
    fn goto_repetition_does_not_cross_an_x_tick() {
        // The gap leaf is the negated sample, the hit leaf the plain one.
        automaton_of("", "a[->1]", |_, leaves| {
            let negated: Vec<bool> = (0..leaves.len() as u32)
                .map(|i| leaves.is_negated(LeafId(i)))
                .collect();
            // The hit is one plain leaf; the gap (a loop body, copied for the
            // mandatory repeat) is negated everywhere it appears.
            assert_eq!(negated.iter().filter(|n| !**n).count(), 1, "{negated:?}");
            assert!(negated.iter().any(|n| *n), "{negated:?}");
        });
        for (bits, want) in [
            ("01x1", set(&[1])),
            ("0x01", set(&[])),
            ("x1", set(&[])),
            ("001x", set(&[2])),
            ("1xxx", set(&[0])),
            ("0011", set(&[2])),
        ] {
            let tr = Trace::new(&[("a", bits)]);
            assert_eq!(ends_at("a[->1]", &tr, 0), want, "a[->1] on {bits}");
            assert_eq!(
                ends_at("!a[*0:$] ##1 a", &tr, 0),
                want,
                "!a[*0:$] ##1 a on {bits}"
            );
        }
        // `a[=1]` may also run on over further known-false ticks, never an `x` one.
        for (bits, want) in [
            ("10x0", set(&[0, 1])),
            ("1x", set(&[0])),
            ("0100", set(&[1, 2, 3])),
            ("01x0", set(&[1])),
        ] {
            let tr = Trace::new(&[("a", bits)]);
            let hand = "!a[*0:$] ##1 a ##1 !a[*0:$]";
            assert_eq!(ends_at("a[=1]", &tr, 0), ends_at(hand, &tr, 0), "{bits}");
            assert_eq!(ends_at("a[=1]", &tr, 0), want, "a[=1] on {bits}");
        }
    }

    /// Unbounded consecutive repetition (`a[*2:$]`): every length from 1
    /// upward (k repeats span k-1 ticks, k >= 2) must be reachable, not just
    /// one extra step past the mandatory minimum -- proving
    /// `build_repeated_unbounded` builds a genuine cycle, not a single
    /// bonus copy.
    #[test]
    fn unbounded_consecutive_repetition_is_a_true_cycle() {
        automaton_of("", "a[*2:$]", |au, _| {
            let lengths = reachable_lengths(&au, 8);
            assert_eq!(lengths, BTreeSet::from([1, 2, 3, 4, 5, 6, 7, 8]));
        });
    }

    // -- error-path coverage: named errors, never a panic ------------------

    /// An `AssertionExprKind::Binary` operator this builder does not implement
    /// (a PROPERTY operator, `|->`: `build_property`'s) must be a named, loud
    /// `LoweringError` that names the operator -- not a wrong automaton and not
    /// a panic.
    #[test]
    fn unsupported_assertion_expr_kind_is_a_named_error() {
        let err = automaton_err("", "a |-> b");
        assert!(err.message.contains("Binary"), "error was: {err}");
        assert!(
            err.message.contains("OverlappedImplication"),
            "error should name the operator: {err}"
        );
    }

    // ======================================================================
    // T10: `##` concatenation + 16.9.2.1 empty-match algebra.
    //
    // The tests below compare the BUILT AUTOMATON against two independent
    // oracles: (1) hand-written, LRM-derived accepted-word sets for the LRM's
    // own worked examples, and (2) a small reference interpreter of Annex
    // F.5.2's tight-satisfaction semantics over explicit word languages (no
    // automata, no empty-match special cases -- plain word concatenation/
    // fusion), driven over a deterministic battery of generated sequence
    // expressions. Both observe the automaton the same way: every accepted
    // match, as a WORD (one Boolean-leaf constraint set per clock tick the
    // match spans), plus whether the empty match is admitted.
    // ======================================================================

    /// One tick of a match: the set of Boolean leaves (by source text) that
    /// must be true on it. A constant-true leaf (`1`) contributes nothing --
    /// it is the LRM's `` `true `` (16.9.2.1), vacuous by definition, which is
    /// also what the empty-match rewrite rules' own `` `true `` stands for.
    type Letter = BTreeSet<String>;
    /// A match as a word: `word.len()` ticks wide; the empty word (`vec![]`)
    /// is the length-0 empty match of 16.9.2.1.
    type Word = Vec<Letter>;
    /// Every match of a sequence spanning at most `cap` letters (clock
    /// ticks), the empty match included when admitted.
    type Lang = BTreeSet<Word>;

    fn word(letters: &[&[&str]]) -> Word {
        letters
            .iter()
            .map(|l| l.iter().map(|s| s.to_string()).collect())
            .collect()
    }

    /// A leaf's source text with whitespace removed and any redundant outer
    /// parentheses stripped (`(b)`, a parenthesized Boolean operand whose leaf
    /// node is the paren expression; `((trdy==0)&&(irdy==0))`), and nothing
    /// else touched -- `(x)&&(y)` keeps its parens, they do not pair up.
    fn norm_leaf(text: &str) -> String {
        let mut s: String = text.chars().filter(|c| !c.is_whitespace()).collect();
        loop {
            let b = s.as_bytes();
            if b.first() != Some(&b'(') || b.last() != Some(&b')') {
                return s;
            }
            // The opening paren must close at the very end.
            let mut depth = 0i32;
            let mut closes_at_end = false;
            for (i, &c) in b.iter().enumerate() {
                match c {
                    b'(' => depth += 1,
                    b')' => {
                        depth -= 1;
                        if depth == 0 {
                            closes_at_end = i == b.len() - 1;
                            break;
                        }
                    }
                    _ => {}
                }
            }
            if !closes_at_end {
                return s;
            }
            s = s[1..s.len() - 1].to_string();
        }
    }

    /// What every leaf in `leaves` stands for, indexed by `LeafId`: the name of
    /// the signal a bare-identifier leaf REFERENCES, else its normalized source
    /// text. The two agree for every leaf that is not a formal argument; for a
    /// formal (`p` in `sequence s(p); p ##1 b;`) slang hands the builder the
    /// ACTUAL's expression -- the semantic node is the actual, only its syntax
    /// still reads `p` -- so the referenced symbol is what shows that the
    /// substitution happened (T12).
    fn leaf_texts(leaves: &LeafTable<'_>, tree: &SyntaxTree) -> Vec<String> {
        (0..leaves.len() as u32)
            .map(|i| {
                let e = leaves.get(LeafId(i));
                let text = if e.kind() == ExpressionKind::NamedValue
                    && let Some(sym) = e.referenced_symbol()
                {
                    sym.name().to_string()
                } else {
                    // A compound match item's value (`v += e` is `v + e` on an
                    // `LValueReference`) is synthesized by slang and has no
                    // source text; it is named by its kind so a test can still
                    // count it.
                    match e.syntax(tree) {
                        Some(node) => norm_leaf(&node.text()),
                        None => format!("<{:?}>", e.kind()),
                    }
                };
                if leaves.is_negated(LeafId(i)) {
                    // A goto gap's `!b`: named exactly as the source text `!b`
                    // would be, so a hand-written expansion compares equal (the
                    // tests use plain identifiers).
                    assert!(
                        text.chars().all(|c| c.is_alphanumeric() || c == '_'),
                        "a negated leaf over `{text}` has no source-text spelling here"
                    );
                    return format!("!{text}");
                }
                text
            })
            .collect()
    }

    /// Enumerates every accepted match of `au` spanning at most `bound`
    /// elapsed ticks (`bound + 1` letters), as words. Bounded DFS over
    /// `(state, elapsed ticks, leaf constraints so far)`; production code never
    /// walks the automaton this way (the engine steps one tick at a time per
    /// live thread). A step cap turns an accidental zero-tick cycle into a
    /// loud failure instead of a hang.
    fn accepted_lang(
        au: &ir::Automaton,
        leaves: &LeafTable<'_>,
        tree: &SyntaxTree,
        bound: u32,
    ) -> Lang {
        let mut out = Lang::new();
        if au.admits_empty {
            out.insert(Vec::new());
        }
        let mut steps = 0u64;
        // (state, elapsed ticks, [(tick, leaf text)] constraints so far)
        type Walk = (ThreadStateId, u32, Vec<(u32, String)>);
        let texts = leaf_texts(leaves, tree);
        // A walk is fully described by where it is and what it has promised
        // so far; the ORDER of those promises is an artifact of eps-edge
        // interleaving (the product automata of T11 interleave their two
        // operands' moves, which would otherwise multiply identical walks
        // exponentially). `seen` is membership-only.
        type Seen = (u32, u32, Vec<(u32, String)>);
        let mut seen: HashSet<Seen> = HashSet::new();
        let mut stack: Vec<Walk> = vec![(au.start, 0, Vec::new())];
        while let Some((state_id, ticks, cons)) = stack.pop() {
            let mut key = cons.clone();
            key.sort();
            key.dedup();
            if !seen.insert((state_id.0, ticks, key)) {
                continue;
            }
            steps += 1;
            assert!(steps < 5_000_000, "automaton walk did not terminate");
            let state = au.state(state_id);
            if state.is_accepting() {
                let mut w: Word = vec![Letter::new(); ticks as usize + 1];
                for (t, name) in &cons {
                    w[*t as usize].insert(name.clone());
                }
                out.insert(w);
            }
            for edge in &state.edges {
                let mut cons2 = cons.clone();
                if let Some(g) = edge.guard {
                    let text = &texts[g.0 as usize];
                    if text != "1" {
                        cons2.push((ticks, text.clone()));
                    }
                }
                match &edge.label {
                    ir::Transition::Epsilon => stack.push((edge.target, ticks, cons2)),
                    ir::Transition::Delay { min, max } => {
                        let hi = max.unwrap_or(bound).min(bound);
                        for k in *min..=hi {
                            if ticks + k <= bound {
                                stack.push((edge.target, ticks + k, cons2.clone()));
                            }
                        }
                    }
                    ir::Transition::Match { .. } => {}
                    // A local-variable action takes no time and constrains no
                    // leaf: the word language is over leaf TEXTS, so it walks
                    // through (the values are `sva::trace`'s, below).
                    ir::Transition::LocalVarWrite { .. }
                    | ir::Transition::LocalVarCopy { .. }
                    | ir::Transition::LocalVarStep { .. }
                    | ir::Transition::SubroutineCall { .. } => {
                        stack.push((edge.target, ticks, cons2))
                    }
                    ir::Transition::Abort { .. } => {
                        panic!("T10 builds no Abort edges")
                    }
                    ir::Transition::EndPoint { .. } => {
                        panic!("a word-language walk cannot decide an EndPoint edge")
                    }
                    ir::Transition::ClockSync { .. } => {
                        panic!("a word-language walk cannot decide a ClockSync edge")
                    }
                    ir::Transition::FirstMatchBegin { .. }
                    | ir::Transition::FirstMatchEnd { .. } => {
                        // A word-language walk has no notion of "earliest
                        // match": first_match filters matches by their END TICK
                        // against the whole evaluation attempt, which a single
                        // path cannot see. Silently walking through the
                        // markers would accept exactly the matches first_match
                        // exists to discard, so refuse loudly; first_match is
                        // checked against concrete traces instead
                        // (`sva::trace`, the T11 batteries below).
                        panic!("accepted_lang cannot interpret first_match markers")
                    }
                }
            }
        }
        out
    }

    /// Compiles `body` as the ANTECEDENT of `body |-> 1` (16.12.7: an
    /// implication's antecedent may admit an empty match, whereas a bare
    /// sequence used as a property may not -- 16.12.2 "shall not admit an
    /// empty match" -- which would make slang reject exactly the shapes this
    /// task needs to build), builds the antecedent's automaton and returns its
    /// accepted language up to `bound` ticks. `None` when slang itself
    /// rejects the source (the generated battery below includes shapes slang
    /// has its own legality diagnostics for); a `build_automaton` failure is a
    /// hard test failure, never a skip.
    fn try_lang_of(body: &str, bound: u32) -> Option<Lang> {
        with_built(body, |au, leaves, tree| {
            accepted_lang(au, leaves, tree, bound)
        })
    }

    /// The shared front end of every antecedent-compiling helper below:
    /// compiles `body |-> 1` (see [`try_lang_of`]), builds the antecedent's
    /// automaton and hands it to `f`. `None` when slang itself rejects the
    /// source; a `build_automaton` failure is a hard test failure.
    fn with_built<R>(
        body: &str,
        f: impl FnOnce(&ir::Automaton, &LeafTable<'_>, &SyntaxTree) -> R,
    ) -> Option<R> {
        with_built_in("", body, f)
    }

    /// [`with_built`] with `extra_decls` (more module-level declarations the
    /// body references -- the LRM figures' own signal names).
    fn with_built_in<R>(
        extra_decls: &str,
        body: &str,
        f: impl FnOnce(&ir::Automaton, &LeafTable<'_>, &SyntaxTree) -> R,
    ) -> Option<R> {
        let src = format!(
            "module m;\n\
             {extra_decls}\n\
             logic clk, a, b, c, d, e;\n\
             always_ff @(posedge clk) begin\n\
               assert property (@(posedge clk) {body} |-> 1);\n\
             end\n\
             endmodule\n"
        );
        let session = Session::new();
        let mut comp = Compilation::new(&session).unwrap();
        comp.add_source(&src).unwrap();
        let design = comp.compile().unwrap();
        if design.has_fatal_errors() {
            return None;
        }
        let m = design
            .top_instances()
            .next()
            .unwrap()
            .instance_body()
            .unwrap();
        let analysis = design.analyze(AnalysisFlags::NONE, 1).unwrap();
        let proc = analysis.procedures(m).next().unwrap();
        let assertion = analysis.assertions(proc.symbol()).next().unwrap();
        let tree = design.syntax_trees().into_iter().next().unwrap();
        let clocking = assertion.root().as_assertion_expr().unwrap();
        let implication = clocking.children()[1].as_assertion_expr().unwrap();
        assert_eq!(implication.kind(), AssertionExprKind::Binary);
        let root = implication.children()[0].as_assertion_expr().unwrap();
        let (au, leaves) = build_automaton(root, Some(clocking.children()[0]), (&tree).into(), &m)
            .unwrap_or_else(|e| panic!("build_automaton failed for `{body}`: {e}"));
        Some(f(&au, &leaves, &tree))
    }

    fn lang_of(body: &str, bound: u32) -> Lang {
        try_lang_of(body, bound).unwrap_or_else(|| panic!("`{body}` failed to compile"))
    }

    // -- 16.9.2.1's four rules, one dedicated test each --------------------

    /// Rule 1 and the LRM's own discriminating pair, verbatim: `a[*0] ##0 b`
    /// "can never be matched", while `` `true ##0 b `` "will match during any
    /// time step when the sampled value of b is true". The pair differs ONLY
    /// in the empty operand, so this test fails if empty operands are treated
    /// as `true` (the naive reading) in either direction.
    #[test]
    fn lrm_empty_hash0_b_never_matches_but_true_hash0_b_matches_whenever_b() {
        assert_eq!(lang_of("a[*0] ##0 b", 8), Lang::new());
        assert_eq!(lang_of("1 ##0 b", 8), Lang::from([word(&[&["b"]])]));
    }

    /// Rule 2: `seq ##0 empty` does not result in a match.
    #[test]
    fn seq_hash0_empty_never_matches() {
        assert_eq!(lang_of("b ##0 a[*0]", 8), Lang::new());
    }

    /// Rule 3: `empty ##n seq` (n > 0) is `##(n-1) seq`, checked against
    /// BOTH the stated rewrite target and its explicit meaning.
    #[test]
    fn empty_hash_n_seq_is_delay_n_minus_1_seq() {
        // n = 1: `##0 b` == `b`.
        assert_eq!(lang_of("a[*0] ##1 b", 8), Lang::from([word(&[&["b"]])]));
        assert_eq!(lang_of("a[*0] ##1 b", 8), lang_of("##0 b", 8));
        // n = 2: `##1 b`, one tick later.
        assert_eq!(
            lang_of("a[*0] ##2 b", 8),
            Lang::from([word(&[&[], &["b"]])])
        );
        assert_eq!(lang_of("a[*0] ##2 b", 8), lang_of("##1 b", 8));
        // n = 4 with a compound right operand.
        assert_eq!(
            lang_of("a[*0] ##4 (b ##1 c)", 12),
            lang_of("##3 (b ##1 c)", 12)
        );
    }

    /// Rule 4: `seq ##n empty` (n > 0) is `seq ##(n-1) `true`.
    #[test]
    fn seq_hash_n_empty_is_seq_delay_n_minus_1_true() {
        // n = 1: `b ##0 1` == `b`.
        assert_eq!(lang_of("b ##1 a[*0]", 8), Lang::from([word(&[&["b"]])]));
        // n = 2: `b ##1 1` -- one extra (vacuous) tick after b.
        assert_eq!(
            lang_of("b ##2 a[*0]", 8),
            Lang::from([word(&[&["b"], &[]])])
        );
        assert_eq!(lang_of("b ##2 a[*0]", 8), lang_of("b ##1 1", 8));
        assert_eq!(lang_of("b ##3 a[*0]", 8), lang_of("b ##2 1", 8));
    }

    /// 16.9.2.1's multiple-concatenation example, verbatim: `b ##1 a[*0:1]
    /// ##2 c` is `(b ##1 a[*0] ##2 c) or (b ##1 a[*1] ##2 c)`, i.e. `(b ##2 c)
    /// or (b ##1 a ##2 c)` -- "the total execution time of the sequence is one
    /// less than when using the 1-tick interval specified by a[*1]".
    #[test]
    fn lrm_multiple_concatenation_example_matches_its_stated_simplification() {
        let got = lang_of("b ##1 a[*0:1] ##2 c", 10);
        let want_b2c = lang_of("b ##2 c", 10);
        let want_b1a2c = lang_of("b ##1 a ##2 c", 10);
        // The two simplified alternatives, spelled out (guards the helper
        // itself, not just the equality).
        assert_eq!(want_b2c, Lang::from([word(&[&["b"], &[], &["c"]])]));
        assert_eq!(
            want_b1a2c,
            Lang::from([word(&[&["b"], &["a"], &[], &["c"]])])
        );
        let expected: Lang = want_b2c.union(&want_b1a2c).cloned().collect();
        assert_eq!(got, expected);
        // One tick shorter for the empty case.
        assert_eq!(got.len(), 2);
    }

    /// Both operands empty (`empty ##n empty`): Annex F.5.2's concatenation
    /// semantics (`x y` over words, `##n` = n-1 vacuous ticks between), which
    /// the 16.9.2.1 prose rules reduce to by repeated application: `##0` no
    /// match, `##1` the empty match, `##n` (n >= 2) `n-1` vacuous ticks.
    #[test]
    fn empty_hash_n_empty() {
        let none = try_lang_of("a[*0] ##0 b[*0]", 8).unwrap();
        assert_eq!(none, Lang::new());
        let one = lang_of("a[*0] ##1 b[*0]", 8);
        assert_eq!(one, Lang::from([Vec::new()]), "empty ##1 empty = empty");
        let three = lang_of("a[*0] ##3 b[*0]", 8);
        assert_eq!(three, Lang::from([word(&[&[], &[]])]), "two vacuous ticks");
    }

    /// Empty-capable operands on both sides (`a[*0:1] ##n b[*0:1]`): every
    /// one of the four empty/nonempty combinations is a distinct accepted
    /// word, enumerated by hand for n = 0, 1, 2.
    #[test]
    fn both_operands_admit_empty_and_nonempty() {
        assert_eq!(
            lang_of("a[*0:1] ##0 b[*0:1]", 8),
            Lang::from([word(&[&["a", "b"]])]),
            "##0 needs both operands nonempty (rules 1-2), fusing a and b into one tick"
        );
        assert_eq!(
            lang_of("a[*0:1] ##1 b[*0:1]", 8),
            Lang::from([
                Vec::new(),              // empty ##1 empty
                word(&[&["b"]]),         // empty ##1 b
                word(&[&["a"]]),         // a ##1 empty
                word(&[&["a"], &["b"]]), // a ##1 b
            ])
        );
        assert_eq!(
            lang_of("a[*0:1] ##2 b[*0:1]", 8),
            Lang::from([
                word(&[&[]]),                 // empty ##2 empty = one vacuous tick
                word(&[&[], &["b"]]),         // empty ##2 b = ##1 b
                word(&[&["a"], &[]]),         // a ##2 empty = a ##1 true
                word(&[&["a"], &[], &["b"]]), // a ##2 b
            ])
        );
    }

    /// A repeated unit that itself admits an empty match: `(a[*0:1])[*2]` is
    /// `empty/a`, `##1`-concatenated twice -- the empty word, `a`, and
    /// `a ##1 a`.
    #[test]
    fn repetition_of_a_unit_that_admits_empty() {
        assert_eq!(
            lang_of("(a[*0:1])[*2]", 8),
            Lang::from([Vec::new(), word(&[&["a"]]), word(&[&["a"], &["a"]])])
        );
    }

    // -- ##N / ##[m:n] / ##[*] / ##[+] shapes -------------------------------

    #[test]
    fn leading_cycle_delay() {
        assert_eq!(lang_of("##2 b", 8), Lang::from([word(&[&[], &[], &["b"]])]));
        assert_eq!(lang_of("##0 b", 8), Lang::from([word(&[&["b"]])]));
        assert_eq!(
            lang_of("##[1:3] a ##1 b", 8),
            Lang::from([
                word(&[&[], &["a"], &["b"]]),
                word(&[&[], &[], &["a"], &["b"]]),
                word(&[&[], &[], &[], &["a"], &["b"]]),
            ])
        );
    }

    #[test]
    fn ranged_delay_includes_zero_as_fusion() {
        assert_eq!(
            lang_of("a ##[0:2] b", 8),
            Lang::from([
                word(&[&["a", "b"]]),
                word(&[&["a"], &["b"]]),
                word(&[&["a"], &[], &["b"]]),
            ])
        );
    }

    /// `##[*]` is `##[0:$]` and `##[+]` is `##[1:$]` (16.7), both in the
    /// infix and the leading position.
    #[test]
    fn star_and_plus_delay_are_zero_and_one_to_dollar() {
        assert_eq!(lang_of("a ##[*] b", 6), lang_of("a ##[0:$] b", 6));
        assert_eq!(lang_of("a ##[+] b", 6), lang_of("a ##[1:$] b", 6));
        assert_eq!(lang_of("##[*] b", 6), lang_of("##[0:$] b", 6));
        assert_eq!(lang_of("##[+] b", 6), lang_of("##[1:$] b", 6));
        // `[*]` includes the same-tick fusion, `[+]` does not.
        assert!(lang_of("a ##[*] b", 6).contains(&word(&[&["a", "b"]])));
        assert!(!lang_of("a ##[+] b", 6).contains(&word(&[&["a", "b"]])));
        // Every length from the minimum up to the bound is reachable (a true
        // unbounded window, not one bonus step).
        assert_eq!(lang_of("a ##[+] b", 6).len(), 6);
        assert_eq!(lang_of("a ##[*] b", 6).len(), 7);
    }

    #[test]
    fn fused_chain() {
        assert_eq!(
            lang_of("a ##0 b ##0 c", 4),
            Lang::from([word(&[&["a", "b", "c"]])])
        );
    }

    /// A parenthesized concatenation as an operand of an outer `##` (slang
    /// binds it as a `SequenceConcat` whose syntax node is the paren node,
    /// not a `DelayedSequenceExpr`).
    #[test]
    fn parenthesized_concat_operands() {
        let want = Lang::from([word(&[&["a"], &["b"], &[], &["c"]])]);
        assert_eq!(lang_of("(a ##1 b) ##2 c", 8), want);
        assert_eq!(lang_of("((a ##1 b)) ##2 c", 8), want);
        assert_eq!(lang_of("a ##1 (b ##2 c)", 8), lang_of("a ##1 b ##2 c", 8));
        assert_eq!(lang_of("(a ##1 b)", 8), lang_of("a ##1 b", 8));
        assert_eq!(
            lang_of("a ##1 (b[*0:1]) ##1 c", 8),
            lang_of("a ##1 b[*0:1] ##1 c", 8)
        );
        assert_eq!(
            lang_of("a ##1 ((b ##1 c)[*0:1]) ##1 a", 8),
            lang_of("a ##1 (b ##1 c)[*0:1] ##1 a", 8)
        );
    }

    /// A reversed delay range is slang-legal source only if slang accepts it
    /// at all; if it does, the builder must reject it by name, not wrap.
    #[test]
    fn reversed_delay_range_is_a_named_error_or_a_slang_error() {
        let src = "module m;\nlogic clk, a, b;\nalways_ff @(posedge clk) begin\n \
                   assert property (@(posedge clk) a ##[3:1] b);\nend\nendmodule\n";
        let session = Session::new();
        let mut comp = Compilation::new(&session).unwrap();
        comp.add_source(src).unwrap();
        let design = comp.compile().unwrap();
        if design.has_fatal_errors() {
            return; // slang's own diagnostic already rejects it
        }
        let err = automaton_err("", "a ##[3:1] b");
        assert!(err.message.contains("min"), "error was: {err}");
    }

    // -- generated differential battery vs the Annex F reference ------------

    /// The reference sequence language: a syntax tree rendered to SV source
    /// AND interpreted by the Annex F.5.2 word semantics below.
    #[derive(Clone, Debug)]
    enum Rx {
        Leaf(&'static str),
        Cat(Box<Rx>, Dl, Box<Rx>),
        Lead(Dl, Box<Rx>),
        Rep(Box<Rx>, Rp),
        Paren(Box<Rx>),
        /// T11: `(l) op (r)` for the binary sequence operators.
        Bin(Box<Rx>, SeqOp, Box<Rx>),
        /// T11: `(cond) throughout (s)`; `cond` is a Boolean leaf's source text.
        Thr(&'static str, Box<Rx>),
        /// T11: `first_match(s)`.
        First(Box<Rx>),
    }

    /// T11: the binary sequence operators (16.9.5-16.9.7, 16.9.10).
    #[derive(Clone, Copy, Debug, PartialEq, Eq)]
    enum SeqOp {
        And,
        Or,
        Intersect,
        Within,
    }

    impl SeqOp {
        fn text(self) -> &'static str {
            match self {
                SeqOp::And => "and",
                SeqOp::Or => "or",
                SeqOp::Intersect => "intersect",
                SeqOp::Within => "within",
            }
        }
    }

    /// A `##` delay: `[min, max]` (`None` = `$`), plus its source spelling.
    #[derive(Clone, Copy, Debug)]
    struct Dl {
        min: u32,
        max: Option<u32>,
        text: &'static str,
    }

    /// A `[*...]` repetition: `[min, max]`, plus its source spelling.
    #[derive(Clone, Copy, Debug)]
    struct Rp {
        min: u32,
        max: Option<u32>,
        text: &'static str,
    }

    const DELAYS: &[Dl] = &[
        Dl {
            min: 0,
            max: Some(0),
            text: "##0",
        },
        Dl {
            min: 1,
            max: Some(1),
            text: "##1",
        },
        Dl {
            min: 2,
            max: Some(2),
            text: "##2",
        },
        Dl {
            min: 3,
            max: Some(3),
            text: "##3",
        },
        Dl {
            min: 0,
            max: Some(2),
            text: "##[0:2]",
        },
        Dl {
            min: 1,
            max: Some(3),
            text: "##[1:3]",
        },
        Dl {
            min: 2,
            max: None,
            text: "##[2:$]",
        },
        Dl {
            min: 0,
            max: None,
            text: "##[*]",
        },
        Dl {
            min: 1,
            max: None,
            text: "##[+]",
        },
    ];

    const REPS: &[Rp] = &[
        Rp {
            min: 0,
            max: Some(0),
            text: "[*0]",
        },
        Rp {
            min: 1,
            max: Some(1),
            text: "[*1]",
        },
        Rp {
            min: 2,
            max: Some(2),
            text: "[*2]",
        },
        Rp {
            min: 0,
            max: Some(1),
            text: "[*0:1]",
        },
        Rp {
            min: 0,
            max: Some(2),
            text: "[*0:2]",
        },
        Rp {
            min: 1,
            max: Some(3),
            text: "[*1:3]",
        },
        Rp {
            min: 0,
            max: None,
            text: "[*]",
        },
        Rp {
            min: 1,
            max: None,
            text: "[+]",
        },
        Rp {
            min: 2,
            max: None,
            text: "[*2:$]",
        },
    ];

    /// Left-folded `##` chain rendering: an operand renders unparenthesized
    /// only where the grammar's left-recursive `sequence_expr ##d
    /// sequence_expr` makes that equal to the tree's own shape.
    fn render(rx: &Rx) -> String {
        match rx {
            Rx::Leaf(n) => n.to_string(),
            Rx::Paren(r) => format!("({})", render(r)),
            Rx::Lead(d, r) => format!("{} {}", d.text, render_operand(r)),
            Rx::Cat(l, d, r) => format!("{} {} {}", render_left(l), d.text, render_operand(r)),
            Rx::Rep(r, p) => match **r {
                Rx::Leaf(_) => format!("{}{}", render(r), p.text),
                _ => format!("({}){}", render(r), p.text),
            },
            // Fully parenthesized: the operators' relative precedence is not
            // under test here, only their semantics.
            Rx::Bin(l, op, r) => format!("(({}) {} ({}))", render(l), op.text(), render(r)),
            Rx::Thr(c, r) => format!("(({c}) throughout ({}))", render(r)),
            Rx::First(r) => format!("first_match({})", render(r)),
        }
    }

    /// Left operand of a `##`: a chain or leading delay continues the same
    /// left fold; anything else is itself an atom.
    fn render_left(rx: &Rx) -> String {
        render(rx)
    }

    /// Right operand of a `##` (or the operand of a leading delay): anything
    /// that is itself a chain/delay must be parenthesized to keep its shape.
    fn render_operand(rx: &Rx) -> String {
        match rx {
            Rx::Cat(..) | Rx::Lead(..) => format!("({})", render(rx)),
            _ => render(rx),
        }
    }

    fn cat_words(l1: &Lang, d: Dl, l2: &Lang, cap: usize) -> Lang {
        let mut out = Lang::new();
        // `k` reaches `cap + 1`: two empty words joined by `##(cap + 1)` are
        // `1[*cap]`, a word of `cap` letters.
        let hi = d.max.unwrap_or(cap as u32 + 1).min(cap as u32 + 1);
        for x in l1 {
            for y in l2 {
                for k in d.min..=hi {
                    let w: Word = if k == 0 {
                        // F.5.2: `xyz` with `|y| = 1`, `xy |= R1`, `yz |= R2`:
                        // the last letter of the left word is the first
                        // letter of the right word. Needs both nonempty.
                        if x.is_empty() || y.is_empty() {
                            continue;
                        }
                        let mut w = x[..x.len() - 1].to_vec();
                        let fused: Letter = x[x.len() - 1].union(&y[0]).cloned().collect();
                        w.push(fused);
                        w.extend_from_slice(&y[1..]);
                        w
                    } else {
                        // `R1 ##k R2` = `R1 ##1 1[*k-1] ##1 R2`: plain word
                        // concatenation with `k - 1` vacuous letters between.
                        let mut w = x.clone();
                        w.extend(std::iter::repeat_n(Letter::new(), (k - 1) as usize));
                        w.extend_from_slice(y);
                        w
                    };
                    if w.len() <= cap {
                        out.insert(w);
                    }
                }
            }
        }
        out
    }

    fn lang_ref(rx: &Rx, cap: usize) -> Lang {
        match rx {
            Rx::Leaf("1") => Lang::from([vec![Letter::new()]]),
            Rx::Leaf(n) => Lang::from([vec![Letter::from([n.to_string()])]]),
            Rx::Paren(r) => lang_ref(r, cap),
            Rx::Cat(l, d, r) => cat_words(&lang_ref(l, cap), *d, &lang_ref(r, cap), cap),
            Rx::Lead(d, r) => {
                // `##[m:n] R` = `1[*m:n] ##1 R` (F.3.4.2.2).
                let r = lang_ref(r, cap);
                let mut out = Lang::new();
                let hi = d.max.unwrap_or(cap as u32).min(cap as u32);
                for k in d.min..=hi {
                    for y in &r {
                        let mut w: Word = vec![Letter::new(); k as usize];
                        w.extend_from_slice(y);
                        if w.len() <= cap {
                            out.insert(w);
                        }
                    }
                }
                out
            }
            Rx::Rep(r, p) => {
                // `R[*0]` = the empty word; `R[*k]` = `R[*k-1] ##1 R`.
                let unit = lang_ref(r, cap);
                let one = Dl {
                    min: 1,
                    max: Some(1),
                    text: "##1",
                };
                let mut pow = Lang::from([Vec::new()]);
                let mut out = Lang::new();
                let top = p.max.unwrap_or(cap as u32 + 1).min(cap as u32 + 1);
                if p.min == 0 {
                    out.extend(pow.iter().cloned());
                }
                for k in 1..=top {
                    pow = cat_words(&pow, one, &unit, cap);
                    if k >= p.min {
                        out.extend(pow.iter().cloned());
                    }
                }
                out
            }
            Rx::Bin(l, op, r) => {
                let (l, r) = (lang_ref(l, cap), lang_ref(r, cap));
                let one = Dl {
                    min: 1,
                    max: Some(1),
                    text: "##1",
                };
                match op {
                    SeqOp::Or => l.union(&r).cloned().collect(),
                    SeqOp::Intersect => intersect_words(&l, &r),
                    // Annex F.3.4.2.4's definition, verbatim:
                    //   r1 and r2 = ((r1 ##1 1[*0:$]) intersect r2)
                    //               or (r1 intersect (r2 ##1 1[*0:$]))
                    SeqOp::And => {
                        let pad = true_run_words(cap);
                        let first = intersect_words(&cat_words(&l, one, &pad, cap), &r);
                        let second = intersect_words(&l, &cat_words(&r, one, &pad, cap));
                        first.union(&second).cloned().collect()
                    }
                    // 16.9.10: `s1 within s2` is
                    //   (1[*0:$] ##1 s1 ##1 1[*0:$]) intersect s2
                    // (`l` is s1, `r` is s2).
                    SeqOp::Within => {
                        let pad = true_run_words(cap);
                        let wrapped = cat_words(&cat_words(&pad, one, &l, cap), one, &pad, cap);
                        intersect_words(&wrapped, &r)
                    }
                }
            }
            Rx::Thr(c, r) => {
                // 16.9.9: `exp throughout seq` is `(exp)[*0:$] intersect seq`.
                let run: Lang = (0..=cap)
                    .map(|k| vec![Letter::from([c.to_string()]); k])
                    .collect();
                intersect_words(&run, &lang_ref(r, cap))
            }
            Rx::First(_) => panic!(
                "first_match is a filter over match END TICKS of an attempt, which a word \
                 language cannot express; it is checked against concrete traces"
            ),
        }
    }

    /// `1[*0:$]` as words of at most `cap` letters: every run of vacuous ticks
    /// (the LRM's `` `true ``), the empty run included.
    fn true_run_words(cap: usize) -> Lang {
        (0..=cap).map(|k| vec![Letter::new(); k]).collect()
    }

    /// Annex F.5.2's `intersect`: both operands match the SAME word. Over
    /// constraint-set words that is equal length, letter-wise union.
    fn intersect_words(l: &Lang, r: &Lang) -> Lang {
        let mut out = Lang::new();
        for x in l {
            for y in r {
                if x.len() == y.len() {
                    out.insert(
                        x.iter()
                            .zip(y)
                            .map(|(p, q)| p.union(q).cloned().collect())
                            .collect(),
                    );
                }
            }
        }
        out
    }

    /// Deterministic generator (a fixed-seed LCG: no `rand` dependency, and
    /// the battery never changes between runs).
    struct Lcg(u64);

    impl Lcg {
        fn next(&mut self, n: usize) -> usize {
            self.0 = self
                .0
                .wrapping_mul(6364136223846793005)
                .wrapping_add(1442695040888963407);
            ((self.0 >> 33) as usize) % n
        }
    }

    fn gen_rx(g: &mut Lcg, depth: u32) -> Rx {
        const LEAVES: &[&str] = &["a", "b", "c", "1"];
        let leaf = |g: &mut Lcg| Rx::Leaf(LEAVES[g.next(LEAVES.len())]);
        if depth == 0 {
            return leaf(g);
        }
        match g.next(10) {
            0..=1 => leaf(g),
            2..=5 => {
                // A left-folded chain of 2-3 operands.
                let mut acc = gen_rx(g, depth - 1);
                for _ in 0..(1 + g.next(2)) {
                    let d = DELAYS[g.next(DELAYS.len())];
                    let rhs = gen_rx(g, depth - 1);
                    acc = Rx::Cat(Box::new(acc), d, Box::new(rhs));
                }
                acc
            }
            6 => Rx::Lead(DELAYS[g.next(DELAYS.len())], Box::new(gen_rx(g, depth - 1))),
            7..=8 => Rx::Rep(Box::new(gen_rx(g, depth - 1)), REPS[g.next(REPS.len())]),
            _ => Rx::Paren(Box::new(gen_rx(g, depth - 1))),
        }
    }

    /// Number of `##` concatenations in `rx` with at least one operand that
    /// admits the empty match -- the sites where 16.9.2.1's rules fire.
    fn concats_with_empty_operand(rx: &Rx, cap: usize) -> usize {
        let admits_empty = |r: &Rx| lang_ref(r, cap).contains(&Vec::new());
        match rx {
            Rx::Leaf(_) => 0,
            Rx::Paren(r) | Rx::Rep(r, _) | Rx::Thr(_, r) | Rx::First(r) => {
                concats_with_empty_operand(r, cap)
            }
            Rx::Lead(_, r) => concats_with_empty_operand(r, cap),
            Rx::Bin(l, _, r) => {
                concats_with_empty_operand(l, cap) + concats_with_empty_operand(r, cap)
            }
            Rx::Cat(l, _, r) => {
                usize::from(admits_empty(l) || admits_empty(r))
                    + concats_with_empty_operand(l, cap)
                    + concats_with_empty_operand(r, cap)
            }
        }
    }

    /// The differential battery: 1000 generated sequences (fixed seed), every
    /// one built into an automaton and compared, match for match, against the
    /// Annex F reference language. This is what pins the empty-match algebra
    /// in every concatenation position (first/middle/last operand, both
    /// operands, nested through repetition and parentheses) at once.
    #[test]
    fn generated_sequences_match_the_annex_f_reference() {
        const BOUND: u32 = 6;
        let mut g = Lcg(0x5eed_5eed_5eed_5eed);
        let (mut compared, mut skipped, mut with_empty, mut empty_sites) = (0usize, 0, 0, 0);
        for _ in 0..1000 {
            let rx = gen_rx(&mut g, 3);
            let src = render(&rx);
            let want = lang_ref(&rx, BOUND as usize + 1);
            match try_lang_of(&src, BOUND) {
                None => skipped += 1,
                Some(got) => {
                    assert_eq!(got, want, "automaton vs Annex F reference for `{src}`");
                    compared += 1;
                    with_empty += usize::from(want.contains(&Vec::new()));
                    empty_sites += concats_with_empty_operand(&rx, BOUND as usize + 1);
                }
            }
        }
        // The battery must actually exercise the empty-match algebra, not
        // vacuously pass on a generator that produced nothing relevant.
        assert!(
            compared >= 700,
            "only {compared} compared, {skipped} skipped"
        );
        assert!(
            with_empty >= 40,
            "only {with_empty} sequences admit an empty match"
        );
        assert!(
            empty_sites >= 150,
            "only {empty_sites} concatenations had an empty-admitting operand"
        );
    }

    // ======================================================================
    // T11: `and` / `intersect` / `or` / `first_match` / `throughout` /
    // `within` (LRM 16.9.5-16.9.10).
    //
    // Three oracles, none of which looks at the builder:
    //  1. hand-derived word languages (this block's first half) -- every
    //     expected set is spelled out from the LRM text or Annex F;
    //  2. the Annex F word-language reference `lang_ref` (operators other
    //     than `first_match`, which no word language can express);
    //  3. `ref_lens`, a trace-level reference over CONCRETE traces that also
    //     covers `first_match`, driven by `sva::trace::attempt` on the
    //     automaton side, plus the LRM's own figures 16-5..16-13.
    // ======================================================================

    // -- or ---------------------------------------------------------------

    /// 16.9.7: "the set of matches of te1 or te2 is the union of the set of
    /// matches of te1 with the set of matches of te2".
    #[test]
    fn or_is_the_union_of_the_operands_matches() {
        assert_eq!(
            lang_of("(a or b)", 8),
            Lang::from([word(&[&["a"]]), word(&[&["b"]])])
        );
        assert_eq!(
            lang_of("((a ##1 b) or (c ##2 a))", 8),
            Lang::from([word(&[&["a"], &["b"]]), word(&[&["c"], &[], &["a"]])])
        );
        // The empty match is a member of the union.
        assert_eq!(
            lang_of("(a[*0] or b)", 8),
            Lang::from([Vec::new(), word(&[&["b"]])])
        );
        // A set union: identical operands do not double up.
        assert_eq!(lang_of("(a or a)", 8), lang_of("a", 8));
        // As an operand of a concatenation it distributes.
        assert_eq!(
            lang_of("(a or b) ##1 c", 8),
            Lang::from([word(&[&["a"], &["c"]]), word(&[&["b"], &["c"]])])
        );
        assert_eq!(
            lang_of("c ##1 (a or (b ##1 b))", 8),
            Lang::from([word(&[&["c"], &["a"]]), word(&[&["c"], &["b"], &["b"]])])
        );
    }

    // -- intersect --------------------------------------------------------

    /// 16.9.6: both operands match and the matches have the same length.
    #[test]
    fn intersect_pairs_matches_of_the_same_length() {
        // `a ##[1:3] b` has lengths 2, 3, 4; `c ##2 d` has length 3.
        assert_eq!(
            lang_of("((a ##[1:3] b) intersect (c ##2 d))", 8),
            Lang::from([word(&[&["a", "c"], &[], &["b", "d"]])])
        );
        assert_eq!(
            lang_of("(a[*1:3] intersect b[*2])", 8),
            Lang::from([word(&[&["a", "b"], &["a", "b"]])])
        );
        // Different, fixed lengths never pair.
        assert_eq!(lang_of("(a[*2] intersect b[*3])", 8), Lang::new());
        assert_eq!(lang_of("(a intersect (b ##1 c))", 8), Lang::new());
        // Unbounded against a window: every common length.
        assert_eq!(
            lang_of("(a[*] intersect b[*2:3])", 8),
            Lang::from([
                word(&[&["a", "b"], &["a", "b"]]),
                word(&[&["a", "b"], &["a", "b"], &["a", "b"]])
            ])
        );
        // The same operand twice is the operand itself (both samples hold).
        assert_eq!(
            lang_of("((a ##1 b) intersect (a ##1 b))", 8),
            lang_of("a ##1 b", 8)
        );
    }

    /// 16.9.2.1 through `intersect`: an empty match has length 0, so it pairs
    /// with another empty match and with nothing else.
    #[test]
    fn intersect_of_empty_matches() {
        assert_eq!(
            lang_of("(a[*0] intersect b[*0])", 8),
            Lang::from([Vec::new()])
        );
        assert_eq!(lang_of("(a[*0] intersect b)", 8), Lang::new());
        assert_eq!(lang_of("(a[*0:2] intersect b[*0:1])", 8), {
            Lang::from([Vec::new(), word(&[&["a", "b"]])])
        });
    }

    // -- and --------------------------------------------------------------

    /// 16.9.5: both operands match, from the same start; the composite ends
    /// where the LATER operand ends. (Annex F.3.4.2.4 spells it out as two
    /// intersects over `##1 1[*0:$]`-padded operands; the expected sets
    /// below are that formula worked by hand.)
    #[test]
    fn and_ends_where_the_later_operand_ends() {
        assert_eq!(lang_of("(a and b)", 8), Lang::from([word(&[&["a", "b"]])]));
        // Lengths 2 and 3: the shorter is padded to the longer.
        assert_eq!(
            lang_of("((a ##1 b) and (c ##2 d))", 8),
            Lang::from([word(&[&["a", "c"], &["b"], &["d"]])])
        );
        // ...in either operand order.
        assert_eq!(
            lang_of("((c ##2 d) and (a ##1 b))", 8),
            Lang::from([word(&[&["a", "c"], &["b"], &["d"]])])
        );
        assert_eq!(
            lang_of("(a and (b ##[1:2] c))", 8),
            Lang::from([
                word(&[&["a", "b"], &["c"]]),
                word(&[&["a", "b"], &[], &["c"]])
            ])
        );
    }

    /// An empty operand of `and` is "already matched": `ε and R` has R's
    /// matches (Annex F.3.4.2.4 applied to the empty word), and `ε and ε` is
    /// the empty match.
    #[test]
    fn and_with_an_empty_operand() {
        assert_eq!(lang_of("(a[*0] and b)", 8), Lang::from([word(&[&["b"]])]));
        assert_eq!(
            lang_of("(a[*0] and (b ##1 c))", 8),
            Lang::from([word(&[&["b"], &["c"]])])
        );
        assert_eq!(lang_of("(a[*0] and b[*0])", 8), Lang::from([Vec::new()]));
        assert_eq!(
            lang_of("(a[*0:1] and b[*0:1])", 8),
            Lang::from([
                Vec::new(),
                word(&[&["a"]]),
                word(&[&["b"]]),
                word(&[&["a", "b"]])
            ])
        );
    }

    /// Annex F.3.4.2.4's definition, as SOURCE TEXT:
    /// `r1 and r2 = ((r1 ##1 1[*0:$]) intersect r2) or (r1 intersect (r2 ##1
    /// 1[*0:$]))`. The built `and` must equal the built rewrite.
    #[test]
    fn and_equals_its_annex_f_rewrite() {
        let operands = [
            "a",
            "a ##2 b",
            "a ##[1:3] b",
            "a[*0:2]",
            "(a ##1 b)[*1:2]",
            "a[*0] ##[0:2] b",
            "a ##[2:$] b",
        ];
        for r1 in operands {
            for r2 in ["c", "c ##1 d", "c[*0:1]", "(c ##2 d)[*1:2]", "c ##[1:3] d"] {
                let and = lang_of(&format!("(({r1}) and ({r2}))"), 7);
                let rewrite = lang_of(
                    &format!(
                        "((({r1}) ##1 1[*0:$]) intersect ({r2})) or \
                         (({r1}) intersect (({r2}) ##1 1[*0:$]))"
                    ),
                    7,
                );
                assert_eq!(and, rewrite, "`({r1}) and ({r2})`");
            }
        }
    }

    // -- throughout / within ---------------------------------------------

    /// 16.9.9: `exp throughout seq` is `(exp)[*0:$] intersect seq`.
    #[test]
    fn throughout_holds_the_condition_on_every_tick() {
        assert_eq!(
            lang_of("(a throughout (b ##2 c))", 8),
            Lang::from([word(&[&["a", "b"], &["a"], &["a", "c"]])])
        );
        assert_eq!(
            lang_of("(a throughout b[*0:2])", 8),
            Lang::from([
                Vec::new(),
                word(&[&["a", "b"]]),
                word(&[&["a", "b"], &["a", "b"]])
            ])
        );
        assert_eq!(lang_of("(a throughout b[*0])", 8), Lang::from([Vec::new()]));
        // Without parentheses around the whole expression, too.
        assert_eq!(
            lang_of("a throughout b ##1 c", 8),
            lang_of("(a throughout (b ##1 c))", 8)
        );
    }

    #[test]
    fn throughout_equals_its_rewrite() {
        for s in [
            "b",
            "b ##2 c",
            "b[*0:2]",
            "(b ##1 c)[*1:3]",
            "b ##[1:3] c",
            "b ##[2:$] c",
        ] {
            assert_eq!(
                lang_of(&format!("(a throughout ({s}))"), 8),
                lang_of(&format!("(a[*0:$] intersect ({s}))"), 8),
                "`a throughout ({s})`"
            );
        }
    }

    /// 16.9.10: `seq1 within seq2` is `(1[*0:$] ##1 seq1 ##1 1[*0:$])
    /// intersect seq2`: seq1 matches along a sub-interval of seq2's match.
    /// The operand order is part of the contract -- `a within b` is "a inside
    /// b", never the reverse.
    #[test]
    fn within_places_the_left_operand_inside_the_right() {
        assert_eq!(
            lang_of("(a within (b ##3 c))", 8),
            Lang::from([
                word(&[&["a", "b"], &[], &[], &["c"]]),
                word(&[&["b"], &["a"], &[], &["c"]]),
                word(&[&["b"], &[], &["a"], &["c"]]),
                word(&[&["b"], &[], &[], &["a", "c"]]),
            ])
        );
        // Reversed, the 4-tick sequence cannot sit inside a 1-tick one.
        assert_eq!(lang_of("((b ##3 c) within a)", 8), Lang::new());
        // Equal length: exactly the intersect.
        assert_eq!(
            lang_of("((a ##1 b) within (c ##1 d))", 8),
            Lang::from([word(&[&["a", "c"], &["b", "d"]])])
        );
        // An empty seq1 sits anywhere: `ε within seq2` is seq2.
        assert_eq!(
            lang_of("(a[*0] within b[*0:1])", 8),
            Lang::from([Vec::new(), word(&[&["b"]])])
        );
    }

    #[test]
    fn within_equals_its_rewrite() {
        for s1 in ["a", "a ##1 b", "a[*0:2]", "a ##[1:2] b"] {
            for s2 in ["c", "c ##3 d", "c[*0:3]", "c ##[1:4] d", "(c ##1 d)[*1:3]"] {
                assert_eq!(
                    lang_of(&format!("(({s1}) within ({s2}))"), 7),
                    lang_of(
                        &format!("((1[*0:$] ##1 ({s1}) ##1 1[*0:$]) intersect ({s2}))"),
                        7
                    ),
                    "`({s1}) within ({s2})`"
                );
            }
        }
    }

    // -- generated differential battery vs the Annex F reference ----------

    /// Operators other than `first_match` (a word language cannot express it).
    fn gen_rx11(g: &mut Lcg, depth: u32, first: bool) -> Rx {
        const LEAVES: &[&str] = &["a", "b", "c", "1"];
        const CONDS: &[&str] = &["a", "b", "c"];
        const OPS: &[SeqOp] = &[SeqOp::And, SeqOp::Or, SeqOp::Intersect, SeqOp::Within];
        let leaf = |g: &mut Lcg| Rx::Leaf(LEAVES[g.next(LEAVES.len())]);
        if depth == 0 {
            return leaf(g);
        }
        match g.next(14) {
            0..=1 => leaf(g),
            2..=3 => {
                let mut acc = gen_rx11(g, depth - 1, first);
                for _ in 0..(1 + g.next(2)) {
                    let d = DELAYS[g.next(DELAYS.len())];
                    let rhs = gen_rx11(g, depth - 1, first);
                    acc = Rx::Cat(Box::new(acc), d, Box::new(rhs));
                }
                acc
            }
            4 => Rx::Lead(
                DELAYS[g.next(DELAYS.len())],
                Box::new(gen_rx11(g, depth - 1, first)),
            ),
            5 => {
                // Half the repetitions can vanish: the empty-match paths of
                // the operators are the subtle ones.
                let zero: Vec<Rp> = REPS.iter().copied().filter(|r| r.min == 0).collect();
                let rep = if g.next(2) == 0 {
                    zero[g.next(zero.len())]
                } else {
                    REPS[g.next(REPS.len())]
                };
                Rx::Rep(Box::new(gen_rx11(g, depth - 1, first)), rep)
            }
            6 => Rx::Paren(Box::new(gen_rx11(g, depth - 1, first))),
            7..=10 => Rx::Bin(
                Box::new(gen_rx11(g, depth - 1, first)),
                OPS[g.next(OPS.len())],
                Box::new(gen_rx11(g, depth - 1, first)),
            ),
            11 => Rx::Thr(
                CONDS[g.next(CONDS.len())],
                Box::new(gen_rx11(g, depth - 1, first)),
            ),
            _ if first => Rx::First(Box::new(gen_rx11(g, depth - 1, first))),
            _ => Rx::Bin(
                Box::new(gen_rx11(g, depth - 1, first)),
                OPS[g.next(OPS.len())],
                Box::new(gen_rx11(g, depth - 1, first)),
            ),
        }
    }

    /// Counts the operators of each kind in `rx`: (and, or, intersect, within,
    /// throughout, first_match).
    fn op_census(rx: &Rx, c: &mut [usize; 6]) {
        match rx {
            Rx::Leaf(_) => {}
            Rx::Paren(r) | Rx::Rep(r, _) | Rx::Lead(_, r) => op_census(r, c),
            Rx::Cat(l, _, r) => {
                op_census(l, c);
                op_census(r, c);
            }
            Rx::Bin(l, op, r) => {
                c[match op {
                    SeqOp::And => 0,
                    SeqOp::Or => 1,
                    SeqOp::Intersect => 2,
                    SeqOp::Within => 3,
                }] += 1;
                op_census(l, c);
                op_census(r, c);
            }
            Rx::Thr(_, r) => {
                c[4] += 1;
                op_census(r, c);
            }
            Rx::First(r) => {
                c[5] += 1;
                op_census(r, c);
            }
        }
    }

    /// 600 generated sequences over `and`/`or`/`intersect`/`within`/
    /// `throughout` (nested in each other and in concatenations and
    /// repetitions), each built and compared match for match, empty match
    /// included, against the Annex F reference language.
    #[test]
    fn generated_sequence_operators_match_the_annex_f_reference() {
        const BOUND: u32 = 6;
        let mut g = Lcg(0x0711_0711_a5a5_5a5a);
        let (mut compared, mut skipped, mut with_empty) = (0usize, 0, 0);
        let mut census = [0usize; 6];
        for _ in 0..600 {
            let rx = gen_rx11(&mut g, 3, false);
            let src = render(&rx);
            let want = lang_ref(&rx, BOUND as usize + 1);
            match try_lang_of(&src, BOUND) {
                None => skipped += 1,
                Some(got) => {
                    assert_eq!(got, want, "automaton vs Annex F reference for `{src}`");
                    compared += 1;
                    with_empty += usize::from(want.contains(&Vec::new()));
                    op_census(&rx, &mut census);
                }
            }
        }
        assert!(
            compared >= 450,
            "only {compared} compared, {skipped} skipped"
        );
        assert!(with_empty >= 40, "only {with_empty} admit an empty match");
        for (name, n) in ["and", "or", "intersect", "within", "throughout"]
            .iter()
            .zip(census)
        {
            assert!(n >= 60, "only {n} `{name}` operators exercised");
        }
    }

    // -- concrete traces ---------------------------------------------------

    /// A concrete trace: one row of 4-state samples per signal (keyed by the
    /// leaf's normalized source text, see [`norm_leaf`]); the constant `1`
    /// needs no row. Ticks are `0..len`. A sample is `Some(known)` or `None`
    /// for `x`/`z`.
    struct Trace {
        rows: BTreeMap<String, Vec<Option<bool>>>,
        len: u32,
    }

    impl Trace {
        /// `rows` are `(leaf text, "0110...")`, a digit being `0`, `1` or `x`;
        /// all rows have the same length.
        fn new(rows: &[(&str, &str)]) -> Trace {
            let mut map = BTreeMap::new();
            let mut len = None;
            for (name, bits) in rows {
                let row: Vec<Option<bool>> = bits
                    .chars()
                    .filter(|c| !c.is_whitespace())
                    .map(|c| match c {
                        '0' => Some(false),
                        '1' => Some(true),
                        'x' => None,
                        other => panic!("trace row `{name}`: bad digit {other:?}"),
                    })
                    .collect();
                assert_eq!(*len.get_or_insert(row.len()), row.len(), "row `{name}`");
                map.insert(norm_leaf(name), row);
            }
            Trace {
                rows: map,
                len: len.expect("a trace needs at least one row") as u32,
            }
        }

        /// A trace numbered like the LRM's figures: tick 1 is the first digit,
        /// tick 0 exists (all false) so a tick number IS an index.
        fn lrm(rows: &[(&str, &str)]) -> Trace {
            let padded: Vec<(&str, String)> =
                rows.iter().map(|(n, b)| (*n, format!("0{b}"))).collect();
            let borrowed: Vec<(&str, &str)> =
                padded.iter().map(|(n, b)| (*n, b.as_str())).collect();
            Trace::new(&borrowed)
        }

        /// The guard value of the leaf `text` at `tick`, as the compiled leaf
        /// predicate gives it: a Boolean context makes an `x` false, and `!b`
        /// (a leaf spelled with a leading `!`, which [`leaf_texts`] also gives
        /// the negated leaf of a goto gap) is 4-state negation THEN that
        /// collapse, so it holds only where `b` is known false.
        fn value(&self, text: &str, tick: u32) -> bool {
            if text == "1" {
                return true;
            }
            // A row keyed by the whole text wins (`!burst_mode` given as a signal
            // of its own); otherwise a leading `!` negates the row of the rest.
            let (name, negated) = match text.strip_prefix('!') {
                Some(inner) if !self.rows.contains_key(text) => (inner, true),
                _ => (text, false),
            };
            let row = self
                .rows
                .get(name)
                .unwrap_or_else(|| panic!("trace has no row for leaf `{name}`"));
            match row.get(tick as usize).copied().flatten() {
                Some(known) => known != negated,
                None => false,
            }
        }
    }

    fn run_attempt(
        au: &ir::Automaton,
        texts: &[String],
        tr: &Trace,
        start: u32,
    ) -> (bool, BTreeSet<u32>) {
        let r = trace::attempt(au, start, tr.len, &|id, t| {
            tr.value(&texts[id.0 as usize], t)
        })
        .unwrap_or_else(|e| panic!("trace interpreter: {e}"));
        (r.admits_empty, r.ends)
    }

    /// One evaluation attempt per `starts` entry of `body` over `tr`:
    /// `(admits the empty match, end ticks of its nonempty matches)`.
    fn attempts_of(
        extra_decls: &str,
        body: &str,
        tr: &Trace,
        starts: &[u32],
    ) -> Vec<(bool, BTreeSet<u32>)> {
        with_built_in(extra_decls, body, |au, leaves, tree| {
            let texts = leaf_texts(leaves, tree);
            starts
                .iter()
                .map(|&s| run_attempt(au, &texts, tr, s))
                .collect()
        })
        .unwrap_or_else(|| panic!("`{body}` failed to compile"))
    }

    fn ends_at(body: &str, tr: &Trace, start: u32) -> BTreeSet<u32> {
        attempts_of("", body, tr, &[start]).remove(0).1
    }

    fn set(v: &[u32]) -> BTreeSet<u32> {
        v.iter().copied().collect()
    }

    // -- the LRM's figures 16-5 .. 16-13 -----------------------------------
    //
    // The figures are drawings; what is checked is what their captions and
    // the surrounding text state: the tick each match ENDS on for the
    // evaluation attempt shown. (A figure also counts matches -- "four of
    // them ending at clock tick 12" -- but a sequence match is a boolean per
    // end tick for every consumer, so the interpreter reports end-tick sets.)

    const TE: &str = "logic te1, te2, te3, te4, te5;";

    /// The signals of Figures 16-5, 16-6, 16-8, 16-10 and 16-11 (the attempt
    /// begins at clock tick 8): te1 at 8; te2 at 9..13 (so `te1 ##2 te2`
    /// matches at 10 and `te1 ##[1:5] te2` at 9..13); te3 at 8, te4 at 9..10,
    /// te5 at 11..13 (`te3 ##2 te4 ##2 te5` matches at 12 only: te4 at 10 and
    /// te5 at 12, with distractors on the neighbouring ticks).
    fn fig_trace() -> Trace {
        Trace::lrm(&[
            ("te1", "00000001000000"),
            ("te2", "00000000111110"),
            ("te3", "00000001000000"),
            ("te4", "00000000110000"),
            ("te5", "00000000001110"),
        ])
    }

    fn fig_ends(body: &str) -> BTreeSet<u32> {
        attempts_of(TE, body, &fig_trace(), &[8]).remove(0).1
    }

    /// Figure 16-5: `(te1 ##2 te2) and (te3 ##2 te4 ##2 te5)` -- operand
    /// matches end at 10 and 12, the composite at 12.
    #[test]
    fn lrm_figure_16_5_and_of_two_sequences() {
        assert_eq!(fig_ends("te1 ##2 te2"), set(&[10]));
        assert_eq!(fig_ends("te3 ##2 te4 ##2 te5"), set(&[12]));
        assert_eq!(
            fig_ends("(te1 ##2 te2) and (te3 ##2 te4 ##2 te5)"),
            set(&[12])
        );
    }

    /// Figure 16-6: with `##[1:5]` the first operand matches at 9..13 and the
    /// composite at 12 (four times) and 13.
    #[test]
    fn lrm_figure_16_6_and_with_a_time_range() {
        assert_eq!(fig_ends("te1 ##[1:5] te2"), set(&[9, 10, 11, 12, 13]));
        assert_eq!(
            fig_ends("(te1 ##[1:5] te2) and (te3 ##2 te4 ##2 te5)"),
            set(&[12, 13])
        );
    }

    /// Figure 16-7: `te1 and te2` on Boolean operands matches at exactly the
    /// ticks where both are true: 1, 3, 8 and 14.
    #[test]
    fn lrm_figure_16_7_and_of_two_booleans() {
        let tr = Trace::lrm(&[("te1", "11101011010111"), ("te2", "10110001100001")]);
        let starts: Vec<u32> = (1..=14).collect();
        let got = attempts_of(TE, "te1 and te2", &tr, &starts);
        for (s, (empty, ends)) in starts.iter().zip(got) {
            assert!(!empty);
            let both = tr.value("te1", *s) && tr.value("te2", *s);
            assert_eq!(ends, if both { set(&[*s]) } else { set(&[]) }, "tick {s}");
        }
        let matching: Vec<u32> = starts
            .iter()
            .copied()
            .filter(|&s| !ends_at_in("te1 and te2", &tr, s).is_empty())
            .collect();
        assert_eq!(matching, vec![1, 3, 8, 14]);
    }

    fn ends_at_in(body: &str, tr: &Trace, s: u32) -> BTreeSet<u32> {
        attempts_of(TE, body, tr, &[s]).remove(0).1
    }

    /// Figure 16-8: the same operands as 16-6 under `intersect`: only the
    /// pair of equal length survives, a single match at 12.
    #[test]
    fn lrm_figure_16_8_intersect() {
        assert_eq!(
            fig_ends("(te1 ##[1:5] te2) intersect (te3 ##2 te4 ##2 te5)"),
            set(&[12])
        );
    }

    /// Figure 16-9: `te1 or te2` on Booleans fails at ticks 7 and 13 only.
    #[test]
    fn lrm_figure_16_9_or_of_two_booleans() {
        let tr = Trace::lrm(&[("te1", "11010101100101"), ("te2", "00101000111000")]);
        let starts: Vec<u32> = (1..=14).collect();
        let got = attempts_of(TE, "te1 or te2", &tr, &starts);
        let failed: Vec<u32> = starts
            .iter()
            .zip(got)
            .filter(|(_, (_, ends))| ends.is_empty())
            .map(|(s, _)| *s)
            .collect();
        assert_eq!(failed, vec![7, 13]);
    }

    /// Figure 16-10: `(te1 ##2 te2) or (te3 ##2 te4 ##2 te5)`: matches at 10
    /// and 12.
    #[test]
    fn lrm_figure_16_10_or_of_two_sequences() {
        assert_eq!(
            fig_ends("(te1 ##2 te2) or (te3 ##2 te4 ##2 te5)"),
            set(&[10, 12])
        );
    }

    /// Figure 16-11: with `##[1:5]`: matches at 9, 10, 11, 12 and 13.
    #[test]
    fn lrm_figure_16_11_or_with_a_time_range() {
        assert_eq!(
            fig_ends("(te1 ##[1:5] te2) or (te3 ##2 te4 ##2 te5)"),
            set(&[9, 10, 11, 12, 13])
        );
    }

    const BURST: &str = "logic mclk, burst_mode, irdy, trdy;";
    const BURST_RULE1: &str = "$fell(burst_mode) ##0 \
         ((!burst_mode) throughout (##2 ((trdy==0)&&(irdy==0))[*7]))";

    /// The rows common to Figures 16-12/16-13: `$fell(burst_mode)` holds at
    /// tick 2 (burst_mode high at 1, low at 2); `(trdy==0)&&(irdy==0)` holds
    /// at ticks 4..10 (the figure numbers them 1..7).
    fn burst_trace(not_burst_mode: &str) -> Trace {
        Trace::lrm(&[
            ("$fell(burst_mode)", "01000000000000"),
            ("!burst_mode", not_burst_mode),
            ("(trdy==0)&&(irdy==0)", "00011111110000"),
        ])
    }

    /// Figure 16-12: burst_mode goes high at tick 9, inside the interval
    /// 2..10, so the `throughout` fails and burst_rule1 does not match.
    #[test]
    fn lrm_figure_16_12_throughout_restriction_fails() {
        let tr = burst_trace("01111111000000");
        assert_eq!(
            attempts_of(BURST, BURST_RULE1, &tr, &[2]).remove(0).1,
            set(&[])
        );
        // Without the restriction the subsequence matches from 2 to 10: the
        // failure is the throughout's doing, not a mistake in the trace.
        assert_eq!(
            attempts_of(
                BURST,
                "$fell(burst_mode) ##0 (##2 ((trdy==0)&&(irdy==0))[*7])",
                &tr,
                &[2]
            )
            .remove(0)
            .1,
            set(&[10])
        );
    }

    /// Figure 16-13: burst_mode stays low through tick 10: burst_rule1
    /// matches from 2 to 10.
    #[test]
    fn lrm_figure_16_13_throughout_restriction_succeeds() {
        let tr = burst_trace("01111111111111");
        assert_eq!(
            attempts_of(BURST, BURST_RULE1, &tr, &[2]).remove(0).1,
            set(&[10])
        );
        // Low only up to tick 9 is not enough: tick 10 is in the interval.
        let tr = burst_trace("01111111100000");
        assert_eq!(
            attempts_of(BURST, BURST_RULE1, &tr, &[2]).remove(0).1,
            set(&[])
        );
    }

    /// 16.9.10's own example, on Figure 16-13's trace: `!trdy[*7] within
    /// ($fell(irdy) ##1 !irdy[*8])` "matches from clock tick 3 to clock tick
    /// 11".
    #[test]
    fn lrm_within_example_matches_from_tick_3_to_11() {
        let tr = Trace::lrm(&[
            ("!trdy", "00011111110000"),
            ("$fell(irdy)", "00100000000000"),
            ("!irdy", "00011111111000"),
        ]);
        let body = "!trdy[*7] within ($fell(irdy) ##1 !irdy[*8])";
        assert_eq!(attempts_of(BURST, body, &tr, &[3]).remove(0).1, set(&[11]));
        // Swapped, the 9-tick sequence cannot sit inside the 7-tick one.
        let swapped = "($fell(irdy) ##1 !irdy[*8]) within !trdy[*7]";
        assert_eq!(attempts_of(BURST, swapped, &tr, &[3]).remove(0).1, set(&[]));
    }

    // -- first_match ------------------------------------------------------

    /// 16.9.8: `ts1 = first_match(te1 ##[2:5] te2)` keeps only the match that
    /// ends first; `t1 = te1 ##[2:5] te2` has them all.
    #[test]
    fn first_match_keeps_the_earliest_ending_match() {
        let tr = Trace::new(&[("a", "10000000"), ("b", "01111110")]);
        assert_eq!(ends_at("a ##[2:5] b", &tr, 0), set(&[2, 3, 4, 5]));
        assert_eq!(ends_at("first_match(a ##[2:5] b)", &tr, 0), set(&[2]));
        // A start with no match at all has none under first_match either.
        assert_eq!(ends_at("first_match(a ##[2:5] b)", &tr, 1), set(&[]));
    }

    /// 16.9.8's second example: `ts2 = first_match((a ##[2:3] b) or (c ##[1:2]
    /// d))` is the earliest-ending of a##2b, a##3b, c##1d, c##2d -- all of
    /// them when several end on that same tick.
    #[test]
    fn first_match_of_an_or_picks_the_earliest_across_both_arms() {
        let body = "first_match((a ##[2:3] b) or (c ##[1:2] d))";
        // a##2b and c##2d both end at 2, c##1d does not match.
        let tr = Trace::new(&[
            ("a", "10000"),
            ("b", "00110"),
            ("c", "10000"),
            ("d", "00100"),
        ]);
        assert_eq!(
            ends_at("(a ##[2:3] b) or (c ##[1:2] d)", &tr, 0),
            set(&[2, 3])
        );
        assert_eq!(ends_at(body, &tr, 0), set(&[2]));
        // c##1d matches too, at 1: it alone is the first match.
        let tr = Trace::new(&[
            ("a", "10000"),
            ("b", "00110"),
            ("c", "10000"),
            ("d", "01100"),
        ]);
        assert_eq!(
            ends_at("(a ##[2:3] b) or (c ##[1:2] d)", &tr, 0),
            set(&[1, 2, 3])
        );
        assert_eq!(ends_at(body, &tr, 0), set(&[1]));
    }

    /// 16.9.8: "when a sequence is a subsequence of a larger sequence, then
    /// applying the first_match operator has significant effect". The earliest
    /// match is THE match even when its continuation then fails: the later,
    /// longer matches stay discarded.
    #[test]
    fn first_match_inside_a_larger_sequence_discards_the_later_matches() {
        let plain = "(a ##[1:3] b) ##1 c";
        let first = "first_match(a ##[1:3] b) ##1 c";
        // `a ##[1:3] b` ends at 1 and 2; only the end-2 match is followed by c.
        let tr = Trace::new(&[("a", "1000000"), ("b", "0110000"), ("c", "0001000")]);
        assert_eq!(ends_at(plain, &tr, 0), set(&[3]));
        assert_eq!(ends_at(first, &tr, 0), set(&[]));
        // c right after the earliest match: both agree.
        let tr = Trace::new(&[("a", "1000000"), ("b", "0110000"), ("c", "0010000")]);
        assert_eq!(ends_at(plain, &tr, 0), set(&[2]));
        assert_eq!(ends_at(first, &tr, 0), set(&[2]));
    }

    /// The earliest end tick of a first_match region is a fact about the
    /// region, not about the product it sits in: `first_match(R) intersect S`
    /// must not fall back to R's LATER match just because S disagrees with
    /// the earliest one (the product's dead-state trim keeps the region's
    /// `FirstMatchEnd` edge for exactly this reason).
    #[test]
    fn first_match_under_a_product_records_its_end_even_when_the_other_side_disagrees() {
        // `a ##[1:2] b` ends at 1 and 2; `a ##2 b` ends at 2 only.
        let tr = Trace::new(&[("a", "100000"), ("b", "011000")]);
        assert_eq!(
            ends_at("(a ##[1:2] b) intersect (a ##2 b)", &tr, 0),
            set(&[2])
        );
        // The earliest R match (end 1) has the wrong length for S: no match.
        assert_eq!(
            ends_at("first_match(a ##[1:2] b) intersect (a ##2 b)", &tr, 0),
            set(&[])
        );
        assert_eq!(
            ends_at("first_match(a ##[1:2] b) and (a ##2 b)", &tr, 0),
            set(&[2])
        );
        // Agreeing lengths keep the match.
        assert_eq!(
            ends_at("first_match(a ##[1:2] b) intersect (a ##1 b)", &tr, 0),
            set(&[1])
        );
    }

    /// Annex F.5.2: `w |= first_match(R)` iff `w |= R` and no proper prefix of
    /// `w` (the empty word included) satisfies R. So when R admits the empty
    /// match, first_match(R) is that empty match and nothing longer.
    #[test]
    fn first_match_of_an_empty_admitting_sequence_is_the_empty_match() {
        let tr = Trace::new(&[("a", "1111"), ("b", "1100")]);
        assert_eq!(
            attempts_of("", "first_match(a[*0:2])", &tr, &[0])[0],
            (true, set(&[]))
        );
        assert_eq!(
            attempts_of("", "a[*0:2]", &tr, &[0])[0],
            (true, set(&[0, 1]))
        );
        // `ε ##1 b` is `b` at the start tick; the longer `a ##1 b` is gone.
        assert_eq!(ends_at("a[*0:2] ##1 b", &tr, 0), set(&[0, 1]));
        assert_eq!(ends_at("first_match(a[*0:2]) ##1 b", &tr, 0), set(&[0]));
    }

    /// Every copy of a repeated first_match is its own region: `(fm(X))[*2]`
    /// is `fm(X) ##1 fm(X)`.
    #[test]
    fn repeated_first_match_is_one_region_per_repeat() {
        let mut g = Lcg(0xfeed_0011);
        let (mut compared, mut nonempty) = (0, 0);
        for _ in 0..60 {
            let tr = random_trace(&mut g, 12);
            let rep = attempts_of(
                "",
                "(first_match(a ##[1:2] b))[*2]",
                &tr,
                &(0..12).collect::<Vec<_>>(),
            );
            let unrolled = attempts_of(
                "",
                "first_match(a ##[1:2] b) ##1 first_match(a ##[1:2] b)",
                &tr,
                &(0..12).collect::<Vec<_>>(),
            );
            assert_eq!(rep, unrolled);
            compared += rep.len();
            nonempty += rep.iter().filter(|(_, e)| !e.is_empty()).count();
        }
        assert_eq!(compared, 720);
        assert!(nonempty >= 40, "only {nonempty} attempts matched");
    }

    /// A repetition around a binary operator (the `SequenceWithMatch` wrapper
    /// path): `(a and b)[*2]` etc.
    #[test]
    fn repetition_of_a_parenthesized_binary_operator() {
        assert_eq!(
            lang_of("(a and b)[*2]", 8),
            Lang::from([word(&[&["a", "b"], &["a", "b"]])])
        );
        assert_eq!(
            lang_of("(a or b)[*1:2]", 8),
            Lang::from([
                word(&[&["a"]]),
                word(&[&["b"]]),
                word(&[&["a"], &["a"]]),
                word(&[&["a"], &["b"]]),
                word(&[&["b"], &["a"]]),
                word(&[&["b"], &["b"]]),
            ])
        );
        assert_eq!(
            lang_of("(a intersect b[*0:1])[*0:1]", 8),
            Lang::from([Vec::new(), word(&[&["a", "b"]])])
        );
    }

    // -- structure: determinism, size, errors ------------------------------

    /// Everything the product construction can reach is reachable from the
    /// start state: the builder prunes the operands' own (now unreferenced)
    /// states, so no dead state is left behind.
    fn reachable_states(au: &ir::Automaton) -> usize {
        let mut seen = vec![false; au.states.len()];
        let mut stack = vec![au.start];
        while let Some(s) = stack.pop() {
            if std::mem::replace(&mut seen[s.0 as usize], true) {
                continue;
            }
            stack.extend(au.state(s).edges.iter().map(|e| e.target));
        }
        seen.iter().filter(|&&r| r).count()
    }

    const OPERATOR_SOURCES: &[&str] = &[
        "a ##1 b",
        "(a ##[1:3] b) intersect (c ##2 d)",
        "(a ##1 b) and (c ##2 d ##1 e)",
        "(a ##[1:2] b) or (c[*2] ##1 d)",
        "first_match(a ##[1:3] b) ##1 c",
        "a throughout (b ##2 c)",
        "a within (b ##4 c)",
        "(first_match(a ##[1:2] b))[*1:$]",
        "((a ##[0:2] b) and (c[*0:2])) within (d ##[2:$] e)",
    ];

    #[test]
    fn every_state_of_a_built_automaton_is_reachable() {
        for src in OPERATOR_SOURCES {
            with_built(src, |au, _, _| {
                assert_eq!(
                    reachable_states(au),
                    au.states.len(),
                    "dead states left in the automaton for `{src}`"
                );
                assert_eq!(au.start, ThreadStateId(0), "`{src}`");
            })
            .unwrap_or_else(|| panic!("`{src}` failed to compile"));
        }
    }

    /// The automaton (state numbering, edge order) is a pure function of the
    /// source: two builds print identically, so nothing iterates a hash
    /// container into the output.
    #[test]
    fn builds_are_deterministic() {
        for src in OPERATOR_SOURCES {
            let dump = || {
                with_built(src, |au, _, _| format!("{au:?}"))
                    .unwrap_or_else(|| panic!("`{src}` failed to compile"))
            };
            let first = dump();
            for _ in 0..3 {
                assert_eq!(first, dump(), "`{src}`");
            }
        }
    }

    /// One first-match group per first_match operator (and per unrolled copy);
    /// an empty-admitting operand needs none.
    #[test]
    fn first_match_groups_are_one_per_region() {
        let groups = |src: &str| {
            with_built(src, |au, _, _| {
                // Every minted group is wired as one Begin and one End at
                // least, and nothing refers to a group that was not minted.
                let (mut begins, mut ends) = (BTreeSet::new(), BTreeSet::new());
                for st in &au.states {
                    for e in &st.edges {
                        match &e.label {
                            ir::Transition::FirstMatchBegin { group } => {
                                begins.insert(group.0);
                            }
                            ir::Transition::FirstMatchEnd { group } => {
                                ends.insert(group.0);
                            }
                            _ => {}
                        }
                    }
                }
                assert_eq!(begins, ends, "`{src}`: Begin/End groups differ");
                assert_eq!(
                    begins,
                    (0..au.first_match_groups).collect::<BTreeSet<_>>(),
                    "`{src}`"
                );
                au.first_match_groups
            })
            .unwrap_or_else(|| panic!("`{src}` failed to compile"))
        };
        assert_eq!(groups("a ##1 b"), 0);
        assert_eq!(groups("first_match(a ##1 b)"), 1);
        assert_eq!(groups("first_match(a ##1 b) ##1 first_match(c)"), 2);
        assert_eq!(groups("first_match(first_match(a ##[1:2] b))"), 2);
        assert_eq!(groups("(first_match(a ##[1:2] b))[*3]"), 3);
        assert_eq!(groups("first_match(a[*0:2])"), 0);
        // A product copies the markers of its operands, it does not mint more.
        assert_eq!(
            groups("first_match(a ##[1:2] b) intersect (c ##[1:2] d)"),
            1
        );
    }

    /// The product construction is bounded: a state count that would run away
    /// is a named error, not an out-of-memory.
    #[test]
    fn a_runaway_product_is_a_named_error() {
        let err = automaton_err("", "(a ##100000 b) intersect (c ##100000 a)");
        assert!(err.message.contains("intersect"), "error was: {err}");
        assert!(err.message.contains("states"), "error was: {err}");
        let err = automaton_err("", "(a ##100000 b) and (c ##100000 a)");
        assert!(err.message.contains("`and`"), "error was: {err}");
    }

    /// A first_match match item that is not a local-variable action is a
    /// loud error (T14); everything else this builder does not implement
    /// still shouts, naming the operator.
    #[test]
    fn unimplemented_neighbours_of_the_new_operators_stay_loud() {
        let err = automaton_err("", "first_match(a, cnt = cnt + 1)");
        assert!(err.message.contains("match item"), "error was: {err}");
        assert!(err.message.contains("local variable"), "error was: {err}");
        let err = automaton_err("", "a until b");
        assert!(err.message.contains("Until"), "error was: {err}");
        // A PROPERTY operand of `and` is not a sequence: recursion reaches
        // the implication and names it.
        let err = automaton_err("", "(a |-> b) and c");
        assert!(
            err.message.contains("OverlappedImplication"),
            "error was: {err}"
        );
    }

    // -- generated differential battery vs the trace reference -------------

    /// Reference for first_match-bearing sequences: the set of LENGTHS (in
    /// ticks; 0 is the empty match) of the matches of `rx` that begin at tick
    /// `s` of `tr`, computed straight from the LRM/Annex F definitions over the
    /// concrete trace -- no automaton, no word language. A match whose last
    /// tick `s + len - 1` is `>= tr.len` is one the trace never reached; [`ref_attempt`]
    /// drops those at the top (they only ever lengthen, so dropping them late
    /// is the same as dropping them early). `first == false` ignores
    /// `first_match` (treats it as the identity), which is how the battery
    /// proves it can tell the operator from its absence.
    fn ref_lens(rx: &Rx, tr: &Trace, s: u32, first: bool) -> BTreeSet<u32> {
        let n = tr.len;
        let rec = |r: &Rx, st: u32| ref_lens(r, tr, st, first);
        match rx {
            Rx::Leaf(t) => {
                if s < n && tr.value(t, s) {
                    set(&[1])
                } else {
                    set(&[])
                }
            }
            Rx::Paren(r) => rec(r, s),
            Rx::Cat(l, d, r) => {
                let mut out = BTreeSet::new();
                // `empty ##k empty` is `1[*k-1]`: k reaches n + 1 for an n-tick length.
                let hi = d.max.unwrap_or(n + 1).min(n + 1);
                for ln in rec(l, s) {
                    for k in d.min..=hi {
                        if k == 0 {
                            // Fusion: the left match's last tick is the right
                            // match's first; neither may be empty.
                            if ln == 0 {
                                continue;
                            }
                            for rn in rec(r, s + ln - 1) {
                                if rn >= 1 {
                                    out.insert(ln - 1 + rn);
                                }
                            }
                        } else {
                            // `ln` ticks, `k - 1` vacuous ticks, then the right
                            // match: 16.9.2.1's four rules at once.
                            for rn in rec(r, s + ln + k - 1) {
                                out.insert(ln + k - 1 + rn);
                            }
                        }
                    }
                }
                out
            }
            Rx::Lead(d, r) => {
                let mut out = BTreeSet::new();
                let hi = d.max.unwrap_or(n).min(n);
                for k in d.min..=hi {
                    for rn in rec(r, s + k) {
                        out.insert(k + rn);
                    }
                }
                out
            }
            Rx::Rep(r, p) => {
                let top = p.max.unwrap_or(n + 2).min(n + 2);
                let mut pow = set(&[0]);
                let mut out = BTreeSet::new();
                if p.min == 0 {
                    out.insert(0);
                }
                for k in 1..=top {
                    let mut next = BTreeSet::new();
                    for &l in &pow {
                        for u in rec(r, s + l) {
                            next.insert(l + u);
                        }
                    }
                    pow = next;
                    if k >= p.min {
                        out.extend(pow.iter().copied());
                    }
                }
                out
            }
            Rx::Bin(l, op, r) => {
                let ll = rec(l, s);
                let rl = rec(r, s);
                match op {
                    SeqOp::Or => ll.union(&rl).copied().collect(),
                    SeqOp::Intersect => ll.intersection(&rl).copied().collect(),
                    // Both match from `s`; the composite ends with the later.
                    SeqOp::And => ll
                        .iter()
                        .flat_map(|&x| rl.iter().map(move |&y| x.max(y)))
                        .collect(),
                    // seq1 matches on a sub-interval `[s+i, s+i+ln)` of a seq2
                    // match of length `rn`.
                    SeqOp::Within => rl
                        .into_iter()
                        .filter(|&rn| {
                            (0..=rn).any(|i| rec(l, s + i).iter().any(|&ln| i + ln <= rn))
                        })
                        .collect(),
                }
            }
            Rx::Thr(c, r) => rec(r, s)
                .into_iter()
                .filter(|&ln| (0..ln).all(|i| tr.value(c, s + i)))
                .collect(),
            Rx::First(r) => {
                let all = rec(r, s);
                match all.first() {
                    Some(&min) if first => set(&[min]),
                    _ => all,
                }
            }
        }
    }

    fn ref_attempt(rx: &Rx, tr: &Trace, s: u32, first: bool) -> (bool, BTreeSet<u32>) {
        let lens = ref_lens(rx, tr, s, first);
        let ends = lens
            .iter()
            .filter(|&&l| l >= 1 && s + l - 1 < tr.len)
            .map(|&l| s + l - 1)
            .collect();
        (lens.contains(&0), ends)
    }

    /// A random trace over `a`, `b`, `c` (each true about 60% of the time, so
    /// matches are common).
    fn random_trace(g: &mut Lcg, len: usize) -> Trace {
        let mut rows = Vec::new();
        for name in ["a", "b", "c"] {
            let bits: String = (0..len)
                .map(|_| if g.next(5) < 3 { '1' } else { '0' })
                .collect();
            rows.push((name, bits));
        }
        let borrowed: Vec<(&str, &str)> = rows.iter().map(|(n, b)| (*n, b.as_str())).collect();
        Trace::new(&borrowed)
    }

    /// The reference checks itself on the cases the LRM states, so a wrong
    /// reference cannot hide a wrong builder (or the reverse).
    #[test]
    fn the_trace_reference_agrees_with_the_lrm_examples() {
        let leaf = |n| Box::new(Rx::Leaf(n));
        let d = |min, max, text| Dl { min, max, text };
        let a_b = Rx::Cat(leaf("a"), d(2, Some(5), "##[2:5]"), leaf("b"));
        let tr = Trace::new(&[("a", "10000000"), ("b", "01111110")]);
        assert_eq!(ref_attempt(&a_b, &tr, 0, true).1, set(&[2, 3, 4, 5]));
        let fm = Rx::First(Box::new(a_b));
        assert_eq!(ref_attempt(&fm, &tr, 0, true).1, set(&[2]));
        assert_eq!(ref_attempt(&fm, &tr, 0, false).1, set(&[2, 3, 4, 5]));
        let ab_and = Rx::Bin(
            Box::new(Rx::Cat(leaf("a"), d(1, Some(1), "##1"), leaf("b"))),
            SeqOp::And,
            Box::new(Rx::Cat(leaf("a"), d(2, Some(2), "##2"), leaf("b"))),
        );
        let tr = Trace::new(&[("a", "111000"), ("b", "011100")]);
        assert_eq!(ref_attempt(&ab_and, &tr, 0, true).1, set(&[2]));
    }

    /// 500 generated sequences, `first_match` nested anywhere, built and run
    /// against 4 random traces from every start tick, end ticks and the empty
    /// match compared with [`ref_attempt`]. The battery must also be able to
    /// tell `first_match` from its absence.
    #[test]
    fn generated_sequences_match_the_trace_reference() {
        const LEN: u32 = 9;
        let mut g = Lcg(0xd1ff_e2e1_7ace_0011);
        let (mut compared, mut skipped, mut attempts) = (0usize, 0, 0usize);
        let (mut first_matters, mut with_matches) = (0usize, 0usize);
        let mut census = [0usize; 6];
        for _ in 0..500 {
            let rx = gen_rx11(&mut g, 3, true);
            let src = render(&rx);
            let traces: Vec<Trace> = (0..4).map(|_| random_trace(&mut g, LEN as usize)).collect();
            let ok = with_built(&src, |au, leaves, tree| {
                let texts = leaf_texts(leaves, tree);
                for tr in &traces {
                    for s in 0..LEN {
                        let got = run_attempt(au, &texts, tr, s);
                        let want = ref_attempt(&rx, tr, s, true);
                        assert_eq!(got, want, "`{src}` from tick {s} over {:?}", tr.rows);
                        attempts += 1;
                        with_matches += usize::from(!want.1.is_empty());
                        first_matters += usize::from(want != ref_attempt(&rx, tr, s, false));
                    }
                }
            });
            match ok {
                Some(()) => {
                    compared += 1;
                    op_census(&rx, &mut census);
                }
                None => skipped += 1,
            }
        }
        assert!(
            compared >= 380,
            "only {compared} compared, {skipped} skipped"
        );
        assert!(
            with_matches >= 2000,
            "only {with_matches} of {attempts} attempts matched"
        );
        assert!(
            first_matters >= 150,
            "first_match changed the result in only {first_matters} attempts"
        );
        for (name, n) in [
            "and",
            "or",
            "intersect",
            "within",
            "throughout",
            "first_match",
        ]
        .iter()
        .zip(census)
        {
            assert!(n >= 40, "only {n} `{name}` operators exercised");
        }
    }

    // -- T12: named sequence instances, LRM 16.8 / 16.8.1 -------------------

    /// Compiles `decls` (module-level declarations: sequences, parameters) and
    /// one concurrent-assertion statement `stmt` inside an `always_ff`, builds
    /// the automaton of that assertion's sequence and hands the build result,
    /// the syntax tree and the compilation's diagnostics to `f`. The root's
    /// `Clocking` wrapper (when the assertion has its own `@(...)`) is stripped
    /// exactly as every other helper in this module does; an assertion that
    /// names a clocked sequence has no such wrapper (the `Clocking` is inside
    /// the instance), so its root is used as is.
    ///
    /// `allow_errors` is for the tests that feed the builder a design slang
    /// itself diagnoses (slang still produces a tree for those): without it a
    /// compile error in the fixture fails the test, so a fixture typo can never
    /// pass as "the builder rejected it".
    fn with_assertion<R>(
        decls: &str,
        stmt: &str,
        allow_errors: bool,
        f: impl FnOnce(
            Result<(ir::Automaton, LeafTable<'_>), LoweringError>,
            &SyntaxTree,
            &sv_lang::Diagnostics,
        ) -> R,
    ) -> R {
        let src = format!(
            "module m;\n\
             logic clk, sysclk, a, b, c, d, e, x, y, z;\n\
             logic [7:0] bb;\n\
             int n;\n\
             parameter my_delay = 2;\n\
             {decls}\n\
             always_ff @(posedge clk) begin\n\
               {stmt}\n\
             end\n\
             endmodule\n"
        );
        let session = Session::new();
        let mut comp = Compilation::new(&session).unwrap();
        comp.add_source(&src).unwrap();
        let design = comp.compile().unwrap();
        let diags = design.diagnostics();
        if !allow_errors {
            assert!(
                !diags.has_errors(),
                "fixture has compile errors:\n{}\n{src}",
                diags.rendered()
            );
        }
        let m = design
            .top_instances()
            .next()
            .unwrap()
            .instance_body()
            .unwrap();
        let analysis = design.analyze(AnalysisFlags::NONE, 1).unwrap();
        let proc = analysis.procedures(m).next().unwrap();
        let Some(assertion) = analysis.assertions(proc.symbol()).next() else {
            panic!(
                "slang dropped the assertion; analysis diagnostics:\n{}",
                analysis.diagnostics().rendered()
            );
        };
        let tree = design.syntax_trees().into_iter().next().unwrap();
        let root = assertion.root().as_assertion_expr().unwrap();
        let (root, root_clock) = if root.kind() == AssertionExprKind::Clocking {
            let kids = root.children();
            (kids[1].as_assertion_expr().unwrap(), Some(kids[0]))
        } else {
            (root, None)
        };
        f(
            build_automaton(root, root_clock, (&tree).into(), &m),
            &tree,
            &diags,
        )
    }

    /// What a T12 equivalence test compares: the automaton's full `Debug`
    /// rendering (`ir::Automaton` has no `PartialEq`), the leaf texts in
    /// `LeafId` order, and the accepted language up to a tick bound.
    struct Built {
        debug: String,
        leaves: Vec<String>,
        lang: Lang,
    }

    fn built(decls: &str, stmt: &str, bound: u32) -> Built {
        with_assertion(decls, stmt, false, |r, tree, _| {
            let (au, leaves) = r.unwrap_or_else(|e| panic!("`{stmt}` failed to build: {e}"));
            Built {
                debug: format!("{au:?}"),
                leaves: leaf_texts(&leaves, tree),
                lang: accepted_lang(&au, &leaves, tree, bound),
            }
        })
    }

    /// The error [`build_automaton`] returns for a design slang accepts.
    fn built_err(decls: &str, stmt: &str) -> LoweringError {
        with_assertion(decls, stmt, false, |r, _, _| {
            r.err()
                .unwrap_or_else(|| panic!("`{stmt}` was expected to be rejected"))
        })
    }

    /// [`built_err`] for a design slang itself diagnoses.
    fn built_err_lenient(decls: &str, stmt: &str) -> LoweringError {
        with_assertion(decls, stmt, true, |r, _, _| {
            r.err()
                .unwrap_or_else(|| panic!("`{stmt}` was expected to be rejected"))
        })
    }

    /// LRM 16.8: `rule` is "equivalent to" the same sequence with `s`'s body
    /// written in place. The instance's own `@(posedge sysclk)` clocking
    /// wrapper must be transparent to the sequence's shape, so the automata
    /// are not merely language-equal but identical.
    #[test]
    fn s1_rule_instantiation_equivalent_to_inline() {
        let decls = "sequence s; a ##1 b ##1 c; endsequence\n\
                     sequence rule; @(posedge clk) x ##1 y ##1 s ##1 z; endsequence";
        let inst = built(decls, "assert property (rule);", 8);
        let inline = built(
            "",
            "assert property (@(posedge clk) x ##1 y ##1 (a ##1 b ##1 c) ##1 z);",
            8,
        );
        assert_eq!(inst.leaves, ["x", "y", "a", "b", "c", "z"]);
        assert_eq!(
            inst.lang,
            Lang::from([word(&[&["x"], &["y"], &["a"], &["b"], &["c"], &["z"]])])
        );
        assert_eq!(inst.lang, inline.lang);
        assert_eq!(inst.leaves, inline.leaves);
        assert_eq!(inst.debug, inline.debug);
    }

    /// 16.8: the rewriting algorithm "substitutes actual arguments for
    /// references to the corresponding formal arguments", for a Boolean actual
    /// and for a sequence actual alike.
    #[test]
    fn untyped_formals_substitute_boolean_and_sequence_actuals() {
        let decls = "sequence s(p, q); p ##2 q; endsequence";
        let b = built(decls, "assert property (@(posedge clk) s(a ##1 b, c));", 8);
        assert_eq!(b.leaves, ["a", "b", "c"]);
        assert_eq!(b.lang, Lang::from([word(&[&["a"], &["b"], &[], &["c"]])]));
        let b = built(decls, "assert property (@(posedge clk) s(a, b));", 8);
        assert_eq!(b.lang, Lang::from([word(&[&["a"], &[], &["b"]])]));
    }

    /// 16.8: a default actual argument is used when the instance omits it, an
    /// explicit actual overrides it, and actuals bind by name as well as by
    /// position. The default `q = c` is a name resolved in the declaration's
    /// scope; the delay default `k = 2` is a bound recovered from the
    /// declaration's own text.
    #[test]
    fn default_actuals_are_used_overridden_and_bound_by_name() {
        let decls = "sequence s(p, q = c, int k = 2); p ##k q; endsequence";
        let w = |stmt: &str| built(decls, stmt, 8).lang;
        assert_eq!(
            w("assert property (@(posedge clk) s(a));"),
            Lang::from([word(&[&["a"], &[], &["c"]])])
        );
        assert_eq!(
            w("assert property (@(posedge clk) s(a, b, 3));"),
            Lang::from([word(&[&["a"], &[], &[], &["b"]])])
        );
        assert_eq!(
            w("assert property (@(posedge clk) s(.p(a), .k(1)));"),
            Lang::from([word(&[&["a"], &["c"]])])
        );
    }

    /// 16.8.1: "If a formal argument of a named sequence is typed ... the
    /// actual argument shall be cast to the type of the formal argument". The
    /// LRM's own pair: `s1(.w(a), .x(bit'(b)), .y(c))` and
    /// `s2(.w(a), .x(b), .y(c))` are equivalent, and with `b` 8 bits wide it
    /// "will be cast to bit by truncation". (`bb` is the 8-bit signal here.)
    /// The leaf is checked directly: a Conversion to width 1 where the untyped
    /// formal keeps the 8-bit operand.
    #[test]
    fn typed_formal_bit_truncates_wider_actual() {
        let decls = "sequence s1(w, x, y); w ##1 x ##[2:10] y; endsequence\n\
                     sequence s2(w, y, bit x); w ##1 x ##[2:10] y; endsequence";
        // The leaf bound to `x` is the second one built (w, x, y).
        let x_leaf = |stmt: &str| {
            with_assertion(decls, stmt, false, |r, _, _| {
                let (au, leaves) = r.unwrap();
                let x = leaves.get(LeafId(1));
                (
                    x.kind() == ExpressionKind::Conversion,
                    x.expr_type().unwrap().bit_width(),
                    reachable_lengths(&au, 20),
                    format!("{au:?}"),
                )
            })
        };
        let (typed_conv, typed_width, typed_lens, typed_au) =
            x_leaf("assert property (@(posedge clk) s2(.w(a), .x(bb), .y(c)));");
        let (_, cast_width, _, cast_au) =
            x_leaf("assert property (@(posedge clk) s1(.w(a), .x(bit'(bb)), .y(c)));");
        let (untyped_conv, untyped_width, _, _) =
            x_leaf("assert property (@(posedge clk) s1(.w(a), .x(bb), .y(c)));");
        assert!(typed_conv, "the typed formal must cast the 8-bit actual");
        assert_eq!(typed_width, 1, "cast to bit = truncation to 1 bit");
        assert_eq!(cast_width, 1);
        assert!(!untyped_conv, "an untyped formal keeps the actual as is");
        assert_eq!(untyped_width, 8);
        // `x` at tick 1, `y` 2..=10 later: matches end at ticks 3..=11.
        assert_eq!(typed_lens, (3..=11).collect::<BTreeSet<u32>>());
        // The LRM's equivalence pair builds the very same automaton.
        assert_eq!(typed_au, cast_au);
    }

    /// 16.8.1: a typed formal used in a delay is cast to its type like any
    /// other typed formal, so `65537` into a `shortint` is `1`.
    #[test]
    fn typed_delay_formal_is_cast_to_its_type() {
        let b = built(
            "sequence s(shortint k, untyped p); p ##k b; endsequence",
            "assert property (@(posedge clk) s(65537, a));",
            8,
        );
        assert_eq!(b.lang, Lang::from([word(&[&["a"], &["b"]])]));
    }

    /// 16.8: "If $ is an actual argument, then the corresponding formal
    /// argument shall be untyped and each of its references either shall be an
    /// upper bound in a cycle_delay_const_range_expression or shall itself be
    /// an actual argument in an instance of a named sequence."
    #[test]
    fn dollar_actual_requires_untyped_formal_used_as_upper_bound() {
        // Legal: an upper bound of a cycle delay range, of a repetition range,
        // and passed on as an actual to another instance.
        let dollar = |decls: &str, stmt: &str| built(decls, stmt, 5);
        let d = dollar(
            "sequence s(max, p); p ##[1:max] b; endsequence",
            "assert property (@(posedge clk) s($, a));",
        );
        assert_eq!(
            d.debug,
            built("", "assert property (@(posedge clk) a ##[1:$] b);", 5).debug
        );
        assert_eq!(d.lang.len(), 5, "b may follow a 1..=5 ticks later");
        let r = dollar(
            "sequence s(max, p); p[*2:max]; endsequence",
            "assert property (@(posedge clk) s($, a) ##1 b);",
        );
        assert_eq!(
            r.debug,
            built("", "assert property (@(posedge clk) a[*2:$] ##1 b);", 5).debug
        );
        let fwd = dollar(
            "sequence inner(m, p); p ##[1:m] b; endsequence\n\
             sequence outer(m2, p); inner(m2, p); endsequence",
            "assert property (@(posedge clk) outer($, a));",
        );
        assert_eq!(d.debug, fwd.debug);

        // Illegal: `$` as a lower bound. slang diagnoses it; the builder, fed
        // the tree slang still produces, must not silently treat it as a
        // number either.
        let decls = "sequence s(k, p); p ##[k:5] b; endsequence";
        let stmt = "assert property (@(posedge clk) s($, a));";
        let e = built_err_lenient(decls, stmt);
        assert!(e.message.contains("upper bound"), "{e}");
        with_assertion(decls, stmt, true, |_, _, diags| {
            let e = crate::sva::named::check_formal_argument_rules(diags)
                .expect_err("`$` into a lower bound is a diagnosed error");
            assert!(e.message.contains("`$`"), "{e}");
        });
    }

    /// LRM 16.8.1's `delay_arg_example`, verbatim: the cover property is
    /// "equivalent to `cover property (x ##2 y[*3:$] ##1 z)`".
    #[test]
    fn lrm_delay_arg_example_equals_its_inline_form() {
        let decls = "sequence delay_arg_example (max, shortint delay1, delay2, min);\n\
                       x ##delay1 y[*min:max] ##delay2 z;\n\
                     endsequence";
        let inst = built(
            decls,
            "cover property (delay_arg_example($, my_delay, my_delay-1, 3));",
            10,
        );
        let inline = built("", "cover property (x ##2 y[*3:$] ##1 z);", 10);
        assert_eq!(inst.debug, inline.debug);
        assert_eq!(inst.leaves, inline.leaves);
        assert_eq!(inst.lang, inline.lang);
        assert!(!inst.lang.is_empty());
    }

    /// LRM 16.8's `delay_example`: the legal instance builds, the illegal one
    /// (`z` and `d` are not elaboration-time constants) is a compile error
    /// that [`crate::sva::named::check_formal_argument_rules`] reports.
    #[test]
    fn lrm_delay_example_legal_builds_and_illegal_is_diagnosed() {
        let decls = "int zz, dd;\n\
                     sequence delay_example(x, y, min, max, delay1);\n\
                       x ##delay1 y[*min:max];\n\
                     endsequence";
        let ok = built(
            decls,
            "assert property (@(posedge clk) delay_example(x, y, 3, $, 2));",
            8,
        );
        assert_eq!(
            ok.debug,
            built("", "assert property (@(posedge clk) x ##2 y[*3:$]);", 8).debug
        );
        with_assertion(
            decls,
            "assert property (@(posedge clk) delay_example(x, y, zz, $, dd));",
            true,
            |r, _, diags| {
                crate::sva::named::check_formal_argument_rules(diags)
                    .expect_err("non-constant actuals in a delay/repetition are illegal");
                // And the builder does not quietly pick some value for them
                // (slang hands it a tree with the bad instance stripped).
                assert!(r.is_err(), "a non-constant bound is not buildable");
            },
        );
    }

    /// LRM 16.8.1's `event_arg_example` and `event_arg_example2`, verbatim: the
    /// instance is equivalent to `@(posedge clk) x ##1 y` either way the
    /// event reaches the body.
    #[test]
    fn lrm_event_arg_examples_equal_the_inline_clocked_sequence() {
        let inline = built("", "cover property (@(posedge clk) x ##1 y);", 4);
        let ev = built(
            "sequence event_arg_example (event ev); @(ev) x ##1 y; endsequence",
            "cover property (event_arg_example(posedge clk));",
            4,
        );
        let ev2 = built(
            "sequence event_arg_example2 (reg sig); @(posedge sig) x ##1 y; endsequence",
            "cover property (event_arg_example2(clk));",
            4,
        );
        assert_eq!(inline.lang, Lang::from([word(&[&["x"], &["y"]])]));
        for got in [&ev, &ev2] {
            assert_eq!(got.debug, inline.debug);
            assert_eq!(got.leaves, inline.leaves);
        }
    }

    /// 16.8 / F.4.1: an actual that is a reference to one of the CALLER's
    /// formals is evaluated in the caller's scope. `outer` hands its own `d`
    /// (3 here, from `my_delay+1`) to `inner` as a delay.
    #[test]
    fn a_callers_formal_passed_as_a_delay_is_resolved_in_the_callers_frame() {
        let b = built(
            "sequence inner(p, int k); p ##k b; endsequence\n\
             sequence outer(w, int d); inner(w, d) ##1 c; endsequence",
            "assert property (@(posedge clk) outer(a, my_delay+1));",
            8,
        );
        assert_eq!(
            b.lang,
            Lang::from([word(&[&["a"], &[], &[], &["b"], &["c"]])])
        );
    }

    /// A SEQUENCE actual's text lives at the call site: its `##d` names the
    /// CALLER's formal `d`, not the callee's `k` or any module constant. `q`'s
    /// `s ##k b` runs `(a ##d c) ##2 b` with `d = 3`.
    #[test]
    fn a_sequence_actual_is_resolved_in_the_call_site_frame() {
        let b = built(
            "sequence q(sequence s, int k); s ##k b; endsequence\n\
             sequence outer(int d); q(a ##d c, 2); endsequence",
            "assert property (@(posedge clk) outer(3));",
            10,
        );
        assert_eq!(
            b.lang,
            Lang::from([word(&[&["a"], &[], &[], &["c"], &[], &["b"]])])
        );
    }

    /// 16.8: names in a declaration resolve in the declaration's scope EXCEPT
    /// formal arguments, which shadow them. The formal `k` is 2 in this
    /// instance; the module constant `k` is 5.
    #[test]
    fn a_formal_shadows_a_module_constant_of_the_same_name() {
        let b = built(
            "parameter k = 5;\n\
             sequence s(k, p); p ##k b; endsequence",
            "assert property (@(posedge clk) s(2, a));",
            8,
        );
        assert_eq!(b.lang, Lang::from([word(&[&["a"], &[], &["b"]])]));
    }

    /// An instance takes a `[*n]` repetition like any sequence operand
    /// (`(a ##1 b)[*2]`), re-expanding the body per repeat.
    #[test]
    fn a_repeated_instance_expands_the_body_per_repeat() {
        let b = built(
            "sequence s(p); p ##1 b; endsequence",
            "assert property (@(posedge clk) s(a)[*2] ##1 c);",
            8,
        );
        assert_eq!(
            b.lang,
            Lang::from([word(&[&["a"], &["b"], &["a"], &["b"], &["c"]])])
        );
        assert_eq!(b.leaves, ["a", "b", "a", "b", "c"]);
    }

    /// 16.8.1 rules (a) and (c): an actual that is not cast compatible with a
    /// typed formal, and an event expression bound to a `sequence` formal, are
    /// illegal. slang diagnoses both and still produces a tree; the builder,
    /// fed that tree, must refuse it rather than return an automaton for an
    /// illegal design. (`named::check_formal_argument_rules` names the rule.)
    #[test]
    fn typed_formal_cast_incompatible_and_event_actuals_are_rejected() {
        let e = built_err_lenient(
            "int arr[2]; sequence s(int k, p); p ##1 (k == 1); endsequence",
            "assert property (@(posedge clk) s(arr, a));",
        );
        assert!(e.message.contains("slang could not bind"), "{e}");
        let e = built_err_lenient(
            "sequence s(sequence q); q; endsequence",
            "assert property (@(posedge clk) s(posedge clk));",
        );
        assert!(e.message.contains("slang could not bind"), "{e}");
    }

    /// 16.9.2: goto and nonconsecutive repetition take a Boolean expression
    /// only, so they are illegal on a sequence instance. slang diagnoses it; the
    /// builder must not model it as a repeated Boolean either.
    #[test]
    fn goto_repetition_on_an_instance_is_rejected() {
        let e = built_err_lenient(
            "sequence s(p); p ##1 b; endsequence",
            "assert property (@(posedge clk) s(a)[->2]);",
        );
        assert!(e.message.contains("named sequence instance"), "{e}");
        let e = built_err_lenient(
            "sequence s(p); p ##1 b; endsequence",
            "assert property (@(posedge clk) s(a)[=2]);",
        );
        assert!(e.message.contains("named sequence instance"), "{e}");
    }

    /// 16.8's actual-argument edge, `s(s(a))`, is a cyclic dependency. slang
    /// reports it when the instance sits directly in an assertion; written
    /// inside another sequence's declaration slang says nothing (pinned by
    /// `named::tests::actual_argument_cycle_inside_another_sequence_is_not_\
    /// reported_by_slang_known_gap`), so the builder refuses to expand a
    /// declaration it is already expanding.
    #[test]
    fn actual_argument_cycle_through_another_sequence_is_rejected() {
        let e = built_err(
            "sequence s(p); p ##1 b; endsequence\n\
             sequence user; s(s(a)); endsequence",
            "assert property (@(posedge clk) user);",
        );
        assert!(e.message.contains("cyclic dependency"), "{e}");
        assert!(e.message.contains("`s`"), "{e}");
        // Directly in the assertion slang diagnoses the cycle itself (and
        // hands the builder a tree with the cyclic instance stripped), so the
        // rejection is the diagnostic's; the builder must still not build it.
        with_assertion(
            "sequence s(p); p ##1 b; endsequence",
            "assert property (@(posedge clk) s(s(a)));",
            true,
            |r, _, diags| {
                let e = crate::sva::named::check_named_sequence_cycles(diags)
                    .expect_err("slang reports s(s(a)) as a cycle");
                assert!(e.message.contains("cyclic dependency"), "{e}");
                assert!(r.is_err(), "the builder must not build a cyclic instance");
            },
        );
    }

    /// 16.8's graph has an edge X -> Y when X's declaration instantiates Y, or
    /// an instance of X instantiates Y within an actual argument. `outer(inner(a))`
    /// is `outer -> inner` only (twice): there is no cycle, and the flattened
    /// `inner(inner(a)) ##1 c` is legal. The builder must not mistake the actual's
    /// `inner` instance, expanded while `outer`'s frame is on the stack, for a
    /// re-entry of `inner`.
    #[test]
    fn an_actual_that_instantiates_a_sequence_the_callee_also_instantiates_is_legal() {
        let decls = "sequence inner(p); p ##1 b; endsequence\n\
                     sequence outer(w); inner(w) ##1 c; endsequence";
        let nested = built(
            decls,
            "assert property (@(posedge clk) outer(inner(a)));",
            8,
        );
        let inline = built(
            "",
            "assert property (@(posedge clk) a ##1 b ##1 b ##1 c);",
            8,
        );
        assert_eq!(
            nested.lang,
            Lang::from([word(&[&["a"], &["b"], &["b"], &["c"]])])
        );
        assert_eq!(nested.lang, inline.lang);
        assert_eq!(nested.leaves, inline.leaves);
        // The same through another declaration, where slang never checks.
        let via_user = built(
            "sequence inner(p); p ##1 b; endsequence\n\
             sequence outer(w); inner(w) ##1 c; endsequence\n\
             sequence user; outer(inner(a)); endsequence",
            "assert property (@(posedge clk) user);",
            8,
        );
        assert_eq!(via_user.lang, nested.lang);
        // Deeper: the actual instantiates the callee's own callee's callee,
        // and the formal is forwarded through two declarations (`w` -> `q` ->
        // `p`), so the forwarded actual must keep its call-site chain.
        let deep = built(
            "sequence inner(p); p ##1 b; endsequence\n\
             sequence mid(q); inner(q) ##1 d; endsequence\n\
             sequence outer(w); mid(w) ##1 c; endsequence",
            "assert property (@(posedge clk) outer(mid(inner(a))));",
            12,
        );
        let deep_inline = built(
            "",
            "assert property (@(posedge clk) a ##1 b ##1 b ##1 d ##1 b ##1 d ##1 c);",
            12,
        );
        assert_eq!(deep.lang, deep_inline.lang);
        assert_eq!(deep.leaves, deep_inline.leaves);
        // A bound inside the doubly-expanded declaration must be read from the
        // innermost expansion of it: `k` is 1 for the wrapper's own `inner` and
        // 3 for the actual's.
        let bound = built(
            "sequence inner(p, int k); p ##k b; endsequence\n\
             sequence outer(w); inner(w, 1) ##1 c; endsequence",
            "assert property (@(posedge clk) outer(inner(a, 3)));",
            12,
        );
        assert_eq!(
            bound.lang,
            Lang::from([word(&[&["a"], &[], &[], &["b"], &["b"], &["c"]])])
        );
        // A repeated formal reference expands the actual once per reference,
        // each under the call-site chain.
        let twice = built(
            "sequence inner(p); p ##1 b; endsequence\n\
             sequence outer(w); w ##1 w; endsequence",
            "assert property (@(posedge clk) outer(inner(a)));",
            8,
        );
        assert_eq!(
            twice.lang,
            Lang::from([word(&[&["a"], &["b"], &["a"], &["b"]])])
        );
        // The actual is a zero-argument instance: no declaration to name, but
        // its body's own instances must still be expanded in its own context.
        let zero = built(
            "sequence inner(p); p ##1 b; endsequence\n\
             sequence zs; inner(a); endsequence\n\
             sequence outer(w); inner(w) ##1 c; endsequence",
            "assert property (@(posedge clk) outer(zs));",
            8,
        );
        assert_eq!(
            zero.lang,
            Lang::from([word(&[&["a"], &["b"], &["b"], &["c"]])])
        );
    }

    /// The false-positive fix must not hide a real cycle: a declaration whose
    /// BODY re-enters itself is still refused, with the declarations named.
    #[test]
    fn a_real_body_cycle_is_still_rejected_after_the_actual_argument_fix() {
        // `user` instantiates `s` inside `s`'s own actual: the s(s(a)) self-edge.
        let e = built_err(
            "sequence s(p); p ##1 b; endsequence\n\
             sequence user; s(s(a)); endsequence",
            "assert property (@(posedge clk) user);",
        );
        assert!(e.message.contains("cyclic dependency"), "{e}");
        // The cycle closes through a forwarded formal: `user` passes `wrap(a)`
        // to `s` (edge s -> wrap, an instance within an actual argument), and
        // `wrap`'s body instantiates `s` (edge wrap -> s). Neither declaration
        // text holds the cycle, and the forwarded actual must keep its
        // call-site chain `user -> s` for the builder to see it.
        let e = built_err(
            "sequence s(p); p ##1 b; endsequence\n\
             sequence wrap(w); s(w); endsequence\n\
             sequence user; s(wrap(a)); endsequence",
            "assert property (@(posedge clk) user);",
        );
        assert!(e.message.contains("cyclic dependency"), "{e}");
        assert!(
            e.message.contains("`s`") && e.message.contains("`wrap`"),
            "{e}"
        );
        // The same through a formal forwarded one level (`w` -> `p`): `user`
        // passes `bb2(a)` to `fa` (edge fa -> bb2), `bb2`'s body instantiates
        // `fa` (edge bb2 -> fa). Only the forwarded actual's own call-site
        // chain `user -> fa` shows the cycle when `bb2` is expanded.
        let e = built_err(
            "sequence fc(p); p; endsequence\n\
             sequence fa(w); fc(w); endsequence\n\
             sequence bb2(q); fa(q); endsequence\n\
             sequence user; fa(bb2(a)); endsequence",
            "assert property (@(posedge clk) user);",
        );
        assert!(e.message.contains("cyclic dependency"), "{e}");
        assert!(
            e.message.contains("`fa`") && e.message.contains("`bb2`"),
            "{e}"
        );
    }

    /// A property instance is loud when a SEQUENCE is required, never built as
    /// a sequence: `build_property` owns it.
    #[test]
    fn property_instance_is_a_loud_error_in_the_sequence_builder() {
        let e = built_err(
            "property p0(q); q ##1 b; endproperty",
            "assert property (@(posedge clk) p0(a));",
        );
        assert!(e.message.contains("property instance"), "{e}");
        assert!(e.message.contains("build_property"), "{e}");
    }

    /// Local variable formals and declarations (T13, formerly a loud pending
    /// error) build, and an unused variable does not change the automaton's
    /// language.
    #[test]
    fn local_variables_in_a_sequence_build() {
        let with_formal = built(
            "sequence s(p, local logic v); p ##1 b; endsequence",
            "assert property (@(posedge clk) s(a, 1'b1));",
            6,
        );
        let with_local = built(
            "sequence s; logic v; a ##1 b; endsequence",
            "assert property (@(posedge clk) s);",
            6,
        );
        let plain = built("", "assert property (@(posedge clk) a ##1 b);", 6);
        assert_eq!(with_formal.lang, plain.lang);
        assert_eq!(with_local.lang, plain.lang);
    }

    /// What T28 reports about an assertion's clocks: how many distinct clocks
    /// it has, the clock its automaton starts in, and every
    /// [`ir::Transition::ClockSync`] as `(to, strict)`, in state order.
    fn clock_info(decls: &str, stmt: &str) -> (usize, ClockId, Vec<(u32, bool)>) {
        with_assertion(decls, stmt, false, |r, _, _| {
            let (au, leaves) = r.unwrap_or_else(|e| panic!("`{stmt}` failed to build: {e}"));
            let syncs = au
                .states
                .iter()
                .flat_map(|st| &st.edges)
                .filter_map(|e| match &e.label {
                    Transition::ClockSync { to, strict } => Some((to.0, *strict)),
                    _ => None,
                })
                .collect();
            (leaves.clock_count(), au.entry_clock, syncs)
        })
    }

    /// A second clocking event inside one automaton is a second clock (16.13.1,
    /// T28; formerly a loud error): two clocked sequences joined by `##1`
    /// build one automaton with a strict clock change between them, and `##0`
    /// is the overlapping change.
    #[test]
    fn a_second_clocking_event_is_a_second_clock() {
        let decls = "sequence sa; @(posedge clk) a ##1 b; endsequence\n\
                     sequence sb; @(negedge clk) c ##1 d; endsequence";
        let (clocks, entry, syncs) = clock_info(decls, "assert property (sa ##1 sb);");
        assert_eq!(clocks, 2);
        assert_eq!(entry, ClockId(0));
        assert_eq!(syncs, [(1, true)]);
        let (_, _, syncs) = clock_info(decls, "assert property (sa ##0 sb);");
        assert_eq!(syncs, [(1, false)]);
    }

    /// LRM 16.13: an assertion clocked `@(negedge clk)` that instantiates a
    /// sequence clocked `@(posedge sysclk)` runs the sequence on its OWN clock
    /// (the instance's `@(...)` is the clock of its Boolean operands), so the
    /// automaton starts in that clock. The stripped root clock takes part in
    /// the comparison (an equal event is transparent, a different one is a
    /// second clock).
    #[test]
    fn a_root_clock_differing_from_an_instances_clock_leads_with_the_instance() {
        let decls = "sequence s; @(posedge sysclk) a ##1 b; endsequence";
        // Different edge of the same signal, different signal, same edge.
        for (root, differs) in [
            ("@(negedge clk)", true),
            ("@(posedge clk)", true),
            ("@(posedge sysclk)", false),
        ] {
            let stmt = format!("assert property ({root} s);");
            if differs {
                let (clocks, entry, syncs) = clock_info(decls, &stmt);
                assert!(syncs.is_empty(), "{root}: nothing changes clock inside s");
                assert_eq!(clocks, 2, "{root}");
                assert_eq!(entry, ClockId(1), "{root}: s runs on its own clock");
            } else {
                // The same event is transparent: identical to the unclocked
                // sequence body written inline under that root.
                let b = built(decls, &stmt, 4);
                let inline = built("", "assert property (@(posedge sysclk) a ##1 b);", 4);
                assert_eq!(b.debug, inline.debug, "{root}");
                assert_eq!(b.lang, Lang::from([word(&[&["a"], &["b"]])]));
            }
        }
        // An `event` formal resolves to the actual before the comparison: the
        // instance's `@(ev)` is the root's `posedge clk` when passed so, and a
        // different event when passed `negedge clk`.
        let ev = "sequence es(event ev); @(ev) a ##1 b; endsequence";
        let ok = built(ev, "assert property (@(posedge clk) es(posedge clk));", 4);
        assert_eq!(ok.lang, Lang::from([word(&[&["a"], &["b"]])]));
        let (clocks, entry, _) =
            clock_info(ev, "assert property (@(posedge clk) es(negedge clk));");
        assert_eq!((clocks, entry), (2, ClockId(1)));
        // A sequence with no clock of its own is clocked by the root, as ever.
        let plain = built(
            "sequence u; a ##1 b; endsequence",
            "assert property (@(negedge clk) u);",
            4,
        );
        assert_eq!(plain.lang, Lang::from([word(&[&["a"], &["b"]])]));
        let (clocks, entry, _) = clock_info(
            "sequence u; a ##1 b; endsequence",
            "assert property (@(negedge clk) u);",
        );
        assert_eq!((clocks, entry), (1, ClockId(0)));
    }

    /// The clock comparison is exact (LRM 16.13): events that differ only in
    /// an operator, a select index, a literal or an `iff` condition are
    /// different clocks, never one flattened clock. Each pair is checked both
    /// ways round (instance vs root, root vs instance), and the identical
    /// event is checked to be ONE clock so the test cannot pass by splitting
    /// everything.
    #[test]
    fn clocking_events_differing_only_in_operator_index_or_iff_are_different_clocks() {
        let pairs: &[(&str, &str)] = &[
            ("@(posedge (a | b))", "@(posedge (a & b))"),
            ("@(posedge (a ^ b))", "@(posedge (a & b))"),
            ("@(posedge bb[1])", "@(posedge bb[0])"),
            ("@(posedge clk iff (n == 2))", "@(posedge clk iff (n == 1))"),
            ("@(posedge clk iff (n == 1))", "@(posedge clk)"),
            ("@(posedge clk or posedge a)", "@(posedge clk or negedge a)"),
            ("@(posedge clk or posedge a)", "@(posedge clk)"),
            ("@(posedge ~a)", "@(posedge !a)"),
        ];
        for (inst_ev, root_ev) in pairs {
            for (decl_ev, root) in [(inst_ev, root_ev), (root_ev, inst_ev)] {
                let decls = format!("sequence s; {decl_ev} c ##1 d; endsequence");
                let (clocks, _, _) = clock_info(&decls, &format!("assert property ({root} s);"));
                assert_eq!(clocks, 2, "{decl_ev} vs {root}");
            }
            // The same event on both sides is one clock.
            let decls = format!("sequence s; {inst_ev} c ##1 d; endsequence");
            let stmt = format!("assert property ({inst_ev} s);");
            let (clocks, _, _) = clock_info(&decls, &stmt);
            assert_eq!(clocks, 1, "{inst_ev}");
            let b = built(&decls, &stmt, 4);
            assert_eq!(b.lang, Lang::from([word(&[&["c"], &["d"]])]), "{inst_ev}");
        }
        // Two instances inside one property, differing only in an operand.
        let (clocks, _, syncs) = clock_info(
            "sequence sa; @(posedge (a | b)) c ##1 d; endsequence\n\
             sequence sb; @(posedge (a & b)) c ##1 d; endsequence",
            "assert property (sa ##1 sb);",
        );
        assert_eq!((clocks, syncs), (2, vec![(1, true)]));
    }

    /// The expansion is a pure function of the design: building twice gives
    /// the identical automaton and leaf table.
    #[test]
    fn instance_expansion_is_deterministic() {
        let decls = "sequence inner(p, int k); p ##k b; endsequence\n\
                     sequence outer(w, int d); inner(w, d)[*1:2] ##1 c; endsequence";
        let stmt = "assert property (@(posedge clk) outer(a, 2) ##1 outer(b, 1));";
        let first = built(decls, stmt, 10);
        let second = built(decls, stmt, 10);
        assert_eq!(first.debug, second.debug);
        assert_eq!(first.leaves, second.leaves);
        assert!(!first.lang.is_empty());
    }

    // -- T13: local variables, LRM 16.10 / 16.8.2 / F.5.4 -------------------

    /// Module-level declarations every T13 fixture shares: the data signals
    /// the LRM's examples use (`int`, so a local `int x = data` needs no
    /// narrowing), and `` `true ``, the LRM's own shorthand in its flow
    /// examples, which is no predefined macro.
    const LV: &str = "`define true 1\nint data, data1, data2, data_in, data_out, do1;\n";

    /// `LV` plus one fixture's own declarations.
    fn lv(decls: &str) -> String {
        format!("{LV}{decls}")
    }

    /// The build result of a design slang accepts, as `Ok(())` or the error.
    fn builds(decls: &str, stmt: &str) -> Result<(), LoweringError> {
        with_assertion(decls, stmt, false, |r, _, _| r.map(|_| ()))
    }

    /// 16.10 intuitive rule (a): variables assigned on parallel threads
    /// cannot be accessed in sibling threads. LRM example `s4`, verbatim.
    #[test]
    fn t13_s4_a_sibling_thread_read_does_not_flow() {
        let e = built_err(
            &lv("sequence s4;\n\
                   int x;\n\
                   (a ##1 (b, x = data) ##1 c) or (d ##1 (e==x)); // illegal\n\
                 endsequence"),
            "assert property (@(posedge clk) s4);",
        );
        assert!(
            e.message.contains("does not flow out") && e.message.contains("`x`"),
            "{e}"
        );
    }

    /// 16.10 rule (c), `s5`: `y` is assigned on one `or` branch only, so it is
    /// not in the intersection and the read after the `or` is illegal.
    #[test]
    fn t13_s5_a_variable_assigned_on_one_or_branch_does_not_flow_out() {
        let e = built_err(
            &lv("sequence s5;\n\
                   int x,y;\n\
                   ((a ##1 (b, x = data, y = data1) ##1 c)\n\
                      or (d ##1 (`true, x = data) ##0 (e==x))) ##1 (y==data2);\n\
                   // illegal because y is not in the intersection\n\
                 endsequence"),
            "assert property (@(posedge clk) s5);",
        );
        assert!(
            e.message.contains("does not flow out") && e.message.contains("`y`"),
            "{e}"
        );
    }

    /// 16.10 rule (c), `s6`: `x` is assigned on both `or` branches, so it is in
    /// the intersection and the read after the `or` is legal.
    #[test]
    fn t13_s6_a_variable_assigned_on_both_or_branches_flows_out() {
        builds(
            &lv("sequence s6;\n\
                   int x,y;\n\
                   ((a ##1 (b, x = data, y = data1) ##1 c)\n\
                      or (d ##1 (`true, x = data) ##0 (e==x))) ##1 (x==data2);\n\
                   // legal because x is in the intersection\n\
                 endsequence"),
            "assert property (@(posedge clk) s6);",
        )
        .unwrap();
    }

    /// 16.10 rule (d), `s7`: `x` is assigned in and flows out of each `and`
    /// operand, so it is blocked.
    #[test]
    fn t13_s7_a_variable_assigned_in_both_and_operands_is_blocked() {
        let e = built_err(
            &lv("sequence s7;\n\
                   int x,y;\n\
                   ((a ##1 (b, x = data, y = data1) ##1 c)\n\
                      and (d ##1 (`true, x = data) ##0 (e==x))) ##1 (x==data2);\n\
                   // illegal because x is common to both threads\n\
                 endsequence"),
            "assert property (@(posedge clk) s7);",
        );
        assert!(
            e.message.contains("does not flow out") && e.message.contains("`x`"),
            "{e}"
        );
    }

    /// 16.10 rule (d), `s8`: `y` is assigned in one `and` operand only (the
    /// difference), so it flows out.
    #[test]
    fn t13_s8_a_variable_in_the_and_difference_flows_out() {
        builds(
            &lv("sequence s8;\n\
                   int x,y;\n\
                   ((a ##1 (b, x = data, y = data1) ##1 c)\n\
                      and (d ##1 (`true, x = data) ##0 (e==x))) ##1 (y==data2);\n\
                   // legal because y is in the difference\n\
                 endsequence"),
            "assert property (@(posedge clk) s8);",
        )
        .unwrap();
    }

    // -- T13: value semantics, driven through the reference interpreter -------

    /// The value of the leaf expression `e` for one thread: signals come from
    /// `sig(name, tick)`, a local variable from the thread's `frame` through
    /// the slot the builder recorded in `locals`. The subset of expressions
    /// the T13 fixtures use; anything else panics rather than guessing.
    fn eval_leaf_expr<'d>(
        e: Expression<'d>,
        locals: &LeafLocals<'d>,
        frame: &[Option<i64>],
        tick: u32,
        sig: &dyn Fn(&str, u32) -> i64,
    ) -> Result<i64, trace::TraceError> {
        eval_leaf_node(e, locals, frame, tick, sig, &std::cell::Cell::new(0))
    }

    /// [`eval_leaf_expr`] for leaf `id` of `leaves`: a negated leaf (a goto gap)
    /// is `!expr`. The values here are 2-state integers, so a negation is plain.
    fn eval_leaf_id<'d>(
        leaves: &LeafTable<'d>,
        id: LeafId,
        frame: &[Option<i64>],
        tick: u32,
        sig: &dyn Fn(&str, u32) -> i64,
    ) -> Result<i64, trace::TraceError> {
        let v = eval_leaf_expr(leaves.get(id), leaves.locals_of(id), frame, tick, sig)?;
        Ok(if leaves.is_negated(id) {
            i64::from(v == 0)
        } else {
            v
        })
    }

    /// [`eval_leaf_expr`]'s walk. `next_flag` counts the end-point applications
    /// met so far: operands are evaluated left to right with no short-circuit, so
    /// the n-th application met is the n-th of [`LeafLocals::end_flags`] (T15,
    /// the pre-order the builder lists them in) -- and the test below that pins a
    /// leaf with two applications fails if that order ever drifts.
    fn eval_leaf_node<'d>(
        e: Expression<'d>,
        locals: &LeafLocals<'d>,
        frame: &[Option<i64>],
        tick: u32,
        sig: &dyn Fn(&str, u32) -> i64,
        next_flag: &std::cell::Cell<usize>,
    ) -> Result<i64, trace::TraceError> {
        let kids = e.as_sem_node().children();
        let sub = |i: usize| -> Result<i64, trace::TraceError> {
            let k = kids[i]
                .as_expression()
                .expect("an operand of a leaf expression is an expression");
            eval_leaf_node(k, locals, frame, tick, sig, next_flag)
        };
        if end_point_call(e).is_some() {
            let n = next_flag.get();
            next_flag.set(n + 1);
            return trace::read_local(frame, locals.end_flags[n]);
        }
        match e.kind() {
            ExpressionKind::IntegerLiteral => Ok(e
                .integer_literal_value()
                .and_then(|v| v.as_i64())
                .expect("an integer literal fits an i64")),
            ExpressionKind::NamedValue => {
                let sym = e.referenced_symbol().expect("a named value has a symbol");
                match locals.reads.iter().find(|(s, _)| *s == sym) {
                    Some((_, slot)) => trace::read_local(frame, *slot),
                    None => Ok(sig(sym.name(), tick)),
                }
            }
            ExpressionKind::LValueReference => trace::read_local(
                frame,
                locals
                    .lvalue
                    .expect("an LValueReference leaf has an lvalue"),
            ),
            ExpressionKind::Conversion => sub(0),
            ExpressionKind::UnaryOp => match e.unary_op() {
                Some(sv_lang::UnaryOp::LogicalNot) => Ok(i64::from(sub(0)? == 0)),
                other => panic!("test evaluator: unary operator {other:?}"),
            },
            ExpressionKind::BinaryOp => {
                let (l, r) = (sub(0)?, sub(1)?);
                match e.binary_op() {
                    Some(sv_lang::BinaryOp::Add) => Ok(l + r),
                    Some(sv_lang::BinaryOp::Subtract) => Ok(l - r),
                    Some(sv_lang::BinaryOp::Equality) => Ok(i64::from(l == r)),
                    Some(sv_lang::BinaryOp::LessThanEqual) => Ok(i64::from(l <= r)),
                    Some(sv_lang::BinaryOp::LogicalAnd) => Ok(i64::from(l != 0 && r != 0)),
                    Some(sv_lang::BinaryOp::LogicalOr) => Ok(i64::from(l != 0 || r != 0)),
                    other => panic!("test evaluator: binary operator {other:?}"),
                }
            }
            other => panic!("test evaluator: expression kind {other:?}"),
        }
    }

    /// One attempt per start tick of `stmt`'s sequence over a trace of integer
    /// signals (`(name, value per tick)`, every row the same length, every
    /// signal a leaf reads listed), plus the slot each local variable's LAST
    /// reading leaf reads (so a test can look a variable up in a match's frame).
    struct Ran {
        attempts: Vec<trace::LocalAttempt>,
        slots: BTreeMap<String, LocalVarId>,
    }

    /// One attempt per `starts` entry of an already built automaton over
    /// `signals` (see [`Ran`]).
    fn attempts_on(
        au: &ir::Automaton,
        leaves: &LeafTable<'_>,
        signals: &[(&str, &[i64])],
        starts: &[u32],
    ) -> Vec<trace::LocalAttempt> {
        let len = signals[0].1.len() as u32;
        assert!(signals.iter().all(|(_, row)| row.len() as u32 == len));
        let sig = |name: &str, t: u32| -> i64 {
            signals
                .iter()
                .find(|(n, _)| *n == name)
                .unwrap_or_else(|| panic!("the trace has no signal `{name}`"))
                .1[t as usize]
        };
        starts
            .iter()
            .map(|&s| {
                trace::attempt_with_locals(au, s, len, &|id, tick, frame| {
                    eval_leaf_id(leaves, id, frame, tick, &sig)
                })
                .unwrap_or_else(|e| panic!("trace interpreter: {e}"))
            })
            .collect()
    }

    fn local_run(decls: &str, stmt: &str, signals: &[(&str, &[i64])], starts: &[u32]) -> Ran {
        with_assertion(&lv(decls), stmt, false, |r, _, _| {
            let (au, leaves) = r.unwrap_or_else(|e| panic!("`{stmt}` failed to build: {e}"));
            let attempts = attempts_on(&au, &leaves, signals, starts);
            let mut slots = BTreeMap::new();
            for i in 0..leaves.len() as u32 {
                for (sym, slot) in &leaves.locals_of(LeafId(i)).reads {
                    slots.insert(sym.name().to_string(), *slot);
                }
            }
            Ran { attempts, slots }
        })
    }

    /// The `(end tick, value of variable `var`)` pairs of attempt `i`.
    fn ends_with(ran: &Ran, i: usize, var: &str) -> BTreeSet<(u32, Option<i64>)> {
        let slot = ran.slots[var].0 as usize;
        ran.attempts[i]
            .matches
            .iter()
            .map(|(t, f)| (*t, f[slot]))
            .collect()
    }

    /// The `(variable, value leaf)` of every initialisation write on the
    /// straight-line prefix of `au`'s start, in the order they run.
    fn init_writes(au: &ir::Automaton) -> Vec<(LocalVarId, LeafId)> {
        let mut writes = Vec::new();
        let mut st = au.start;
        while let [edge] = au.state(st).edges.as_slice() {
            // The first guarded edge is the body's first Boolean leaf.
            if edge.guard.is_some() {
                break;
            }
            match &edge.label {
                Transition::LocalVarWrite { var, value } => writes.push((*var, *value)),
                Transition::Epsilon => {}
                _ => break,
            }
            st = edge.target;
        }
        writes
    }

    /// 16.8.2: an `input` formal starts as the actual, and a declared local's
    /// initialiser (`int v = f + 1`) may read it, because the formals'
    /// assignments come first. Also pins the build-time ORDER of the action
    /// list on the entry: the formal's write precedes the declared one.
    #[test]
    fn t13_input_formals_are_initialised_before_declared_locals() {
        let decls = "sequence q(local input int f); int v = f + 1; a ##1 (v == 8); endsequence";
        let stmt = "assert property (@(posedge clk) q(7));";
        with_assertion(&lv(decls), stmt, false, |r, tree, _| {
            let (au, leaves) = r.unwrap();
            let texts = leaf_texts(&leaves, tree);
            let writes = init_writes(&au);
            assert_eq!(writes.len(), 2, "one write per formal and per initialiser");
            assert_eq!(texts[writes[0].1.0 as usize], "7");
            // slang substitutes a typed `local input` formal's actual into a
            // declared initializer (the leaf is `7 + 1`, its source text
            // `f + 1`), so the formal's write is the FIRST action and the
            // second one needs no slot read; what pins the order is the
            // action list itself.
            assert_eq!(texts[writes[1].1.0 as usize], "f+1");
        });
        let sigs: [(&str, &[i64]); 1] = [("a", &[1, 0, 0])];
        let ran = local_run(decls, stmt, &sigs, &[0]);
        assert_eq!(ran.attempts[0].ends(), BTreeSet::from([1]), "7 + 1 == 8");
        let ran = local_run(decls, "assert property (@(posedge clk) q(6));", &sigs, &[0]);
        assert!(ran.attempts[0].matches.is_empty(), "6 + 1 != 8");
    }

    /// 16.8.2: the actual is CAST to the formal's type: `19` into a 4-bit
    /// formal is `3`.
    #[test]
    fn t13_the_input_actual_is_cast_to_the_formals_type() {
        let decls = "sequence q(local input logic [3:0] r); a ##1 (r == 3); endsequence";
        let sigs: [(&str, &[i64]); 1] = [("a", &[1, 0])];
        let ran = local_run(
            decls,
            "assert property (@(posedge clk) q(19));",
            &sigs,
            &[0],
        );
        assert_eq!(ran.attempts[0].ends(), BTreeSet::from([1]));
        let ran = local_run(
            decls,
            "assert property (@(posedge clk) q(18));",
            &sigs,
            &[0],
        );
        assert!(ran.attempts[0].matches.is_empty());
    }

    /// 16.8.2: declared locals are initialised in declaration order (`t = v + 1`
    /// reads the initialised `v`), and an uninitialised one is assigned by a
    /// match item before its read.
    #[test]
    fn t13_declared_initialisers_run_in_declaration_order() {
        let decls = "sequence w; int v = data + 1, t = v + 1; int u; (a, u = v) ##1 (u + 1 == t); endsequence";
        let stmt = "assert property (@(posedge clk) w);";
        let sigs: [(&str, &[i64]); 2] = [("a", &[1, 0]), ("data", &[4, 0])];
        let ran = local_run(decls, stmt, &sigs, &[0]);
        assert_eq!(ran.attempts[0].ends(), BTreeSet::from([1]));
        // The action list itself: `t`'s initializer runs after `v`'s and reads
        // `v`'s slot (a local read is never substituted by slang).
        with_assertion(&lv(decls), stmt, false, |r, _, _| {
            let (au, leaves) = r.unwrap();
            let writes = init_writes(&au);
            assert_eq!(writes.len(), 2);
            let reads: Vec<LocalVarId> = leaves
                .locals_of(writes[1].1)
                .reads
                .iter()
                .map(|(_, s)| *s)
                .collect();
            assert_eq!(reads, [writes[0].0]);
        });
    }

    /// 16.8.2: an `output` formal is written back to the caller's variable
    /// when the instance matches, and the caller then reads the value.
    #[test]
    fn t13_an_output_formal_flows_back_to_the_callers_variable() {
        let decls = "sequence o(local output int q, local input logic [3:0] r);\n\
                       (a, q = r) ##1 b;\n\
                     endsequence\n\
                     sequence seven; int g; o(g, 4'd7) ##1 (g == 7); endsequence\n\
                     sequence eight; int g; o(g, 4'd7) ##1 (g == 8); endsequence";
        let sigs: [(&str, &[i64]); 2] = [("a", &[1, 0, 0]), ("b", &[0, 1, 0])];
        let ran = local_run(
            decls,
            "assert property (@(posedge clk) seven);",
            &sigs,
            &[0],
        );
        assert_eq!(ends_with(&ran, 0, "g"), BTreeSet::from([(2, Some(7))]));
        let ran = local_run(
            decls,
            "assert property (@(posedge clk) eight);",
            &sigs,
            &[0],
        );
        assert!(ran.attempts[0].matches.is_empty());
    }

    /// 16.8.2's own example: `seq2` (an `inout` formal) and `seq2_inlined`
    /// "match equivalently". Checked on the LRM-shaped trace by value and on
    /// 400 pseudo-random traces by end tick, over every start tick.
    #[test]
    fn t13_sub_seq2_matches_like_seq2_inlined() {
        let decls = "sequence sub_seq2(local inout int lv);\n\
                       (a ##1 !a, lv += data_in) ##1 !b[*0:$] ##1 b && (data_out == lv);\n\
                     endsequence\n\
                     sequence seq2; int v1; (c, v1 = data) ##1 sub_seq2(v1) ##1 (do1 == v1); endsequence\n\
                     sequence seq2_inlined;\n\
                       int v1, lv;\n\
                       (c, v1 = data) ##1\n\
                       ((1, lv = v1) ##0 (a ##1 !a, lv += data_in)\n\
                         ##1 (!b[*0:$] ##1 b && (data_out == lv), v1 = lv))\n\
                       ##1 (do1 == v1);\n\
                     endsequence";
        let (s2, inl) = (
            "assert property (@(posedge clk) seq2);",
            "assert property (@(posedge clk) seq2_inlined);",
        );
        // c@0 with data=3 starts v1 = 3; a@1, !a@2 with data_in=4 makes lv = 7;
        // b@3 with data_out == 7 ends the sub-sequence and writes v1 = 7 back;
        // do1@4 is compared against the WRITTEN-BACK 7.
        let row = |data_out: i64, do1: i64| -> [(&'static str, Vec<i64>); 7] {
            [
                ("a", vec![0, 1, 0, 0, 0, 0]),
                ("b", vec![0, 0, 0, 1, 0, 0]),
                ("c", vec![1, 0, 0, 0, 0, 0]),
                ("data", vec![3, 0, 0, 0, 0, 0]),
                ("data_in", vec![0, 0, 4, 0, 0, 0]),
                ("data_out", vec![0, 0, 0, data_out, 0, 0]),
                ("do1", vec![0, 0, 0, 0, do1, 0]),
            ]
        };
        for (data_out, do1, want) in [
            (7, 7, Some(4)),
            (7, 3, None), // do1 sees the old v1 (3), not the written-back 7
            (3, 7, None), // data_out disagrees with lv (7)
        ] {
            let r = row(data_out, do1);
            let sigs: Vec<(&str, &[i64])> = r.iter().map(|(n, v)| (*n, v.as_slice())).collect();
            for stmt in [s2, inl] {
                let ran = local_run(decls, stmt, &sigs, &[0]);
                assert_eq!(
                    ran.attempts[0].ends(),
                    want.into_iter().collect::<BTreeSet<u32>>(),
                    "{stmt} with data_out={data_out} do1={do1}"
                );
            }
        }
        let mut seed = 0x2545_f491_4f6c_dd1du64;
        let mut next = move |m: u64| {
            seed = seed
                .wrapping_mul(6364136223846793005)
                .wrapping_add(1442695040888963407);
            ((seed >> 33) % m) as i64
        };
        // Both automata are built once; every trace is run through each.
        let build = |stmt: &str, f: &mut dyn FnMut(&ir::Automaton, &LeafTable<'_>)| {
            with_assertion(&lv(decls), stmt, false, |r, _, _| {
                let (au, leaves) = r.unwrap_or_else(|e| panic!("`{stmt}` failed to build: {e}"));
                f(&au, &leaves);
            });
        };
        let traces: Vec<Vec<(&str, Vec<i64>)>> = (0..4000)
            .map(|_| {
                [
                    ("a", 2),
                    ("b", 2),
                    ("c", 2),
                    ("data", 2),
                    ("data_in", 2),
                    ("data_out", 3),
                    ("do1", 3),
                ]
                .iter()
                .map(|&(name, m)| (name, (0..8).map(|_| next(m)).collect()))
                .collect()
            })
            .collect();
        let starts: Vec<u32> = (0..8).collect();
        let mut ends: Vec<Vec<BTreeSet<u32>>> = Vec::new();
        for stmt in [s2, inl] {
            let mut per_trace = Vec::new();
            build(stmt, &mut |au, leaves| {
                for rows in &traces {
                    let sigs: Vec<(&str, &[i64])> =
                        rows.iter().map(|(n, v)| (*n, v.as_slice())).collect();
                    for at in attempts_on(au, leaves, &sigs, &starts) {
                        per_trace.push(at.ends());
                    }
                }
            });
            ends.push(per_trace);
        }
        assert_eq!(ends[0], ends[1], "seq2 and seq2_inlined disagree");
        let matched = ends[0].iter().filter(|e| !e.is_empty()).count();
        assert!(
            matched >= 100,
            "only {matched} attempts matched; the sweep is vacuous"
        );
    }

    /// 16.10 rule (d): an `and`'s operands are parallel threads, each with its
    /// OWN copy of every variable, initialised from the value at the operator's
    /// start. The second operand reads `x == 5` while the first has assigned 9
    /// (so a shared slot would fail), and the variable only the first operand
    /// assigns flows out with its value.
    #[test]
    fn t13_and_operands_own_their_copies_and_the_difference_flows_out() {
        // (`##` binds tighter than `and`, hence the outer parentheses.)
        let decls = "sequence s; int x = 5; (((a, x = 9) ##1 b) and (c ##1 (x == 5))) ##1 (x == 9); endsequence";
        let sigs: [(&str, &[i64]); 3] = [("a", &[1, 0, 0]), ("b", &[0, 1, 0]), ("c", &[1, 0, 0])];
        let ran = local_run(decls, "assert property (@(posedge clk) s);", &sigs, &[0]);
        assert_eq!(ends_with(&ran, 0, "x"), BTreeSet::from([(2, Some(9))]));
    }

    /// The variable only the SECOND operand of an `and` assigns is copied out
    /// of its shadow, so the read after the `and` sees it (s8's `y`, by value).
    #[test]
    fn t13_a_variable_only_the_second_and_operand_assigns_is_copied_out() {
        // The first operand READS `y` (so `y` is shadowed in the second, which
        // assigns it) and assigns `x`; both flow out of the `and`.
        let decls = "sequence s; int x, y = 0; ((a ##1 (b, x = data) ##0 (y == 0)) and (c ##1 (d, y = data1))) ##1 (x == 1 && y == 2); endsequence";
        let sigs = |data1: i64| -> [(&'static str, Vec<i64>); 6] {
            [
                ("a", vec![1, 0, 0]),
                ("b", vec![0, 1, 0]),
                ("c", vec![1, 0, 0]),
                ("d", vec![0, 1, 0]),
                ("data", vec![0, 1, 0]),
                ("data1", vec![0, data1, 0]),
            ]
        };
        let r = sigs(2);
        let view: Vec<(&str, &[i64])> = r.iter().map(|(n, v)| (*n, v.as_slice())).collect();
        let ran = local_run(decls, "assert property (@(posedge clk) s);", &view, &[0]);
        assert_eq!(ran.attempts[0].ends(), BTreeSet::from([2]));
        let r = sigs(3);
        let view: Vec<(&str, &[i64])> = r.iter().map(|(n, v)| (*n, v.as_slice())).collect();
        let ran = local_run(decls, "assert property (@(posedge clk) s);", &view, &[0]);
        assert!(ran.attempts[0].matches.is_empty());
    }

    /// 16.10 rule (c): an `or`'s two threads are independent; the variable
    /// assigned on both branches flows out with the value of the thread that
    /// matched (s6's `x`, by value).
    #[test]
    fn t13_or_flows_the_value_of_the_matching_branch() {
        let decls = "sequence s; int x; ((a ##1 (b, x = data)) or (c ##1 (d, x = data1))) ##1 (x == 5); endsequence";
        let first: [(&str, &[i64]); 6] = [
            ("a", &[1, 0, 0]),
            ("b", &[0, 1, 0]),
            ("c", &[0, 0, 0]),
            ("d", &[0, 0, 0]),
            ("data", &[0, 5, 0]),
            ("data1", &[0, 9, 0]),
        ];
        let ran = local_run(decls, "assert property (@(posedge clk) s);", &first, &[0]);
        assert_eq!(ran.attempts[0].ends(), BTreeSet::from([2]));
        let second: [(&str, &[i64]); 6] = [
            ("a", &[0, 0, 0]),
            ("b", &[0, 0, 0]),
            ("c", &[1, 0, 0]),
            ("d", &[0, 1, 0]),
            ("data", &[0, 9, 0]),
            ("data1", &[0, 5, 0]),
        ];
        let ran = local_run(decls, "assert property (@(posedge clk) s);", &second, &[0]);
        assert_eq!(ran.attempts[0].ends(), BTreeSet::from([2]));
    }

    /// A compound match item reads and then writes its own target: `t += data`.
    #[test]
    fn t13_a_compound_match_item_accumulates() {
        let decls =
            "sequence s; int t = 1; (a, t += data) ##1 (b, t += data) ##1 (t == 8); endsequence";
        let sigs: [(&str, &[i64]); 3] =
            [("a", &[1, 0, 0]), ("b", &[0, 1, 0]), ("data", &[3, 4, 0])];
        let ran = local_run(decls, "assert property (@(posedge clk) s);", &sigs, &[0]);
        assert_eq!(ran.attempts[0].ends(), BTreeSet::from([2]));
    }

    /// An unbounded repetition's body runs at least once for `[*1:$]`, so its
    /// assignment flows out; `[*0:$]` may not run it, so it does not. (The
    /// match item sits inside the repeated unit: a match item attached to the
    /// repeated sub-sequence itself is T14's, tested below.)
    #[test]
    fn t13_a_repetition_flows_out_only_if_it_runs_at_least_once() {
        builds(
            &lv("sequence s; int v; ((a, v = data) ##1 b)[*1:$] ##1 (v == 1); endsequence"),
            "assert property (@(posedge clk) s);",
        )
        .unwrap();
        let e = built_err(
            &lv("sequence s; int v; ((a, v = data) ##1 b)[*0:$] ##1 (v == 1); endsequence"),
            "assert property (@(posedge clk) s);",
        );
        assert!(
            e.message.contains("does not flow out") && e.message.contains("`v`"),
            "{e}"
        );
    }

    /// `intersect` has `and`'s flow rule: assigned in both operands blocks, in
    /// one only flows (16.10 rule (d)).
    #[test]
    fn t13_intersect_blocks_the_common_variable_and_flows_the_difference() {
        let e = built_err(
            &lv(
                "sequence s; int x; ((a ##1 (b, x = data)) intersect (c ##1 (d, x = data1))) ##1 (x == 1); endsequence",
            ),
            "assert property (@(posedge clk) s);",
        );
        assert!(
            e.message.contains("does not flow out") && e.message.contains("`x`"),
            "{e}"
        );
        builds(
            &lv("sequence s; int x; ((a ##1 (b, x = data)) intersect (c ##1 d)) ##1 (x == 1); endsequence"),
            "assert property (@(posedge clk) s);",
        )
        .unwrap();
    }

    /// An `output` formal the body assigns on only one `or` branch does not
    /// flow out of the instance, so writing it back is an error (16.8.2).
    #[test]
    fn t13_an_output_formal_must_flow_out_of_its_body() {
        let e = built_err_lenient(
            &lv(
                "sequence o(local output int q); (a, q = data) or (b ##1 c); endsequence\n\
                 sequence s; int g; o(g) ##1 (g == 1); endsequence",
            ),
            "assert property (@(posedge clk) s);",
        );
        assert!(
            e.message.contains("does not flow out") && e.message.contains("`q`"),
            "{e}"
        );
    }

    /// 16.8.2: an `inout`/`output` instance that admits an empty match is an
    /// error.
    #[test]
    fn t13_an_inout_instance_that_admits_an_empty_match_is_rejected() {
        let e = built_err_lenient(
            &lv(
                "sequence o(local inout int q); (a ##1 b)[*0:1]; endsequence\n\
                 sequence s; int g = 0; o(g) ##1 b; endsequence",
            ),
            "assert property (@(posedge clk) s);",
        );
        assert!(e.message.contains("empty match"), "{e}");
    }

    /// 16.8.2: "It shall be an error if references to the same local variable
    /// are bound as actual arguments to two or more local variable formal
    /// arguments of direction inout or output." slang does not check it, so
    /// the builder does (two `output`s, and an `inout` with an `output`).
    #[test]
    fn t13_one_local_bound_to_two_output_formals_is_rejected() {
        let e = built_err_lenient(
            &lv("sequence o(local output int p, local output int q);\n\
                   (a, p = data, q = data) ##1 b;\n\
                 endsequence\n\
                 sequence s; int g; o(g, g) ##1 (g == 1); endsequence"),
            "assert property (@(posedge clk) s);",
        );
        assert!(
            e.message.contains("`g`")
                && e.message.contains("two or more")
                && e.message.contains("16.8.2"),
            "{e}"
        );
        let e = built_err_lenient(
            &lv("sequence o(local inout int p, local output int q);\n\
                   (a, p = data, q = data) ##1 b;\n\
                 endsequence\n\
                 sequence s; int g = 0; o(g, g) ##1 (g == 1); endsequence"),
            "assert property (@(posedge clk) s);",
        );
        assert!(
            e.message.contains("`g`") && e.message.contains("two or more"),
            "{e}"
        );
    }

    /// The legal neighbours of the 16.8.2 duplicate-binding rule must still
    /// build: distinct locals on the two formals, and one local bound to the
    /// output of two DIFFERENT instances.
    #[test]
    fn t13_distinct_or_per_instance_output_bindings_build() {
        builds(
            &lv("sequence o(local output int p, local output int q);\n\
                   (a, p = data, q = data) ##1 b;\n\
                 endsequence\n\
                 sequence s; int g, h; o(g, h) ##1 (g == 1); endsequence"),
            "assert property (@(posedge clk) s);",
        )
        .unwrap();
        builds(
            &lv(
                "sequence o(local output int p); (a, p = data) ##1 b; endsequence\n\
                 sequence s; int g; o(g) ##1 o(g) ##1 (g == 1); endsequence",
            ),
            "assert property (@(posedge clk) s);",
        )
        .unwrap();
    }

    /// 16.10: reading a declared local before anything assigns it is rejected
    /// (slang's own `AssertionLocalUnassigned` agrees, so the fixture is built
    /// leniently), and so is passing an unassigned caller local as an input
    /// actual.
    #[test]
    fn t13_a_read_of_an_unassigned_local_is_rejected() {
        let e = built_err_lenient(
            &lv("sequence s; int v; a ##1 (v == 1); endsequence"),
            "assert property (@(posedge clk) s);",
        );
        assert!(
            e.message.contains("does not flow out") && e.message.contains("`v`"),
            "{e}"
        );
        let e = built_err_lenient(
            &lv(
                "sequence o(local input int f); a ##1 (f == 1); endsequence\n\
                 sequence s; int g; o(g); endsequence",
            ),
            "assert property (@(posedge clk) s);",
        );
        assert!(
            e.message.contains("does not flow out") && e.message.contains("`g`"),
            "{e}"
        );
    }

    /// A local variable wider than 64 bits (16.10) takes a frame slot per limb
    /// of its value and of its unknown bits (100 bits: 2 + 2), its initializer
    /// is one write per slot, and each write's leaf says which word it yields.
    #[test]
    fn t13_a_wide_local_variable_has_a_slot_and_a_leaf_per_limb() {
        with_assertion(
            &lv("sequence s; logic [99:0] v = 0; a ##1 (v == 0); endsequence"),
            "assert property (@(posedge clk) s);",
            false,
            |r, _, _| {
                let (au, leaves) = r.unwrap();
                assert_eq!(au.local_vars.len(), 4, "100 bits = 2 limbs = 4 slots");
                assert_eq!(au.local_vars[0].width, 100);
                let mut writes = Vec::new();
                for e in au.states.iter().flat_map(|s| &s.edges) {
                    if let Transition::LocalVarWrite { var, value } = &e.label {
                        writes.push((var.0, leaves.limb_of(*value), value.0));
                    }
                }
                let group = writes[0].2;
                let sel = |unknown, index| {
                    Some(LimbSel {
                        width: 100,
                        unknown,
                        index,
                        group,
                    })
                };
                assert_eq!(
                    writes.iter().map(|w| (w.0, w.1)).collect::<Vec<_>>(),
                    [
                        (0, sel(false, 0)),
                        (1, sel(false, 1)),
                        (2, sel(true, 0)),
                        (3, sel(true, 1))
                    ]
                );
            },
        );
    }

    /// An assignment whose value reads the wide target is computed into a
    /// fresh variable and copied over, so every limb sees the OLD value.
    #[test]
    fn t13_a_wide_self_assignment_goes_through_a_temporary() {
        with_assertion(
            &lv(
                "sequence s; logic [99:0] v = 0; (a, v = {v[98:0], 1'b1}) ##1 (v != 0); \
                 endsequence",
            ),
            "assert property (@(posedge clk) s);",
            false,
            |r, _, _| {
                let (au, _) = r.unwrap();
                assert_eq!(au.local_vars.len(), 8, "v and its temporary");
                let copies: Vec<_> = au
                    .states
                    .iter()
                    .flat_map(|s| &s.edges)
                    .filter_map(|e| match &e.label {
                        Transition::LocalVarCopy { dst, src } => Some((dst.0, src.0)),
                        _ => None,
                    })
                    .collect();
                assert_eq!(copies, [(0, 4)], "the temporary is copied back to `v`");
            },
        );
        // A narrow target is written in place.
        with_assertion(
            &lv("sequence s; int v = 0; (a, v = v + 1) ##1 (v != 0); endsequence"),
            "assert property (@(posedge clk) s);",
            false,
            |r, _, _| {
                let (au, _) = r.unwrap();
                assert_eq!(au.local_vars.len(), 1);
            },
        );
    }

    /// The widest local variable is a loud error naming the limit.
    #[test]
    fn t13_an_unrepresentable_local_variable_is_a_loud_error() {
        let e = built_err(
            &lv("sequence s; logic [1999999:0] v = 0; a ##1 (v == 0); endsequence"),
            "assert property (@(posedge clk) s);",
        );
        assert!(e.message.contains("1048576"), "{e}");
    }

    /// A match item assigns a LOCAL variable (16.11); `n` is a module variable.
    #[test]
    fn t13_a_match_item_must_assign_a_local_variable() {
        // slang diagnoses this itself ("sequence match items can only modify
        // local variables"); the builder must refuse it too, not skip it.
        let e = built_err_lenient(
            &lv("sequence s; (a, n = 1) ##1 b; endsequence"),
            "assert property (@(posedge clk) s);",
        );
        assert!(e.message.contains("local variable"), "{e}");
    }

    /// 16.10: a thread's variable never leaks between repeated instances: two
    /// uses of one sequence mint two slot sets.
    #[test]
    fn t13_every_instance_gets_its_own_variables() {
        let decls = "sequence s(local input int f); int v = f; a ##1 (v == f); endsequence";
        with_assertion(
            &lv(decls),
            "assert property (@(posedge clk) s(1) ##1 s(2));",
            false,
            |r, _, _| {
                let (au, _) = r.unwrap();
                assert_eq!(au.local_vars.len(), 4, "f and v, once per instance");
            },
        );
    }

    // -- T14: sequence match items (LRM 16.10, 16.11) ---------------------------

    /// The assertion every T14 fixture checks.
    const S: &str = "assert property (@(posedge clk) s);";

    /// 16.10's illegal example, verbatim but for the declaration of the local
    /// variable `x` (the LRM leaves it implicit): a match item attached to
    /// `b[*0:1]`, which admits the empty match.
    #[test]
    fn t14_a_match_item_on_a_subsequence_that_admits_an_empty_match_is_illegal() {
        // slang diagnoses this itself ("sequences with match items cannot
        // admit an empty match"); the builder enforces the rule independently.
        let e = built_err_lenient(
            &lv("sequence s;\n\
                   int x;\n\
                   a ##1 (b[*0:1], x = e) ##1 c[*2]; // illegal\n\
                 endsequence"),
            S,
        );
        assert!(
            e.message.contains("empty match") && e.message.contains("16.11"),
            "{e}"
        );
    }

    /// 16.10's legal example, verbatim but for the local variable: the
    /// concatenated subsequence `a ##1 b[*0:1]` cannot match the empty word.
    #[test]
    fn t14_a_match_item_on_a_concatenation_that_cannot_be_empty_is_legal() {
        builds(
            &lv("sequence s;\n\
                   int x;\n\
                   (a ##1 b[*0:1], x = e) ##1 c[*2]; // legal\n\
                 endsequence"),
            S,
        )
        .unwrap();
    }

    /// The nondegeneracy rule is the same for every kind of match item: an
    /// increment, a decrement and a subroutine call are as illegal on an
    /// empty-admitting subsequence as an assignment is, and so is an item on a
    /// `[*]`-repeated operand that admits the empty match.
    #[test]
    fn t14_every_kind_of_match_item_needs_a_nonempty_subsequence() {
        for item in [
            "x++",
            "--x",
            "x = 1",
            "x += 1",
            "$display(\"%d\", x)",
            "tk(x)",
        ] {
            let e = built_err_lenient(
                &lv(&format!(
                    "task tk(int v); endtask\n\
                     sequence s; int x = 0; a ##1 (b[*0:1], {item}) ##1 c; endsequence"
                )),
                S,
            );
            assert!(e.message.contains("empty match"), "`{item}`: {e}");
        }
        let e = built_err_lenient(
            &lv("sequence s; int x = 0; a ##1 (b[*0:1], x++)[*2] ##1 c; endsequence"),
            S,
        );
        assert!(e.message.contains("empty match"), "{e}");
    }

    /// `x++`, `x--`, `++x` and `--x` (16.11): each reads then writes the whole
    /// local variable, in list order, and the value is cast to the declared
    /// type. Driven through the reference interpreter.
    #[test]
    fn t14_increment_and_decrement_update_the_local_variable() {
        let sig: [(&str, &[i64]); 2] = [("a", &[1, 0, 0]), ("b", &[0, 1, 0])];
        let up = local_run(
            "sequence s; int x; (a, x = 10) ##1 (b, x++, x++, x++, --x) ##1 (x == 12); endsequence",
            S,
            &sig,
            &[0],
        );
        assert_eq!(ends_with(&up, 0, "x"), BTreeSet::from([(2, Some(12))]));
        let down = local_run(
            "sequence s; int x; (a, x = 10) ##1 (b, x--, x--, ++x) ##1 (x == 9); endsequence",
            S,
            &sig,
            &[0],
        );
        assert_eq!(ends_with(&down, 0, "x"), BTreeSet::from([(2, Some(9))]));
        // 2-bit unsigned: 3 + 1 wraps to 0 (the slot holds a value of the
        // variable's declared type).
        let wrap = local_run(
            "sequence s; bit [1:0] y; (a, y = 3) ##1 (b, y++) ##1 (y == 0); endsequence",
            S,
            &sig,
            &[0],
        );
        assert_eq!(ends_with(&wrap, 0, "y"), BTreeSet::from([(2, Some(0))]));
    }

    /// The implicit read of `++`/`--` (16.10): the variable must have been
    /// assigned first, exactly like `x += 1`.
    #[test]
    fn t14_increment_of_an_unassigned_local_variable_is_rejected() {
        for item in ["x++", "x--", "++x", "--x"] {
            let e = built_err(
                &lv(&format!(
                    "sequence s; int x; (a, {item}) ##1 b; endsequence"
                )),
                S,
            );
            assert!(
                e.message.contains("does not flow out") && e.message.contains("`x`"),
                "`{item}`: {e}"
            );
        }
    }

    /// A match item updates a whole LOCAL variable; `n` is a module variable.
    #[test]
    fn t14_increment_must_name_a_local_variable() {
        let e = built_err_lenient(&lv("sequence s; (a, n++) ##1 b; endsequence"), S);
        assert!(e.message.contains("local variable"), "{e}");
    }

    /// 16.10 `rep_v`, verbatim: match items on the operand of a `[*]`
    /// repetition accumulate over the repeats. `a[->1]` is the repeated unit.
    #[test]
    fn t14_rep_v_accumulates_over_a_repetition() {
        let decls = "sequence s;\n\
                       int x = 0;\n\
                       (a[->1], x += data)[*4] ##1 b ##1 c && (data_out == x);\n\
                     endsequence";
        let row = |v: &[i64]| -> Vec<i64> { v.to_vec() };
        let run = |out: i64| {
            let (a, b, c) = (
                row(&[1, 1, 1, 1, 0, 0]),
                row(&[0, 0, 0, 0, 1, 0]),
                row(&[0, 0, 0, 0, 0, 1]),
            );
            let (data, data_out) = (row(&[1, 2, 3, 4, 0, 0]), row(&[0, 0, 0, 0, 0, out]));
            local_run(
                decls,
                S,
                &[
                    ("a", &a),
                    ("b", &b),
                    ("c", &c),
                    ("data", &data),
                    ("data_out", &data_out),
                ],
                &[0],
            )
        };
        // 1 + 2 + 3 + 4 = 10: the match ends at tick 5 with x == 10.
        assert_eq!(ends_with(&run(10), 0, "x"), BTreeSet::from([(5, Some(10))]));
        // A wrong expectation does not match.
        assert!(run(9).attempts[0].matches.is_empty());
    }

    /// 16.10 `count_a_cycles`: `x++` counts the cycles a stays high. The LRM's
    /// own start `$rose(a)` needs a sampled-value call the reference
    /// evaluator does not have, so the run uses `a` itself; the verbatim text
    /// builds too (below).
    #[test]
    fn t14_count_a_cycles_counts_with_an_increment() {
        let decls = "parameter MAX = 3;\n\
                     sequence s;\n\
                       int x;\n\
                       (a, x = 1)\n\
                       ##1 (a, x++)[*0:$]\n\
                       ##1 !a && (x <= MAX);\n\
                     endsequence";
        let run = |max: i64| local_run(decls, S, &[("a", &[1, 1, 1, 0]), ("MAX", &[max; 4])], &[0]);
        // a is high on ticks 0..=2 and low on 3: x = 1 + 2 = 3 at the match.
        assert_eq!(ends_with(&run(3), 0, "x"), BTreeSet::from([(3, Some(3))]));
        assert!(run(2).attempts[0].matches.is_empty());
    }

    #[test]
    fn t14_count_a_cycles_verbatim_builds() {
        builds(
            &lv("parameter MAX = 3;\n\
                 sequence s;\n\
                   int x;\n\
                   ($rose(a), x = 1)\n\
                   ##1 (a, x++)[*0:$]\n\
                   ##1 !a && (x <= MAX);\n\
                 endsequence"),
            S,
        )
        .unwrap();
    }

    /// 16.9.8: `first_match(seq, x = e)` is `first_match((seq, x = e))`: the
    /// item runs for the earliest match only, whichever way it is written.
    #[test]
    fn t14_first_match_with_a_match_item() {
        let sig: [(&str, &[i64]); 3] = [
            ("a", &[1, 0, 0, 0]),
            ("b", &[0, 1, 1, 0]),
            ("data", &[0, 5, 7, 0]),
        ];
        let seq = |fm: &str, want: i64| {
            local_run(
                &format!("sequence s; int x; {fm} ##1 (x == {want}); endsequence"),
                S,
                &sig,
                &[0],
            )
        };
        // The earliest match of `a ##[1:2] b` ends at tick 1, where data == 5.
        for fm in [
            "first_match(a ##[1:2] b, x = data)",
            "first_match((a ##[1:2] b, x = data))",
        ] {
            assert_eq!(
                ends_with(&seq(fm, 5), 0, "x"),
                BTreeSet::from([(2, Some(5))]),
                "{fm}"
            );
            assert!(seq(fm, 7).attempts[0].matches.is_empty(), "{fm}");
        }
        // Without first_match the later match (tick 2, data == 7) survives.
        let all = seq("(a ##[1:2] b, x = data)", 7);
        assert_eq!(ends_with(&all, 0, "x"), BTreeSet::from([(3, Some(7))]));
    }

    #[test]
    fn t14_first_match_match_item_needs_a_nonempty_sequence() {
        let e = built_err_lenient(
            &lv("sequence s; int x; first_match(a[*0:1], x = data) ##1 b; endsequence"),
            S,
        );
        assert!(e.message.contains("empty match"), "{e}");
    }

    /// 16.9.8 and 16.11: `first_match(seq, tk(e))` is `first_match((seq, tk(e)))`,
    /// and a call runs at EVERY end point of the sequence it is attached to, the
    /// matches `first_match` discards included. `a ##[1:2] b` ends at ticks 1
    /// and 2; all three spellings record the call on both. Assignments cannot
    /// tell the positions apart (see `t14_first_match_with_a_match_item`), calls
    /// can.
    #[test]
    fn t14_first_match_calls_fire_at_every_end_point_whichever_way_it_is_written() {
        let sigs: [(&str, &[i64]); 3] = [
            ("a", &[1, 0, 0, 0]),
            ("b", &[0, 1, 1, 0]),
            ("data", &[0, 5, 7, 0]),
        ];
        type Calls = BTreeSet<(u32, Vec<Option<i64>>)>;
        let calls_of = |body: &str| -> (Calls, BTreeSet<u32>) {
            call_run(
                &format!("task tk(int n); endtask\nsequence s; {body}; endsequence"),
                &sigs,
                |leaves, got| {
                    assert_eq!(leaves.call_count(), 1, "`{body}`");
                    (
                        got.calls.iter().map(|c| (c.tick, c.args.clone())).collect(),
                        got.attempt.ends(),
                    )
                },
            )
        };
        let both = BTreeSet::from([(1, vec![Some(5)]), (2, vec![Some(7)])]);
        let (plain, plain_ends) = calls_of("(a ##[1:2] b, tk(data))");
        assert_eq!(plain, both);
        assert_eq!(plain_ends, BTreeSet::from([1, 2]));
        for fm in [
            "first_match(a ##[1:2] b, tk(data))",
            "first_match((a ##[1:2] b, tk(data)))",
        ] {
            let (calls, ends) = calls_of(fm);
            assert_eq!(calls, both, "{fm}: the call fires at both end points");
            // first_match still keeps only the earliest match.
            assert_eq!(ends, BTreeSet::from([1]), "{fm}");
        }
    }

    /// A mixed list on `first_match` keeps list order: the call samples the
    /// variable the assignment before it wrote, at every end point.
    #[test]
    fn t14_first_match_mixed_items_run_in_list_order() {
        let sigs: [(&str, &[i64]); 3] = [
            ("a", &[1, 0, 0, 0]),
            ("b", &[0, 1, 1, 0]),
            ("data", &[0, 5, 7, 0]),
        ];
        call_run(
            "task tk(int n); endtask\n\
             sequence s; int x; first_match(a ##[1:2] b, x = data, tk(x), x++) ##1 (x == 6); endsequence",
            &sigs,
            |_, got| {
                let calls: Vec<_> = got.calls.iter().map(|c| (c.tick, c.args.clone())).collect();
                assert_eq!(calls, vec![(1, vec![Some(5)]), (2, vec![Some(7)])]);
                // Only the earliest match continues, with x == data + 1 == 6.
                assert_eq!(got.attempt.ends(), BTreeSet::from([2]));
            },
        );
    }

    /// The items of a `first_match` whose operand can never match are still
    /// validated: `x++` reads an `x` that never flowed in (16.10).
    #[test]
    fn t14_first_match_items_are_validated_when_the_operand_never_matches() {
        for item in ["x++", "x += 1"] {
            let e = built_err_lenient(
                &lv(&format!(
                    "sequence s; int x; first_match((a ##1 b) intersect (a ##2 b), {item}); \
                     endsequence"
                )),
                S,
            );
            assert!(
                e.message.contains("does not flow out") && e.message.contains("`x`"),
                "`{item}`: {e}"
            );
        }
    }

    /// 16.11 `s1`, verbatim (the `f` signal is the LRM's implicit one).
    #[test]
    fn t14_s1_from_16_11_builds() {
        builds(
            &lv("logic f;\n\
                 sequence s;\n\
                   logic v, w;\n\
                   (a, v = e) ##1\n\
                   (b[->1], w = f, $display(\"b after a with v = %h, w = %h\\n\", v, w));\n\
                 endsequence"),
            S,
        )
        .unwrap();
    }

    /// 16.11: a function call is not a match item unless it is void. slang
    /// rejects it first; the builder must not accept what slang diagnosed.
    #[test]
    fn t14_a_non_void_function_is_not_a_match_item() {
        let e = built_err_lenient(
            &lv("function int fn(int v); return v; endfunction\n\
                 sequence s; int x; (a, x = 1) ##1 (b, fn(x)); endsequence"),
            S,
        );
        assert!(e.message.contains("void"), "{e}");
    }

    /// 16.11: a subroutine called from a match item takes `input` and `ref`
    /// arguments only.
    #[test]
    fn t14_output_and_inout_formals_are_rejected() {
        for dir in ["output", "inout"] {
            let e = built_err_lenient(
                &lv(&format!(
                    "task tk({dir} int o); endtask\n\
                     sequence s; (a, tk(data)) ##1 b; endsequence"
                )),
                S,
            );
            assert!(e.message.contains(dir), "{dir}: {e}");
        }
    }

    /// 16.11: "If a local variable appears in an actual argument expression,
    /// then that argument shall be passed by value."
    #[test]
    fn t14_a_local_variable_cannot_be_passed_by_reference() {
        let e = built_err_lenient(
            &lv("task tk(ref int r); endtask\n\
                 sequence s; int x; (a, x = 1) ##1 (b, tk(x)); endsequence"),
            S,
        );
        assert!(
            e.message.contains("local variable") && e.message.contains("by value"),
            "{e}"
        );
    }

    /// The legal argument shapes: by value (also a local variable), by `ref`
    /// and `const ref`, by name, and with a defaulted formal.
    #[test]
    fn t14_input_ref_and_const_ref_arguments_are_legal() {
        for call in [
            "tk(data, 1)",
            "tk(.n(data), .m(2))",
            "tk(x, x + 1)",
            "tk(data)",
        ] {
            builds(
                &lv(&format!(
                    "task tk(int n, int m = 0); endtask\n\
                     sequence s; int x = 1; (a, {call}) ##1 b; endsequence"
                )),
                S,
            )
            .unwrap_or_else(|e| panic!("`{call}`: {e}"));
        }
        for decl in ["task tk(ref int r);", "task tk(const ref int r);"] {
            builds(
                &lv(&format!(
                    "{decl} endtask\nsequence s; (a, tk(data)) ##1 b; endsequence"
                )),
                S,
            )
            .unwrap_or_else(|e| panic!("`{decl}`: {e}"));
        }
    }

    /// Runs `stmt` over `signals` from tick 0 through the call-tracking
    /// interpreter, handing the call table and the result to `f`.
    fn call_run<R>(
        decls: &str,
        signals: &[(&str, &[i64])],
        f: impl FnOnce(&LeafTable<'_>, &trace::CallAttempt) -> R,
    ) -> R {
        with_assertion(&lv(decls), S, false, |r, _, _| {
            let (au, leaves) = r.unwrap_or_else(|e| panic!("failed to build: {e}"));
            let len = signals[0].1.len() as u32;
            let sig = |name: &str, t: u32| -> i64 {
                signals
                    .iter()
                    .find(|(n, _)| *n == name)
                    .unwrap_or_else(|| panic!("the trace has no signal `{name}`"))
                    .1[t as usize]
            };
            let got = trace::attempt_with_calls(&au, 0, len, &|id, tick, frame| {
                eval_leaf_id(&leaves, id, frame, tick, &sig)
            })
            .unwrap_or_else(|e| panic!("trace interpreter: {e}"));
            f(&leaves, &got)
        })
    }

    /// 16.11: the items of one list run in list order at the end point, each
    /// call sampling the variable as the items before it left it.
    #[test]
    fn t14_calls_and_writes_run_in_list_order() {
        let sigs: [(&str, &[i64]); 3] = [("a", &[1, 0, 0]), ("b", &[0, 1, 0]), ("c", &[0, 0, 1])];
        call_run(
            "task tk(int n); endtask\n\
             sequence s; int x; (a, x = 1) ##1 (b, tk(x), x = 5, tk(x)) ##1 c; endsequence",
            &sigs,
            |leaves, got| {
                assert_eq!(leaves.call_count(), 2);
                let calls: Vec<_> = got
                    .calls
                    .iter()
                    .map(|c| (c.tick, c.call.0, c.args.clone()))
                    .collect();
                assert_eq!(
                    calls,
                    vec![(1, 0, vec![Some(1)]), (1, 1, vec![Some(5)])],
                    "the first call sees x == 1, the second the x = 5 written between them"
                );
                assert_eq!(got.attempt.ends(), BTreeSet::from([2]));
            },
        );
    }

    /// 16.11: a call fires at every end point of the subsequence it is
    /// attached to, even when the longer sequence then fails.
    #[test]
    fn t14_a_call_fires_even_if_the_longer_sequence_fails() {
        // `c` never holds, so the whole sequence never matches.
        let sigs: [(&str, &[i64]); 3] = [("a", &[1, 0, 0]), ("b", &[0, 1, 0]), ("c", &[0, 0, 0])];
        call_run(
            "task tk(int n); endtask\n\
             sequence s; int x; (a, x = 1) ##1 (b, tk(x)) ##1 c; endsequence",
            &sigs,
            |_, got| {
                assert!(got.attempt.matches.is_empty());
                assert_eq!(got.calls.len(), 1, "the call at tick 1 still fired");
            },
        );
    }

    /// 16.11 by-value vs by-reference: `n` is an `input` (sampled), `r` is a
    /// `ref` (bound to the actual). The call table records which is which and
    /// the actual expression of each.
    #[test]
    fn t14_the_call_table_records_how_each_argument_is_passed() {
        call_run(
            "task tk(int n, ref int r); endtask\n\
             sequence s; (a, tk(data, data2)) ##1 b; endsequence",
            &[("a", &[1, 0]), ("b", &[0, 1]), ("data", &[7, 0])],
            |leaves, got| {
                assert_eq!(leaves.call_count(), 1);
                let site = leaves.call_site(ir::CallId(0));
                assert_eq!(site.args.len(), 2);
                assert!(matches!(site.args[0].0, ir::CallArg::Value(_)));
                assert!(matches!(site.args[1].0, ir::CallArg::Ref));
                let event = got.calls.iter().next().expect("the call fired");
                assert_eq!(event.args, vec![Some(7), None], "ref has no sampled value");
            },
        );
    }

    /// A call inside an `and`/`intersect` operand cannot be composed by the
    /// lockstep product: a loud error naming the edge kind, not a silent drop.
    #[test]
    fn t14_a_call_inside_an_and_or_intersect_operand_is_a_loud_error() {
        for op in ["and", "intersect"] {
            let e = built_err(
                &lv(&format!(
                    "task tk(int n); endtask\n\
                     sequence s; ((a, tk(data)) ##1 b) {op} (c ##1 d); endsequence"
                )),
                S,
            );
            assert!(
                e.message.contains("SubroutineCall") && e.message.contains(op),
                "{op}: {e}"
            );
        }
    }

    // -- T15: `.triggered` / `.matched`, LRM 16.9.11, 16.10, 16.13.5, 16.13.6 --

    /// The signals the T15 fixtures use, on top of `with_assertion`'s and `LV`'s.
    const EP: &str = "logic reset, inst, branch_back, ready, proc1, proc2, reset1, branch_back1, \
                      req, w;\n";

    /// `EP`, `LV` and one fixture's own declarations.
    fn ep(decls: &str) -> String {
        format!("{EP}{}", lv(decls))
    }

    /// Builds `stmt` (declarations `decls`) and runs one attempt per `starts`
    /// entry through the two-clock interpreter: the destination clock ticks at
    /// `dest` (simulation times), the source clock at `source`, and each signal
    /// of `sigs` is a row indexed by the tick of ITS OWN clock (a leaf of an
    /// instance a `.matched` is applied to is evaluated at source ticks, the
    /// rest at destination ticks -- the interpreter hands the evaluator the
    /// leaf's own tick, and every name here belongs to one domain). `f` also
    /// sees the automaton and the leaf table.
    fn clock_run<R>(
        decls: &str,
        stmt: &str,
        (dest, source): (&[u64], &[u64]),
        sigs: &[(&str, &[i64])],
        starts: &[u32],
        f: impl FnOnce(&ir::Automaton, &LeafTable<'_>, Vec<trace::CallAttempt>) -> R,
    ) -> R {
        with_assertion(&ep(decls), stmt, false, |r, _, _| {
            let (au, leaves) = r.unwrap_or_else(|e| panic!("`{stmt}` failed to build: {e}"));
            let sig = |name: &str, t: u32| -> i64 {
                sigs.iter()
                    .find(|(n, _)| *n == name)
                    .unwrap_or_else(|| panic!("the trace has no signal `{name}`"))
                    .1[t as usize]
            };
            let clocks = trace::TraceClocks {
                dest: dest.to_vec(),
                source: source.to_vec(),
            };
            let got = starts
                .iter()
                .map(|&s| {
                    trace::attempt_with_clocks(&au, s, &clocks, &|id, tick, frame| {
                        eval_leaf_id(&leaves, id, frame, tick, &sig)
                    })
                    .unwrap_or_else(|e| panic!("trace interpreter: {e}"))
                })
                .collect();
            f(&au, &leaves, got)
        })
    }

    /// One clock: every tick of both domains is the same instant.
    fn one_clock(n: u64) -> Vec<u64> {
        (0..n).map(|t| (t + 1) * 10).collect()
    }

    /// The end ticks of each attempt, one set per start.
    fn ends_of(got: &[trace::CallAttempt]) -> Vec<BTreeSet<u32>> {
        got.iter().map(|g| g.attempt.ends()).collect()
    }

    /// 16.9.11, `zero_or_one_req` verbatim: the sequence admits an empty match
    /// AND a nonempty one, but "such empty matches shall not activate the
    /// .triggered method": `.triggered` is true exactly when `req` is 1.
    #[test]
    fn t15_an_empty_match_never_fires_triggered() {
        let decls = "sequence zero_or_one_req; (req==1'b1)[*0:1]; endsequence";
        let stmt = "assert property (@(posedge clk) a ##1 zero_or_one_req.triggered);";
        let t = one_clock(5);
        let sigs: [(&str, &[i64]); 2] = [("a", &[1, 1, 1, 1, 1]), ("req", &[0, 1, 0, 1, 0])];
        clock_run(
            decls,
            stmt,
            (&t, &t),
            &sigs,
            &[0, 1, 2, 3],
            |au, leaves, got| {
                assert_eq!(au.end_points.len(), 1);
                assert!(
                    au.end_point(ir::EndPointId(0)).automaton.admits_empty,
                    "the instance admits the empty match; that is the point of the test"
                );
                assert_eq!(leaves.end_site_count(), 1);
                // Starting at 0 the end point is tested at tick 1 (req = 1: fires);
                // at 1 it is tested at tick 2 (req = 0, the EMPTY match: must not).
                assert_eq!(
                    ends_of(&got),
                    vec![
                        BTreeSet::from([1]),
                        BTreeSet::new(),
                        BTreeSet::from([3]),
                        BTreeSet::new()
                    ]
                );
            },
        );
    }

    /// The LRM's two-sequence `e1`/`e2` of 16.13.6 (same clock, `.triggered`),
    /// verbatim, builds one end point whose site records the instance's own
    /// clock.
    #[test]
    fn t15_e1_e2_from_16_13_6_build_one_triggered_end_point() {
        let decls = "sequence e1;\n\
                       @(posedge sysclk) $rose(a) ##1 b ##1 c;\n\
                     endsequence\n\
                     sequence e2;\n\
                       @(posedge sysclk) reset ##1 inst ##1 e1.triggered ##1 branch_back;\n\
                     endsequence";
        with_assertion(&ep(decls), "assert property (e2);", false, |r, _, _| {
            let (au, leaves) = r.unwrap();
            assert_eq!(au.end_points.len(), 1);
            let point = au.end_point(ir::EndPointId(0));
            assert_eq!(point.method, ir::EndMethod::Triggered);
            assert_eq!(point.site, 0);
            assert!(point.flow_out.is_empty());
            assert_eq!(leaves.end_site(0).method, ir::EndMethod::Triggered);
            assert!(leaves.end_site(0).clock.is_some(), "e1 has its own clock");
        });
    }

    /// `e2` (16.13.6) by value: `.triggered` tests only the END POINT, so it
    /// holds at the tick `e1` ends whatever tick it started on -- which is
    /// before the point `e2` reaches it. Replacing the application by the
    /// instance (`e1` itself) starts `e1` one tick after `inst` and so needs a
    /// different trace, which discriminates the two.
    #[test]
    fn t15_triggered_tests_the_end_point_and_not_the_start() {
        let decls = "sequence e1x; @(posedge sysclk) a ##1 b ##1 c; endsequence\n\
                     sequence e2x;\n\
                       @(posedge sysclk) reset ##1 inst ##1 e1x.triggered ##1 branch_back;\n\
                     endsequence\n\
                     sequence e2i;\n\
                       @(posedge sysclk) reset ##1 inst ##1 e1x ##1 branch_back;\n\
                     endsequence";
        let t = one_clock(8);
        // e1x: a@0 b@1 c@2 ends at 2. e2x: reset@0 inst@1 triggered@2 bb@3.
        let sigs: [(&str, &[i64]); 6] = [
            ("reset", &[1, 0, 0, 0, 0, 0, 0, 0]),
            ("inst", &[0, 1, 0, 0, 0, 0, 0, 0]),
            ("a", &[1, 0, 0, 0, 0, 0, 0, 0]),
            ("b", &[0, 1, 0, 0, 0, 0, 0, 0]),
            ("c", &[0, 0, 1, 0, 0, 0, 0, 0]),
            ("branch_back", &[0, 0, 0, 1, 0, 0, 0, 0]),
        ];
        clock_run(
            decls,
            "assert property (e2x);",
            (&t, &t),
            &sigs,
            &[0],
            |_, _, got| {
                assert_eq!(ends_of(&got), vec![BTreeSet::from([3])]);
            },
        );
        // The instance form needs `a` at 2, `b` at 3, `c` at 4: not in this trace.
        clock_run(
            decls,
            "assert property (e2i);",
            (&t, &t),
            &sigs,
            &[0],
            |_, _, got| {
                assert_eq!(ends_of(&got), vec![BTreeSet::new()]);
            },
        );
        // No end point at tick 2 (c low): no match.
        let mut c_low = sigs.to_vec();
        c_low[4] = ("c", &[0, 0, 0, 0, 0, 0, 0, 0]);
        clock_run(
            decls,
            "assert property (e2x);",
            (&t, &t),
            &c_low,
            &[0],
            |_, _, got| {
                assert_eq!(ends_of(&got), vec![BTreeSet::new()]);
            },
        );
    }

    /// 16.9.11's `e2(a,b,c)` with arguments: the end point of an instance with
    /// ACTUALS, and `rule2a`'s equivalent (a named instance in between).
    #[test]
    fn t15_triggered_on_an_instance_with_arguments_and_through_a_name() {
        let decls = "sequence e2p(p,q,r); @(posedge sysclk) p ##1 q ##1 r; endsequence\n\
                     sequence rule2;\n\
                       @(posedge sysclk) reset ##1 inst ##1 e2p(ready,proc1,proc2).triggered\n\
                         ##1 branch_back;\n\
                     endsequence\n\
                     sequence e2_instantiated; e2p(ready,proc1,proc2); endsequence\n\
                     sequence rule2a;\n\
                       @(posedge sysclk) reset ##1 inst ##1 e2_instantiated.triggered ##1 branch_back;\n\
                     endsequence";
        let t = one_clock(6);
        let sigs: [(&str, &[i64]); 6] = [
            ("reset", &[1, 0, 0, 0, 0, 0]),
            ("inst", &[0, 1, 0, 0, 0, 0]),
            ("ready", &[1, 0, 0, 0, 0, 0]),
            ("proc1", &[0, 1, 0, 0, 0, 0]),
            ("proc2", &[0, 0, 1, 0, 0, 0]),
            ("branch_back", &[0, 0, 0, 1, 0, 0]),
        ];
        for rule in ["rule2", "rule2a"] {
            let stmt = format!("assert property ({rule});");
            clock_run(decls, &stmt, (&t, &t), &sigs, &[0], |_, _, got| {
                assert_eq!(ends_of(&got), vec![BTreeSet::from([3])], "{rule}");
            });
        }
    }

    /// 16.9.11's `e3(sequence a, untyped b)`: `.triggered` on a formal argument
    /// of type `sequence`, whose actual (`ready ##1 proc1`) has no clock of its
    /// own and so ends on the clock of the context. `rule3` verbatim.
    #[test]
    fn t15_triggered_on_a_sequence_formal_argument() {
        let decls = "sequence e3f(sequence s, untyped t);\n\
                       @(posedge sysclk) s.triggered ##1 t;\n\
                     endsequence\n\
                     sequence rule3;\n\
                       @(posedge sysclk) reset ##1 e3f(ready ##1 proc1, proc2) ##1 branch_back;\n\
                     endsequence";
        let t = one_clock(5);
        // reset@0; e3f at 1: (ready ##1 proc1) ended at 1 (ready@0, proc1@1);
        // proc2@2; branch_back@3.
        let sigs: [(&str, &[i64]); 5] = [
            ("reset", &[1, 0, 0, 0, 0]),
            ("ready", &[1, 0, 0, 0, 0]),
            ("proc1", &[0, 1, 0, 0, 0]),
            ("proc2", &[0, 0, 1, 0, 0]),
            ("branch_back", &[0, 0, 0, 1, 0]),
        ];
        clock_run(
            decls,
            "assert property (rule3);",
            (&t, &t),
            &sigs,
            &[0],
            |au, _, got| {
                assert_eq!(au.end_points.len(), 1);
                assert_eq!(ends_of(&got), vec![BTreeSet::from([3])]);
            },
        );
    }

    /// `e2_with_arg(sequence subseq)` and `e4` of 16.13.6, verbatim: the
    /// application on a formal of type `sequence` whose actual is a clocked
    /// sequence expression, equivalent to `e2`.
    #[test]
    fn t15_e2_with_arg_and_e4_from_16_13_6() {
        let decls = "sequence e2_with_arg(sequence subseq);\n\
                       @(posedge sysclk) reset ##1 inst ##1 subseq.triggered ##1 branch_back;\n\
                     endsequence\n\
                     sequence e4;\n\
                       e2_with_arg(@(posedge sysclk) a ##1 b ##1 c);\n\
                     endsequence";
        let t = one_clock(8);
        let sigs: [(&str, &[i64]); 6] = [
            ("reset", &[1, 0, 0, 0, 0, 0, 0, 0]),
            ("inst", &[0, 1, 0, 0, 0, 0, 0, 0]),
            ("a", &[1, 0, 0, 0, 0, 0, 0, 0]),
            ("b", &[0, 1, 0, 0, 0, 0, 0, 0]),
            ("c", &[0, 0, 1, 0, 0, 0, 0, 0]),
            ("branch_back", &[0, 0, 0, 1, 0, 0, 0, 0]),
        ];
        clock_run(
            decls,
            "assert property (e4);",
            (&t, &t),
            &sigs,
            &[0],
            |au, leaves, got| {
                assert_eq!(au.end_points.len(), 1);
                assert!(leaves.end_site(0).clock.is_some());
                assert_eq!(ends_of(&got), vec![BTreeSet::from([3])]);
            },
        );
    }

    /// 16.13.6's `e3` with `.matched` across clocks (`e1` ends on `sysclk`, the
    /// context is `clk`): the end point is stored until the first destination
    /// tick after it, and `.triggered` in its place is a clock mismatch.
    #[test]
    fn t15_matched_synchronises_two_clocks_and_triggered_does_not() {
        let decls = "sequence e1x; @(posedge sysclk) a ##1 b ##1 c; endsequence\n\
                     sequence e3m; @(posedge clk) reset1 ##1 e1x.matched ##1 branch_back1; endsequence\n\
                     sequence e3t; @(posedge clk) reset1 ##1 e1x.triggered ##1 branch_back1; endsequence";
        // sysclk at 5, 15, 25, ...; clk at 10, 20, 30, ...
        let source: Vec<u64> = (0..9).map(|k| 5 + 10 * k).collect();
        let dest: Vec<u64> = (1..=9).map(|k| 10 * k).collect();
        // e1x: a@0 b@1 c@2, ends at source tick 2 = time 25. Destination ticks:
        // reset1@1 (t 20), the first tick after the match is index 2 (t 30), and
        // branch_back1@3.
        let sigs: [(&str, &[i64]); 5] = [
            ("a", &[1, 0, 0, 0, 0, 0, 0, 0, 0]),
            ("b", &[0, 1, 0, 0, 0, 0, 0, 0, 0]),
            ("c", &[0, 0, 1, 0, 0, 0, 0, 0, 0]),
            ("reset1", &[0, 1, 0, 0, 0, 0, 0, 0, 0]),
            ("branch_back1", &[0, 0, 0, 1, 0, 0, 0, 0, 0]),
        ];
        clock_run(
            decls,
            "assert property (e3m);",
            (&dest, &source),
            &sigs,
            &[1],
            |au, leaves, got| {
                assert_eq!(
                    au.end_point(ir::EndPointId(0)).method,
                    ir::EndMethod::Matched
                );
                assert!(leaves.end_site(0).clock.is_some());
                assert_eq!(ends_of(&got), vec![BTreeSet::from([3])]);
            },
        );
        // The status persists only to the first destination tick after the match:
        // `reset1` one tick later finds no `.matched` at tick 3.
        let mut late = sigs.to_vec();
        late[3] = ("reset1", &[0, 0, 1, 0, 0, 0, 0, 0, 0]);
        late[4] = ("branch_back1", &[0, 0, 0, 0, 1, 0, 0, 0, 0]);
        clock_run(
            decls,
            "assert property (e3m);",
            (&dest, &source),
            &late,
            &[2],
            |_, _, got| {
                assert_eq!(ends_of(&got), vec![BTreeSet::new()]);
            },
        );
        let e = built_err(&ep(decls), "assert property (e3t);");
        assert!(
            e.message.contains("`.triggered`") && e.message.contains("different clock"),
            "{e}"
        );
    }

    /// 16.13.5's `e2` with `.matched [->1]`: the destination sequence waits for
    /// the source's end point sometime after `inst`.
    #[test]
    fn t15_matched_with_goto_repetition() {
        let decls = "sequence e1p(p,q,r); @(posedge sysclk) p ##1 q ##1 r; endsequence\n\
                     sequence e2g;\n\
                       @(posedge clk) reset ##1 inst ##1 e1p(ready,proc1,proc2).matched [->1]\n\
                         ##1 branch_back;\n\
                     endsequence";
        let source: Vec<u64> = (0..9).map(|k| 5 + 10 * k).collect();
        let dest: Vec<u64> = (1..=9).map(|k| 10 * k).collect();
        // e1p ends at source tick 2 (time 25), seen at destination tick 2 (30):
        // reset@0, inst@1, the end point @2, branch_back@3. `[->1]` is
        // `(!e1p.matched[*0:$] ##1 e1p.matched)`: no end point may come before
        // the one that is waited for (16.9.2), see `build_goto`.
        let sigs: [(&str, &[i64]); 6] = [
            ("ready", &[1, 0, 0, 0, 0, 0, 0, 0, 0]),
            ("proc1", &[0, 1, 0, 0, 0, 0, 0, 0, 0]),
            ("proc2", &[0, 0, 1, 0, 0, 0, 0, 0, 0]),
            ("reset", &[1, 0, 0, 0, 0, 0, 0, 0, 0]),
            ("inst", &[0, 1, 0, 0, 0, 0, 0, 0, 0]),
            ("branch_back", &[0, 0, 0, 1, 0, 0, 0, 0, 0]),
        ];
        clock_run(
            decls,
            "assert property (e2g);",
            (&dest, &source),
            &sigs,
            &[0],
            |au, _, got| {
                // One application per copy of the unit: the two gap samples
                // (`!e1p.matched`, first copy and loop copy) and the hit.
                assert_eq!(au.end_points.len(), 3);
                assert_eq!(ends_of(&got), vec![BTreeSet::from([3])]);
            },
        );
    }

    /// 16.13.6: the matched status "persists until the Observed region following
    /// the arrival of the first clock tick of the destination sequence after the
    /// match" and no longer: `.matched` holds on ONE destination tick per source
    /// match, so `inst ##1 e1x.matched` ends only where that tick is.
    #[test]
    fn t15_matched_holds_on_one_destination_tick_per_match() {
        let decls = "sequence e1x; @(posedge sysclk) a ##1 b; endsequence\n\
                     sequence mm; @(posedge clk) inst ##1 e1x.matched; endsequence";
        let source: Vec<u64> = (0..9).map(|k| 5 + 10 * k).collect();
        let dest: Vec<u64> = (1..=9).map(|k| 10 * k).collect();
        // e1x ends at source tick 3 (time 35): the first destination tick at or
        // after it is index 3 (40); `inst` is high everywhere.
        let sigs: [(&str, &[i64]); 3] = [
            ("a", &[0, 0, 1, 0, 0, 0, 0, 0, 0]),
            ("b", &[0, 0, 0, 1, 0, 0, 0, 0, 0]),
            ("inst", &[1, 1, 1, 1, 1, 1, 1, 1, 1]),
        ];
        let starts: Vec<u32> = (0..9).collect();
        clock_run(
            decls,
            "assert property (mm);",
            (&dest, &source),
            &sigs,
            &starts,
            |_, _, got| {
                let ends = ends_of(&got);
                for (start, e) in ends.iter().enumerate() {
                    let want = if start == 2 {
                        BTreeSet::from([3])
                    } else {
                        BTreeSet::new()
                    };
                    assert_eq!(*e, want, "start {start}");
                }
            },
        );
    }

    /// 16.10 `seq2a`: a local variable passed into `sub_seq2(v1).triggered`
    /// flows out of the (maximal) application, so `do1 == v1` reads the value
    /// `lv = data_in` assigned inside the instance -- and a SECOND distinct
    /// valuation at the same tick forks the thread (16.10: "treated the same way
    /// as matching both disjuncts of an or").
    #[test]
    fn t15_seq2a_a_local_flows_out_of_a_maximal_triggered() {
        let decls = "sequence sub_seq2(lv);\n\
                       (a ##1 !a, lv = data_in) ##1 !b[*0:$] ##1 b && (data_out == lv);\n\
                     endsequence\n\
                     sequence seq2a;\n\
                       int v1; c ##1 sub_seq2(v1).triggered ##1 (do1 == v1);\n\
                       // v1 is now bound to lv\n\
                     endsequence";
        let t = one_clock(4);
        // sub_seq2 started at 0: a@0, !a@1 (lv = data_in = 5), b@2 with
        // data_out == 5. c@1, so the application is tested at tick 2; do1@3.
        let sigs = |do1: i64| -> Vec<(&'static str, Vec<i64>)> {
            vec![
                ("a", vec![1, 0, 0, 0]),
                ("b", vec![0, 0, 1, 0]),
                ("c", vec![0, 1, 0, 0]),
                ("data_in", vec![0, 5, 0, 0]),
                ("data_out", vec![0, 0, 5, 0]),
                ("do1", vec![0, 0, 0, do1]),
            ]
        };
        for (do1, want) in [(5, BTreeSet::from([3])), (6, BTreeSet::new())] {
            let owned = sigs(do1);
            let rows: Vec<(&str, &[i64])> = owned.iter().map(|(n, r)| (*n, r.as_slice())).collect();
            clock_run(
                decls,
                "assert property (@(posedge clk) seq2a);",
                (&t, &t),
                &rows,
                &[1],
                |au, _, got| {
                    assert_eq!(au.end_points.len(), 1);
                    assert_eq!(
                        au.end_point(ir::EndPointId(0)).flow_out.len(),
                        1,
                        "v1 flows out"
                    );
                    assert_eq!(ends_of(&got), vec![want.clone()], "do1 = {do1}");
                },
            );
        }
    }

    /// Two distinct valuations of a flowing local at one end tick fork the
    /// thread (16.10): each of the two later comparisons matches its own.
    #[test]
    fn t15_distinct_flow_out_valuations_fork_the_thread() {
        let decls = "sequence two(lv); (a, lv = data_in) or (b, lv = data_out); endsequence\n\
                     sequence fk; int v1; c ##1 two(v1).triggered ##1 (do1 == v1); endsequence";
        let t = one_clock(3);
        for (do1, want) in [(3, true), (4, true), (9, false)] {
            let sigs: [(&str, &[i64]); 6] = [
                ("a", &[0, 1, 0]),
                ("b", &[0, 1, 0]),
                ("c", &[1, 0, 0]),
                ("data_in", &[0, 3, 0]),
                ("data_out", &[0, 4, 0]),
                ("do1", &[0, 0, do1]),
            ];
            clock_run(
                decls,
                "assert property (@(posedge clk) fk);",
                (&t, &t),
                &sigs,
                &[0],
                |_, _, got| {
                    let ends = ends_of(&got);
                    assert_eq!(
                        ends[0] == BTreeSet::from([2]),
                        want,
                        "do1 = {do1}: {ends:?}"
                    );
                },
            );
        }
    }

    /// 16.10 `seq2b`: negating the application means it is not a maximal Boolean
    /// expression, so `v1` does not flow out and the read of it is an error.
    #[test]
    fn t15_seq2b_a_negated_triggered_does_not_flow_a_local_out() {
        let decls = "sequence sub_seq2(lv);\n\
                       (a ##1 !a, lv = data_in) ##1 !b[*0:$] ##1 b && (data_out == lv);\n\
                     endsequence\n\
                     sequence seq2b;\n\
                       int v1; c ##1 !sub_seq2(v1).triggered ##1 (do1 == v1); // v1 unassigned\n\
                     endsequence";
        let e = built_err(&ep(decls), "assert property (@(posedge clk) seq2b);");
        assert!(
            e.message.contains("does not flow out") && e.message.contains("`v1`"),
            "{e}"
        );
    }

    /// 16.8.2: it is an error to apply `triggered`/`matched` to an instance of a
    /// sequence with an `input`/`inout` local variable formal.
    #[test]
    fn t15_a_local_input_or_inout_formal_is_an_error() {
        for (dir, method) in [
            ("input", "triggered"),
            ("inout", "triggered"),
            ("input", "matched"),
        ] {
            let decls = format!(
                "sequence li(local {dir} int f); a ##1 (f == 1); endsequence\n\
                 sequence u; int k; c ##1 li(k).{method}; endsequence"
            );
            let e = built_err_lenient(&ep(&decls), "assert property (@(posedge clk) u);");
            assert!(
                e.message.contains(&format!("`.{method}`"))
                    && e.message.contains("local variable formal"),
                "{dir}/{method}: {e}"
            );
        }
    }

    /// An application inside a larger expression counts one end point per
    /// application, in the pre-order the leaf's flag slots are listed in; the
    /// leaf reads each at the call's position, so a swapped order changes the
    /// value.
    #[test]
    fn t15_an_application_inside_an_expression_is_a_flag_in_preorder() {
        let decls = "sequence sa; a; endsequence\n\
                     sequence sb; b; endsequence";
        let t = one_clock(2);
        let sigs: [(&str, &[i64]); 3] = [("a", &[1, 0]), ("b", &[0, 1]), ("c", &[1, 1])];
        // `!sa.triggered && sb.triggered` is `!a && b`: true at tick 1 only.
        // The `c ##1` prefix tests the leaf at tick 1.
        clock_run(
            decls,
            "assert property (@(posedge clk) c ##1 (!sa.triggered && sb.triggered));",
            (&t, &t),
            &sigs,
            &[0],
            |au, leaves, got| {
                assert_eq!(au.end_points.len(), 2);
                assert_eq!(leaves.end_site_count(), 2);
                assert_eq!(leaves.end_site(0).method, ir::EndMethod::Triggered);
                let flagged: Vec<_> = (0..leaves.len() as u32)
                    .filter(|&i| !leaves.locals_of(LeafId(i)).end_flags.is_empty())
                    .collect();
                assert_eq!(flagged.len(), 1);
                assert_eq!(leaves.locals_of(LeafId(flagged[0])).end_flags.len(), 2);
                assert_eq!(ends_of(&got), vec![BTreeSet::from([1])]);
            },
        );
        clock_run(
            decls,
            "assert property (@(posedge clk) c ##1 (!sb.triggered && sa.triggered));",
            (&t, &t),
            &sigs,
            &[0],
            |_, _, got| {
                assert_eq!(
                    ends_of(&got),
                    vec![BTreeSet::new()],
                    "!b && a is false at 1"
                )
            },
        );
    }

    /// `.triggered` as an operand of `and`/`intersect`: the lockstep product
    /// carries the end-point edge on the thread.
    #[test]
    fn t15_an_end_point_inside_a_product_operand() {
        let decls = "sequence sc; c ##1 d; endsequence";
        let t = one_clock(4);
        let sigs: [(&str, &[i64]); 4] = [
            ("a", &[1, 1, 0, 0]),
            ("b", &[0, 0, 1, 0]),
            ("c", &[1, 0, 0, 0]),
            ("d", &[0, 1, 0, 0]),
        ];
        // sc ends at tick 1. `(a ##1 sc.triggered) and (a ##1 a)` over [0,1].
        for (op, want) in [
            ("and", BTreeSet::from([1])),
            ("intersect", BTreeSet::from([1])),
        ] {
            let stmt =
                format!("assert property (@(posedge clk) (a ##1 sc.triggered) {op} (a ##1 a));");
            clock_run(decls, &stmt, (&t, &t), &sigs, &[0], |_, _, got| {
                assert_eq!(ends_of(&got), vec![want.clone()], "{op}");
            });
        }
    }

    /// 16.13.6: "There shall be no circular dependencies between sequences
    /// induced by the use of triggered." slang diagnoses it; a caller that
    /// ignores the diagnostic gets a named error from the builder, not
    /// unbounded recursion.
    #[test]
    fn t15_a_circular_triggered_dependency_is_an_error_not_a_loop() {
        let decls = "sequence r1; a ##1 r2.triggered; endsequence\n\
                     sequence r2; b ##1 r1.triggered; endsequence";
        let e = built_err_lenient(&ep(decls), "assert property (@(posedge clk) r1);");
        // slang leaves the cyclic operand unbound, which the builder reports.
        assert!(e.message.contains("slang could not bind"), "{e}");
    }

    /// The expansion with end points is a pure function of the design.
    #[test]
    fn t15_building_end_points_is_deterministic() {
        let decls = ep("sequence e1x; @(posedge sysclk) a ##1 b; endsequence\n\
                        sequence e2x; @(posedge sysclk) reset ##1 e1x.triggered ##1 c; endsequence");
        let render = || {
            with_assertion(&decls, "assert property (e2x);", false, |r, _, _| {
                let (au, _) = r.unwrap();
                format!("{au:?}")
            })
        };
        assert_eq!(render(), render());
    }

    // -- T18: global clocking future functions, LRM 16.9.4 -------------------

    /// A module-level `global clocking` for the `*_gclk` functions to resolve.
    const GCLK: &str = "logic sig; global clocking gc @(posedge sysclk); endclocking\n";

    /// The LRM's `s` of 16.9.4's `a2`: a local variable assigned in a match item.
    const S_WITH_MATCH_ITEM: &str =
        "sequence s; bit v; (a, v = a) ##1 (b == v)[->1]; endsequence\n";

    fn gclk_decls(more: &str) -> String {
        format!("{GCLK}{more}")
    }

    /// Whether the assertion's table says it has future functions, or the
    /// builder's error.
    fn uses_future(decls: &str, stmt: &str) -> Result<bool, String> {
        with_assertion(decls, stmt, false, |r, _, _| {
            r.map(|(_, leaves)| leaves.uses_future_gclk())
                .map_err(|e| e.message)
        })
    }

    /// The five future functions mark the table; the past family and plain
    /// sampled functions do not (they need no delayed action).
    #[test]
    fn t18_future_functions_flag_the_table_and_past_ones_do_not() {
        let decls = gclk_decls("");
        for f in [
            "$future_gclk",
            "$rising_gclk",
            "$falling_gclk",
            "$steady_gclk",
            "$changing_gclk",
        ] {
            let stmt = format!("assert property (@(posedge clk) a ##1 {f}(b));");
            assert_eq!(uses_future(&decls, &stmt), Ok(true), "{f}");
        }
        for f in [
            "$past_gclk",
            "$rose_gclk",
            "$fell_gclk",
            "$stable_gclk",
            "$changed_gclk",
            "$rose",
        ] {
            let stmt = format!("assert property (@(posedge clk) a ##1 {f}(b));");
            assert_eq!(uses_future(&decls, &stmt), Ok(false), "{f}");
        }
        assert_eq!(
            uses_future(&decls, "assert property (@(posedge clk) a ##1 b);"),
            Ok(false)
        );
    }

    /// Where `a2` (16.9.4)'s illegal shapes are stopped: slang's ANALYSIS stage
    /// reports "cannot call '$future_gclk' in an assertion that has sequence
    /// match items" and then drops the assertion from `Analysis::assertions()`
    /// (the shape `sva::clock` documents for the clocking errors), so
    /// [`build_automaton`] is never handed one; when an assertion does reach it
    /// the builder's own check (`gclk::check`) rejects it. Returns the message
    /// of whichever stopped it, and panics if neither did.
    fn a2_rejection(decls: &str, stmt: &str) -> String {
        let src = format!(
            "module m;\nlogic clk, sysclk, a, b, c;\n{decls}\n\
             always_ff @(posedge clk) begin\n{stmt}\nend\nendmodule\n"
        );
        let session = Session::new();
        let mut comp = Compilation::new(&session).unwrap();
        comp.add_source(&src).unwrap();
        let design = comp.compile().unwrap();
        assert!(
            !design.diagnostics().has_errors(),
            "fixture has compile errors:\n{}\n{src}",
            design.diagnostics().rendered()
        );
        let m = design
            .top_instances()
            .next()
            .unwrap()
            .instance_body()
            .unwrap();
        let analysis = design.analyze(AnalysisFlags::NONE, 1).unwrap();
        let proc = analysis.procedures(m).next().unwrap();
        let Some(assertion) = analysis.assertions(proc.symbol()).next() else {
            return analysis.diagnostics().rendered().to_string();
        };
        let tree = design.syntax_trees().into_iter().next().unwrap();
        let root = assertion.root().as_assertion_expr().unwrap();
        let (root, root_clock) = if root.kind() == AssertionExprKind::Clocking {
            let kids = root.children();
            (kids[1].as_assertion_expr().unwrap(), Some(kids[0]))
        } else {
            (root, None)
        };
        match build_automaton(root, root_clock, (&tree).into(), &m) {
            Ok(_) => panic!("`{stmt}` was accepted"),
            Err(e) => e.message,
        }
    }

    /// `a2` (16.9.4): a future function in an assertion whose sequence has
    /// match items is illegal, however the sequence is reached; the other
    /// shapes show the rule is not "any match item" nor "any future function".
    #[test]
    fn t18_a_future_function_with_sequence_match_items_is_rejected_by_name() {
        let decls = gclk_decls(&format!(
            "{S_WITH_MATCH_ITEM}\
             sequence s2; bit v; (a ##1 $rising_gclk(c), v = 1); endsequence\n\
             sequence s3; bit v; first_match(a ##1 b, v = 1); endsequence\n"
        ));
        for stmt in [
            // The LRM's a2, and its sequence form.
            "assert property (@(posedge clk) s |=> $future_gclk(c));",
            "assert property (@(posedge clk) s ##1 $future_gclk(c));",
            // The future function is in the match item's own sequence.
            "assert property (@(posedge clk) s2 ##1 c);",
            // Through `first_match`'s match items.
            "assert property (@(posedge clk) s3 ##1 $steady_gclk(c));",
            // Through a sequence that is itself under another.
            "assert property (@(posedge clk) c ##1 s ##1 $changing_gclk(c));",
        ] {
            let msg = a2_rejection(&decls, stmt);
            assert!(msg.contains("sequence match items"), "{stmt}: {msg}");
        }
        // The same assertions without a future function, and a future function
        // without match items, are legal (the table says which has one).
        assert_eq!(
            uses_future(&decls, "assert property (@(posedge clk) c ##1 s);"),
            Ok(false)
        );
        assert_eq!(
            uses_future(&decls, "assert property (@(posedge clk) s3 ##1 c);"),
            Ok(false)
        );
        assert_eq!(
            uses_future(
                &decls,
                "assert property (@(posedge clk) a ##1 $future_gclk(c));"
            ),
            Ok(true)
        );
    }

    /// `a1` (16.9.4): the future functions shall not be nested. slang reports
    /// it as a compile error; the builder gives its own, so a design that
    /// got past the diagnostic cannot evaluate a future of a future.
    #[test]
    fn t18_nested_future_functions_are_rejected_by_slang_and_the_builder() {
        let decls = gclk_decls("");
        let stmt = "assert property (@(posedge clk) $future_gclk(a || $rising_gclk(b)));";
        let (message, rendered) = with_assertion(&decls, stmt, true, |r, _, d| {
            let Err(e) = r else {
                panic!("nested future functions were accepted")
            };
            (e.message, d.rendered().to_string())
        });
        assert!(rendered.contains("may not be nested"), "{rendered}");
        assert!(message.contains("shall not be nested"), "{message}");
    }

    /// The tick-by-tick sampled values of the LRM's Figure 16-4 reconstruction
    /// that `sv-sim-sim::sva::future`'s own tests derive from Table 16-2
    /// (global ticks at times 0, 10, ..., 110): `sig` and `clk`.
    const SIG: &[u8] = b"110000111000";
    const CLK: &[u8] = b"110011001100";

    /// `$falling_gclk`/`$steady_gclk` of `samples` at global tick `i`.
    fn gclk_fn(f: sv_sim_sim::sva::future::FutureFn, samples: &[u8], i: usize) -> bool {
        sv_sim_sim::sva::future::eval_at(f, samples, i) == Some(b'1')
    }

    /// A 0/1 row over the ticks `0..len`.
    fn row_of(len: usize, f: impl Fn(usize) -> bool) -> String {
        (0..len).map(|i| if f(i) { '1' } else { '0' }).collect()
    }

    /// The end ticks of `body`'s attempt starting at `start` over `rows`.
    fn gclk_ends(decls: &str, body: &str, rows: &[(&str, &str)], start: u32) -> BTreeSet<u32> {
        let tr = Trace::new(rows);
        let stmt = format!("assert property (@(posedge clk) {body});");
        with_assertion(decls, &stmt, false, |r, tree, _| {
            let (au, leaves) = r.unwrap_or_else(|e| panic!("`{body}` failed to build: {e}"));
            let texts = leaf_texts(&leaves, tree);
            run_attempt(&au, &texts, &tr, start).1
        })
    }

    /// Example 4: `##1 $stable_gclk(sig)` (a4) and `$steady_gclk(sig)` (a5) are
    /// equivalent, attempt for attempt; a plain `$stable_gclk(sig)` is not,
    /// at cycle 0, which is why a4 needs its `##1`.
    #[test]
    fn t18_example_4_a4_and_a5_agree_on_every_attempt() {
        use sv_sim_sim::sva::future::FutureFn;
        let decls = gclk_decls("");
        // Every tick that has a successor: 0..=10.
        let n = SIG.len() - 1;
        // `$stable_gclk` is `$stable(sig, @$global_clock)`: equal to the
        // previous tick's sample, the default sampled value x before the first.
        let stable = row_of(n + 1, |i| SIG[i] == if i > 0 { SIG[i - 1] } else { b'x' });
        let steady = row_of(n + 1, |i| gclk_fn(FutureFn::Steady, SIG, i));
        let rows = [
            ("$stable_gclk(sig)", stable.as_str()),
            ("$steady_gclk(sig)", steady.as_str()),
        ];
        let (mut matched, mut failed) = (0, 0);
        for start in 0..n as u32 {
            let a4 = gclk_ends(&decls, "##1 $stable_gclk(sig)", &rows, start);
            let a5 = gclk_ends(&decls, "$steady_gclk(sig)", &rows, start);
            // Same verdict; the `##1` only moves the end point one tick on.
            if a5.is_empty() {
                assert!(a4.is_empty(), "attempt at tick {start}: {a4:?} vs {a5:?}");
                failed += 1;
            } else {
                assert_eq!(a4, set(&[start + 1]), "attempt at tick {start}");
                assert_eq!(a5, set(&[start]), "attempt at tick {start}");
                matched += 1;
            }
        }
        // `sig` holds on some ticks and changes on others, so both verdicts
        // were compared.
        assert!(
            matched > 0 && failed > 0,
            "{matched} matched, {failed} failed"
        );
        // The corner case at cycle 0: `$stable_gclk(sig)` compared with x.
        assert!(gclk_ends(&decls, "$stable_gclk(sig)", &rows, 0).is_empty());
        assert!(!gclk_ends(&decls, "$steady_gclk(sig)", &rows, 0).is_empty());
    }

    /// Example 2: the antecedent of
    /// `$falling_gclk(clk) ##1 (!$falling_gclk(clk)[*1:$]) |-> $steady_gclk(sig)`
    /// matches from each global tick at which `clk` falls, once at every tick
    /// up to the next fall; the consequent is then violated only where `sig`
    /// is about to change inside such a window (time 80).
    #[test]
    fn t18_example_2_between_two_falling_edges_sig_may_change_only_at_a_fall() {
        use sv_sim_sim::sva::future::FutureFn;
        let decls = gclk_decls("");
        let n = CLK.len() - 1;
        let falling = |i: usize| gclk_fn(FutureFn::Falling, CLK, i);
        let fall = row_of(n, falling);
        let not_fall = row_of(n, |i| !falling(i));
        let rows = [
            ("$falling_gclk(clk)", fall.as_str()),
            ("!$falling_gclk(clk)", not_fall.as_str()),
        ];
        let body = "$falling_gclk(clk) ##1 (!$falling_gclk(clk))[*1:$]";
        let ends: Vec<BTreeSet<u32>> = (0..n as u32)
            .map(|s| gclk_ends(&decls, body, &rows, s))
            .collect();
        // clk falls between the ticks at times 10-20, 50-60 and 90-100.
        assert_eq!(ends[1], set(&[2, 3, 4]));
        assert_eq!(ends[5], set(&[6, 7, 8]));
        assert_eq!(ends[9], set(&[10]));
        for (s, e) in ends.iter().enumerate() {
            if ![1, 5, 9].contains(&s) {
                assert!(e.is_empty(), "no attempt at tick {s} may match");
            }
        }
        let violations: Vec<u32> = ends
            .iter()
            .flatten()
            .copied()
            .filter(|&e| !gclk_fn(FutureFn::Steady, SIG, e as usize))
            .collect();
        assert_eq!(violations, [8], "tick 8 is time 80");
    }
}