vj-codegen 0.2.0

//! Task S3c (`docs/superpowers/plans/2026-09-26-wave-A2-slice.md`): codegen's
//! switch-dispatched process kernel, lowered from `vj-sim::process`'s
//! Segment IR (Task S3a) + `FrameLayout` (Task S3b). Ledger PR-009, PR-010,
//! PR-011, PR-038, PR-039, PR-040, PR-105, CG-085, CG-086, CG-090, CG-091,
//! CG-095, CG-096, CG-097, XC-056. See `docs/design/process.md` §§1-6 and
//! ARCHITECTURE.md §5/§6.1/§6.4.
//!
//! **Dependency edge (Task S1's own reconciliation note, `module.rs`'s doc
//! comment on `KindCountDrift`):** this is the file that finally adds
//! `vj-codegen -> vj-sim` (`Cargo.toml`) -- codegen consumes the
//! A2-process track's `process::cfg::{Segment,SegTerminator,SuspendPoint}` /
//! `process::liveness::FrameLayout` shapes directly rather than re-deriving
//! them, the same "consume, don't re-derive" discipline Task S5's own plan
//! text applies to `netlist::registration_order()`.
//!
//! **`lower_process_cfg`'s own ABI (deliberately not yet the frozen
//! `vj_abi::ProcessFn` shape -- that reconciliation is Task S4's own
//! `lower_kernel_fn`, which wraps this function's output):** every emitted
//! function has LLVM signature `(handle: ptr, local: ptr, resume_pc: i32) ->
//! i32`. `handle` is the opaque `SimHandle` the four accessor calls thread
//! through (never GEP'd directly, CG-093); `local` is the private,
//! per-process frame pointer (`ActivationRecord::frame`'s backing storage --
//! the ONLY pointer this file ever GEPs directly, per CG-093's own
//! exception); `resume_pc` selects which `Segment` to resume into (`0` is
//! always the fresh/never-run entry point, PR-012 -- `build_cfg`'s `entry`
//! block is always allocated first, so `SegId(0)` is always the entry
//! segment for every fixture this crate's frontend can construct). The
//! return value is either a non-negative `SegId` to resume at on the next
//! call (a `Suspend` was hit) or the reserved sentinel [`SEG_FINISHED`] (the
//! process ran to completion, `SegTerminator::End{loop_back: None}`) --
//! Task S4's `lower_kernel_fn` decodes this into the frozen `EvalResult`/
//! `RescheduleReq` ABI; this file does not itself encode a `SuspendPoint`'s
//! payload (the delay amount / edge signal) anywhere, since the scheduler
//! only needs that at the Task S4 wrapping layer, never inside the switch
//! dispatch itself.
//!
//! **PR-038/PR-039's prologue/epilogue discipline:** every declared-local
//! frame slot is loaded from `local` into a per-call LLVM `alloca` EXACTLY
//! ONCE, at the function's true entry (before the `resume_pc` switch even
//! exists) -- since `process::cfg::lower_to_segments`'s own doc comment
//! establishes every `FrameLayout` slot is a *permanent* slot, present in
//! **every** segment's `live_in`/`live_out` unconditionally, loading them
//! once up front is exactly "load segment.live_in" for whichever segment
//! `resume_pc` happens to select (the sets are identical across segments in
//! this slice). Ordinary intra-call control flow (`SegTerminator::Goto`/
//! `CondGoto`, and `End{loop_back: Some(_)}`) never re-touches `local` at
//! all -- those edges stay inside ONE function call, so the same allocas
//! keep flowing normally through LLVM's own def-use graph, exactly like
//! `func.rs`'s own if/else lowering already does for a plain function's
//! locals. Only a `SegTerminator::Suspend` (control genuinely returning to
//! the caller, to come back on a LATER, separate call) writes the current
//! alloca contents back to `local` -- `SegTerminator`'s own shape enforces
//! this: only the `Suspend` variant carries a `live_out` field at all.
//!
//! **External (module-level) signal access (CG-093-compliant, deliberately
//! NOT threaded through `expr.rs`'s `locals` map as a raw arena pointer):**
//! `expr.rs::lower_expr`'s `NamedValue`/`Assignment` arms only ever resolve a
//! symbol through `LowerCtx::locals` (a `PointerValue`-backed map) -- reusing
//! them unchanged (this file's Files: list never touches `expr.rs`) for an
//! EXTERNAL signal means giving it a `locals` entry too, but that pointer can
//! never be a raw GEP into the shared arena (CG-093 permits GEP-ing only the
//! private `local` frame pointer). This file instead primes a fresh `alloca`
//! per external signal referenced in a given segment (or, in the
//! segment_count==1 fast path, the one segment), populated via
//! `accessor::build_get_scalar` right when that segment starts executing,
//! and flushes any symbol that was the LHS of an assignment anywhere in that
//! segment back out via `accessor::build_set_scalar` once, after all of the
//! segment's ordinary statements have lowered (deferred-to-segment-end
//! rather than immediate-per-statement, since nothing else can observe an
//! intermediate value between two statements of the SAME segment -- there is
//! no scheduling point until the segment's own terminator runs).
use crate::types::TypeWidth;
use std::collections::{HashMap, HashSet};
use std::num::NonZeroU32;
use vj_sim::symid::SymbolUid;

use inkwell::AddressSpace;
use inkwell::attributes::{Attribute, AttributeLoc};
use inkwell::basic_block::BasicBlock as LlvmBasicBlock;
use inkwell::builder::Builder;
use inkwell::context::Context;
use inkwell::module::{Linkage, Module};
use inkwell::types::{AnyType, IntType};
use inkwell::values::{FunctionValue, GlobalValue, IntValue, PointerValue, StructValue};

use sv_lang::kinds::{ExpressionKind, StatementKind};
use sv_lang::{
    Expression, KnownSystemName, SemNode, Statement, StatementBlockKind, Symbol, UnaryOp,
};
use vj_sim::symid::SymbolId;

use vj_sim::analysis::DpiVpiTag;
use vj_sim::process::Effect;
use vj_sim::process::cfg::{
    RepeatCounterId, SegTerminator, Segment, SuspendPoint, SwitchOn, lower_to_segments,
};
use vj_sim::process::liveness::{FrameLayout, FrameSlotSource, compute_liveness};
use vj_sim::sched::{
    JoinKind, ResolvedSuspend, SpawnSpec, WaitTableEntry, build_eval_result, mark_rechecks_on_wake,
};
use vj_sim::state::{EdgeKind as StateEdgeKind, StateCellId};

use crate::ops::OpBuilder;

use crate::accessor::{
    AccessorFns, build_get_scalar, build_get_wide, build_set_scalar, build_set_wide,
    reposition_width_tight_to_fixed,
};
use crate::error::LoweringError;
use crate::expr::{
    LowerCtx, MemAccessorCtx, MemorySignalInfo, lower_condition, lower_expr,
    lower_negated_condition,
};
use crate::stmt_shared::{
    lower_case, lower_do_while_loop, lower_for_loop, lower_foreach_loop, lower_forever_loop,
    lower_loop_jump, lower_repeat_loop, lower_while_loop,
};
use crate::value::{PackedValue, ValueRepr};

/// The reserved `resume_pc`-space return value meaning "this process ran to
/// completion" (`SegTerminator::End{loop_back: None}`) -- never a legal
/// `SegId` (those are always `>= 0` and, by construction, `< segments.len()`
/// as a plain array index).
pub const SEG_FINISHED: i32 = -1;

/// The accessor-ABI tier of a [`SignalSlot`] (R-run Task 13) and the slot
/// itself. Both are plain data shared with the slang-free VPI runtime, so
/// they live in `vj-exec` (`timing::place::{LocClass, SlotRef}`); the
/// codegen-side names are kept as aliases.
pub use vj_exec::timing::place::{LocClass as SignalSlotClass, SlotRef as SignalSlot};

/// R-run Task 13: derives `LowerCtx::mem_signals` from a `signals` map --
/// every `SignalSlotClass::Memory` entry, narrowed to `expr.rs`'s own
/// [`MemorySignalInfo`] shape. Every one of this file's `LowerCtx`
/// construction sites calls this once (never re-filters `signals` by hand at
/// each site), so the "which entries are memories" predicate lives in
/// exactly one place.
pub(crate) fn mem_signals_of(
    signals: &HashMap<SymbolId, SignalSlot>,
) -> HashMap<SymbolId, MemorySignalInfo> {
    signals
        .iter()
        .filter_map(|(id, slot)| match slot.class {
            SignalSlotClass::Memory {
                num_rows,
                lower_index,
            } => Some((
                id.clone(),
                MemorySignalInfo {
                    slot: slot.slot,
                    elem_width: slot.width,
                    signed: slot.signed,
                    num_rows,
                    lower_index,
                },
            )),
            SignalSlotClass::Inline | SignalSlotClass::Wide => None,
        })
        .collect()
}

/// The keys one disable scope `(resume, label, exit)` of a process of an
/// instance is registered under (LRM 9.6.2 `disable u1.blk;` from another
/// instance): the plain label, the absolute path `/<path>.<label>`, the
/// requester-relative `<ancestor id>/<rest>.<label>` of every ancestor
/// instance and, for a dotted label (`disable p.b.x;`), `<own id>/<label>`.
/// Shared by a process's own scopes and those of its fork branches.
pub struct DisableScopeKeys {
    /// This instance's id.
    pub instance: u32,
    /// This instance's hierarchical path.
    pub own_path: String,
    /// `(ancestor instance id, path from it down to this instance)`.
    pub ancestors: Vec<(u32, String)>,
    /// The `disable <path>;` keys (`<requester id>/<path>`) each `extern`
    /// method scope tag answers to (LRM 25.7.4,
    /// `vj_sim::netlist::itf::extern_scope_tags`).
    pub ext_aliases: std::sync::Arc<HashMap<String, Vec<String>>>,
}

impl DisableScopeKeys {
    /// Every `(resume, key, exit)` row one scope expands to.
    pub fn expand(&self, resume: u32, label: &str, exit: u32) -> Vec<(u32, String, u32)> {
        if vj_sim::netlist::itf::is_scope_tag(label) {
            // A synthetic extern-method scope: only the requesters' keys.
            return self
                .ext_aliases
                .get(label)
                .into_iter()
                .flatten()
                .map(|k| (resume, k.clone(), exit))
                .collect();
        }
        let mut out = vec![
            (resume, label.to_string(), exit),
            (resume, format!("/{}.{label}", self.own_path), exit),
        ];
        if label.contains('.') {
            out.push((resume, format!("{}/{label}", self.instance), exit));
        }
        out.extend(
            self.ancestors
                .iter()
                .map(|(aid, rest)| (resume, format!("{aid}/{rest}.{label}"), exit)),
        );
        out
    }
}

/// Everything [`lower_process_cfg`] needs to emit one process kernel
/// function: the already-built Segment IR + FrameLayout (Task S3a/S3b's
/// output), a symbol table for whichever module-level signals the process
/// body references, and the enclosing symbol (cited in every
/// [`LoweringError`]). Built by [`build_lowering_plan`], not constructed by
/// hand at call sites (its `frame_signed` field is *derived*, not supplied).
pub struct ProcessLoweringPlan<'d> {
    pub fn_name: String,
    pub fn_sym: Symbol<'d>,
    pub segments: Vec<Segment<'d>>,
    pub frame: FrameLayout,
    /// Signedness of each `frame.slots[i]`, parallel to it by index.
    /// `FrameSlotDesc` itself carries no signedness (out of A2-process's own
    /// contract -- `vj-sim::process::liveness`'s `FrameSlotDesc` doc
    /// comment freezes its field list at `{offset, width_bits, repr,
    /// source}`), so codegen derives it once here rather than asking that
    /// track to grow a field it does not otherwise need.
    pub frame_signed: Vec<bool>,
    /// The `Symbol` of every `FrameSlotSource::DeclaredVar` slot the body
    /// references (found by the same scan as `frame_signed`), for
    /// [`emit_local_inits`]: a declared local's initializer / default value.
    pub local_syms: HashMap<SymbolId, Symbol<'d>>,
    pub signals: HashMap<SymbolId, SignalSlot>,
    /// Task 10 (A2-part2, PR-122): this process's own WOCB partition/
    /// `RegionId`, distinct from `sched::control`'s four scheduling Regions
    /// (Active/Inactive/Nba/Postponed) that Segment effect-region tagging
    /// already carries (PR-067) -- see [`vj_sim::process::
    /// arena_base_offset_for_region`]'s own doc comment for the per-partition
    /// arena-base bias this field drives. Defaults to `0` in
    /// [`build_lowering_plan`] -- v1's single-partition conservative engine
    /// makes `region_id == 0` a real (if degenerate) value for every real
    /// process, exactly the same "not a stub" posture `ProcessSideTable::
    /// region_id`'s own doc comment (Task 9) already established. Set
    /// directly (this field is `pub`, like every other field here) by a
    /// caller that has a real WOCB partition result to thread through, or by
    /// a test hand-setting a synthetic value (no live WOCB analysis pass
    /// exists yet in this wave, per this file's own module doc comment).
    pub region_id: u32,
    /// Review fix (Task 9, CG-101 r2): the `netlist::InstanceId` of the
    /// elaborated instance that OWNS this process. Two processes belonging
    /// to the SAME instance (e.g. counter.sv's `initial` + `always_ff`, both
    /// members of its one instance) must carry the SAME value here --
    /// `pipeline::side_tables_for_plans`/`compile_design_kernels` group
    /// plans by exactly this field to derive [`ProcessSideTable::
    /// canonical_process_id`] via the real `process::dedup::assign_process_
    /// instance_ids` (never a raw per-plan-index stand-in -- see those
    /// functions' own doc comments for why that was CG-101's own bug).
    /// Defaults to `InstanceId(0)` in [`build_lowering_plan`] -- a
    /// legitimate, if degenerate, value for a single-instance fixture/test
    /// where every process already shares it, and set directly (this field
    /// is `pub`, like `region_id`) by a caller that discovered its process's
    /// real owning instance -- `vj::run::run_design`, the only
    /// production caller with real sub-hierarchy, does exactly this inside
    /// its own `for &id in &registration_order` loop.
    pub owning_instance: vj_sim::netlist::InstanceId,
    /// Task 4b (`docs/superpowers/plans/2026-10-03-sdf.md`): the specify-
    /// path VARIABLE destinations this process's OWN owning instance
    /// writes procedurally (never just the ones THIS process itself
    /// references -- see `vj::run::run_design`'s own doc comment at
    /// its `specify_dest_redirect` construction site for why handing the
    /// whole instance's table to every one of its processes is safe), each
    /// mapped to its own staging cell's foreign [`SignalSlot`] in the
    /// driver bank. Consulted ONLY at a write's own lvalue resolution
    /// (`crate::select::resolve_lvalue`'s `RootMode::Signal` branch,
    /// `lower_nonblocking_assignment`'s fast-path exclusion) -- never a
    /// read, never a blocking write (`vj::specify::plan`'s own
    /// variable-destination branch rejects one as a named, not-yet-
    /// implemented gap before ever minting an entry here). Defaults to
    /// empty in [`build_lowering_plan`] (every design with no specify-path
    /// variable destination at all, i.e. every pre-Task-4b design and
    /// every pre-Task-4b test fixture, is completely unaffected), set
    /// directly (this field is `pub`, like `owning_instance`) by
    /// `vj::run::run_design`, the only production caller with a
    /// real table to thread through.
    pub specify_dest_redirect: HashMap<SymbolId, SignalSlot>,
    /// T30 (16.14.6): the assertion statement this plan's process hosts -- a
    /// static assertion's or a procedural one's -- when this is the plan the
    /// assertion engine resumes to run the pass/fail statement. Set by
    /// `vj::run::run_design`; `None` (a plan nothing resumes for an
    /// assertion) makes lowering an assertion statement here a loud error.
    pub hosted_assertion: Option<crate::sva::proc::HostedAssertion<'d>>,
    /// 17.4: what `$inferred_disable` stands for in a static checker's procedure
    /// (see `crate::sva::emit::procedure_inferred_disable`): the `default disable
    /// iff` signal of the scope instantiating the checker and whether it is
    /// negated, the inner `None` being `1'b0`. The outer `None`: not a checker
    /// procedure that reads it. Set by `vj::run::run_design`.
    pub inferred_disable: Option<Option<(SymbolId, bool)>>,
    /// T30: for a process containing procedural concurrent assertions, the plan
    /// index of the plan hosting each (key: [`crate::sva::proc::assertion_key`]).
    pub nested_assertions: HashMap<String, usize>,
    /// 16.14.6.4: what `disable <name>;` clears -- the plan indices of the
    /// procedural assertions whose pending instances it removes -- for each
    /// name the process may disable: the labels of its own assertions, its own
    /// outermost block (all of its assertions) and the outermost blocks of the
    /// instance's other processes. A name with no assertions maps to an empty
    /// list (the disable has nothing to clear); a name absent here is a
    /// disable of a fork block (`sv_rt_disable_fork_block`).
    pub disable_keys: HashMap<String, Vec<usize>>,
    /// [`vj_sim::process::cfg::ProcessCfg::fork_branch_names`], copied
    /// verbatim: every fork-branch name this plan's own CFG walk resolved a
    /// `disable <label>;` against without a same-process lexical match. A
    /// kept `StatementKind::Disable` whose label is in here lowers to the
    /// generic cross-process runtime call (`sv_rt_disable_named`); one
    /// whose label is NOT in here (and is not an assertion key) is the
    /// OLDER, same-fork-only `sv_rt_disable_fork_block` case. Empty for
    /// every plan built before this field existed (every existing call
    /// site of [`build_lowering_plan`] is unaffected -- the same "real
    /// caller overrides directly" posture `disable_keys`'s own doc comment
    /// already established for a `pub` field defaulted here).
    pub fork_branch_names: Vec<String>,
    /// [`vj_sim::process::cfg::ProcessCfg::disable_broadcast`], copied
    /// verbatim: a kept `disable <label>;` whose label is in here also calls
    /// `sv_rt_disable_named`, which ends the activations of the block or task
    /// `label` in the instance's other processes (LRM 9.6.2). The flag is
    /// whether the statement is the whole disable (no jump follows), so
    /// codegen emits its VPI `cbDisable` probe.
    pub disable_broadcast: Vec<(String, bool)>,
    /// Write every frame slot back to `local` when the kernel ends, not only
    /// at a suspend: an exported task's `output`/`inout` formals are read
    /// from its frame after it finished (LRM 35.7).
    pub write_back_at_end: bool,
    /// Instance-path key expansion of this process's disable scopes (and those
    /// of its fork branches); `None` outside a design run.
    pub disable_scope_keys: Option<std::sync::Arc<DisableScopeKeys>>,
    /// SV-C T14 (16.11): the subroutine calls attached as match items to the
    /// assertion this plan hosts, indexed by `CallId`. Filled by
    /// `sva::emit::emit_assertions` (which therefore runs before the kernels are
    /// lowered); empty for every other plan.
    pub assertion_calls: std::cell::RefCell<Vec<crate::sva::actions::CallSite<'d>>>,
}

/// Builds a [`ProcessLoweringPlan`], deriving `frame_signed` from a scan of
/// `segments` (every `NamedValue` reference to a `FrameSlotSource::
/// DeclaredVar` symbol anywhere in a segment's body or terminator condition
/// carries the real `sv_lang::Symbol`, from which `value_type().is_signed()`
/// is read once). A frame slot whose symbol never appears in any `NamedValue`
/// at all (a declared-but-truly-never-referenced local -- legal per PR-017's
/// "permanent slot even when dead", though every fixture this crate's own
/// tests construct DOES reference its declared locals at least once, e.g. as
/// an assignment's own LHS) defaults to unsigned: harmless, since no
/// signed-sensitive operation can ever run on a symbol nothing in the
/// process body reads or writes.
/// Records `sym`'s signedness and handle, first sighting wins.
fn note_symbol<'d>(
    sign_by_id: &mut HashMap<SymbolId, bool>,
    sym_by_id: &mut HashMap<SymbolId, Symbol<'d>>,
    sym: Symbol<'d>,
) {
    sign_by_id
        .entry(sym.uid())
        .or_insert_with(|| sym.value_type().is_some_and(|t| t.is_signed()));
    sym_by_id.entry(sym.uid()).or_insert(sym);
}

pub fn build_lowering_plan<'d>(
    fn_name: String,
    fn_sym: Symbol<'d>,
    segments: Vec<Segment<'d>>,
    frame: FrameLayout,
    signals: HashMap<SymbolId, SignalSlot>,
) -> ProcessLoweringPlan<'d> {
    let mut sign_by_id: HashMap<SymbolId, bool> = HashMap::new();
    let mut sym_by_id: HashMap<SymbolId, Symbol<'d>> = HashMap::new();
    for seg in &segments {
        for b in &seg.bindings {
            let mut found = Vec::new();
            match b {
                vj_sim::process::cfg::ArgBinding::In { formal, actual } => {
                    found.push(*formal);
                    collect_named_value_symbols(actual.as_sem_node(), &mut found);
                }
                vj_sim::process::cfg::ArgBinding::Init { var }
                | vj_sim::process::cfg::ArgBinding::Const { var, .. }
                | vj_sim::process::cfg::ArgBinding::ThisOf { var }
                | vj_sim::process::cfg::ArgBinding::Release { var }
                | vj_sim::process::cfg::ArgBinding::Step { var, .. } => found.push(*var),
                vj_sim::process::cfg::ArgBinding::Out { actual, formal }
                | vj_sim::process::cfg::ArgBinding::RefOpen { actual, formal, .. }
                | vj_sim::process::cfg::ArgBinding::RefClose { actual, formal, .. } => {
                    found.push(*formal);
                    collect_named_value_symbols(actual.as_sem_node(), &mut found);
                }
                vj_sim::process::cfg::ArgBinding::Capture { value: e, .. }
                | vj_sim::process::cfg::ArgBinding::AssignCaptured { target: e, .. } => {
                    collect_named_value_symbols(e.as_sem_node(), &mut found);
                }
                vj_sim::process::cfg::ArgBinding::FromCaptured { formal, .. }
                | vj_sim::process::cfg::ArgBinding::ToCaptured { formal, .. } => {
                    found.push(*formal);
                }
                vj_sim::process::cfg::ArgBinding::CaptureThis { .. }
                | vj_sim::process::cfg::ArgBinding::CallResult { .. }
                | vj_sim::process::cfg::ArgBinding::ClassEventLeave => {}
                vj_sim::process::cfg::ArgBinding::AssocKey { var, arr, .. } => {
                    found.push(*var);
                    collect_named_value_symbols(arr.as_sem_node(), &mut found);
                }
            }
            for sym in found {
                note_symbol(&mut sign_by_id, &mut sym_by_id, sym);
            }
        }
        for stmt in &seg.body {
            let mut found = Vec::new();
            collect_named_value_symbols(stmt.as_sem_node(), &mut found);
            for sym in found {
                note_symbol(&mut sign_by_id, &mut sym_by_id, sym);
            }
        }
        // R-run Task 8: a `repeat` loop's own count expression can name a
        // real, signed `DeclaredVar`/external signal too -- same
        // completeness reason `external_refs_in_segment` records it.
        if let Some((_, count)) = &seg.repeat_init
            && let Some(count_expr) = count.expr()
        {
            let mut found = Vec::new();
            collect_named_value_symbols(count_expr.as_sem_node(), &mut found);
            for sym in found {
                note_symbol(&mut sign_by_id, &mut sym_by_id, sym);
            }
        }
        let mut term_found = Vec::new();
        match &seg.terminator {
            SegTerminator::SwitchGoto { on, .. } => {
                for e in on.reads() {
                    collect_named_value_symbols(e.as_sem_node(), &mut term_found);
                }
            }
            SegTerminator::CondGoto { cond, .. } => {
                collect_named_value_symbols(cond.as_sem_node(), &mut term_found);
            }
            SegTerminator::AssertGoto { stmt, .. } => {
                if let Some(e) = vj_sim::process::cfg::assertion_cond(stmt) {
                    collect_named_value_symbols(e.as_sem_node(), &mut term_found);
                }
            }
            SegTerminator::CaseGoto { stmt, .. } => {
                for e in vj_sim::process::liveness::case_reads(stmt) {
                    collect_named_value_symbols(e.as_sem_node(), &mut term_found);
                }
            }
            SegTerminator::Suspend {
                point: SuspendPoint::Delay(e, _) | SuspendPoint::Level(e),
                ..
            } => {
                collect_named_value_symbols(e.as_sem_node(), &mut term_found);
            }
            // Task 1 (`process::cfg`): `EdgeList`'s member signals are real
            // named-value expressions too -- collected for the same
            // "every symbol that appears anywhere gets a signedness entry"
            // completeness reason as `Delay`/`Level`.
            SegTerminator::Suspend {
                point: SuspendPoint::EdgeList(entries, iffs),
                ..
            } => {
                for (e, _) in entries {
                    collect_named_value_symbols(e.as_sem_node(), &mut term_found);
                }
                // The `iff` guards are evaluated at the wake (LRM 9.4.2.3).
                for g in iffs.iter().flatten() {
                    collect_named_value_symbols(g.as_sem_node(), &mut term_found);
                }
            }
            SegTerminator::Suspend {
                point: SuspendPoint::Edge { signal, iff: Some(g), .. },
                ..
            } => {
                collect_named_value_symbols(g.as_sem_node(), &mut term_found);
                if !vj_sim::symid::is_value_name(signal.kind()) {
                    collect_named_value_symbols(signal.as_sem_node(), &mut term_found);
                }
            }
            // Task 6 (`process::cfg`): `ImplicitComb`'s captured read-set is
            // real named-value expressions too -- same completeness reason
            // as `EdgeList`'s members above.
            SegTerminator::Suspend {
                point: SuspendPoint::ImplicitComb(reads),
                ..
            } => {
                for e in reads {
                    collect_named_value_symbols(e.as_sem_node(), &mut term_found);
                }
            }
            // An event-array element's index, or an event expression, is
            // evaluated at the suspend.
            SegTerminator::Suspend {
                point: SuspendPoint::Edge { signal, .. },
                ..
            } if !vj_sim::symid::is_value_name(signal.kind()) => {
                collect_named_value_symbols(signal.as_sem_node(), &mut term_found);
            }
            SegTerminator::Suspend {
                point:
                    SuspendPoint::Edge { .. }
                    | SuspendPoint::CycleDelay { .. }
                    | SuspendPoint::OneStep
                    | SuspendPoint::WaitFork
                    | SuspendPoint::ByRequest,
                ..
            }
            | SegTerminator::Goto(_)
            // R-run Task 8: `CondGotoCounter`'s own counter is compiler-
            // synthesized (no `sv_lang::Symbol` at all) -- nothing here for
            // a sign-inference walk to collect.
            | SegTerminator::CondGotoCounter { .. }
            // R-run Task 17: a fork/join site's OWN branches are each
            // compiled as their own, separate `ProcessLoweringPlan` (see
            // `lower_kernel_fn_with_repr`'s own new fork-support arm) --
            // each gets its own, independent `build_lowering_plan` call, so
            // nothing in a branch's body needs collecting into THIS plan's
            // `sign_by_id` map.
            | SegTerminator::ForkJoin { .. }
            | SegTerminator::End { .. } => {}
        }
        for sym in term_found {
            note_symbol(&mut sign_by_id, &mut sym_by_id, sym);
        }
        // A `for` loop's initializer/step expressions name its loop
        // variables (and may be the only place they appear).
        for step in &seg.step_exprs {
            let mut found = Vec::new();
            collect_named_value_symbols(step.as_sem_node(), &mut found);
            for sym in found {
                note_symbol(&mut sign_by_id, &mut sym_by_id, sym);
            }
        }
    }

    let frame_signed = frame
        .slots
        .iter()
        .map(|slot| match &slot.source {
            FrameSlotSource::DeclaredVar(id) => sign_by_id.get(id).copied().unwrap_or(false),
            FrameSlotSource::Temporary(_) => false,
            // R-run Task 8: a `repeat` loop's own synthetic counter is
            // always clamped non-negative before it is ever stored (see
            // `lower_repeat_init`'s own doc comment) and only ever compared/
            // decremented as unsigned -- `signed` is meaningless for it,
            // `false` is the same harmless default `Temporary` uses.
            FrameSlotSource::SyntheticCounter(_) => false,
        })
        .collect();
    let local_syms = frame
        .slots
        .iter()
        .filter_map(|slot| match &slot.source {
            FrameSlotSource::DeclaredVar(id) => sym_by_id.get(id).map(|s| (id.clone(), *s)),
            FrameSlotSource::Temporary(_) | FrameSlotSource::SyntheticCounter(_) => None,
        })
        .collect();

    ProcessLoweringPlan {
        fn_name,
        fn_sym,
        segments,
        frame,
        frame_signed,
        local_syms,
        signals,
        // Task 10 (PR-122): v1's real, degenerate single-partition default
        // -- see the field's own doc comment. Every existing call site of
        // this function (across the whole tree) is unaffected: none of them
        // mentions `region_id`, and they all get this same real v1 value.
        region_id: 0,
        // Review fix (Task 9, CG-101 r2): same "real, degenerate default;
        // real caller overrides directly" posture as `region_id` immediately
        // above -- see `ProcessLoweringPlan::owning_instance`'s own doc
        // comment.
        owning_instance: vj_sim::netlist::InstanceId(0),
        // Task 4b: empty by default -- every existing call site (across the
        // whole tree) is unaffected, same "real caller overrides directly"
        // posture `owning_instance` already established.
        specify_dest_redirect: HashMap::new(),
        hosted_assertion: None,
        inferred_disable: None,
        nested_assertions: HashMap::new(),
        disable_keys: HashMap::new(),
        fork_branch_names: Vec::new(),
        disable_broadcast: Vec::new(),
        write_back_at_end: false,
        disable_scope_keys: None,
        assertion_calls: std::cell::RefCell::new(Vec::new()),
    }
}

/// Finds the first `NamedValue` expression anywhere in `segments` (bodies
/// and terminator conditions/delay expressions) whose name is exactly
/// `name`, returning its `referenced_symbol()`. A small, real convenience
/// (not test-only scaffolding): any real caller resolving `plan.signals`
/// from a symbol TABLE keyed by name (rather than already holding the
/// `Symbol` handle from its own earlier walk) needs exactly this.
pub fn find_named_value_symbol<'d>(segments: &[Segment<'d>], name: &str) -> Option<Symbol<'d>> {
    for seg in segments {
        for stmt in &seg.body {
            let mut found = Vec::new();
            collect_named_value_symbols(stmt.as_sem_node(), &mut found);
            if let Some(sym) = found.into_iter().find(|s| s.name() == name) {
                return Some(sym);
            }
        }
        if let Some((_, count)) = &seg.repeat_init
            && let Some(count_expr) = count.expr()
        {
            let mut found = Vec::new();
            collect_named_value_symbols(count_expr.as_sem_node(), &mut found);
            if let Some(sym) = found.into_iter().find(|s| s.name() == name) {
                return Some(sym);
            }
        }
        let mut term_found = Vec::new();
        match &seg.terminator {
            SegTerminator::SwitchGoto { on, .. } => {
                for e in on.reads() {
                    collect_named_value_symbols(e.as_sem_node(), &mut term_found);
                }
            }
            SegTerminator::CondGoto { cond, .. } => {
                collect_named_value_symbols(cond.as_sem_node(), &mut term_found)
            }
            SegTerminator::AssertGoto { stmt, .. } => {
                if let Some(e) = vj_sim::process::cfg::assertion_cond(stmt) {
                    collect_named_value_symbols(e.as_sem_node(), &mut term_found);
                }
            }
            SegTerminator::CaseGoto { stmt, .. } => {
                for e in vj_sim::process::liveness::case_reads(stmt) {
                    collect_named_value_symbols(e.as_sem_node(), &mut term_found);
                }
            }
            SegTerminator::Suspend {
                point: SuspendPoint::Delay(e, _) | SuspendPoint::Level(e),
                ..
            } => collect_named_value_symbols(e.as_sem_node(), &mut term_found),
            SegTerminator::Suspend {
                point: SuspendPoint::EdgeList(entries, iffs),
                ..
            } => {
                for (e, _) in entries {
                    collect_named_value_symbols(e.as_sem_node(), &mut term_found);
                }
                // The `iff` guards are evaluated at the wake (LRM 9.4.2.3).
                for g in iffs.iter().flatten() {
                    collect_named_value_symbols(g.as_sem_node(), &mut term_found);
                }
            }
            SegTerminator::Suspend {
                point: SuspendPoint::Edge { signal, iff: Some(g), .. },
                ..
            } => {
                collect_named_value_symbols(g.as_sem_node(), &mut term_found);
                if !vj_sim::symid::is_value_name(signal.kind()) {
                    collect_named_value_symbols(signal.as_sem_node(), &mut term_found);
                }
            }
            SegTerminator::Suspend {
                point: SuspendPoint::ImplicitComb(reads),
                ..
            } => {
                for e in reads {
                    collect_named_value_symbols(e.as_sem_node(), &mut term_found);
                }
            }
            SegTerminator::Suspend {
                point: SuspendPoint::Edge { signal, .. },
                ..
            } if !vj_sim::symid::is_value_name(signal.kind()) => {
                collect_named_value_symbols(signal.as_sem_node(), &mut term_found);
            }
            SegTerminator::Suspend {
                point:
                    SuspendPoint::Edge { .. }
                    | SuspendPoint::CycleDelay { .. }
                    | SuspendPoint::OneStep
                    | SuspendPoint::WaitFork
                    | SuspendPoint::ByRequest,
                ..
            }
            | SegTerminator::Goto(_)
            | SegTerminator::CondGotoCounter { .. }
            // R-run Task 17: same reasoning as `build_lowering_plan`'s own
            // identical new arm above -- a fork/join site's branches are
            // each their own, separately-searched `Vec<Segment>` (a real
            // caller of this convenience function walks a branch's own
            // `find_named_value_symbol` call itself, if it ever needs to).
            | SegTerminator::ForkJoin { .. }
            | SegTerminator::End { .. } => {}
        }
        if let Some(sym) = term_found.into_iter().find(|s| s.name() == name) {
            return Some(sym);
        }
    }
    None
}

/// CG-094/PR-016's spill-set-eligibility tag (see this file's module doc
/// comment / the plan's own "Public names/types introduced" list): every
/// `ExpressionStatement` whose top expression is an `Assignment` is a
/// `StateWrite`; everything else this task's slice-scope grammar accepts
/// (`Empty`, `VariableDeclaration`) is `Pure`. `$display`/`$finish`'s
/// `Irrevocable` tag is Task S6's own routing (no system-call statement
/// lowering exists yet in this file).
pub fn effect_of_statement(stmt: &Statement<'_>) -> Effect {
    if stmt.kind() == StatementKind::ExpressionStatement
        && let Some(e) = stmt.expr()
        && e.kind() == ExpressionKind::Assignment
    {
        Effect::StateWrite
    } else {
        Effect::Pure
    }
}

/// Generic depth-first walk (mirrors `process::cfg::contains_suspend_
/// trigger`'s / `process::liveness::collect_named_values`'s shape) collecting
/// every `NamedValue` expression's `referenced_symbol()` anywhere in `node`'s
/// subtree, in encounter order, without deduplication (callers dedup as
/// needed).
pub(crate) fn collect_named_value_symbols<'d>(node: SemNode<'d>, out: &mut Vec<Symbol<'d>>) {
    let mut stack = vec![node];
    while let Some(n) = stack.pop() {
        if let Some(e) = n.as_expression()
            && vj_sim::symid::is_value_name(e.kind())
            && let Some(sym) = e.referenced_symbol()
        {
            // A modport port with an expression (`.x(r[3:0])`, LRM 25.5.4)
            // names the interface signals that expression does.
            if sym.kind() == sv_lang::kinds::SymbolKind::ModportPort
                && let Some(x) = sym.modport_port_explicit_connection()
            {
                stack.push(x.as_sem_node());
            }
            out.push(sym);
        }
        stack.extend(n.children());
    }
}

/// The external-signal reference set for one segment's lowering: every
/// `plan.signals`-resolvable `NamedValue` referenced anywhere in `seg.body`
/// or its terminator's condition/delay expression (first-appearance order,
/// deduplicated -- these get a priming `alloca` before any statement lowers)
/// and the subset that is ever the LHS of a top-level `Assignment`, OR the
/// plain-`NamedValue` operand of a `++`/`--` (R-run Task 8 fix) -- these get
/// flushed back via `sv_set_scalar` once, after every statement has lowered.
/// An event control through a virtual interface (`@(posedge vif.clk)`,
/// `@(vif.d)`): its one term's member access and edge.
fn vif_event<'d>(point: &SuspendPoint<'d>) -> Option<(Expression<'d>, sv_lang::EdgeKind)> {
    let (signal, edge) = match point {
        SuspendPoint::Edge { signal, edge, .. } => (signal, *edge),
        // `v.sb.c <= ##1 1` (LRM 25.9.1): counts the events of the clocking
        // block of the instance `v` holds.
        SuspendPoint::CycleDelay { via: Some(via), .. } => {
            return crate::vif::event_base(via).map(|_| (*via, sv_lang::EdgeKind::BothEdges));
        }
        SuspendPoint::EdgeList(entries, ..) if entries.len() == 1 => (&entries[0].0, entries[0].1),
        // `@(posedge vi.clk or negedge vi.rst)`: the first term stands for the
        // list (every term goes through the same `vi`, see `vif_event_list`).
        SuspendPoint::EdgeList(entries, ..) if vif_event_list(point).is_some() => {
            let (t, e) = entries
                .iter()
                .find(|(t, _)| vif_term_member(t).is_some())
                .expect("a vif list has a vif term");
            (t, *e)
        }
        _ => return None,
    };
    if crate::vif::event_base(signal).is_some() {
        return Some((*signal, edge));
    }
    // `@(vif.ea[i])`: an element of an event array member, waited on through
    // the array member's candidates.
    if edge == sv_lang::EdgeKind::None {
        return crate::vif::event_elem_root(signal).map(|root| (root, edge));
    }
    None
}

/// The virtual interface member access a list term waits through: the term
/// itself (`vi.clk`), or the event array member under an element select
/// (`vi.ea[i]` -> `vi.ea`). `None` for a term that reaches no virtual interface.
fn vif_term_member<'d>(term: &Expression<'d>) -> Option<Expression<'d>> {
    if crate::vif::event_base(term).is_some() {
        Some(*term)
    } else {
        crate::vif::event_elem_root(term)
    }
}

/// An event-control LIST of two or more terms of which at least one waits on
/// a member of a virtual interface variable (`@(posedge vi.clk or negedge
/// vi.rst)`, `@(posedge a.clk or negedge b.rst)`, LRM 25.9 + 9.4.2): the
/// terms' (member access, edge). The wait is then one event list per tuple of
/// candidate instances (one candidate per distinct variable), keyed by the
/// variables' ids together (`vif::suspend_key_multi`).
/// Terms that name no virtual interface member (a module signal, an event) may
/// be mixed in (LRM 9.4.2: a list's terms are independent); their wait entry
/// is the same under every candidate. `None` for any other list (an event
/// array element of a vif member, a vif held in a non-name expression, or no
/// vif term at all).
fn vif_event_list<'d>(
    point: &SuspendPoint<'d>,
) -> Option<Vec<(Expression<'d>, sv_lang::EdgeKind)>> {
    let SuspendPoint::EdgeList(entries, _) = point else {
        return None;
    };
    if entries.len() < 2 {
        return None;
    }
    let mut any = false;
    for (term, _) in entries {
        let Some(member) = vif_term_member(term) else {
            continue;
        };
        let base = crate::vif::event_base(&member)?;
        vif_var_key(&base)?;
        any = true;
    }
    any.then(|| entries.clone())
}

/// What identifies the virtual interface variable a term goes through: the
/// source text of its base expression with the whitespace removed (`vi`,
/// `cfg.vi`), so terms spelled alike share one candidate id in the resume key.
/// Two spellings of one variable are just two ids that always agree.
fn vif_var_key(base: &Expression<'_>) -> Option<String> {
    let text = vj_sim::process::cfg::source_text_range(base.source_range())?;
    Some(text.split_whitespace().collect())
}

/// One term (a member access) per distinct virtual interface variable the
/// event control `point` waits through, in order of first appearance: what
/// the resume key's id tuple is read from. Empty if `point` is no vif wait.
fn vif_event_vars<'d>(point: &SuspendPoint<'d>) -> Vec<Expression<'d>> {
    if let Some(terms) = vif_event_list(point) {
        let mut seen: Vec<String> = Vec::new();
        let mut out = Vec::new();
        for (term, _) in terms {
            let Some(member) = vif_term_member(&term) else {
                continue;
            };
            let Some(base) = crate::vif::event_base(&member) else {
                continue;
            };
            let Some(key) = vif_var_key(&base) else {
                continue;
            };
            if !seen.contains(&key) {
                seen.push(key);
                out.push(member);
            }
        }
        return out;
    }
    vif_event(point)
        .map(|(signal, _)| vec![signal])
        .unwrap_or_default()
}

/// The resume key a suspend at `resume` through `point`'s virtual interface
/// variable(s) returns (`crate::vif::suspend_key`, `suspend_key_multi`).
fn vif_point_key<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    point: &SuspendPoint<'d>,
    resume: u32,
) -> Result<inkwell::values::IntValue<'ctx>, LoweringError> {
    vif_vars_key(cx, &vif_event_vars(point), resume)
}

/// [`vif_point_key`] for the variables `vars` ([`vif_event_vars`]).
fn vif_vars_key<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    vars: &[Expression<'d>],
    resume: u32,
) -> Result<inkwell::values::IntValue<'ctx>, LoweringError> {
    if let [signal] = vars {
        return crate::vif::suspend_key(
            cx,
            crate::vif::event_base(signal).expect("vif_event checked it"),
            resume,
            vif_candidates(signal).len(),
        );
    }
    let bases: Vec<(Expression<'d>, usize)> = vars
        .iter()
        .map(|s| {
            (
                crate::vif::event_base(s).expect("a vif term"),
                vif_candidates(s).len(),
            )
        })
        .collect();
    crate::vif::suspend_key_multi(cx, &bases, resume)
}

/// The expression of the one-term event control `point` that waits through a
/// virtual interface (the whole term, `vif.ea[i]` included).
fn vif_event_term<'d>(point: &SuspendPoint<'d>) -> Option<Expression<'d>> {
    vif_event(point)?;
    match point {
        SuspendPoint::Edge { signal, .. } => Some(*signal),
        SuspendPoint::CycleDelay { via, .. } => *via,
        SuspendPoint::EdgeList(entries, ..) => entries
            .iter()
            .map(|(e, _)| *e)
            .find(|e| vif_term_member(e).is_some())
            .or_else(|| entries.first().map(|(e, _)| *e)),
        _ => None,
    }
}

/// For `vif.m` (`e`): every candidate instance's `m` (`crate::vif`).
pub(crate) fn vif_candidates<'d>(e: &Expression<'d>) -> Vec<Symbol<'d>> {
    vj_sim::netlist::vif::member_targets(e)
        .map(|t| t.into_iter().flatten().collect())
        .unwrap_or_default()
}

/// Besides the module signals the segment names (and the subset it writes),
/// returns the hidden sampled-value cells its sampled value calls read
/// (`vj_sim::sva::sampled::use_views`, owned by the process `owner`),
/// primed like signals so `crate::sampled` can lower a call from them.
///
/// `extra` are expressions the segment's lowering also evaluates though they
/// are not part of its body: the subroutine calls attached to the sequence of a
/// hosted assertion (16.11, `ProcessLoweringPlan::assertion_calls`).
fn external_refs_in_segment<'d>(
    seg: &Segment<'d>,
    signals: &HashMap<SymbolId, SignalSlot>,
    owner: &SymbolId,
    extra: &[Expression<'d>],
) -> (Vec<Symbol<'d>>, HashSet<SymbolId>, Vec<SymbolId>) {
    let mut order = Vec::new();
    let mut seen = HashSet::new();
    let mut written = HashSet::new();
    let mut hidden: Vec<SymbolId> = Vec::new();
    let mut hidden_seen: HashSet<SymbolId> = HashSet::new();

    // R-run Task 13 (ST-009/ST-024/ST-114): a `SignalSlotClass::Memory`
    // symbol is NEVER primed as a whole external signal -- it has no single
    // scalar value to shadow-`alloca` (only its individual ROWS, addressed
    // dynamically via `expr.rs`'s own `ElementSelect`/`Assignment` arms
    // through `LowerCtx::mem_signals`/`mem_accessor` and
    // `accessor::build_get_mem_word`/`build_set_mem_word`). A memory symbol
    // is only ever referenced as the base of an `ElementSelect` (`mem[i]`),
    // never bare -- but this walk descends into EVERY node's children,
    // including an `ElementSelect`'s own base-`NamedValue` child, so without
    // this exclusion `mem` would still get recorded here (and wrongly
    // shadow-`alloca`'d as if it were a whole `Inline`/`Wide` signal).
    let is_memory_signal = |id: &SymbolId| {
        matches!(
            signals.get(id).map(|s| s.class),
            Some(SignalSlotClass::Memory { .. })
        )
    };

    let mut record = |node: SemNode<'d>,
                      order: &mut Vec<Symbol<'d>>,
                      seen: &mut HashSet<SymbolId>| {
        let mut stack = vec![node];
        while let Some(n) = stack.pop() {
            // A procedural checker instance's assertions (17.3) are not part
            // of the statement's own tree (they are items of the instance
            // body) but this process evaluates them or their `const'` casts
            // where it reaches the instantiation.
            if let Some(s) = n.as_statement()
                && s.kind() == StatementKind::ProceduralChecker
            {
                for instance in s.procedural_checker_instances() {
                    for block in vj_sim::netlist::module_items(&instance) {
                        let assertion = crate::module::static_concurrent_assertion_of(&block)
                            .or_else(|| crate::module::static_deferred_assertion_of(&block));
                        stack.extend(assertion.map(|a| a.as_sem_node()));
                    }
                }
            }
            // A block nested in a leaf statement (a `case` item) initializes
            // its automatic variables on entry (`lower_segment_statement`):
            // those initializers read module signals too.
            if let Some(s) = n.as_statement()
                && matches!(s.kind(), StatementKind::List | StatementKind::Block)
            {
                for var in vj_sim::process::cfg::block_automatic_vars(&s, false) {
                    if let Some(init) = var.initializer() {
                        stack.push(init.as_sem_node());
                    }
                }
            }
            // `-> e` flips the event's shadow copy
            // (`lower_event_trigger_statement`), so the event is written.
            // A nonblocking trigger (`->> e`) is staged in the NBA log, not
            // written through the shadow.
            if let Some(s) = n.as_statement()
                && s.kind() == StatementKind::EventTrigger
                && s.is_nonblocking_trigger() != Some(true)
                && let Some(target) = s.expressions().into_iter().next()
                && let Some(()) = {
                    // `-> vif.ev`: every candidate instance's event.
                    for sym in vif_candidates(&target) {
                        if signals.contains_key(&sym.uid()) && !is_memory_signal(&sym.uid()) {
                            written.insert(sym.uid());
                        }
                    }
                    Some(())
                }
                && let Some(sym) = target.referenced_symbol()
                && signals.contains_key(&sym.uid())
                // An element of an event array is a row of its memory,
                // stored straight through the memory accessor.
                && !is_memory_signal(&sym.uid())
            {
                written.insert(sym.uid());
            }
            // `force`/`release` change their target through STATE's
            // force table (`crate::force`), never through this
            // segment's copy: its operands are read, nothing is written
            // back (a flush would count as the design driving it).
            if let Some(s) = n.as_statement()
                && matches!(
                    s.kind(),
                    StatementKind::ProceduralAssign | StatementKind::ProceduralDeassign
                )
            {
                for e in s.expressions() {
                    if e.kind() == ExpressionKind::Assignment {
                        stack.extend(e.left().map(|x| x.as_sem_node()));
                        stack.extend(e.right().map(|x| x.as_sem_node()));
                    } else {
                        stack.push(e.as_sem_node());
                    }
                }
                continue;
            }
            if let Some(e) = n.as_expression() {
                // A modport port with an expression (LRM 25.5.4) names the
                // interface signals that expression does.
                if let Some(inner) = crate::expr::modport_expr_target(&e) {
                    stack.push(inner.as_sem_node());
                }
                if vj_sim::symid::is_value_name(e.kind())
                    && let Some(sym) = e.referenced_symbol()
                    && signals.contains_key(&sym.uid())
                    && !is_memory_signal(&sym.uid())
                    && seen.insert(sym.uid())
                {
                    order.push(sym);
                }
                // `s.triggered` reads its watcher's cell
                // (`vj_sim::sva::endpoint`), which no expression names.
                if let Some(inst) = vj_sim::sva::endpoint::watched_call(&e) {
                    let id = vj_sim::sva::endpoint::watcher_id(owner, &inst);
                    if signals.contains_key(&id) && hidden_seen.insert(id.clone()) {
                        hidden.push(id);
                    }
                }
                // 17.4: `$inferred_disable` reads the `default disable iff`
                // signal of the checker's instantiation scope, which no
                // expression of this process names: primed like a hidden cell.
                if e.call_subroutine_name().as_deref() == Some("$inferred_disable")
                    && let Some(id) = crate::sva::emit::inferred_disable_signal()
                    && signals.contains_key(&id)
                    && !is_memory_signal(&id)
                    && !seen.contains(&id)
                    && hidden_seen.insert(id.clone())
                {
                    hidden.push(id);
                }
                // A malformed call is reported by its own lowering.
                if let Ok(Some(call)) = vj_sim::sva::sampled::decode(e) {
                    let args =
                        vj_sim::sva::sampled::strict_site_signals_in(call.arg).unwrap_or_default();
                    let views = vj_sim::sva::sampled::use_views(owner, &call, &args);
                    for (_, cell) in views.cur.into_iter().chain(views.prev) {
                        if signals.contains_key(&cell) && hidden_seen.insert(cell.clone()) {
                            hidden.push(cell);
                        }
                    }
                }
                // `vif.m`: every candidate instance's `m` (`crate::vif`),
                // all written by a blocking write to it.
                for sym in vif_candidates(&e) {
                    if signals.contains_key(&sym.uid())
                        && !is_memory_signal(&sym.uid())
                        && seen.insert(sym.uid())
                    {
                        order.push(sym);
                    }
                }
                if e.kind() == ExpressionKind::Assignment
                    && e.is_nonblocking() != Some(true)
                    && let Some(lhs) = e.left()
                {
                    for sym in vif_candidates(&lhs) {
                        if signals.contains_key(&sym.uid()) && !is_memory_signal(&sym.uid()) {
                            written.insert(sym.uid());
                        }
                    }
                }
                // Task S4 deviation: a nonblocking (`<=`) top-level
                // assignment must NOT be added to `written` -- it is
                // staged via `nba_enqueue` inside `lower_segment_
                // statement`/`lower_nonblocking_assignment`, never
                // flushed back through `flush_external_signals`'s own
                // `sv_set_scalar` call (PR-065's negative gate: routing
                // it through here too would make the segment-end flush
                // call `sv_set_scalar` for a `<=` write, exactly the bug
                // this exclusion prevents).
                // Any blocking target -- `x`, `x[3:0]`, `s.f`, `{a, b}`
                // -- writes its storage roots (a memory root is written
                // row-wise through its accessor instead).
                if e.kind() == ExpressionKind::Assignment
                    && e.is_nonblocking() != Some(true)
                    && let Some(lhs) = e.left()
                {
                    for sym in crate::select::lvalue_root_symbols(lhs) {
                        if signals.contains_key(&sym.uid()) && !is_memory_signal(&sym.uid()) {
                            written.insert(sym.uid());
                        }
                    }
                }
                // R-run Task 8 fix: `c++`/`c--`/`++c`/`--c` on an
                // EXTERNAL (module-level) signal is a real, immediate
                // write too (`expr.rs`'s own `UnaryOp::Pre/Postinc/
                // decrement` special case stores the new value straight
                // into `cx.locals`'s shadow pointer, exactly like a
                // plain `=` assignment does) -- but before this fix it
                // was never added to `written`, so `flush_external_
                // signals` silently never wrote it back to real STATE:
                // the increment was fully computed and even visible to a
                // LATER read in the SAME segment/call (since both share
                // the one shadow `alloca`), then silently discarded the
                // moment the segment's own call returned (a suspend, or
                // the process's own End) -- exactly the shape
                // `repeat(5) #1 c++;` exercises (5 separate suspend/
                // resume calls, each one's own increment lost). Found by
                // this task's own `repeat_with_delay.sv` regression
                // fixture (`c=0 at 5` instead of `c=5 at 5`), a
                // pre-existing gap this file's own `written`-detection
                // never previously had a failing test to catch, not a
                // defect this task's new CFG shape introduced.
                if e.kind() == ExpressionKind::UnaryOp
                    && matches!(
                        e.unary_op(),
                        Some(
                            UnaryOp::Preincrement
                                | UnaryOp::Predecrement
                                | UnaryOp::Postincrement
                                | UnaryOp::Postdecrement
                        )
                    )
                    && let Some(operand) = e.operand()
                {
                    for sym in crate::select::lvalue_root_symbols(operand) {
                        if signals.contains_key(&sym.uid()) && !is_memory_signal(&sym.uid()) {
                            written.insert(sym.uid());
                        }
                    }
                }
                // `$value$plusargs(fmt, v)` and `$random(seed)`/
                // `$urandom(seed)` store into their variable argument
                // through its shadow copy: its roots are written.
                if e.kind() == ExpressionKind::Call
                    && e.is_system_call() == Some(true)
                    && let Some(sub) = e.system_subroutine()
                    && matches!(
                        sub.known_name_id(),
                        KnownSystemName::ValuePlusArgs
                            | KnownSystemName::Random
                            | KnownSystemName::URandom
                    )
                {
                    let out_arg = if sub.known_name_id() == KnownSystemName::ValuePlusArgs {
                        e.operands().get(1).copied()
                    } else {
                        e.operands().first().copied()
                    };
                    if let Some(arg) = out_arg {
                        let target = if arg.kind() == ExpressionKind::Assignment {
                            arg.left().unwrap_or(arg)
                        } else {
                            arg
                        };
                        for sym in crate::select::lvalue_root_symbols(target) {
                            if signals.contains_key(&sym.uid()) && !is_memory_signal(&sym.uid()) {
                                written.insert(sym.uid());
                            }
                        }
                    }
                }
                // The stochastic queue calls (LRM 20.15) store their output
                // arguments (status, job, inform, statistic) the same way.
                if e.kind() == ExpressionKind::Call
                    && e.is_system_call() == Some(true)
                    && let Some(sub) = e.system_subroutine()
                {
                    let first_out = match sub.known_name_id() {
                        KnownSystemName::QInitialize | KnownSystemName::QAdd => Some(3),
                        KnownSystemName::QRemove | KnownSystemName::QExam => Some(2),
                        // `$countdrivers` (LRM D.2) stores its counts the same way.
                        KnownSystemName::QFull | KnownSystemName::CountDrivers => Some(1),
                        _ => None,
                    };
                    let outs = e.operands();
                    let outs = first_out.map_or(&[][..], |i| {
                        let i = i.min(outs.len());
                        &outs[i..]
                    });
                    let outs = if sub.known_name_id() == KnownSystemName::QRemove {
                        // job and inform precede the status
                        let all = e.operands();
                        all.get(1..).unwrap_or(&[]).to_vec()
                    } else {
                        outs.to_vec()
                    };
                    for arg in outs {
                        let target = if arg.kind() == ExpressionKind::Assignment {
                            arg.left().unwrap_or(arg)
                        } else {
                            arg
                        };
                        for sym in crate::select::lvalue_root_symbols(target) {
                            if signals.contains_key(&sym.uid()) && !is_memory_signal(&sym.uid()) {
                                written.insert(sym.uid());
                            }
                        }
                    }
                }
                // A user subroutine call reads/writes the module signals
                // its `SubroutineAbi` names through this segment's own
                // shadow copies, so they are primed/flushed here too.
                for callee in crate::func::user_callees(&e) {
                    let abi = crate::func::dispatch_abi(&callee);
                    for sig in abi.signals {
                        let id = sig.uid();
                        if !signals.contains_key(&id) || is_memory_signal(&id) {
                            continue;
                        }
                        if abi.written.contains(&id) {
                            written.insert(id.clone());
                        }
                        if seen.insert(id) {
                            order.push(sig);
                        }
                    }
                }
            }
            stack.extend(vj_sim::process::cfg::live_children(&n));
        }
    };

    // Inlined-task argument transfers read their actuals; an output
    // copy-back also writes its target's roots.
    let mut binding_written: Vec<SymbolId> = Vec::new();
    // A static task's formal or local the binding sets is a signal.
    let set_signal = |var: &Symbol<'d>,
                      order: &mut Vec<Symbol<'d>>,
                      seen: &mut HashSet<SymbolId>,
                      binding_written: &mut Vec<SymbolId>| {
        let id = var.uid();
        if signals.contains_key(&id) && !is_memory_signal(&id) {
            binding_written.push(id.clone());
            if seen.insert(id) {
                order.push(*var);
            }
        }
    };
    for b in &seg.bindings {
        match b {
            vj_sim::process::cfg::ArgBinding::In { actual, formal } => {
                record(actual.as_sem_node(), &mut order, &mut seen);
                set_signal(formal, &mut order, &mut seen, &mut binding_written);
            }
            vj_sim::process::cfg::ArgBinding::Init { var } => {
                if let Some(init) = var.initializer() {
                    record(init.as_sem_node(), &mut order, &mut seen);
                }
                set_signal(var, &mut order, &mut seen, &mut binding_written);
            }
            // A `foreach` loop variable is a process local, never a signal;
            // so is an inlined method's `this`.
            vj_sim::process::cfg::ArgBinding::Const { .. }
            | vj_sim::process::cfg::ArgBinding::Step { .. }
            | vj_sim::process::cfg::ArgBinding::ThisOf { .. }
            | vj_sim::process::cfg::ArgBinding::Release { .. } => {}
            vj_sim::process::cfg::ArgBinding::Capture { value, .. } => {
                record(value.as_sem_node(), &mut order, &mut seen);
            }
            // The element is reached through its collection's handle.
            vj_sim::process::cfg::ArgBinding::RefOpen { actual, .. }
            | vj_sim::process::cfg::ArgBinding::RefClose { actual, .. } => {
                record(actual.as_sem_node(), &mut order, &mut seen);
            }
            vj_sim::process::cfg::ArgBinding::FromCaptured { .. }
            | vj_sim::process::cfg::ArgBinding::CaptureThis { .. }
            | vj_sim::process::cfg::ArgBinding::ToCaptured { .. }
            | vj_sim::process::cfg::ArgBinding::CallResult { .. }
            | vj_sim::process::cfg::ArgBinding::ClassEventLeave => {}
            vj_sim::process::cfg::ArgBinding::AssocKey { arr, .. } => {
                record(arr.as_sem_node(), &mut order, &mut seen);
            }
            vj_sim::process::cfg::ArgBinding::Out {
                actual: target,
                formal,
            } => {
                let id = formal.uid();
                if signals.contains_key(&id) && !is_memory_signal(&id) && seen.insert(id) {
                    order.push(*formal);
                }
                record(target.as_sem_node(), &mut order, &mut seen);
                for sym in crate::select::lvalue_root_symbols(*target) {
                    if signals.contains_key(&sym.uid()) && !is_memory_signal(&sym.uid()) {
                        binding_written.push(sym.uid());
                    }
                }
            }
            vj_sim::process::cfg::ArgBinding::AssignCaptured { target, nba, .. } => {
                record(target.as_sem_node(), &mut order, &mut seen);
                // A nonblocking one is staged, never written to the shadow.
                if !*nba {
                    for sym in crate::select::lvalue_root_symbols(*target) {
                        if signals.contains_key(&sym.uid()) && !is_memory_signal(&sym.uid()) {
                            binding_written.push(sym.uid());
                        }
                    }
                }
            }
        }
    }
    for stmt in &seg.body {
        record(stmt.as_sem_node(), &mut order, &mut seen);
    }
    for e in extra {
        record(e.as_sem_node(), &mut order, &mut seen);
    }
    // A `for` loop's bare initializer/step expressions (`step_exprs`) can
    // read AND write a module-level signal -- the classic `integer i;
    // for (i = 0; i < n; i = i + 1)` form -- so they are scanned like any
    // other statement (reads primed, writes flushed).
    for step in &seg.step_exprs {
        record(step.as_sem_node(), &mut order, &mut seen);
    }
    // R-run Task 8: `repeat_init`'s own count expression can reference an
    // external (module-level) signal too (`repeat(n) ...` where `n` is a
    // port), so it gets the same priming treatment every other read site
    // here does.
    if let Some((_, count)) = &seg.repeat_init
        && let Some(count_expr) = count.expr()
    {
        record(count_expr.as_sem_node(), &mut order, &mut seen);
    }
    match &seg.terminator {
        // A virtual interface selecting an inlined task is read.
        SegTerminator::SwitchGoto { on, .. } => {
            for e in on.reads() {
                record(e.as_sem_node(), &mut order, &mut seen);
            }
        }
        SegTerminator::CondGoto { cond, .. } => record(cond.as_sem_node(), &mut order, &mut seen),
        SegTerminator::AssertGoto { stmt, .. } => {
            if let Some(e) = vj_sim::process::cfg::assertion_cond(stmt) {
                record(e.as_sem_node(), &mut order, &mut seen);
            }
        }
        SegTerminator::CaseGoto { stmt, .. } => {
            for e in vj_sim::process::liveness::case_reads(stmt) {
                record(e.as_sem_node(), &mut order, &mut seen);
            }
        }
        SegTerminator::Suspend {
            point: SuspendPoint::Delay(e, _) | SuspendPoint::Level(e),
            ..
        } => record(e.as_sem_node(), &mut order, &mut seen),
        SegTerminator::Suspend {
            point: SuspendPoint::EdgeList(entries, iffs),
            ..
        } => {
            for (e, _) in entries {
                record(e.as_sem_node(), &mut order, &mut seen);
            }
            for g in iffs.iter().flatten() {
                record(g.as_sem_node(), &mut order, &mut seen);
            }
        }
        SegTerminator::Suspend {
            point: SuspendPoint::Edge { signal, iff: Some(g), .. },
            ..
        } => {
            record(g.as_sem_node(), &mut order, &mut seen);
            if !vj_sim::symid::is_value_name(signal.kind()) {
                record(signal.as_sem_node(), &mut order, &mut seen);
            }
        }
        // Task 6: `ImplicitComb`'s read-set members are real accessor-primed
        // reads too, same completeness reason as `EdgeList`'s members above
        // (harmless even though `resolve_suspend_point` does not yet resolve
        // this kind codegen-side -- see that function's own doc comment; the
        // guarded body's own `seg.body` already reaches these same reads
        // independently via the RESUME segment's own `record()` call, so
        // this is redundant-but-correct priming for the SUSPENDING segment
        // itself, never a correctness requirement).
        SegTerminator::Suspend {
            point: SuspendPoint::ImplicitComb(reads),
            ..
        } => {
            for e in reads {
                record(e.as_sem_node(), &mut order, &mut seen);
            }
        }
        // `Edge`/`CycleDelay`'s signal(s) and `OneStep` (no expression at
        // all) never need LLVM-level accessor priming -- `resolve_suspend_
        // point` resolves them to a `StateCellId`/nothing purely at codegen
        // time (Rust-side `signals.get(&sym.uid())`), never emitting IR that
        // reads them.
        // An event control through a virtual interface (`@(posedge
        // vif.clk)`) reads the virtual interface for its resume key.
        SegTerminator::Suspend { point, .. } if vif_event(point).is_some() => {
            if let Some(signal) = vif_event_term(point) {
                record(signal.as_sem_node(), &mut order, &mut seen)
            }
            // A list through several variables reads each one's id.
            for signal in vif_event_vars(point) {
                record(signal.as_sem_node(), &mut order, &mut seen)
            }
        }
        // `@(ea[k])` on an event-array element evaluates its index (and
        // snapshots the element) when the wait starts; an event expression
        // is evaluated then too.
        SegTerminator::Suspend {
            point: SuspendPoint::Edge { signal, .. },
            ..
        } if !vj_sim::symid::is_value_name(signal.kind()) => {
            record(signal.as_sem_node(), &mut order, &mut seen)
        }
        SegTerminator::Suspend {
            point:
                SuspendPoint::Edge { .. }
                    | SuspendPoint::CycleDelay { .. }
                    | SuspendPoint::OneStep
                    | SuspendPoint::WaitFork
                    | SuspendPoint::ByRequest,
            ..
        }
        | SegTerminator::Goto(_)
        // R-run Task 8: a `repeat` loop's own synthetic counter (unlike a
        // `for` loop's user-visible control variable) is never an external
        // (module-level) signal, so `CondGotoCounter` never needs accessor
        // priming -- same bucket as `Goto`/a non-`iff` `Edge` above.
        | SegTerminator::CondGotoCounter { .. }
        // R-run Task 17: a fork/join site's branches are each compiled as
        // their OWN, separate kernel function with their OWN, independent
        // `prime_external_signals`/`external_symbols_in_plan` pass (see
        // `lower_kernel_fn_with_repr`'s new fork-support arm) -- nothing in
        // a branch body needs priming into THIS (outer/parent) kernel's own
        // `ext_ptrs`.
        | SegTerminator::ForkJoin { .. }
        | SegTerminator::End { .. } => {}
    }

    written.extend(binding_written);
    (order, written, hidden)
}

fn int_type(ctx: &Context, w: u32) -> IntType<'_> {
    ctx.custom_width_int_type(NonZeroU32::new(w).expect("zero-width int type"))
        .expect("custom_width_int_type")
}

/// The ONE kind of raw `getelementptr` CG-093 permits: against the private,
/// per-process `local` frame pointer (never the shared-arena `handle`).
/// `word_offset` is a [`vj_sim::process::liveness::FrameSlotDesc::
/// offset`] (a count of 8-byte words, matching every other word-addressed
/// STATE/frame convention in this workspace).
/// The storage a frame slot's local lives in: its packed value, or for an
/// array local the slot's raw words (element rows addressed by
/// `crate::arrays`, packed within them).
fn slot_storage_type<'ctx>(
    ctx: &'ctx Context,
    slot: &vj_sim::process::liveness::FrameSlotDesc,
) -> inkwell::types::BasicTypeEnum<'ctx> {
    match slot.repr {
        vj_sim::process::FrameSlot::Array { rows, row_words } => ctx
            .i64_type()
            .array_type(rows * u32::from(row_words))
            .into(),
        _ => int_type(ctx, slot.width_bits * 2).into(),
    }
}

/// A process-local variable wider than `WIDE_THRESHOLD` has no frame slot
/// representation (the frame holds packed `i(2N)` values): a loud error,
/// never a silently truncated or mis-typed slot. Module-level vectors of any
/// width are fine (`crate::huge`), and so is a process-local one that fits an
/// LLVM integer (its alloca is also a valid image for the huge operators).
fn reject_huge_frame_slots(plan: &ProcessLoweringPlan<'_>) -> Result<(), LoweringError> {
    for slot in &plan.frame.slots {
        if !matches!(slot.repr, vj_sim::process::FrameSlot::Array { .. })
            && slot.width_bits > crate::value::WIDE_THRESHOLD
        {
            return Err(LoweringError::unsupported_at(
                &format!(
                    "a process-local variable of {} bits (LRM 1800-2023 6.9.1): a vector wider \
                     than {} bits is supported only as a module-level signal",
                    slot.width_bits,
                    crate::value::WIDE_THRESHOLD,
                ),
                &plan.fn_sym,
            ));
        }
    }
    Ok(())
}

/// Copies one frame slot's value from `src` to `dst` (frame <-> local).
fn copy_frame_slot<'ctx>(
    ctx: &'ctx Context,
    b: &Builder<'ctx>,
    slot: &vj_sim::process::liveness::FrameSlotDesc,
    dst: PointerValue<'ctx>,
    src: PointerValue<'ctx>,
) {
    match slot.repr {
        vj_sim::process::FrameSlot::Array { rows, row_words } => {
            let bytes = u64::from(rows) * u64::from(row_words) * 8;
            b.build_memcpy(dst, 8, src, 8, ctx.i64_type().const_int(bytes, false))
                .unwrap();
        }
        _ => {
            let ty = int_type(ctx, slot.width_bits * 2);
            let v = b.build_load(ty, src, "frame_ld").unwrap();
            b.build_store(dst, v).unwrap();
        }
    }
}

fn frame_slot_ptr<'ctx>(
    ctx: &'ctx Context,
    b: &Builder<'ctx>,
    local: PointerValue<'ctx>,
    word_offset: u32,
) -> PointerValue<'ctx> {
    let byte_offset = u64::from(word_offset) * 8;
    let i8_ty = ctx.i8_type();
    let idx = ctx.i64_type().const_int(byte_offset, false);
    // SAFETY: `local` points to the caller-owned per-process frame buffer
    // (`ActivationRecord::frame`'s backing storage), sized to hold at least
    // `plan.frame`'s total word count -- every `FrameSlotDesc::offset` this
    // file ever GEPs with was itself assigned within that same total by
    // `process::liveness::compute_liveness`, so this GEP is in-bounds by
    // construction. This is exactly CG-093's one permitted GEP target (a
    // private, per-process `local` pointer), never the shared arena.
    unsafe {
        b.build_gep(i8_ty, local, &[idx], "frame_slot_ptr")
            .expect("in-bounds GEP into the caller-sized frame buffer")
    }
}

fn declare_process_fn<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    name: &str,
) -> FunctionValue<'ctx> {
    let ptr_ty = ctx.ptr_type(AddressSpace::default());
    let i32_ty = ctx.i32_type();
    let fn_ty = i32_ty.fn_type(&[ptr_ty.into(), ptr_ty.into(), i32_ty.into()], false);
    let f = module.add_function(name, fn_ty, None);
    f.get_nth_param(0).unwrap().set_name("handle");
    f.get_nth_param(1).unwrap().set_name("local");
    f.get_nth_param(2).unwrap().set_name("resume_pc");
    f
}

/// One `for`-loop initializer/step expression (`i++`, `j = 0`, or -- LRM
/// 12.7.1 -- a function call such as `tick()`). A call to a user task or
/// void function has no value, so it goes through the statement-position
/// call path rather than the value-producing `lower_expr`.
fn lower_step_expr<'ctx, 'd, 'm>(
    cx: &mut LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
) -> Result<(), LoweringError> {
    if e.kind() == ExpressionKind::Call && e.is_system_call() == Some(false) {
        return crate::func::lower_task_call(cx, e);
    }
    lower_expr(cx, e)?;
    Ok(())
}

/// PR-009/CG-095's ONE shared statement-lowering visitor, used identically by
/// every segment whether or not the enclosing process ever suspends (the
/// segment_count==1 fast path and the general switch-dispatched path both
/// call this same function; see this file's module doc comment).
///
/// Every `sv_lang::StatementKind` a `Segment::body` can legally contain in
/// the A2 slice's restricted grammar is named explicitly: `Empty` and
/// `VariableDeclaration` (both a documented runtime no-op -- see the
/// `VariableDeclaration` arm's own comment), `ExpressionStatement`
/// (routed through `crate::expr::lower_expr`, reused unchanged), and
/// `List`/`Block` (review fix, R-run Task 4 r1: a `begin...end` block nested
/// inside a `case` arm or `repeat` body -- `process::cfg::
/// is_ordinary_statement_kind` treats `Case`/`RepeatLoop` as opaque leaves,
/// so unlike a segment's own top-level body, a block nested INSIDE one of
/// those two is never pre-flattened before reaching this dispatcher; this
/// mirrors `func.rs::lower_stmt`'s own `List | Block` arm exactly). Every
/// other kind is unreachable here by construction (`process::cfg::build_cfg`
/// already extracts `if`/`else` into `Terminator::Branch`/`SegTerminator::
/// CondGoto` and a `Timed` suspend point into `Terminator::Suspend`/
/// `SegTerminator::Suspend` -- neither a `Conditional` nor a `Timed`
/// statement node is ever pushed into a `BasicBlock`'s/`Segment`'s own
/// `stmts`/`body`), but a named [`LoweringError`] -- never a silent no-op --
/// is still returned for any of them, since `process::cfg`'s own
/// "ordinary straight-line statement" fallback (`is_ordinary_statement_kind`)
/// can push an un-decomposed `Case`/loop/etc. leaf statement into a segment's
/// body when it contains no nested suspend point (that guard's own scope is
/// "no CFG split needed", not "this crate's codegen can lower it").
/// Task S4 (PR-059, PR-062): every `ExpressionStatement` whose top expression
/// is an `Assignment` is routed on slang's own `isNonBlocking()` bit -- read
/// exactly once, here, at the single site that lowers that statement, never
/// re-derived a second time deeper in the call chain (this IS "Segment-build
/// time" for this crate's own purposes: `vj-sim::process::cfg::build_cfg`
/// -- a different, `sv-lang`-free crate -- builds the Segment IR itself and
/// has no notion of blocking/nonblocking at all, so codegen's own single read
/// of the bit, right where the statement is lowered, is the earliest and only
/// point in this crate's pipeline that can name it).
// R-run Task 4 (CG-095/CG-096): `cx` is now `&mut` (not `&`) so this function
// can call into the shared `stmt_shared::lower_case`/`lower_repeat_loop`
// helpers below, both of which may introduce a brand-new `cx.locals` entry
// mid-lowering (a `case` item label reads nothing new, but the shared helper
// signature is uniform across all five control-flow shapes it implements --
// see that module's own doc comment). Every existing call site already binds
// `cx` as `let mut cx = LowerCtx { ... }`, so this is a caller-side
// `&cx` -> `&mut cx` change, not a new binding.
fn lower_segment_statement<'ctx, 'd, 'm>(
    cx: &mut LowerCtx<'ctx, 'd, 'm>,
    handle: PointerValue<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    nba_fn: FunctionValue<'ctx>,
    sys_fns: &SysCallFns<'ctx>,
    stmt: &Statement<'d>,
) -> Result<(), LoweringError> {
    // A statement slang demoted to `Invalid` (a case-arm or `if` arm whose
    // dead sub-arm it could not bind, LRM 12.4/12.5) lowers as the real live
    // statement it wraps, as `func::lower_stmt` does.
    let unwrapped = vj_sim::process::cfg::unwrap_invalid(*stmt);
    let stmt = &unwrapped;
    // VPI `cbStmt` (Table 38-6): before the statement executes. A statement of
    // a segment's own body had its probe recorded by the CFG (and already
    // emitted by `lower_segment_body`); every statement nested in a leaf is
    // probed here.
    crate::vpi_dyn::emit_entry_probe(cx, stmt);
    match stmt.kind() {
        // Review fix (R-run Task 4 r1, CG-095/CG-096): a `begin...end` block
        // nested inside a `case` arm or a `repeat` body (the ordinary,
        // idiomatic SV form once an arm/body needs more than one statement)
        // reaches this dispatcher as a `StatementKind::List`/`Block` node via
        // `stmt_shared::lower_case`/`lower_repeat_loop`'s own `recurse`
        // callback -- `process::cfg::is_ordinary_statement_kind` treats
        // `Case`/`RepeatLoop` as opaque leaves, so it never pre-flattens a
        // block nested INSIDE one of them the way it flattens a segment's own
        // top-level body. Mirrors `func.rs::lower_stmt`'s existing
        // `List | Block` arm exactly (iterate children in order, stop early
        // if a prior sibling already left the block terminated -- this
        // dispatcher's own leaf kinds never build a terminating branch
        // themselves, but staying consistent with `func.rs`'s discipline here
        // costs nothing and keeps the two visitors' shapes identical).
        StatementKind::List | StatementKind::Block => {
            // Its automatic variables are initialized on entry (§6.21).
            for var in vj_sim::process::cfg::block_automatic_vars(stmt, false) {
                init_local_var(cx, &var)?;
            }
            // LRM 19.3: the begin/end of a named block a covergroup names.
            let blk = stmt
                .block_symbol()
                .filter(crate::covergroup::is_block_target);
            if let Some(b) = &blk {
                crate::covergroup::emit_block_event_of(cx, handle, b, false)?;
            }
            // A labeled assertion block its own `disable L;` leaves (the CFG
            // keeps it whole, `self_disabling_assertion_block`): that jump
            // goes to an exit block after it (LRM 9.6.2).
            let exit = if vj_sim::process::cfg::self_disabling_assertion_block(stmt) {
                let (_, f) = crate::stmt_shared::current_block_and_fn(cx)?;
                let bb = cx.ctx.append_basic_block(f, "disable_exit");
                cx.block_exits
                    .push((vj_sim::process::cfg::block_name(stmt), bb));
                Some(bb)
            } else {
                None
            };
            for child in vj_sim::process::cfg::live_statements(stmt) {
                if crate::stmt_shared::current_block_terminated(cx) {
                    break;
                }
                lower_segment_statement(cx, handle, signals, nba_fn, sys_fns, &child)?;
            }
            if let Some(bb) = exit {
                cx.block_exits.pop();
                if !crate::stmt_shared::current_block_terminated(cx) {
                    cx.b.build_unconditional_branch(bb).unwrap();
                }
                cx.b.position_at_end(bb);
            }
            if let Some(b) = &blk
                && !crate::stmt_shared::current_block_terminated(cx)
            {
                crate::covergroup::emit_block_event_of(cx, handle, b, true)?;
            }
            // A sequential block's handle-holding variables end with it
            // (LRM 6.21); a block the CFG walks releases them in a CFG block
            // of its own (`ArgBinding::Release`).
            if stmt.block_kind() == Some(StatementBlockKind::Sequential)
                && !crate::stmt_shared::current_block_terminated(cx)
            {
                for var in vj_sim::process::cfg::block_automatic_vars(stmt, false)
                    .iter()
                    .rev()
                {
                    release_task_local(cx, var);
                }
            }
            Ok(())
        }
        StatementKind::Empty => Ok(()),
        // An `if` nested in a statement lowered as one piece (a `case` arm,
        // a `repeat` body); a process's own `if`s are CFG branches.
        StatementKind::Conditional => crate::stmt_shared::lower_if(cx, *stmt, &mut |cx, s| {
            lower_segment_statement(cx, handle, signals, nba_fn, sys_fns, &s)
        }),
        // sv-lang=0.1.9's pinned C API exposes no accessor recovering a
        // `VariableDeclaration` statement's own initializer expression
        // (`Statement::children()`/`::expressions()` both come back empty
        // for this leaf kind -- confirmed by `process::liveness::
        // collect_declared_locals`'s own doc comment, which hit the exact
        // same binding limitation). The slot itself is already reserved via
        // `FrameLayout` (Task S3b); with no way to read back whatever
        // initializer syntax might exist, this is unconditionally a runtime
        // no-op for every fixture the A2 slice's grammar can construct (each
        // of which separately assigns any needed initial value via an
        // ordinary `ExpressionStatement`, e.g. `int x; x = 5;`).
        StatementKind::VariableDeclaration => Ok(()),
        StatementKind::ExpressionStatement => {
            let e = stmt.expr().ok_or_else(|| {
                LoweringError::unsupported_at("expression statement missing expr", &cx.fn_sym)
            })?;
            // Task S6 (CG-045): a system-call TASK statement ($display/
            // $write/$finish) is routed here, before the nonblocking-
            // assignment check below -- a `Call` is never an `Assignment`,
            // so this ordering is not load-bearing against that check, but
            // routing it first keeps this arm's own dispatch order matching
            // the order LRM statements are actually written in.
            if e.kind() == ExpressionKind::Call && e.is_system_call() == Some(true) {
                lower_system_call_statement(cx, handle, signals, sys_fns, e)
            } else if e.kind() == ExpressionKind::Assignment && e.is_nonblocking() == Some(true) {
                lower_nonblocking_assignment(cx, handle, signals, nba_fn, e)
            } else if e.kind() == ExpressionKind::Call && e.is_system_call() == Some(false) {
                // R-run Task 10 (CG-061/CG-042 respected): a bare, statement-
                // position user task/function call inside a REAL procedural
                // block/process body (`function_task.sv`'s own
                // `show(sq(7));`, an `initial` block statement -- unlike a
                // leaf `function`'s own body, which reaches `func.rs::
                // lower_stmt` instead, this dispatcher's own domain) --
                // mirrors `func.rs::lower_stmt`'s identical interception,
                // routed to the SAME shared `func::lower_task_call` (never a
                // second, divergent call-lowering path) so a bare call to a
                // VOID task doesn't fall through to the generic
                // `lower_expr(cx, e)` branch below, which -- correctly, for
                // an actual value-producing expression -- rejects a void
                // callee outright.
                crate::func::lower_task_call(cx, e)
            } else {
                // A dropped huge value frees its temp-pool slot.
                crate::huge::discard(lower_expr(cx, e)?);
                Ok(())
            }
        }
        // R-run Task 4 (CG-095/CG-096/PR-009): `case`/`casex`/`casez` and
        // `repeat` are the only two `StatementKind`s `vj_sim::process::
        // cfg::is_ordinary_statement_kind` leaves un-decomposed (every other
        // control-flow kind -- `if`/`for`/`while`/`do-while`/`forever`/
        // `foreach` -- is unconditionally expanded into real
        // `SegTerminator::Goto`/`CondGoto` segment shapes by that crate's own
        // `walk_stmt`, so those kinds can never reach this dispatcher at
        // all). Both now lower through the exact same `stmt_shared` builder
        // `func.rs::lower_stmt` already uses -- the CG-095/CG-096
        // "one visitor" fix -- with THIS dispatcher supplied back as the
        // `recurse` callback for arm/body statements, so a nested statement
        // still sees every leaf kind this segment path itself understands
        // ($display-family system calls, nonblocking assignment staging).
        StatementKind::Case => lower_case(cx, *stmt, &mut |cx, s| {
            lower_segment_statement(cx, handle, signals, nba_fn, sys_fns, &s)
        }),
        StatementKind::PatternCase => {
            crate::stmt_shared::lower_pattern_case(cx, *stmt, &mut |cx, s| {
                lower_segment_statement(cx, handle, signals, nba_fn, sys_fns, &s)
            })
        }
        StatementKind::ImmediateAssertion => {
            let env = crate::deferred_call::DeferredEnv { handle, signals };
            lower_immediate_assertion(cx, sys_fns, stmt, Some(&env), &mut |cx, s| {
                lower_segment_statement(cx, handle, signals, nba_fn, sys_fns, s)
            })
        }
        StatementKind::ConcurrentAssertion => {
            lower_concurrent_assertion(cx, handle, signals, nba_fn, sys_fns, stmt, &[])
        }
        StatementKind::ProceduralChecker => {
            lower_procedural_checker(cx, handle, signals, nba_fn, sys_fns, stmt)
        }
        StatementKind::RandCase => crate::stmt_shared::lower_randcase(cx, *stmt, &mut |cx, s| {
            lower_segment_statement(cx, handle, signals, nba_fn, sys_fns, &s)
        }),
        StatementKind::RepeatLoop => lower_repeat_loop(cx, *stmt, &mut |cx, s| {
            lower_segment_statement(cx, handle, signals, nba_fn, sys_fns, &s)
        }),
        // Loops nested inside such a leaf (a `case` arm's or a suspend-free
        // `repeat`'s own `for`/`while`/...): suspend-free too (a suspend
        // makes the whole statement a CFG construct), so lowered straight-
        // line like a function's; their `break`/`continue` are local jumps.
        StatementKind::WhileLoop => lower_while_loop(cx, *stmt, &mut |cx, s| {
            lower_segment_statement(cx, handle, signals, nba_fn, sys_fns, &s)
        }),
        StatementKind::DoWhileLoop => lower_do_while_loop(cx, *stmt, &mut |cx, s| {
            lower_segment_statement(cx, handle, signals, nba_fn, sys_fns, &s)
        }),
        StatementKind::ForLoop => lower_for_loop(cx, *stmt, &mut |cx, s| {
            lower_segment_statement(cx, handle, signals, nba_fn, sys_fns, &s)
        }),
        StatementKind::ForeverLoop => lower_forever_loop(cx, *stmt, &mut |cx, s| {
            lower_segment_statement(cx, handle, signals, nba_fn, sys_fns, &s)
        }),
        StatementKind::ForeachLoop => lower_foreach_loop(cx, *stmt, &mut |cx, s| {
            lower_segment_statement(cx, handle, signals, nba_fn, sys_fns, &s)
        }),
        StatementKind::ProceduralAssign => {
            crate::force::lower_procedural_assign(cx, handle, signals, *stmt)
        }
        StatementKind::ProceduralDeassign => {
            crate::force::lower_procedural_deassign(cx, handle, signals, *stmt)
        }
        StatementKind::Break => lower_loop_jump(cx, true),
        StatementKind::Continue => lower_loop_jump(cx, false),
        // Task 7 (CG-082): `->ev;`/`->>ev;` -- see
        // `lower_event_trigger_statement`'s own doc comment for the full
        // reasoning, including the documented, pre-existing, out-of-this-
        // task's-Files-list gap that keeps a REAL `event`-typed variable
        // from reaching this arm today.
        StatementKind::EventTrigger => lower_event_trigger_statement(cx, handle, signals, stmt),
        // `@e` on a class event: `process::cfg::walk_timed` leaves the
        // statement as the leaf that queues the process on the event.
        StatementKind::Timed => crate::class_events::lower_wait(cx, stmt),
        // SC-125: `disable fork;` -- kill every live child this process
        // forked. A runtime call, never a suspend (see
        // `vj_sim::sched::real_sv_rt_disable_fork`).
        StatementKind::DisableFork => {
            let f = cx
                .module
                .get_function(SV_RT_DISABLE_FORK_SYMBOL)
                .unwrap_or_else(|| {
                    let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
                    let fn_ty = cx.ctx.void_type().fn_type(&[ptr_ty.into()], false);
                    cx.module.add_function(
                        SV_RT_DISABLE_FORK_SYMBOL,
                        fn_ty,
                        Some(Linkage::External),
                    )
                });
            cx.b.build_call(f, &[handle.into()], "rt_disable_fork_call")
                .unwrap();
            Ok(())
        }
        // A `disable` the CFG builder keeps as a statement (a disable of an
        // enclosing named block is otherwise a jump, and any other target is
        // rejected there): of a procedural assertion label or of a process's
        // outermost block (16.14.6.4: clears the pending assertion instances,
        // see `lower_assertion_disable`), or `disable f;` in a branch of
        // fork `f`, which ends the fork's other branches; the branch itself
        // ends right after (`vj_sim::sched::real_sv_rt_disable_fork_block`).
        StatementKind::Disable => {
            let mut label = vj_sim::process::cfg::disable_leaf_label(stmt)
                .map_err(|e| LoweringError::unsupported_at(&e.to_string(), &cx.fn_sym))?;
            // `disable <deferred assertion label>` (16.4.4).
            if lower_deferred_disable(cx, &label)? {
                return Ok(());
            }
            // The label of an enclosing assertion block lowered as a leaf.
            if let Some(&(_, bb)) = cx.block_exits.iter().rev().find(|(n, _)| *n == label) {
                cx.b.build_unconditional_branch(bb).unwrap();
                return Ok(());
            }
            // `disable u1.blk;` (an instance path): the CFG walk registered the
            // dotted text as the broadcast name.
            if let Some(path) = vj_sim::process::cfg::disable_path(stmt) {
                let dotted = path.join(".");
                if ASSERTION_LOWERING.with(|c| {
                    c.borrow()
                        .as_ref()
                        .is_some_and(|a| a.disable_broadcast.iter().any(|(n, _)| *n == dotted))
                }) {
                    label = dotted;
                }
            }
            let keys = ASSERTION_LOWERING.with(|c| {
                c.borrow()
                    .as_ref()
                    .and_then(|a| a.disable_keys.get(&label).cloned())
            });
            // LRM 9.6.2: a block or task activation another process of the
            // instance may be inside (`ProcessCfg::disable_broadcast`).
            let broadcast = ASSERTION_LOWERING.with(|c| {
                c.borrow().as_ref().and_then(|a| {
                    a.disable_broadcast
                        .iter()
                        .find(|(n, _)| *n == label)
                        .map(|(_, whole)| *whole)
                })
            });
            if let Some(keys) = keys {
                lower_assertion_disable(cx, &keys)?;
                if broadcast.is_none() {
                    return Ok(());
                }
            }
            // LRM 9.6.2: a cross-process/fork-sibling target (this process's
            // own CFG walk could not resolve `label` to an enclosing block
            // or its own `fork_name`, but DID find it among the fork-branch
            // names `ProcessLoweringPlan::fork_branch_names` carries) --
            // `sv_rt_disable_named`, never the older, same-fork-only
            // `sv_rt_disable_fork_block` below.
            let is_cross_process = broadcast.is_some()
                || ASSERTION_LOWERING.with(|c| {
                    c.borrow()
                        .as_ref()
                        .is_some_and(|a| a.fork_branch_names.contains(&label))
                });
            if is_cross_process {
                let f = cx
                    .module
                    .get_function(SV_RT_DISABLE_NAMED_SYMBOL)
                    .unwrap_or_else(|| {
                        let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
                        let fn_ty = cx
                            .ctx
                            .void_type()
                            .fn_type(&[ptr_ty.into(), ptr_ty.into()], false);
                        cx.module.add_function(
                            SV_RT_DISABLE_NAMED_SYMBOL,
                            fn_ty,
                            Some(Linkage::External),
                        )
                    });
                let label_ptr =
                    cx.b.build_global_string_ptr(&label, "disable_named_label")
                        .unwrap()
                        .as_pointer_value();
                cx.b.build_call(
                    f,
                    &[handle.into(), label_ptr.into()],
                    "rt_disable_named_call",
                )
                .unwrap();
                if broadcast == Some(true) {
                    crate::vpi_dyn::emit_disable_probe(cx, stmt);
                }
                // The call ends the CALLING process itself when it (or an
                // ancestor of it) is among the live processes `label`
                // named (LRM 9.6.2) -- `real_sv_rt_disable_named` set the
                // abort flag for exactly that case; leave this kernel at
                // once, the same two-step `process::kill()` already uses
                // (`classes::process_call`'s `ProcessOp::Kill` arm).
                return crate::stmt_shared::leave_if_aborted(cx);
            }
            let f = cx
                .module
                .get_function(SV_RT_DISABLE_FORK_BLOCK_SYMBOL)
                .unwrap_or_else(|| {
                    let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
                    let fn_ty = cx.ctx.void_type().fn_type(&[ptr_ty.into()], false);
                    cx.module.add_function(
                        SV_RT_DISABLE_FORK_BLOCK_SYMBOL,
                        fn_ty,
                        Some(Linkage::External),
                    )
                });
            cx.b.build_call(f, &[handle.into()], "rt_disable_fork_block_call")
                .unwrap();
            crate::vpi_dyn::emit_disable_probe(cx, stmt);
            Ok(())
        }
        other => Err(LoweringError::unsupported_at(
            &format!(
                "statement kind {other:?} cannot appear in a Segment's own body under the A2 \
                 slice's grammar -- if/else and suspend points are already extracted into \
                 SegTerminator::CondGoto/Suspend by process::cfg::build_cfg (Task S3a); this \
                 is process::cfg's own \"ordinary straight-line statement\" fallback reaching \
                 an un-decomposed construct this crate's codegen does not lower"
            ),
            &cx.fn_sym,
        )),
    }
}

/// Task 7 (CG-082/PR-006): `->ev;`/`->>ev;` -- the named event's trigger
/// pulse. Reaches this leaf-statement dispatcher either as an ordinary,
/// undelayed leaf (`process::cfg::CfgBuilder::walk_event_trigger`'s own
/// "no `timing()` -> push as an ordinary leaf" arm) or as the sole leaf of a
/// `#n->>ev;`'s own resume segment (that same function's `Delay` arm) --
/// this dispatcher does not need to distinguish the two cases, since the
/// delay itself was already extracted into a real `SuspendPoint::Delay` by
/// `process::cfg` before this code ever runs; by the time an `EventTrigger`
/// statement reaches here, only the trigger write itself remains.
///
/// Lowers to `expr::lower_event_trigger`: a blocking write to the event's
/// 2-state cell (`vj_sim::state::EVENT_CELL_WIDTH`; trigger count + stamp
/// of the triggering tick) through the same shadow-`alloca`/`cx.locals`
/// mechanism every other blocking assignment to an external signal uses --
/// `external_refs_in_segment` records an `EventTrigger` target as written, so
/// the segment's `flush_external_signals` commits it. `@e` is an any-change
/// wait on that cell, so every flushed trigger wakes its waiters.
///
/// `->> e` (no delay) is lowered like `-> e`: the trigger becomes visible at
/// the end of the triggering segment, not in the NBA region.
fn lower_event_trigger_statement<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    handle: PointerValue<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    stmt: &Statement<'d>,
) -> Result<(), LoweringError> {
    let target = stmt.expressions().into_iter().next().ok_or_else(|| {
        LoweringError::unsupported_at(
            "EventTrigger statement has no target expression",
            &cx.fn_sym,
        )
    })?;
    if stmt.is_nonblocking_trigger() != Some(true) {
        return crate::expr::lower_event_trigger(cx, target);
    }
    // `->> [#d | @(ctl)] e;` (LRM 1800-2023 15.5.2): the trigger is a
    // nonblocking update, committed in the NBA region of its time step. `#d`
    // delays it by `d` ticks without blocking the issuer; an `@(ctl)` was
    // split off into a detached process by `process::cfg`, so by the time
    // this leaf runs the control has occurred and the trigger stages now.
    let mut delay = cx.ctx.i64_type().const_zero();
    if let Some(tc) = stmt.timing().and_then(|n| n.as_timing_control())
        && tc.kind() == sv_lang::kinds::TimingControlKind::Delay
    {
        let d = tc
            .children()
            .into_iter()
            .find_map(|n| n.as_expression())
            .ok_or_else(|| LoweringError::unsupported_at("delay with no value", &cx.fn_sym))?;
        delay = crate::timescale::lower_delay_ticks(cx, d)?;
    }
    // A class event is a runtime object, triggered through the scheduler.
    if crate::class_events::lower_trigger_nba(cx, target, delay)? {
        return Ok(());
    }
    let i32_ty = cx.ctx.i32_type();
    let (slot, row, has_row, valid) =
        if let Some(el) = crate::arrays::resolve_event_element(cx, target)? {
            let slot = el
                .slot
                .unwrap_or_else(|| i32_ty.const_int(u64::from(el.info.slot), false));
            (slot, el.row, 1u64, Some(el.valid))
        } else {
            let sym = target.referenced_symbol().ok_or_else(|| {
                LoweringError::unsupported_at(
                    "->> (nonblocking event trigger): unresolved event name",
                    &cx.fn_sym,
                )
            })?;
            // The same operand check `->` makes: a plain named event of this scope.
            crate::expr::event_cell_ptr(cx, target, "->> (nonblocking event trigger)")?;
            let info = signals.get(&sym.uid()).ok_or_else(|| {
                LoweringError::unsupported_at(
                    "->> (nonblocking event trigger): the event is not a module-level signal",
                    &sym,
                )
            })?;
            (
                i32_ty.const_int(u64::from(info.slot), false),
                cx.ctx.i64_type().const_zero(),
                0u64,
                None,
            )
        };
    let stage = || -> Result<(), LoweringError> {
        let f = rt_nba_pulse_fn(cx);
        cx.b.build_call(
            f,
            &[
                handle.into(),
                slot.into(),
                row.into(),
                i32_ty.const_int(has_row, false).into(),
                delay.into(),
            ],
            "rt_nba_pulse_call",
        )
        .unwrap();
        Ok(())
    };
    match valid {
        Some(valid) => crate::arrays::when_valid(cx, valid, stage),
        None => stage(),
    }
}

/// `void sv_rt_nba_pulse(SimHandle, u32 slot, u64 row, u32 has_row, u64 delay)`,
/// fetched or declared in the module being lowered.
fn rt_nba_pulse_fn<'ctx>(cx: &LowerCtx<'ctx, '_, '_>) -> FunctionValue<'ctx> {
    cx.module
        .get_function(SV_RT_NBA_PULSE_SYMBOL)
        .unwrap_or_else(|| {
            let ptr = cx.ctx.ptr_type(AddressSpace::default());
            let i32_ty = cx.ctx.i32_type();
            let i64_ty = cx.ctx.i64_type();
            let fn_ty = cx.ctx.void_type().fn_type(
                &[
                    ptr.into(),
                    i32_ty.into(),
                    i64_ty.into(),
                    i32_ty.into(),
                    i64_ty.into(),
                ],
                false,
            );
            cx.module
                .add_function(SV_RT_NBA_PULSE_SYMBOL, fn_ty, Some(Linkage::External))
        })
}

/// PR-065/PR-066/CG-119: a nonblocking (`<=`) assignment NEVER lowers to a
/// direct store or a `sv_set_scalar` call -- it stages the write via a call
/// to the new `nba_enqueue` extern fn (declared by [`declare_nba_enqueue`]),
/// reusing [`reposition_width_tight_to_fixed`] (the exact same FIXED-layout
/// repositioning `accessor::build_set_scalar` uses) so the staged `value: u128`
/// is in the one convention every accessor-ABI caller shares.
///
/// Slice-scope restriction: the lvalue must be a plain `NamedValue` resolving
/// to a known external (module-level) `plan.signals` entry -- a nonblocking
/// write to a process-local frame variable is legal SV but has no meaningful
/// staging target in this slice (no scheduler-visible cell backs it), so it
/// is a named [`LoweringError`], never silently treated as a local store.
/// A nonblocking assignment's intra-assignment delay in ticks (`q <= #d
/// v`), `None` without one. An event control (`q <= @(e) v`) is rejected:
/// it needs a write that waits on an event independently of the process.
/// For `lhs` naming an output clock variable (`cb.q`): the signal it
/// drives (its declaration's expression) and its output skew in ticks (the
/// block's default output skew when it declares none; `#0` when neither
/// does).
fn clocking_output<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    signals: &HashMap<SymbolId, SignalSlot>,
    lhs: sv_lang::Expression<'d>,
) -> Result<Option<ClockDrive<'ctx, 'd>>, LoweringError> {
    let Some(cv) = lhs
        .referenced_symbol()
        .filter(|s| s.kind() == sv_lang::kinds::SymbolKind::ClockVar)
    else {
        return Ok(None);
    };
    let target = cv
        .initializer()
        .ok_or_else(|| LoweringError::unsupported_at("a clock variable with no signal", &cv))?;
    let mut skew = cv.clock_var_output_skew();
    if !skew.has_value()
        && let Some(cb) = cv.parent()
    {
        skew = cb.clocking_block_default_output_skew();
    }
    let ticks = match skew
        .delay
        .and_then(|n| n.as_timing_control())
        .and_then(|tc| tc.children().into_iter().find_map(|n| n.as_expression()))
    {
        Some(d) => crate::timescale::lower_delay_ticks(cx, d)?,
        None => cx.ctx.i64_type().const_zero(),
    };
    // An edge output skew (`output negedge q`, LRM 14.4) drives at the next
    // such edge of the clocking event's signal (plus `ticks` for `output
    // negedge #1 q`, LRM 14.10's example), a time no static delay gives.
    let edge = match skew.edge {
        sv_lang::EdgeKind::None => None,
        kind @ (sv_lang::EdgeKind::PosEdge
        | sv_lang::EdgeKind::NegEdge
        | sv_lang::EdgeKind::BothEdges) => {
            let ev = cv
                .parent()
                .and_then(|cb| cb.clocking_block_event())
                .and_then(|n| n.as_timing_control())
                .ok_or_else(|| {
                    LoweringError::unsupported_at("a clocking block with no event", &cv)
                })?;
            let clock = vj_sim::sva::sampled::clock_event_of(ev)
                .map_err(|e| LoweringError::unsupported_at(&e.0, &cv))?;
            Some((clock.signal, kind))
        }
    };
    let vif_lhs = vj_sim::netlist::vif::is_member_access(&lhs).then_some(lhs);
    // 14.16: a drive that executes off its clocking event matures at the next
    // one. The block's event counter (bumped by the sampler when the event is
    // triggered) is what the run time waits on; a block this instance does
    // not own (hierarchical or virtual-interface drive) keeps the immediate
    // drive.
    let counter = if edge.is_none() && vif_lhs.is_none() {
        cv.parent()
            .and_then(|cb| signals.get(&cb.uid()))
            .map(|s| s.slot)
    } else {
        None
    };
    Ok(Some(ClockDrive {
        target,
        ticks,
        edge,
        counter,
        vif_lhs,
    }))
}

/// A synchronous drive of an output clock variable (LRM 1800-2023 14.16).
struct ClockDrive<'ctx, 'd> {
    /// The signal driven.
    target: sv_lang::Expression<'d>,
    /// The output skew in ticks (after the edge, for an edge skew).
    ticks: IntValue<'ctx>,
    /// An edge output skew: the clocking event's signal and the edge.
    edge: Option<(sv_lang::Expression<'d>, sv_lang::EdgeKind)>,
    /// A drive of a block of this instance without an edge skew: the slot of
    /// the block's event counter, the run time's "next clocking event" (14.16).
    counter: Option<u32>,
    /// The driven `vif.cb.m` when the drive goes through a virtual interface
    /// (its clock signal then differs per candidate instance).
    vif_lhs: Option<sv_lang::Expression<'d>>,
}

impl ClockDrive<'_, '_> {
    /// A skew-less drive through a virtual interface: it matures at the next
    /// event of the held instance's clocking block (14.16, 25.9.1).
    fn vif_counter(&self) -> bool {
        self.edge.is_none() && self.vif_lhs.is_some()
    }
}

/// The staging delay marking a drive that waits for a clock edge (the run-time
/// `sv_rt_reactive_drive` bracket carries the edge): the all-ones tick count,
/// which no real delay reaches.
const EDGE_DELAY: u64 = u64::MAX;

/// Opens (`open`) or closes the `sv_rt_reactive_drive` bracket of a clocking
/// drive. An edge skew's open call hands the scheduler its clock signal, edge
/// and post-edge ticks; the writes inside are staged with [`drive_delay`].
fn emit_reactive_drive<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    handle: PointerValue<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    drive: &ClockDrive<'ctx, '_>,
    open: bool,
) -> Result<(), LoweringError> {
    let i32_ty = cx.ctx.i32_type();
    let i64_ty = cx.ctx.i64_type();
    let f = cx
        .module
        .get_function(SV_RT_REACTIVE_DRIVE_SYMBOL)
        .unwrap_or_else(|| {
            let ptr = cx.ctx.ptr_type(AddressSpace::default());
            let fn_ty = cx.ctx.void_type().fn_type(
                &[
                    ptr.into(),
                    i32_ty.into(),
                    i32_ty.into(),
                    i32_ty.into(),
                    i64_ty.into(),
                ],
                false,
            );
            cx.module
                .add_function(SV_RT_REACTIVE_DRIVE_SYMBOL, fn_ty, Some(Linkage::External))
        });
    let (mut slot, mut code, mut after) = (i32_ty.const_zero(), 0u64, i64_ty.const_zero());
    if open && let Some((sig, kind)) = drive.edge {
        slot = if let Some(l) = drive.vif_lhs {
            // Through a virtual interface: the selected candidate's own clock.
            crate::vif::edge_clock_slot(cx, signals, l, false).ok_or_else(|| {
                LoweringError::unsupported_at("a virtual interface member access", &cx.fn_sym)
            })??
        } else {
            let sym = sig.referenced_symbol().ok_or_else(|| {
                LoweringError::unsupported_at(
                    "an edge output skew whose clocking event is not a plain signal",
                    &cx.fn_sym,
                )
            })?;
            let info = signals.get(&sym.uid()).ok_or_else(|| {
                LoweringError::unsupported_at(
                    "an edge output skew whose clock is not a module-level signal",
                    &sym,
                )
            })?;
            i32_ty.const_int(u64::from(info.slot), false)
        };
        code = match kind {
            sv_lang::EdgeKind::PosEdge => 1,
            sv_lang::EdgeKind::NegEdge => 2,
            sv_lang::EdgeKind::BothEdges => 3,
            sv_lang::EdgeKind::None => unreachable!("drive.edge is only set for an edge skew"),
        };
        after = drive.ticks;
    } else if open && drive.vif_counter() {
        slot = crate::vif::edge_clock_slot(cx, signals, drive.vif_lhs.expect("vif_counter"), true)
            .ok_or_else(|| {
                LoweringError::unsupported_at("a virtual interface member access", &cx.fn_sym)
            })??;
        code = 4;
        after = drive.ticks;
    } else if open && let Some(c) = drive.counter {
        slot = i32_ty.const_int(u64::from(c), false);
        code = 4;
        after = drive.ticks;
    }
    cx.b.build_call(
        f,
        &[
            handle.into(),
            i32_ty.const_int(u64::from(open), false).into(),
            slot.into(),
            i32_ty.const_int(code, false).into(),
            after.into(),
        ],
        "rt_reactive_drive",
    )
    .unwrap();
    Ok(())
}

/// The staging delay of a clocking drive's writes: its output skew in ticks,
/// or [`EDGE_DELAY`] for an edge skew.
fn drive_delay<'ctx>(cx: &LowerCtx<'ctx, '_, '_>, drive: &ClockDrive<'ctx, '_>) -> IntValue<'ctx> {
    if drive.edge.is_some() || drive.counter.is_some() || drive.vif_counter() {
        cx.ctx.i64_type().const_int(EDGE_DELAY, false)
    } else {
        drive.ticks
    }
}

/// Whether `lhs` names an output clock variable (`cb.q`), not a select of one
/// (`referenced_symbol` looks through selects to the root).
fn is_clock_var(lhs: sv_lang::Expression<'_>) -> bool {
    !matches!(
        lhs.kind(),
        ExpressionKind::ElementSelect | ExpressionKind::RangeSelect
    ) && lhs
        .referenced_symbol()
        .is_some_and(|s| s.kind() == sv_lang::kinds::SymbolKind::ClockVar)
}

/// The clock variable a drive's target is rooted in: `lhs` itself (`cb.q`) or
/// the clock variable under bit/part selects (`cb.q[3:0]`, `cb.q[i]`; LRM
/// 1800-2023 14.16's `clockvar_expression ::= hierarchical_identifier select`).
fn clock_var_root<'d>(mut lhs: sv_lang::Expression<'d>) -> Option<sv_lang::Expression<'d>> {
    while matches!(
        lhs.kind(),
        ExpressionKind::ElementSelect | ExpressionKind::RangeSelect
    ) {
        lhs = lhs.select_value()?;
    }
    is_clock_var(lhs).then_some(lhs)
}

pub(crate) fn nba_intra_delay<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    e: sv_lang::Expression<'_>,
) -> Result<Option<IntValue<'ctx>>, LoweringError> {
    let Some(node) = e.assignment_timing() else {
        return Ok(None);
    };
    let tc = node.as_timing_control().ok_or_else(|| {
        LoweringError::unsupported_at("assignment timing is not a timing control", &cx.fn_sym)
    })?;
    if tc.kind() != sv_lang::kinds::TimingControlKind::Delay {
        return Err(LoweringError::unsupported_at(
            &format!(
                "a nonblocking assignment with an intra-assignment {:?} control (only a delay, \
                 `q <= #d v`)",
                tc.kind()
            ),
            &cx.fn_sym,
        ));
    }
    let d = tc
        .children()
        .into_iter()
        .find_map(|n| n.as_expression())
        .ok_or_else(|| LoweringError::unsupported_at("delay with no value", &cx.fn_sym))?;
    crate::timescale::lower_delay_ticks(cx, d).map(Some)
}

pub(crate) fn lower_nonblocking_assignment<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    handle: PointerValue<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    nba_fn: FunctionValue<'ctx>,
    e: sv_lang::Expression<'d>,
) -> Result<(), LoweringError> {
    // A clocking drive (`cb.q <= v`) updates in the Re-NBA region (LRM
    // 1800-2023 14.16): its staged writes are bracketed for the scheduler.
    let drive = match e.left() {
        Some(l) => match clock_var_root(l) {
            Some(root) => clocking_output(cx, signals, root)?,
            None => None,
        },
        None => None,
    };
    let Some(drive) = drive else {
        return lower_nonblocking_assignment_inner(cx, handle, signals, nba_fn, e, None);
    };
    emit_reactive_drive(cx, handle, signals, &drive, true)?;
    lower_nonblocking_assignment_inner(cx, handle, signals, nba_fn, e, Some(&drive))?;
    emit_reactive_drive(cx, handle, signals, &drive, false)
}

fn lower_nonblocking_assignment_inner<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    handle: PointerValue<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    nba_fn: FunctionValue<'ctx>,
    e: sv_lang::Expression<'d>,
    drive: Option<&ClockDrive<'ctx, 'd>>,
) -> Result<(), LoweringError> {
    let lhs = e.left().ok_or_else(|| {
        LoweringError::unsupported_at("nonblocking assignment missing lvalue", &cx.fn_sym)
    })?;
    // `q <= #d v` (LRM 1800-2023 §10.4.2): `v` now, the write `d` ticks
    // later (staged through the masked path, which carries the delay).
    let delay = nba_intra_delay(cx, e)?;
    // A clocking block output (`cb.q <= v`, LRM 1800-2023 §14.16): a drive
    // of the clock variable's signal, its output skew after now.
    let (lhs, delay) = match drive {
        // Through a virtual interface (`vif.cb.d <= v`): each candidate's
        // own clock variable, retargeted by `crate::vif::lvalues`.
        Some(d) if vj_sim::netlist::vif::is_member_access(&lhs) => {
            (lhs, delay.or(Some(drive_delay(cx, d))))
        }
        // A select of the clock variable (`cb.q[3:0] <= v`): the select stays,
        // its root resolves to the clock variable's signal (`select::resolve_lvalue`).
        Some(d) if !is_clock_var(lhs) => (lhs, delay.or(Some(drive_delay(cx, d)))),
        Some(d) => (d.target, delay.or(Some(drive_delay(cx, d)))),
        None => (lhs, delay),
    };
    // A vector wider than `WIDE_THRESHOLD` (whole or a select of one): a
    // value image plus a mask image, staged through `sv_rt_nba_masked`.
    if crate::huge::rooted_in_huge(lhs) && crate::huge::huge_local_root(cx, lhs) {
        let rhs_expr = e.right().ok_or_else(|| {
            LoweringError::unsupported_at("nonblocking assignment missing rvalue", &cx.fn_sym)
        })?;
        let rhs = crate::collections::assigned_value(cx, lhs, rhs_expr)?;
        return crate::huge::lower_nba(
            cx,
            handle,
            signals,
            lhs,
            rhs,
            delay.unwrap_or_else(|| cx.ctx.i64_type().const_zero()),
        );
    }
    // A class property wider than the huge threshold (`obj.p <= v`, `obj.p[i] <= v`):
    // staged against the object.
    if crate::huge::rooted_in_huge(lhs)
        && crate::huge::class_prop_root(lhs)
        && !crate::huge::huge_local_root(cx, lhs)
    {
        let rhs_expr = e.right().ok_or_else(|| {
            LoweringError::unsupported_at("nonblocking assignment missing rvalue", &cx.fn_sym)
        })?;
        let rhs = crate::collections::assigned_value(cx, lhs, rhs_expr)?;
        return crate::huge::lower_nba_class_prop(
            cx,
            lhs,
            rhs,
            delay.unwrap_or_else(|| cx.ctx.i64_type().const_zero()),
        );
    }
    // An element of a module memory wider than the huge threshold (`m[i] <= v`,
    // `m[i][b] <= v`): staged against its row.
    if crate::huge::mem_elem_root(cx, lhs) {
        let rhs_expr = e.right().ok_or_else(|| {
            LoweringError::unsupported_at("nonblocking assignment missing rvalue", &cx.fn_sym)
        })?;
        let rhs = crate::collections::assigned_value(cx, lhs, rhs_expr)?;
        return crate::huge::lower_nba_mem_elem(
            cx,
            handle,
            lhs,
            rhs,
            delay.unwrap_or_else(|| cx.ctx.i64_type().const_zero()),
        );
    }
    // `{>>{q with [a +: n], x}} <= v`, `{>>{x}} <= q`: the stream is built
    // now in the runtime buffer; each fixed operand's bits and each
    // collection operand's new handle are staged (LRM 1800-2023 11.4.14.3,
    // 10.4.2).
    if lhs.kind() == ExpressionKind::Streaming
        && let Some(rhs_expr) = e.right()
        && crate::stream::nonblocking_needs_runtime(lhs, rhs_expr)
    {
        let delay = delay.unwrap_or_else(|| cx.ctx.i64_type().const_zero());
        return crate::stream::unpack_runtime_source(
            cx,
            lhs,
            rhs_expr,
            &mut |operand, with, bits| {
                if let Some(w) = with {
                    // `a with [...]` on a fixed-size array: each selected
                    // element is staged on its own.
                    return crate::stream_with::unpack_with(cx, operand, w, bits, &mut |row, v| {
                        crate::arrays::nba_stage_ref(cx, handle, row, v, delay)
                    });
                }
                crate::select::lower_nba_to(cx, handle, signals, operand, bits, delay)
            },
            Some(&mut |operand, new| {
                let h = crate::collections::handle_value(cx, new);
                crate::select::lower_nba_to(cx, handle, signals, operand, h, delay)
            }),
            Some(&mut |row, v| crate::arrays::nba_stage_ref(cx, handle, row, v, delay)),
        );
    }
    // A module memory, whole or part: one staged write per row.
    if let Some((dst, shape)) = crate::arrays::array_target(cx, lhs)? {
        let rhs_expr = e.right().ok_or_else(|| {
            LoweringError::unsupported_at("nonblocking assignment missing rvalue", &cx.fn_sym)
        })?;
        return crate::arrays::nba_array(
            cx,
            handle,
            dst,
            &shape,
            rhs_expr,
            delay.unwrap_or_else(|| cx.ctx.i64_type().const_zero()),
        );
    }
    // An element of a queue / dynamic array held by a module variable
    // (`a[2][k] <= v`): staged against the collection's handle.
    if let Some(rhs_expr) = e.right()
        && let Some(r) = crate::collections::nba_element(
            cx,
            handle,
            signals,
            lhs,
            rhs_expr,
            delay.unwrap_or_else(|| cx.ctx.i64_type().const_zero()),
        )
    {
        return r;
    }
    // Anything but a plain <=64-bit signal (a select, struct field, memory
    // element, concatenation, or a wide signal) is staged as a masked
    // partial write (`select::lower_nba_to`). Task 4b: a specify-path
    // VARIABLE destination is EXCLUDED from this fast path even when it is
    // otherwise a plain inline scalar -- this path calls `nba_fn`/
    // `rt_nba_masked` directly with `info.slot`, bypassing
    // `select::resolve_lvalue`'s own `RootMode::Signal` branch entirely
    // (the one place that consults `cx.specify_dest`'s staging-cell
    // redirect), so taking it for a redirected destination would silently
    // write straight to the signal instead of through the retimer.
    let plain_inline = vj_sim::symid::is_value_name(lhs.kind())
        && lhs.referenced_symbol().is_some_and(|s| {
            signals
                .get(&s.uid())
                .is_some_and(|info| info.class == SignalSlotClass::Inline)
                && !cx.specify_dest.contains_key(&s.uid())
        });
    if !plain_inline || delay.is_some() {
        let rhs_expr = e.right().ok_or_else(|| {
            LoweringError::unsupported_at("nonblocking assignment missing rvalue", &cx.fn_sym)
        })?;
        let width = lhs.expr_type().map(|t| t.value_width()).unwrap_or(0);
        let rhs_pv = crate::real::to_storage(
            cx,
            crate::collections::assigned_value(cx, lhs, rhs_expr)?,
            width,
            "nonblocking assignment of a >128-bit rvalue",
        )?;
        return crate::select::lower_nba_to(
            cx,
            handle,
            signals,
            lhs,
            rhs_pv,
            delay.unwrap_or_else(|| cx.ctx.i64_type().const_zero()),
        );
    }
    let sym = lhs.referenced_symbol().ok_or_else(|| {
        LoweringError::unsupported_at("nonblocking assignment lvalue unresolved name", &cx.fn_sym)
    })?;
    let info = *signals.get(&sym.uid()).ok_or_else(|| {
        LoweringError::unsupported_at(
            "PR-065/CG-119: a nonblocking assignment target must be an external (module-level) \
             signal in the A2 slice -- there is no meaningful NBA staging target among \
             process-local frame variables",
            &sym,
        )
    })?;
    let rhs_expr = e.right().ok_or_else(|| {
        LoweringError::unsupported_at("nonblocking assignment missing rvalue", &cx.fn_sym)
    })?;
    let rhs_pv = crate::real::to_storage(
        cx,
        crate::collections::assigned_value(cx, lhs, rhs_expr)?,
        info.width,
        "nonblocking assignment of a >128-bit rvalue",
    )?;
    let fixed = reposition_width_tight_to_fixed(cx, rhs_pv.llvm, info.width);
    let slot_const = cx.ctx.i32_type().const_int(u64::from(info.slot), false);
    // Task S4's own documented scope limit (see `vj-sim::sched::
    // kernel_adapter`'s module doc comment): the frozen `ProcessFn` ABI
    // carries no `ProcessId`, so every NBA staging call this crate emits
    // still passes a constant `0` for `source` here -- an ABI-breaking
    // change remains out of this task's authority. A2-part2 review-fix r1
    // closed the other half of that gap on the RUNTIME side instead:
    // `vj-sim::sched::kernel_adapter::real_nba_enqueue` no longer takes
    // this `0` at face value -- it prefers the real `ProcessId` its own
    // `CURRENT_PROCESS` ambient-state lookup supplies (installed by
    // `sched::resume::ResumeDriver::resume_for`/`start`, which already know
    // it), falling back to this raw value only for call shapes that bypass
    // `ResumeDriver` entirely. This constant is therefore not a source of
    // incorrect attribution in production, just a placeholder this crate's
    // own codegen has no ABI-legal way to fill in with anything else.
    let source_const = cx.ctx.i32_type().const_int(0, false);
    cx.b.build_call(
        nba_fn,
        &[
            handle.into(),
            slot_const.into(),
            fixed.into(),
            source_const.into(),
        ],
        "nba_enqueue_call",
    )
    .unwrap();
    Ok(())
}

/// Declares `extern "C" fn nba_enqueue(SimHandle, SlotId, u128, u32)`
/// (`vj_abi::process::{NbaEnqueueFn, NBA_ENQUEUE_SYMBOL}`) the same way
/// `accessor::declare_accessor_fns` declares the four accessor-ABI functions
/// -- `alwaysinline`, external linkage, resolved by the JIT/linker by name.
pub(crate) fn declare_nba_enqueue<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
) -> FunctionValue<'ctx> {
    let ptr_ty = ctx.ptr_type(AddressSpace::default());
    let i32_ty = ctx.i32_type();
    let i128_ty = ctx.i128_type();
    let void_ty = ctx.void_type();
    let fn_ty = void_ty.fn_type(
        &[ptr_ty.into(), i32_ty.into(), i128_ty.into(), i32_ty.into()],
        false,
    );
    let f = module.add_function(
        vj_abi::process::NBA_ENQUEUE_SYMBOL,
        fn_ty,
        Some(Linkage::External),
    );
    let kind_id = Attribute::get_named_enum_kind_id("alwaysinline");
    f.add_attribute(
        AttributeLoc::Function,
        ctx.create_enum_attribute(kind_id, 0),
    );
    f
}

/// Task S6 (CG-045): the three system-call shim functions `$display`/
/// `$write`/`$finish` statement lowering calls into, fetched-or-declared once
/// per `lower_process_cfg` call -- mirrors `nba_fn`'s own fetch-or-declare
/// discipline just above (a caller lowering several processes into one
/// shared `Module`, S7's future job, must not re-declare any of these a
/// second time under the same name).
pub(crate) struct SysCallFns<'ctx> {
    pub(crate) display: FunctionValue<'ctx>,
    pub(crate) write: FunctionValue<'ctx>,
    pub(crate) finish: FunctionValue<'ctx>,
    /// B-runtime Task 4 (RT-070/RT-162): `$dumpfile`/`$dumpflush` -- the only
    /// two of the seven `$dump*`-family system tasks given a recognizer arm
    /// this wave (see `vj_runtime::fst::dump_control`'s own module doc
    /// for why: the other five route through a `RuntimeHost` nothing in
    /// `vj::run_design` installs today, and lowering a real call
    /// site to them would abort a real compiled kernel's very first process
    /// activation instead of failing loudly at compile time).
    dumpfile: FunctionValue<'ctx>,
    dumpflush: FunctionValue<'ctx>,
    /// B-runtime Task 7 (RT-050/RT-051/RT-052/RT-053/RT-065): `$fclose`/
    /// `$fflush`'s own real production symbols (`vj_runtime::file_io`).
    /// `$fopen` itself needs no entry here -- it is a system FUNCTION,
    /// dispatched from the shared `expr::lower_expr` (`expr::
    /// lower_fopen_call`), which every segment statement already reaches
    /// through `lower_expr`/`lower_nonblocking_assignment`'s own RHS
    /// lowering, not through this statement-only table.
    fclose: FunctionValue<'ctx>,
    fflush: FunctionValue<'ctx>,
    /// B-runtime Task 8 (RT-022/RT-049/RT-054/RT-055/RT-056/RT-057):
    /// `$fwrite`/`$fdisplay`/`$fmonitor`/`$fstrobe`'s own real production
    /// symbols (`vj_runtime::file_io::write`).
    fwrite: FunctionValue<'ctx>,
    fdisplay: FunctionValue<'ctx>,
    /// Declared (keeps the symbol in the module) but `$fmonitor` now lowers
    /// through the postponed `fstrobe` writer.
    #[allow(dead_code)]
    fmonitor: FunctionValue<'ctx>,
    fstrobe: FunctionValue<'ctx>,
}

/// This task's own new symbol (no existing pinned ABI names one, unlike
/// `sv_rt_display`/`sv_rt_write` below): see [`declare_rt_finish`]'s own doc
/// comment for the scope decision this name's real (production) wiring is
/// deliberately deferred by.
pub const SV_RT_FINISH_SYMBOL: &str = "sv_rt_finish";

/// `disable fork;` (SC-125): `void sv_rt_disable_fork(SimHandle)`, bound to
/// `vj_sim::sched::real_sv_rt_disable_fork`.
pub const SV_RT_DISABLE_FORK_SYMBOL: &str = "sv_rt_disable_fork";

/// `void sv_rt_disable_fork_block(SimHandle)`: `disable f;` in a branch of
/// fork `f`, bound to `vj_sim::sched::real_sv_rt_disable_fork_block`.
pub const SV_RT_DISABLE_FORK_BLOCK_SYMBOL: &str = "sv_rt_disable_fork_block";

/// `void sv_rt_disable_named(SimHandle, ptr label, i64 len)` (LRM 9.6.2): a
/// `disable <label>;` resolved against [`ProcessLoweringPlan::
/// fork_branch_names`] -- a fork-spawned branch's own name, reachable from
/// the parent (after the fork), a sibling branch, or an ancestor fork's
/// descendant, never just the SAME fork `self.fork_name` already covers.
/// Bound to `vj_sim::sched::real_sv_rt_disable_named`.
pub const SV_RT_DISABLE_NAMED_SYMBOL: &str = "sv_rt_disable_named";

/// `$dumpvars(levels, scope, ...)`: `void sv_rt_dump_vars(i32 levels, const
/// char *scopes)` (`vj::dump`), `scopes` the selected scopes'
/// hierarchical paths joined by newlines (empty: the whole design).
pub const SV_RT_DUMP_VARS_SYMBOL: &str = "sv_rt_dump_vars";

/// `$dumpon`/`$dumpoff`/`$dumpall`/`$dumplimit`: `void sv_rt_dump_ctl(u32 op,
/// u64 arg)` (`vj::dump`).
pub const SV_RT_DUMP_CTL_SYMBOL: &str = "sv_rt_dump_ctl";

fn lower_dumpvars_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    call: Expression<'d>,
) -> Result<(), LoweringError> {
    let operands = call.operands();
    let i32_ty = cx.ctx.i32_type();
    let (levels, scopes) = match operands.split_first() {
        None => (i32_ty.const_zero(), &[][..]),
        Some((first, rest)) => {
            let constant = first
                .constant_value()
                .as_ref()
                .and_then(sv_lang::ConstantValue::as_integer)
                .and_then(sv_lang::SVInt::as_i64);
            let levels = if let Some(c) = constant {
                i32_ty.const_int(c as u64, true)
            } else {
                // LRM 21.7.2.1: `levels` is an expression like any argument;
                // a run-time value is read when the call executes.
                let pv = lower_expr(cx, *first)?.into_packed(
                    "$dumpvars's levels argument must be an integral value",
                    &cx.fn_sym,
                )?;
                let op_b = OpBuilder {
                    ctx: cx.ctx,
                    b: &cx.b,
                };
                let val = op_b.lane_val(pv);
                cx.b.build_int_cast_sign_flag(val, i32_ty, pv.signed, "dumpvars_levels")
                    .unwrap()
            };
            (levels, rest)
        }
    };
    let mut paths = Vec::new();
    for scope in scopes {
        let sym = scope
            .arbitrary_symbol()
            .or_else(|| scope.referenced_symbol())
            .ok_or_else(|| {
                LoweringError::unsupported_at(
                    "$dumpvars scope argument must name a module instance or a variable",
                    &cx.fn_sym,
                )
            })?;
        paths.push(sym.hierarchical_path());
    }
    let text = paths.join("\n");
    let scopes_ptr =
        cx.b.build_global_string_ptr(&text, "dumpvars_scopes")
            .unwrap()
            .as_pointer_value();
    let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
    let f = cx
        .module
        .get_function(SV_RT_DUMP_VARS_SYMBOL)
        .unwrap_or_else(|| {
            cx.module.add_function(
                SV_RT_DUMP_VARS_SYMBOL,
                cx.ctx
                    .void_type()
                    .fn_type(&[i32_ty.into(), ptr_ty.into()], false),
                Some(Linkage::External),
            )
        });
    cx.b.build_call(f, &[levels.into(), scopes_ptr.into()], "rt_dump_vars")
        .unwrap();
    Ok(())
}

/// `$dumpports`, `$dumpportsoff`/`on`/`all`/`limit`/`flush` (LRM 21.7.3):
/// `void sv_rt_dump_ports(u32 op, u64 arg, const char *scopes, const char
/// *file)` (`vj_exec::dump::sv_rt_dump_ports`; `op` as documented there).
pub const SV_RT_DUMP_PORTS_SYMBOL: &str = "sv_rt_dump_ports";

/// Lowers one `$dumpports` family call. `$dumpports(scope, file)` names the
/// module instance (default: the calling module, LRM 21.7.3.1) and the file
/// (a string literal, `string` or integral character string, evaluated at
/// the call; default `dumpports.vcd`); the control tasks take the file
/// (`$dumpportslimit(size, file)`; no file: every `$dumpports` file).
fn lower_dumpports_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    call: Expression<'d>,
    op: u64,
) -> Result<(), LoweringError> {
    let operands = call.operands();
    let is_instance = |e: &Expression<'d>| {
        e.arbitrary_symbol()
            .or_else(|| e.referenced_symbol())
            .is_some_and(|sym| sym.kind() == sv_lang::kinds::SymbolKind::Instance)
    };
    // `$dumpports([scope_list] [, file_name])` (LRM 21.7.3): the leading operands that
    // name module instances are the scope list, a following operand is the file name.
    let mut scope_exprs: Vec<Expression<'d>> = Vec::new();
    let (arg_expr, file_expr) = match (op, operands.as_slice()) {
        (0, ops) => {
            let n = ops.iter().take_while(|e| is_instance(e)).count();
            scope_exprs.extend(ops[..n].iter().copied());
            match &ops[n..] {
                [] => (None, None),
                [file] => (None, Some(*file)),
                _ => {
                    return Err(LoweringError::unsupported_at(
                        "$dumpports scope argument must name a module instance (LRM 21.7.3.1)",
                        &cx.fn_sym,
                    ));
                }
            }
        }
        (4, [size]) => (Some(*size), None),
        (4, [size, file]) => (Some(*size), Some(*file)),
        (1 | 2 | 3 | 5, []) => (None, None),
        (1 | 2 | 3 | 5, [file]) => (None, Some(*file)),
        _ => {
            return Err(LoweringError::unsupported_at(
                "$dumpports-family control call with an argument list this simulator does not \
                 support (LRM 21.7.3 gives one file name)",
                &cx.fn_sym,
            ));
        }
    };
    let i64_ty = cx.ctx.i64_type();
    let arg_v = match arg_expr {
        None => i64_ty.const_zero(),
        Some(e) => {
            let pv = lower_expr(cx, e)?.into_packed(
                "$dumpportslimit's byte count must be an integral value",
                &cx.fn_sym,
            )?;
            let op_b = OpBuilder {
                ctx: cx.ctx,
                b: &cx.b,
            };
            let val = op_b.lane_val(pv);
            cx.b.build_int_z_extend_or_bit_cast(val, i64_ty, "dumpportslimit_arg")
                .unwrap()
        }
    };
    let scope_path = if !scope_exprs.is_empty() {
        scope_exprs
            .iter()
            .map(|s| {
                s.arbitrary_symbol()
                    .or_else(|| s.referenced_symbol())
                    .map(|sym| sym.hierarchical_path())
                    .expect("is_instance checked the symbol")
            })
            .collect::<Vec<_>>()
            .join("\n")
    } else if op == 0 {
        enclosing_instance_body(&cx.fn_sym)
            .and_then(|b| b.parent())
            .map(|i| i.hierarchical_path())
            .ok_or_else(|| {
                LoweringError::unsupported_at(
                    "$dumpports outside a module has no scope to dump",
                    &cx.fn_sym,
                )
            })?
    } else {
        String::new()
    };
    let scopes_ptr =
        cx.b.build_global_string_ptr(&scope_path, "dumpports_scope")
            .unwrap()
            .as_pointer_value();
    let file_ptr = match file_expr {
        Some(f) => crate::systask::lower_format_expr(cx, f)?,
        None => {
            cx.b.build_global_string_ptr("", "dumpports_nofile")
                .unwrap()
                .as_pointer_value()
        }
    };
    let i32_ty = cx.ctx.i32_type();
    let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
    let f = cx
        .module
        .get_function(SV_RT_DUMP_PORTS_SYMBOL)
        .unwrap_or_else(|| {
            cx.module.add_function(
                SV_RT_DUMP_PORTS_SYMBOL,
                cx.ctx.void_type().fn_type(
                    &[i32_ty.into(), i64_ty.into(), ptr_ty.into(), ptr_ty.into()],
                    false,
                ),
                Some(Linkage::External),
            )
        });
    cx.b.build_call(
        f,
        &[
            i32_ty.const_int(op, false).into(),
            arg_v.into(),
            scopes_ptr.into(),
            file_ptr.into(),
        ],
        "rt_dump_ports",
    )
    .unwrap();
    Ok(())
}

/// The `InstanceBody` that encloses `sym` (the design element a system task
/// written in `sym`'s scope belongs to).
fn enclosing_instance_body<'d>(sym: &sv_lang::Symbol<'d>) -> Option<sv_lang::Symbol<'d>> {
    if sym.kind() == sv_lang::kinds::SymbolKind::Instance {
        return sym.instance_body();
    }
    let mut cur = Some(*sym);
    while let Some(s) = cur {
        if s.kind() == sv_lang::kinds::SymbolKind::InstanceBody {
            return Some(s);
        }
        cur = s.parent();
    }
    None
}

/// `$printtimescale[(module_path)]` (LRM 1800-2023 §20.4.1): prints
/// `Time scale of (path) is 1ns / 1ps`. The scale and the path are known at
/// compile time, so the line is a constant `$display`. Without an argument
/// the enclosing module (or `$unit::` for a compilation-unit subroutine) is
/// reported.
pub(crate) fn lower_printtimescale_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    display: FunctionValue<'ctx>,
    e: Expression<'d>,
) -> Result<(), LoweringError> {
    use sv_lang::kinds::SymbolKind;
    // `start`: where the scale is looked up (a `` `timescale `` directive
    // lands on the subroutine or module declared after it, not on `$unit`).
    let (target, start) = match e.operands().first() {
        Some(a) => {
            let s = a.arbitrary_symbol().ok_or_else(|| {
                LoweringError::unsupported_at(
                    "$printtimescale argument must name a module or instance",
                    &cx.fn_sym,
                )
            })?;
            (s, s)
        }
        None => {
            // The nearest enclosing instance, or the compilation unit.
            let start = e.system_call_scope().unwrap_or(cx.fn_sym);
            let mut cur = start;
            while !matches!(
                cur.kind(),
                SymbolKind::InstanceBody | SymbolKind::CompilationUnit | SymbolKind::Package
            ) {
                match cur.parent() {
                    Some(p) => cur = p,
                    None => break,
                }
            }
            (cur, start)
        }
    };
    let name = if target.kind() == SymbolKind::CompilationUnit {
        "$unit::".to_string()
    } else if target.kind() == SymbolKind::Package {
        format!("{}::", target.name())
    } else {
        vj_sim::process::cfg::shown_path(&target)
    };
    let line = format!(
        "Time scale of ({}) is {}",
        name.replace('%', "%%"),
        crate::timescale::scale_text_at(&start)
    );
    let fmt = build_c_string_global(cx.ctx, cx.module, &line, "printtimescale_fmt");
    let rtarg_ty = crate::systask::rtarg_llvm_type(cx.ctx);
    let (args_ptr, n) = crate::systask::build_rtarg_array(cx, rtarg_ty, Vec::new())?;
    cx.b.build_call(
        display,
        &[fmt.into(), args_ptr.into(), n.into()],
        "rt_printtimescale",
    )
    .unwrap();
    Ok(())
}

/// `$stacktrace` (LRM 1800-2023 20.17): the content is tool-defined. The
/// process's frames are not materialised at run time, so this prints one
/// line naming the lexical scope of the call (the innermost frame).
pub(crate) fn lower_stacktrace_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    display: FunctionValue<'ctx>,
) -> Result<(), LoweringError> {
    let line = format!(
        "Stack trace:\n  at {}",
        vj_sim::process::cfg::shown_path(&cx.fn_sym).replace('%', "%%")
    );
    let fmt = build_c_string_global(cx.ctx, cx.module, &line, "stacktrace_fmt");
    let rtarg_ty = crate::systask::rtarg_llvm_type(cx.ctx);
    let (args_ptr, n) = crate::systask::build_rtarg_array(cx, rtarg_ty, Vec::new())?;
    cx.b.build_call(
        display,
        &[fmt.into(), args_ptr.into(), n.into()],
        "rt_stacktrace",
    )
    .unwrap();
    Ok(())
}

/// `$exit` (LRM 1800-2023 20.2, 24.7): terminates the initial procedures of
/// the calling program block. Called from anything that is not a program
/// thread it "shall be ignored", so outside a `program` it is a no-op; inside
/// one it is `sv_rt_disable_named` with [`EXIT_PROGRAM_LABEL`], which ends
/// every program `initial` thread of the caller's program instance (and the
/// fork descendants), then leaves this kernel when the caller is among them.
fn lower_exit_call<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    handle: PointerValue<'ctx>,
    sys_fns: &SysCallFns<'ctx>,
    e: sv_lang::Expression<'d>,
) -> Result<(), LoweringError> {
    let in_program = enclosing_instance_body(&cx.fn_sym)
        .and_then(|b| b.instance_body_definition())
        .is_some_and(|d| d.definition_kind() == Some(sv_lang::DefinitionKind::Program));
    if !in_program {
        return Ok(());
    }
    // The implicit `$finish` (default argument 1, Table 20-1) is reported at the `$exit`
    // call, the point where the program stops.
    lower_finish_diag(cx, sys_fns, e, 1, "$finish")?;
    let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
    let f = cx
        .module
        .get_function(SV_RT_DISABLE_NAMED_SYMBOL)
        .unwrap_or_else(|| {
            cx.module.add_function(
                SV_RT_DISABLE_NAMED_SYMBOL,
                cx.ctx
                    .void_type()
                    .fn_type(&[ptr_ty.into(), ptr_ty.into()], false),
                Some(Linkage::External),
            )
        });
    let label_ptr =
        cx.b.build_global_string_ptr(vj_sim::sched::EXIT_PROGRAM_LABEL, "exit_label")
            .unwrap()
            .as_pointer_value();
    cx.b.build_call(f, &[handle.into(), label_ptr.into()], "rt_exit_program")
        .unwrap();
    crate::stmt_shared::leave_if_aborted(cx)
}

/// `$timeformat(units, precision, suffix, min_width)` (LRM 1800-2023
/// §20.4.2): `sv_rt_timeformat`; the argument-less form restores the default
/// (`units == i32::MIN`).
fn lower_timeformat_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: Expression<'d>,
) -> Result<(), LoweringError> {
    let i32_ty = cx.ctx.i32_type();
    let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
    let args = e.operands();
    let int_arg = |k: usize, default: i64| -> Result<IntValue<'ctx>, LoweringError> {
        match args
            .get(k)
            .filter(|a| a.kind() != ExpressionKind::EmptyArgument)
        {
            Some(a) => {
                let pv = lower_expr(cx, *a)?
                    .into_packed("a $timeformat argument must be integral", &cx.fn_sym)?;
                let op = OpBuilder {
                    ctx: cx.ctx,
                    b: &cx.b,
                };
                Ok(crate::expr::packed_to_plain_i32(&op, pv))
            }
            None => Ok(i32_ty.const_int(default as u64, true)),
        }
    };
    let (units, precision, suffix, width) = if args.is_empty() {
        (
            i32_ty.const_int(i32::MIN as u64, true),
            i32_ty.const_zero(),
            ptr_ty.const_null(),
            i32_ty.const_int(20, false),
        )
    } else {
        let suffix = match args
            .get(2)
            .filter(|a| a.kind() != ExpressionKind::EmptyArgument)
        {
            Some(s) => crate::systask::lower_format_expr(cx, *s)?,
            None => ptr_ty.const_null(),
        };
        (int_arg(0, 0)?, int_arg(1, 0)?, suffix, int_arg(3, 20)?)
    };
    let f = cx
        .module
        .get_function(vj_runtime::timefmt::SV_RT_TIMEFORMAT_SYMBOL)
        .unwrap_or_else(|| {
            cx.module.add_function(
                vj_runtime::timefmt::SV_RT_TIMEFORMAT_SYMBOL,
                cx.ctx.void_type().fn_type(
                    &[i32_ty.into(), i32_ty.into(), ptr_ty.into(), i32_ty.into()],
                    false,
                ),
                Some(Linkage::External),
            )
        });
    cx.b.build_call(
        f,
        &[units.into(), precision.into(), suffix.into(), width.into()],
        "rt_timeformat",
    )
    .unwrap();
    Ok(())
}

fn lower_dump_ctl_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    op: u64,
    arg: Option<Expression<'d>>,
) -> Result<(), LoweringError> {
    let i32_ty = cx.ctx.i32_type();
    let i64_ty = cx.ctx.i64_type();
    let arg_v = match arg {
        None => i64_ty.const_zero(),
        Some(e) => {
            let pv = lower_expr(cx, e)?.into_packed(
                "$dumplimit's byte count must be an integral value",
                &cx.fn_sym,
            )?;
            let op_b = OpBuilder {
                ctx: cx.ctx,
                b: &cx.b,
            };
            let val = op_b.lane_val(pv);
            cx.b.build_int_z_extend_or_bit_cast(val, i64_ty, "dumplimit_arg")
                .unwrap()
        }
    };
    let f = cx
        .module
        .get_function(SV_RT_DUMP_CTL_SYMBOL)
        .unwrap_or_else(|| {
            cx.module.add_function(
                SV_RT_DUMP_CTL_SYMBOL,
                cx.ctx
                    .void_type()
                    .fn_type(&[i32_ty.into(), i64_ty.into()], false),
                Some(Linkage::External),
            )
        });
    cx.b.build_call(
        f,
        &[i32_ty.const_int(op, false).into(), arg_v.into()],
        "rt_dump_ctl",
    )
    .unwrap();
    Ok(())
}

/// A nonblocking write to a select / memory element / concatenation / >64-bit
/// signal (`select::lower_nba_to`): `sv_rt_nba_masked`, bound to
/// `vj_sim::sched::real_sv_rt_nba_masked`.
pub const SV_RT_NBA_MASKED_SYMBOL: &str = "sv_rt_nba_masked";
/// A nonblocking event trigger (`->> e`): `sv_rt_nba_pulse`, bound to
/// `vj_sim::sched::real_sv_rt_nba_pulse`.
pub const SV_RT_NBA_PULSE_SYMBOL: &str = "sv_rt_nba_pulse";
/// `void sv_rt_reactive_drive(SimHandle, u32 on, u32 clock_slot, u32 edge, u64
/// after)`: brackets the nonblocking writes of a clocking-block synchronous
/// drive, which update in the Re-NBA region (LRM 1800-2023 14.16); a nonzero
/// `edge` (1 pos, 2 neg, 3 either) is an edge output skew (14.4), whose writes
/// (delay `EDGE_DELAY`) land `after` ticks past the next such edge of the
/// clock signal in `clock_slot`; bound to `vj_sim::sched::real_sv_rt_reactive_drive`.
pub const SV_RT_REACTIVE_DRIVE_SYMBOL: &str = "sv_rt_reactive_drive";
/// A nonblocking write of a queue / dynamic-array element
/// (`a[2][k] <= v`): `sv_rt_nba_coll`, bound to
/// `vj_sim::sched::real_sv_rt_nba_coll`.
pub const SV_RT_NBA_COLL_SYMBOL: &str = "sv_rt_nba_coll";

/// `void sv_rt_set_delay(u64 ticks)`: a run-time delay's tick count, stored
/// just before the kernel suspends on it (`ResolvedSuspend::DynamicDelay`),
/// bound to `vj_sim::sched::real_sv_rt_set_delay`.
pub const SV_RT_SET_DELAY_SYMBOL: &str = "sv_rt_set_delay";

/// `i64 sv_rt_fired_term()`: which term of its event wait woke the kernel,
/// bound to `vj_sim::sched::real_sv_rt_fired_term`.
pub const SV_RT_FIRED_TERM_SYMBOL: &str = "sv_rt_fired_term";

/// `i64 sv_rt_fired_mask()`: every term (bit k = term k) of its event wait
/// that matched before the kernel resumed, bound to
/// `vj_sim::sched::real_sv_rt_fired_mask`.
pub const SV_RT_FIRED_MASK_SYMBOL: &str = "sv_rt_fired_mask";
/// `void sv_rt_proc_assert(i64 key, ptr values, i64 n)`: a procedural
/// concurrent assertion reached, with its captured values (16.14.6).
pub const SV_RT_PROC_ASSERT_SYMBOL: &str = "sv_rt_proc_assert";
/// `void sv_rt_proc_assert_disable(ptr keys, i64 n)`: `disable` of procedural
/// concurrent assertions (16.14.6.4): clears the pending instances of the `n`
/// assertions `keys` names.
pub const SV_RT_PROC_ASSERT_DISABLE_SYMBOL: &str = "sv_rt_proc_assert_disable";
/// `SimHandle sv_rt_slot_owner(SimHandle, SlotId)`: the instance a foreign
/// slot of the running instance belongs to (a hierarchical call's callee
/// handle, LRM 23.6).
pub const SV_RT_SLOT_OWNER_SYMBOL: &str = "sv_rt_slot_owner";
/// `i64 sv_rt_assert_input(i64 k)`: the `k`th captured value of the attempt
/// whose action block is running.
pub const SV_RT_ASSERT_INPUT_SYMBOL: &str = "sv_rt_assert_input";

/// `ptr sv_rt_cell_alloc(i64 bytes)`: a new cell for a variable a process
/// shares with its fork branches, bound to
/// `vj_sim::sched::real_sv_rt_cell_alloc`.
pub const SV_RT_CELL_ALLOC_SYMBOL: &str = "sv_rt_cell_alloc";

/// A compiled fork branch: its kernel index, its frame's word count, and
/// the (parent word, child word) of each variable it shares with its parent,
/// and its `ProcessCfg::disable_scopes` as `(resume pc, label, exit pc)` (a
/// `disable` of a block nested in the branch, LRM 9.6.2).
pub type BranchFrame = (u32, u32, Vec<(u32, u32)>, Vec<(u32, String, u32)>);

/// `void sv_rt_cell_store(ptr cell, ptr value, i64 bytes)`: a shared
/// variable's value into its cell, waking waiters if it changed; bound to
/// `vj_sim::sched::real_sv_rt_cell_store`.
pub const SV_RT_CELL_STORE_SYMBOL: &str = "sv_rt_cell_store";

/// `void sv_rt_edge_snapshot(i64 frame, i64 site, ptr value, i64 bytes)` /
/// `i32 sv_rt_edge_check(i64 frame, i64 site, ptr value, i64 bytes, i32
/// width, i32 edge)`: an event control on a variable shared between
/// processes (`vj_sim::sched::real_sv_rt_edge_*`).
pub const SV_RT_EDGE_SNAPSHOT_SYMBOL: &str = "sv_rt_edge_snapshot";
pub const SV_RT_EDGE_CHECK_SYMBOL: &str = "sv_rt_edge_check";
/// `void sv_rt_edge_load(i64 frame, i64 site, ptr out, i64 bytes)` /
/// The value of `sv_rt_fired_term()` now (a call in the builder's block).
fn fired_now_value<'ctx>(
    b: &inkwell::builder::Builder<'ctx>,
    fired_fn: FunctionValue<'ctx>,
) -> inkwell::values::IntValue<'ctx> {
    b.build_call(fired_fn, &[], "fired_now")
        .unwrap()
        .try_as_basic_value()
        .unwrap_basic()
        .into_int_value()
}

/// `void sv_rt_set_fired_term(i64 term)`: the resume guard of a wait on named
/// event array elements (`vj_sim::sched::real_sv_rt_edge_load` /
/// `real_sv_rt_set_fired_term`).
pub const SV_RT_EDGE_LOAD_SYMBOL: &str = "sv_rt_edge_load";
pub const SV_RT_SET_FIRED_TERM_SYMBOL: &str = "sv_rt_set_fired_term";

/// `i32 sv_rt_aborted()`: whether the running process has ended the run,
/// bound to `vj_sim::sched::real_sv_rt_aborted`.
pub const SV_RT_ABORTED_SYMBOL: &str = "sv_rt_aborted";

/// `u64 sv_rt_deferred_begin()` / `void sv_rt_deferred_end(u64 start, u64
/// site, u32 is_final)`: a deferred assertion's action output is captured
/// and reported at the end of the time step (`vj_sim::sched::deferred`).
pub const SV_RT_DEFERRED_BEGIN_SYMBOL: &str = "sv_rt_deferred_begin";
pub const SV_RT_DEFERRED_END_SYMBOL: &str = "sv_rt_deferred_end";

pub(crate) fn fetch_or_declare_sys_call_fns<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
) -> SysCallFns<'ctx> {
    let display = module
        .get_function(vj_runtime::rtarg::SV_RT_DISPLAY_SYMBOL)
        .unwrap_or_else(|| {
            declare_rt_display_like(ctx, module, vj_runtime::rtarg::SV_RT_DISPLAY_SYMBOL)
        });
    let write = module
        .get_function(vj_runtime::rtarg::SV_RT_WRITE_SYMBOL)
        .unwrap_or_else(|| {
            declare_rt_display_like(ctx, module, vj_runtime::rtarg::SV_RT_WRITE_SYMBOL)
        });
    let finish = module
        .get_function(SV_RT_FINISH_SYMBOL)
        .unwrap_or_else(|| declare_rt_finish(ctx, module));
    let dumpfile = module
        .get_function(vj_runtime::fst::SV_RT_DUMPFILE_SYMBOL)
        .unwrap_or_else(|| {
            declare_dump_control_fn(ctx, module, vj_runtime::fst::SV_RT_DUMPFILE_SYMBOL, true)
        });
    let dumpflush = module
        .get_function(vj_runtime::fst::SV_RT_DUMPFLUSH_SYMBOL)
        .unwrap_or_else(|| {
            declare_dump_control_fn(ctx, module, vj_runtime::fst::SV_RT_DUMPFLUSH_SYMBOL, false)
        });
    let fclose = module
        .get_function(vj_runtime::file_io::SV_RT_FCLOSE_SYMBOL)
        .unwrap_or_else(|| {
            declare_file_io_void_fn(ctx, module, vj_runtime::file_io::SV_RT_FCLOSE_SYMBOL)
        });
    let fflush = module
        .get_function(vj_runtime::file_io::SV_RT_FFLUSH_SYMBOL)
        .unwrap_or_else(|| {
            declare_file_io_void_fn(ctx, module, vj_runtime::file_io::SV_RT_FFLUSH_SYMBOL)
        });
    let fwrite = module
        .get_function(vj_runtime::file_io::SV_RT_FWRITE_SYMBOL)
        .unwrap_or_else(|| {
            declare_rt_fdisplay_like(ctx, module, vj_runtime::file_io::SV_RT_FWRITE_SYMBOL)
        });
    let fdisplay = module
        .get_function(vj_runtime::file_io::SV_RT_FDISPLAY_SYMBOL)
        .unwrap_or_else(|| {
            declare_rt_fdisplay_like(ctx, module, vj_runtime::file_io::SV_RT_FDISPLAY_SYMBOL)
        });
    let fmonitor = module
        .get_function(vj_runtime::file_io::SV_RT_FMONITOR_SYMBOL)
        .unwrap_or_else(|| {
            declare_rt_fdisplay_like(ctx, module, vj_runtime::file_io::SV_RT_FMONITOR_SYMBOL)
        });
    let fstrobe = module
        .get_function(vj_runtime::file_io::SV_RT_FSTROBE_SYMBOL)
        .unwrap_or_else(|| {
            declare_rt_fdisplay_like(ctx, module, vj_runtime::file_io::SV_RT_FSTROBE_SYMBOL)
        });
    SysCallFns {
        display,
        write,
        finish,
        dumpfile,
        dumpflush,
        fclose,
        fflush,
        fwrite,
        fdisplay,
        fmonitor,
        fstrobe,
    }
}

/// Declares one of `sv_rt_fwrite`/`sv_rt_fdisplay`/`sv_rt_fmonitor`/
/// `sv_rt_fstrobe` -- `void sv_rt_f<family>(int32_t fd, const char *fmt,
/// const RtArg *args, uint32_t nargs)` (`vj_runtime::file_io::write`'s
/// own doc comment: the frozen ABI's `$display`-family shape with one
/// prepended `fd: i32` MCD-bitmask argument). Mirrors
/// [`declare_rt_display_like`]'s identical fetch-or-declare discipline just
/// below.
fn declare_rt_fdisplay_like<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    symbol: &str,
) -> FunctionValue<'ctx> {
    let i32_ty = ctx.i32_type();
    let ptr_ty = ctx.ptr_type(AddressSpace::default());
    let void_ty = ctx.void_type();
    let fn_ty = void_ty.fn_type(
        &[i32_ty.into(), ptr_ty.into(), ptr_ty.into(), i32_ty.into()],
        false,
    );
    module.add_function(symbol, fn_ty, Some(Linkage::External))
}

/// Declares `void sv_rt_fclose(int32_t fd)` / `void sv_rt_fflush(int32_t
/// fd)` -- mirrors [`declare_dump_control_fn`]'s identical fetch-or-declare
/// discipline just above.
fn declare_file_io_void_fn<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    symbol: &str,
) -> FunctionValue<'ctx> {
    let void_ty = ctx.void_type();
    let i32_ty = ctx.i32_type();
    let fn_ty = void_ty.fn_type(&[i32_ty.into()], false);
    module.add_function(symbol, fn_ty, Some(Linkage::External))
}

/// Declares the `extern "C"` shim function for `$dumpfile`/`$dumpflush` --
/// `void sv_rt_dumpfile(const char *path, const char *src)` or `void sv_rt_dumpflush(void)`,
/// matching `vj_runtime::fst::dump_control`'s real production symbols
/// exactly. Mirrors `declare_nba_enqueue`/`declare_rt_finish`'s own
/// fetch-or-declare discipline just above.
fn declare_dump_control_fn<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    symbol: &str,
    has_path_arg: bool,
) -> FunctionValue<'ctx> {
    let void_ty = ctx.void_type();
    let fn_ty = if has_path_arg {
        let ptr_ty = ctx.ptr_type(AddressSpace::default());
        void_ty.fn_type(&[ptr_ty.into(), ptr_ty.into()], false)
    } else {
        void_ty.fn_type(&[], false)
    };
    module.add_function(symbol, fn_ty, Some(Linkage::External))
}

/// Declares one of `sv_rt_display`/`sv_rt_write` -- the ALREADY-PINNED
/// `vj_runtime::rtarg::SvRtDisplayFn`/`SvRtWriteFn` ABI shape
/// (`extern "C" fn(fmt: *const c_char, args: *const RtArg, nargs: u32)`,
/// `rtarg.rs`'s own doc comment: "the argument shape ... receive from
/// LLVM-generated code at a `$display`-family call site"), consumed here
/// verbatim rather than re-derived -- this crate now depends on
/// `vj-runtime` for exactly this shared-contract reason (CG-045's own
/// "jointly finalized ABI" ask, satisfied by consuming the ABI runtime
/// already ships rather than inventing a second, competing one).
fn declare_rt_display_like<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    symbol: &str,
) -> FunctionValue<'ctx> {
    let ptr_ty = ctx.ptr_type(AddressSpace::default());
    let i32_ty = ctx.i32_type();
    let void_ty = ctx.void_type();
    let fn_ty = void_ty.fn_type(&[ptr_ty.into(), ptr_ty.into(), i32_ty.into()], false);
    module.add_function(symbol, fn_ty, Some(Linkage::External))
}

/// Declares `sv_rt_finish(state: SimHandle, code: i32)`.
///
/// **Scope decision (deviation from a literal reading of this task's plan):**
/// the plan text describes this shim as reaching a live
/// `SchedulerOps::request_finish` "via `SimHandle` -- the exact same handle
/// `sv_get_scalar` already threads through." That is not yet true anywhere in
/// this tree: `SimHandle` currently points only at STATE's own
/// `InstanceHandle` (`state::accessor_impl`'s own doc comment -- "`SimHandle`
/// is reachable only via `SimHandle`", i.e. STATE's arena, nothing else), and
/// `CompiledKernelProcess::resume` "never calls into `ops`" from inside a
/// running kernel (`sched::kernel_adapter`'s/`process_kernel_abi.rs`'s own
/// `NoOpSchedulerOps` comment). Wiring `SimHandle` to also carry scheduler-ops
/// reachability is a cross-cutting ABI decision this task does not own (it
/// touches STATE's `InstanceHandle` and/or `sched::kernel_adapter`, neither
/// named in this file's own `Files:` list) -- it belongs to S7 (the
/// end-to-end pipeline) or a later wiring task. This function therefore only
/// declares the call-site shape and emits the call
/// ([`lower_finish_call`]); nothing in this crate defines `sv_rt_finish`'s
/// real body, exactly like `nba_enqueue` above (declared, never defined, in
/// this crate) -- a test supplies whatever `SchedulerOps`-touching body it
/// needs via `Jit::add_global_mapping`, the same pattern
/// `tests/process_kernel_abi.rs` already established for `nba_enqueue`.
fn declare_rt_finish<'ctx>(ctx: &'ctx Context, module: &Module<'ctx>) -> FunctionValue<'ctx> {
    let ptr_ty = ctx.ptr_type(AddressSpace::default());
    let i32_ty = ctx.i32_type();
    let void_ty = ctx.void_type();
    let fn_ty = void_ty.fn_type(&[ptr_ty.into(), i32_ty.into()], false);
    module.add_function(SV_RT_FINISH_SYMBOL, fn_ty, Some(Linkage::External))
}

/// Builds a private, constant, NUL-terminated LLVM global holding `s`'s
/// UTF-8 bytes. The already-pinned `sv_rt_display`/`sv_rt_write` ABI shape
/// (`vj_runtime::rtarg::SvRtDisplayFn`) takes a bare `*const c_char`, not
/// a `(ptr, len)` pair, so the format string must be NUL-terminated here --
/// the A2 slice's own format strings are ordinary SV string literals, never
/// containing an embedded NUL.
pub(crate) fn build_c_string_global<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    s: &str,
    name: &str,
) -> PointerValue<'ctx> {
    let mut bytes = s.as_bytes().to_vec();
    bytes.push(0);
    let i8_ty = ctx.i8_type();
    let const_bytes: Vec<IntValue<'ctx>> = bytes
        .iter()
        .map(|byte| i8_ty.const_int(u64::from(*byte), false))
        .collect();
    let arr = i8_ty.const_array(&const_bytes);
    let global = module.add_global(arr.get_type(), None, name);
    global.set_initializer(&arr);
    global.set_constant(true);
    global.set_linkage(Linkage::Private);
    global.as_pointer_value()
}

/// Task S6 (CG-045): `$display`/`$write`/`$finish` statement lowering -- the
/// only system-call TASKS (as opposed to CG-042's constant-foldable system
/// FUNCTIONS, `expr.rs`'s own scope, see that file's `is_cg042_type_query`)
/// the A2 slice's grammar accepts. `KnownSystemName` is `#[non_exhaustive]`
/// (a `sv-lang`-owned enum this crate cannot itself extend, so an external
/// crate is *required* to include a wildcard arm to compile at all -- the one
/// place this file's "no wildcard arm" discipline, ARCHITECTURE §7 item 9,
/// necessarily yields to a foreign non-exhaustive enum); the wildcard arm
/// below still falls through to a loud, named `LoweringError` citing the
/// unsupported system call's own name, never a silent no-op, never a panic.
fn lower_system_call_statement<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    handle: PointerValue<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    sys_fns: &SysCallFns<'ctx>,
    e: sv_lang::Expression<'d>,
) -> Result<(), LoweringError> {
    let sub = e.system_subroutine().ok_or_else(|| {
        LoweringError::unsupported_at("system call missing its SystemMethod handle", &cx.fn_sym)
    })?;
    // A user application registered under a built-in's name replaces it
    // (36.3.2: `$display`, `$finish`, ...): lower the call as the user task.
    if crate::vpi_systf::is_registered(&sub.name()) {
        crate::huge::discard(lower_expr(cx, e)?);
        return Ok(());
    }
    match sub.known_name_id() {
        // The `b`/`h`/`o` variants differ only in the default radix of an
        // unformatted argument (`systask::display_format_and_values`).
        KnownSystemName::Display
        | KnownSystemName::DisplayB
        | KnownSystemName::DisplayH
        | KnownSystemName::DisplayO => lower_display_write_call(cx, sys_fns.display, e),
        KnownSystemName::Write
        | KnownSystemName::WriteB
        | KnownSystemName::WriteH
        | KnownSystemName::WriteO => lower_display_write_call(cx, sys_fns.write, e),
        KnownSystemName::ReadMemH => lower_readmem_call(cx, handle, e, false, false),
        KnownSystemName::ReadMemB => lower_readmem_call(cx, handle, e, true, false),
        KnownSystemName::WriteMemH => lower_readmem_call(cx, handle, e, false, true),
        KnownSystemName::WriteMemB => lower_readmem_call(cx, handle, e, true, true),
        // The reading system functions, their value discarded
        // (`crate::fileio`, through the ordinary `lower_expr`).
        KnownSystemName::FScanf
        | KnownSystemName::SScanf
        | KnownSystemName::FGets
        | KnownSystemName::FGetC
        | KnownSystemName::FRead
        | KnownSystemName::UngetC
        | KnownSystemName::FTell
        | KnownSystemName::FError
        | KnownSystemName::Rewind
        | KnownSystemName::FSeek
        | KnownSystemName::FEof
        | KnownSystemName::System
        // The coverage system functions (`crate::covergroup`), as tasks.
        | KnownSystemName::CoverageControl
        | KnownSystemName::CoverageGetMax
        | KnownSystemName::CoverageGet
        | KnownSystemName::CoverageMerge
        | KnownSystemName::CoverageSave
        | KnownSystemName::GetCoverage
        | KnownSystemName::SetCoverageDbName
        | KnownSystemName::LoadCoverageDb => {
            lower_expr(cx, e)?;
            Ok(())
        }
        // `$strobe`/`$monitor` (RT-036/RT-037/RT-047, SC-020): arguments are
        // evaluated at the END of the timestep by a per-call-site thunk the
        // scheduler runs in the Postponed region -- see
        // `lower_postponed_display_call`.
        KnownSystemName::Strobe
        | KnownSystemName::StrobeB
        | KnownSystemName::StrobeH
        | KnownSystemName::StrobeO => {
            lower_postponed_display_call(cx, handle, signals, e, PostponedDisplay::Strobe)
        }
        KnownSystemName::Monitor
        | KnownSystemName::MonitorB
        | KnownSystemName::MonitorH
        | KnownSystemName::MonitorO => {
            lower_postponed_display_call(cx, handle, signals, e, PostponedDisplay::Monitor)
        }
        KnownSystemName::MonitorOn | KnownSystemName::MonitorOff => {
            let on = u64::from(sub.known_name_id() == KnownSystemName::MonitorOn);
            let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
            let i32_ty = cx.ctx.i32_type();
            let f = cx
                .module
                .get_function(SV_RT_MONITOR_ENABLE_SYMBOL)
                .unwrap_or_else(|| {
                    cx.module.add_function(
                        SV_RT_MONITOR_ENABLE_SYMBOL,
                        cx.ctx
                            .void_type()
                            .fn_type(&[ptr_ty.into(), i32_ty.into()], false),
                        Some(Linkage::External),
                    )
                });
            cx.b.build_call(
                f,
                &[handle.into(), i32_ty.const_int(on, false).into()],
                "rt_monitor_enable",
            )
            .unwrap();
            Ok(())
        }
        // `$stop`: no interactive mode to stop into, so it ends the run
        // (iverilog `vvp -n` does the same).
        KnownSystemName::Finish | KnownSystemName::Stop => {
            let which = if matches!(e.system_subroutine().map(|s| s.known_name_id()), Some(KnownSystemName::Stop)) {
                KnownSystemName::Stop
            } else {
                KnownSystemName::Finish
            };
            lower_finish_call(cx, handle, sys_fns, e, which)?;
            end_process_here(cx)
        }
        // `$info`/`$warning`/`$error`/`$fatal` (LRM 1800-2023 §20.10).
        KnownSystemName::Info
        | KnownSystemName::Warning
        | KnownSystemName::Error
        | KnownSystemName::Fatal => {
            lower_severity_call(cx, handle, sys_fns, e, sub.known_name_id())?;
            if sub.known_name_id() == KnownSystemName::Fatal {
                end_process_here(cx)?;
            }
            Ok(())
        }
        // B-runtime Task 4 (RT-070/RT-162): see `SysCallFns::dumpfile`'s own
        // doc comment for why only these two of the seven `$dump*` tasks are
        // recognized here.
        KnownSystemName::DumpFile => lower_dumpfile_call(cx, sys_fns.dumpfile, e),
        KnownSystemName::DumpFlush => lower_dumpflush_call(cx, sys_fns.dumpflush, e),
        // Waveform selection/control (`vj::dump`).
        KnownSystemName::DumpVars => lower_dumpvars_call(cx, e),
        KnownSystemName::TimeFormat => lower_timeformat_call(cx, e),
        KnownSystemName::PrintTimeScale => lower_printtimescale_call(cx, sys_fns.display, e),
        KnownSystemName::Exit => lower_exit_call(cx, handle, sys_fns, e),
        KnownSystemName::Stacktrace => lower_stacktrace_call(cx, sys_fns.display),
        KnownSystemName::DumpOn => lower_dump_ctl_call(cx, 0, None),
        KnownSystemName::DumpOff => lower_dump_ctl_call(cx, 1, None),
        KnownSystemName::DumpAll => lower_dump_ctl_call(cx, 2, None),
        KnownSystemName::DumpLimit => lower_dump_ctl_call(cx, 4, e.operands().first().copied()),
        KnownSystemName::DumpPorts => lower_dumpports_call(cx, e, 0),
        KnownSystemName::DumpPortsOff => lower_dumpports_call(cx, e, 1),
        KnownSystemName::DumpPortsOn => lower_dumpports_call(cx, e, 2),
        KnownSystemName::DumpPortsAll => lower_dumpports_call(cx, e, 3),
        KnownSystemName::DumpPortsLimit => lower_dumpports_call(cx, e, 4),
        KnownSystemName::DumpPortsFlush => lower_dumpports_call(cx, e, 5),
        // Assertion control (LRM 1800-2023 20.11): `vj_sim::sched::assert_control`.
        KnownSystemName::AssertControl
        | KnownSystemName::AssertOn
        | KnownSystemName::AssertOff
        | KnownSystemName::AssertKill
        | KnownSystemName::AssertPassOn
        | KnownSystemName::AssertPassOff
        | KnownSystemName::AssertFailOn
        | KnownSystemName::AssertFailOff
        | KnownSystemName::AssertNonvacuousOn
        | KnownSystemName::AssertVacuousOff => {
            lower_assert_control_call(cx, sub.known_name_id(), e)
        }
        // B-runtime Task 7 (RT-050/RT-051/RT-052/RT-053/RT-065): `$fclose`/
        // `$fflush` -- see `SysCallFns::fclose`'s own doc comment for why
        // `$fopen` needs no arm here at all (it is a system FUNCTION,
        // reached generically through `lower_expr`, not this statement-only
        // dispatch).
        KnownSystemName::FClose => lower_file_io_void_call(cx, sys_fns.fclose, false, e),
        KnownSystemName::FFlush => lower_file_io_void_call(cx, sys_fns.fflush, true, e),
        // B-runtime Task 7 (RT-050/RT-051): a bare `$fopen(...);` statement
        // (its returned fd discarded, exactly like `func.rs`'s own generic
        // "a plain expression used as a statement" fallback treats any other
        // discarded-value system FUNCTION call) -- routed through the
        // ordinary shared `lower_expr`, which dispatches to
        // `expr::lower_fopen_call` (never re-implemented here a second
        // time).
        KnownSystemName::FOpen => {
            lower_expr(cx, e)?;
            Ok(())
        }
        // B-runtime Task 11 (RT-074/RT-075/RT-076): a bare `$test$plusargs
        // (...)`/`void'($value$plusargs(...))` statement (its returned
        // value discarded) -- the identical "discarded-value system
        // FUNCTION call routed through the ordinary shared `lower_expr`"
        // pattern `KnownSystemName::FOpen` immediately above already
        // establishes (dispatches to `expr::lower_test_plusargs_call`/
        // `expr::lower_value_plusargs_call`, never re-implemented here a
        // second time).
        KnownSystemName::TestPlusArgs | KnownSystemName::ValuePlusArgs => {
            lower_expr(cx, e)?;
            Ok(())
        }
        // B-runtime Task 8 (RT-022/RT-049/RT-054/RT-055/RT-056/RT-057):
        // `$fwrite`/`$fdisplay`/`$fmonitor`/`$fstrobe` -- see
        // `lower_fdisplay_write_call`'s own doc comment.
        KnownSystemName::FWrite
        | KnownSystemName::FWriteB
        | KnownSystemName::FWriteH
        | KnownSystemName::FWriteO => lower_fdisplay_write_call(cx, sys_fns.fwrite, e),
        KnownSystemName::FDisplay
        | KnownSystemName::FDisplayB
        | KnownSystemName::FDisplayH
        | KnownSystemName::FDisplayO => lower_fdisplay_write_call(cx, sys_fns.fdisplay, e),
        KnownSystemName::FMonitor
        | KnownSystemName::FMonitorB
        | KnownSystemName::FMonitorH
        | KnownSystemName::FMonitorO => lower_postponed_display_call(
            cx,
            handle,
            signals,
            e,
            PostponedDisplay::FMonitor(sys_fns.fstrobe),
        ),
        KnownSystemName::FStrobe
        | KnownSystemName::FStrobeB
        | KnownSystemName::FStrobeH
        | KnownSystemName::FStrobeO => {
            // The write itself is postponed, but C's `errno` is not: a bad
            // descriptor must be visible to a `$ferror` right after the
            // call (LRM 21.3.7), so the call site flushes `fd` -- a no-op
            // for a valid one, the same error state for an invalid one.
            lower_file_io_void_call(cx, sys_fns.fflush, false, e)?;
            lower_postponed_display_call(
                cx,
                handle,
                signals,
                e,
                PostponedDisplay::FStrobe(sys_fns.fstrobe),
            )
        }
        // SD-B / T25: `$sdf_annotate` -- the one lowering the leaf pipeline
        // (`func.rs`) shares; see `systask::lower_sdf_annotate_call`.
        KnownSystemName::SdfAnnotate => crate::systask::lower_sdf_annotate_call(cx, e),
        // `$cast(dest, src);` as a task (LRM 6.24.2): a failed cast is a
        // run-time error, not a result of 0.
        KnownSystemName::Cast => crate::sysfunc::lower_cast_stmt(cx, e),
        // Any other system call (a string method, `$sformat`, a system
        // function whose value is discarded): the expression lowering, which
        // names anything it cannot lower.
        _ => {
            // PLA modeling tasks (LRM 20.16): no `KnownSystemName` variant.
            if let Some(sub) = e.system_subroutine() {
                let name = sub.name();
                if crate::pla::is_pla_task(&name) {
                    return crate::pla::lower_pla_call(cx, &name, e);
                }
            }
            crate::huge::discard(lower_expr(cx, e)?);
            Ok(())
        }
    }
}

/// B-runtime Task 7 (RT-050 open/close/flush clause, RT-051, RT-052, RT-053,
/// RT-065): `$fclose`/`$fflush` statement lowering for the segment pipeline
/// -- `vj::run_design`'s real `initial`/`always` process bodies. A
/// SEPARATE implementation from `systask.rs::lower_file_io_void_call` (the
/// leaf `function`/`task`-body pipeline's own copy) by necessity, not
/// laziness: this file's `LowerCtx`/`SysCallFns` shape and this function's
/// own `default_zero` parameter differ from that file's enum-based one, the
/// same historical "two independently-maintained pipelines, cross-checked
/// against the same real ABI symbols, never silently shared" split this
/// file's own module doc already documents for `lower_display_write_call`.
///
/// Unlike `$finish`'s own `n` argument (a compile-time-constant-only
/// diagnostic level, [`lower_finish_call`]), `$fclose`/`$fflush`'s
/// MCD-bitmask argument is a genuine runtime value by construction -- an MCD
/// only ever exists as `$fopen`'s own runtime return value (RT-051) -- so
/// this lowers it through the ordinary dynamic `lower_expr` path (mirroring
/// `expr.rs`'s own `$urandom_range` `hi`/`lo` handling), never
/// `constant_value()`. `default_zero` is `true` for `$fflush` (LRM:
/// `$fflush()`'s zero-argument form flushes every open file, matching
/// `sv_rt_fflush`'s own documented "fd == 0 flushes every open file"
/// convention) and `false` for `$fclose` (no such zero-argument form
/// exists).
fn lower_file_io_void_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    rt_fn: FunctionValue<'ctx>,
    default_zero: bool,
    e: sv_lang::Expression<'d>,
) -> Result<(), LoweringError> {
    let children = e.children();
    let fd_i32 = match children.first() {
        Some(node) => {
            let arg_expr = node.as_expression().ok_or_else(|| {
                LoweringError::unsupported_at(
                    "$fclose/$fflush's argument is not an expression",
                    &cx.fn_sym,
                )
            })?;
            let pv = lower_expr(cx, arg_expr)?.into_packed(
                "$fclose/$fflush's fd argument must be an integral value",
                &cx.fn_sym,
            )?;
            let op = OpBuilder {
                ctx: cx.ctx,
                b: &cx.b,
            };
            crate::expr::packed_to_plain_i32(&op, pv)
        }
        // `$fflush()` flushes everything: `FLUSH_ALL_FD`, so an explicit
        // `$fflush(0)` (an MCD naming no channel) stays distinguishable.
        None if default_zero => cx.ctx.i32_type().const_int(
            u64::from(vj_runtime::file_io_sink::FLUSH_ALL_FD as u32),
            false,
        ),
        None => {
            return Err(LoweringError::unsupported_at(
                "$fclose requires an fd argument",
                &cx.fn_sym,
            ));
        }
    };
    cx.b.build_call(rt_fn, &[fd_i32.into()], "rt_file_io_void_call")
        .unwrap();
    Ok(())
}

/// CG-045/RT-154: `$display`/`$write` statement lowering. The `Call`'s first
/// child is always the format string (A2 slice scope: a compile-time SV
/// string literal only -- no dynamic/plusarg format strings, matching the
/// slice's own "plusarg-free `$time`" restriction); every remaining child
/// lowers as an ordinary A2-slice expression and marshals into the `RtArg`
/// ABI shape `rtarg.rs` already pins, one element per argument,
/// `RtArgKind::Narrow4State` only (the slice's own scalar/vector, `bit_width
/// <= 64` restriction -- STATE's `Inline` slot class never produces a
/// `Wide4State`/`Str`/`Real` operand here).
fn lower_display_write_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    rt_fn: FunctionValue<'ctx>,
    e: sv_lang::Expression<'d>,
) -> Result<(), LoweringError> {
    let (fmt_ptr, args_ptr, nargs_const) = lower_display_args(cx, e)?;
    mark_deferred_args_done(cx);
    cx.b.build_call(
        rt_fn,
        &[fmt_ptr.into(), args_ptr.into(), nargs_const.into()],
        "rt_display_call",
    )
    .unwrap();
    Ok(())
}

/// Lowers a `$display`-family call's format string and value arguments:
/// `(format C string, RtArg array, arg count)`.
fn lower_display_args<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    e: sv_lang::Expression<'d>,
) -> Result<(PointerValue<'ctx>, PointerValue<'ctx>, IntValue<'ctx>), LoweringError> {
    let (fmt_ptr, packed_args) = crate::systask::display_format_and_values(cx, &e.operands(), e)?;
    let rtarg_ty = crate::systask::rtarg_llvm_type(cx.ctx);
    let (args_ptr, nargs_const) = crate::systask::build_rtarg_array(cx, rtarg_ty, packed_args)?;
    Ok((fmt_ptr, args_ptr, nargs_const))
}

/// Which end-of-timestep display a [`lower_postponed_display_call`] site is.
#[derive(Clone, Copy)]
pub(crate) enum PostponedDisplay<'ctx> {
    /// `$strobe`: print once, in this timestep's Postponed region.
    Strobe,
    /// `$fstrobe` (LRM 21.2.2): as `Strobe`, but the thunk also re-reads the
    /// `fd` argument and writes through the given `sv_rt_fstrobe` function;
    /// a descriptor closed meanwhile is skipped by the runtime.
    FStrobe(FunctionValue<'ctx>),
    /// `$monitor`: become the one active monitor (prints on change).
    Monitor,
    /// `$fmonitor` (LRM 21.2.3): as `Monitor`, but each print goes to the
    /// `fd` argument through the given `sv_rt_fstrobe` function (the same
    /// postponed-region file writer `$fstrobe` uses).
    FMonitor(FunctionValue<'ctx>),
}

/// `$strobe(...)` / `$monitor(...)` (LRM 21.2.2/21.2.3): both evaluate their
/// arguments at the END of the timestep, so the call site cannot pass
/// values. Emits a per-call-site thunk `void thunk(SimHandle)` that re-reads
/// the arguments from STATE and prints (`$display` for `$strobe`,
/// `sv_rt_monitor_emit`'s print-on-change for `$monitor`), and at the call
/// site hands that thunk to the scheduler (`sv_rt_strobe_postponed` /
/// `sv_rt_monitor_start`). Arguments may reference module-level signals,
/// memories and constants; a reference to a process-local variable is a
/// named error (it no longer exists when the thunk runs).
pub(crate) fn lower_postponed_display_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    handle: PointerValue<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    e: sv_lang::Expression<'d>,
    which: PostponedDisplay<'ctx>,
) -> Result<(), LoweringError> {
    let fns = crate::accessor::accessor_fns_of(cx.module).ok_or_else(|| {
        LoweringError::unsupported_at(
            "internal error: $strobe/$monitor thunk emitted into a module with no accessor \
             declarations",
            &cx.fn_sym,
        )
    })?;
    let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
    let void_ty = cx.ctx.void_type();
    let mut n = 0u32;
    let name = loop {
        let candidate = format!("vj_postponed_thunk_{n}");
        if cx.module.get_function(&candidate).is_none() {
            break candidate;
        }
        n += 1;
    };
    let thunk = cx
        .module
        .add_function(&name, void_ty.fn_type(&[ptr_ty.into()], false), None);
    let thunk_handle = thunk.get_nth_param(0).unwrap().into_pointer_value();
    let b = cx.ctx.create_builder();
    b.position_at_end(cx.ctx.append_basic_block(thunk, "entry"));
    let mut tcx = LowerCtx {
        ctx: cx.ctx,
        b,
        repr: cx.repr,
        locals: HashMap::new(),
        fn_sym: cx.fn_sym,
        module: cx.module,
        mem_signals: mem_signals_of(signals),
        mem_accessor: Some(MemAccessorCtx {
            handle: thunk_handle,
            fns: &fns,
        }),
        lvalue_ref: Default::default(),
        deferred_start: Default::default(),
        unbounded: Default::default(),
        coll_temp: Default::default(),
        iter: Default::default(),
        loop_exits: Default::default(),
        block_exits: Default::default(),
        write_through: None,
        cells: Default::default(),
        copy_out: Default::default(),
        ctor_this: Default::default(),
        decl_scale: Default::default(),
        inline_this: Default::default(),
        end_flags: Default::default(),
        // Task 4b: a `$strobe`/`$monitor` thunk only ever READS its
        // arguments -- never consulted, never populated.
        specify_dest: Default::default(),
        elem_refs: Default::default(),
    };
    // Load every module-level signal the arguments read, fresh, at the time
    // the thunk runs (same shape as `lower_cont_assign_kernel_fn`).
    let (refs, written) = external_refs_in_expr(e, signals);
    for sym in refs {
        let info = signals[&sym.uid()];
        if crate::huge::is_huge_width(info.width) {
            // A display thunk normally only reads: the runtime's long-lived
            // image. One whose arguments write the signal works on a copy.
            let ptr = if written.contains(&sym.uid()) {
                let ptr = crate::huge::shadow_alloca(tcx.ctx, &tcx.b, info.width, "ext_shadow");
                crate::accessor::build_get_huge(
                    &tcx,
                    &fns,
                    thunk_handle,
                    info.slot,
                    info.width,
                    ptr,
                );
                ptr
            } else {
                crate::huge::rt_prime(&tcx, thunk_handle, info.slot, info.width, false)
            };
            tcx.locals.insert(sym.uid(), (ptr, info.width, info.signed));
            continue;
        }
        let raw = match info.class {
            SignalSlotClass::Inline => {
                build_get_scalar(&tcx, &fns, thunk_handle, info.slot, info.width)
            }
            SignalSlotClass::Wide => {
                build_get_wide(&tcx, &fns, thunk_handle, info.slot, info.width)
            }
            SignalSlotClass::Memory { .. } => {
                unreachable!("external_refs_in_expr excludes SignalSlotClass::Memory symbols")
            }
        };
        let ptr =
            crate::types::entry_alloca_in(&tcx.b, int_type(tcx.ctx, info.width * 2), "ext_shadow");
        tcx.b.build_store(ptr, raw).unwrap();
        tcx.locals.insert(sym.uid(), (ptr, info.width, info.signed));
    }
    // LRM 21.2.2: a `$sampled(x)` argument is the Preponed value of the time
    // step, read from the sampled value's hidden cell (not the signal), so a
    // `$strobe` shows the pre-update value next to the post-update one.
    {
        let owner = cx.fn_sym.uid();
        let mut stack = vec![e.as_sem_node()];
        let mut done: HashSet<SymbolId> = HashSet::new();
        while let Some(n) = stack.pop() {
            if let Some(x) = n.as_expression()
                && let Ok(Some(call)) = vj_sim::sva::sampled::decode(x)
            {
                let args =
                    vj_sim::sva::sampled::strict_site_signals_in(call.arg).unwrap_or_default();
                let views = vj_sim::sva::sampled::use_views(&owner, &call, &args);
                for (_, cell) in views.cur.into_iter().chain(views.prev) {
                    let Some(info) = signals.get(&cell).copied() else {
                        continue;
                    };
                    if crate::huge::is_huge_width(info.width)
                        || matches!(info.class, SignalSlotClass::Memory { .. })
                        || !done.insert(cell.clone())
                    {
                        continue;
                    }
                    let raw = match info.class {
                        SignalSlotClass::Inline => {
                            build_get_scalar(&tcx, &fns, thunk_handle, info.slot, info.width)
                        }
                        _ => build_get_wide(&tcx, &fns, thunk_handle, info.slot, info.width),
                    };
                    let ptr = crate::types::entry_alloca_in(
                        &tcx.b,
                        int_type(tcx.ctx, info.width * 2),
                        "ext_shadow",
                    );
                    tcx.b.build_store(ptr, raw).unwrap();
                    tcx.locals.insert(cell, (ptr, info.width, info.signed));
                }
            }
            stack.extend(n.children());
        }
    }
    // Both print like `$display`; `$monitor`'s "only when an argument
    // changed" decision is the scheduler's (it watches the argument signals'
    // cells -- see `vj_sim::sched::real_sv_rt_monitor`).
    // `$monitor`: which display arguments are `$time`-like (ignored by the
    // change test, LRM 21.2.3); `None` for the other forms.
    let mut time_flags: Option<Vec<bool>> = None;
    if let PostponedDisplay::FStrobe(rt_fn) | PostponedDisplay::FMonitor(rt_fn) = which {
        let ops = e.operands();
        let (fd_expr, rest) = ops.split_first().ok_or_else(|| {
            LoweringError::unsupported_at("$fstrobe call has no fd argument", &cx.fn_sym)
        })?;
        let fd_pv = lower_expr(&tcx, *fd_expr)?.into_packed(
            "$fstrobe's fd argument must be an integral value",
            &cx.fn_sym,
        )?;
        let op = OpBuilder {
            ctx: tcx.ctx,
            b: &tcx.b,
        };
        let fd_i32 = crate::expr::packed_to_plain_i32(&op, fd_pv);
        let (fmt_ptr, packed_args) = crate::systask::display_format_and_values(&tcx, rest, e)?;
        let rtarg_ty = crate::systask::rtarg_llvm_type(tcx.ctx);
        let (args_ptr, nargs) = crate::systask::build_rtarg_array(&tcx, rtarg_ty, packed_args)?;
        tcx.b
            .build_call(
                rt_fn,
                &[fd_i32.into(), fmt_ptr.into(), args_ptr.into(), nargs.into()],
                "postponed_fdisplay",
            )
            .unwrap();
    } else {
        let (fmt_ptr, packed_args, flags) =
            crate::systask::display_format_and_values_flagged(&tcx, &e.operands(), e)?;
        let rtarg_ty = crate::systask::rtarg_llvm_type(tcx.ctx);
        let (args_ptr, nargs) = crate::systask::build_rtarg_array(&tcx, rtarg_ty, packed_args)?;
        time_flags = Some(flags);
        let display = cx
            .module
            .get_function(vj_runtime::rtarg::SV_RT_DISPLAY_SYMBOL)
            .unwrap_or_else(|| {
                declare_rt_display_like(cx.ctx, cx.module, vj_runtime::rtarg::SV_RT_DISPLAY_SYMBOL)
            });
        tcx.b
            .build_call(
                display,
                &[fmt_ptr.into(), args_ptr.into(), nargs.into()],
                "postponed_display",
            )
            .unwrap();
    }
    tcx.b.build_return(None).unwrap();

    let thunk_ptr = thunk.as_global_value().as_pointer_value();
    match which {
        PostponedDisplay::Strobe | PostponedDisplay::FStrobe(_) => {
            let f = cx
                .module
                .get_function(SV_RT_STROBE_POSTPONED_SYMBOL)
                .unwrap_or_else(|| {
                    cx.module.add_function(
                        SV_RT_STROBE_POSTPONED_SYMBOL,
                        void_ty.fn_type(&[ptr_ty.into(), ptr_ty.into()], false),
                        Some(Linkage::External),
                    )
                });
            cx.b.build_call(f, &[handle.into(), thunk_ptr.into()], "strobe_schedule")
                .unwrap();
        }
        PostponedDisplay::Monitor | PostponedDisplay::FMonitor(_) => {
            // The module-level signals (incl. memories) the arguments read:
            // any value change to one of them retriggers the monitor.
            let mut slots: Vec<u32> = Vec::new();
            let mut stack = vec![e.as_sem_node()];
            while let Some(node) = stack.pop() {
                if let Some(x) = node.as_expression()
                    && vj_sim::symid::is_value_name(x.kind())
                    && let Some(sym) = x.referenced_symbol()
                    && let Some(info) = signals.get(&sym.uid())
                    && !slots.contains(&info.slot)
                {
                    slots.push(info.slot);
                }
                stack.extend(node.children());
            }
            let i32_ty = cx.ctx.i32_type();
            // LRM 21.2.3: the monitor prints when an argument EXPRESSION
            // changes value, not when a signal it reads does. A plain
            // `$monitor` (up to 32 display values) appends the mask of its
            // `$time`-like values after the slots and sets `MONITOR_DEDUPE_N`
            // on the count: the runtime then skips a print whose other
            // values equal the previous print's.
            let mut entries: Vec<u32> = slots.clone();
            let mut n_field = slots.len() as u64;
            // A monitor whose arguments are all whole variables (or constants,
            // `$time`-likes) keeps the per-signal test: a value-changing write
            // to one IS an expression change. Only a select/operator/call
            // argument can read a cell without changing its own value.
            let needs_expr_test = e.operands().iter().any(|&op| {
                let mut p = op;
                while p.kind() == ExpressionKind::Conversion {
                    match p.conversion_operand() {
                        Some(inner) => p = inner,
                        None => break,
                    }
                }
                if vj_sim::symid::is_value_name(p.kind()) {
                    return false;
                }
                let mut stack = vec![p.as_sem_node()];
                while let Some(node) = stack.pop() {
                    if node
                        .as_expression()
                        .is_some_and(|x| vj_sim::symid::is_value_name(x.kind()))
                    {
                        return true;
                    }
                    stack.extend(node.children());
                }
                false
            });
            if let Some(flags) = time_flags
                .as_ref()
                .filter(|f| f.len() <= 32 && needs_expr_test)
            {
                let mask = flags
                    .iter()
                    .enumerate()
                    .fold(0u32, |m, (i, &t)| if t { m | (1 << i) } else { m });
                entries.push(mask);
                n_field |= u64::from(vj_sim::sched::MONITOR_DEDUPE_N);
            }
            let arr_ty = i32_ty.array_type(entries.len() as u32);
            let global = cx.module.add_global(arr_ty, None, "monitor_watch_slots");
            global.set_constant(true);
            global.set_linkage(Linkage::Private);
            global.set_initializer(
                &i32_ty.const_array(
                    &entries
                        .iter()
                        .map(|&s| i32_ty.const_int(u64::from(s), false))
                        .collect::<Vec<_>>(),
                ),
            );
            let f = cx
                .module
                .get_function(SV_RT_MONITOR_START_SYMBOL)
                .unwrap_or_else(|| {
                    cx.module.add_function(
                        SV_RT_MONITOR_START_SYMBOL,
                        void_ty.fn_type(
                            &[ptr_ty.into(), ptr_ty.into(), ptr_ty.into(), i32_ty.into()],
                            false,
                        ),
                        Some(Linkage::External),
                    )
                });
            cx.b.build_call(
                f,
                &[
                    handle.into(),
                    thunk_ptr.into(),
                    global.as_pointer_value().into(),
                    i32_ty.const_int(n_field, false).into(),
                ],
                "monitor_start",
            )
            .unwrap();
        }
    }
    Ok(())
}

/// `$strobe`: `void sv_rt_strobe_postponed(SimHandle, thunk)`, bound to
/// `vj_sim::sched::real_sv_rt_strobe`.
pub const SV_RT_STROBE_POSTPONED_SYMBOL: &str = "sv_rt_strobe_postponed";
/// `$monitor`: `void sv_rt_monitor_start(SimHandle, thunk)`, bound to
/// `vj_sim::sched::real_sv_rt_monitor`.
pub const SV_RT_MONITOR_START_SYMBOL: &str = "sv_rt_monitor_start";
/// `$monitoron`/`$monitoroff`: `void sv_rt_monitor_enable(SimHandle, i32)`.
pub const SV_RT_MONITOR_ENABLE_SYMBOL: &str = "sv_rt_monitor_enable";

/// B-runtime Task 8 (RT-022/RT-049/RT-054/RT-055/RT-056/RT-057): `$fwrite`/
/// `$fdisplay`/`$fmonitor`/`$fstrobe` statement lowering for the segment
/// pipeline -- `vj::run_design`'s real `initial`/`always` process
/// bodies. Mirrors [`lower_display_write_call`]'s own shape exactly, with
/// one structural difference: the `Call`'s first child is the MCD-bitmask
/// `fd` argument (a genuine runtime value, [`lower_file_io_void_call`]'s own
/// dynamic-`lower_expr` treatment -- an MCD only ever exists as `$fopen`'s
/// own runtime return value, RT-051), the SECOND child is the format string
/// (A2-slice scope: a compile-time SV string literal only, identical
/// restriction to `$display`/`$write`), and every remaining child marshals
/// exactly like `$display`/`$write`'s own arguments (shared via
/// [`build_rtarg_array_from_packed`], never re-derived a second time).
fn lower_fdisplay_write_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    rt_fn: FunctionValue<'ctx>,
    e: sv_lang::Expression<'d>,
) -> Result<(), LoweringError> {
    let children = e.children();
    let (fd_node, rest) = children.split_first().ok_or_else(|| {
        LoweringError::unsupported_at("$fwrite-family call has no fd argument", &cx.fn_sym)
    })?;
    let fd_expr = fd_node.as_expression().ok_or_else(|| {
        LoweringError::unsupported_at(
            "$fwrite-family's fd argument is not an expression",
            &cx.fn_sym,
        )
    })?;
    let fd_pv = lower_expr(cx, fd_expr)?.into_packed(
        "$fwrite-family's fd argument must be an integral value",
        &cx.fn_sym,
    )?;
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let fd_i32 = crate::expr::packed_to_plain_i32(&op, fd_pv);

    let rest: Vec<sv_lang::Expression<'d>> =
        rest.iter().filter_map(|n| n.as_expression()).collect();
    let (fmt_ptr, packed_args) = crate::systask::display_format_and_values(cx, &rest, e)?;
    let rtarg_ty = crate::systask::rtarg_llvm_type(cx.ctx);
    let (args_ptr, nargs_const) = crate::systask::build_rtarg_array(cx, rtarg_ty, packed_args)?;
    cx.b.build_call(
        rt_fn,
        &[
            fd_i32.into(),
            fmt_ptr.into(),
            args_ptr.into(),
            nargs_const.into(),
        ],
        "rt_fdisplay_call",
    )
    .unwrap();
    Ok(())
}

/// B-runtime Task 4 (RT-070/RT-162): `$dumpfile` statement lowering. The
/// `Call`'s single child is the path argument -- a compile-time SV string
/// literal only (mirrors [`lower_display_write_call`]'s identical "A2 slice
/// scope: literal format string only" restriction, for the same reason: no
/// dynamic/plusarg string values are lowerable anywhere in this crate).
fn lower_dumpfile_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    rt_fn: FunctionValue<'ctx>,
    e: sv_lang::Expression<'d>,
) -> Result<(), LoweringError> {
    let children = e.children();
    // The file name is optional and defaults to "dump.vcd" (LRM 21.7.1.1),
    // which is what the dumper uses when no `$dumpfile` ran.
    let Some((path_node, _rest)) = children.split_first() else {
        return Ok(());
    };
    let path_expr = path_node.as_expression().ok_or_else(|| {
        LoweringError::unsupported_at("$dumpfile's argument is not an expression", &cx.fn_sym)
    })?;
    // A literal or a dynamic string value (LRM 21.7.1.1 takes a `string`;
    // an integral character string such as `{name, ".vcd"}` is legal too).
    let path_ptr = crate::systask::lower_format_expr(cx, path_expr)?;
    // The argument's source text rides along for `$version` (LRM 21.7.2.3: a
    // variable or expression appears unevaluated).
    let src_text =
        vj_sim::process::cfg::source_text_range(path_expr.source_range()).unwrap_or_default();
    let src_ptr =
        cx.b.build_global_string_ptr(&src_text, "dumpfile_src")
            .unwrap()
            .as_pointer_value();
    cx.b.build_call(
        rt_fn,
        &[path_ptr.into(), src_ptr.into()],
        "rt_dumpfile_call",
    )
    .unwrap();
    Ok(())
}

/// B-runtime Task 4 (RT-070/RT-162): `$dumpflush` statement lowering -- no
/// operands at all, unlike every other system call this file lowers.
fn lower_dumpflush_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    rt_fn: FunctionValue<'ctx>,
    _e: sv_lang::Expression<'d>,
) -> Result<(), LoweringError> {
    cx.b.build_call(rt_fn, &[], "rt_dumpflush_call").unwrap();
    Ok(())
}

/// `$finish`/`$finish(n)` statement lowering: emits a call to the
/// `sv_rt_finish(state, code)` shim ([`declare_rt_finish`]'s own doc comment
/// records this task's scope decision on what that shim's real body does).
/// `n` (LRM: a diagnostic-verbosity level, default `0`) must be a
/// compile-time constant in the A2 slice, matching the slice's own "no
/// dynamic system-call arguments" posture (mirrors
/// [`eval_constant_delay_ticks`]'s identical restriction for `#<delay>`).
/// `$readmemh(file, mem [, start [, end]])` / `$readmemb(...)` (LRM §21.4,
/// RT-071/RT-072): one call to `sv_rt_readmem_rows` with the memory's own
/// slot/range (the same `MemorySignalInfo` its `mem[i]` accesses use).
fn lower_readmem_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    handle: PointerValue<'ctx>,
    e: sv_lang::Expression<'d>,
    binary: bool,
    write: bool,
) -> Result<(), LoweringError> {
    let task = match (write, binary) {
        (false, true) => "$readmemb",
        (false, false) => "$readmemh",
        (true, true) => "$writememb",
        (true, false) => "$writememh",
    };
    let operands = e.operands();
    if !(2..=4).contains(&operands.len()) {
        return Err(LoweringError::unsupported_at(
            &format!("{task} takes 2 to 4 arguments (file, memory [, start [, end]])"),
            &cx.fn_sym,
        ));
    }
    // sv-lang models the memory argument as an output argument -- an
    // `Assignment` whose left-hand side names the memory (`$readmemh` writes
    // into it). Unwrap that.
    let mem_expr = if operands[1].kind() == ExpressionKind::Assignment {
        operands[1].left()
    } else {
        Some(operands[1])
    };
    let refuse = |what: &str| {
        LoweringError::unsupported_at(
            &format!(
                "{task}'s second argument must name a fixed-size unpacked array, queue, \
                 dynamic or associative array, or a part of one, of this module ({what})"
            ),
            &cx.fn_sym,
        )
    };
    let mem_expr = mem_expr.ok_or_else(|| refuse("not an array reference"))?;
    let i64_ty = cx.ctx.i64_type();
    let i32_ty = cx.ctx.i32_type();
    let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
    let mut flags = 0u32;
    // The array's addressing: (slot, lower index, rows, sub-rows per address,
    // base row, element width, element type, collection handle, key width).
    let (slot, lower, rows, sub, base, width, elem, coll, key_width) =
        if let Some(c) = crate::collections::coll_of_expr(&mem_expr) {
            if c.obj || c.leaky || (c.assoc && c.key_kind >= 2) {
                return Err(refuse(
                    "a collection of class handles or with a string / class-handle index",
                ));
            }
            flags |= vj_runtime::readmem::READMEM_COLL;
            if c.assoc {
                flags |= vj_runtime::readmem::READMEM_ASSOC;
                if c.key_kind == 1 {
                    flags |= vj_runtime::readmem::READMEM_KEY_SIGNED;
                }
            }
            let h = crate::collections::handle_of(cx, mem_expr)?;
            (
                i32_ty.const_zero(),
                i64_ty.const_zero(),
                i32_ty.const_zero(),
                i32_ty.const_int(1, false),
                i64_ty.const_zero(),
                c.width,
                c.elem,
                h,
                c.key_width,
            )
        } else {
            // 21.4's grammar takes a `memory_name`: a range select of a
            // fixed-size array (`mem[0:7]`) is not one (ivtest readmemh5
            // expects a compile error). Slices of dynamic arrays / queues
            // are accepted above as an extension.
            if mem_expr.kind() == ExpressionKind::RangeSelect {
                return Err(refuse(
                    "a range select of a fixed-size array is not a memory name",
                ));
            }
            let (aref, shape) = crate::arrays::resolve_array_ref(cx, mem_expr)?
                .ok_or_else(|| refuse(&format!("got a {:?} expression", operands[1].kind())))?;
            let crate::arrays::Backing::Memory(info) = aref.backing else {
                return Err(refuse("a local array is not a module memory"));
            };
            if shape.dims.is_empty() {
                return Err(refuse("a single element, not an array"));
            }
            let top = shape.size(0);
            let rows =
                cx.b.build_select(
                    aref.valid,
                    i32_ty.const_int(top, false),
                    i32_ty.const_zero(),
                    "rm_rows",
                )
                .unwrap()
                .into_int_value();
            (
                i32_ty.const_int(u64::from(info.slot), false),
                i64_ty.const_int(shape.dims[0].0.min(shape.dims[0].1) as u64, true),
                rows,
                i32_ty.const_int(shape.stride(0), false),
                aref.base,
                info.elem_width,
                shape.elem,
                i64_ty.const_zero(),
                0,
            )
        };
    if !elem.is_integral() {
        return Err(refuse("its elements are not integral"));
    }
    if !elem.is_four_state() {
        flags |= vj_runtime::readmem::READMEM_TWO_STATE;
    }
    // An enum element: the member values a file word must match (21.4.2).
    let (enum_ptr, enum_count) = if elem.is_enum() && elem.value_width() <= 64 {
        flags |= vj_runtime::readmem::READMEM_ENUM;
        let mask = if elem.value_width() >= 64 {
            u64::MAX
        } else {
            (1u64 << elem.value_width()) - 1
        };
        let vals: Vec<u64> = elem
            .enum_members()
            .filter_map(|m| {
                m.constant_value()
                    .as_ref()
                    .and_then(|c| c.as_integer())
                    .and_then(|i| i.as_i64())
                    .map(|v| (v as u64) & mask)
            })
            .collect();
        let arr =
            crate::expr::entry_alloca(cx, i64_ty.array_type(vals.len().max(1) as u32), "rm_enum");
        for (k, v) in vals.iter().enumerate() {
            let p = unsafe {
                cx.b.build_in_bounds_gep(
                    i64_ty,
                    arr,
                    &[i64_ty.const_int(k as u64, false)],
                    "rm_enum_p",
                )
                .unwrap()
            };
            cx.b.build_store(p, i64_ty.const_int(*v, false)).unwrap();
        }
        (arr, vals.len() as u64)
    } else {
        (ptr_ty.const_null(), 0)
    };
    let path_ptr = crate::systask::lower_format_expr(cx, operands[0])?;
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let bound = |i: usize| -> Result<IntValue<'ctx>, LoweringError> {
        match operands.get(i) {
            None => Ok(i64_ty.const_zero()),
            Some(expr) => {
                // A real address converts to an integer by rounding to the
                // nearest (LRM 6.12.2: the start/finish address is an integral
                // argument; sv-lang accepts the implicit real-to-int cast).
                let pv = match lower_expr(cx, *expr)? {
                    crate::expr::LoweredValue::Real(r) => crate::real::real_to_count(cx, r),
                    other => other
                        .into_packed(&format!("{task} address must be integral"), &cx.fn_sym)?,
                };
                Ok(crate::expr::mem_row_index_i64(&op, cx, pv))
            }
        }
    };
    let start = bound(2)?;
    let end = bound(3)?;
    if binary {
        flags |= vj_runtime::readmem::READMEM_BINARY;
    }
    if write {
        flags |= vj_runtime::readmem::READMEM_WRITE;
    }
    if operands.len() >= 3 {
        flags |= vj_runtime::readmem::READMEM_HAS_START;
    }
    if operands.len() == 4 {
        flags |= vj_runtime::readmem::READMEM_HAS_END;
    }
    let rt_fn = cx
        .module
        .get_function(vj_runtime::readmem::SV_RT_READMEM_ROWS_SYMBOL)
        .unwrap_or_else(|| {
            let fn_ty = i64_ty.fn_type(
                &[
                    ptr_ty.into(),
                    i32_ty.into(),
                    i64_ty.into(),
                    i32_ty.into(),
                    i32_ty.into(),
                    ptr_ty.into(),
                    i64_ty.into(),
                    i64_ty.into(),
                    i32_ty.into(),
                    i64_ty.into(),
                    i32_ty.into(),
                    ptr_ty.into(),
                    i32_ty.into(),
                    i64_ty.into(),
                    i32_ty.into(),
                ],
                false,
            );
            cx.module.add_function(
                vj_runtime::readmem::SV_RT_READMEM_ROWS_SYMBOL,
                fn_ty,
                Some(Linkage::External),
            )
        });
    let ret =
        cx.b.build_call(
            rt_fn,
            &[
                handle.into(),
                slot.into(),
                lower.into(),
                rows.into(),
                i32_ty.const_int(u64::from(width), false).into(),
                path_ptr.into(),
                start.into(),
                end.into(),
                i32_ty.const_int(u64::from(flags), false).into(),
                base.into(),
                sub.into(),
                enum_ptr.into(),
                i32_ty.const_int(enum_count, false).into(),
                coll.into(),
                i32_ty.const_int(u64::from(key_width), false).into(),
            ],
            "rt_readmem_rows_call",
        )
        .unwrap()
        .try_as_basic_value()
        .unwrap_basic()
        .into_int_value();
    if !write && flags & vj_runtime::readmem::READMEM_COLL != 0 {
        crate::collections::set_handle(cx, mem_expr, ret)?;
    }
    Ok(())
}

/// After `$finish`/`$stop`/`$fatal`, nothing more of the process runs --
/// also when the call sits inside a statement lowered as one piece (a
/// `case` or `randcase` arm, an assertion's action): the process ends
/// here. Lowering continues in a fresh (unreachable) block.
fn end_process_here(cx: &LowerCtx<'_, '_, '_>) -> Result<(), LoweringError> {
    let (_, f) = crate::stmt_shared::current_block_and_fn(cx)?;
    crate::stmt_shared::leave_now(cx, f);
    let rest = cx.ctx.append_basic_block(f, "after_finish");
    cx.b.position_at_end(rest);
    Ok(())
}

/// `$info`/`$warning`/`$error`/`$fatal([finish_number,] fmt, ...)`: the
/// message in iverilog 12's form -- `TAG: file:line: message`, then an
/// indented `Time: t  Scope: scope` line -- and, for `$fatal`, `$finish`
/// (with its finish number, default 1).
pub(crate) fn lower_severity_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    handle: PointerValue<'ctx>,
    sys_fns: &SysCallFns<'ctx>,
    e: sv_lang::Expression<'d>,
    which: KnownSystemName,
) -> Result<(), LoweringError> {
    let tag = match which {
        KnownSystemName::Info => "INFO: ",
        KnownSystemName::Warning => "WARNING: ",
        KnownSystemName::Error => "ERROR: ",
        _ => "FATAL: ",
    };
    let mut args = e.operands();
    // `$fatal`'s leading finish number.
    let mut code: i64 = 1;
    // A finish number that is not a constant (LRM 20.10: it is an expression) is read
    // when the task runs, before the message's own arguments.
    let mut dynamic_code: Option<IntValue<'ctx>> = None;
    if which == KnownSystemName::Fatal
        && let Some(first) = args.first()
        && !first.expr_type().is_some_and(|t| t.is_string())
        && first.kind() != ExpressionKind::StringLiteral
    {
        let first = *first;
        if let Some(v) = first.constant_value().and_then(|c| c.as_i64()) {
            code = v;
            args.remove(0);
        } else if first.expr_type().is_some_and(|t| t.is_integral()) {
            let pv = lower_expr(cx, first)?.into_packed(
                "$fatal's finish number must be an integral value",
                &cx.fn_sym,
            )?;
            let op = OpBuilder {
                ctx: cx.ctx,
                b: &cx.b,
            };
            dynamic_code = Some(crate::expr::packed_to_plain_i32(&op, pv));
            args.remove(0);
        }
    }
    let rtarg_ty = crate::systask::rtarg_llvm_type(cx.ctx);
    let emit = |f: FunctionValue<'ctx>,
                fmt: PointerValue<'ctx>,
                values: Vec<crate::expr::LoweredValue<'ctx>>|
     -> Result<(), LoweringError> {
        let (args_ptr, n) = crate::systask::build_rtarg_array(cx, rtarg_ty, values)?;
        cx.b.build_call(f, &[fmt.into(), args_ptr.into(), n.into()], "rt_severity")
            .unwrap();
        Ok(())
    };
    let scope = vj_sim::process::cfg::shown_path(&e.system_call_scope().unwrap_or(cx.fn_sym));
    // The message's arguments are evaluated before the task runs (LRM 20.10:
    // `$error(...)` is an ordinary system task call), so what a function in
    // them prints precedes the frame -- and, in a deferred assertion's action,
    // is not part of its deferred report (16.4.1).
    let mut message = if args.is_empty() {
        None
    } else {
        Some(crate::systask::display_format_and_values(cx, &args, e)?)
    };
    mark_deferred_args_done(cx);
    severity_frame(
        cx,
        sys_fns,
        tag,
        e.source_range().start,
        &scope,
        &mut || {
            if let Some((fmt, values)) = message.take() {
                emit(sys_fns.write, fmt, values)?;
            }
            Ok(())
        },
    )?;
    if which == KnownSystemName::Fatal {
        let code_const =
            dynamic_code.unwrap_or_else(|| cx.ctx.i32_type().const_int(code as u64, true));
        cx.b.build_call(
            sys_fns.finish,
            &[handle.into(), code_const.into()],
            "rt_fatal_finish",
        )
        .unwrap();
    }
    Ok(())
}

/// A severity message's frame, around the message `body` prints: its first
/// line's `ERROR: file:line: ` prefix (`tag` and the source location at
/// `offset`) and its second line, `       Time: t  Scope: s` (Icarus's
/// format).
pub(crate) fn severity_frame<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    sys_fns: &SysCallFns<'ctx>,
    tag: &str,
    at: sv_lang::SourceLoc,
    scope: &str,
    body: &mut dyn FnMut() -> Result<(), LoweringError>,
) -> Result<(), LoweringError> {
    let rtarg_ty = crate::systask::rtarg_llvm_type(cx.ctx);
    let emit = |f: FunctionValue<'ctx>,
                fmt: PointerValue<'ctx>,
                values: Vec<crate::expr::LoweredValue<'ctx>>|
     -> Result<(), LoweringError> {
        let (args_ptr, n) = crate::systask::build_rtarg_array(cx, rtarg_ty, values)?;
        cx.b.build_call(f, &[fmt.into(), args_ptr.into(), n.into()], "rt_severity")
            .unwrap();
        Ok(())
    };
    let loc = vj_sim::process::cfg::source_location(at).unwrap_or_else(|| "?".to_string());
    // An error or fatal frame is marked for the run's error report (cbError).
    let mark = if tag.starts_with("ERROR") || tag.starts_with("FATAL") {
        char::from(vj_runtime::display::SEVERITY_ERROR_MARK).to_string()
    } else {
        String::new()
    };
    let prefix = crate::systask::build_c_string_global(
        cx.ctx,
        cx.module,
        &format!("{mark}{tag}{loc}: "),
        "severity_prefix",
    );
    emit(sys_fns.write, prefix, Vec::new())?;
    body()?;
    let suffix = crate::systask::build_c_string_global(
        cx.ctx,
        cx.module,
        &format!("\n{}Time: %0d  Scope: {scope}", " ".repeat(tag.len())),
        "severity_suffix",
    );
    let now = crate::expr::lower_time_system_call(cx, KnownSystemName::Time, "$time", &cx.fn_sym)?;
    emit(sys_fns.display, suffix, vec![now])
}

/// What the assertion statements of the plan being lowered mean (16.14.6, T30):
/// the key of the one this plan hosts, and the plan index of the host of each
/// procedural assertion the process reaches. A thread-local because statement
/// lowering takes no plan; owned data only. `None` outside a plan lowering.
struct AssertionLowering {
    hosted: Option<String>,
    nested: HashMap<String, usize>,
    disable_keys: HashMap<String, Vec<usize>>,
    /// [`ProcessLoweringPlan::fork_branch_names`], read by the
    /// `StatementKind::Disable` dispatch to tell a cross-process/fork-
    /// sibling `disable <label>;` (the new, generic `sv_rt_disable_named`
    /// case) apart from the older, same-fork-only
    /// `sv_rt_disable_fork_block` one.
    fork_branch_names: Vec<String>,
    /// [`ProcessLoweringPlan::disable_broadcast`].
    disable_broadcast: Vec<(String, bool)>,
}

thread_local! {
    static ASSERTION_LOWERING: std::cell::RefCell<Option<AssertionLowering>> =
        const { std::cell::RefCell::new(None) };
}

/// Installs a plan's [`AssertionLowering`] for the duration of its lowering and
/// restores the previous one (a plan lowered inside another's lowering).
struct AssertionLoweringGuard(Option<AssertionLowering>);

impl AssertionLowering {
    fn enter(plan: &ProcessLoweringPlan<'_>) -> AssertionLoweringGuard {
        let mine = AssertionLowering {
            hosted: plan
                .hosted_assertion
                .map(|h| crate::sva::proc::assertion_key(&plan.fn_sym, &h.stmt)),
            nested: plan.nested_assertions.clone(),
            disable_keys: plan.disable_keys.clone(),
            fork_branch_names: plan.fork_branch_names.clone(),
            disable_broadcast: plan.disable_broadcast.clone(),
        };
        AssertionLoweringGuard(ASSERTION_LOWERING.with(|c| c.borrow_mut().replace(mine)))
    }
}

impl Drop for AssertionLoweringGuard {
    fn drop(&mut self) {
        ASSERTION_LOWERING.with(|c| *c.borrow_mut() = self.0.take());
    }
}

/// The action half of a static concurrent assertion (16.14.1-16.14.5, plan T29).
///
/// The property itself is never evaluated here: the assertion engine
/// (`vj_sim::sva::engine`, driven from `vj`) evaluates it from the
/// sampled values and, for every attempt it decides, resumes this process in the
/// Reactive region (16.14.1: "the pass and fail statements are executed in the
/// Reactive region") with `sv_rt_fired_term()` = 0 for the pass statement and 1
/// for the fail statement. A coverage statement's pass statement runs once per
/// successful attempt (cover property) or per match (cover sequence); `restrict`
/// has no action block and is never resumed.
///
/// Without an `else` branch an `assert`/`assume` failure reports `$error` with no
/// message (16.14.1, 16.3).
fn lower_concurrent_assertion<'ctx, 'd, 'm>(
    cx: &mut LowerCtx<'ctx, 'd, 'm>,
    handle: PointerValue<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    nba_fn: FunctionValue<'ctx>,
    sys_fns: &SysCallFns<'ctx>,
    stmt: &Statement<'d>,
    calls: &[crate::sva::actions::CallSite<'d>],
) -> Result<(), LoweringError> {
    let kind = stmt
        .assertion_kind()
        .ok_or_else(|| LoweringError::unsupported_at("an assertion of unknown kind", &cx.fn_sym))?;
    // Which half is this? The plan the engine resumes for the assertion runs its
    // pass/fail statements; the process that merely reaches a procedural
    // assertion (16.14.6) queues an instance of it.
    let key = crate::sva::proc::assertion_key(&cx.fn_sym, stmt);
    let (hosted, queued) = ASSERTION_LOWERING.with(|c| {
        c.borrow()
            .as_ref()
            .map(|a| {
                (
                    a.hosted.as_deref() == Some(key.as_str()),
                    a.nested.get(&key).copied(),
                )
            })
            .unwrap_or((false, None))
    });
    if !hosted {
        return match queued {
            Some(plan_index) => queue_procedural_assertion(cx, signals, stmt, plan_index),
            None => Err(LoweringError::unsupported_at(
                "a concurrent assertion that the process discovery did not host (a build mode \
                 without the assertion engine, or a context the discovery does not walk) is \
                 not supported",
                &cx.fn_sym,
            )),
        };
    }
    if kind == sv_lang::AssertionKind::Expect {
        // 16.17: the hosted plan only gives the engine an assertion to run; the
        // process that blocked on the `expect` runs its pass/fail statements
        // itself ([`lower_expect_action`]).
        return Ok(());
    }
    prime_assertion_inputs(cx, signals, stmt)?;
    if calls.is_empty() {
        return lower_assertion_action(cx, handle, signals, nba_fn, sys_fns, stmt, kind);
    }
    lower_assertion_calls_and_action(cx, handle, signals, nba_fn, sys_fns, stmt, kind, calls)
}

/// A checker instantiated in a procedure (LRM 17.3): reaching the statement
/// queues the instance's static assertions. The instance's other contents (its
/// variables, functions, `always_ff`, ...) exist whether or not it is reached
/// ([`vj_sim::netlist::module_items`]). A static concurrent assertion is
/// queued like a procedural one (16.14.6), with the current values of the
/// automatic variables the instance's actuals name; a static deferred
/// assertion (16.4.3) is executed here like a procedural deferred assertion, in
/// this process, so its condition reads the same current values.
fn lower_procedural_checker<'ctx, 'd, 'm>(
    cx: &mut LowerCtx<'ctx, 'd, 'm>,
    handle: PointerValue<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    nba_fn: FunctionValue<'ctx>,
    sys_fns: &SysCallFns<'ctx>,
    stmt: &Statement<'d>,
) -> Result<(), LoweringError> {
    for instance in stmt.procedural_checker_instances() {
        if instance.kind() != sv_lang::kinds::SymbolKind::CheckerInstance {
            return Err(LoweringError::unsupported_at(
                "an array of procedural checker instances: the grammar has no such construct \
                 (17.3 instantiates one checker per statement), so this is an internal error",
                &cx.fn_sym,
            ));
        }
        for block in vj_sim::netlist::module_items(&instance) {
            if let Some(assertion) = crate::module::static_concurrent_assertion_of(&block) {
                let key =
                    crate::sva::proc::queued_assertion_key(&cx.fn_sym, Some(&instance), &assertion);
                let plan_index = ASSERTION_LOWERING
                    .with(|c| {
                        c.borrow()
                            .as_ref()
                            .and_then(|a| a.nested.get(&key).copied())
                    })
                    .ok_or_else(|| {
                        LoweringError::unsupported_at(
                            "a procedural checker instance whose assertion has no hosting plan",
                            &cx.fn_sym,
                        )
                    })?;
                queue_procedural_assertion(cx, signals, &assertion, plan_index)?;
            } else if let Some(deferred) = crate::module::static_deferred_assertion_of(&block) {
                let env = crate::deferred_call::DeferredEnv { handle, signals };
                lower_immediate_assertion(cx, sys_fns, &deferred, Some(&env), &mut |cx, s| {
                    lower_segment_statement(cx, handle, signals, nba_fn, sys_fns, s)
                })?;
            }
        }
    }
    Ok(())
}

/// The kernel of an assertion with subroutine calls attached to its sequences
/// (16.11): the assertion engine resumes it with `sv_rt_fired_term()` = 0 or 1
/// for the pass or fail statement ([`lower_assertion_action`]), or `2 + k` for
/// the call `k` (the [`CallSite`]'s index) of an end point, where it runs that
/// call in the Reactive region with the by-value arguments the engine sampled
/// ([`lower_match_item_call`]).
#[allow(clippy::too_many_arguments)]
fn lower_assertion_calls_and_action<'ctx, 'd, 'm>(
    cx: &mut LowerCtx<'ctx, 'd, 'm>,
    handle: PointerValue<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    nba_fn: FunctionValue<'ctx>,
    sys_fns: &SysCallFns<'ctx>,
    stmt: &Statement<'d>,
    kind: sv_lang::AssertionKind,
    calls: &[crate::sva::actions::CallSite<'d>],
) -> Result<(), LoweringError> {
    let i64t = cx.ctx.i64_type();
    let fired = read_fired_term(cx);
    let is_call =
        cx.b.build_int_compare(
            inkwell::IntPredicate::UGE,
            fired,
            i64t.const_int(FIRED_TERM_FIRST_CALL, false),
            "assert_is_call",
        )
        .unwrap();
    let (_, f) = crate::stmt_shared::current_block_and_fn(cx)?;
    let call_bb = cx.ctx.append_basic_block(f, "cassert_calls");
    let action_bb = cx.ctx.append_basic_block(f, "cassert_action");
    let done_bb = cx.ctx.append_basic_block(f, "cassert_calls_done");
    cx.b.build_conditional_branch(is_call, call_bb, action_bb)
        .unwrap();

    cx.b.position_at_end(action_bb);
    lower_assertion_action(cx, handle, signals, nba_fn, sys_fns, stmt, kind)?;
    if !crate::stmt_shared::current_block_terminated(cx) {
        cx.b.build_unconditional_branch(done_bb).unwrap();
    }

    // The engine's event arguments follow the values the instance captured.
    let captured = crate::sva::proc::capture_words(&crate::sva::proc::capture_items(
        signals, *stmt, &cx.fn_sym,
    )?);
    cx.b.position_at_end(call_bb);
    let which =
        cx.b.build_int_sub(
            fired,
            i64t.const_int(FIRED_TERM_FIRST_CALL, false),
            "assert_call_index",
        )
        .unwrap();
    let case_bbs: Vec<LlvmBasicBlock<'ctx>> = (0..calls.len())
        .map(|k| cx.ctx.append_basic_block(f, &format!("cassert_call{k}")))
        .collect();
    let cases: Vec<(IntValue<'ctx>, LlvmBasicBlock<'ctx>)> = case_bbs
        .iter()
        .enumerate()
        .map(|(k, bb)| (i64t.const_int(k as u64, false), *bb))
        .collect();
    // An index past the table is not a call this assertion has: a no-op, like
    // any resume of a process for an event it does not handle.
    cx.b.build_switch(which, done_bb, &cases).unwrap();
    for (call, bb) in calls.iter().zip(case_bbs) {
        cx.b.position_at_end(bb);
        // A task that can suspend runs as a process of its own that the runner
        // spawns (`lower_match_item_task_kernel`); this kernel has nothing to run.
        if !call.spawns {
            lower_match_item_call(cx, handle, signals, sys_fns, call, captured)?;
        }
        if !crate::stmt_shared::current_block_terminated(cx) {
            cx.b.build_unconditional_branch(done_bb).unwrap();
        }
    }
    cx.b.position_at_end(done_bb);
    Ok(())
}

/// The first `sv_rt_fired_term()` value of a subroutine call (16.11): 0 and 1 are
/// the pass and fail statements.
const FIRED_TERM_FIRST_CALL: u64 = 2;

/// The subroutine call of one sequence end point (16.11), run in the Reactive
/// region like an action block. Its by-value arguments are the values the
/// engine sampled consistently with the match, read from the assertion inputs
/// from index `first_input` (`captured`: the instance's own values come first),
/// in argument order; a `ref` argument and a constant lower from the call itself.
/// The call goes through the lowering of a statement-position call, so a task, a
/// void function and a system task behave exactly as they do in a process.
fn lower_match_item_call<'ctx, 'd, 'm>(
    cx: &mut LowerCtx<'ctx, 'd, 'm>,
    handle: PointerValue<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    sys_fns: &SysCallFns<'ctx>,
    site: &crate::sva::actions::CallSite<'d>,
    first_input: usize,
) -> Result<(), LoweringError> {
    let _scope = crate::sva::proc::CallArgScope::enter();
    let mut keys = Vec::new();
    let mut next = first_input;
    for (arg, actual) in &site.args {
        if !matches!(arg, vj_sim::sva::ir::CallArg::Value(_)) {
            continue;
        }
        let t = actual.expr_type().ok_or_else(|| {
            LoweringError::unsupported_at(
                "a by-value argument of a sequence match-item call has no type",
                &cx.fn_sym,
            )
        })?;
        let width = t.value_width();
        let ptr = assert_input_slot(cx, next, width);
        let key = crate::sva::proc::call_arg_key(actual);
        cx.locals.insert(key.clone(), (ptr, width, t.is_signed()));
        keys.push(key);
        // A wide argument travels as `2 * ceil(width / 64)` words (`push_arg_leaves`).
        next += if width > 64 {
            2 * width.div_ceil(64) as usize
        } else {
            1
        };
    }
    let result = if site.call.is_system_call() == Some(true) {
        lower_system_call_statement(cx, handle, signals, sys_fns, site.call)
    } else {
        crate::func::lower_task_call(cx, site.call)
    };
    for key in keys {
        cx.locals.remove(&key);
    }
    result
}

/// Lowers the statements of segment `seg`. The first statement of the segment an
/// `expect` blocks on ([`vj_sim::process::cfg::Segment::expect_resume`]) is
/// that `expect` again: its resume half, the pass/fail statement. `calls` are the
/// subroutine calls attached to the sequences of the assertion the plan hosts
/// (16.11), dispatched by its statement.
fn lower_segment_body<'ctx, 'd, 'm>(
    cx: &mut LowerCtx<'ctx, 'd, 'm>,
    handle: PointerValue<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    nba_fn: FunctionValue<'ctx>,
    sys_fns: &SysCallFns<'ctx>,
    seg: &vj_sim::process::cfg::Segment<'d>,
    calls: &[crate::sva::actions::CallSite<'d>],
) -> Result<(), LoweringError> {
    // VPI `cbStmt` probes the CFG recorded, each just before `body[at]`.
    let emit_probes = |cx: &LowerCtx<'ctx, 'd, 'm>, at: usize| {
        let vpi = crate::vpi_dyn::enabled();
        if !(vpi || crate::stmtcov::enabled()) || crate::stmt_shared::current_block_terminated(cx) {
            return;
        }
        // A task's frame begins before its first statement and ends before
        // the caller's next one.
        for (_, fp) in seg.frame_probes.iter().filter(|(i, _)| vpi && *i == at) {
            match fp {
                vj_sim::process::cfg::FrameProbe::Enter { task, vars, bound } => {
                    // 37.15 detail 1: the task's `ref` formals are ref objs of
                    // its frame: those aliasing static storage in this
                    // activation, and those the call copies in and out
                    // (detail 3: bound by the call, the actual an automatic
                    // of the caller or a frameless block).
                    let mut refs: Vec<vj_exec::vpi_data::FrameRef> = Vec::new();
                    let mut actuals = Vec::new();
                    for f in task.subroutine_arguments() {
                        if let Some((_, a)) =
                            seg.ref_aliases.iter().find(|(x, _)| x.uid() == f.uid())
                        {
                            refs.push(vj_exec::vpi_data::FrameRef {
                                name: f.name().to_owned(),
                                actual: a.hierarchical_path(),
                                store: None,
                            });
                        } else if let Some((_, a)) = bound.iter().find(|(x, _)| x.uid() == f.uid())
                        {
                            refs.push(vj_exec::vpi_data::FrameRef {
                                name: f.name().to_owned(),
                                actual: crate::vpi_dyn::ref_actual_of(*a),
                                store: None,
                            });
                            actuals.push(*a);
                        }
                    }
                    if !bound.is_empty() {
                        crate::vpi_dyn::emit_bind(cx, task, refs.clone(), &actuals);
                    }
                    crate::vpi_dyn::emit_frame_enter(cx, task, vars, &refs);
                }
                vj_sim::process::cfg::FrameProbe::Exit { task, vars } => {
                    let site = crate::vpi_dyn::frame_site(cx, task, vars);
                    crate::vpi_dyn::emit_frame_exit(cx, site);
                }
            }
        }
        for (_, st) in seg.probes.iter().filter(|(i, _)| *i == at) {
            crate::vpi_dyn::emit_stmt_probe(cx, st);
        }
        for (_, st) in seg.disable_probes.iter().filter(|(i, _)| vpi && *i == at) {
            crate::vpi_dyn::emit_disable_probe(cx, st);
        }
    };
    // LRM 19.3: the begin/end of an inlined task a covergroup's block event
    // names samples that covergroup, just before `body[at]`.
    let emit_block_events = |cx: &LowerCtx<'ctx, 'd, 'm>, at: usize| -> Result<(), LoweringError> {
        for (_, task, is_end) in seg.block_events.iter().filter(|(i, _, _)| *i == at) {
            if crate::covergroup::is_block_target(task) {
                crate::covergroup::emit_block_event_of(cx, handle, task, *is_end)?;
            }
        }
        Ok(())
    };
    for (k, stmt) in seg.body.iter().enumerate() {
        cx.decl_scale.set(
            seg.stmt_scopes
                .iter()
                .find(|(i, _)| *i == k)
                .map(|(_, s)| crate::timescale::unit_and_precision(s)),
        );
        emit_block_events(cx, k)?;
        emit_probes(cx, k);
        if seg.expect_resume && k == 0 && is_expect_statement(stmt) {
            lower_expect_action(cx, handle, signals, nba_fn, sys_fns, stmt)?;
        } else if stmt.kind() == StatementKind::ConcurrentAssertion {
            lower_concurrent_assertion(cx, handle, signals, nba_fn, sys_fns, stmt, calls)?;
        } else {
            crate::vpi_dyn::mark_probed_by_cfg();
            lower_segment_statement(cx, handle, signals, nba_fn, sys_fns, stmt)?;
        }
    }
    emit_block_events(cx, seg.body.len())?;
    emit_probes(cx, seg.body.len());
    Ok(())
}

/// Whether `stmt` is an `expect` statement (16.17).
fn is_expect_statement(stmt: &Statement<'_>) -> bool {
    stmt.kind() == StatementKind::ConcurrentAssertion
        && stmt.assertion_kind() == Some(sv_lang::AssertionKind::Expect)
}

/// The resume half of an `expect` statement (16.17): run in the process the
/// assertion engine woke in the Observed region of the step the property was
/// decided in, with `sv_rt_fired_term()` 0 (the property succeeded: the pass
/// statement) or 1 (it failed: the `else` statement, else `$error`). The
/// process's own variables are read directly: it never left.
fn lower_expect_action<'ctx, 'd, 'm>(
    cx: &mut LowerCtx<'ctx, 'd, 'm>,
    handle: PointerValue<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    nba_fn: FunctionValue<'ctx>,
    sys_fns: &SysCallFns<'ctx>,
    stmt: &Statement<'d>,
) -> Result<(), LoweringError> {
    lower_assertion_action(
        cx,
        handle,
        signals,
        nba_fn,
        sys_fns,
        stmt,
        sv_lang::AssertionKind::Expect,
    )
}

/// `sv_rt_fired_term()`: which outcome the assertion engine resumed the kernel for.
fn read_fired_term<'ctx>(cx: &LowerCtx<'ctx, '_, '_>) -> IntValue<'ctx> {
    let i64t = cx.ctx.i64_type();
    let rt = cx
        .module
        .get_function(SV_RT_FIRED_TERM_SYMBOL)
        .unwrap_or_else(|| {
            cx.module
                .add_function(SV_RT_FIRED_TERM_SYMBOL, i64t.fn_type(&[], false), None)
        });
    cx.b.build_call(rt, &[], "assert_fired")
        .unwrap()
        .try_as_basic_value()
        .unwrap_basic()
        .into_int_value()
}

/// The branch on `sv_rt_fired_term()` running the pass or the fail statement of
/// the assertion `stmt` of kind `kind`.
fn lower_assertion_action<'ctx, 'd, 'm>(
    cx: &mut LowerCtx<'ctx, 'd, 'm>,
    handle: PointerValue<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    nba_fn: FunctionValue<'ctx>,
    sys_fns: &SysCallFns<'ctx>,
    stmt: &Statement<'d>,
    kind: sv_lang::AssertionKind,
) -> Result<(), LoweringError> {
    let i64t = cx.ctx.i64_type();
    let fired = read_fired_term(cx);
    let is_fail =
        cx.b.build_int_compare(
            inkwell::IntPredicate::NE,
            fired,
            i64t.const_zero(),
            "assert_is_fail",
        )
        .unwrap();
    let (_, f) = crate::stmt_shared::current_block_and_fn(cx)?;
    let pass_bb = cx.ctx.append_basic_block(f, "cassert_pass");
    let fail_bb = cx.ctx.append_basic_block(f, "cassert_fail");
    let done_bb = cx.ctx.append_basic_block(f, "cassert_done");
    if kind == sv_lang::AssertionKind::Expect {
        // 20.11: the assertion control tasks can switch off either action of an
        // `expect`; the engine then resumes the process with term 2 (the property
        // was decided, neither action runs).
        let none =
            cx.b.build_int_compare(
                inkwell::IntPredicate::EQ,
                fired,
                i64t.const_int(
                    vj_sim::sched::assert_control::EXPECT_NO_ACTION_TERM as u64,
                    false,
                ),
                "expect_no_action",
            )
            .unwrap();
        let decided_bb = cx.ctx.append_basic_block(f, "cassert_decided");
        cx.b.build_conditional_branch(none, done_bb, decided_bb)
            .unwrap();
        cx.b.position_at_end(decided_bb);
    }
    cx.b.build_conditional_branch(is_fail, fail_bb, pass_bb)
        .unwrap();
    cx.b.position_at_end(pass_bb);
    if let Some(t) = stmt.assertion_if_true() {
        lower_segment_statement(cx, handle, signals, nba_fn, sys_fns, &t)?;
    }
    if !crate::stmt_shared::current_block_terminated(cx) {
        cx.b.build_unconditional_branch(done_bb).unwrap();
    }
    cx.b.position_at_end(fail_bb);
    match stmt.assertion_if_false() {
        Some(e) => lower_segment_statement(cx, handle, signals, nba_fn, sys_fns, &e)?,
        None if matches!(
            kind,
            sv_lang::AssertionKind::Assert
                | sv_lang::AssertionKind::Assume
                | sv_lang::AssertionKind::Expect
        ) =>
        {
            let scope = vj_sim::process::cfg::shown_path(&cx.fn_sym);
            severity_frame(
                cx,
                sys_fns,
                "ERROR: ",
                stmt.source_range().start,
                &scope,
                &mut || Ok(()),
            )?;
        }
        None => {}
    }
    if !crate::stmt_shared::current_block_terminated(cx) {
        cx.b.build_unconditional_branch(done_bb).unwrap();
    }
    cx.b.position_at_end(done_bb);
    Ok(())
}

/// `v`'s value lane as an `i64` (sign-extended when `v` is signed): how an
/// assertion instance's captured values travel.
fn packed_as_i64<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    v: PackedValue<'ctx>,
) -> Result<IntValue<'ctx>, LoweringError> {
    if v.width > 64 {
        return Err(LoweringError::unsupported_at(
            "internal error: a wide captured value reached the one-word capture path",
            &cx.fn_sym,
        ));
    }
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let val = op.lane_val(v);
    let i64t = cx.ctx.i64_type();
    Ok(if v.width == 64 {
        val
    } else if v.signed {
        cx.b.build_int_s_extend(val, i64t, "cap_sext").unwrap()
    } else {
        cx.b.build_int_z_extend(val, i64t, "cap_zext").unwrap()
    })
}

/// The words `v` travels in as an assertion instance's captured value of
/// `width` bits ([`crate::sva::proc::CaptureItem::words`]): the two-state
/// [`packed_as_i64`] for a value of at most 64 bits; for a wider one its value
/// limbs, least significant first, then its unknown-plane limbs, so `x` and `z`
/// bits survive the capture (16.14.6.1 samples a value, not a two-state view of it).
fn capture_words<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    v: PackedValue<'ctx>,
    width: u32,
) -> Result<Vec<IntValue<'ctx>>, LoweringError> {
    if width <= 64 {
        return Ok(vec![packed_as_i64(cx, v)?]);
    }
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let v = match v.width.cmp(&width) {
        std::cmp::Ordering::Less => op.extend4(v, width, v.signed),
        std::cmp::Ordering::Equal => v,
        std::cmp::Ordering::Greater => op.truncate4(v, width),
    };
    let i64t = cx.ctx.i64_type();
    let plane_ty = op.i_n(width);
    let limbs = width.div_ceil(64);
    let mut out = Vec::with_capacity(2 * limbs as usize);
    for plane in [op.lane_val(v), op.lane_unk(v)] {
        for k in 0..limbs {
            let shifted =
                cx.b.build_right_shift(
                    plane,
                    plane_ty.const_int(64 * u64::from(k), false),
                    false,
                    "cap_shr",
                )
                .unwrap();
            out.push(cx.b.build_int_truncate(shifted, i64t, "cap_limb").unwrap());
        }
    }
    Ok(out)
}

/// The process side of a procedural concurrent assertion (16.14.6): reaching the
/// statement queues an instance of it -- `sv_rt_proc_assert(plan_index, values, n)`
/// -- carrying the current values of the automatic variables and `const'(expr)`s
/// it uses ([`crate::sva::proc::capture_items`]). Nothing is evaluated here; the
/// engine matures the instance in the Observed region.
fn queue_procedural_assertion<'ctx, 'd, 'm>(
    cx: &mut LowerCtx<'ctx, 'd, 'm>,
    signals: &HashMap<SymbolId, SignalSlot>,
    stmt: &Statement<'d>,
    plan_index: usize,
) -> Result<(), LoweringError> {
    let items = crate::sva::proc::capture_items(signals, *stmt, &cx.fn_sym)?;
    let i64t = cx.ctx.i64_type();
    let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
    let words = crate::sva::proc::capture_words(&items);
    let n = words.max(1) as u32;
    let buf = crate::types::entry_alloca_in(&cx.b, i64t.array_type(n), "assert_capture");
    let mut k = 0usize;
    for item in &items {
        let v = lower_expr(cx, item.expr)?.into_packed(
            "a captured real, string or >128-bit value in a procedural concurrent assertion",
            &cx.fn_sym,
        )?;
        for word in capture_words(cx, v, item.width)? {
            // SAFETY: `k < n`, the length of `buf` (`capture_words` totals it).
            let p = unsafe {
                cx.b.build_in_bounds_gep(
                    i64t,
                    buf,
                    &[i64t.const_int(k as u64, false)],
                    "assert_capture_slot",
                )
                .unwrap()
            };
            cx.b.build_store(p, word).unwrap();
            k += 1;
        }
    }
    let f = cx
        .module
        .get_function(SV_RT_PROC_ASSERT_SYMBOL)
        .unwrap_or_else(|| {
            cx.module.add_function(
                SV_RT_PROC_ASSERT_SYMBOL,
                cx.ctx
                    .void_type()
                    .fn_type(&[i64t.into(), ptr_ty.into(), i64t.into()], false),
                None,
            )
        });
    cx.b.build_call(
        f,
        &[
            i64t.const_int(plan_index as u64, false).into(),
            buf.into(),
            i64t.const_int(words as u64, false).into(),
        ],
        "proc_assert",
    )
    .unwrap();
    Ok(())
}

/// `disable` of procedural concurrent assertions (16.14.6.4): the pending
/// instances of the assertions `keys` (their plan indices) leave the queue --
/// `sv_rt_proc_assert_disable(keys, n)`. Nothing happens for no assertions.
fn lower_assertion_disable<'ctx, 'd, 'm>(
    cx: &mut LowerCtx<'ctx, 'd, 'm>,
    keys: &[usize],
) -> Result<(), LoweringError> {
    if keys.is_empty() {
        return Ok(());
    }
    let i64t = cx.ctx.i64_type();
    let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
    let buf = crate::types::entry_alloca_in(
        &cx.b,
        i64t.array_type(keys.len() as u32),
        "assert_disable_keys",
    );
    for (k, key) in keys.iter().enumerate() {
        // SAFETY: `k < keys.len()`, the length of `buf`.
        let p = unsafe {
            cx.b.build_in_bounds_gep(
                i64t,
                buf,
                &[i64t.const_int(k as u64, false)],
                "assert_disable_slot",
            )
            .unwrap()
        };
        cx.b.build_store(p, i64t.const_int(*key as u64, false))
            .unwrap();
    }
    let f = cx
        .module
        .get_function(SV_RT_PROC_ASSERT_DISABLE_SYMBOL)
        .unwrap_or_else(|| {
            cx.module.add_function(
                SV_RT_PROC_ASSERT_DISABLE_SYMBOL,
                cx.ctx
                    .void_type()
                    .fn_type(&[ptr_ty.into(), i64t.into()], false),
                None,
            )
        });
    cx.b.build_call(
        f,
        &[buf.into(), i64t.const_int(keys.len() as u64, false).into()],
        "proc_assert_disable",
    )
    .unwrap();
    Ok(())
}

/// The action side of a procedural concurrent assertion: makes the values the
/// instance captured readable to its pass/fail statements, under the keys the
/// lowered expressions look them up by (`cx.locals`).
fn prime_assertion_inputs<'ctx, 'd, 'm>(
    cx: &mut LowerCtx<'ctx, 'd, 'm>,
    signals: &HashMap<SymbolId, SignalSlot>,
    stmt: &Statement<'d>,
) -> Result<(), LoweringError> {
    let items = crate::sva::proc::capture_items(signals, *stmt, &cx.fn_sym)?;
    if items.is_empty() {
        return Ok(());
    }
    let mut k = 0usize;
    for item in &items {
        let ptr = assert_input_slot(cx, k, item.width);
        cx.locals
            .insert(item.key.clone(), (ptr, item.width, item.signed));
        k += item.words();
    }
    Ok(())
}

/// Assertion input `k` (an `i64` the engine passed with the resume), truncated
/// to `width` bits (a known value: its unknown lane is zero) into a fresh slot
/// of the representation the lowered expressions read.
pub(crate) fn assert_input_slot<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    k: usize,
    width: u32,
) -> PointerValue<'ctx> {
    let i64t = cx.ctx.i64_type();
    let f = cx
        .module
        .get_function(SV_RT_ASSERT_INPUT_SYMBOL)
        .unwrap_or_else(|| {
            cx.module.add_function(
                SV_RT_ASSERT_INPUT_SYMBOL,
                i64t.fn_type(&[i64t.into()], false),
                None,
            )
        });
    let input = |j: usize| -> IntValue<'ctx> {
        cx.b.build_call(f, &[i64t.const_int(j as u64, false).into()], "assert_input")
            .unwrap()
            .try_as_basic_value()
            .unwrap_basic()
            .into_int_value()
    };
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    if width > 64 {
        // A wide value: `2 * ceil(width / 64)` words, its value limbs then its
        // unknown-plane limbs ([`capture_words`]).
        let limbs = width.div_ceil(64) as usize;
        let plane_ty = op.i_n(width);
        let assemble = |first: usize| -> IntValue<'ctx> {
            let mut acc = plane_ty.const_zero();
            for j in 0..limbs {
                let limb = input(first + j);
                let limb = if (width as usize) < 64 * (j + 1) {
                    cx.b.build_int_truncate(limb, op.i_n(width - 64 * j as u32), "input_top")
                        .unwrap()
                } else {
                    limb
                };
                let ext =
                    cx.b.build_int_z_extend(limb, plane_ty, "input_limb")
                        .unwrap();
                let moved =
                    cx.b.build_left_shift(
                        ext,
                        plane_ty.const_int(64 * j as u64, false),
                        "input_limb_shl",
                    )
                    .unwrap();
                acc = cx.b.build_or(acc, moved, "input_plane").unwrap();
            }
            acc
        };
        let val = assemble(k);
        let stored = if cx.repr == ValueRepr::FourState {
            op.pack(val, assemble(k + limbs), width, ValueRepr::FourState, false)
                .llvm
        } else {
            val
        };
        let ptr = crate::types::entry_alloca_in(&cx.b, stored.get_type(), "assert_input_slot");
        cx.b.build_store(ptr, stored).unwrap();
        return ptr;
    }
    let raw = input(k);
    let val = if width < 64 {
        cx.b.build_int_truncate(raw, op.i_n(width), "input_val")
            .unwrap()
    } else {
        raw
    };
    let stored = if cx.repr == ValueRepr::FourState {
        cx.b.build_int_z_extend(val, op.i_n(width * 2), "input_packed")
            .unwrap()
    } else {
        val
    };
    let ptr = crate::types::entry_alloca_in(&cx.b, stored.get_type(), "assert_input_slot");
    cx.b.build_store(ptr, stored).unwrap();
    ptr
}

/// An immediate assertion (`assert`/`assume`/`cover (expr) pass else
/// fail;`, LRM 1800-2023 §16.3): the pass action when the expression is
/// true, else the fail action -- for an `assert`/`assume` without one,
/// `$error` with no message (§16.3; Icarus prints the same). An unknown
/// value fails. A deferred assertion (`#0`, `final`) is checked where it
/// executes, but its action's output is captured and reported in the
/// Reactive (`final`: Postponed) region, unless the process reaches a
/// flush point first (`vj_sim::sched::deferred`). `action` lowers a
/// pass/fail action statement in the caller's context (a process or a
/// subroutine body).
pub(crate) fn lower_immediate_assertion<'ctx, 'd, 'm>(
    cx: &mut LowerCtx<'ctx, 'd, 'm>,
    sys_fns: &SysCallFns<'ctx>,
    stmt: &Statement<'d>,
    deferred_env: Option<&crate::deferred_call::DeferredEnv<'_, 'ctx>>,
    action: &mut dyn FnMut(
        &mut LowerCtx<'ctx, 'd, 'm>,
        &Statement<'d>,
    ) -> Result<(), LoweringError>,
) -> Result<(), LoweringError> {
    let cond = stmt
        .as_sem_node()
        .children()
        .into_iter()
        .find_map(|n| n.as_expression())
        .ok_or_else(|| {
            LoweringError::unsupported_at("an assertion with no expression", &cx.fn_sym)
        })?;
    let kind = stmt
        .immediate_assertion_kind()
        .ok_or_else(|| LoweringError::unsupported_at("an assertion of unknown kind", &cx.fn_sym))?;
    // 20.11: the control state of the assertion. `$assertoff`/`$assertkill` stop
    // it checking at all; `$assertpassoff` and `$assertfailoff` stop its pass or
    // fail action (the default `$error` included). An immediate assertion has no
    // vacuous success, so only the nonvacuous pass bit applies.
    let site = crate::assert_site::describe(&cx.fn_sym, *stmt).map(|d| d.encode());
    let (_, f) = crate::stmt_shared::current_block_and_fn(cx)?;
    let controlled = match &site {
        Some(text) => {
            let bits = assert_ctl_query(cx, text);
            let checking = query_bit(
                cx,
                bits,
                vj_sim::sched::assert_control::Q_CHECKING,
                "assert_checking",
            );
            let pass_on = query_bit(
                cx,
                bits,
                vj_sim::sched::assert_control::Q_PASS_NONVACUOUS,
                "assert_pass_on",
            );
            let fail_on = query_bit(
                cx,
                bits,
                vj_sim::sched::assert_control::Q_FAIL,
                "assert_fail_on",
            );
            let run_bb = cx.ctx.append_basic_block(f, "assert_run");
            let off_bb = cx.ctx.append_basic_block(f, "assert_off");
            cx.b.build_conditional_branch(checking, run_bb, off_bb)
                .unwrap();
            cx.b.position_at_end(run_bb);
            Some((pass_on, fail_on, off_bb))
        }
        None => None,
    };
    let pass = crate::expr::lower_condition(cx, cond)?;
    // A deferred assertion: capture whichever action runs.
    let deferred = stmt.is_deferred_assertion() == Some(true);
    let capture_start = deferred.then(|| deferred_begin_call(cx));
    // 16.4.1: the capture starts at the action's first printing call, after its
    // arguments are evaluated (`mark_deferred_args_done`).
    let capture_slot = deferred.then(|| {
        let slot = crate::types::entry_alloca_in(&cx.b, cx.ctx.i64_type(), "deferred_start_slot");
        cx.b.build_store(slot, cx.ctx.i64_type().const_all_ones())
            .unwrap();
        slot
    });
    let outer_slot = cx.deferred_start.replace(capture_slot);
    let pass_bb = cx.ctx.append_basic_block(f, "assert_pass");
    let fail_bb = cx.ctx.append_basic_block(f, "assert_fail");
    let done_bb = cx.ctx.append_basic_block(f, "assert_done");
    cx.b.build_conditional_branch(pass, pass_bb, fail_bb)
        .unwrap();
    cx.b.position_at_end(pass_bb);
    // The pass (fail) action runs only while it is on.
    if let Some((pass_on, _, _)) = &controlled {
        let run = cx.ctx.append_basic_block(f, "assert_pass_run");
        cx.b.build_conditional_branch(*pass_on, run, done_bb)
            .unwrap();
        cx.b.position_at_end(run);
    }
    if let Some(t) = stmt.immediate_assertion_if_true() {
        run_assertion_action(
            cx,
            stmt,
            deferred,
            deferred_env,
            site.as_deref(),
            &t,
            action,
        )?;
    }
    if !crate::stmt_shared::current_block_terminated(cx) {
        cx.b.build_unconditional_branch(done_bb).unwrap();
    }
    cx.b.position_at_end(fail_bb);
    if let Some((_, fail_on, _)) = &controlled {
        let run = cx.ctx.append_basic_block(f, "assert_fail_run");
        cx.b.build_conditional_branch(*fail_on, run, done_bb)
            .unwrap();
        cx.b.position_at_end(run);
    }
    match stmt.immediate_assertion_if_false() {
        Some(e) => run_assertion_action(
            cx,
            stmt,
            deferred,
            deferred_env,
            site.as_deref(),
            &e,
            action,
        )?,
        None if matches!(
            kind,
            sv_lang::AssertionKind::Assert | sv_lang::AssertionKind::Assume
        ) =>
        {
            let scope = vj_sim::process::cfg::shown_path(&cx.fn_sym);
            severity_frame(
                cx,
                sys_fns,
                "ERROR: ",
                stmt.source_range().start,
                &scope,
                &mut || Ok(()),
            )?;
        }
        None => {}
    }
    if !crate::stmt_shared::current_block_terminated(cx) {
        cx.b.build_unconditional_branch(done_bb).unwrap();
    }
    cx.b.position_at_end(done_bb);
    cx.deferred_start.set(outer_slot);
    if let (Some(first), Some(slot)) = (capture_start, capture_slot) {
        let i64t = cx.ctx.i64_type();
        let marked =
            cx.b.build_load(i64t, slot, "deferred_start_marked")
                .unwrap()
                .into_int_value();
        let unset =
            cx.b.build_int_compare(
                inkwell::IntPredicate::EQ,
                marked,
                i64t.const_all_ones(),
                "deferred_nothing_printed",
            )
            .unwrap();
        let start =
            cx.b.build_select(unset, first, marked, "deferred_capture_start")
                .unwrap()
                .into_int_value();
        let mode = if stmt.is_final_assertion() == Some(true) {
            vj_sim::sched::DEFERRED_MODE_FINAL
        } else {
            vj_sim::sched::DEFERRED_MODE_OBSERVED
        };
        deferred_end_call(
            cx,
            start,
            stmt.source_range().start.offset,
            mode,
            site.as_deref(),
        );
    }
    // An assertion that is off came straight here.
    if let Some((_, _, off_bb)) = controlled {
        cx.b.build_unconditional_branch(off_bb).unwrap();
        cx.b.position_at_end(off_bb);
    }
    Ok(())
}

/// One pass/fail action of an immediate assertion. A deferred assertion whose
/// action is a call of a user task or void function does not make the call: it
/// captures the arguments and queues the call for the report's maturation
/// (LRM 16.4.1, `crate::deferred_call`). Anything else runs through `action`.
fn run_assertion_action<'ctx, 'd, 'm>(
    cx: &mut LowerCtx<'ctx, 'd, 'm>,
    stmt: &Statement<'d>,
    deferred: bool,
    deferred_env: Option<&crate::deferred_call::DeferredEnv<'_, 'ctx>>,
    site: Option<&str>,
    act: &Statement<'d>,
    action: &mut dyn FnMut(
        &mut LowerCtx<'ctx, 'd, 'm>,
        &Statement<'d>,
    ) -> Result<(), LoweringError>,
) -> Result<(), LoweringError> {
    if deferred && let Some(call) = crate::deferred_call::action_call(act) {
        let env = deferred_env.ok_or_else(|| {
            LoweringError::unsupported_at(
                "a deferred assertion in a subroutine body whose action calls a user task or \
                 function (LRM 16.4.1: the call is made when the report matures, which needs \
                 the calling process's instance)",
                &cx.fn_sym,
            )
        })?;
        return crate::deferred_call::lower_deferred_call(
            cx,
            env,
            call,
            stmt.is_final_assertion() == Some(true),
            site,
        );
    }
    action(cx, act)
}

/// `disable <label>;` where `label` names a deferred immediate assertion of the
/// running process or subroutine body (LRM 16.4.4): cancels the executing
/// process's pending reports of that assertion, through `sv_rt_deferred_end`'s
/// cancel mode. `false` when `label` names no such assertion.
pub(crate) fn lower_deferred_disable<'ctx, 'd, 'm>(
    cx: &mut LowerCtx<'ctx, 'd, 'm>,
    label: &str,
) -> Result<bool, LoweringError> {
    let Some(body) = vj_sim::process::cfg::proc_body(&cx.fn_sym) else {
        return Ok(false);
    };
    let Some((_, assertion)) = vj_sim::process::cfg::deferred_assertion_labels(&body)
        .into_iter()
        .find(|(n, _)| n == label)
    else {
        return Ok(false);
    };
    let Some(site) = crate::assert_site::describe(&cx.fn_sym, assertion).map(|d| d.encode()) else {
        return Ok(false);
    };
    let start = deferred_begin_call(cx);
    deferred_end_call(
        cx,
        start,
        0,
        vj_sim::sched::DEFERRED_MODE_CANCEL,
        Some(&site),
    );
    Ok(true)
}

/// The first printing call of a deferred assertion's action has evaluated its
/// arguments (LRM 16.4.1: "the subroutine arguments of the action block are
/// evaluated" when the assertion fails, the action itself runs later): moves
/// the capture start past anything the evaluation printed (a function called
/// in an argument), once per assertion execution. No-op outside a deferred
/// action.
pub(crate) fn mark_deferred_args_done<'ctx>(cx: &LowerCtx<'ctx, '_, '_>) {
    let Some(slot) = cx.deferred_start.get() else {
        return;
    };
    let i64t = cx.ctx.i64_type();
    let cur =
        cx.b.build_load(i64t, slot, "deferred_start")
            .unwrap()
            .into_int_value();
    let unset =
        cx.b.build_int_compare(
            inkwell::IntPredicate::EQ,
            cur,
            i64t.const_all_ones(),
            "deferred_unset",
        )
        .unwrap();
    let now = deferred_begin_call(cx);
    let next =
        cx.b.build_select(unset, now, cur, "deferred_start_next")
            .unwrap();
    cx.b.build_store(slot, next).unwrap();
}

/// `sv_rt_deferred_begin()`: starts capturing the output of a deferred
/// action (a deferred assertion's, or a `unique`/`priority` violation
/// report's) -- the returned token is where it begins.
pub(crate) fn deferred_begin_call<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
) -> inkwell::values::IntValue<'ctx> {
    let i64t = cx.ctx.i64_type();
    let begin = cx
        .module
        .get_function(SV_RT_DEFERRED_BEGIN_SYMBOL)
        .unwrap_or_else(|| {
            cx.module
                .add_function(SV_RT_DEFERRED_BEGIN_SYMBOL, i64t.fn_type(&[], false), None)
        });
    cx.b.build_call(begin, &[], "deferred_begin")
        .unwrap()
        .try_as_basic_value()
        .unwrap_basic()
        .into_int_value()
}

/// `sv_rt_deferred_end(start, site, mode, control)`: the captured output since
/// `start` is reported by assertion `site` as its `mode` says
/// (`vj_sim::sched::DEFERRED_MODE_OBSERVED`/`_FINAL`, or a
/// `ViolationType::deferred_mode`). `control` is the assertion control site
/// (20.11) of the report -- a `SiteDesc::encode` text -- that `$assertoff` and
/// `$assertkill` act on.
pub(crate) fn deferred_end_call<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    start: inkwell::values::IntValue<'ctx>,
    site: u64,
    mode: u32,
    control: Option<&str>,
) {
    let i64t = cx.ctx.i64_type();
    let i32t = cx.ctx.i32_type();
    let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
    let end = cx
        .module
        .get_function(SV_RT_DEFERRED_END_SYMBOL)
        .unwrap_or_else(|| {
            cx.module.add_function(
                SV_RT_DEFERRED_END_SYMBOL,
                cx.ctx.void_type().fn_type(
                    &[i64t.into(), i64t.into(), i32t.into(), ptr_ty.into()],
                    false,
                ),
                None,
            )
        });
    let control = match control {
        Some(text) => build_c_string_global(cx.ctx, cx.module, text, "assert_site"),
        None => ptr_ty.const_null(),
    };
    cx.b.build_call(
        end,
        &[
            start.into(),
            i64t.const_int(site, false).into(),
            i32t.const_int(u64::from(mode), false).into(),
            control.into(),
        ],
        "deferred_end",
    )
    .unwrap();
}

/// `u64 sv_rt_assert_ctl(u32 op, i64 a0, i64 a1, i64 a2, i64 a3, ptr text)`: the
/// assertion control registry (20.11), bound to
/// `vj_sim::sched::assert_control::real_sv_rt_assert_ctl`.
pub const SV_RT_ASSERT_CTL_SYMBOL: &str = "sv_rt_assert_ctl";

fn assert_ctl_fn<'ctx>(cx: &LowerCtx<'ctx, '_, '_>) -> FunctionValue<'ctx> {
    let i32_ty = cx.ctx.i32_type();
    let i64_ty = cx.ctx.i64_type();
    let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
    cx.module
        .get_function(SV_RT_ASSERT_CTL_SYMBOL)
        .unwrap_or_else(|| {
            cx.module.add_function(
                SV_RT_ASSERT_CTL_SYMBOL,
                i64_ty.fn_type(
                    &[
                        i32_ty.into(),
                        i64_ty.into(),
                        i64_ty.into(),
                        i64_ty.into(),
                        i64_ty.into(),
                        ptr_ty.into(),
                    ],
                    false,
                ),
                Some(Linkage::External),
            )
        })
}

/// The `Q_*` bits (`vj_sim::sched::assert_control`) of the control state of
/// the assertion `site` (a `SiteDesc::encode` text): which of its checking, its
/// nonvacuous pass action, its vacuous pass action and its fail action the
/// control tasks left on.
fn assert_ctl_query<'ctx>(cx: &LowerCtx<'ctx, '_, '_>, site: &str) -> IntValue<'ctx> {
    let i32_ty = cx.ctx.i32_type();
    let i64_ty = cx.ctx.i64_type();
    let text = build_c_string_global(cx.ctx, cx.module, site, "assert_site");
    cx.b.build_call(
        assert_ctl_fn(cx),
        &[
            i32_ty
                .const_int(
                    u64::from(vj_sim::sched::assert_control::CTL_OP_QUERY),
                    false,
                )
                .into(),
            i64_ty.const_zero().into(),
            i64_ty.const_zero().into(),
            i64_ty.const_zero().into(),
            i64_ty.const_zero().into(),
            text.into(),
        ],
        "assert_query",
    )
    .unwrap()
    .try_as_basic_value()
    .unwrap_basic()
    .into_int_value()
}

/// Whether `bit` of the query result `bits` is set, as an `i1`.
fn query_bit<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    bits: IntValue<'ctx>,
    bit: u32,
    name: &str,
) -> IntValue<'ctx> {
    let masked =
        cx.b.build_and(bits, bits.get_type().const_int(u64::from(bit), false), name)
            .unwrap();
    cx.b.build_int_compare(
        inkwell::IntPredicate::NE,
        masked,
        bits.get_type().const_zero(),
        name,
    )
    .unwrap()
}

/// `$assertcontrol(control_type[, assertion_type[, directive_type[, levels[,
/// list]]]])` and the convenience tasks `$asserton`..`$assertvacuousoff` (LRM
/// 1800-2023 20.11, which defines each as an `$assertcontrol`): one
/// `sv_rt_assert_ctl` control call. The scalar arguments are evaluated when the
/// task executes; an omitted `assertion_type`, `directive_type` and `levels` take
/// their defaults (255, 7, 0), and the list names scopes or assertions by their
/// hierarchical names.
fn lower_assert_control_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    name: KnownSystemName,
    e: Expression<'d>,
) -> Result<(), LoweringError> {
    use vj_sim::sched::assert_control as ac;
    let i32_ty = cx.ctx.i32_type();
    let i64_ty = cx.ctx.i64_type();
    let args = e.operands();
    // `(control_type, assertion_type, directive_type)` of the convenience tasks.
    let fixed = |control: i64, atype: i64| (control, atype, i64::from(ac::DIR_ALL));
    let fixed_args = match name {
        KnownSystemName::AssertControl => None,
        KnownSystemName::AssertOn => Some(fixed(3, 15)),
        KnownSystemName::AssertOff => Some(fixed(4, 15)),
        KnownSystemName::AssertKill => Some(fixed(5, 15)),
        KnownSystemName::AssertPassOn => Some(fixed(6, 31)),
        KnownSystemName::AssertPassOff => Some(fixed(7, 31)),
        KnownSystemName::AssertFailOn => Some(fixed(8, 31)),
        KnownSystemName::AssertFailOff => Some(fixed(9, 31)),
        KnownSystemName::AssertNonvacuousOn => Some(fixed(10, 31)),
        KnownSystemName::AssertVacuousOff => Some(fixed(11, 31)),
        other => {
            return Err(LoweringError::unsupported_at(
                &format!("{other:?} is not an assertion control task (internal invariant)"),
                &cx.fn_sym,
            ));
        }
    };
    // One scalar argument as an `i64`, `default` when it is absent or empty.
    let scalar = |arg: Option<&Expression<'d>>,
                  default: i64,
                  what: &str|
     -> Result<IntValue<'ctx>, LoweringError> {
        match arg.filter(|a| a.kind() != ExpressionKind::EmptyArgument) {
            Some(a) => {
                let pv = lower_expr(cx, *a)?.into_packed(
                    &format!("the {what} argument of an assertion control task must be integral"),
                    &cx.fn_sym,
                )?;
                let op = OpBuilder {
                    ctx: cx.ctx,
                    b: &cx.b,
                };
                let v = crate::expr::packed_to_plain_i32(&op, pv);
                Ok(cx.b.build_int_s_extend(v, i64_ty, what).unwrap())
            }
            None => Ok(i64_ty.const_int(default as u64, true)),
        }
    };
    let (control, atype, directive, levels, targets) = match fixed_args {
        Some((control, atype, directive)) => (
            i64_ty.const_int(control as u64, false),
            i64_ty.const_int(atype as u64, false),
            i64_ty.const_int(directive as u64, false),
            scalar(args.first(), 0, "levels")?,
            args.get(1..).unwrap_or(&[]),
        ),
        None => {
            if args.is_empty() {
                return Err(LoweringError::unsupported_at(
                    "$assertcontrol needs a control_type argument",
                    &cx.fn_sym,
                ));
            }
            (
                scalar(args.first(), 0, "control_type")?,
                scalar(args.get(1), i64::from(ac::ASSERT_ALL), "assertion_type")?,
                scalar(args.get(2), i64::from(ac::DIR_ALL), "directive_type")?,
                scalar(args.get(3), 0, "levels")?,
                args.get(4..).unwrap_or(&[]),
            )
        }
    };
    let mut paths = Vec::new();
    for target in targets {
        let sym = target
            .arbitrary_symbol()
            .or_else(|| target.referenced_symbol())
            .ok_or_else(|| {
                LoweringError::unsupported_at(
                    "an assertion control task's scope or assertion argument must name a \
                     module instance, a scope or an assertion",
                    &cx.fn_sym,
                )
            })?;
        paths.push(vj_sim::process::cfg::shown_path(&sym));
    }
    let text = build_c_string_global(cx.ctx, cx.module, &paths.join("\n"), "assert_targets");
    cx.b.build_call(
        assert_ctl_fn(cx),
        &[
            i32_ty
                .const_int(u64::from(ac::CTL_OP_CONTROL), false)
                .into(),
            control.into(),
            atype.into(),
            directive.into(),
            levels.into(),
            text.into(),
        ],
        "rt_assert_control",
    )
    .unwrap();
    Ok(())
}

/// The LRM 20.2 Table 20-1 diagnostic of a `$finish`/`$stop` of `code` (1 or 2) called
/// as `name` at `e`: a marked `$write` the runtime sends to stderr.
fn lower_finish_diag<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    sys_fns: &SysCallFns<'ctx>,
    e: sv_lang::Expression<'d>,
    code: i64,
    name: &str,
) -> Result<(), LoweringError> {
    let scope = e.system_call_scope().unwrap_or(cx.fn_sym);
    let loc = vj_sim::process::cfg::source_location(e.source_range().start)
        .unwrap_or_else(|| "?".to_string());
    let unit = match crate::timescale::scale_at(&scope) {
        Some(ts) => crate::timescale::value_text(ts.base),
        None => "1s".to_string(),
    };
    let fmt = crate::systask::build_c_string_global(
        cx.ctx,
        cx.module,
        &format!(
            "{}{code}{loc}: {name} called at %0d ({unit})",
            char::from(vj_runtime::display::FINISH_DIAG_MARK)
        ),
        "finish_diag",
    );
    let now = crate::expr::lower_time_system_call(cx, KnownSystemName::Time, "$time", &scope)?;
    let rtarg_ty = crate::systask::rtarg_llvm_type(cx.ctx);
    let (args_ptr, n) = crate::systask::build_rtarg_array(cx, rtarg_ty, vec![now])?;
    cx.b.build_call(
        sys_fns.write,
        &[fmt.into(), args_ptr.into(), n.into()],
        "rt_finish_diag",
    )
    .unwrap();
    Ok(())
}

pub(crate) fn lower_finish_call<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    handle: PointerValue<'ctx>,
    sys_fns: &SysCallFns<'ctx>,
    e: sv_lang::Expression<'d>,
    which: KnownSystemName,
) -> Result<(), LoweringError> {
    let finish_fn = sys_fns.finish;
    let children = e.children();
    let name = if which == KnownSystemName::Stop {
        "$stop"
    } else {
        "$finish"
    };
    // `finish_number` is an expression (LRM 20.2): a constant picks the diagnostic at
    // compile time, anything else is read when the call runs.
    let arg_expr = match children.first() {
        None => None,
        Some(node) => Some(node.as_expression().ok_or_else(|| {
            LoweringError::unsupported_at("$finish's argument is not an expression", &cx.fn_sym)
        })?),
    };
    let constant: Option<i64> = match arg_expr {
        None => Some(1),
        Some(a) => match a.constant_value() {
            Some(cv) => {
                let iv = cv.as_integer().ok_or_else(|| {
                    LoweringError::unsupported_at(
                        "$finish's argument constant is not an integer",
                        &cx.fn_sym,
                    )
                })?;
                Some(iv.as_i64().ok_or_else(|| {
                    LoweringError::unsupported_at(
                        "$finish's argument constant does not fit in an i64",
                        &cx.fn_sym,
                    )
                })?)
            }
            None => None,
        },
    };
    match constant {
        Some(code) => {
            // LRM 20.2 Table 20-1: the argument picks the diagnostic printed, it is not an
            // exit status (a bare `$finish` is level 1 and ends cleanly, so does
            // `$finish(1)`); only 0, 1 and 2 are defined.
            if !(0..=2).contains(&code) {
                return Err(LoweringError::unsupported_at(
                    "$finish/$stop argument must be 0, 1 or 2 (LRM 20.2)",
                    &cx.fn_sym,
                ));
            }
            // The diagnostic goes to stderr before the run ends: a marked `$write` the
            // runtime renders (`vj_runtime::display::FINISH_DIAG_MARK`), carrying the
            // level, the call's location and the time in the calling scope's unit. Level
            // 0 prints nothing.
            if code > 0 {
                lower_finish_diag(cx, sys_fns, e, code, name)?;
            }
        }
        None => {
            // A run-time level: 1 and 2 print their diagnostic, 0 prints nothing; the
            // LRM defines no other value (like iverilog, any other prints nothing).
            let a = arg_expr.expect("a non-constant argument exists");
            let pv = lower_expr(cx, a)?
                .into_packed("$finish's argument must be integral", &cx.fn_sym)?;
            let op = OpBuilder {
                ctx: cx.ctx,
                b: &cx.b,
            };
            let v = crate::expr::packed_to_plain_i32(&op, pv);
            let (_, f) = crate::stmt_shared::current_block_and_fn(cx)?;
            for level in [1_i64, 2] {
                let hit = cx.ctx.append_basic_block(f, "finish_level");
                let next = cx.ctx.append_basic_block(f, "finish_next");
                let is =
                    cx.b.build_int_compare(
                        inkwell::IntPredicate::EQ,
                        v,
                        v.get_type().const_int(level as u64, false),
                        "finish_is_level",
                    )
                    .unwrap();
                cx.b.build_conditional_branch(is, hit, next).unwrap();
                cx.b.position_at_end(hit);
                lower_finish_diag(cx, sys_fns, e, level, name)?;
                cx.b.build_unconditional_branch(next).unwrap();
                cx.b.position_at_end(next);
            }
        }
    }
    let code_const = cx.ctx.i32_type().const_int(0, true);
    cx.b.build_call(
        finish_fn,
        &[handle.into(), code_const.into()],
        "rt_finish_call",
    )
    .unwrap();
    Ok(())
}

/// Primes an `alloca` for every external signal `seg` references (populated
/// via `sv_get_scalar`), inserting `(SymbolId, (ptr, width, signed))` into
/// `cx.locals` -- part of this file's own per-segment "prologue" for
/// EXTERNAL signals (distinct from the once-per-call frame prologue PR-038
/// governs). Returns the set of externally-referenced symbols that must be
/// flushed back after the segment's statements lower.
/// Task 10 (A2-part2, PR-122): the per-partition additive bias this file's
/// two accessor-call sites (here and [`flush_external_signals`]) add to a
/// `SignalSlot::slot` before it becomes an LLVM constant operand --
/// `vj_sim::process::arena_base_offset_for_region(region_id,
/// slots_per_region)`. `slots_per_region` is `signals.len()` (this
/// process's own known external-signal count): no live `vj_sim::
/// state::layout::StateLayout` is wired into this crate yet (this file's
/// own module doc comment: "no such wiring exists yet in this wave, so this
/// task's own tests build the map directly"), and `region_id` is `0` for
/// every real v1 process (`ProcessLoweringPlan::region_id`'s own doc
/// comment), so `arena_base_offset_for_region(0, _) == 0` regardless of
/// this stride's exact value for every real design today -- this task
/// changes zero observable behavior for any real v1 design. For a
/// synthetic, hand-set nonzero `region_id` (no such partition exists yet;
/// see `region_arena_bias.rs`'s own IR-inspection tests), this stride is a
/// real, correct, non-overlapping bound for that ONE process's own two
/// lowerings sharing the same `signals` map (the scenario those tests
/// exercise) -- not a cross-process guarantee, since a different process's
/// own `signals.len()` could differ; a live `StateLayout`-sourced total
/// slot count is the eventual, cross-process-correct replacement, wiring
/// which is explicitly out of this task's own scope (its plan text: "without
/// ... touching STATE's `state::layout`").
/// `signals` with each aliased `ref` formal of `seg`
/// (`Segment::ref_aliases`) naming its actual's slot: one process may bind a
/// formal to different storage per call (LRM 13.5.2).
pub(crate) fn seg_signals<'a>(
    signals: &'a HashMap<SymbolId, SignalSlot>,
    seg: &Segment<'_>,
) -> Result<std::borrow::Cow<'a, HashMap<SymbolId, SignalSlot>>, LoweringError> {
    if seg.ref_aliases.is_empty() {
        return Ok(std::borrow::Cow::Borrowed(signals));
    }
    let mut out = signals.clone();
    for (formal, actual) in &seg.ref_aliases {
        let slot = *signals.get(&actual.uid()).ok_or_else(|| {
            LoweringError::unsupported_at(
                &format!(
                    "`ref` argument `{}` is bound to `{}`, which is not storage of this instance",
                    formal.name(),
                    actual.name()
                ),
                formal,
            )
        })?;
        out.insert(formal.uid(), slot);
    }
    Ok(std::borrow::Cow::Owned(out))
}

/// [`seg_signals`] over every segment of `segments` at once (a formal aliased
/// to different actuals keeps one of them: only its width and class matter).
fn all_seg_signals<'a>(
    signals: &'a HashMap<SymbolId, SignalSlot>,
    segments: &[Segment<'_>],
) -> Result<std::borrow::Cow<'a, HashMap<SymbolId, SignalSlot>>, LoweringError> {
    let mut out = std::borrow::Cow::Borrowed(signals);
    for seg in segments.iter().filter(|s| !s.ref_aliases.is_empty()) {
        let with = seg_signals(signals, seg)?;
        for (formal, _) in &seg.ref_aliases {
            if !out.contains_key(&formal.uid()) {
                out.to_mut().insert(formal.uid(), with[&formal.uid()]);
            }
        }
    }
    Ok(out)
}

fn region_arena_bias(region_id: u32, signals: &HashMap<SymbolId, SignalSlot>) -> u32 {
    vj_sim::process::arena_base_offset_for_region(region_id, signals.len() as u32)
}

/// `ext_ptrs`: `None` (`lower_fast_path`'s only call site) means this
/// segment is the function's ONE and only basic block, so a fresh
/// `build_alloca` right here is already, trivially, "once per call" -- no
/// hoisting is needed or done. `Some(hoisted)` (`lower_switch_path`'s call
/// site, Task 3/PR-045) means every external signal any segment in the
/// enclosing plan might reference already has exactly one `alloca`, built
/// once in the function's `entry_bb` before any segment's own code -- see
/// that call site's own doc comment for why a per-segment `alloca` there is
/// a genuine, unbounded dynamic stack allocation whenever that segment's
/// basic block is revisited via a loop back-edge without the function ever
/// returning. Either way, the actual PRIMING (the `sv_get_scalar` call +
/// store into the shadow slot) still happens here, at this segment's own
/// position, every time this segment is entered -- that part is correct and
/// necessary as-is: it is what lets a later segment in the same call see an
/// earlier segment's own `flush_external_signals` write (both round-trip
/// through the accessor ABI, never a direct alloca-to-alloca handoff).
#[allow(clippy::too_many_arguments)]
fn prime_external_signals<'ctx, 'd, 'm>(
    cx: &mut LowerCtx<'ctx, 'd, 'm>,
    fns: &AccessorFns<'ctx>,
    handle: PointerValue<'ctx>,
    seg: &Segment<'d>,
    signals: &HashMap<SymbolId, SignalSlot>,
    region_id: u32,
    ext_ptrs: Option<&HashMap<SymbolId, PointerValue<'ctx>>>,
    extra: &[Expression<'d>],
) -> HashSet<SymbolId> {
    let owner = cx.fn_sym.uid();
    let (refs, written, hidden) = external_refs_in_segment(seg, signals, &owner, extra);
    let bias = region_arena_bias(region_id, signals);
    // A sampled value call's hidden cells (value history) read exactly like
    // an external signal, so `crate::sampled` finds them in `cx.locals`.
    // (`$inferred_disable`'s signal may also be a plain reference: prime it once.)
    let mut primed = HashSet::new();
    let ids = refs
        .iter()
        .map(SymbolUid::uid)
        .chain(hidden)
        .filter(|id| primed.insert(id.clone()))
        .collect::<Vec<_>>();
    // A checker `always_ff` (LRM 17.5) reads every signal but its event
    // control's at the sampled value: the shadow is primed from the signal's
    // P cell. `hidden_slots` made a cell for each, and the layout failed
    // loudly if that was not possible, so a missing one is a bug.
    let sampled = vj_sim::sva::sampled::checker_ff_sampled_signals(&cx.fn_sym)
        .expect("a checker always_ff's sampled signals were validated by the layout");
    // An aliased `ref` formal shares its actual's slot: one shadow for both,
    // so a write through either is seen by a read of the other.
    let mut by_slot: HashMap<u32, (PointerValue<'ctx>, u32, bool)> = HashMap::new();
    // JIT only, from two `Inline` reads up (`crate::accessor::InlineReads`).
    let mut inline_reads = crate::accessor::InlineReads::new(
        ids.iter()
            .filter(|id| {
                signals[*id].class == SignalSlotClass::Inline
                    && !crate::huge::is_huge_width(signals[*id].width)
            })
            .count(),
    );
    for sym_id in ids {
        let info = signals[&sym_id];
        if let Some(&shared) = by_slot.get(&info.slot) {
            cx.locals.insert(sym_id, shared);
            continue;
        }
        let info = if sampled.contains(&sym_id) {
            assert!(
                !written.contains(&sym_id),
                "a checker always_ff blocking-writes a signal it samples"
            );
            signals[&vj_sim::sva::sampled::p_id(&sym_id)]
        } else {
            info
        };
        let biased_slot = info.slot + bias;
        // A vector past the huge threshold: its shadow is a memory image
        // (`crate::huge`), primed through the wide accessor's planes.
        if crate::huge::is_huge_width(info.width) {
            // The runtime owns the shadow (a long-lived image kept current
            // from the signal's dirty window, `vj_sim::state::huge_mirror`):
            // priming is O(changed words), not O(width), and the pointer is
            // the call's result, valid for this segment.
            // LRM 30.4: a specify-path VARIABLE destination this segment WRITES
            // works on its retimer's staging cell's image, so the dirty window
            // marked by the write and the commit (`flush_external_signals`, the
            // write-through table) name the same image; priming the variable's
            // own image would commit an unmarked staging image and lose the write.
            let prime_slot = if written.contains(&sym_id) {
                cx.specify_dest
                    .get(&sym_id)
                    .map_or(biased_slot, |r| r.slot + bias)
            } else {
                biased_slot
            };
            let ptr = crate::huge::rt_prime(&*cx, handle, prime_slot, info.width, false);
            cx.locals
                .insert(sym_id.clone(), (ptr, info.width, info.signed));
            by_slot.insert(signals[&sym_id].slot, (ptr, info.width, info.signed));
            continue;
        }
        // R-run Task 13 (ST-009/AB-050/CG-163): dispatch on the signal's own
        // accessor-ABI tier -- `Inline` (width <= 64, the pre-Task-13 sole
        // path) via `sv_get_scalar`, `Wide` (width > 64) via `sv_get_wide`.
        // `Memory` never reaches this loop at all (`external_refs_in_segment`
        // excludes it -- see that function's own doc comment).
        let raw = match info.class {
            SignalSlotClass::Inline => inline_reads.get(&*cx, fns, handle, biased_slot, info.width),
            SignalSlotClass::Wide => build_get_wide(&*cx, fns, handle, biased_slot, info.width),
            SignalSlotClass::Memory { .. } => {
                unreachable!("external_refs_in_segment excludes SignalSlotClass::Memory symbols")
            }
        };
        let ptr = match ext_ptrs.and_then(|m| m.get(&sym_id)) {
            Some(&hoisted) => hoisted,
            None => {
                let packed_ty = int_type(cx.ctx, info.width * 2);
                crate::types::entry_alloca_in(&cx.b, packed_ty, "ext_shadow")
            }
        };
        cx.b.build_store(ptr, raw).unwrap();
        cx.locals
            .insert(sym_id.clone(), (ptr, info.width, info.signed));
        by_slot.insert(signals[&sym_id].slot, (ptr, info.width, info.signed));
    }
    written
}

/// Task 3 (PR-045): the union of every external signal referenced -- read
/// OR written -- by ANY segment in `segments`, each destined for exactly
/// ONE `alloca`, built by the caller in `entry_bb` before any segment's own
/// code runs. See `lower_switch_path`'s call site and `prime_external_
/// signals`'s own doc comment for the full root-cause reasoning: a `for`/
/// `while`/... loop with no suspend point of its own still lowers to more
/// than one `Segment` (header/body/step, `process::cfg::walk_for_loop` et
/// al.), each becoming its own LLVM basic block that a back-edge (`SegTerminator::
/// End{loop_back: Some(_)}`/`Goto`) can revisit many times at runtime
/// without this function ever returning -- an `alloca` built at that
/// block's own position is therefore a genuine, unbounded DYNAMIC stack
/// allocation, not the "once per call" prologue every other frame/external
/// slot in this file already gets.
fn external_symbols_in_plan<'d>(
    segments: &[Segment<'d>],
    signals: &HashMap<SymbolId, SignalSlot>,
    owner: &SymbolId,
    extra: &[Expression<'d>],
) -> Result<HashSet<SymbolId>, LoweringError> {
    let mut all = HashSet::new();
    for seg in segments {
        let signals = seg_signals(signals, seg)?;
        let (refs, written, hidden) = external_refs_in_segment(seg, &signals, owner, extra);
        all.extend(refs.iter().map(SymbolUid::uid));
        all.extend(written);
        all.extend(hidden);
    }
    Ok(all)
}

/// Flushes every symbol in `written` back to STATE via `sv_set_scalar`,
/// reading its current value from the shadow `alloca` `prime_external_
/// signals` installed into `cx.locals` (CG-093: the accessor call, never a
/// direct arena write). Deferred to segment-end -- see this file's module
/// doc comment for why that is still correct within one segment's
/// straight-line execution.
fn flush_external_signals<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    fns: &AccessorFns<'ctx>,
    handle: PointerValue<'ctx>,
    written: &HashSet<SymbolId>,
    signals: &HashMap<SymbolId, SignalSlot>,
    region_id: u32,
) {
    let bias = region_arena_bias(region_id, signals);
    // Symbol order, not hash order: the flush order is part of the emitted
    // code (and of the order the scheduler sees the changes in).
    let mut written: Vec<&SymbolId> = written.iter().collect();
    written.sort();
    for id in written {
        let (ptr, width, _signed) = cx.locals[id];
        let info = signals[id];
        // LRM 30.4: a specify-path VARIABLE destination's blocking write
        // lands in its retimer's staging cell, never the variable itself
        // (the same redirect its nonblocking write takes in
        // `select::resolve_lvalue`). The shadow was primed from the real
        // variable, so reads inside the segment see the process's own value.
        let biased_slot = cx.specify_dest.get(id).map_or(info.slot, |r| r.slot) + bias;
        if crate::huge::is_huge_width(width) {
            // Only the dirty window is committed (a clean shadow is a no-op).
            crate::huge::rt_commit(cx, handle, biased_slot, width);
            continue;
        }
        let packed_ty = int_type(cx.ctx, width * 2);
        let cur = cx.b.build_load(packed_ty, ptr, "ext_flush_ld").unwrap();
        // R-run Task 13: the write-side twin of `prime_external_signals`'s
        // own class dispatch, above.
        match info.class {
            SignalSlotClass::Inline => build_set_scalar(
                cx,
                fns,
                handle,
                biased_slot,
                cur.into_int_value(),
                info.width,
            ),
            SignalSlotClass::Wide => build_set_wide(
                cx,
                fns,
                handle,
                biased_slot,
                cur.into_int_value(),
                info.width,
            ),
            SignalSlotClass::Memory { .. } => unreachable!(
                "external_refs_in_segment excludes SignalSlotClass::Memory symbols from `written`"
            ),
        }
    }
}

/// Gives every declared local its starting value when the process first
/// runs: its declaration initializer (`int x = 5;`) or else its type's
/// default (0 for a 2-state type such as `int`, all-X for a 4-state one).
/// A local declared in an `initial`/`always` block is STATIC by default
/// (LRM 1800-2023 §6.21), so this happens once, at process start -- a
/// `begin int acc = 10; ... end` loop body does not re-run it per iteration
/// (Icarus agrees).
fn emit_local_inits<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    plan: &ProcessLoweringPlan<'d>,
) -> Result<(), LoweringError> {
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let mut ids: Vec<&SymbolId> = plan.local_syms.keys().collect();
    ids.sort_by(|a, b| a.path().cmp(b.path()));
    for id in ids {
        let sym = plan.local_syms[id];
        // An inlined task's formals/locals are set by its own
        // `ArgBinding`s at each call (their initializers may read formals),
        // and a block's automatic variables on each entry to it.
        if is_subroutine_owned(&sym) || vj_sim::process::cfg::is_automatic_block_var(&sym) {
            continue;
        }
        let Some(&(ptr, width, signed)) = cx.locals.get(id) else {
            continue;
        };
        // A variable a fork branch shares with the process that forked it
        // has the parent's value already.
        if plan
            .frame
            .slots
            .iter()
            .any(|s| s.captured && matches!(&s.source, FrameSlotSource::DeclaredVar(d) if d == id))
        {
            continue;
        }
        fresh_cell(cx, &sym);
        if crate::class_events::init_local(cx, &sym)? {
            continue;
        }
        if crate::events::is_pool_event_var(cx, &sym) {
            crate::events::init_event_var(cx, &sym)?;
            continue;
        }
        if let Some(shape) = sym
            .value_type()
            .as_ref()
            .and_then(crate::arrays::array_shape)
        {
            crate::arrays::init_array_var(cx, ptr, &shape, sym.initializer())?;
            continue;
        }
        let value = local_init_value(cx, &sym, width, signed)?;
        cx.b.build_store(ptr, value.llvm).unwrap();
    }
    let _ = &op;
    Ok(())
}

/// The [`crate::expr::WriteThrough`] for one process segment whose module
/// signals are already primed into `cx.locals` (their shadow copies).
fn write_through_for<'ctx, 'm>(
    cx: &LowerCtx<'ctx, '_, 'm>,
    fns: &'m AccessorFns<'ctx>,
    handle: PointerValue<'ctx>,
    plan: &ProcessLoweringPlan<'_>,
    seg_signals: &HashMap<SymbolId, SignalSlot>,
) -> crate::expr::WriteThrough<'ctx, 'm> {
    let bias = region_arena_bias(plan.region_id, &plan.signals);
    let signals = seg_signals
        .iter()
        .filter(|(_, info)| !matches!(info.class, SignalSlotClass::Memory { .. }))
        .filter_map(|(id, info)| {
            let (ptr, _, _) = *cx.locals.get(id)?;
            Some((
                ptr,
                (
                    // A specify-path variable destination's write goes to its
                    // retimer's staging cell (see `flush_external_signals`).
                    cx.specify_dest.get(id).map_or(info.slot, |r| r.slot) + bias,
                    info.width,
                    info.class == SignalSlotClass::Wide,
                ),
            ))
        })
        .collect();
    crate::expr::WriteThrough {
        handle,
        fns,
        signals,
        reload: Default::default(),
    }
}

/// Whether `sym` is declared inside a task/function (a formal or local).
fn is_subroutine_owned(sym: &Symbol<'_>) -> bool {
    let mut cur = sym.parent();
    while let Some(p) = cur {
        let kind = p.kind();
        if kind == sv_lang::kinds::SymbolKind::Subroutine {
            return true;
        }
        if kind == sv_lang::kinds::SymbolKind::InstanceBody {
            return false;
        }
        cur = p.parent();
    }
    false
}

/// Sets the local `var` to its starting value ([`local_init_value`]): at
/// the start of an inlined task, or on entry to the block declaring an
/// automatic variable. A collection it held is released first.
pub(crate) fn init_local_var<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    var: &Symbol<'d>,
) -> Result<(), LoweringError> {
    if cx.locals.contains_key(&var.uid()) && crate::class_events::init_local(cx, var)? {
        return Ok(());
    }
    if crate::events::is_pool_event_var(cx, var) {
        if cx.locals.contains_key(&var.uid()) {
            fresh_cell(cx, var);
        }
        return crate::events::init_event_var(cx, var);
    }
    let (ptr, width, signed) =
        cx.locals.get(&var.uid()).copied().ok_or_else(|| {
            LoweringError::unsupported_at("a local variable has no frame slot", var)
        })?;
    fresh_cell(cx, var);
    if let Some(shape) = var
        .value_type()
        .as_ref()
        .and_then(crate::arrays::array_shape)
    {
        return crate::arrays::init_array_var(cx, ptr, &shape, var.initializer());
    }
    let v = local_init_value(cx, var, width, signed)?;
    cx.b.build_store(ptr, v.llvm).unwrap();
    // A static task's formal or local is a signal: committed at once.
    crate::expr::write_through_store(cx, ptr);
    Ok(())
}

/// Gives back the class / collection handles the task-local `var` holds at
/// the end of its (inlined) task, then clears the slot so a second release
/// (a `disable` re-entering the exit) finds nothing.
fn release_task_local<'ctx, 'd>(cx: &LowerCtx<'ctx, 'd, '_>, var: &Symbol<'d>) {
    let Some(t) = var.value_type() else { return };
    if crate::collections::handle_offsets(&t).is_empty() || crate::arrays::array_shape(&t).is_some()
    {
        return;
    }
    // A variable shared with fork branches (a cell) may still be read by a
    // branch that outlives the block: its handle is left alone.
    if cx.cells.contains_key(&var.uid()) {
        return;
    }
    let Some(&(ptr, width, signed)) = cx.locals.get(&var.uid()) else {
        return;
    };
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let old =
        cx.b.build_load(op.packed_type(width, cx.repr), ptr, "task_local_old")
            .unwrap()
            .into_int_value();
    let pv = crate::value::PackedValue {
        llvm: old,
        width,
        repr: cx.repr,
        signed,
    };
    crate::collections::release_handles(cx, &t, crate::expr::LoweredValue::Packed(pv));
    cx.b.build_store(ptr, op.packed_type(width, cx.repr).const_zero())
        .unwrap();
}

/// A declared variable's starting value: its initializer, or its type's
/// default (0 for 2-state, all-X for 4-state).
fn local_init_value<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    sym: &Symbol<'d>,
    width: u32,
    signed: bool,
) -> Result<crate::value::PackedValue<'ctx>, LoweringError> {
    match sym.initializer() {
        // A queue / dynamic / associative array starts as a copy.
        Some(init)
            if sym
                .value_type()
                .is_some_and(|t| vj_sim::state::storage::is_collection(&t)) =>
        {
            Ok(PackedValue {
                llvm: crate::collections::owned_arg(cx, init)?,
                width,
                repr: cx.repr,
                signed,
            })
        }
        Some(init) => {
            let v = crate::real::to_storage(
                cx,
                crate::collections::owned(cx, init)?,
                width,
                "a >128-bit local initializer",
            )?;
            if v.width != width {
                return Err(LoweringError::unsupported_at(
                    &format!(
                        "local initializer is {} bits for a {width}-bit variable",
                        v.width
                    ),
                    sym,
                ));
            }
            Ok(v)
        }
        None => {
            let ty = sym
                .value_type()
                .ok_or_else(|| LoweringError::unsupported_at("local has no type", sym))?;
            Ok(PackedValue {
                llvm: crate::arrays::default_value(cx, &ty),
                width,
                repr: cx.repr,
                signed,
            })
        }
    }
}

/// A frame slot no symbol names: a `repeat` loop's counter, or an
/// intra-assignment-timed assignment's captured value (`process::cfg::
/// ArgBinding::Capture`).
#[derive(Clone, Copy, PartialEq, Eq, Hash, Debug)]
pub(crate) enum SyntheticSlot {
    Counter(RepeatCounterId),
    Temp(u32),
}

/// Runs a segment's inlined-task argument transfers (`process::cfg::
/// ArgBinding`), before its statements.
fn lower_segment_bindings<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    handle: PointerValue<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    bindings: &[vj_sim::process::cfg::ArgBinding<'d>],
    synthetic: &HashMap<SyntheticSlot, (PointerValue<'ctx>, u32, bool)>,
) -> Result<(), LoweringError> {
    use vj_sim::process::cfg::ArgBinding;
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let local = |sym: &Symbol<'d>| {
        cx.locals.get(&sym.uid()).copied().ok_or_else(|| {
            LoweringError::unsupported_at("inlined task formal/local has no frame slot", sym)
        })
    };
    let array_of = |sym: &Symbol<'d>| {
        sym.value_type()
            .as_ref()
            .and_then(crate::arrays::array_shape)
    };
    let temp_slot = |temp: u32| {
        synthetic
            .get(&SyntheticSlot::Temp(temp))
            .copied()
            .ok_or_else(|| {
                LoweringError::unsupported_at(
                    "intra-assignment temporary has no frame slot (internal invariant)",
                    &cx.fn_sym,
                )
            })
    };
    for b in bindings {
        match b {
            ArgBinding::In { formal, actual } => {
                // An `event` argument is passed as a handle (LRM 15.5.5.1).
                if crate::class_events::bind_formal(cx, formal, *actual)? {
                    continue;
                }
                if crate::events::is_pool_event_var(cx, formal) {
                    if cx.locals.contains_key(&formal.uid()) {
                        fresh_cell(cx, formal);
                    }
                    crate::events::bind_event_formal(cx, formal, *actual)?;
                    continue;
                }
                let (ptr, width, _) = local(formal)?;
                fresh_cell(cx, formal);
                if let Some(shape) = array_of(formal) {
                    crate::arrays::assign_array_into_fresh(
                        cx,
                        crate::arrays::ArrayRef::whole(cx, crate::arrays::Backing::Local(ptr)),
                        &shape,
                        *actual,
                    )?;
                    continue;
                }
                // A queue / dynamic / associative array input: a copy.
                if formal
                    .value_type()
                    .is_some_and(|t| vj_sim::state::storage::is_collection(&t))
                {
                    let h = crate::collections::owned_arg(cx, *actual)?;
                    cx.b.build_store(ptr, h).unwrap();
                    continue;
                }
                let v = crate::real::to_storage(
                    cx,
                    crate::collections::owned(cx, *actual)?,
                    width,
                    "a >128-bit task argument",
                )?;
                let v = crate::select::fit_width(&op, v, width);
                cx.b.build_store(ptr, v.llvm).unwrap();
                crate::expr::write_through_store(cx, ptr);
            }
            ArgBinding::Init { var } => init_local_var(cx, var)?,
            // LRM 13.5.1, 6.21: the task's automatic input formal / local
            // ends with the call; it gives back the handles it holds.
            ArgBinding::Release { var } => release_task_local(cx, var),
            // The caller's current object, held by the inlined method's
            // `this` local (one reference, as an input argument holds one).
            ArgBinding::ThisOf { var } => {
                let (ptr, width, _) = local(var)?;
                fresh_cell(cx, var);
                let h = crate::classes::current_this_handle(cx)?;
                crate::classes::retain_handle(cx, h);
                let v = crate::collections::handle_value(cx, h);
                let v = crate::select::fit_width(&op, v, width);
                cx.b.build_store(ptr, v.llvm).unwrap();
            }
            // A recursive method activation's receiver, from the caller's
            // current object (the spawner owns the count; no retain).
            ArgBinding::CaptureThis { temp } => {
                let (ptr, width, _) = temp_slot(*temp)?;
                let h = crate::classes::current_this_handle(cx)?;
                let v = crate::collections::handle_value(cx, h);
                let v = crate::select::fit_width(&op, v, width);
                cx.b.build_store(ptr, v.llvm).unwrap();
            }
            ArgBinding::Const { var, value } => {
                let (ptr, width, signed) = local(var)?;
                fresh_cell(cx, var);
                let v = op.pack(
                    op.i_n(width).const_int(*value as u64, true),
                    op.i_n(width).const_zero(),
                    width,
                    cx.repr,
                    signed,
                );
                cx.b.build_store(ptr, v.llvm).unwrap();
            }
            ArgBinding::Step { var, by } => {
                let (ptr, width, signed) = local(var)?;
                let llvm =
                    cx.b.build_load(op.packed_type(width, cx.repr), ptr, "foreach_i")
                        .unwrap()
                        .into_int_value();
                let cur = crate::value::PackedValue {
                    llvm,
                    width,
                    repr: cx.repr,
                    signed,
                };
                let next =
                    cx.b.build_int_add(
                        op.lane_val(cur),
                        op.i_n(width).const_int(*by as u64, true),
                        "foreach_next",
                    )
                    .unwrap();
                let v = op.pack(next, op.i_n(width).const_zero(), width, cx.repr, signed);
                cx.b.build_store(ptr, v.llvm).unwrap();
            }
            ArgBinding::AssocKey {
                var,
                arr,
                path,
                next,
            } => {
                let (ptr, width, signed) = local(var)?;
                let llvm =
                    cx.b.build_load(op.packed_type(width, cx.repr), ptr, "foreach_key")
                        .unwrap()
                        .into_int_value();
                let cur = crate::value::PackedValue {
                    llvm,
                    width,
                    repr: cx.repr,
                    signed,
                };
                let k = crate::collections::assoc_step(cx, *arr, path, cur, *next)?;
                let k = crate::select::fit_width(&op, k, width);
                cx.b.build_store(ptr, k.llvm).unwrap();
            }
            // An intra-assignment-timed assignment: the value now, the
            // write after the wait.
            ArgBinding::Capture { temp, value } => {
                let (ptr, width, _) = temp_slot(*temp)?;
                // A whole unpacked array (LRM 10.4.2): the temporary is a
                // local array; the right-hand side is evaluated into it.
                if let Some(shape) = value
                    .expr_type()
                    .filter(|t| t.is_unpacked_array())
                    .and_then(|t| crate::arrays::array_shape(&t))
                    .filter(|sh| !sh.dims.is_empty())
                {
                    if !crate::collections::handle_offsets(&shape.elem).is_empty() {
                        return Err(LoweringError::unsupported_at(
                            "an intra-assignment-timed unpacked array whose elements hold \
                             class handles or collections (LRM 1800-2023 10.4.2)",
                            &cx.fn_sym,
                        ));
                    }
                    crate::arrays::assign_array_into_fresh(
                        cx,
                        crate::arrays::ArrayRef::whole(cx, crate::arrays::Backing::Local(ptr)),
                        &shape,
                        *value,
                    )?;
                    continue;
                }
                let v = crate::real::to_storage(
                    cx,
                    lower_expr(cx, *value)?,
                    width,
                    "an intra-assignment-timed value wider than 128 bits",
                )?;
                let v = crate::select::fit_width(&op, v, width);
                cx.b.build_store(ptr, v.llvm).unwrap();
            }
            ArgBinding::AssignCaptured { temp, target, nba } => {
                let (ptr, width, _) = temp_slot(*temp)?;
                // A whole unpacked array target: copy the captured rows.
                if let Some((dst, dst_shape)) = crate::arrays::array_target(cx, *target)? {
                    if *nba {
                        let delay = cx.ctx.i64_type().const_zero();
                        crate::arrays::nba_array_from_local(
                            cx, handle, dst, &dst_shape, ptr, &dst_shape, delay,
                        )?;
                    } else {
                        crate::arrays::copy_array(
                            cx,
                            dst,
                            &dst_shape,
                            crate::arrays::ArrayRef::whole(cx, crate::arrays::Backing::Local(ptr)),
                            &dst_shape,
                        )?;
                    }
                    continue;
                }
                let llvm =
                    cx.b.build_load(op.packed_type(width, cx.repr), ptr, "captured")
                        .unwrap()
                        .into_int_value();
                let signed = target.expr_type().is_some_and(|t| t.is_signed());
                let v = crate::value::PackedValue {
                    llvm,
                    width,
                    repr: cx.repr,
                    signed,
                };
                if *nba {
                    // `q <= @(e) v;` (LRM 10.4.2): staged now, in the NBA region.
                    if crate::huge::rooted_in_huge(*target)
                        || crate::arrays::array_target(cx, *target)?.is_some()
                    {
                        return Err(LoweringError::unsupported_at(
                            "a nonblocking assignment with an event control to a memory, \
                             unpacked array or >128-bit vector (LRM 1800-2023 10.4.2)",
                            &cx.fn_sym,
                        ));
                    }
                    // A clocking drive (`cb.q <= ##N v`, LRM 14.16) stages
                    // after N clocking events: the clock variable's signal,
                    // its output skew after now.
                    let drive = match clock_var_root(*target) {
                        Some(root) => clocking_output(cx, signals, root)?,
                        None => None,
                    };
                    let (target, delay) = match &drive {
                        Some(d) if vj_sim::netlist::vif::is_member_access(target) => {
                            (*target, drive_delay(cx, d))
                        }
                        Some(d) if !is_clock_var(*target) => (*target, drive_delay(cx, d)),
                        Some(d) => (d.target, drive_delay(cx, d)),
                        None => (*target, cx.ctx.i64_type().const_zero()),
                    };
                    if let Some(d) = &drive {
                        emit_reactive_drive(cx, handle, signals, d, true)?;
                    }
                    crate::select::lower_nba_to(cx, handle, signals, target, v, delay)?;
                    if let Some(d) = &drive {
                        emit_reactive_drive(cx, handle, signals, d, false)?;
                    }
                } else {
                    crate::select::lower_assign_to(cx, *target, v)?;
                }
            }
            // A recursive task's activation: its formal from the argument the
            // caller evaluated.
            ArgBinding::FromCaptured { temp, formal } => {
                let (tptr, twidth, _) = temp_slot(*temp)?;
                let (ptr, width, signed) = local(formal)?;
                fresh_cell(cx, formal);
                let llvm =
                    cx.b.build_load(op.packed_type(twidth, cx.repr), tptr, "task_arg")
                        .unwrap()
                        .into_int_value();
                let v = crate::value::PackedValue {
                    llvm,
                    width: twidth,
                    repr: cx.repr,
                    signed,
                };
                let v = crate::select::fit_width(&op, v, width);
                cx.b.build_store(ptr, v.llvm).unwrap();
                crate::expr::write_through_store(cx, ptr);
            }
            // A recursive task's `output`/`inout` formal, parked for the
            // spawner as the activation ends.
            // Read by the call's expression through its `call_result_key`.
            ArgBinding::CallResult { .. } => {}
            ArgBinding::ClassEventLeave => crate::class_events::lower_leave(cx),
            ArgBinding::ToCaptured { temp, formal } => {
                let (tptr, twidth, _) = temp_slot(*temp)?;
                let (ptr, width, signed) = local(formal)?;
                let llvm =
                    cx.b.build_load(op.packed_type(width, cx.repr), ptr, "task_result")
                        .unwrap()
                        .into_int_value();
                let v = crate::value::PackedValue {
                    llvm,
                    width,
                    repr: cx.repr,
                    signed,
                };
                let v = crate::select::fit_width(&op, v, twidth);
                cx.b.build_store(tptr, v.llvm).unwrap();
            }
            ArgBinding::RefOpen {
                temp,
                formal,
                actual,
            } => {
                let (ptr, _, _) = local(formal)?;
                let (tptr, twidth, _) = temp_slot(*temp)?;
                fresh_cell(cx, formal);
                let id = crate::collections::open_ref(cx, *actual)?;
                let idv = op.pack(id, op.i_n(64).const_zero(), 64, cx.repr, false);
                let idv = crate::select::fit_width(&op, idv, twidth);
                cx.b.build_store(tptr, idv.llvm).unwrap();
                // The formal now is the element (written to the local).
                crate::collections::elem_ref_refresh(cx, ptr);
            }
            ArgBinding::RefClose { temp, .. } => {
                let (tptr, twidth, _) = temp_slot(*temp)?;
                crate::collections::close_ref(cx, tptr, twidth);
            }
            ArgBinding::Out { actual, formal } => {
                // An event formal copies its handle back: the actual then
                // names the same object (LRM 1800-2023 15.5.5.1 merging).
                if crate::events::copy_out_formal(cx, formal, *actual)? {
                    continue;
                }
                let (ptr, width, signed) = local(formal)?;
                if let Some(shape) = array_of(formal) {
                    let (dst, dst_shape) =
                        crate::arrays::array_target(cx, *actual)?.ok_or_else(|| {
                            LoweringError::unsupported_at(
                                "an array output argument whose actual is not an array variable",
                                &cx.fn_sym,
                            )
                        })?;
                    crate::arrays::copy_array(
                        cx,
                        dst,
                        &dst_shape,
                        crate::arrays::ArrayRef::whole(cx, crate::arrays::Backing::Local(ptr)),
                        &shape,
                    )?;
                    continue;
                }
                let llvm =
                    cx.b.build_load(op.packed_type(width, cx.repr), ptr, "task_out")
                        .unwrap()
                        .into_int_value();
                let v = crate::value::PackedValue {
                    llvm,
                    width,
                    repr: cx.repr,
                    signed,
                };
                let target_width = actual
                    .expr_type()
                    .map(|t| t.value_width())
                    .filter(|w| *w > 0)
                    .unwrap_or(width);
                let v = crate::select::fit_width(&op, v, target_width);
                crate::select::lower_assign_to(cx, *actual, v)?;
            }
        }
    }
    Ok(())
}

/// PR-010/CG-097's fast path: a `segment_count==1` process (never suspends)
/// lowers to a plain function with zero `resume_pc` switch and zero `local`/
/// frame traffic -- every declared local (if any) gets an ordinary,
/// uninitialized-until-assigned `alloca`, exactly like `func.rs`'s own plain
/// functions, never a GEP into `local` (the process executes exactly once
/// per activation in this case, so nothing needs to survive past this one
/// call).
// CG-009 (A2-part2 Task 0) added the `value_repr` parameter, pushing this
// already-large private helper's own argument count past clippy's default
// threshold; bundling them into a struct would only obscure this
// call-site-only function's real shape for no correctness benefit.
#[allow(clippy::too_many_arguments)]
fn lower_fast_path<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    nba_fn: FunctionValue<'ctx>,
    sys_fns: &SysCallFns<'ctx>,
    plan: &ProcessLoweringPlan<'d>,
    f: FunctionValue<'ctx>,
    value_repr: ValueRepr,
) -> Result<(), LoweringError> {
    let seg = &plan.segments[0];
    let entry_bb = ctx.append_basic_block(f, "entry");
    let b = ctx.create_builder();
    b.position_at_end(entry_bb);
    let handle = f.get_nth_param(0).unwrap().into_pointer_value();

    let mut cx = LowerCtx {
        ctx,
        b,
        repr: value_repr,
        locals: HashMap::new(),
        fn_sym: plan.fn_sym,
        module,
        mem_signals: mem_signals_of(&plan.signals),
        mem_accessor: Some(MemAccessorCtx { handle, fns }),
        lvalue_ref: Default::default(),
        deferred_start: Default::default(),
        unbounded: Default::default(),
        coll_temp: Default::default(),
        iter: Default::default(),
        loop_exits: Default::default(),
        block_exits: Default::default(),
        write_through: None,
        cells: Default::default(),
        copy_out: Default::default(),
        ctor_this: Default::default(),
        decl_scale: Default::default(),
        inline_this: Default::default(),
        end_flags: Default::default(),
        specify_dest: plan.specify_dest_redirect.clone(),
        elem_refs: Default::default(),
    };

    reject_huge_frame_slots(plan)?;
    for (idx, slot) in plan.frame.slots.iter().enumerate() {
        let id = match &slot.source {
            FrameSlotSource::DeclaredVar(id) => id.clone(),
            // A fork branch inside a recursive task's activation reserves the
            // activation's capture temporaries (`process::cfg::build_cfg`) so
            // a recursive call in it finds the same slots; a branch that never
            // suspends has no such call. A binding that did read one fails by
            // name in `lower_segment_bindings` (no frame slot).
            FrameSlotSource::Temporary(_) => continue,
            // R-run Task 8: unreachable by internal invariant, never a
            // silent no-op -- a `SyntheticCounter` slot only ever exists for
            // a suspend-containing `repeat` loop (`process::cfg::
            // CfgBuilder::walk_repeat_loop`'s own gate), and any suspend
            // always splits `process::cfg::build_cfg`'s output into more
            // than one block/`Segment` (at minimum header/body/exit), so
            // `plan.segments.len() == 1` (this function's own precondition,
            // asserted by its caller) can never carry one.
            FrameSlotSource::SyntheticCounter(counter) => {
                return Err(LoweringError::unsupported_at(
                    &format!(
                        "internal invariant violated: a segment_count==1 process carries a \
                         repeat-loop synthetic counter slot ({counter:?}) -- a suspend-\
                         containing repeat loop always splits into more than one segment"
                    ),
                    &plan.fn_sym,
                ));
            }
        };
        if slot.cell {
            let local = f.get_nth_param(1).unwrap().into_pointer_value();
            let (shadow, cell_ptr, bytes) = open_cell(cx.ctx, module, &cx.b, local, slot);
            cx.locals.insert(
                id.clone(),
                (shadow, slot.width_bits, plan.frame_signed[idx]),
            );
            cx.cells.insert(id, (cell_ptr, bytes));
            continue;
        }
        let ptr =
            crate::types::entry_alloca_in(&cx.b, slot_storage_type(cx.ctx, slot), "decl_local");
        cx.locals
            .insert(id, (ptr, slot.width_bits, plan.frame_signed[idx]));
    }

    let calls = plan.assertion_calls.borrow();
    let call_exprs: Vec<Expression<'d>> = calls.iter().map(|c| c.call).collect();
    let written = prime_external_signals(
        &mut cx,
        fns,
        handle,
        seg,
        &plan.signals,
        plan.region_id,
        None,
        &call_exprs,
    );
    cx.write_through = Some(write_through_for(&cx, fns, handle, plan, &plan.signals));
    emit_local_inits(&cx, plan)?;
    cx.inline_this = seg.this_var;
    lower_segment_bindings(&cx, handle, &plan.signals, &seg.bindings, &HashMap::new())?;
    lower_segment_body(&mut cx, handle, &plan.signals, nba_fn, sys_fns, seg, &calls)?;
    // Task 3 (PR-045): a `for` loop's per-iteration step expressions
    // (`i++`) run after `stmts` and before the segment's own terminator
    // fires -- see `BasicBlock::step_exprs`'s own doc comment. This single-
    // segment fast path can never actually carry a non-empty `step_exprs`
    // in practice (a real loop always splits into >1 `Segment` -- see
    // `external_symbols_in_plan`'s doc comment), but the field is handled
    // here too, unconditionally, rather than silently assuming that.
    for step in &seg.step_exprs {
        lower_step_expr(&mut cx, *step)?;
    }
    flush_external_signals(&cx, fns, handle, &written, &plan.signals, plan.region_id);
    flush_cells(&cx);

    match &seg.terminator {
        SegTerminator::End { loop_back: None } => {
            let ret = cx
                .ctx
                .i32_type()
                .const_int(SEG_FINISHED as u32 as u64, false);
            cx.b.build_return(Some(&ret)).unwrap();
            Ok(())
        }
        other => Err(LoweringError::unsupported_at(
            &format!(
                "a segment_count==1 process's only segment terminated with {other:?}, not \
                 End{{loop_back: None}} -- a single segment can only arise from a suspend-free \
                 process body, which process::cfg::build_cfg always closes with a plain End \
                 (internal invariant)"
            ),
            &plan.fn_sym,
        )),
    }
}

/// The general, switch-dispatched path (`plan.segments.len() > 1`):
/// PR-040's `switch(resume_pc) { case SEG_i => tail-call seg_i(...), ... }`
/// dispatcher, PR-038/PR-039's once-per-call frame prologue / suspend-only
/// epilogue (see this file's module doc comment), and PR-009/CG-095's shared
/// statement visitor reused once per segment.
#[allow(clippy::too_many_lines)]
// CG-009 (A2-part2 Task 0): see `lower_fast_path`'s identical `#[allow]`
// comment just above -- same reasoning, same new `value_repr` parameter.
#[allow(clippy::too_many_arguments)]
fn lower_switch_path<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    nba_fn: FunctionValue<'ctx>,
    sys_fns: &SysCallFns<'ctx>,
    plan: &ProcessLoweringPlan<'d>,
    f: FunctionValue<'ctx>,
    value_repr: ValueRepr,
) -> Result<(), LoweringError> {
    let entry_bb = ctx.append_basic_block(f, "entry");
    let eb = ctx.create_builder();
    eb.position_at_end(entry_bb);
    let handle = f.get_nth_param(0).unwrap().into_pointer_value();
    let local = f.get_nth_param(1).unwrap().into_pointer_value();
    let resume_pc = f.get_nth_param(2).unwrap().into_int_value();

    // PR-038: the once-per-call frame prologue -- exactly one load per
    // permanent (`FrameLayout`) slot, into a fresh per-call `alloca`, and
    // nothing else touches `local` here. R-run Task 8: a `repeat` loop's own
    // synthetic counter slot is ALSO permanent (`FrameSlotSource::
    // SyntheticCounter`'s own doc comment) and gets exactly the same
    // once-per-call load-into-alloca treatment -- but it has no `SymbolId`
    // to key `frame_locals` by, so it goes into its own, parallel
    // `RepeatCounterId`-keyed map (`counter_locals`) instead.
    let mut frame_locals: HashMap<SymbolId, (PointerValue<'ctx>, u32, bool)> = HashMap::new();
    let mut counter_locals: HashMap<SyntheticSlot, (PointerValue<'ctx>, u32, bool)> =
        HashMap::new();
    let mut cells: HashMap<SymbolId, (PointerValue<'ctx>, u32)> = HashMap::new();
    reject_huge_frame_slots(plan)?;
    for (idx, slot) in plan.frame.slots.iter().enumerate() {
        // A variable shared with fork branches: its working copy, from its
        // cell (the slot holds the cell's pointer).
        if slot.cell
            && let FrameSlotSource::DeclaredVar(id) = &slot.source
        {
            let (shadow, cell_ptr, bytes) = open_cell(ctx, module, &eb, local, slot);
            frame_locals.insert(
                id.clone(),
                (shadow, slot.width_bits, plan.frame_signed[idx]),
            );
            cells.insert(id.clone(), (cell_ptr, bytes));
            continue;
        }
        let src = frame_slot_ptr(ctx, &eb, local, slot.offset);
        let ptr = crate::types::entry_alloca_in(&eb, slot_storage_type(ctx, slot), "decl_local");
        copy_frame_slot(ctx, &eb, slot, ptr, src);
        match &slot.source {
            FrameSlotSource::DeclaredVar(id) => {
                frame_locals.insert(id.clone(), (ptr, slot.width_bits, plan.frame_signed[idx]));
            }
            FrameSlotSource::SyntheticCounter(counter) => {
                counter_locals.insert(
                    SyntheticSlot::Counter(*counter),
                    (ptr, slot.width_bits, plan.frame_signed[idx]),
                );
            }
            FrameSlotSource::Temporary(temp) => {
                counter_locals.insert(
                    SyntheticSlot::Temp(*temp),
                    (ptr, slot.width_bits, plan.frame_signed[idx]),
                );
            }
        };
    }

    // An inlined call of a function that spawns processes whose value was
    // parked in a capture temporary: the call's expression finds the temporary
    // under the call's key (`expr::lower_user_subroutine_call_of`).
    let mut call_result_locals: Vec<(SymbolId, (PointerValue<'ctx>, u32, bool))> = Vec::new();
    for seg in &plan.segments {
        for b in &seg.bindings {
            if let vj_sim::process::cfg::ArgBinding::CallResult { temp, call } = b
                && let Some(&(ptr, width, _)) = counter_locals.get(&SyntheticSlot::Temp(*temp))
            {
                let signed = call.expr_type().is_some_and(|t| t.is_signed());
                call_result_locals.push((
                    vj_sim::process::cfg::call_result_key(call),
                    (ptr, width, signed),
                ));
            }
        }
    }

    // The `ref` formals bound to a queue / dynamic-array element (LRM
    // 1800-2023 13.5.2): their frame local -> their reference id's slot.
    let mut elem_refs: HashMap<PointerValue<'ctx>, crate::collections::ElemRefSlot<'ctx>> =
        HashMap::new();
    for seg in &plan.segments {
        for b in &seg.bindings {
            if let vj_sim::process::cfg::ArgBinding::RefOpen { temp, formal, .. } = b
                && let Some(&(ptr, width, signed)) = frame_locals.get(&formal.uid())
                && let Some(&(id, id_width, _)) = counter_locals.get(&SyntheticSlot::Temp(*temp))
            {
                elem_refs.insert(
                    ptr,
                    crate::collections::ElemRefSlot {
                        id,
                        id_width,
                        width,
                        signed,
                        part: None,
                    },
                );
            }
        }
    }

    // VPI frames (37.43): this resume's copies of the variables.
    {
        let mut vars: Vec<(SymbolId, PointerValue<'ctx>)> = frame_locals
            .iter()
            .map(|(id, &(p, _, _))| (id.clone(), p))
            .collect();
        vars.sort_by(|a, b| a.0.cmp(&b.0));
        crate::vpi_dyn::emit_frame_rebind(ctx, module, &eb, &vars);
    }

    // Task 3 (PR-045): exactly ONE `alloca` per external signal any segment
    // in `plan.segments` references, built here in `entry_bb` -- alongside
    // the `FrameLayout` prologue just above -- instead of inside each
    // segment's own basic block (`prime_external_signals`'s previous
    // behavior). A `for`/`while`/... loop with no suspend point at all
    // still lowers to more than one `Segment` (header/body/step), each its
    // own LLVM basic block that a back-edge revisits at runtime without
    // this function ever returning; an `alloca` executed at that block's
    // own position on every such revisit is a genuine, LLVM-verifier-
    // invisible dynamic stack allocation that walks the stack pointer
    // downward once per loop iteration, with nothing to pop it back until
    // the whole function returns -- exactly the root cause `gdb` showed for
    // `z_for_loop.sv`'s SIGSEGV inside `Arena::inline()`. Hoisting the
    // `alloca` here (executed exactly once per call, like every other slot
    // in this prologue) fixes that; each segment still re-primes (a plain
    // `build_get_scalar` + `build_store` into this same pointer, not a new
    // `alloca`) every time it is entered, at its own position, exactly as
    // before -- see `prime_external_signals`'s own doc comment for why that
    // part must stay per-segment.
    let calls = plan.assertion_calls.borrow();
    let call_exprs: Vec<Expression<'d>> = calls.iter().map(|c| c.call).collect();
    let all_signals = all_seg_signals(&plan.signals, &plan.segments)?;
    // (Allocated in symbol order, not hash order: the emitted function, and the
    // object an AOT build writes, must be the same on every build.)
    let mut ext_symbols: Vec<SymbolId> = external_symbols_in_plan(
        &plan.segments,
        &plan.signals,
        &plan.fn_sym.uid(),
        &call_exprs,
    )?
    .into_iter()
    .collect();
    ext_symbols.sort();
    let ext_ptrs: HashMap<SymbolId, PointerValue<'ctx>> = ext_symbols
        .into_iter()
        .filter_map(|sym_id| {
            let info = all_signals[&sym_id];
            // A huge signal's shadow is the runtime's long-lived image, handed
            // back by `prime_external_signals`'s own call: nothing to hoist.
            if crate::huge::is_huge_width(info.width) {
                return None;
            }
            let packed_ty = int_type(ctx, info.width * 2);
            let ptr = crate::types::entry_alloca_in(&eb, packed_ty, "ext_shadow");
            Some((sym_id, ptr))
        })
        .collect();

    // One basic block per segment, pre-allocated so Goto/CondGoto/End{Some}
    // targets (which may reference a not-yet-lowered segment) already have a
    // real `BasicBlock` handle to branch to.
    let seg_blocks: Vec<LlvmBasicBlock<'ctx>> = (0..plan.segments.len())
        .map(|i| ctx.append_basic_block(f, &format!("seg{i}")))
        .collect();

    // PR-011/PR-040/CG-086: resume dispatch is exclusively a `switch`, never
    // `indirectbr`/`blockaddress`. An out-of-range `resume_pc` is an
    // internal-invariant violation (only this file's own returned `SegId`s
    // or `0` ever become a caller's `resume_pc`), so the default arm traps
    // rather than silently picking a segment.
    let trap_bb = ctx.append_basic_block(f, "resume_pc_trap");
    let i32_ty = ctx.i32_type();
    // `resume_pc == 0` is only ever the process's first activation (every
    // suspend resumes at a later, freshly-built segment; a loop back-edge to
    // segment 0 is an in-function branch, not a resume), so declared locals
    // are initialized on that path only (`emit_local_inits`).
    let start_bb = ctx.append_basic_block(f, "process_start");
    let cases: Vec<(IntValue<'ctx>, LlvmBasicBlock<'ctx>)> = (0..plan.segments.len())
        .map(|i| {
            let target = if i == 0 { start_bb } else { seg_blocks[i] };
            (i32_ty.const_int(i as u64, false), target)
        })
        .collect();
    eb.build_switch(resume_pc, trap_bb, &cases).unwrap();
    eb.position_at_end(trap_bb);
    eb.build_unreachable().unwrap();

    // Task 3 (CG-115/PR-106): every segment that is the resume target of a
    // `wait(expr)`/`iff`-carrying suspend point gets a compiled, standalone
    // recheck guard, built up front (once per suspend site, never rebuilt
    // per segment) so the per-segment loop below can just `build_call` it --
    // see `build_resume_guards`'s own doc comment.
    let resume_guards = build_resume_guards(ctx, module, fns, plan, value_repr)?;
    // LRM 1800-2023 9.4.3: `wait(expr)` whose expression is already true never
    // suspends. That same-call edge jumps straight to the guarded body's
    // segment, but the recheck guard reads the spilled frame (`local`), which
    // only a genuine suspend refreshes: a condition over an inlined task's
    // formal/local (live only in this call's allocas) read a stale value,
    // failed, and re-suspended with no wake source (silent deadlock). The
    // condition was already evaluated true by the branch, so in-function
    // jumps enter a guarded segment past its guard; the scheduler's
    // resume dispatch (`seg_blocks`) still runs it.
    let jump_blocks: Vec<LlvmBasicBlock<'ctx>> = (0..plan.segments.len())
        .map(|i| {
            if resume_guards.contains_key(&(i as u32)) {
                ctx.append_basic_block(f, &format!("seg{i}_guard_ok"))
            } else {
                seg_blocks[i]
            }
        })
        .collect();
    // R-run Task 13: built once, outside the per-segment loop below (`plan.
    // signals` does not change per segment) -- reused by every segment's own
    // `LowerCtx`, mirroring `frame_locals`'s own once-per-call `.clone()`
    // reuse pattern immediately below.
    let mem_signals = mem_signals_of(&plan.signals);

    {
        let ib = ctx.create_builder();
        ib.position_at_end(start_bb);
        let icx = LowerCtx {
            ctx,
            b: ib,
            repr: value_repr,
            locals: frame_locals.clone(),
            fn_sym: plan.fn_sym,
            module,
            mem_signals: mem_signals.clone(),
            mem_accessor: Some(MemAccessorCtx { handle, fns }),
            lvalue_ref: Default::default(),
            deferred_start: Default::default(),
            unbounded: Default::default(),
            coll_temp: Default::default(),
            iter: Default::default(),
            loop_exits: Default::default(),
            block_exits: Default::default(),
            write_through: None,
            cells: cells.clone(),
            copy_out: Default::default(),
            ctor_this: Default::default(),
            decl_scale: Default::default(),
            inline_this: Default::default(),
            end_flags: Default::default(),
            // Task 4b: `emit_local_inits` only initializes DECLARED LOCALS
            // (never a module-level signal via `write_through_store`, and
            // never an NBA target) -- this redirect table has no consumer
            // reachable from this block, so it is left empty rather than
            // cloned for no purpose.
            specify_dest: HashMap::new(),
            elem_refs: Default::default(),
        };
        emit_local_inits(&icx, plan)?;
        icx.b.build_unconditional_branch(seg_blocks[0]).unwrap();
    }

    for (i, seg) in plan.segments.iter().enumerate() {
        let sb = ctx.create_builder();
        sb.position_at_end(seg_blocks[i]);
        let signals = seg_signals(&plan.signals, seg)?;
        let mut cx = LowerCtx {
            ctx,
            b: sb,
            repr: value_repr,
            locals: {
                let mut l = frame_locals.clone();
                l.extend(call_result_locals.iter().cloned());
                l
            },
            fn_sym: plan.fn_sym,
            module,
            mem_signals: if seg.ref_aliases.is_empty() {
                mem_signals.clone()
            } else {
                mem_signals_of(&signals)
            },
            mem_accessor: Some(MemAccessorCtx { handle, fns }),
            lvalue_ref: Default::default(),
            deferred_start: Default::default(),
            unbounded: Default::default(),
            coll_temp: Default::default(),
            iter: Default::default(),
            loop_exits: Default::default(),
            block_exits: Default::default(),
            write_through: None,
            cells: cells.clone(),
            copy_out: Default::default(),
            ctor_this: Default::default(),
            decl_scale: Default::default(),
            // Set up front: the resume guard's re-suspend key reads a
            // class property (`@(posedge this.vi.clk iff ..)`).
            inline_this: seg.this_var,
            end_flags: Default::default(),
            specify_dest: plan.specify_dest_redirect.clone(),
            elem_refs: elem_refs.clone(),
        };

        // Task 3: this segment's own resume-prologue recheck, if it is ever
        // reached as a suspend's `resume_blk` target carrying a guard --
        // see `build_resume_guards`'s doc comment. Runs BEFORE any of this
        // segment's own statements/signal priming, exactly once per entry,
        // on EVERY path that reaches this segment (both a genuine resume
        // from the scheduler and, for `wait(expr)`'s own "already true"
        // inline fallthrough edge, a same-call `CondGoto` -- see
        // `process::cfg::CfgBuilder::walk_wait`'s doc comment for why that
        // second path re-running this same, already-satisfied check is
        // correct, merely redundant).
        if let Some(guard) = resume_guards.get(&(i as u32)) {
            let call =
                cx.b.build_call(guard.guard_fn, &[handle.into(), local.into()], "guard_call")
                    .unwrap();
            let ret_i8 = call.try_as_basic_value().unwrap_basic().into_int_value();
            let zero = cx.ctx.i8_type().const_int(0, false);
            let passed =
                cx.b.build_int_compare(inkwell::IntPredicate::NE, ret_i8, zero, "guard_passed")
                    .unwrap();
            let guard_ok_bb = jump_blocks[i];
            let guard_resuspend_bb = ctx.append_basic_block(f, &format!("seg{i}_guard_resuspend"));
            cx.b.build_conditional_branch(passed, guard_ok_bb, guard_resuspend_bb)
                .unwrap();

            cx.b.position_at_end(guard_resuspend_bb);
            // CG-115/CG-170: re-return the IDENTICAL WaitSpec unchanged --
            // the raw `SegId` returned here is `i` itself (this segment's
            // own id, the exact resume target the originating `Suspend`
            // terminator already registered with `lower_kernel_fn_with_repr`'s
            // suspend_cases table), so the ABI wrapper decodes this return
            // value into exactly the same `EvalResult` the original suspend
            // would have produced -- no second, possibly-divergent encoding
            // is built here.
            // Through a virtual interface: the same resume key the original
            // suspend returned (its virtual interface read afresh -- directly
            // from STATE when it is a module signal, not yet primed here).
            let key = if guard.vif_vars.is_empty() {
                None
            } else {
                for signal in &guard.vif_vars {
                    let base = crate::vif::event_base(signal).expect("a vif event");
                    // Every variable the base expression names (`vi`, or `h`
                    // of `h.vi`).
                    let mut named = Vec::new();
                    collect_named_value_symbols(base.as_sem_node(), &mut named);
                    for sym in named {
                        if cx.locals.contains_key(&sym.uid()) {
                            continue;
                        }
                        let Some(info) = signals.get(&sym.uid()) else {
                            continue;
                        };
                        let raw = build_get_scalar(&cx, fns, handle, info.slot, info.width);
                        let ptr = crate::types::entry_alloca_in(
                            &cx.b,
                            int_type(ctx, info.width * 2),
                            "vif_guard_shadow",
                        );
                        cx.b.build_store(ptr, raw).unwrap();
                        cx.locals.insert(sym.uid(), (ptr, info.width, info.signed));
                    }
                }
                Some(vif_vars_key(&cx, &guard.vif_vars, i as u32)?)
            };
            write_live_out_and_return(
                &cx,
                local,
                &plan.frame,
                &frame_locals,
                &counter_locals,
                &guard.live_out,
                i as u32,
                key,
            )?;

            cx.b.position_at_end(guard_ok_bb);
        }

        let written = prime_external_signals(
            &mut cx,
            fns,
            handle,
            seg,
            &signals,
            plan.region_id,
            Some(&ext_ptrs),
            &call_exprs,
        );
        cx.write_through = Some(write_through_for(&cx, fns, handle, plan, &signals));
        cx.inline_this = seg.this_var;
        lower_segment_bindings(&cx, handle, &signals, &seg.bindings, &counter_locals)?;
        lower_segment_body(&mut cx, handle, &signals, nba_fn, sys_fns, seg, &calls)?;
        // Task 3 (PR-045): the loop-back-edge segment's own step expressions
        // (`i++`) -- see `BasicBlock::step_exprs`'s doc comment ("run after
        // `stmts` and before `terminator` fires"). Previously never
        // consumed at all, so a `for` loop's own control variable never
        // advanced and its stop condition never went false.
        for step in &seg.step_exprs {
            lower_step_expr(&mut cx, *step)?;
        }
        // R-run Task 8: a `repeat` loop's own synthetic-counter bookkeeping
        // -- see `BasicBlock::repeat_init`/`repeat_decrement`'s own doc
        // comments for the "run after stmts/step_exprs, before terminator"
        // placement (same convention `step_exprs` above already uses).
        if let Some((counter, count)) = &seg.repeat_init {
            let (ptr, width, _signed) = *counter_locals
                .get(&SyntheticSlot::Counter(*counter))
                .ok_or_else(|| {
                    LoweringError::unsupported_at(
                        "repeat_init's counter has no matching alloca (internal invariant)",
                        &plan.fn_sym,
                    )
                })?;
            match count {
                vj_sim::process::cfg::RepeatCount::Expr(count_expr) => {
                    lower_repeat_counter_init(&cx, *count_expr, ptr, width)?
                }
                vj_sim::process::cfg::RepeatCount::Const(n) => {
                    let op = OpBuilder { ctx, b: &cx.b };
                    store_repeat_counter(&cx, &op, ptr, width, op.i_n(width).const_int(*n, false));
                }
                vj_sim::process::cfg::RepeatCount::Size(arr) => {
                    let (size, _) = crate::collections::size_and_handle(&cx, *arr)?;
                    let op = OpBuilder { ctx, b: &cx.b };
                    let size =
                        cx.b.build_int_truncate_or_bit_cast(size, op.i_n(width), "foreach_size")
                            .unwrap();
                    store_repeat_counter(&cx, &op, ptr, width, size);
                }
                vj_sim::process::cfg::RepeatCount::NestedSize { arr, path } => {
                    let size = crate::collections::nested_size(&cx, *arr, path)?;
                    let op = OpBuilder { ctx, b: &cx.b };
                    let size =
                        cx.b.build_int_truncate_or_bit_cast(size, op.i_n(width), "foreach_size")
                            .unwrap();
                    store_repeat_counter(&cx, &op, ptr, width, size);
                }
                // Copied in from the forking process at the spawn.
                vj_sim::process::cfg::RepeatCount::Inherited(_) => {}
            }
        }
        if let Some(counter) = &seg.repeat_decrement {
            let (ptr, width, _signed) = *counter_locals
                .get(&SyntheticSlot::Counter(*counter))
                .ok_or_else(|| {
                    LoweringError::unsupported_at(
                        "repeat_decrement's counter has no matching alloca (internal invariant)",
                        &plan.fn_sym,
                    )
                })?;
            let op = OpBuilder { ctx, b: &cx.b };
            let cur_val = load_repeat_counter(&cx, &op, ptr, width);
            let one = op.i_n(width).const_int(1, false);
            let dec = cx.b.build_int_sub(cur_val, one, "repeat_dec").unwrap();
            store_repeat_counter(&cx, &op, ptr, width, dec);
        }
        flush_external_signals(&cx, fns, handle, &written, &signals, plan.region_id);

        match &seg.terminator {
            SegTerminator::Goto(target) => {
                cx.b.build_unconditional_branch(jump_blocks[target.0 as usize])
                    .unwrap();
            }
            // `wait_order`'s step (the wait term that fired) or an interface
            // task through a virtual interface (its instance id - 1).
            SegTerminator::SwitchGoto {
                on,
                arms,
                default,
                report,
            } => {
                let i64t = ctx.i64_type();
                let idx = match on {
                    SwitchOn::FiredTerm => {
                        let rt =
                            module
                                .get_function(SV_RT_FIRED_TERM_SYMBOL)
                                .unwrap_or_else(|| {
                                    module.add_function(
                                        SV_RT_FIRED_TERM_SYMBOL,
                                        i64t.fn_type(&[], false),
                                        None,
                                    )
                                });
                        cx.b.build_call(rt, &[], "fired_term")
                            .unwrap()
                            .try_as_basic_value()
                            .unwrap_basic()
                            .into_int_value()
                    }
                    SwitchOn::VifId(e) => {
                        let pv = crate::expr::lower_expr(&cx, *e)?
                            .into_packed("a virtual interface", &plan.fn_sym)?;
                        let op = OpBuilder { ctx, b: &cx.b };
                        let v =
                            cx.b.build_int_z_extend_or_bit_cast(op.lane_val(pv), i64t, "vif_id")
                                .unwrap();
                        cx.b.build_int_sub(v, i64t.const_int(1, false), "vif_arm")
                            .unwrap()
                    }

                    SwitchOn::ObjClass { receiver, ids } => {
                        let h = match receiver {
                            Some(r) => crate::classes::receiver_handle(&cx, *r)?,
                            None => crate::classes::current_this_handle(&cx)?,
                        };
                        let dyn_id = crate::classes::dynamic_template_call(&cx, h);
                        let mut idx = i64t.const_all_ones();
                        for (k, set) in ids.iter().enumerate() {
                            for id in set {
                                let hit =
                                    cx.b.build_int_compare(
                                        inkwell::IntPredicate::EQ,
                                        dyn_id,
                                        i64t.const_int(u64::from(*id), false),
                                        "obj_class_hit",
                                    )
                                    .unwrap();
                                idx =
                                    cx.b.build_select(
                                        hit,
                                        i64t.const_int(k as u64, false),
                                        idx,
                                        "obj_class_arm",
                                    )
                                    .unwrap()
                                    .into_int_value();
                            }
                        }
                        idx
                    }
                    SwitchOn::RandCase(stmt) => {
                        let weights: Vec<Expression<'_>> =
                            stmt.randcase_items().iter().map(|i| i.expr()).collect();
                        crate::stmt_shared::rand_pick(
                            &cx,
                            &weights,
                            Some(stmt.source_range().start),
                        )?
                    }
                    // No arm: only the error below.
                    SwitchOn::NoTarget { .. } => i64t.const_all_ones(),
                    SwitchOn::FnDisable { labels } => {
                        let rt = module
                            .get_function(crate::dpi::SV_RT_DPI_FN_DISABLE_INDEX_SYMBOL)
                            .unwrap_or_else(|| {
                                module.add_function(
                                    crate::dpi::SV_RT_DPI_FN_DISABLE_INDEX_SYMBOL,
                                    i64t.fn_type(
                                        &[ctx.ptr_type(inkwell::AddressSpace::default()).into()],
                                        false,
                                    ),
                                    None,
                                )
                            });
                        let names =
                            cx.b.build_global_string_ptr(&labels.join("\n"), "fn_disable_labels")
                                .unwrap()
                                .as_pointer_value();
                        cx.b.build_call(rt, &[names.into()], "fn_disable_idx")
                            .unwrap()
                            .try_as_basic_value()
                            .unwrap_basic()
                            .into_int_value()
                    }
                };
                let func = cx.b.get_insert_block().unwrap().get_parent().unwrap();
                for (k, arm) in arms.iter().enumerate() {
                    let hit =
                        cx.b.build_int_compare(
                            inkwell::IntPredicate::EQ,
                            idx,
                            i64t.const_int(k as u64, false),
                            "switch_hit",
                        )
                        .unwrap();
                    let next = ctx.append_basic_block(func, "switch_next");
                    cx.b.build_conditional_branch(hit, jump_blocks[arm.0 as usize], next)
                        .unwrap();
                    cx.b.position_at_end(next);
                }
                if let Some(at) = report {
                    let scope = vj_sim::process::cfg::shown_path(&plan.fn_sym);
                    severity_frame(&cx, sys_fns, "ERROR: ", *at, &scope, &mut || {
                        let SwitchOn::NoTarget { what } = on else {
                            return Ok(());
                        };
                        // The message, as a constant `$write` with no arguments.
                        let rtarg_ty = crate::systask::rtarg_llvm_type(cx.ctx);
                        let fmt = crate::systask::build_c_string_global(
                            cx.ctx,
                            cx.module,
                            &what.replace('%', "%%"),
                            "no_target_msg",
                        );
                        let (args_ptr, n) =
                            crate::systask::build_rtarg_array(&cx, rtarg_ty, Vec::new())?;
                        cx.b.build_call(
                            sys_fns.write,
                            &[fmt.into(), args_ptr.into(), n.into()],
                            "rt_no_target",
                        )
                        .unwrap();
                        Ok(())
                    })?;
                }
                cx.b.build_unconditional_branch(jump_blocks[default.0 as usize])
                    .unwrap();
            }
            SegTerminator::CondGoto {
                cond,
                t,
                f: else_seg,
            } => {
                let bit = lower_condition(&cx, *cond)?;
                cx.b.build_conditional_branch(
                    bit,
                    jump_blocks[t.0 as usize],
                    jump_blocks[else_seg.0 as usize],
                )
                .unwrap();
            }
            // R-run Task 8: `repeat`'s own header decision -- see
            // `SegTerminator::CondGotoCounter`'s own doc comment for why
            // this is a real, new branch shape (a synthetic counter compare,
            // never `lower_condition` on a fabricated AST expression).
            // A decomposed `case`: its items tested in order, each jumping
            // to its arm's segment, else the default's.
            // An immediate assertion with a waiting action (LRM 16.3): the
            // ordinary assertion lowering (control gating, default `$error`)
            // with each action replaced by a jump to its segment.
            SegTerminator::AssertGoto {
                stmt,
                pass,
                fail,
                done,
            } => {
                let has_pass = stmt.immediate_assertion_if_true().is_some();
                let mut seen = 0;
                lower_immediate_assertion(&mut cx, sys_fns, stmt, None, &mut |cx, _| {
                    let is_pass = has_pass && seen == 0;
                    seen += 1;
                    let target = if is_pass { pass } else { fail };
                    cx.b.build_unconditional_branch(jump_blocks[target.0 as usize])
                        .unwrap();
                    Ok(())
                })?;
                cx.b.build_unconditional_branch(jump_blocks[done.0 as usize])
                    .unwrap();
            }
            SegTerminator::CaseGoto {
                stmt,
                arms,
                default,
            } if vj_sim::process::cfg::violation_check(stmt).is_some() => {
                // A `unique`/`unique0`/`priority` `if` series or `case`: the
                // dispatch also reports its violations.
                let arm_blocks: Vec<_> = arms.iter().map(|a| jump_blocks[a.0 as usize]).collect();
                crate::stmt_shared::lower_checked_dispatch(
                    &cx,
                    *stmt,
                    &arm_blocks,
                    jump_blocks[default.0 as usize],
                )?;
            }
            SegTerminator::CaseGoto {
                stmt,
                arms,
                default,
            } if matches!(
                stmt.kind(),
                StatementKind::Conditional | StatementKind::PatternCase
            ) =>
            {
                // An `if` with a pattern or `&&&` predicate, or a
                // `case ... matches`.
                let arm_blocks: Vec<_> = arms.iter().map(|a| jump_blocks[a.0 as usize]).collect();
                crate::stmt_shared::lower_clause_dispatch(
                    &cx,
                    *stmt,
                    &arm_blocks,
                    jump_blocks[default.0 as usize],
                )?;
            }
            SegTerminator::CaseGoto {
                stmt,
                arms,
                default,
            } => {
                let (cond_kind, sel) = crate::stmt_shared::case_selector(&cx, *stmt)?;
                let func = cx.b.get_insert_block().unwrap().get_parent().unwrap();
                for (item, arm) in stmt.case_items().iter().zip(arms) {
                    let m = crate::stmt_shared::case_item_matches(&cx, cond_kind, sel, item)?;
                    let next = ctx.append_basic_block(func, "case_next");
                    cx.b.build_conditional_branch(m, jump_blocks[arm.0 as usize], next)
                        .unwrap();
                    cx.b.position_at_end(next);
                }
                cx.b.build_unconditional_branch(jump_blocks[default.0 as usize])
                    .unwrap();
            }
            SegTerminator::CondGotoCounter { counter, t, f } => {
                let (ptr, width, _signed) = *counter_locals
                    .get(&SyntheticSlot::Counter(*counter))
                    .ok_or_else(|| {
                        LoweringError::unsupported_at(
                            "CondGotoCounter's counter has no matching alloca (internal invariant)",
                            &plan.fn_sym,
                        )
                    })?;
                let op = OpBuilder { ctx, b: &cx.b };
                let cur_val = load_repeat_counter(&cx, &op, ptr, width);
                let zero = op.i_n(width).const_zero();
                let cont =
                    cx.b.build_int_compare(inkwell::IntPredicate::NE, cur_val, zero, "repeat_cont")
                        .unwrap();
                cx.b.build_conditional_branch(
                    cont,
                    jump_blocks[t.0 as usize],
                    jump_blocks[f.0 as usize],
                )
                .unwrap();
            }
            SegTerminator::Suspend {
                resume,
                live_out,
                point,
                ..
            } => {
                // A run-time delay (`ResolvedSuspend::DynamicDelay`): its
                // ticks, evaluated now, go to the scheduler out of band.
                if let SuspendPoint::Delay(expr, scope) = point
                    && !crate::timescale::delay_is_static(expr)
                {
                    let ticks = crate::timescale::lower_delay_ticks_in(&cx, *expr, scope.as_ref())?;
                    let name = SV_RT_SET_DELAY_SYMBOL;
                    let f = module.get_function(name).unwrap_or_else(|| {
                        let ty = ctx.void_type().fn_type(&[ctx.i64_type().into()], false);
                        module.add_function(name, ty, None)
                    });
                    cx.b.build_call(f, &[ticks.into()], "set_delay").unwrap();
                }
                // PR-039: the suspend epilogue -- exactly the live_out slot
                // set, written back to `local`, before returning the resume
                // SegId. Shared (Task 3) with the guard-resuspend path above
                // via `write_live_out_and_return` -- see that function's own
                // doc comment for why this must be the one writeback
                // implementation, not two independently-written copies.
                // Through a virtual interface: the resume key carries the
                // id (`crate::vif::suspend_key`).
                // An event control on a shared variable: the value it waits
                // to see change.
                for t in local_event_terms(point, &signals) {
                    let Some(&(cell_ptr, bytes)) = cx.cells.get(&t.var.uid()) else {
                        continue;
                    };
                    let _ = cell_ptr;
                    let (shadow, _, _) = cx.locals[&t.var.uid()];
                    edge_snapshot_call(
                        &cx,
                        local,
                        local_event_site(resume.0, t.index),
                        shadow,
                        bytes,
                    );
                }
                // A wait on named event array elements: the rows (index
                // values) and trigger counts it waits to see change.
                for t in event_elem_terms(point, &signals) {
                    event_elem_snapshot(&cx, local, event_elem_site(resume.0, t.index), t.expr)?;
                }
                // A wait on an expression: its value now, which the resume
                // guard compares the value at the wake against.
                for t in expr_event_terms(point, &signals) {
                    let (image, width) = event_value_image(&cx, t.expr)?;
                    let words = event_value_words(width);
                    let i64t = ctx.i64_type();
                    let buf =
                        crate::types::entry_alloca_in(&cx.b, i64t.array_type(words), "ev_value");
                    cx.b.build_store(buf, image).unwrap();
                    edge_snapshot_call(
                        &cx,
                        local,
                        local_event_site(resume.0, t.index),
                        buf,
                        words * 8,
                    );
                }
                let key = match vif_event(point) {
                    Some(_) => Some(vif_point_key(&cx, point, resume.0)?),
                    None => None,
                };
                write_live_out_and_return(
                    &cx,
                    local,
                    &plan.frame,
                    &frame_locals,
                    &counter_locals,
                    live_out,
                    resume.0,
                    key,
                )?;
            }
            SegTerminator::End { loop_back: None } if plan.write_back_at_end => {
                let all: Vec<u32> = (0..plan.frame.slots.len() as u32).collect();
                write_live_out_and_return(
                    &cx,
                    local,
                    &plan.frame,
                    &frame_locals,
                    &counter_locals,
                    &all,
                    SEG_FINISHED as u32,
                    None,
                )?;
            }
            SegTerminator::End { loop_back: None } => {
                // A branch still running sees the final values.
                flush_cells(&cx);
                let ret = cx
                    .ctx
                    .i32_type()
                    .const_int(SEG_FINISHED as u32 as u64, false);
                cx.b.build_return(Some(&ret)).unwrap();
            }
            SegTerminator::End {
                loop_back: Some(target),
            } => {
                cx.b.build_unconditional_branch(jump_blocks[target.0 as usize])
                    .unwrap();
            }
            // R-run Task 17 (PR-047/PR-061/PR-085): a fork/join site is a
            // real suspend point (the parent suspends until its spawned
            // children join, exactly like `Suspend` above) -- reuses the
            // IDENTICAL `write_live_out_and_return` epilogue, with
            // `join_blk.0` playing `resume.0`'s exact role (the raw case
            // value this call returns, and the `resume_pc` a later
            // `ResumeArg::ForkChildDone` activation calls back in with --
            // see this function's own `resume_pc` switch at the top of this
            // function, which already treats every segment id uniformly).
            // All three join kinds share this epilogue; the kind itself only
            // changes the `JoinKind` the fork-table pass below encodes, which
            // the scheduler's `handle_fork` then acts on (All: resume after
            // every child; Any: after the first; None: immediately).
            SegTerminator::ForkJoin {
                join_blk, live_out, ..
            } => {
                write_live_out_and_return(
                    &cx,
                    local,
                    &plan.frame,
                    &frame_locals,
                    &counter_locals,
                    live_out,
                    join_blk.0,
                    None,
                )?;
            }
        }
    }

    Ok(())
}

/// PR-009/PR-010/PR-011/PR-038/PR-039/PR-040/CG-085/CG-086/CG-095/CG-096/
/// CG-097's own entry point: emits ONE LLVM function implementing `plan`'s
/// process, in `plan.fn_name`'s `module`. See this file's module doc comment
/// for the emitted function's exact (pre-Task-S4-ABI-wrap) signature.
pub fn lower_process_cfg<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    plan: &ProcessLoweringPlan<'d>,
) -> Result<FunctionValue<'ctx>, LoweringError> {
    lower_process_cfg_with_repr(ctx, module, fns, plan, ValueRepr::FourState)
}

/// CG-009 (A2-part2 Task 0): the same entry point as [`lower_process_cfg`],
/// parameterized over [`ValueRepr`] (`FourState`/`TwoState`) instead of
/// hardcoding `ValueRepr::FourState` at the two `LowerCtx` construction
/// sites inside [`lower_fast_path`]/[`lower_switch_path`] -- the expression/
/// operator lowering core (`expr.rs`/`ops.rs`) already branches on
/// `LowerCtx::repr` for every leaf-function caller (`lower_function`'s own
/// `ValueRepr::TwoState` tests), so threading a real caller-supplied value
/// down to the process-kernel path is a real parameterization, not a stub.
/// [`lower_process_cfg`] itself stays exactly as it was (a `ValueRepr::
/// FourState`-only call into this function) so no existing caller's
/// signature changes.
pub fn lower_process_cfg_with_repr<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    plan: &ProcessLoweringPlan<'d>,
    value_repr: ValueRepr,
) -> Result<FunctionValue<'ctx>, LoweringError> {
    if plan.segments.is_empty() {
        return Err(LoweringError::unsupported_at(
            "a ProcessLoweringPlan with zero segments (malformed plan -- process::cfg::\
             build_cfg always produces at least one)",
            &plan.fn_sym,
        ));
    }

    let f = declare_process_fn(ctx, module, &plan.fn_name);
    let _assertions = AssertionLowering::enter(plan);
    let _inferred_disable =
        crate::sva::emit::InferredDisableGuard::enter_plan(plan.inferred_disable.clone());
    // Fetch-or-declare (Task S4): a caller lowering several processes into
    // one shared `Module` (S7's future job) must not re-declare `nba_enqueue`
    // a second time under the same name, exactly like this crate's own
    // callers already declare `AccessorFns` once per module and pass it by
    // reference into every process's lowering.
    let nba_fn = module
        .get_function(vj_abi::process::NBA_ENQUEUE_SYMBOL)
        .unwrap_or_else(|| declare_nba_enqueue(ctx, module));
    // Task S6: same fetch-or-declare discipline as `nba_fn` above -- a
    // caller lowering several processes into one shared `Module` must not
    // re-declare any of `sv_rt_display`/`sv_rt_write`/`sv_rt_finish` a
    // second time under the same name.
    let sys_fns = fetch_or_declare_sys_call_fns(ctx, module);

    if plan.segments.len() == 1 {
        lower_fast_path(ctx, module, fns, nba_fn, &sys_fns, plan, f, value_repr)?;
    } else {
        lower_switch_path(ctx, module, fns, nba_fn, &sys_fns, plan, f, value_repr)?;
    }

    if f.verify(true) {
        Ok(f)
    } else {
        Err(LoweringError {
            message: "process kernel function failed LLVM verify".into(),
            at: plan.fn_sym.hierarchical_path(),
        })
    }
}

/// PR-039's suspend epilogue, factored out of [`lower_switch_path`]'s own
/// `SegTerminator::Suspend` arm (Task 3) so it is the ONE place `live_out`
/// gets written back to `local` before a raw `SegId` return -- reused
/// identically by a genuine suspend and by [`build_resume_guards`]'s
/// guard-resuspend path (CG-115's own "one evaluator" discipline extended to
/// this epilogue too: two independently-written copies of this exact
/// writeback loop is exactly the kind of duplication this project's own
/// "duplicate pure-function eval diverges" lesson warns can silently drift
/// apart).
#[allow(clippy::too_many_arguments)]
fn write_live_out_and_return<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    local: PointerValue<'ctx>,
    frame: &FrameLayout,
    frame_locals: &HashMap<SymbolId, (PointerValue<'ctx>, u32, bool)>,
    // R-run Task 8: the `RepeatCounterId`-keyed sibling of `frame_locals` --
    // see `counter_locals`'s own definition-site comment (`lower_switch_path`)
    // for why a `SyntheticCounter` slot cannot share `frame_locals`'s
    // `SymbolId` key.
    counter_locals: &HashMap<SyntheticSlot, (PointerValue<'ctx>, u32, bool)>,
    live_out: &[u32],
    ret_val: u32,
    key: Option<IntValue<'ctx>>,
) -> Result<(), LoweringError> {
    flush_cells(cx);
    // With a VPI library loaded every declared variable is kept, live or not:
    // a frame's automatic variables stay readable while it is suspended.
    let all: Vec<u32>;
    let live_out = if crate::vpi_dyn::enabled() {
        all = (0..frame.slots.len() as u32)
            .filter(|&i| {
                live_out.contains(&i)
                    || matches!(
                        frame.slots[i as usize].source,
                        FrameSlotSource::DeclaredVar(_)
                    )
            })
            .collect();
        &all[..]
    } else {
        live_out
    };
    for idx in live_out {
        let slot = &frame.slots[*idx as usize];
        // A shared variable: its cell pointer.
        if slot.cell
            && let FrameSlotSource::DeclaredVar(id) = &slot.source
            && let Some(&(cell_ptr, _)) = cx.cells.get(id)
        {
            let p =
                cx.b.build_load(cx.ctx.i64_type(), cell_ptr, "cell_ptr")
                    .unwrap();
            let dst = frame_slot_ptr(cx.ctx, &cx.b, local, slot.offset);
            cx.b.build_store(dst, p).unwrap();
            continue;
        }
        let (ptr, width, _signed) = match &slot.source {
            FrameSlotSource::DeclaredVar(id) => *frame_locals.get(id).ok_or_else(|| {
                LoweringError::unsupported_at(
                    "live_out slot has no matching declared-local alloca (internal invariant)",
                    &cx.fn_sym,
                )
            })?,
            FrameSlotSource::SyntheticCounter(counter) => *counter_locals
                .get(&SyntheticSlot::Counter(*counter))
                .ok_or_else(|| {
                    LoweringError::unsupported_at(
                        "live_out slot has no matching repeat-counter alloca (internal \
                         invariant)",
                        &cx.fn_sym,
                    )
                })?,
            FrameSlotSource::Temporary(temp) => *counter_locals
                .get(&SyntheticSlot::Temp(*temp))
                .ok_or_else(|| {
                    LoweringError::unsupported_at(
                        "live_out slot has no matching temporary alloca (internal invariant)",
                        &cx.fn_sym,
                    )
                })?,
        };
        let _ = width;
        let dst = frame_slot_ptr(cx.ctx, &cx.b, local, slot.offset);
        copy_frame_slot(cx.ctx, &cx.b, slot, dst, ptr);
    }
    // VPI frames: while suspended, the variables are their frame slots.
    if crate::vpi_dyn::enabled() {
        let mut vars: Vec<(SymbolId, PointerValue<'ctx>)> = frame
            .slots
            .iter()
            .filter(|slot| !slot.cell)
            .filter_map(|slot| match &slot.source {
                FrameSlotSource::DeclaredVar(id) => Some((
                    id.clone(),
                    frame_slot_ptr(cx.ctx, &cx.b, local, slot.offset),
                )),
                _ => None,
            })
            .collect();
        vars.sort_by(|a, b| a.0.cmp(&b.0));
        crate::vpi_dyn::emit_frame_rebind(cx.ctx, cx.module, &cx.b, &vars);
    }
    let ret = key.unwrap_or_else(|| cx.ctx.i32_type().const_int(u64::from(ret_val), false));
    cx.b.build_return(Some(&ret)).unwrap();
    Ok(())
}

/// R-run Task 8: loads a `repeat(N)` synthetic counter's current numeric
/// value (a plain `width`-bit `IntValue`, never packed val+unk -- this
/// slot's own "unk" plane is unconditionally zero, see
/// [`lower_repeat_counter_init`]'s own doc comment for why) from its
/// per-call `alloca`, honoring `cx.repr` exactly like every other
/// `locals`-resident value this file reads (`FourState` reads the full
/// `width*2`-bit packed word and takes only its low `width`-bit "val" lane
/// via [`OpBuilder::lane_val`]; `TwoState` reads exactly `width` bits, no
/// packing at all -- mirrors `expr.rs`'s own `NamedValue`/inc-dec read
/// sites' identical `cx.repr` branch).
fn load_repeat_counter<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    op: &OpBuilder<'_, 'ctx>,
    ptr: PointerValue<'ctx>,
    width: u32,
) -> IntValue<'ctx> {
    let raw_ty = if cx.repr == ValueRepr::FourState {
        op.i_n(width * 2)
    } else {
        op.i_n(width)
    };
    let raw =
        cx.b.build_load(raw_ty, ptr, "repeat_counter_ld")
            .unwrap()
            .into_int_value();
    let pv = PackedValue {
        llvm: raw,
        width,
        repr: cx.repr,
        signed: false,
    };
    op.lane_val(pv)
}

/// The exact inverse of [`load_repeat_counter`] -- stores `val` (a plain
/// `width`-bit numeric value, never X/Z: this counter's own "unk" plane is
/// always zero) back through the counter's `alloca`, via
/// [`OpBuilder::pack`] (which already produces the right physical width for
/// either `cx.repr`: `width*2` packed bits for `FourState`, `val` untouched
/// for `TwoState` -- the same call every other `locals` write site in this
/// crate uses).
fn store_repeat_counter<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    op: &OpBuilder<'_, 'ctx>,
    ptr: PointerValue<'ctx>,
    width: u32,
    val: IntValue<'ctx>,
) {
    let packed = op.pack(val, op.i_n(width).const_zero(), width, cx.repr, false);
    cx.b.build_store(ptr, packed.llvm).unwrap();
}

/// R-run Task 8: `seg.repeat_init`'s own leaf lowering -- evaluates
/// `count_expr` (a `repeat(N)` loop's iteration count, LRM 1800-2023
/// §12.7.1) exactly ONCE and stores the result, clamped to non-negative,
/// into the counter's own `alloca` (`ptr`/`width`, from `counter_locals`).
/// Mirrors `stmt_shared::lower_repeat_loop`'s identical clamp -- LRM: a
/// negative or unknown (X/Z) count runs the loop ZERO times, never a huge
/// unsigned wraparound count -- adapted from that function's own plain
/// `width`-bit local to this file's packed val+unk `PackedValue`
/// convention (the count expression is lowered once, through the ordinary
/// `expr::lower_expr`, exactly like any other `RHS` this crate lowers; only
/// the destination -- a permanent, cross-suspend frame slot rather than a
/// one-shot function-local `alloca` -- differs).
fn lower_repeat_counter_init<'ctx, 'd, 'm>(
    cx: &LowerCtx<'ctx, 'd, 'm>,
    count_expr: Expression<'d>,
    ptr: PointerValue<'ctx>,
    width: u32,
) -> Result<(), LoweringError> {
    let count_pv = match lower_expr(cx, count_expr)? {
        crate::expr::LoweredValue::Real(rv) => crate::real::real_to_count(cx, rv),
        other => other.into_packed(
            "repeat count must be an integral (non-real) value",
            &cx.fn_sym,
        )?,
    };
    let op = OpBuilder {
        ctx: cx.ctx,
        b: &cx.b,
    };
    let val = op.lane_val(count_pv);
    let unk = op.lane_unk(count_pv);
    let zero_c = op.i_n(count_pv.width).const_zero();
    let unk_zero =
        cx.b.build_int_compare(inkwell::IntPredicate::EQ, unk, zero_c, "repeat_unk_zero")
            .unwrap();
    let n0 =
        cx.b.build_select(unk_zero, val, zero_c, "repeat_n0")
            .unwrap()
            .into_int_value();
    let n = if count_pv.signed {
        let is_neg =
            cx.b.build_int_compare(inkwell::IntPredicate::SLT, n0, zero_c, "repeat_is_neg")
                .unwrap();
        cx.b.build_select(is_neg, zero_c, n0, "repeat_n")
            .unwrap()
            .into_int_value()
    } else {
        n0
    };
    store_repeat_counter(cx, &op, ptr, width, n);
    Ok(())
}

/// Task 3 (CG-115/PR-106): one segment's compiled resume-prologue guard --
/// see [`build_resume_guards`]'s own doc comment.
struct ResumeGuard<'ctx, 'd> {
    guard_fn: FunctionValue<'ctx>,
    live_out: Vec<u32>,
    /// For an event control through virtual interfaces: one member access
    /// per variable, whose resume key a re-suspend must return too.
    vif_vars: Vec<Expression<'d>>,
}

/// Task 3 (CG-115/CG-169/CG-170/PR-106): scans `plan.segments` for every
/// `SegTerminator::Suspend` whose `point` carries a re-checkable condition --
/// `SuspendPoint::Level(expr)` (`wait(expr)`, the condition itself) or
/// `SuspendPoint::Edge { iff: Some(iff_expr), .. }` (the `iff` qualifier,
/// never the edge signal) -- and compiles exactly one standalone
/// [`compile_iff_guard`] function per such suspend site, keyed by the
/// suspend's own `resume: SegId` (`resume.0`, unique per suspend site by
/// construction -- `process::cfg::CfgBuilder` always allocates a fresh
/// `resume` block per suspend point). A `SuspendPoint` with no re-checkable
/// condition (`Delay`/`CycleDelay`/`EdgeList`/an `iff`-free `Edge`) never
/// gets an entry -- its resume target runs its ordinary body unconditionally,
/// exactly as before this task.
fn build_resume_guards<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    plan: &ProcessLoweringPlan<'d>,
    value_repr: ValueRepr,
) -> Result<HashMap<u32, ResumeGuard<'ctx, 'd>>, LoweringError> {
    let mut guards = HashMap::new();
    for seg in &plan.segments {
        let SegTerminator::Suspend {
            point,
            resume,
            live_out,
        } = &seg.terminator
        else {
            continue;
        };
        let signals = seg_signals(&plan.signals, seg)?;
        if !local_event_terms(point, &signals).is_empty()
            || !event_elem_terms(point, &signals).is_empty()
            || !expr_event_terms(point, &signals).is_empty()
            || matches!(point, SuspendPoint::EdgeList(_, iffs) if iffs.iter().any(|g| !g.is_empty()))
        {
            let fn_name = format!("{}__guard_seg{}", plan.fn_name, resume.0);
            let guard_fn = local_event_guard(
                ctx,
                module,
                fns,
                plan,
                &signals,
                point,
                resume.0,
                &fn_name,
                value_repr,
                seg.this_var,
            )?;
            guards.insert(
                resume.0,
                ResumeGuard {
                    guard_fn,
                    live_out: live_out.clone(),
                    vif_vars: vif_event_vars(point),
                },
            );
            continue;
        }
        let guard_expr = match point {
            SuspendPoint::Level(expr) => Some(*expr),
            SuspendPoint::Edge {
                iff: Some(iff_expr),
                ..
            } => Some(*iff_expr),
            _ => None,
        };
        let Some(guard_expr) = guard_expr else {
            continue;
        };
        let fn_name = format!("{}__guard_seg{}", plan.fn_name, resume.0);
        let guard_fn = compile_iff_guard_with_frame(
            ctx,
            module,
            fns,
            &signals,
            &plan.fn_sym,
            &fn_name,
            guard_expr,
            value_repr,
            Some((&plan.frame, &plan.frame_signed)),
            seg.this_var,
        )?;
        guards.insert(
            resume.0,
            ResumeGuard {
                guard_fn,
                live_out: live_out.clone(),
                vif_vars: vif_event_vars(point),
            },
        );
    }
    Ok(guards)
}

/// Task 3 (CG-115/PR-106's joint `CondThunk` decision, now settled): the ONE
/// compiler entry point that produces a real `vj_sim::process::
/// PredicateFn` instance -- compiles `expr` into a standalone `extern "C"
/// fn(handle: SimHandle) -> bool` guard function (`i8 @name(ptr handle)` at
/// the LLVM level -- `bool`'s Rust `extern "C"` ABI representation is `i8`,
/// zero-extended from the `i1` `lower_condition` produces) the engine can
/// poll generically. Called from exactly two sites, never duplicated
/// (`build_resume_guards`): the `iff`-on-edge resume prologue and the
/// `wait(expr)` resume prologue.
///
/// Builds its own, brand-new, EMPTY-`locals` `LowerCtx` (independent of, and
/// never sharing allocas with, whatever `cx.locals` an enclosing segment
/// already primed) -- this function must be independently callable given
/// only a bare `SimHandle`, so it primes its own private shadow `alloca` for
/// every external signal `expr` references, via the same `accessor::
/// build_get_scalar` call every other external-signal read in this crate
/// uses (CG-093), then reads the boolean result through [`lower_condition`],
/// the exact same entry point every direct if/while/wait/iff branch-
/// condition site in this crate uses (CG-007/CG-090's `is_definitely_true`
/// branch reduction: any X/Z bit anywhere makes the guard `false`, never a
/// runtime panic and never `true`).
// Same reasoning/precedent as `lower_switch_path`'s/`lower_fast_path`'s own
// identical `#[allow]` comment: bundling these into a struct would only
// obscure this call-site-only function's real shape for no correctness
// benefit.
#[allow(clippy::too_many_arguments)]
pub fn compile_iff_guard<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    fn_sym: &Symbol<'d>,
    name: &str,
    expr: sv_lang::Expression<'d>,
    value_repr: ValueRepr,
) -> Result<FunctionValue<'ctx>, LoweringError> {
    compile_iff_guard_with_frame(
        ctx, module, fns, signals, fn_sym, name, expr, value_repr, None, None,
    )
}

/// [`compile_iff_guard`] for a condition that may read the process's own
/// locals (`wait (s > lim)`): with `frame` (the process's frame layout and
/// each slot's signedness) the guard takes the frame as a second argument
/// and reads the locals it names from it.
#[allow(clippy::too_many_arguments)]
pub fn compile_iff_guard_with_frame<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    fn_sym: &Symbol<'d>,
    name: &str,
    expr: sv_lang::Expression<'d>,
    value_repr: ValueRepr,
    frame: Option<(&FrameLayout, &[bool])>,
    this: Option<Symbol<'d>>,
) -> Result<FunctionValue<'ctx>, LoweringError> {
    compile_guard(
        ctx,
        module,
        fns,
        signals,
        fn_sym,
        name,
        expr,
        value_repr,
        frame,
        this,
        GuardBody::Condition { negated: false },
    )
}

/// The standalone function that evaluates event-control expression `expr`
/// (LRM 1800-2023 9.4.2: an expression event control waits for its value to
/// change) into the image the runtime's edge check compares, `void(handle,
/// frame, out)`: `out` receives [`event_value_words`]`(width)` 64-bit words,
/// the value plane in the low `width` bits and the unknown plane above it.
/// Returns the function and the expression's width.
#[allow(clippy::too_many_arguments)]
fn compile_event_value<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    fn_sym: &Symbol<'d>,
    name: &str,
    expr: sv_lang::Expression<'d>,
    value_repr: ValueRepr,
    frame: (&FrameLayout, &[bool]),
    this: Option<Symbol<'d>>,
) -> Result<(FunctionValue<'ctx>, u32), LoweringError> {
    let width = event_value_width(&expr, fn_sym)?;
    let f = compile_guard(
        ctx,
        module,
        fns,
        signals,
        fn_sym,
        name,
        expr,
        value_repr,
        Some(frame),
        this,
        GuardBody::Value,
    )?;
    Ok((f, width))
}

/// What a standalone guard function computes from its expression.
#[derive(Clone, Copy)]
enum GuardBody {
    /// The expression as a condition (`!expr` with `negated`): `i8(handle[,
    /// frame])`.
    Condition { negated: bool },
    /// The expression's value image: `void(handle, frame, out)`
    /// ([`compile_event_value`]).
    Value,
}

/// The bit width of the value of event-control expression `e`: a 2- or
/// 4-state integral value that fits the narrow packed representation.
fn event_value_width(e: &Expression<'_>, fn_sym: &Symbol<'_>) -> Result<u32, LoweringError> {
    let ty = e.expr_type().ok_or_else(|| {
        LoweringError::unsupported_at("an event control expression with no type", fn_sym)
    })?;
    let width = ty.bit_width();
    if ty.is_event()
        || !ty.is_integral()
        || width == 0
        || width > u64::from(crate::value::WIDE_THRESHOLD)
    {
        return Err(LoweringError::unsupported_at(
            &format!(
                "an event control on an expression of type {} (LRM 1800-2023 9.4.2): only an \
                 integral expression of at most {} bits is supported",
                ty.to_sv_string(),
                crate::value::WIDE_THRESHOLD
            ),
            fn_sym,
        ));
    }
    Ok(width as u32)
}

/// 64-bit words of an event-expression value image of `width` bits.
fn event_value_words(width: u32) -> u32 {
    (2 * width).div_ceil(64)
}

/// The value image of event-control expression `e` as a whole number of
/// 64-bit words (`event_value_words`), as [`compile_event_value`] stores it.
fn event_value_image<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    e: Expression<'d>,
) -> Result<(IntValue<'ctx>, u32), LoweringError> {
    let width = event_value_width(&e, &cx.fn_sym)?;
    let p = lower_expr(cx, e)?.into_packed(
        "an event control on an expression that is not a narrow packed value",
        &cx.fn_sym,
    )?;
    // A 4-state value is already `unknown plane : value plane`; a 2-state
    // one has no unknown plane, so zero-extending leaves it all known.
    let whole = int_type(cx.ctx, event_value_words(width) * 64);
    let image =
        cx.b.build_int_z_extend_or_bit_cast(p.llvm, whole, "ev_image")
            .unwrap();
    Ok((image, width))
}

/// [`compile_iff_guard`] for the guard `!expr` (a goto repetition's gap sample,
/// sva LRM 16.9.2): true only where `expr` is a known zero, so an `x`/`z`
/// expression makes it false (see `expr::lower_negated_condition`).
#[allow(clippy::too_many_arguments)]
pub fn compile_negated_iff_guard<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    fn_sym: &Symbol<'d>,
    name: &str,
    expr: sv_lang::Expression<'d>,
    value_repr: ValueRepr,
) -> Result<FunctionValue<'ctx>, LoweringError> {
    compile_guard(
        ctx,
        module,
        fns,
        signals,
        fn_sym,
        name,
        expr,
        value_repr,
        None,
        None,
        GuardBody::Condition { negated: true },
    )
}

/// The body of the guard compilers: `expr` as a condition, or `!expr` with
/// `negated`, or (`GuardBody::Value`) its value image.
#[allow(clippy::too_many_arguments)]
fn compile_guard<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    fn_sym: &Symbol<'d>,
    name: &str,
    expr: sv_lang::Expression<'d>,
    value_repr: ValueRepr,
    frame: Option<(&FrameLayout, &[bool])>,
    this: Option<Symbol<'d>>,
    body: GuardBody,
) -> Result<FunctionValue<'ctx>, LoweringError> {
    let ptr_ty = ctx.ptr_type(AddressSpace::default());
    let i8_ty = ctx.i8_type();
    let fn_ty = match body {
        // `void(handle, frame, out)`.
        GuardBody::Value => ctx
            .void_type()
            .fn_type(&[ptr_ty.into(), ptr_ty.into(), ptr_ty.into()], false),
        _ if frame.is_some() => i8_ty.fn_type(&[ptr_ty.into(), ptr_ty.into()], false),
        _ => i8_ty.fn_type(&[ptr_ty.into()], false),
    };
    let f = module.add_function(name, fn_ty, None);
    f.get_nth_param(0).unwrap().set_name("handle");
    let entry_bb = ctx.append_basic_block(f, "entry");
    let b = ctx.create_builder();
    b.position_at_end(entry_bb);
    let handle = f.get_nth_param(0).unwrap().into_pointer_value();

    let mut cx = LowerCtx {
        ctx,
        b,
        repr: value_repr,
        locals: HashMap::new(),
        fn_sym: *fn_sym,
        module,
        mem_signals: mem_signals_of(signals),
        mem_accessor: Some(MemAccessorCtx { handle, fns }),
        lvalue_ref: Default::default(),
        deferred_start: Default::default(),
        unbounded: Default::default(),
        coll_temp: Default::default(),
        iter: Default::default(),
        loop_exits: Default::default(),
        block_exits: Default::default(),
        write_through: None,
        cells: Default::default(),
        copy_out: Default::default(),
        ctor_this: Default::default(),
        decl_scale: Default::default(),
        // The `this` of the inlined class method the wait sits in (a bare
        // field in `wait (n == 0)`, LRM 9.4.3): read from the frame below.
        inline_this: this,
        end_flags: Default::default(),
        // Task 4b: a boolean guard function only ever READS `expr` -- never
        // consulted, never populated.
        specify_dest: Default::default(),
        elem_refs: Default::default(),
    };

    // `vif.m`: every candidate instance's `m` (`crate::vif`).
    let found = named_reads(&[expr.as_sem_node()]);
    // The process's own locals it names, from the frame.
    if let Some((layout, signed)) = frame {
        let local = f.get_nth_param(1).unwrap().into_pointer_value();
        let mut named: HashSet<SymbolId> = found.iter().map(|s| s.uid()).collect();
        named.extend(this.map(|t| t.uid()));
        for (idx, slot) in layout.slots.iter().enumerate() {
            if let FrameSlotSource::DeclaredVar(id) = &slot.source
                && named.contains(id)
            {
                if slot.cell {
                    let (shadow, _, _) = open_cell(ctx, module, &cx.b, local, slot);
                    cx.locals
                        .insert(id.clone(), (shadow, slot.width_bits, signed[idx]));
                    continue;
                }
                let src = frame_slot_ptr(ctx, &cx.b, local, slot.offset);
                let ptr = crate::types::entry_alloca_in(
                    &cx.b,
                    slot_storage_type(ctx, slot),
                    "guard_local",
                );
                copy_frame_slot(ctx, &cx.b, slot, ptr, src);
                cx.locals
                    .insert(id.clone(), (ptr, slot.width_bits, signed[idx]));
            }
        }
    }
    // A sampled value call in the guard (`iff $changed(d)`, LRM 16.9.3) reads
    // the value history cells of its process's call site.
    let mut ids: Vec<SymbolId> = found.iter().map(|s| s.uid()).collect();
    let owner = fn_sym.uid();
    let mut stack = vec![expr.as_sem_node()];
    while let Some(n) = stack.pop() {
        // `wait (s.triggered)`'s guard reads the watcher's cell.
        if let Some(e) = n.as_expression()
            && let Some(inst) = vj_sim::sva::endpoint::watched_call(&e)
        {
            ids.push(vj_sim::sva::endpoint::watcher_id(&owner, &inst));
        }
        if let Some(e) = n.as_expression()
            && let Ok(Some(call)) = vj_sim::sva::sampled::decode(e)
        {
            let args = vj_sim::sva::sampled::strict_site_signals_in(call.arg).unwrap_or_default();
            let views = vj_sim::sva::sampled::use_views(&owner, &call, &args);
            ids.extend(
                views
                    .cur
                    .into_iter()
                    .chain(views.prev)
                    .map(|(_, cell)| cell),
            );
        }
        stack.extend(n.children());
    }
    prime_signal_ids(&mut cx, fns, handle, signals, ids, fn_sym)?;

    match body {
        GuardBody::Condition { negated } => {
            let bit = if negated {
                lower_negated_condition(&cx, expr)?
            } else {
                lower_condition(&cx, expr)?
            };
            let ext =
                cx.b.build_int_z_extend(bit, i8_ty, "guard_bool_zext")
                    .unwrap();
            cx.b.build_return(Some(&ext)).unwrap();
        }
        GuardBody::Value => {
            let (image, _) = event_value_image(&cx, expr)?;
            let out = f.get_nth_param(2).unwrap().into_pointer_value();
            cx.b.build_store(out, image).unwrap();
            cx.b.build_return(None).unwrap();
        }
    }

    if f.verify(true) {
        Ok(f)
    } else {
        Err(LoweringError {
            message: "compile_iff_guard: guard function failed LLVM verify".into(),
            at: fn_sym.hierarchical_path(),
        })
    }
}

/// Every symbol a standalone read-only function (a guard, a covergroup
/// kernel) names in `nodes`, plus the instances a `vif.m` in them may reach.
pub(crate) fn named_reads<'d>(nodes: &[SemNode<'d>]) -> Vec<Symbol<'d>> {
    let mut found = Vec::new();
    for &node in nodes {
        collect_named_value_symbols(node, &mut found);
        let mut stack = vec![node];
        while let Some(n) = stack.pop() {
            if let Some(e) = n.as_expression() {
                found.extend(vif_candidates(&e));
            }
            stack.extend(n.children());
        }
    }
    found
}

/// Gives a standalone read-only function's `cx` a private shadow `alloca` of
/// every signal in `found` (deduplicated), read through the accessor ABI at
/// its entry -- the read half of a process segment's priming.
pub(crate) fn prime_signal_reads<'ctx, 'd>(
    cx: &mut LowerCtx<'ctx, 'd, '_>,
    fns: &AccessorFns<'ctx>,
    handle: PointerValue<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    found: Vec<Symbol<'d>>,
    fn_sym: &Symbol<'d>,
) -> Result<(), LoweringError> {
    let ids = found.iter().map(|s| s.uid()).collect();
    prime_signal_ids(cx, fns, handle, signals, ids, fn_sym)
}

/// [`prime_signal_reads`] by id: also a sampled value call's hidden history
/// cells, which no expression names.
pub(crate) fn prime_signal_ids<'ctx, 'd>(
    cx: &mut LowerCtx<'ctx, 'd, '_>,
    fns: &AccessorFns<'ctx>,
    handle: PointerValue<'ctx>,
    signals: &HashMap<SymbolId, SignalSlot>,
    ids: Vec<SymbolId>,
    _fn_sym: &Symbol<'d>,
) -> Result<(), LoweringError> {
    let mut seen = HashSet::new();
    for id in ids {
        if !seen.insert(id.clone()) {
            continue;
        }
        let Some(info) = signals.get(&id) else {
            continue;
        };
        // R-run Task 13: a `wait(expr)`/`iff`-on-edge guard condition can
        // reference a wide external signal too -- same class dispatch as
        // `prime_external_signals`. A `Memory` reference inside a guard
        // condition (`wait(mem[i] == 1)`, `wait(ea[i].triggered)`) has no
        // whole-signal shadow to prime: `collect_named_value_symbols` only
        // finds the bare `mem` NamedValue node, never the element, and the
        // element select itself reads the row through the guard's own memory
        // accessor (`LowerCtx::mem_accessor`, set by `compile_guard`).
        if matches!(info.class, SignalSlotClass::Memory { .. }) {
            continue;
        }
        if crate::huge::is_huge_width(info.width) {
            // A guard only reads: the runtime's long-lived image, no copy.
            let ptr = crate::huge::rt_prime(cx, handle, info.slot, info.width, false);
            cx.locals.insert(id, (ptr, info.width, info.signed));
            continue;
        }
        let raw = match info.class {
            SignalSlotClass::Inline => build_get_scalar(cx, fns, handle, info.slot, info.width),
            SignalSlotClass::Wide => build_get_wide(cx, fns, handle, info.slot, info.width),
            SignalSlotClass::Memory { .. } => unreachable!("handled above"),
        };
        let packed_ty = int_type(cx.ctx, info.width * 2);
        let ptr = crate::types::entry_alloca_in(&cx.b, packed_ty, "guard_shadow");
        cx.b.build_store(ptr, raw).unwrap();
        cx.locals.insert(id, (ptr, info.width, info.signed));
    }
    Ok(())
}

// --- Task S4: the frozen-ABI wrapper (`lower_kernel_fn`) and the process
// table (`emit_process_table`). -------------------------------------------

/// CG-084/CG-111..CG-116's reconciliation, recorded at exactly the site a
/// future reader auditing those ledger rows would look (mirrors `vj-sim::
/// sched::kernel_adapter::SV_KERNEL_ABI_RECONCILIATION`'s own note on the
/// scheduler-facing half of the same boundary): `docs/design/codegen.md` §9's
/// literal `SvKernelTable`/`SvProcessDesc`/`SvWakeSpec`/`SvResumeStatus` draft
/// is superseded by ARCHITECTURE.md §5's frozen, simpler ABI (`SimHandle`/
/// `ProcessFn`/`EvalResult`/`RescheduleReq`) -- the same reconciliation
/// `PR-037`/`PR-107` already record for the process-model side.
/// [`lower_kernel_fn`] implements that frozen shape directly; the old struct
/// names are never constructed anywhere in this crate. CG-088/CG-089's own
/// "physical resume-point representation" question is pinned here too: a
/// plain `switch` on the caller-supplied `resume_pc: u32` ABI argument, never
/// a state-arena-resident discriminant slot (the switch already built by
/// `lower_process_cfg`/`lower_switch_path` above, wrapped -- not
/// re-implemented -- by this function).
///
/// Resolves a Segment IR [`SuspendPoint`] (still carrying an un-evaluated
/// `sv_lang::Expression`/an unresolved signal reference) down to
/// `vj-sim::sched`'s frontend-free [`ResolvedSuspend`] -- a plain integer
/// tick count or an already-assigned `SlotId`-derived [`StateCellId`], both
/// resolvable entirely at THIS crate's own codegen time (the slice's own
/// scope restriction: "constant, already-elaborated integer delay only";
/// "posedge/negedge only" on an external signal already present in
/// `plan.signals`).
fn resolve_suspend_point<'d>(
    point: &SuspendPoint<'d>,
    signals: &HashMap<SymbolId, SignalSlot>,
    fn_sym: &Symbol<'d>,
    tick: i32,
) -> Result<ResolvedSuspend, LoweringError> {
    match point {
        // A run-time delay's ticks are stored by the kernel itself
        // (`lower_dynamic_delay_store`).
        SuspendPoint::Delay(expr, _) if !crate::timescale::delay_is_static(expr) => {
            Ok(ResolvedSuspend::DynamicDelay)
        }
        SuspendPoint::Delay(expr, scope) => Ok(ResolvedSuspend::Delay(eval_constant_delay_ticks(
            expr,
            scope.as_ref().unwrap_or(fn_sym),
            tick,
        )?)),
        // Task 3: `iff` (if present) never changes the SUBSCRIPTION itself
        // (`docs/design/process.md` §2/line 60: "iff re-evaluates on every
        // wake and re-suspends unchanged on false rather than being folded
        // into the subscription itself") -- the process still wakes on
        // exactly the same edge as an `iff`-free `@(posedge clk)` would, and
        // the re-check happens entirely inside the compiled kernel's resume
        // prologue (see [`resume_guards_by_target`]/[`compile_iff_guard`]),
        // never here.
        SuspendPoint::Edge { signal, edge, .. } => {
            let sym = signal.referenced_symbol().ok_or_else(|| {
                LoweringError::unsupported_at("edge suspend signal has no resolved symbol", fn_sym)
            })?;
            let info = signals.get(&sym.uid()).ok_or_else(|| {
                LoweringError::unsupported_at(
                    "edge suspend signal is not a known external signal (no SignalSlot -- the \
                     A2 slice only supports suspending on a module-level port/net's edge)",
                    &sym,
                )
            })?;
            Ok(ResolvedSuspend::Edge {
                cell: StateCellId(u64::from(info.slot)),
                edge: to_state_edge_kind(*edge, fn_sym)?,
            })
        }
        // Task 3 (CG-169): `wait(expr)`'s level-sensitive subscription.
        // `docs/design/process.md` §4 sketches this as `WaitSpec::
        // ImplicitComb(SubscriptionSetId)` -- an arbitrary read-set,
        // resolved against a static, elaboration-built sensitivity table
        // this crate has no allocator for yet (no committed code anywhere
        // in this tree builds one; `sched::mod`'s own `EventTerm::
        // ImplicitAny(Vec<StateCellId>)` is the eventual multi-cell shape,
        // out of this task's own scope). This task's own fixtures all wait
        // on a single, plain external signal (`wait(done)`), whose read-set
        // is exactly one `StateCellId` -- for exactly that shape, an
        // any-change subscription is expressible today with ZERO new ABI
        // surface by reusing `ResolvedSuspend::Edge` with `EdgeKind::
        // BothEdges` (`sched::notify::infer_edge`'s own truth table already
        // classifies every real bit-pattern transition on a 1-bit cell,
        // other than the four "stayed unknown" X/Z-only pairs, as some real
        // edge -- a `BothEdges`-qualified subscriber wakes on any of them,
        // `sched::sensitivity`'s own `(BothEdges, e) => e == Posedge || e ==
        // Negedge` matching rule). A multi-signal read-set (e.g. `wait(a &&
        // b)`) genuinely needs the `ImplicitAny`/subscription-set-table
        // wiring this task does not build -- named `LoweringError`, never a
        // silent single-signal guess that would miss a real wake.
        SuspendPoint::Level(expr) => {
            let mut found = Vec::new();
            collect_named_value_symbols(expr.as_sem_node(), &mut found);
            let mut seen = HashSet::new();
            let uniq: Vec<Symbol<'d>> =
                found.into_iter().filter(|s| seen.insert(s.uid())).collect();
            let sym = match uniq.as_slice() {
                [sym] => *sym,
                [] => {
                    return Err(LoweringError::unsupported_at(
                        "wait(expr) condition references no named-value symbol at all -- this \
                         crate cannot derive a subscription for it",
                        fn_sym,
                    ));
                }
                _ => {
                    return Err(LoweringError::unsupported_at(
                        "wait(expr) condition's read-set spans more than one signal -- this \
                         task's scope only resolves a single-signal level-sensitive wait (see \
                         resolve_suspend_point's own SuspendPoint::Level doc comment); a \
                         multi-signal wait needs the ImplicitAny/subscription-set-table wiring \
                         this task does not build",
                        fn_sym,
                    ));
                }
            };
            let info = signals.get(&sym.uid()).ok_or_else(|| {
                LoweringError::unsupported_at(
                    "wait(expr) condition's signal is not a known external signal (no \
                     SignalSlot -- only a module-level port/net can be waited on this wave)",
                    &sym,
                )
            })?;
            if info.width != 1 {
                return Err(LoweringError::unsupported_at(
                    "wait(expr) on a signal wider than 1 bit is out of this task's scope -- \
                     `sched::notify::infer_edge`'s edge classification (and therefore the \
                     BothEdges subscription this task reuses) is defined bit-0-only, which \
                     would silently miss a change confined to a higher bit of a wider signal",
                    &sym,
                ));
            }
            Ok(ResolvedSuspend::Edge {
                cell: StateCellId(u64::from(info.slot)),
                edge: StateEdgeKind::BothEdges,
            })
        }
        // Task 6 (CG-171): `##N` against the process's own inferred clock --
        // see `SuspendPoint::CycleDelay`'s own doc comment for the full
        // reasoning. `clock` resolves to a `StateCellId` exactly like
        // `Edge`'s own `signal` above (purely at THIS crate's codegen time);
        // `count` stays a raw CYCLE count (never multiplied by any period --
        // ARCHITECTURE §6.5's own "converted cycles->ticks by the scheduler
        // at runtime" requirement is what `ResolvedSuspend::RepeatEdge`'s own
        // doc comment/`sched::mod::EventTerm::Repeat`'s already-tested
        // live-edge-counting machinery (SC-052/SC-053) actually delivers --
        // never a codegen-side multiply).
        SuspendPoint::CycleDelay {
            count, clock, edge, ..
        } => {
            let sym = *clock;
            let info = signals.get(&sym.uid()).ok_or_else(|| {
                LoweringError::unsupported_at(
                    "CycleDelay (`##N`) clock signal is not a known external signal (no \
                     SignalSlot -- only a module-level port/net's edge can be counted this \
                     wave)",
                    &sym,
                )
            })?;
            // A clocking block's event counter changes once per event.
            let edge = if *edge == sv_lang::EdgeKind::BothEdges {
                StateEdgeKind::BothEdges
            } else {
                to_state_edge_kind(*edge, fn_sym)?
            };
            Ok(ResolvedSuspend::RepeatEdge {
                count: u64::from(*count),
                cell: StateCellId(u64::from(info.slot)),
                edge,
            })
        }
        // SC-123 (LRM 3.14.3, A.2.2.3 `delay_value ::= ... | 1step`): the step
        // time unit equals the global time precision, so `#1step` advances
        // exactly ONE kernel tick (the scheduler's tick IS the global
        // precision). It is NOT a zero-tick `#0`. Inside a clocking skew
        // (14.4) `1step` is handled by `clocking.rs` as a Preponed sample,
        // never through this suspend point.
        SuspendPoint::OneStep => Ok(ResolvedSuspend::Delay(1)),
        // SC-125: payload-free; the scheduler tracks the forked children.
        SuspendPoint::WaitFork => Ok(ResolvedSuspend::WaitFork),
        // Classes plan Task 13: payload-free; the engine applies the
        // request the preceding `process` call queued.
        SuspendPoint::ByRequest => Ok(ResolvedSuspend::ByRequest),
        // Task 1 (`process::cfg`, PR-006's Part 2 half) added the CFG
        // *shape* for `EdgeList`; Task 6 adds the same shape for
        // `ImplicitComb`. Both still have no codegen-side resolution --
        // genuinely out of THIS task's scope (not merely deferred like
        // `CycleDelay`/`OneStep` above): a real multi-signal wait needs a
        // per-process, elaboration-time-built "edge-term table" (a `Vec<
        // (StateCellId, EdgeKind)>` the wire's `ArenaRange{base, count}`
        // addresses into at DECODE time -- `vj-sim::sched::
        // reschedule_req_proposal::KIND_EDGE_LIST`'s own doc comment already
        // documents this exact gap: "no allocator and no STATE-owned storage
        // exists yet to resolve base/count against"), which this task does
        // not build (it would need this function's own signature threaded
        // with a mutable accumulator, `ProcessLoweringPlan` extended with an
        // output field for it, and a caller -- `vj::run.rs` -- wired
        // to actually feed that table into `CompiledKernelProcess` at
        // registration time; the last of those is exactly the kind of
        // `run.rs`-touching change this wave's binding rules forbid risking,
        // wave-B-runtime is concurrently landing there). Named error, never
        // a silent guess.
        SuspendPoint::EdgeList(..) | SuspendPoint::ImplicitComb(_) => {
            Err(LoweringError::unsupported_at(
                "this SuspendPoint kind has no codegen-side resolution yet (a real multi-signal \
             wait needs a per-process edge-term table this crate does not build -- CFG-shape \
             only this wave, PR-006/Task 6)",
                fn_sym,
            ))
        }
    }
}

/// An integer delay constant as time units (LRM 9.4.1): a value with an unknown or
/// high-impedance bit is a zero delay, a negative value is the two's-complement unsigned
/// 64-bit integer of the same bits (a time variable's size): at least 2^63 time units, so it
/// is returned as `None` and the caller uses [`NEVER_TICKS`] (a delay no run can reach; not
/// `u64::MAX`, which the scheduler would wrap).
fn constant_delay_integer(
    cv: &sv_lang::ConstantValue,
    fn_sym: &Symbol<'_>,
) -> Result<Option<f64>, LoweringError> {
    let iv = cv
        .as_integer()
        .ok_or_else(|| LoweringError::unsupported_at("delay constant is not a number", fn_sym))?;
    if iv.has_unknown() {
        return Ok(Some(0.0));
    }
    let v = iv
        .as_i64()
        .ok_or_else(|| LoweringError::unsupported_at("delay constant is not a number", fn_sym))?;
    Ok((v >= 0).then_some(v as f64))
}

/// Scheduler ticks standing in for a delay of 2^63 or more time units (LRM 9.4.1 negative delay).
const NEVER_TICKS: u64 = 1 << 63;

/// A constant delay (`#5`, `#1.5`, `#10ns`: an integer, real or time
/// literal already in the scope's time unit) as scheduler ticks of exponent
/// `tick` (`crate::timescale`).
pub(crate) fn eval_constant_delay_ticks(
    expr: &sv_lang::Expression<'_>,
    fn_sym: &Symbol<'_>,
    tick: i32,
) -> Result<u64, LoweringError> {
    let cv = expr.constant_value().ok_or_else(|| {
        LoweringError::unsupported_at(
            "delay expression is not a compile-time constant (only a constant delay is \
             supported)",
            fn_sym,
        )
    })?;
    let v = match &cv {
        sv_lang::ConstantValue::Real(f) => *f,
        other => match constant_delay_integer(other, fn_sym)? {
            Some(v) => v,
            None => return Ok(NEVER_TICKS),
        },
    };
    crate::timescale::delay_ticks(v, fn_sym, tick)
}

/// [`eval_constant_delay_ticks`] for a delay in the time unit `scale` (`(unit, precision)`
/// exponents) rather than `fn_sym`'s own.
pub(crate) fn eval_constant_delay_ticks_scaled(
    expr: &sv_lang::Expression<'_>,
    fn_sym: &Symbol<'_>,
    scale: (i32, i32),
    tick: i32,
) -> Result<u64, LoweringError> {
    let cv = expr.constant_value().ok_or_else(|| {
        LoweringError::unsupported_at("delay expression is not a compile-time constant", fn_sym)
    })?;
    let v = match &cv {
        sv_lang::ConstantValue::Real(f) => *f,
        other => match constant_delay_integer(other, fn_sym)? {
            Some(v) => v,
            None => return Ok(NEVER_TICKS),
        },
    };
    crate::timescale::delay_ticks_scaled(v, fn_sym, scale, tick)
}

/// `sv_lang::EdgeKind` (the frontend AST's edge-kind enum) -> `vj_sim::
/// state::EdgeKind` (the frontend-free, ABI-facing mirror `state::EdgeKind`'s
/// own doc comment describes, "the netlist track owns the real conversion" --
/// no such conversion exists anywhere else in this tree yet, so this is it,
/// scoped narrowly to this crate's own boundary). Exhaustive, no wildcard arm
/// (ARCHITECTURE §7 item 9): `process::cfg::build_cfg` already rejects every
/// `EdgeKind` other than `PosEdge`/`NegEdge` before a `SuspendPoint::Edge` can
/// ever be constructed, so the `None`/`BothEdges` arms below are unreachable
/// in practice, but a named error -- never a silent default or a panic -- is
/// still required for them.
pub fn to_state_edge_kind(
    e: sv_lang::EdgeKind,
    fn_sym: &Symbol<'_>,
) -> Result<StateEdgeKind, LoweringError> {
    match e {
        sv_lang::EdgeKind::PosEdge => Ok(StateEdgeKind::Posedge),
        sv_lang::EdgeKind::NegEdge => Ok(StateEdgeKind::Negedge),
        sv_lang::EdgeKind::None | sv_lang::EdgeKind::BothEdges => {
            Err(LoweringError::unsupported_at(
                &format!(
                    "edge kind {e:?} is unsupported in the A2 slice (only posedge/negedge suspend \
                 points are ever constructed by process::cfg::build_cfg)"
                ),
                fn_sym,
            ))
        }
    }
}

/// Writes `bytes` (a compile-time-constant 36-byte `EvalResult` bit pattern,
/// `{outcome: u32}{reschedule.opaque: [u8;32]}` -- `EvalResult`'s own
/// `#[repr(C)]` layout, no hidden padding per its `size_of::<EvalResult>() ==
/// 4 + RESCHEDULE_REQ_SIZE` assertion) into the `sret`-pointed return slot and
/// returns. The ONE place [`lower_kernel_fn`]'s wrapper ever touches `sret`.
fn store_eval_result_bytes_and_return<'ctx>(
    ctx: &'ctx Context,
    b: &Builder<'ctx>,
    sret: PointerValue<'ctx>,
    bytes: &[u8; 36],
) {
    let i8_ty = ctx.i8_type();
    let elems: Vec<IntValue<'ctx>> = bytes
        .iter()
        .map(|byte| i8_ty.const_int(u64::from(*byte), false))
        .collect();
    let arr = i8_ty.const_array(&elems);
    b.build_store(sret, arr).unwrap();
    b.build_return(None).unwrap();
}

/// Task S4's own entry point (PR-031, PR-032, PR-035, PR-036, PR-121,
/// CG-083, CG-087, CG-088, CG-089, CG-106, CG-107, CG-164): wraps
/// [`lower_process_cfg`]'s output in the frozen ABI signature exactly,
/// `extern "C" fn(SimHandle, *mut u8, u32) -> EvalResult` -- at the LLVM
/// level, since `EvalResult` (36 bytes) is SysV-MEMORY-classified, this is a
/// `void(sret ptr, ptr handle, ptr local, i32 resume_pc)` function, the same
/// `sret`-parameter convention `accessor::declare_accessor_fns` already uses
/// for `sv_get_wide`.
///
/// **How the raw `SegId`/[`SEG_FINISHED`] return value becomes an
/// `EvalResult`:** every `SegTerminator::Suspend` in `plan.segments` returns
/// its own fixed `resume.0` value UNCONDITIONALLY (see `lower_switch_path`'s
/// own `SegTerminator::Suspend` arm) -- a compile-time-known constant PER
/// SUSPEND SITE, even though which constant control flow reaches within one
/// call is only known at runtime (an intra-call `Goto`/`CondGoto`/loop-back
/// can reach any one of several `Suspend` sites before finally returning).
/// This function therefore precomputes, in Rust, one constant 36-byte
/// `EvalResult` bit pattern per possible raw return value (each distinct
/// `resume.0` across every `Suspend` terminator, plus [`SEG_FINISHED`]) via
/// [`resolve_suspend_point`] + `vj_sim::sched::build_eval_result`, then
/// emits a single runtime `switch` on the inner kernel's actual return value
/// selecting which precomputed constant to store into `sret` -- no runtime
/// byte-twiddling IR at all, only a `switch` and one whole-struct `store` per
/// arm. `resume.0` values are unique per suspend site by construction
/// (`process::cfg::CfgBuilder::walk_timed` always allocates a FRESH `resume`
/// block per `Timed` statement), so this switch can never have two suspend
/// sites collide on the same case value; the default arm is therefore a hard
/// trap (an internal-invariant violation, never a legitimate return value).
pub fn lower_kernel_fn<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    plan: &ProcessLoweringPlan<'d>,
) -> Result<FunctionValue<'ctx>, LoweringError> {
    lower_kernel_fn_with_repr(ctx, module, fns, plan, ValueRepr::FourState)
}

/// CG-009 (A2-part2 Task 0): the same entry point as [`lower_kernel_fn`],
/// parameterized over [`ValueRepr`] -- see [`lower_process_cfg_with_repr`]'s
/// own doc comment for why this is a real parameterization. [`lower_kernel_fn`]
/// itself stays exactly as it was (a `ValueRepr::FourState`-only call into
/// this function) so no existing caller's signature changes.
///
/// **R-run Task 17:** delegates to [`lower_kernel_fn_with_repr_impl`] with
/// `fork_ctx: None` -- this function's own signature is UNCHANGED (every
/// existing caller, across both crates and every test file, is unaffected).
/// A process whose CFG contains a fork/join site can only be compiled
/// through [`lower_kernel_fn_with_fork_support`] instead (`None` here makes
/// that a loud, named [`LoweringError`] rather than a silent miscompile --
/// see the impl function's own `SegTerminator::ForkJoin` arm).
pub fn lower_kernel_fn_with_repr<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    plan: &ProcessLoweringPlan<'d>,
    value_repr: ValueRepr,
) -> Result<FunctionValue<'ctx>, LoweringError> {
    lower_kernel_fn_with_repr_impl(ctx, module, fns, plan, value_repr, None)
}

/// R-run Task 17 (PR-047/PR-061/PR-085): the ONLY entry point that can
/// compile a process whose CFG contains a `fork ... join` (`JoinAll`) site
/// -- a real, ADDITIVE sibling of [`lower_kernel_fn_with_repr`], never a
/// signature change to it (see that function's own doc comment). `kernels`/
/// `fork_table` are the caller's OWN, whole-compiled-program accumulators
/// (the exact `Vec<FunctionValue>` it already builds up to eventually hand
/// `emit_process_table`, and a parallel `Vec<SpawnSpec>` it must pass, as an
/// `Arc<[SpawnSpec]>`, to every [`vj_sim::sched::CompiledKernelProcess::
/// with_fork_table`] it later mints from this same program) -- this
/// function APPENDS each fork branch's own freshly-compiled kernel to
/// `kernels` (recording its real, final index as a [`SpawnSpec::kernel`])
/// and each branch's `SpawnSpec` to `fork_table`, but never touches
/// `kernels`/`fork_table`'s EXISTING contents or ordering, so a caller's own
/// prior/later pushes (other top-level processes) are unaffected.
pub fn lower_kernel_fn_with_fork_support<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    plan: &ProcessLoweringPlan<'d>,
    value_repr: ValueRepr,
    kernels: &mut Vec<FunctionValue<'ctx>>,
    fork_table: &mut Vec<SpawnSpec>,
) -> Result<FunctionValue<'ctx>, LoweringError> {
    let mut branch_frames = Vec::new();
    let mut wait_table = Vec::new();
    lower_kernel_fn_with_fork_branches(
        ctx,
        module,
        fns,
        plan,
        value_repr,
        kernels,
        fork_table,
        &mut branch_frames,
        &mut wait_table,
    )
}

/// [`lower_kernel_fn_with_fork_support`], additionally recording every fork
/// branch kernel it compiles as `(index into kernels, frame word count)` in
/// `branch_frames` -- what a caller needs to mint that branch's child process
/// at run time (`vj_sim::sched::ForkKernel`).
#[allow(clippy::too_many_arguments)]
pub fn lower_kernel_fn_with_fork_branches<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    plan: &ProcessLoweringPlan<'d>,
    value_repr: ValueRepr,
    kernels: &mut Vec<FunctionValue<'ctx>>,
    fork_table: &mut Vec<SpawnSpec>,
    branch_frames: &mut Vec<BranchFrame>,
    wait_table: &mut Vec<WaitTableEntry>,
) -> Result<FunctionValue<'ctx>, LoweringError> {
    let mut fork_ctx = ForkCompileCtx {
        kernels,
        fork_table,
        branch_frames,
        wait_table,
        recursion: Vec::new(),
        shared: HashMap::new(),
    };
    lower_kernel_fn_with_repr_impl(ctx, module, fns, plan, value_repr, Some(&mut fork_ctx))
}

/// A compiled DPI export task that consumes time (LRM 1800-2023 35.7): its
/// kernel is a fork-branch kernel (so `CompiledProcess::mint_fork_child` can
/// start it as a process of its own, with a frame of its own).
#[derive(Debug, Clone)]
pub struct ExportTaskKernel {
    /// Index into `kernels` (the program's branch-kernel table) and into
    /// `branch_frames`; a `SpawnSpec { kernel, entry_pc, .. }` starts it.
    pub kernel: u32,
    /// The pc the process starts at.
    pub entry_pc: u32,
    /// The process's frame size, in words.
    pub frame_words: u32,
    /// The frame slot of each formal of the task, in declaration order
    /// (`None` for a `static` formal, which is module state, not frame).
    pub formals: Vec<Option<vj_sim::process::liveness::FrameSlotDesc>>,
}

/// Compiles the body of `task`, a DPI export whose body consumes time, as a
/// one-shot fork-branch kernel appended to `kernels`/`branch_frames` (see
/// [`vj_sim::process::cfg::build_export_task_cfg`] for the process it
/// runs and how its caller supplies the formals). `signals` is the slot map of
/// the instance body declaring the task; `fn_name` names the kernel function.
#[allow(clippy::too_many_arguments)]
pub fn lower_export_task_kernel<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    task: &Symbol<'d>,
    signals: HashMap<SymbolId, SignalSlot>,
    fn_name: String,
    value_repr: ValueRepr,
    kernels: &mut Vec<FunctionValue<'ctx>>,
    fork_table: &mut Vec<SpawnSpec>,
    branch_frames: &mut Vec<BranchFrame>,
    wait_table: &mut Vec<WaitTableEntry>,
) -> Result<ExportTaskKernel, LoweringError> {
    let cfg = vj_sim::process::cfg::build_export_task_cfg(task, None)
        .map_err(|e| LoweringError::unsupported_at(&e.to_string(), task))?;
    let frame =
        compute_liveness(&cfg).map_err(|e| LoweringError::unsupported_at(&e.to_string(), task))?;
    let frame_words = frame.total_words();
    let segments = lower_to_segments(&cfg, &frame);
    let mut plan = build_lowering_plan(fn_name, *task, segments, frame, signals);
    plan.fork_branch_names = cfg.fork_branch_names.clone();
    plan.disable_broadcast = cfg.disable_broadcast.clone();
    plan.write_back_at_end = true;
    let formals = task
        .subroutine_arguments()
        .map(|f| {
            let id = f.uid();
            plan.frame
                .slots
                .iter()
                .find(|s| matches!(&s.source, FrameSlotSource::DeclaredVar(d) if *d == id))
                .cloned()
        })
        .collect();
    let mut fc = ForkCompileCtx {
        kernels,
        fork_table,
        branch_frames,
        wait_table,
        recursion: Vec::new(),
        shared: HashMap::new(),
    };
    let fv = lower_kernel_fn_with_repr_impl(ctx, module, fns, &plan, value_repr, Some(&mut fc))?;
    let kernel = fc.kernels.len() as u32;
    fc.kernels.push(fv);
    fc.branch_frames
        .push((kernel, frame_words, Vec::new(), Vec::new()));
    Ok(ExportTaskKernel {
        kernel,
        entry_pc: cfg.entry.0,
        frame_words,
        formals,
    })
}

/// The process a task called from a sequence match item runs as (LRM 1800-2023
/// 16.11): see [`ExportTaskKernel`], which this shares the compiled shape of.
/// `site` is the call, `first_input` the first assertion input word of its
/// by-value arguments (after the captured values), `signals` the slot map of the
/// instance body the assertion belongs to. Its by-value actuals read the values
/// the engine sampled at the end point, handed to the process as its assertion
/// inputs ([`crate::sva::proc::SpawnArgScope`]).
#[allow(clippy::too_many_arguments)]
pub fn lower_match_item_task_kernel<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    site: &crate::sva::actions::CallSite<'d>,
    first_input: usize,
    signals: HashMap<SymbolId, SignalSlot>,
    fn_name: String,
    value_repr: ValueRepr,
    kernels: &mut Vec<FunctionValue<'ctx>>,
    fork_table: &mut Vec<SpawnSpec>,
    branch_frames: &mut Vec<BranchFrame>,
    wait_table: &mut Vec<WaitTableEntry>,
) -> Result<ExportTaskKernel, LoweringError> {
    let task = site.call.call_subroutine().ok_or_else(|| {
        LoweringError::unsupported(
            "a match-item call of a task has no subroutine symbol",
            "match-item task",
        )
    })?;
    let cfg = vj_sim::process::cfg::build_match_item_task_cfg(site.call)
        .map_err(|e| LoweringError::unsupported_at(&e.to_string(), &task))?;
    // The sampled by-value actuals, in argument order: their input words.
    let mut args = Vec::new();
    let mut next = first_input;
    for (arg, actual) in &site.args {
        if !matches!(arg, vj_sim::sva::ir::CallArg::Value(_)) {
            continue;
        }
        let t = actual.expr_type().ok_or_else(|| {
            LoweringError::unsupported_at(
                "a by-value argument of a sequence match-item call has no type",
                &task,
            )
        })?;
        let width = t.value_width();
        args.push((
            crate::sva::proc::call_arg_key(actual),
            (next, width, t.is_signed()),
        ));
        next += if width > 64 {
            2 * width.div_ceil(64) as usize
        } else {
            1
        };
    }
    let _scope = crate::sva::proc::SpawnArgScope::enter(args);
    let frame =
        compute_liveness(&cfg).map_err(|e| LoweringError::unsupported_at(&e.to_string(), &task))?;
    let frame_words = frame.total_words();
    let segments = lower_to_segments(&cfg, &frame);
    let mut plan = build_lowering_plan(fn_name, task, segments, frame, signals);
    plan.fork_branch_names = cfg.fork_branch_names.clone();
    plan.disable_broadcast = cfg.disable_broadcast.clone();
    plan.write_back_at_end = true;
    let mut fc = ForkCompileCtx {
        kernels,
        fork_table,
        branch_frames,
        wait_table,
        recursion: Vec::new(),
        shared: HashMap::new(),
    };
    let fv = lower_kernel_fn_with_repr_impl(ctx, module, fns, &plan, value_repr, Some(&mut fc))?;
    let kernel = fc.kernels.len() as u32;
    fc.kernels.push(fv);
    fc.branch_frames
        .push((kernel, frame_words, Vec::new(), Vec::new()));
    Ok(ExportTaskKernel {
        kernel,
        entry_pc: cfg.entry.0,
        frame_words,
        formals: Vec::new(),
    })
}

/// The word-for-word copies a spawned branch makes of its parent's frame
/// slots (`ProcessCfg::inherited`): `(parent word, child word)` pairs.
fn inherited_captures<'d>(
    parent: &FrameLayout,
    child: &FrameLayout,
    inherited: &[vj_sim::process::cfg::InheritedSlot],
    fn_sym: &Symbol<'d>,
) -> Result<Vec<(u32, u32)>, LoweringError> {
    let mut out = Vec::new();
    for inh in inherited {
        let (ps, cs) = match inh {
            vj_sim::process::cfg::InheritedSlot::Temp { parent, child } => (
                FrameSlotSource::Temporary(*parent),
                FrameSlotSource::Temporary(*child),
            ),
            vj_sim::process::cfg::InheritedSlot::Counter { parent, child } => (
                FrameSlotSource::SyntheticCounter(*parent),
                FrameSlotSource::SyntheticCounter(*child),
            ),
            vj_sim::process::cfg::InheritedSlot::Return { parent, child } => (
                FrameSlotSource::Temporary(*parent),
                FrameSlotSource::Temporary(*child),
            ),
        };
        let ret = matches!(inh, vj_sim::process::cfg::InheritedSlot::Return { .. });
        let find = |f: &FrameLayout, src: &FrameSlotSource| {
            f.slots.iter().find(|x| x.source == *src).cloned()
        };
        let (Some(p), Some(c)) = (find(parent, &ps), find(child, &cs)) else {
            return Err(LoweringError::unsupported_at(
                "an inherited fork-branch slot has no frame slot (internal invariant)",
                fn_sym,
            ));
        };
        let words = match p.repr {
            vj_sim::process::FrameSlot::Narrow4State { word_count } => u32::from(word_count),
            vj_sim::process::FrameSlot::Array { rows, row_words } => rows * u32::from(row_words),
            vj_sim::process::FrameSlot::Wide4State {
                aval_word_count,
                bval_word_count,
            } => aval_word_count + bval_word_count,
        };
        // A return copy runs child -> parent when the branch is done.
        let flag = if ret { vj_sim::sched::RETURN_COPY } else { 0 };
        out.extend((0..words).map(|k| ((p.offset + k) | flag, c.offset + k)));
    }
    Ok(out)
}

/// R-run Task 17: the shared accumulator [`lower_kernel_fn_with_fork_support`]
/// threads through [`lower_kernel_fn_with_repr_impl`]'s recursive branch
/// compilation -- see that function's own `SegTerminator::ForkJoin` arm.
/// `'a` is the borrow's own lifetime (this whole struct lives only for the
/// duration of one top-level [`lower_kernel_fn_with_fork_support`] call);
/// `'ctx` is the LLVM `Context`/`Module` lifetime every [`FunctionValue`]
/// here is already tied to.
struct ForkCompileCtx<'a, 'ctx> {
    kernels: &'a mut Vec<FunctionValue<'ctx>>,
    fork_table: &'a mut Vec<SpawnSpec>,
    branch_frames: &'a mut Vec<BranchFrame>,
    /// The program's multi-term wait table (see `resolve_suspend_point_tabled`).
    wait_table: &'a mut Vec<WaitTableEntry>,
    /// The recursive-task activations being compiled, innermost last.
    recursion: Vec<RecursionFrame>,
    /// Fork-branch kernels already compiled, by `ProcessCfg::share_id`: the
    /// kernel, and the branch's frame size and layout. A branch the CFG
    /// builder shares is compiled once per process; every spawn site points
    /// at that code (it differs only by the by-value copies and captures
    /// each spawn makes).
    shared: HashMap<u64, (FunctionValue<'ctx>, u32, FrameLayout)>,
}

/// A recursive task's activation kernel under compilation
/// ([`vj_sim::process::cfg::Recursion`]): its calls inside its own body
/// spawn it again, before its kernel index is known.
struct RecursionFrame {
    /// The activation's entry pc.
    entry_pc: u32,
    /// The activation's frame size, in words.
    frame_words: u32,
    /// The activation's own frame layout: the child of every recursive
    /// spawn, wherever in the activation's fork branches the call sits.
    frame: FrameLayout,
    /// `fork_table` rows to point at a re-spawn kernel once it exists, each
    /// with the by-value copies its spawn makes (the spawning frame to the
    /// activation's: the activation's own frame for a call in its body, a
    /// fork branch's frame for a call nested in one of its forks).
    pending: Vec<(usize, Vec<(u32, u32)>)>,
}

/// [`resolve_suspend_point`], plus the waits that need more than one inline
/// (cell, edge) term -- appended to the program's `wait_table` and encoded as
/// [`ResolvedSuspend::EventList`]:
/// - `@*` / `@(*)` (`ImplicitComb`) and `wait(expr)` (`Level`): any value
///   change of any module-level signal (incl. memories) the expression
///   reads. A spurious wake is harmless for both (`@*` recomputes the same
///   values; `wait` re-checks its condition in the kernel's resume prologue).
/// - `@(a or posedge b ...)` (`EdgeList`) and a plain edge-less `@(a)`: each
///   term must name a plain signal -- an edge (or change) on a bit/part
///   select needs per-bit event detection this table does not express, so it
///   is a named error rather than a spurious wake.
///
/// Every other kind goes through [`resolve_suspend_point`] unchanged.
fn resolve_suspend_point_tabled<'d>(
    point: &SuspendPoint<'d>,
    signals: &HashMap<SymbolId, SignalSlot>,
    fn_sym: &Symbol<'d>,
    wait_table: &mut Vec<WaitTableEntry>,
    tick: i32,
) -> Result<ResolvedSuspend, LoweringError> {
    let any_change_terms = |exprs: &[Expression<'d>]| -> Vec<WaitTableEntry> {
        let mut slots: Vec<u32> = Vec::new();
        for e in exprs {
            for slot in expr_dependency_slots(e, signals, fn_sym) {
                if !slots.contains(&slot) {
                    slots.push(slot);
                }
            }
        }
        slots
            .into_iter()
            .map(|slot| WaitTableEntry::whole(slot, None))
            .collect()
    };
    let plain_signal_term =
        |expr: &Expression<'d>, edge: sv_lang::EdgeKind| -> Result<WaitTableEntry, LoweringError> {
            // A modport port with an expression (`@(p.x)`, LRM 25.5.4) waits
            // on that expression of the interface instance.
            let target = crate::expr::modport_expr_target(expr);
            let expr = target.as_ref().unwrap_or(expr);
            // `@(s)` on a sequence instance (9.4.2.4): its watcher's cell changes
            // at each end point.
            if expr.kind() == sv_lang::kinds::ExpressionKind::AssertionInstance {
                let id = vj_sim::sva::endpoint::watcher_id(&fn_sym.uid(), expr);
                let info = signals.get(&id).ok_or_else(|| {
                    LoweringError::unsupported_at(
                        "a sequence event control `@(s)` whose instance is not watched here",
                        fn_sym,
                    )
                })?;
                return Ok(WaitTableEntry::whole(info.slot, None));
            }
            // An element of an event array (`@(ea[i])`): the array's memory
            // cell wakes the wait on any element's trigger; the resume guard
            // (`local_event_guard`) tells whether this element's was.
            if let Some(info) = event_elem_signal(expr, signals) {
                if edge != sv_lang::EdgeKind::None {
                    return Err(LoweringError::unsupported_at(
                        "an edge qualifier on a named event array element",
                        fn_sym,
                    ));
                }
                return Ok(WaitTableEntry::whole(info.slot, None));
            }
            // A constant bit/part select of a signal (`@(posedge v[1])`, LRM
            // 9.4.2): the signal's cell wakes the wait and the scheduler
            // tells, from the update's old/new bits, whether the SELECTED
            // bits changed (`EventTerm::Select`).
            if let Some((info, lsb, width)) = constant_select_of_signal(expr, signals) {
                let edge = match edge {
                    sv_lang::EdgeKind::PosEdge => Some(StateEdgeKind::Posedge),
                    sv_lang::EdgeKind::NegEdge => Some(StateEdgeKind::Negedge),
                    sv_lang::EdgeKind::BothEdges => Some(StateEdgeKind::BothEdges),
                    sv_lang::EdgeKind::None => None,
                };
                return Ok(WaitTableEntry {
                    slot: info.slot,
                    edge,
                    select: Some((lsb, width)),
                });
            }
            // A name, or a clocking block (`@(cb)`: its event counter).
            let sym = expr
                .referenced_symbol()
                .filter(|s| {
                    vj_sim::symid::is_value_name(expr.kind())
                        || s.kind() == sv_lang::kinds::SymbolKind::ClockingBlock
                })
                .ok_or_else(|| {
                    LoweringError::unsupported_at(
                        "an event control term on a bit/part select or expression (only a \
                         plain signal name is supported in @(...) event lists)",
                        fn_sym,
                    )
                })?;
            let info = signals.get(&sym.uid()).ok_or_else(|| {
                LoweringError::unsupported_at(
                    "an event control term that is not a module-level signal",
                    &sym,
                )
            })?;
            let edge = match edge {
                sv_lang::EdgeKind::PosEdge => Some(StateEdgeKind::Posedge),
                sv_lang::EdgeKind::NegEdge => Some(StateEdgeKind::Negedge),
                sv_lang::EdgeKind::BothEdges => Some(StateEdgeKind::BothEdges),
                sv_lang::EdgeKind::None => None,
            };
            Ok(WaitTableEntry::whole(info.slot, edge))
        };
    // An event control naming a process-local variable: it changes only as
    // one shared with another process (a fork branch or its parent), so
    // that term waits on any shared variable's change; the resume guard
    // (`local_event_guard`) checks for its own edge.
    //
    // An event control on an expression (`@(mem[i])`, `@(a + b)`, LRM
    // 1800-2023 9.4.2: it waits for the expression's value to change) wakes
    // on any change of any cell the expression reads: its own term holds the
    // first of them and the rest follow the point's terms, so the terms keep
    // their positions. The resume guard (`local_event_guard`) compares the
    // value to the one recorded when the wait began.
    let locals = local_event_terms(point, signals);
    let exprs = expr_event_terms(point, signals);
    if !locals.is_empty() || !exprs.is_empty() {
        let entries: Vec<(Expression<'d>, sv_lang::EdgeKind)> = match point {
            SuspendPoint::Edge { signal, edge, .. } => vec![(*signal, *edge)],
            SuspendPoint::EdgeList(entries, ..) => entries.clone(),
            _ => Vec::new(),
        };
        let mut terms = Vec::new();
        let mut extra = Vec::new();
        for (k, (expr, edge)) in entries.iter().enumerate() {
            if locals.iter().any(|t| t.index == k) {
                terms.push(WaitTableEntry::whole(vj_sim::sched::SHARED_VARS_SLOT, None));
            } else if exprs.iter().any(|t| t.index == k) {
                let mut deps = expr_dependency_slots(expr, signals, fn_sym).into_iter();
                // An expression that reads no variable (`@(1 + 1)`) can never change
                // (LRM 9.4.2), so the wait never ends; the term waits on the shared-
                // variable slot only to have a valid entry, and the resume guard's
                // value comparison filters every wake.
                let first = deps.next().unwrap_or(vj_sim::sched::SHARED_VARS_SLOT);
                terms.push(WaitTableEntry::whole(first, None));
                extra.extend(deps.map(|slot| WaitTableEntry::whole(slot, None)));
            } else {
                terms.push(plain_signal_term(expr, *edge)?);
            }
        }
        extra.extend(group_wait_extras(point, signals, &terms));
        terms.extend(extra);
        let base = wait_table.len() as u32;
        let count = terms.len() as u32;
        wait_table.extend(terms);
        return Ok(ResolvedSuspend::EventList { base, count });
    }
    let terms: Vec<WaitTableEntry> = match point {
        SuspendPoint::ImplicitComb(exprs) => any_change_terms(exprs),
        SuspendPoint::Level(expr) => {
            let mut terms = any_change_terms(std::slice::from_ref(expr));
            // A condition reading class-object state (`wait (weak.get() ==
            // null)`, LRM 1800-2023 8.30.3) also wakes on any object-state
            // change: a heap write is no signal change.
            if crate::classes::reads_object_state(expr) {
                terms.push(WaitTableEntry::whole(
                    vj_sim::sched::OBJECT_STATE_SLOT,
                    None,
                ));
            }
            terms
        }
        SuspendPoint::EdgeList(entries, ..) => entries
            .iter()
            .map(|(expr, edge)| plain_signal_term(expr, *edge))
            .collect::<Result<_, _>>()?,
        SuspendPoint::Edge {
            signal,
            edge: edge @ (sv_lang::EdgeKind::None | sv_lang::EdgeKind::BothEdges),
            ..
        } => vec![plain_signal_term(signal, *edge)?],
        // `@(posedge v[1])`: an edge on a constant select needs the
        // per-bit event detection only the wait table can express.
        SuspendPoint::Edge { signal, edge, .. }
            if constant_select_of_signal(signal, signals).is_some() =>
        {
            vec![plain_signal_term(signal, *edge)?]
        }
        SuspendPoint::Edge { .. }
        | SuspendPoint::Delay(..)
        | SuspendPoint::CycleDelay { .. }
        | SuspendPoint::OneStep
        | SuspendPoint::WaitFork
        | SuspendPoint::ByRequest => return resolve_suspend_point(point, signals, fn_sym, tick),
    };
    let mut terms = terms;
    terms.extend(group_wait_extras(point, signals, &terms));
    let base = wait_table.len() as u32;
    let count = terms.len() as u32;
    wait_table.extend(terms);
    Ok(ResolvedSuspend::EventList { base, count })
}

/// R-run Task 17: the real body [`lower_kernel_fn_with_repr`]/
/// [`lower_kernel_fn_with_fork_support`] both delegate to -- identical to
/// this file's pre-Task-17 `lower_kernel_fn_with_repr` body, plus ONE new
/// arm in the `suspend_cases`-building loop below for `SegTerminator::
/// ForkJoin`. `fork_ctx: None` (the ordinary path, used by 100% of every
/// pre-existing caller/test, none of which ever lowers a process whose CFG
/// contains a fork/join site) reaches that new arm never (`plan.segments`
/// has no `ForkJoin` terminator for any of them) -- this refactor is
/// therefore observably a no-op for every existing caller.
fn lower_kernel_fn_with_repr_impl<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    plan: &ProcessLoweringPlan<'d>,
    value_repr: ValueRepr,
    mut fork_ctx: Option<&mut ForkCompileCtx<'_, 'ctx>>,
) -> Result<FunctionValue<'ctx>, LoweringError> {
    let inner_plan = ProcessLoweringPlan {
        fn_name: format!("{}__inner", plan.fn_name),
        fn_sym: plan.fn_sym,
        segments: plan.segments.clone(),
        frame: plan.frame.clone(),
        frame_signed: plan.frame_signed.clone(),
        local_syms: plan.local_syms.clone(),
        signals: plan.signals.clone(),
        // Task 10 (PR-122): must carry the OUTER plan's real `region_id`
        // through to the inner kernel -- this is the plan that actually
        // reaches `prime_external_signals`/`flush_external_signals` and
        // their bias computation; leaving this at the struct-literal
        // default would silently re-zero every biased accessor call the
        // wrapped ABI kernel ever emits.
        region_id: plan.region_id,
        // Review fix (Task 9, CG-101 r2): same "must carry the OUTER plan's
        // real value through" posture as `region_id` immediately above --
        // this inner plan is never handed to `side_tables_for_plans`/
        // `compile_design_kernels` itself (only the outer `plan` is), but
        // there is no reason to let it silently diverge from its owner.
        owning_instance: plan.owning_instance,
        // Task 4b: same "must carry the OUTER plan's real value through"
        // posture as `owning_instance` immediately above -- this inner
        // plan's own segments are what actually reaches
        // `lower_nonblocking_assignment`/`resolve_lvalue`'s `RootMode::
        // Signal` branch, so losing this to the struct-literal default
        // would silently un-redirect a specify-path variable destination
        // written from inside a fork branch.
        specify_dest_redirect: plan.specify_dest_redirect.clone(),
        hosted_assertion: plan.hosted_assertion,
        inferred_disable: plan.inferred_disable.clone(),
        nested_assertions: plan.nested_assertions.clone(),
        disable_keys: plan.disable_keys.clone(),
        fork_branch_names: plan.fork_branch_names.clone(),
        disable_broadcast: plan.disable_broadcast.clone(),
        write_back_at_end: plan.write_back_at_end,
        disable_scope_keys: plan.disable_scope_keys.clone(),
        assertion_calls: plan.assertion_calls.clone(),
    };
    let inner_fn = lower_process_cfg_with_repr(ctx, module, fns, &inner_plan, value_repr)?;

    let tick = crate::timescale::tick_exp(ctx, module, &plan.fn_sym);
    let mut suspend_cases: Vec<(u32, [u8; 36])> = Vec::new();
    for seg in &plan.segments {
        let signals = seg_signals(&plan.signals, seg)?;
        // An event control through a virtual interface: one wait per
        // candidate instance, keyed by its id (`crate::vif::suspend_key`);
        // `null` waits on nothing.
        if let SegTerminator::Suspend { point, resume, .. } = &seg.terminator
            && let Some((signal, edge)) = vif_event(point)
        {
            let edge = &edge;
            if let Some(terms) = vif_event_list(point) {
                // A term's `iff` (LRM 9.4.2.3) is checked by the resume guard
                // from the matched-term mask; the per-candidate wait lists keep
                // the terms in order, so bit k is term k whatever instance fired.
                let Some(fc) = fork_ctx.as_deref_mut() else {
                    return Err(LoweringError::unsupported_at(
                        "an event control list through a virtual interface outside a process \
                         kernel",
                        &plan.fn_sym,
                    ));
                };
                let is_vif = |t: &Expression<'d>| vif_term_member(t).is_some();
                let cands: Vec<Vec<Symbol<'d>>> = terms
                    .iter()
                    .map(|(t, _)| {
                        if let Some(member) = vif_term_member(t) {
                            vif_candidates(&member)
                        } else {
                            Vec::new()
                        }
                    })
                    .collect();
                // The distinct variables, in order of first appearance, each
                // with its candidate count (every term through one variable
                // reaches the same instances); `var_of[ti]` is a vif term's
                // variable index. The tuple of held instances is one key
                // code (`vif::suspend_key_multi`): 1 + sum(k_j * stride_j).
                let mut var_syms: Vec<String> = Vec::new();
                let mut var_n: Vec<usize> = Vec::new();
                let mut var_of: Vec<usize> = vec![0; terms.len()];
                for (ti, (t, _)) in terms.iter().enumerate() {
                    let Some(base) = vif_term_member(t).and_then(|m| crate::vif::event_base(&m))
                    else {
                        continue;
                    };
                    let sym = vif_var_key(&base).ok_or_else(|| {
                        LoweringError::unsupported_at(
                            "a virtual interface expression with no source text",
                            &plan.fn_sym,
                        )
                    })?;
                    let j = match var_syms.iter().position(|s| *s == sym) {
                        Some(j) => j,
                        None => {
                            var_syms.push(sym);
                            var_n.push(cands[ti].len());
                            var_syms.len() - 1
                        }
                    };
                    if var_n[j] != cands[ti].len() {
                        return Err(LoweringError::unsupported_at(
                            "an event control list through a virtual interface whose terms differ \
                             in the instances they reach",
                            &plan.fn_sym,
                        ));
                    }
                    var_of[ti] = j;
                }
                let total = var_n.iter().try_fold(1usize, |a, &n| a.checked_mul(n));
                // The code sits above `KEY_SHIFT` in a u32 key.
                if total.is_none_or(|t| t >= 1 << (32 - crate::vif::KEY_SHIFT)) {
                    return Err(LoweringError::unsupported_at(
                        "an event control list through virtual interface variables whose \
                         candidate instances multiply past 4095 combinations",
                        &plan.fn_sym,
                    ));
                }
                let total = total.unwrap_or(0);
                // Key 0 (`null` / past the last id) waits on nothing.
                let mut keyed: Vec<(u32, Vec<WaitTableEntry>)> = vec![(resume.0, Vec::new())];
                for code in 0..total {
                    // The candidate index of each variable for this code.
                    let mut ks = Vec::with_capacity(var_n.len());
                    let mut rest = code;
                    for &n in &var_n {
                        ks.push(rest % n);
                        rest /= n;
                    }
                    let mut entries = Vec::new();
                    let mut extra = Vec::new();
                    for (ti, (term, term_edge)) in terms.iter().enumerate() {
                        if !is_vif(term) {
                            // A plain term waits the same way under every
                            // candidate: resolve it as a one-term list.
                            let mut scratch = Vec::new();
                            let one =
                                SuspendPoint::EdgeList(vec![(*term, *term_edge)], vec![Vec::new()]);
                            resolve_suspend_point_tabled(
                                &one,
                                &signals,
                                &plan.fn_sym,
                                &mut scratch,
                                tick,
                            )?;
                            if scratch.is_empty() {
                                return Err(LoweringError::unsupported_at(
                                    "an event term that waits on nothing in a list that also \
                                     waits through a virtual interface",
                                    &plan.fn_sym,
                                ));
                            }
                            // An expression term holds its first dependency in
                            // its own position; the rest follow all the terms
                            // (as in `resolve_suspend_point_tabled`), so bit k
                            // of the matched mask stays term k.
                            entries.push(scratch.remove(0));
                            extra.append(&mut scratch);
                            continue;
                        }
                        let cand = &cands[ti][ks[var_of[ti]]];
                        let info = signals.get(&cand.uid()).ok_or_else(|| {
                            LoweringError::unsupported_at(
                                "a virtual interface member this process cannot reach",
                                cand,
                            )
                        })?;
                        let e = match term_edge {
                            sv_lang::EdgeKind::None => None,
                            sv_lang::EdgeKind::BothEdges => Some(StateEdgeKind::BothEdges),
                            e @ (sv_lang::EdgeKind::PosEdge | sv_lang::EdgeKind::NegEdge) => {
                                Some(to_state_edge_kind(*e, &plan.fn_sym)?)
                            }
                        };
                        entries.push(WaitTableEntry::whole(info.slot, e));
                    }
                    entries.append(&mut extra);
                    keyed.push((
                        resume.0 + ((code as u32 + 1) << crate::vif::KEY_SHIFT),
                        entries,
                    ));
                }
                for (key, entries) in keyed {
                    let base = fc.wait_table.len() as u32;
                    let count = entries.len() as u32;
                    fc.wait_table.extend(entries);
                    let er =
                        build_eval_result(ResolvedSuspend::EventList { base, count }, resume.0);
                    // SAFETY: as for the ordinary suspend case below.
                    let bytes: [u8; 36] = unsafe { core::mem::transmute(er) };
                    suspend_cases.push((key, bytes));
                }
                continue;
            }
            // `v.sb.c <= ##N v` (LRM 25.9.1): one wait per candidate instance,
            // counting the events of that instance's clocking block.
            if let SuspendPoint::CycleDelay { count, .. } = point {
                let mut keyed = vec![(resume.0, None)];
                for (k, cand) in vif_candidates(&signal).iter().enumerate() {
                    let cb = cand
                        .parent()
                        .filter(|p| p.kind() == sv_lang::kinds::SymbolKind::ClockingBlock)
                        .ok_or_else(|| {
                            LoweringError::unsupported_at(
                                "a cycle delay through a virtual interface member that is not a \
                                 clock variable",
                                cand,
                            )
                        })?;
                    let info = signals.get(&cb.uid()).ok_or_else(|| {
                        LoweringError::unsupported_at(
                            "a virtual interface clocking block this process cannot reach",
                            &cb,
                        )
                    })?;
                    keyed.push((
                        resume.0 + ((k as u32 + 1) << crate::vif::KEY_SHIFT),
                        Some(info.slot),
                    ));
                }
                for (key, slot) in keyed {
                    let resolved = match slot {
                        Some(slot) => ResolvedSuspend::RepeatEdge {
                            count: u64::from(*count),
                            cell: StateCellId(u64::from(slot)),
                            edge: StateEdgeKind::BothEdges,
                        },
                        // `null` waits on nothing (the drive is suppressed).
                        None => ResolvedSuspend::Delay(NEVER_TICKS),
                    };
                    let er = build_eval_result(resolved, resume.0);
                    // SAFETY: as for the ordinary suspend case below.
                    let bytes: [u8; 36] = unsafe { core::mem::transmute(er) };
                    suspend_cases.push((key, bytes));
                }
                continue;
            }
            let mut keyed = vec![(resume.0, None)];
            for (k, cand) in vif_candidates(&signal).iter().enumerate() {
                let info = signals.get(&cand.uid()).ok_or_else(|| {
                    LoweringError::unsupported_at(
                        "a virtual interface member this process cannot reach",
                        cand,
                    )
                })?;
                keyed.push((
                    resume.0 + ((k as u32 + 1) << crate::vif::KEY_SHIFT),
                    Some(info.slot),
                ));
            }
            for (key, slot) in keyed {
                let resolved = match (slot, fork_ctx.as_deref_mut()) {
                    (Some(slot), _) if *edge != sv_lang::EdgeKind::None => ResolvedSuspend::Edge {
                        cell: StateCellId(u64::from(slot)),
                        edge: to_state_edge_kind(*edge, &plan.fn_sym)?,
                    },
                    (slot, Some(fc)) => {
                        let base = fc.wait_table.len() as u32;
                        fc.wait_table
                            .extend(slot.map(|slot| WaitTableEntry::whole(slot, None)));
                        ResolvedSuspend::EventList {
                            base,
                            count: u32::from(slot.is_some()),
                        }
                    }
                    (_, None) => {
                        return Err(LoweringError::unsupported_at(
                            "an any-change event control through a virtual interface outside \
                             a process kernel",
                            &plan.fn_sym,
                        ));
                    }
                };
                let er = build_eval_result(resolved, resume.0);
                // SAFETY: as for the ordinary suspend case below.
                let bytes: [u8; 36] = unsafe { core::mem::transmute(er) };
                suspend_cases.push((key, bytes));
            }
            continue;
        }
        if let SegTerminator::Suspend { point, resume, .. } = &seg.terminator {
            let resolved = match fork_ctx.as_deref_mut() {
                Some(fc) => resolve_suspend_point_tabled(
                    point,
                    &signals,
                    &plan.fn_sym,
                    fc.wait_table,
                    tick,
                )?,
                None => resolve_suspend_point(point, &signals, &plan.fn_sym, tick)?,
            };
            let mut er = build_eval_result(resolved, resume.0);
            // `wait(expr)` re-checks its condition on every wake, so a wake
            // parked during `process::suspend` may be replayed (an `@(...)`
            // waiter is desensitised instead -- LRM 9.7.4).
            if matches!(point, SuspendPoint::Level(_)) {
                er = mark_rechecks_on_wake(er);
            }
            // SAFETY: `EvalResult` is `#[repr(C)]`/`Copy`, statically sized to
            // exactly `4 + RESCHEDULE_REQ_SIZE == 36` bytes with no
            // unaccounted padding (its own `const _: () = assert!(...)`), and
            // `build_eval_result` initializes every byte of it -- this
            // transmute reads a fully-initialized, non-poison bit pattern.
            let bytes: [u8; 36] = unsafe { core::mem::transmute(er) };
            suspend_cases.push((resume.0, bytes));
        }
        // R-run Task 17 (PR-047/PR-061/PR-085): the fork-table-building
        // half of a fork/join site -- `lower_switch_path` (already run, via
        // `lower_process_cfg_with_repr` above) already validated `kind ==
        // JoinAll` and emitted the raw `write_live_out_and_return(...,
        // join_blk.0)` return; this loop's job is building the constant
        // `EvalResult` THAT raw value maps to, exactly like every
        // `SegTerminator::Suspend` arm above -- plus, uniquely for
        // `ForkJoin`, actually compiling each branch into its own real
        // kernel first (a `Suspend` site's `point` is already fully
        // resolved data; a `ForkJoin` site's branches are NOT YET compiled
        // kernels at all until this exact loop iteration compiles them).
        if let SegTerminator::ForkJoin {
            kind,
            branches,
            join_blk,
            ..
        } = &seg.terminator
        {
            let join_kind = match kind {
                StatementBlockKind::JoinAll => JoinKind::All,
                StatementBlockKind::JoinAny => JoinKind::Any,
                StatementBlockKind::JoinNone => JoinKind::None,
                StatementBlockKind::Sequential => {
                    return Err(LoweringError::unsupported_at(
                        "internal error: a SegTerminator::ForkJoin carries a Sequential block \
                         kind (process::cfg only builds ForkJoin for fork blocks)",
                        &plan.fn_sym,
                    ));
                }
            };
            let fc = fork_ctx.as_deref_mut().ok_or_else(|| {
                LoweringError::unsupported_at(
                    "a fork/join site reached codegen but no fork-compilation context was \
                     installed -- a process whose CFG contains fork/join must be compiled via \
                     lower_kernel_fn_with_fork_support, never the plain lower_kernel_fn(_with_\
                     repr) (internal invariant, R-run Task 17)",
                    &plan.fn_sym,
                )
            })?;
            let mut spawns: Vec<SpawnSpec> = Vec::with_capacity(branches.len());
            for (bi, branch) in branches.iter().enumerate() {
                // A recursive call inside its own activation (LRM 1800-2023
                // 13.4): no kernel of its own, it spawns the enclosing
                // activation's again (patched in once that kernel exists).
                // `AncestorSpawn(up)` (mutual recursion) spawns the activation
                // `up` levels out instead.
                let spawn_up = match branch.recursion {
                    vj_sim::process::cfg::Recursion::SelfSpawn => Some(0usize),
                    vj_sim::process::cfg::Recursion::AncestorSpawn(up) => Some(up as usize),
                    _ => None,
                };
                if let Some(up) = spawn_up {
                    let depth = fc.recursion.len();
                    let top = depth
                        .checked_sub(up + 1)
                        .and_then(|i| fc.recursion.get_mut(i))
                        .ok_or_else(|| {
                            LoweringError::unsupported_at(
                                "a recursive task call outside its activation (internal invariant)",
                                &plan.fn_sym,
                            )
                        })?;
                    let copies = inherited_captures(
                        &plan.frame,
                        &top.frame,
                        &branch.inherited,
                        &plan.fn_sym,
                    )?;
                    top.pending.push((fc.fork_table.len() + bi, copies));
                    spawns.push(SpawnSpec {
                        kernel: 0,
                        entry_pc: top.entry_pc,
                        parent: 0,
                        disable_name: Vec::new(),
                    });
                    continue;
                }
                // LRM 9.3.2: a fork branch can reference its parent's own
                // enclosing-scope variables. This task's own scope only
                // resolves references to MODULE-level signals (`plan.
                // signals`, reused unchanged for every branch below) -- a
                // branch referencing the PARENT PROCESS's own declared
                // local (not a module-level signal) is not resolved by
                // this task; whatever "unresolved symbol" error the normal
                // expression-lowering path already produces for an
                // unmapped `NamedValue` fires naturally, never silently
                // wrong (see this task's own deviations for the precise
                // accounting of this known limitation).
                let is_root = branch.recursion == vj_sim::process::cfg::Recursion::Root;
                // A branch the CFG builder shares (`ProcessCfg::share_id`) is
                // compiled once per process; later spawns point at that code.
                // A non-Root branch is not shared inside a recursive
                // activation (its spawn rows are patched per activation); a
                // Root is keyed on its enclosing activations' ids.
                let shared_id = branch
                    .share_id
                    .filter(|_| is_root || fc.recursion.is_empty());
                // False when a shared Root is reused: its activation frame
                // was pushed, and its re-spawn rows patched, by the compile
                // that built it.
                let mut fresh = false;
                let (branch_fn, branch_frame_words, branch_frame_layout) =
                    if let Some(hit) = shared_id.and_then(|id| fc.shared.get(&id).cloned()) {
                        hit
                    } else {
                        fresh = true;
                        let branch_frame = compute_liveness(branch).map_err(|e| {
                            LoweringError::unsupported_at(&e.to_string(), &plan.fn_sym)
                        })?;
                        let branch_frame_words = branch_frame.total_words();
                        let branch_segments = lower_to_segments(branch, &branch_frame);
                        let mut branch_plan = build_lowering_plan(
                            format!("{}__fork{}_{bi}", plan.fn_name, join_blk.0),
                            plan.fn_sym,
                            branch_segments,
                            branch_frame,
                            plan.signals.clone(),
                        );
                        // A branch is part of the process that forked it: an assertion
                        // statement it reaches queues (or blocks on) the hosting plan
                        // the parent's does (16.14.6, 16.17), and `disable` of an
                        // assertion label / outermost block clears the same queues.
                        branch_plan.nested_assertions = plan.nested_assertions.clone();
                        branch_plan.disable_keys = plan.disable_keys.clone();
                        branch_plan.disable_scope_keys = plan.disable_scope_keys.clone();
                        branch_plan.inferred_disable = plan.inferred_disable.clone();
                        // `vj_sim::process::cfg::ProcessCfg::fork_branch_names`
                        // (see `ProcessLoweringPlan::fork_branch_names`'s own doc
                        // comment): this branch's own CFG walk already resolved
                        // these against its siblings/ancestors, so its plan carries
                        // exactly that list, not the parent's.
                        branch_plan.fork_branch_names = branch.fork_branch_names.clone();
                        branch_plan.disable_broadcast = branch.disable_broadcast.clone();
                        // A recursive task's activation with `output`/`inout`
                        // formals hands them back from its frame, which the spawner
                        // copies as the activation ends (`RETURN_COPY`).
                        branch_plan.write_back_at_end = branch.inherited.iter().any(|i| {
                            matches!(i, vj_sim::process::cfg::InheritedSlot::Return { .. })
                        });
                        // Recursive: a fork branch can itself contain a NESTED
                        // fork/join (`Some(&mut *fc)` reborrows this same context,
                        // so a nested branch's own kernels/spawns append to the
                        // exact same whole-program accumulators, never a second,
                        // shadow table).
                        if is_root {
                            fc.recursion.push(RecursionFrame {
                                entry_pc: branch.entry.0,
                                frame_words: branch_frame_words,
                                frame: branch_plan.frame.clone(),
                                pending: Vec::new(),
                            });
                        }
                        let branch_fn = lower_kernel_fn_with_repr_impl(
                            ctx,
                            module,
                            fns,
                            &branch_plan,
                            value_repr,
                            Some(&mut *fc),
                        )?;
                        if let Some(id) = shared_id {
                            fc.shared.insert(
                                id,
                                (branch_fn, branch_frame_words, branch_plan.frame.clone()),
                            );
                        }
                        (branch_fn, branch_frame_words, branch_plan.frame.clone())
                    };
                let kernel_idx = fc.kernels.len() as u32;
                fc.kernels.push(branch_fn);
                if is_root && fresh {
                    // The same function again, under the capture list of a
                    // spawn from inside the activation.
                    let frame = fc.recursion.pop().ok_or_else(|| {
                        LoweringError::unsupported_at(
                            "recursion frame lost (internal invariant)",
                            &plan.fn_sym,
                        )
                    })?;
                    // One re-spawn kernel per distinct capture list.
                    let mut groups: Vec<(u32, Vec<(u32, u32)>)> = Vec::new();
                    for (row, copies) in frame.pending {
                        let again = match groups.iter().find(|(_, c)| *c == copies) {
                            Some((k, _)) => *k,
                            None => {
                                let again = fc.kernels.len() as u32;
                                fc.kernels.push(branch_fn);
                                crate::vpi_dyn::note_fork_branch(again, &branch.body);
                                fc.branch_frames.push((
                                    again,
                                    frame.frame_words,
                                    copies.clone(),
                                    Vec::new(),
                                ));
                                groups.push((again, copies));
                                again
                            }
                        };
                        fc.fork_table[row].kernel = again;
                    }
                }
                crate::vpi_dyn::note_fork_branch(kernel_idx, &branch.body);
                // The branch's shared variables: the parent's cell pointer
                // slot -> the branch's.
                let captures: Vec<(u32, u32)> = branch_frame_layout
                    .slots
                    .iter()
                    .filter(|s| s.captured)
                    .filter_map(|s| {
                        let FrameSlotSource::DeclaredVar(id) = &s.source else {
                            return None;
                        };
                        plan.frame
                            .slots
                            .iter()
                            .find(|p| {
                                p.cell && matches!(&p.source, FrameSlotSource::DeclaredVar(d) if d == id)
                            })
                            .map(|p| (p.offset, s.offset))
                    })
                    .collect();
                let mut captures = captures;
                // By-value copies (`ProcessCfg::inherited`): word for word.
                captures.extend(inherited_captures(
                    &plan.frame,
                    &branch_frame_layout,
                    &branch.inherited,
                    &plan.fn_sym,
                )?);
                let scopes = branch
                    .disable_scopes
                    .iter()
                    .flat_map(|(resume, label, exit)| match &plan.disable_scope_keys {
                        Some(keys) => keys.expand(resume.0, label, exit.0),
                        None => vec![(resume.0, label.clone(), exit.0)],
                    })
                    .collect();
                fc.branch_frames
                    .push((kernel_idx, branch_frame_words, captures, scopes));
                spawns.push(SpawnSpec {
                    kernel: kernel_idx,
                    entry_pc: branch.entry.0,
                    // R-run Task 17: `SpawnSpec::parent` is dead on the real
                    // scheduler path (verified directly: `ResumeDriver::
                    // handle_fork` uses its OWN `parent: ProcessId`
                    // argument to set every minted child's `fork_parent`,
                    // never `spec.parent` -- `grep`ped, zero real (non-test)
                    // read site of this field anywhere in the tree) -- `0`
                    // is a real, harmless placeholder, not a lie a real
                    // consumer could ever observe.
                    parent: 0,
                    // `vj_sim::process::cfg::ProcessCfg::disable_names`:
                    // the enclosing `fork : NAME`'s own name (shared by
                    // every branch) and/or this branch's own named
                    // outermost block -- `Engine`'s `Suspend::ForkJoin`
                    // handling tags this spawn's newly minted child with
                    // it (LRM 9.6.2).
                    disable_name: branch.disable_names.clone(),
                });
            }
            let base = fc.fork_table.len() as u32;
            let count = spawns.len() as u32;
            fc.fork_table.extend(spawns);
            let resolved = ResolvedSuspend::ForkJoin {
                join_kind,
                base,
                count,
            };
            let er = build_eval_result(resolved, join_blk.0);
            // SAFETY: see the identical justification on the `Suspend` arm
            // just above -- same type, same invariant.
            let bytes: [u8; 36] = unsafe { core::mem::transmute(er) };
            suspend_cases.push((join_blk.0, bytes));
        }
    }
    let done_er = build_eval_result(ResolvedSuspend::Done, 0);
    // SAFETY: see the identical justification above.
    let done_bytes: [u8; 36] = unsafe { core::mem::transmute(done_er) };

    let ptr_ty = ctx.ptr_type(AddressSpace::default());
    let i32_ty = ctx.i32_type();
    let void_ty = ctx.void_type();
    let i8_ty = ctx.i8_type();
    let eval_result_ty = ctx.struct_type(&[i32_ty.into(), i8_ty.array_type(32).into()], false);
    let fn_ty = void_ty.fn_type(
        &[ptr_ty.into(), ptr_ty.into(), ptr_ty.into(), i32_ty.into()],
        false,
    );
    let wrapper = module.add_function(&plan.fn_name, fn_ty, None);
    let sret_kind_id = Attribute::get_named_enum_kind_id("sret");
    wrapper.add_attribute(
        AttributeLoc::Param(0),
        ctx.create_type_attribute(sret_kind_id, eval_result_ty.as_any_type_enum()),
    );
    wrapper.get_nth_param(0).unwrap().set_name("sret");
    wrapper.get_nth_param(1).unwrap().set_name("handle");
    wrapper.get_nth_param(2).unwrap().set_name("local");
    wrapper.get_nth_param(3).unwrap().set_name("resume_pc");

    let entry_bb = ctx.append_basic_block(wrapper, "entry");
    let b = ctx.create_builder();
    b.position_at_end(entry_bb);
    let sret = wrapper.get_nth_param(0).unwrap().into_pointer_value();
    let handle = wrapper.get_nth_param(1).unwrap().into_pointer_value();
    let local = wrapper.get_nth_param(2).unwrap().into_pointer_value();
    let resume_pc = wrapper.get_nth_param(3).unwrap().into_int_value();

    let raw = b
        .build_call(
            inner_fn,
            &[handle.into(), local.into(), resume_pc.into()],
            "inner_call",
        )
        .unwrap()
        .try_as_basic_value()
        .unwrap_basic()
        .into_int_value();

    let finished_bb = ctx.append_basic_block(wrapper, "finished");
    let case_blocks: Vec<LlvmBasicBlock<'ctx>> = suspend_cases
        .iter()
        .enumerate()
        .map(|(i, _)| ctx.append_basic_block(wrapper, &format!("susp_case_{i}")))
        .collect();
    let trap_bb = ctx.append_basic_block(wrapper, "kernel_abi_trap");

    let mut switch_cases: Vec<(IntValue<'ctx>, LlvmBasicBlock<'ctx>)> = vec![(
        i32_ty.const_int(SEG_FINISHED as u32 as u64, false),
        finished_bb,
    )];
    for (i, (raw_val, _)) in suspend_cases.iter().enumerate() {
        switch_cases.push((i32_ty.const_int(u64::from(*raw_val), false), case_blocks[i]));
    }
    b.build_switch(raw, trap_bb, &switch_cases).unwrap();

    b.position_at_end(finished_bb);
    store_eval_result_bytes_and_return(ctx, &b, sret, &done_bytes);

    for (i, (_, bytes)) in suspend_cases.iter().enumerate() {
        b.position_at_end(case_blocks[i]);
        store_eval_result_bytes_and_return(ctx, &b, sret, bytes);
    }

    b.position_at_end(trap_bb);
    b.build_unreachable().unwrap();

    if wrapper.verify(true) {
        Ok(wrapper)
    } else {
        Err(LoweringError {
            message: "process ABI wrapper function failed LLVM verify".into(),
            at: plan.fn_sym.hierarchical_path(),
        })
    }
}

/// R-run Task 2 (NL-034, `docs/superpowers/plans/2026-09-27-run-wiring.md`):
/// the external-signal reference set for one continuous assign's whole
/// `assign_expr` (its LHS target AND its RHS) -- mirrors
/// [`external_refs_in_segment`]'s identical `record` walk exactly, over the
/// one `Expression`'s own `SemNode` subtree instead of a `Segment::body`/
/// terminator. Duplicated rather than shared: there is no `Segment` (or even
/// a `Statement`) to hand `external_refs_in_segment` here at all --
/// `module::DiscoveredContAssign`'s own doc comment records that
/// `Symbol::body()` is `None` for a `ContinuousAssign` symbol, confirmed
/// directly against real `sv-lang`=0.1.9 output.
fn external_refs_in_expr<'d>(
    assign_expr: Expression<'d>,
    signals: &HashMap<SymbolId, SignalSlot>,
) -> (Vec<Symbol<'d>>, HashSet<SymbolId>) {
    let mut order = Vec::new();
    let mut seen = HashSet::new();
    let mut written = HashSet::new();
    // R-run Task 13: mirrors `external_refs_in_segment`'s own identical
    // `SignalSlotClass::Memory` exclusion -- see that function's doc comment.
    let is_memory_signal = |id: &SymbolId| {
        matches!(
            signals.get(id).map(|s| s.class),
            Some(SignalSlotClass::Memory { .. })
        )
    };
    let mut stack = vec![assign_expr.as_sem_node()];
    while let Some(n) = stack.pop() {
        if let Some(e) = n.as_expression() {
            if vj_sim::symid::is_value_name(e.kind())
                && let Some(sym) = e.referenced_symbol()
                && signals.contains_key(&sym.uid())
                && !is_memory_signal(&sym.uid())
                && seen.insert(sym.uid())
            {
                order.push(sym);
            }
            for sym in vif_candidates(&e) {
                if signals.contains_key(&sym.uid())
                    && !is_memory_signal(&sym.uid())
                    && seen.insert(sym.uid())
                {
                    order.push(sym);
                }
            }
            // Mirrors `external_refs_in_segment`'s own nonblocking exclusion
            // comment -- moot here in practice (`module::discover_cont_assigns`
            // already rejects a nonblocking top-level assign before this
            // function ever runs, and `<=` is not legal SystemVerilog inside
            // a continuous assign to begin with), kept for exact structural
            // parity with the one function this mirrors.
            if e.kind() == ExpressionKind::Assignment
                && e.is_nonblocking() != Some(true)
                && let Some(lhs) = e.left()
            {
                for sym in crate::select::lvalue_root_symbols(lhs) {
                    if signals.contains_key(&sym.uid()) && !is_memory_signal(&sym.uid()) {
                        written.insert(sym.uid());
                    }
                }
            }
            // Same as `external_refs_in_segment`: a called subroutine's
            // module signals go through this kernel's shadow copies.
            for callee in crate::func::user_callees(&e) {
                let abi = crate::func::dispatch_abi(&callee);
                for sig in abi.signals {
                    let id = sig.uid();
                    if !signals.contains_key(&id) || is_memory_signal(&id) {
                        continue;
                    }
                    if abi.written.contains(&id) {
                        written.insert(id.clone());
                    }
                    if seen.insert(id) {
                        order.push(sig);
                    }
                }
            }
        }
        stack.extend(n.children());
    }
    (order, written)
}

/// R-run Task 2 (NL-034): lowers a continuous assign's `assign_expr`
/// (`module::DiscoveredContAssign::assign_expr`, an `assign y = a + 1;`-
/// shaped `Assignment` expression) directly into the frozen
/// `vj_abi::ProcessFn` ABI -- the exact same `void(sret, handle, local,
/// resume_pc)` wrapper shape [`lower_kernel_fn_with_repr`] emits -- WITHOUT
/// going through `process::cfg::build_cfg`/`Segment`/[`lower_kernel_fn`] at
/// all: a `ContinuousAssign` symbol has no `Statement` a `Segment::body`
/// could ever hold (see `module::DiscoveredContAssign`'s own doc comment),
/// so the CFG/Segment machinery -- built for general statement sequences
/// with suspend points -- has nothing to contribute to a continuous assign's
/// body, which is, by LRM construction, always exactly one blocking
/// assignment expression that can never suspend and never declares a
/// frame-local of its own.
///
/// Reuses the exact same blocking-assignment evaluator every other kernel's
/// `ExpressionStatement`/`Assignment` arm calls
/// ([`lower_segment_statement`]'s own `else => lower_expr(cx, e)` branch --
/// never a second, independently-written evaluator, per this crate's "one
/// lowering path" posture, CG-095/CG-096), and the same external-signal
/// priming/flush discipline [`prime_external_signals`]/
/// [`flush_external_signals`] apply to a `Segment` (here driven by
/// [`external_refs_in_expr`] instead, since there is no `Segment` to hand
/// those two functions).
///
/// The returned function always signals `Suspend::Done`/`EvalResult`'s
/// "finished" encoding on every call, regardless of `resume_pc` (which it
/// never reads at all) -- a continuous assign is a one-shot kernel,
/// re-triggered externally by its own static sensitivity, exactly the way
/// `vj::run::run_design` already registers an `always_comb` kernel
/// (`ProcessKind::AlwaysComb`, static sensitivity = the RHS's read-set, per
/// this task's own plan text) -- never an internally-looping process. Region
/// bias is the v1 single-partition default (`region_id == 0`, matching
/// `ProcessLoweringPlan::region_id`'s own default), so no bias is added to
/// any accessor call here, matching every other real v1 process today.
/// Whether `e` names (reads) any symbol keyed in `set`.
fn names_any(e: Expression<'_>, set: &HashMap<SymbolId, SignalSlot>) -> bool {
    let mut stack = vec![e.as_sem_node()];
    while let Some(n) = stack.pop() {
        if let Some(x) = n.as_expression()
            && vj_sim::symid::is_value_name(x.kind())
            && x.referenced_symbol()
                .is_some_and(|s| set.contains_key(&s.uid()))
        {
            return true;
        }
        stack.extend(n.children());
    }
    false
}

pub fn lower_cont_assign_kernel_fn<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    spec: &crate::pipeline::ContAssignLoweringSpec<'d>,
) -> Result<FunctionValue<'ctx>, LoweringError> {
    let fn_name = spec.fn_name.clone();
    let fn_sym = spec.fn_sym;
    let assign_expr = spec.assign_expr;
    let net_target = spec.net_target;
    let signals = &spec.signals;
    // LRM 10.3 / 6.5: a driver of PART of a resolved net that also reads the
    // net (`assign y[1] = y[0];`) reads the net's RESOLVED value, but writes
    // only its own contribution cell, which `signals` names. Evaluate the
    // right-hand side against `read_view`, then switch to `signals` to store.
    let two_phase = spec.force_site.is_none()
        && spec.port_source.is_none()
        && net_target.is_none()
        && !spec.read_signals.is_empty()
        && assign_expr.is_compound_assignment() != Some(true)
        && assign_expr.left().is_some_and(|l| {
            matches!(
                l.kind(),
                ExpressionKind::ElementSelect | ExpressionKind::RangeSelect
            )
        })
        && assign_expr
            .right()
            .is_some_and(|r| names_any(r, &spec.read_signals))
        && !spec
            .read_signals
            .values()
            .any(|i| crate::huge::is_huge_width(i.width));
    // A WHOLE-net driver that reads its own net (`assign (pull0, pull1) q =
    // q;`, a keeper, LRM 10.3 / 28.12) likewise reads the net's RESOLVED value,
    // not its own last contribution; the whole store overwrites the shadow, so
    // flushing it to the contribution cell is exact.
    let whole_self_read = !two_phase
        && spec.force_site.is_none()
        && spec.port_source.is_none()
        && net_target.is_none()
        && !spec.read_signals.is_empty()
        && assign_expr.is_compound_assignment() != Some(true)
        && assign_expr
            .left()
            .is_some_and(|l| vj_sim::symid::is_value_name(l.kind()))
        && assign_expr
            .right()
            .is_some_and(|r| names_any(r, &spec.read_signals))
        && !spec
            .read_signals
            .values()
            .any(|i| crate::huge::is_huge_width(i.width));
    let read_view: HashMap<SymbolId, SignalSlot> = if two_phase || whole_self_read {
        let mut v = signals.clone();
        v.extend(spec.read_signals.iter().map(|(k, i)| (k.clone(), *i)));
        v
    } else {
        HashMap::new()
    };
    let view = if two_phase || whole_self_read {
        &read_view
    } else {
        signals
    };
    let ptr_ty = ctx.ptr_type(AddressSpace::default());
    let i32_ty = ctx.i32_type();
    let void_ty = ctx.void_type();
    let i8_ty = ctx.i8_type();
    let eval_result_ty = ctx.struct_type(&[i32_ty.into(), i8_ty.array_type(32).into()], false);
    let fn_ty = void_ty.fn_type(
        &[ptr_ty.into(), ptr_ty.into(), ptr_ty.into(), i32_ty.into()],
        false,
    );
    let f = module.add_function(&fn_name, fn_ty, None);
    let sret_kind_id = Attribute::get_named_enum_kind_id("sret");
    f.add_attribute(
        AttributeLoc::Param(0),
        ctx.create_type_attribute(sret_kind_id, eval_result_ty.as_any_type_enum()),
    );
    f.get_nth_param(0).unwrap().set_name("sret");
    f.get_nth_param(1).unwrap().set_name("handle");
    f.get_nth_param(2).unwrap().set_name("local");
    f.get_nth_param(3).unwrap().set_name("resume_pc");

    let entry_bb = ctx.append_basic_block(f, "entry");
    let b = ctx.create_builder();
    b.position_at_end(entry_bb);
    let sret = f.get_nth_param(0).unwrap().into_pointer_value();
    let handle = f.get_nth_param(1).unwrap().into_pointer_value();
    // Params 2 (`local`) and 3 (`resume_pc`) are deliberately never read --
    // see this function's own doc comment: no frame, no suspend, no
    // resume-point dispatch for a continuous assign's kernel.

    let mut cx = LowerCtx {
        ctx,
        b,
        repr: ValueRepr::FourState,
        locals: HashMap::new(),
        fn_sym,
        module,
        mem_signals: mem_signals_of(view),
        mem_accessor: Some(MemAccessorCtx { handle, fns }),
        lvalue_ref: Default::default(),
        deferred_start: Default::default(),
        unbounded: Default::default(),
        coll_temp: Default::default(),
        iter: Default::default(),
        loop_exits: Default::default(),
        block_exits: Default::default(),
        write_through: None,
        cells: Default::default(),
        copy_out: Default::default(),
        ctor_this: Default::default(),
        decl_scale: Default::default(),
        inline_this: Default::default(),
        end_flags: Default::default(),
        // Task 4b: a continuous-assign kernel's own net-destination
        // redirect (Task 4a) already happens one level up, by substituting
        // the net's entry in `signals` itself (`ContAssignLoweringSpec::
        // signals`, built by `vj::run::run_design`) -- this field
        // is this task's OWN, separate mechanism for a PROCEDURAL
        // (variable) destination, which a continuous assign can never be
        // (LRM 30.4.1).
        specify_dest: Default::default(),
        elem_refs: Default::default(),
    };

    // A `force` statement's continuous driver (`crate::force`): only its
    // right-hand side's signals are read, and nothing is written directly.
    let force_rhs = spec.force_site.and(assign_expr.right());
    let (mut refs, mut written) = external_refs_in_expr(force_rhs.unwrap_or(assign_expr), signals);
    if force_rhs.is_some() {
        written.clear();
    }
    // A net declaration assignment writes its net (not referenced by the
    // RHS-only `assign_expr`, so it is added to both sets here).
    // A class's static property (`var_init` kernel of its class's time-zero
    // initialization, LRM 6.21 / 8.9) lives in the class's singleton object,
    // not in a signal slot.
    let class_static_init = spec.var_init
        && net_target.is_some_and(|n| {
            n.kind() == sv_lang::kinds::SymbolKind::ClassProperty
                && n.variable_lifetime() == sv_lang::VariableLifetime::Static
        });
    // The kernel evaluates EVERY dynamic static initializer of the class, not
    // just `assign_expr`'s (UVM's `uvm_register_cb` adds a second one): their
    // signals are primed and flushed too.
    if class_static_init
        && let Some(class_sym) = net_target.and_then(|n| n.parent())
        && let Ok(members) = vj_sim::netlist::classify_members(class_sym)
    {
        for init in members
            .statics
            .iter()
            .filter_map(|s| s.initializer())
            .filter(|e| e.constant_value().is_none())
        {
            let (r, w) = external_refs_in_expr(init, signals);
            for sym in r {
                if !refs.iter().any(|s| s.uid() == sym.uid()) {
                    refs.push(sym);
                }
            }
            written.extend(w);
        }
    }
    if let Some(net) = net_target
        && !class_static_init
    {
        if !signals.contains_key(&net.uid()) {
            return Err(LoweringError::unsupported_at(
                "net declaration assignment to a net with no signal slot",
                &net,
            ));
        }
        // An unpacked-array net (`wire [3:0] a[0:1] = '{1, 2};`, LRM 10.3.1)
        // is a module memory: it has no scalar shadow to flush, its rows are
        // written through the accessor in the `Some(net)` arm below.
        if !matches!(signals[&net.uid()].class, SignalSlotClass::Memory { .. }) {
            if !refs.iter().any(|s| s.uid() == net.uid()) {
                refs.push(net);
            }
            written.insert(net.uid());
        }
    }
    if let Some(src) = spec.port_source {
        if !signals.contains_key(&src.uid()) {
            return Err(LoweringError::unsupported_at(
                "output port connection whose port has no signal slot in the parent",
                &src,
            ));
        }
        if !refs.iter().any(|s| s.uid() == src.uid()) {
            refs.push(src);
        }
    }
    let mut inline_reads = crate::accessor::InlineReads::new(
        refs.iter()
            .filter(|sym| {
                let info = view[&sym.uid()];
                info.class == SignalSlotClass::Inline && !crate::huge::is_huge_width(info.width)
            })
            .count(),
    );
    for sym in refs {
        let info = view[&sym.uid()];
        if crate::huge::is_huge_width(info.width) {
            // The runtime's long-lived image of the signal, current, with no
            // copy (`O(changed words)`, not `O(width)`). A written signal is
            // stored into this image too and committed through its dirty
            // window below, instead of a private copy flushed whole.
            let ptr = crate::huge::rt_prime(&cx, handle, info.slot, info.width, false);
            cx.locals.insert(sym.uid(), (ptr, info.width, info.signed));
            continue;
        }
        // R-run Task 13: `external_refs_in_expr` already excludes
        // `SignalSlotClass::Memory` (see that function's own doc comment),
        // so only `Inline`/`Wide` ever reach this loop.
        let raw = match info.class {
            SignalSlotClass::Inline => inline_reads.get(&cx, fns, handle, info.slot, info.width),
            SignalSlotClass::Wide => build_get_wide(&cx, fns, handle, info.slot, info.width),
            SignalSlotClass::Memory { .. } => {
                unreachable!("external_refs_in_expr excludes SignalSlotClass::Memory symbols")
            }
        };
        let packed_ty = int_type(cx.ctx, info.width * 2);
        let ptr = crate::types::entry_alloca_in(&cx.b, packed_ty, "ext_shadow");
        cx.b.build_store(ptr, raw).unwrap();
        cx.locals.insert(sym.uid(), (ptr, info.width, info.signed));
    }
    // The pattern variables (`x matches tagged V .n ? n : 0`, LRM 12.6.2) of
    // the right-hand side: declared by no block, so each gets its own cell.
    for v in vj_sim::patterns::pattern_vars(assign_expr.as_sem_node()) {
        let ty = v
            .value_type()
            .ok_or_else(|| LoweringError::unsupported_at("a pattern variable with no type", &v))?;
        let width = ty.value_width();
        let ptr = crate::types::entry_alloca_in(&cx.b, int_type(cx.ctx, width * 2), "pat_var");
        cx.b.build_store(ptr, int_type(cx.ctx, width * 2).const_zero())
            .unwrap();
        cx.locals.insert(v.uid(), (ptr, width, ty.is_signed()));
    }

    match net_target {
        None if let Some(site) = spec.force_site => {
            // Re-force the target, only while this `force` is in effect.
            let lhs = assign_expr
                .left()
                .ok_or_else(|| LoweringError::unsupported_at("a force with no target", &fn_sym))?;
            let row_target = crate::force::row_target(&cx, lhs)?;
            // An unpacked-array element is re-forced through
            // `emit_force_row`; anything else through `emit_force`.
            let plain = if row_target.is_none() {
                Some(crate::force::target(&cx, lhs, signals)?)
            } else {
                None
            };
            let width = row_target
                .as_ref()
                .map_or_else(|| plain.as_ref().map_or(0, |p| p.2), |rt| rt.width);
            let active_fn = module
                .get_function(crate::force::SV_RT_FORCE_ACTIVE_SYMBOL)
                .unwrap_or_else(|| {
                    module.add_function(
                        crate::force::SV_RT_FORCE_ACTIVE_SYMBOL,
                        i32_ty.fn_type(&[ptr_ty.into(), ctx.i64_type().into()], false),
                        Some(Linkage::External),
                    )
                });
            let active =
                cx.b.build_call(
                    active_fn,
                    &[handle.into(), ctx.i64_type().const_int(site, false).into()],
                    "force_active",
                )
                .unwrap()
                .try_as_basic_value()
                .unwrap_basic()
                .into_int_value();
            let on =
                cx.b.build_int_compare(
                    inkwell::IntPredicate::NE,
                    active,
                    i32_ty.const_zero(),
                    "force_on",
                )
                .unwrap();
            let then_bb = ctx.append_basic_block(f, "force_then");
            let done_bb = ctx.append_basic_block(f, "force_done");
            cx.b.build_conditional_branch(on, then_bb, done_bb).unwrap();
            cx.b.position_at_end(then_bb);
            let rhs = force_rhs.expect("a force driver has a right-hand side");
            let op = OpBuilder { ctx, b: &cx.b };
            let v = crate::real::to_storage(&cx, lower_expr(&cx, rhs)?, width, "a forced value")?;
            let v = crate::select::fit_width(&op, v, width);
            let flags = vj_sim::sched::FORCE_REFRESH
                | if site & crate::force::PROCEDURAL_SITE_BIT != 0 {
                    vj_sim::sched::FORCE_PROCEDURAL_ASSIGN
                } else {
                    0
                };
            if let Some(rt) = &row_target {
                crate::force::emit_force_row(&cx, handle, rt, Some(v), flags, site);
            } else if let Some((slot, lo, width, is_net, _)) = &plain {
                crate::force::emit_force(
                    &cx,
                    handle,
                    slot.slot,
                    *lo,
                    *width,
                    v,
                    u32::from(*is_net) | flags,
                    site,
                );
            }
            cx.b.build_unconditional_branch(done_bb).unwrap();
            cx.b.position_at_end(done_bb);
        }
        None if let Some(hidden) = spec.hidden_target => {
            // A primitive input terminal expression (LRM 28.3): its
            // self-determined value, stored whole into the hidden cell.
            if crate::huge::is_huge_width(hidden.width)
                || matches!(hidden.class, SignalSlotClass::Memory { .. })
            {
                return Err(LoweringError::unsupported_at(
                    "a primitive input terminal expression wider than the inline value path",
                    &fn_sym,
                ));
            }
            let op = OpBuilder { ctx, b: &cx.b };
            let rhs = lower_expr(&cx, assign_expr)?;
            let v = crate::real::to_storage(
                &cx,
                rhs,
                hidden.width,
                "a primitive input terminal expression",
            )?;
            let v = crate::select::fit_width(&op, v, hidden.width).llvm;
            match hidden.class {
                SignalSlotClass::Inline => {
                    build_set_scalar(&cx, fns, handle, hidden.slot, v, hidden.width);
                }
                _ => build_set_wide(&cx, fns, handle, hidden.slot, v, hidden.width),
            }
        }
        None if let Some(src) = spec.port_source => {
            let lhs = assign_expr.left().ok_or_else(|| {
                LoweringError::unsupported_at("an output port connection with no target", &fn_sym)
            })?;
            let (ptr, width, signed) = cx.locals[&src.uid()];
            let value = if crate::huge::is_huge_width(width) {
                // The port's value is the shadow image itself.
                crate::expr::LoweredValue::Huge(crate::huge::HugeValue { ptr, width, signed })
            } else {
                let v =
                    cx.b.build_load(int_type(ctx, width * 2), ptr, "port_ld")
                        .unwrap()
                        .into_int_value();
                let pv = PackedValue {
                    llvm: v,
                    width,
                    repr: cx.repr,
                    signed,
                };
                if src.value_type().is_some_and(|t| t.is_floating()) {
                    crate::expr::LoweredValue::Real(crate::real::bits_to_real(&cx, pv))
                } else {
                    let target = lhs.expr_type().map(|t| t.value_width()).unwrap_or(width);
                    crate::expr::LoweredValue::Packed(crate::select::fit_width(
                        &OpBuilder { ctx, b: &cx.b },
                        pv,
                        target,
                    ))
                }
            };
            crate::expr::store_to(&cx, lhs, value)?;
        }
        None if two_phase => {
            let lhs = assign_expr.left().ok_or_else(|| {
                LoweringError::unsupported_at("assignment missing lvalue", &fn_sym)
            })?;
            let rhs_expr = assign_expr.right().ok_or_else(|| {
                LoweringError::unsupported_at("assignment missing rvalue", &fn_sym)
            })?;
            if crate::collections::coll_of_expr(&lhs).is_some() {
                return Err(LoweringError::unsupported_at(
                    "a continuous assign driving a collection of a net whose right-hand \
                     side reads that net",
                    &fn_sym,
                ));
            }
            if let Some((_, shape)) = crate::arrays::array_target(&cx, lhs)? {
                // A whole unpacked-array slice (LRM 10.3.2, 10.9): the
                // right-hand side is evaluated against the net's RESOLVED
                // memory into a frame temporary (every element before any
                // store), then copied into the target's own contribution
                // memory.
                if !crate::collections::handle_offsets(&shape.elem).is_empty() {
                    return Err(LoweringError::unsupported_at(
                        "a continuous assign of an unpacked-array net slice whose \
                         elements hold class handles or collections and whose \
                         right-hand side reads that net",
                        &fn_sym,
                    ));
                }
                let tmp = crate::expr::entry_alloca(
                    &cx,
                    crate::arrays::local_array_type(ctx, &shape, cx.repr),
                    "arr_cont_tmp",
                );
                let tmp_ref =
                    crate::arrays::ArrayRef::whole(&cx, crate::arrays::Backing::Local(tmp));
                crate::arrays::assign_array_into_fresh(&cx, tmp_ref, &shape, rhs_expr)?;
                cx.mem_signals = mem_signals_of(signals);
                let Some((dst, dst_shape)) = crate::arrays::array_target(&cx, lhs)? else {
                    return Err(LoweringError::unsupported_at(
                        "an unpacked-array net slice target",
                        &fn_sym,
                    ));
                };
                crate::arrays::copy_array(&cx, dst, &dst_shape, tmp_ref, &shape)?;
            } else {
                let rhs = crate::collections::owned(&cx, rhs_expr)?;
                // Phase 2: the target's own contribution cells.
                for id in spec.read_signals.keys() {
                    let Some(info) = signals.get(id) else {
                        continue;
                    };
                    if let Some(&(ptr, width, _)) = cx.locals.get(id) {
                        let raw = match info.class {
                            SignalSlotClass::Inline => {
                                build_get_scalar(&cx, fns, handle, info.slot, info.width)
                            }
                            SignalSlotClass::Wide => {
                                build_get_wide(&cx, fns, handle, info.slot, info.width)
                            }
                            SignalSlotClass::Memory { .. } => continue,
                        };
                        debug_assert_eq!(width, info.width);
                        cx.b.build_store(ptr, raw).unwrap();
                    }
                }
                cx.mem_signals = mem_signals_of(signals);
                if let Some(r) = crate::arrays::resolve_element(&cx, lhs)? {
                    let op = OpBuilder { ctx, b: &cx.b };
                    let rhs_pv = crate::real::to_storage(
                        &cx,
                        rhs,
                        r.width,
                        "assignment of a >128-bit value to an array element",
                    )?;
                    let rhs_pv = crate::select::fit_width(&op, rhs_pv, r.width);
                    crate::arrays::write_element(&cx, &r, rhs_pv)?;
                } else {
                    crate::collections::store_releasing(&cx, lhs, rhs)?;
                }
            }
        }
        None => {
            lower_expr(&cx, assign_expr)?;
        }
        Some(var) if class_static_init => {
            let class_sym = var.parent().ok_or_else(|| {
                LoweringError::unsupported_at("class property has no enclosing class", &var)
            })?;
            crate::classes::run_dynamic_static_initializers(&cx, class_sym)?;
        }
        Some(var)
            if spec.var_init
                && let Some(info) = cx.mem_signals.get(&var.uid()).copied()
                && let Some(shape) = var
                    .value_type()
                    .as_ref()
                    .and_then(crate::arrays::array_shape) =>
        {
            // A fixed-size unpacked array's non-constant initializer
            // (LRM 6.8): assigned element-wise into the (empty) memory.
            let dst = crate::arrays::ArrayRef::whole(&cx, crate::arrays::Backing::Memory(info));
            crate::arrays::assign_array_into_fresh(&cx, dst, &shape, assign_expr)?;
        }
        Some(var) if spec.var_init => {
            // A variable's own initializer: evaluated like a local's
            // (`local_init_value`, which also takes ownership of a class
            // handle or string), then flushed to the variable's slot below.
            if crate::events::is_pool_event_var(&cx, &var) {
                crate::events::init_event_var(&cx, &var)?;
            } else {
                let (ptr, width, signed) = cx.locals[&var.uid()];
                let v = local_init_value(&cx, &var, width, signed)?;
                cx.b.build_store(ptr, v.llvm).unwrap();
            }
        }
        Some(net)
            if let Some(info) = cx.mem_signals.get(&net.uid()).copied()
                && let Some(shape) = net
                    .value_type()
                    .as_ref()
                    .and_then(crate::arrays::array_shape) =>
        {
            let dst = crate::arrays::ArrayRef::whole(&cx, crate::arrays::Backing::Memory(info));
            crate::arrays::assign_array_into_fresh(&cx, dst, &shape, assign_expr)?;
        }
        Some(net) => {
            let width = net.value_type().map(|t| t.value_width()).unwrap_or(0);
            let rhs = lower_expr(&cx, assign_expr)?;
            if !crate::huge::try_store_symbol(&cx, &net, rhs)? {
                let value = crate::real::to_storage(
                    &cx,
                    rhs,
                    width,
                    "a >128-bit net declaration assignment",
                )?;
                crate::select::store_whole(&cx, &net, value)?;
            }
        }
    }

    let mut written_sorted: Vec<&SymbolId> = written.iter().collect();
    written_sorted.sort();
    for id in written_sorted {
        let (ptr, width, _signed) = cx.locals[id];
        let info = signals[id];
        if crate::huge::is_huge_width(width) {
            // Commit through the dirty window (`state::huge_commit`): only the
            // words that differ reach STATE, and only they are notified.
            let _ = ptr;
            let i64t = cx.ctx.i64_type();
            crate::huge::rt_mark(
                &cx,
                handle,
                info.slot,
                width,
                i64t.const_zero(),
                i64t.const_int(u64::from(width), false),
            );
            crate::huge::rt_commit(&cx, handle, info.slot, width);
            continue;
        }
        let packed_ty = int_type(cx.ctx, width * 2);
        let cur = cx.b.build_load(packed_ty, ptr, "ext_flush_ld").unwrap();
        match info.class {
            SignalSlotClass::Inline => build_set_scalar(
                &cx,
                fns,
                handle,
                info.slot,
                cur.into_int_value(),
                info.width,
            ),
            SignalSlotClass::Wide => build_set_wide(
                &cx,
                fns,
                handle,
                info.slot,
                cur.into_int_value(),
                info.width,
            ),
            SignalSlotClass::Memory { .. } => {
                unreachable!("external_refs_in_expr excludes SignalSlotClass::Memory symbols")
            }
        }
    }

    let done_er = build_eval_result(ResolvedSuspend::Done, 0);
    // SAFETY: see `lower_kernel_fn_with_repr`'s identical justification --
    // `EvalResult` is `#[repr(C)]`/`Copy`, statically sized to exactly
    // `4 + RESCHEDULE_REQ_SIZE == 36` bytes with no unaccounted padding (its
    // own `const _: () = assert!(...)`), and `build_eval_result` initializes
    // every byte of it -- this transmute reads a fully-initialized,
    // non-poison bit pattern.
    let done_bytes: [u8; 36] = unsafe { core::mem::transmute(done_er) };
    store_eval_result_bytes_and_return(ctx, &cx.b, sret, &done_bytes);

    if f.verify(true) {
        Ok(f)
    } else {
        Err(LoweringError {
            message: "continuous-assign kernel function failed LLVM verify".into(),
            at: fn_sym.hierarchical_path(),
        })
    }
}

/// PR-033: emits `#[no_mangle] static VJ_PROCESS_TABLE: [ProcessFn; N]`
/// as an LLVM global array of function pointers, one entry per
/// `lower_kernel_fn`-emitted kernel, in `kernels`' own order (the caller's
/// elaboration-derived process id order -- this function assigns no ordering
/// of its own).
pub fn emit_process_table<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    kernels: &[FunctionValue<'ctx>],
) -> GlobalValue<'ctx> {
    let ptr_ty = ctx.ptr_type(AddressSpace::default());
    let arr_ty = ptr_ty.array_type(kernels.len() as u32);
    let elems: Vec<PointerValue<'ctx>> = kernels
        .iter()
        .map(|f| f.as_global_value().as_pointer_value())
        .collect();
    let const_arr = ptr_ty.const_array(&elems);
    let global = module.add_global(arr_ty, None, vj_abi::process::VJ_PROCESS_TABLE_SYMBOL);
    global.set_initializer(&const_arr);
    global.set_linkage(Linkage::External);
    global
}

// --- Task 9 (A2-part2, CG-101/CG-102/CG-103/CG-104/CG-105): per-process
// side-table -----------------------------------------------------------

/// The per-process side-table (`docs/design/faceoffs.md` -- VERDICT
/// (parallel-determinism engine) § Interface Requirements #1; ledger
/// CG-101, CG-102, CG-103, CG-104, CG-105): canonical identity, v1's
/// single-partition `region_id`, the process's static write-set, and a
/// fail-closed DPI/VPI purity tag. Reuses `vj-sim::analysis::DpiVpiTag`
/// (already the one shared, cross-track 4-variant type -- `determinism::
/// policy::dpi_speculation_policy` and `docs/CONTRACTS.md`'s own ownership
/// table both key off it for CG-105/ST-149/NL-092/NL-095/NL-100/DT-045)
/// rather than minting a second, independently-derived enum with the same
/// 4 variants.
#[derive(Clone, Debug, PartialEq)]
pub struct ProcessSideTable {
    /// The slice file's Task S5 `ProcessInstanceId` value for this
    /// process's OWNING elaborated instance (`process::dedup::assign_
    /// process_instance_ids`'s own output), re-exposed here verbatim --
    /// never a second, independently-derived identity (CG-101).
    pub canonical_process_id: u64,
    /// v1's real, degenerate single-conservative-partition value: every
    /// process gets `0` (ARCHITECTURE §4 item 1: `LOOKAHEAD_CYCLES = 0`) --
    /// see `vj_sim::sched::partition_of` for the consuming half
    /// (CG-102).
    pub region_id: u32,
    /// Every `(slot, width)` external-signal target this process's own
    /// Segment IR statically writes (a top-level `Assignment`, blocking or
    /// non-blocking, whose LHS resolves to a `plan.signals`-known
    /// module-level signal) -- never a process-private frame-local
    /// temporary, which no other process's kernel can ever observe
    /// (CG-103).
    pub write_set: Vec<(u32, u32)>,
    /// Fail-closed DPI/VPI purity classification (CG-104/CG-105).
    pub dpi_tag: DpiVpiTag,
}

/// Builds [`ProcessSideTable`] for `plan`, given `canonical_process_id` --
/// the OWNING elaborated instance's `process::ProcessInstanceId` (Task S5's
/// `dedup::assign_process_instance_ids` output for that instance), supplied
/// by the caller rather than re-derived here: this function performs no
/// elaboration-order walk of its own (mirrors `process::dedup::assign_
/// process_instance_ids`'s own "consume, don't re-derive" discipline).
pub fn build_process_side_table(
    plan: &ProcessLoweringPlan<'_>,
    canonical_process_id: vj_sim::process::ProcessInstanceId,
) -> ProcessSideTable {
    ProcessSideTable {
        canonical_process_id: canonical_process_id.0,
        // Task 10 (PR-122), review fix: sourced from `plan.region_id` --
        // the one place `ProcessLoweringPlan`'s own WOCB partition id is
        // set -- rather than hardcoded here a second time, so this and
        // `ProcessLoweringPlan::region_id` can never independently drift.
        // ARCHITECTURE §4 item 1: v1 ships exactly one conservative
        // partition, so `plan.region_id` is `0` for every real process
        // today (not a stub -- see `ProcessLoweringPlan::region_id`'s own
        // doc comment).
        region_id: plan.region_id,
        write_set: write_set_of_segments(&plan.segments, &plan.signals),
        dpi_tag: classify_dpi_tag(&plan.segments),
    }
}

/// Review fix (CG-101/102/103/104, round 2): the plan's own literal
/// "emitted as an LLVM constant global per process" instruction, actually
/// implemented -- mirrors [`emit_process_table`]'s own shape exactly (a
/// `#[no_mangle]` external-linkage constant array, index-aligned with
/// `tables`, under a FIXED ABI symbol name), so a caller that already emits
/// `VJ_PROCESS_TABLE` alongside a set of kernels emits this the same
/// way, in the same order.
///
/// `tables` must be in the caller's own elaboration-derived process-id order
/// (the same ordering contract [`emit_process_table`]'s `kernels` slice
/// already carries) -- this function assigns no ordering of its own and
/// performs no sort/dedup.
///
/// **Why two globals, not one (CG-103's "arena-offset/length slices"
/// acceptance wording):** [`ProcessSideTable::write_set`] is a
/// variable-length `Vec`, and LLVM has no constant-array-of-variable-length-
/// array type -- so every process's write-set entries are flattened, in
/// `tables`' order, into ONE shared [`vj_abi::process::WriteSetEntry`]
/// array (`VJ_PROCESS_WRITE_SET`), and each [`SideTableEntry`][vj_abi::
/// process::SideTableEntry] row instead carries `(write_set_offset,
/// write_set_len)` slicing into it -- exactly the representation
/// [`vj_abi::process::SideTableEntry`]'s own doc comment freezes.
///
/// Returns `(side_table_global, write_set_global)`, both real,
/// `module.verify()`-clean LLVM globals under their fixed
/// `vj_abi::process::VJ_PROCESS_SIDE_TABLE_SYMBOL`/
/// `VJ_PROCESS_WRITE_SET_SYMBOL` names -- any runtime consumer that
/// resolves either fixed symbol (JIT `get_function_address`-style lookup, or
/// AOT static linkage) reads real per-process data (CG-101's "readable by
/// the runtime" acceptance), never a placeholder or dead struct only a test
/// constructs.
pub fn emit_process_side_table<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    tables: &[ProcessSideTable],
) -> (GlobalValue<'ctx>, GlobalValue<'ctx>) {
    let i64_ty = ctx.i64_type();
    let i32_ty = ctx.i32_type();

    // Field order/types here MUST match `vj_abi::process::
    // WriteSetEntry`/`SideTableEntry`'s own `#[repr(C)]` layout exactly --
    // see those types' own doc comments, which name this function as their
    // one real producer.
    let write_set_entry_ty = ctx.struct_type(&[i32_ty.into(), i32_ty.into()], false);
    let entry_ty = ctx.struct_type(
        &[
            i64_ty.into(),
            i32_ty.into(),
            i32_ty.into(),
            i32_ty.into(),
            i32_ty.into(),
        ],
        false,
    );

    let mut flat_write_set: Vec<StructValue<'ctx>> = Vec::new();
    let mut entries: Vec<StructValue<'ctx>> = Vec::with_capacity(tables.len());
    for table in tables {
        let offset = flat_write_set.len() as u32;
        for &(slot, width) in &table.write_set {
            flat_write_set.push(write_set_entry_ty.const_named_struct(&[
                i32_ty.const_int(u64::from(slot), false).into(),
                i32_ty.const_int(u64::from(width), false).into(),
            ]));
        }
        let len = table.write_set.len() as u32;
        entries.push(entry_ty.const_named_struct(&[
            i64_ty.const_int(table.canonical_process_id, false).into(),
            i32_ty.const_int(u64::from(table.region_id), false).into(),
            // `DpiVpiTag`'s own unannotated default discriminants (`Pure = 0`
            // .. `SpeculationUnsafe = 3`) -- `vj_abi::process::
            // SideTableEntry::dpi_tag`'s own doc comment pins this exact
            // mapping.
            i32_ty.const_int(table.dpi_tag as u64, false).into(),
            i32_ty.const_int(u64::from(offset), false).into(),
            i32_ty.const_int(u64::from(len), false).into(),
        ]));
    }

    let write_set_arr_ty = write_set_entry_ty.array_type(flat_write_set.len() as u32);
    let write_set_const = write_set_entry_ty.const_array(&flat_write_set);
    let write_set_global = module.add_global(
        write_set_arr_ty,
        None,
        vj_abi::process::VJ_PROCESS_WRITE_SET_SYMBOL,
    );
    write_set_global.set_initializer(&write_set_const);
    write_set_global.set_linkage(Linkage::External);
    write_set_global.set_constant(true);

    let side_table_arr_ty = entry_ty.array_type(entries.len() as u32);
    let side_table_const = entry_ty.const_array(&entries);
    let side_table_global = module.add_global(
        side_table_arr_ty,
        None,
        vj_abi::process::VJ_PROCESS_SIDE_TABLE_SYMBOL,
    );
    side_table_global.set_initializer(&side_table_const);
    side_table_global.set_linkage(Linkage::External);
    side_table_global.set_constant(true);

    (side_table_global, write_set_global)
}

/// CG-103: every module-level signal a `StateWrite`-tagged top-level
/// `Assignment` (blocking OR non-blocking -- `effect_of_statement` does not
/// distinguish the two, and neither does this) targets, in first-
/// appearance order, deduplicated by `SymbolId`. A LHS that is not a plain
/// `NamedValue` (a part-/bit-select -- unsupported anywhere else in this
/// crate's own A2 slice grammar) or that resolves to a purely process-
/// private frame slot (never present in `signals` at all -- `signals` only
/// ever holds module-level signal entries) contributes nothing: exactly
/// the exclusion the plan's own `write_set_matches_the_processs_own_
/// statewrite_tagged_slots` test requires ("not `clk`, which is read,
/// never written, by this process").
fn write_set_of_segments(
    segments: &[Segment<'_>],
    signals: &HashMap<SymbolId, SignalSlot>,
) -> Vec<(u32, u32)> {
    let mut seen: HashSet<u32> = HashSet::new();
    let mut out = Vec::new();
    for seg in segments {
        // A formal no segment can alias (its error is reported by lowering).
        let Ok(signals) = seg_signals(signals, seg) else {
            continue;
        };
        for stmt in &seg.body {
            if effect_of_statement(stmt) != Effect::StateWrite {
                continue;
            }
            let Some(e) = stmt.expr() else { continue };
            let Some(lhs) = e.left() else { continue };
            if !vj_sim::symid::is_value_name(lhs.kind()) {
                continue;
            }
            let Some(sym) = lhs.referenced_symbol() else {
                continue;
            };
            let Some(slot) = signals.get(&sym.uid()) else {
                continue;
            };
            if seen.insert(slot.slot) {
                out.push((slot.slot, slot.width));
            }
        }
    }
    out
}

/// CG-104/CG-105: fail-closed DPI/VPI purity classification. A2 has zero
/// DPI-import lowering anywhere in this crate (no `import "DPI-C"` call
/// site can be lowered to a real kernel yet), so the only call shape this
/// classifier can ever prove safe is a system-function call (`$display`,
/// `$time`, `$bits`, ...) -- `is_system_call() == Some(true)`. Any OTHER
/// `ExpressionKind::Call` (a plain user subroutine call is syntactically
/// indistinguishable, at this IR layer, from a DPI-imported function call
/// -- `import "DPI-C" function ...` declares an ordinary-looking
/// subroutine) is a call this classifier cannot prove pure, so the whole
/// process defaults to `Barrier`, never `Pure` by a missed-case default.
fn classify_dpi_tag(segments: &[Segment<'_>]) -> DpiVpiTag {
    if segments.iter().any(segment_has_unprovable_call) {
        DpiVpiTag::Barrier
    } else {
        DpiVpiTag::Pure
    }
}

/// Depth-first scan (mirrors `collect_named_value_symbols`'s shape) of one
/// segment's body AND terminator condition/delay/edge-list expressions for
/// any `ExpressionKind::Call` this classifier cannot prove is a known-safe
/// system function.
fn segment_has_unprovable_call(seg: &Segment<'_>) -> bool {
    fn scan(node: SemNode<'_>) -> bool {
        let mut stack = vec![node];
        while let Some(n) = stack.pop() {
            if let Some(e) = n.as_expression()
                && e.kind() == ExpressionKind::Call
                && e.is_system_call() != Some(true)
            {
                return true;
            }
            stack.extend(n.children());
        }
        false
    }

    if seg.body.iter().any(|stmt| scan(stmt.as_sem_node())) {
        return true;
    }
    // R-run Task 8: a `repeat` loop's own count expression can hide an
    // unprovable call too (`repeat(f()) ...`), same completeness reason as
    // every other read site above.
    if let Some((_, count)) = &seg.repeat_init
        && let Some(count_expr) = count.expr()
        && scan(count_expr.as_sem_node())
    {
        return true;
    }
    match &seg.terminator {
        SegTerminator::SwitchGoto { on, .. } => on.reads().iter().any(|e| scan(e.as_sem_node())),
        SegTerminator::CondGoto { cond, .. } => scan(cond.as_sem_node()),
        SegTerminator::AssertGoto { stmt, .. } => {
            vj_sim::process::cfg::assertion_cond(stmt).is_some_and(|e| scan(e.as_sem_node()))
        }
        SegTerminator::CaseGoto { stmt, .. } => vj_sim::process::liveness::case_reads(stmt)
            .iter()
            .any(|e| scan(e.as_sem_node())),
        SegTerminator::Suspend {
            point: SuspendPoint::Delay(e, _) | SuspendPoint::Level(e),
            ..
        } => scan(e.as_sem_node()),
        SegTerminator::Suspend {
            point: SuspendPoint::EdgeList(entries, iffs),
            ..
        } => {
            entries.iter().any(|(e, _)| scan(e.as_sem_node()))
                || iffs.iter().flatten().any(|g| scan(g.as_sem_node()))
        }
        SegTerminator::Suspend {
            point: SuspendPoint::Edge { iff: Some(g), .. },
            ..
        } => scan(g.as_sem_node()),
        SegTerminator::Suspend {
            point: SuspendPoint::ImplicitComb(reads),
            ..
        } => reads.iter().any(|e| scan(e.as_sem_node())),
        SegTerminator::Suspend {
            point:
                SuspendPoint::Edge { .. }
                    | SuspendPoint::CycleDelay { .. }
                    | SuspendPoint::OneStep
                    | SuspendPoint::WaitFork
                    | SuspendPoint::ByRequest,
            ..
        }
        | SegTerminator::Goto(_)
        | SegTerminator::CondGotoCounter { .. }
        // R-run Task 17: a fork/join site's branches are each classified
        // for DPI/VPI purity independently, the moment each one is
        // compiled via its own recursive `lower_kernel_fn_with_repr` call
        // (see that function's own fork-support arm) -- this OUTER scan
        // does not need to recurse into `branches` itself. `false` (never
        // provably-unprovable at THIS level) is the same conservative-but-
        // correct default `Goto`/`CondGotoCounter`/`End` already use for
        // "no call expression lives directly on this terminator."
        | SegTerminator::ForkJoin { .. }
        | SegTerminator::End { .. } => false,
    }
}

/// A variable the process shares with a fork branch (`FrameSlotDesc::cell`):
/// its working copy (an `alloca` of the value's words), primed from the cell
/// the frame slot points at, and an `alloca` holding that pointer. Returns
/// `(working copy, pointer alloca, bytes)`.
fn open_cell<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    b: &Builder<'ctx>,
    local: PointerValue<'ctx>,
    slot: &vj_sim::process::liveness::FrameSlotDesc,
) -> (PointerValue<'ctx>, PointerValue<'ctx>, u32) {
    let words = match slot.repr {
        vj_sim::process::FrameSlot::Narrow4State { word_count } => u32::from(word_count),
        vj_sim::process::FrameSlot::Array { rows, row_words } => rows * u32::from(row_words),
        vj_sim::process::FrameSlot::Wide4State {
            aval_word_count,
            bval_word_count,
        } => aval_word_count + bval_word_count,
    };
    let bytes = words * 8;
    let i64t = ctx.i64_type();
    let shadow = crate::types::entry_alloca_in(b, i64t.array_type(words), "shared_local");
    let cell_ptr = crate::types::entry_alloca_in(b, i64t, "cell_ptr");
    let src = frame_slot_ptr(ctx, b, local, slot.offset);
    let p = b.build_load(i64t, src, "cell_ptr_ld").unwrap();
    b.build_store(cell_ptr, p).unwrap();
    let from = cell_or_scratch(ctx, module, b, p.into_int_value(), bytes);
    b.build_memcpy(shadow, 8, from, 8, i64t.const_int(u64::from(bytes), false))
        .unwrap();
    (shadow, cell_ptr, bytes)
}

/// The cell `p` points at, or (for a variable whose block has not yet run,
/// a null pointer) a scratch buffer of `bytes`.
fn cell_or_scratch<'ctx>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    b: &Builder<'ctx>,
    p: IntValue<'ctx>,
    bytes: u32,
) -> PointerValue<'ctx> {
    let name = format!("vj_cell_scratch_{bytes}");
    let scratch = module.get_global(&name).unwrap_or_else(|| {
        let ty = ctx.i64_type().array_type(bytes.div_ceil(8));
        let g = module.add_global(ty, None, &name);
        g.set_linkage(Linkage::Internal);
        g.set_initializer(&ty.const_zero());
        g
    });
    let ptr_ty = ctx.ptr_type(AddressSpace::default());
    let as_ptr = b.build_int_to_ptr(p, ptr_ty, "cell").unwrap();
    let null = b
        .build_int_compare(
            inkwell::IntPredicate::EQ,
            p,
            ctx.i64_type().const_zero(),
            "cell_null",
        )
        .unwrap();
    b.build_select(null, scratch.as_pointer_value(), as_ptr, "cell_or_scratch")
        .unwrap()
        .into_pointer_value()
}

/// Copies every shared variable's working copy into its cell: done before
/// another process can run (a suspend, a fork, the process's end).
fn flush_cells(cx: &LowerCtx<'_, '_, '_>) {
    let mut ids: Vec<&SymbolId> = cx.cells.keys().collect();
    ids.sort_by(|a, b| a.path().cmp(b.path()));
    for id in ids {
        let (cell_ptr, bytes) = cx.cells[id];
        let Some(&(shadow, _, _)) = cx.locals.get(id) else {
            continue;
        };
        let p =
            cx.b.build_load(cx.ctx.i64_type(), cell_ptr, "cell_ptr")
                .unwrap()
                .into_int_value();
        let to = cell_or_scratch(cx.ctx, cx.module, &cx.b, p, bytes);
        let i64t = cx.ctx.i64_type();
        let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
        let store = cx
            .module
            .get_function(SV_RT_CELL_STORE_SYMBOL)
            .unwrap_or_else(|| {
                cx.module.add_function(
                    SV_RT_CELL_STORE_SYMBOL,
                    cx.ctx
                        .void_type()
                        .fn_type(&[ptr_ty.into(), ptr_ty.into(), i64t.into()], false),
                    Some(Linkage::External),
                )
            });
        cx.b.build_call(
            store,
            &[
                to.into(),
                shadow.into(),
                i64t.const_int(u64::from(bytes), false).into(),
            ],
            "cell_store",
        )
        .unwrap();
    }
}

/// A new cell for `var` if the process shares it with fork branches: each
/// creation of the variable (its block entered, its task called) is a new
/// variable, which the branches forked from then on use.
fn fresh_cell(cx: &LowerCtx<'_, '_, '_>, var: &Symbol<'_>) {
    let Some(&(cell_ptr, bytes)) = cx.cells.get(&var.uid()) else {
        return;
    };
    let i64t = cx.ctx.i64_type();
    let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
    let alloc = cx
        .module
        .get_function(SV_RT_CELL_ALLOC_SYMBOL)
        .unwrap_or_else(|| {
            cx.module.add_function(
                SV_RT_CELL_ALLOC_SYMBOL,
                ptr_ty.fn_type(&[i64t.into()], false),
                Some(Linkage::External),
            )
        });
    let cell =
        cx.b.build_call(
            alloc,
            &[i64t.const_int(u64::from(bytes), false).into()],
            "cell",
        )
        .unwrap()
        .try_as_basic_value()
        .unwrap_basic()
        .into_pointer_value();
    let as_int = cx.b.build_ptr_to_int(cell, i64t, "cell_int").unwrap();
    cx.b.build_store(cell_ptr, as_int).unwrap();
}

/// An event-control term naming a process-local variable (`@(v)`,
/// `@(posedge v iff c)`, a member of `@(a or v)`): one that only changes as
/// a variable shared with another process.
struct LocalEventTerm<'d> {
    index: usize,
    var: Symbol<'d>,
    edge: sv_lang::EdgeKind,
}

/// The edge code `sv_rt_edge_check` takes: 0 any change, 1 posedge, 2
/// negedge, 3 either edge.
fn edge_code_of(edge: sv_lang::EdgeKind) -> u64 {
    match edge {
        sv_lang::EdgeKind::None => 0,
        sv_lang::EdgeKind::PosEdge => 1,
        sv_lang::EdgeKind::NegEdge => 2,
        sv_lang::EdgeKind::BothEdges => 3,
    }
}

fn local_event_terms<'d>(
    point: &SuspendPoint<'d>,
    signals: &HashMap<SymbolId, SignalSlot>,
) -> Vec<LocalEventTerm<'d>> {
    let entries: Vec<(Expression<'d>, sv_lang::EdgeKind)> = match point {
        SuspendPoint::Edge { signal, edge, .. } => vec![(*signal, *edge)],
        SuspendPoint::EdgeList(entries, ..) => entries.clone(),
        _ => return Vec::new(),
    };
    let mut out = Vec::new();
    for (index, (e, edge)) in entries.into_iter().enumerate() {
        if !vj_sim::symid::is_value_name(e.kind()) || event_elem_signal(&e, signals).is_some() {
            continue;
        }
        let Some(var) = e.referenced_symbol() else {
            continue;
        };
        if signals.contains_key(&var.uid())
            || !matches!(
                var.kind(),
                sv_lang::kinds::SymbolKind::Variable | sv_lang::kinds::SymbolKind::FormalArgument
            )
        {
            continue;
        }
        out.push(LocalEventTerm { index, var, edge });
    }
    out
}

/// An event-control term naming one element of a module's unpacked array of
/// named events (`@(ea[i])`, a member of `@(ea[0] or ea[1])`, a `wait_order`
/// operand). The array's one memory cell wakes the wait on any element's
/// trigger, so the resume guard checks this element's own trigger count
/// against the one recorded (with its row, evaluated then: LRM 1800-2023
/// 15.5.1) when the wait started.
struct EventElemTerm<'d> {
    index: usize,
    expr: Expression<'d>,
}

/// `e` is an element select whose type is `event`.
fn is_event_elem(e: &Expression<'_>) -> bool {
    e.kind() == ExpressionKind::ElementSelect && e.expr_type().is_some_and(|t| t.is_event())
}

/// The array symbol under the select chain of event element `e`.
fn event_elem_array<'d>(e: &Expression<'d>) -> Option<Symbol<'d>> {
    let mut cur = *e;
    while cur.kind() == ExpressionKind::ElementSelect {
        cur = cur.select_value()?;
    }
    if vj_sim::symid::is_value_name(cur.kind()) {
        cur.referenced_symbol()
    } else {
        None
    }
}

/// Group mode (`events::group`): the slot of every pool of the design. A wait
/// on an event handle can end on a trigger in any of them, so it subscribes to
/// all (the resume guard tells whether its own event triggered). Empty outside
/// group mode.
fn group_pool_slots(signals: &HashMap<SymbolId, SignalSlot>) -> Vec<u32> {
    if !vj_sim::state::event_plan::group_mode()
        || !signals.contains_key(&vj_sim::state::event_pool::pool_key())
    {
        return Vec::new();
    }
    let mut out = Vec::new();
    let mut j = 0;
    while let Some(p) = signals.get(&vj_sim::state::event_pool::peer_key(j)) {
        out.push(p.slot);
        j += 1;
    }
    out
}

/// The wait entries a point's event-element terms add in group mode: every
/// pool slot not already subscribed by `terms` (appended after the terms, as
/// the expression terms' extra slots are).
fn group_wait_extras<'d>(
    point: &SuspendPoint<'d>,
    signals: &HashMap<SymbolId, SignalSlot>,
    terms: &[WaitTableEntry],
) -> Vec<WaitTableEntry> {
    let pools = group_pool_slots(signals);
    if pools.is_empty() || event_elem_terms(point, signals).is_empty() {
        return Vec::new();
    }
    pools
        .into_iter()
        .filter(|s| !terms.iter().any(|t| t.slot == *s))
        .map(|s| WaitTableEntry::whole(s, None))
        .collect()
}

/// The memory slot of the module array that event element `e` selects from.
fn event_elem_signal<'a, 'd>(
    e: &Expression<'d>,
    signals: &'a HashMap<SymbolId, SignalSlot>,
) -> Option<&'a SignalSlot> {
    // A body with an event pool keeps every event in it: any event
    // expression (a named event, a handle variable, an element) is one row
    // of that memory.
    if e.expr_type().is_some_and(|t| t.is_event()) {
        // `@(s.ev)` on an event of another instance that keeps its events in
        // a pool: that instance's pool memory (run.rs registers it here).
        if let Some(var) = crate::events::hierarchical_event_var(e)
            && let Some(pool) = signals.get(&vj_sim::state::event_pool::pool_of_key(&var.uid()))
        {
            return Some(pool);
        }
        if let Some(pool) = signals.get(&vj_sim::state::event_pool::pool_key()) {
            return Some(pool);
        }
    }
    if !is_event_elem(e) {
        return None;
    }
    signals
        .get(&event_elem_array(e)?.uid())
        .filter(|s| matches!(s.class, SignalSlotClass::Memory { .. }))
}

/// `e` as a constant bit/part select of one plain (non-memory) signal --
/// `v[1]`, `v[5:4]`, `w[2][3]`: the signal and the physical bit window
/// `(lsb, width)` it addresses. `None` for a plain name, a select with a
/// variable index, an out-of-range select, or a select of a memory.
fn constant_select_of_signal<'a, 'd>(
    e: &Expression<'d>,
    signals: &'a HashMap<SymbolId, SignalSlot>,
) -> Option<(&'a SignalSlot, u32, u32)> {
    if !matches!(
        e.kind(),
        ExpressionKind::ElementSelect | ExpressionKind::RangeSelect
    ) {
        return None;
    }
    let mut root = *e;
    while matches!(
        root.kind(),
        ExpressionKind::ElementSelect | ExpressionKind::RangeSelect
    ) {
        root = root.select_value()?;
        if root.expr_type().is_some_and(|t| t.is_unpacked_array()) {
            return None;
        }
    }
    let info = signals.get(&root.referenced_symbol()?.uid())?;
    if matches!(info.class, SignalSlotClass::Memory { .. }) {
        return None;
    }
    let (lsb, width) = crate::select::constant_window(*e, info.width).ok()?;
    Some((info, lsb, width))
}

/// The constant bit windows `(lsb, width)` an `always_comb`/`always_latch`
/// body reads of each signal whose EVERY read in the body is a constant
/// bit/part select (LRM 9.2.2.2.1: the implicit sensitivity list holds the
/// longest static prefix of an expression, so `r = v[0]` is not sensitive to
/// `v[1]`). A signal also read whole, through a variable index, in a called
/// subroutine, or anywhere this walk cannot see is absent from the map and
/// keeps its whole-signal sensitivity -- the walk only ever narrows. A body
/// that calls a user subroutine yields an empty map (its reads are the
/// callee's whole body, which this walk does not enter).
pub fn comb_read_windows<'d>(
    body: &Statement<'d>,
    signals: &HashMap<SymbolId, SignalSlot>,
) -> HashMap<SymbolId, Vec<(u32, u32)>> {
    use vj_sim::process::cfg::live_children;
    let mut windows: HashMap<SymbolId, Vec<(u32, u32)>> = HashMap::new();
    let mut whole: HashSet<SymbolId> = HashSet::new();
    let mut stack = vec![body.as_sem_node()];
    while let Some(n) = stack.pop() {
        if let Some(e) = n.as_expression() {
            if e.kind() == ExpressionKind::Call && e.is_system_call() != Some(true) {
                return HashMap::new();
            }
            if let Some((_, lsb, width)) = constant_select_of_signal(&e, signals) {
                let mut root = e;
                while matches!(
                    root.kind(),
                    ExpressionKind::ElementSelect | ExpressionKind::RangeSelect
                ) {
                    match root.select_value() {
                        Some(r) => root = r,
                        None => break,
                    }
                }
                if let Some(sym) = root.referenced_symbol() {
                    let w = windows.entry(sym.uid()).or_default();
                    if !w.contains(&(lsb, width)) {
                        w.push((lsb, width));
                    }
                }
                continue;
            }
            if vj_sim::symid::is_value_name(e.kind()) {
                if let Some(sym) = e.referenced_symbol() {
                    whole.insert(sym.uid());
                }
                continue;
            }
            // A plain assignment's target is written, not read; a compound
            // one reads it. Constant-select targets are skipped whole.
            if e.kind() == ExpressionKind::Assignment {
                let lhs_is_read = e.is_compound_assignment() == Some(true);
                if let Some(lhs) = e.left() {
                    let skip = !lhs_is_read
                        && (vj_sim::symid::is_value_name(lhs.kind())
                            || constant_select_of_signal(&lhs, signals).is_some());
                    if !skip {
                        stack.push(lhs.as_sem_node());
                    }
                }
                if let Some(rhs) = e.right() {
                    stack.push(rhs.as_sem_node());
                }
                continue;
            }
        }
        stack.extend(live_children(&n));
    }
    for id in whole {
        windows.remove(&id);
    }
    windows
}

fn event_elem_terms<'d>(
    point: &SuspendPoint<'d>,
    signals: &HashMap<SymbolId, SignalSlot>,
) -> Vec<EventElemTerm<'d>> {
    let entries: Vec<Expression<'d>> = match point {
        SuspendPoint::Edge { signal, .. } => vec![*signal],
        SuspendPoint::EdgeList(entries, ..) => entries.iter().map(|(e, _)| *e).collect(),
        _ => return Vec::new(),
    };
    entries
        .into_iter()
        .enumerate()
        .filter(|(_, e)| {
            event_elem_signal(e, signals).is_some() || crate::vif::event_elem_root(e).is_some()
        })
        .map(|(index, expr)| EventElemTerm { index, expr })
        .collect()
}

/// An event-control term that is an arbitrary expression -- `@(mem[i])`,
/// `@(a + b)`, `@(v[i+2])`, `@(posedge a & b)` (LRM 1800-2023 9.4.2: it
/// waits for the VALUE of the expression to change; with an edge, for that
/// edge of its least significant bit). Not a plain signal name, a constant
/// select of one, an event array element, a sequence instance, or a virtual
/// interface member, which each have a subscription of their own.
struct ExprEventTerm<'d> {
    index: usize,
    expr: Expression<'d>,
    edge: sv_lang::EdgeKind,
}

fn is_expr_event_term(e: &Expression<'_>, signals: &HashMap<SymbolId, SignalSlot>) -> bool {
    if e.kind() == ExpressionKind::AssertionInstance
        || event_elem_signal(e, signals).is_some()
        || crate::vif::event_elem_root(e).is_some()
        || constant_select_of_signal(e, signals).is_some()
        || crate::vif::event_base(e).is_some()
    {
        return false;
    }
    // `@(field)` on a class field (UVM's `@on`): not a module signal, so it is
    // an expression term over object state (LRM 1800-2023 9.4.2: wait for the
    // value to change), woken by the object-state pseudo-cell.
    let class_field = vj_sim::symid::is_value_name(e.kind())
        && crate::classes::reads_object_state(e)
        && e.referenced_symbol().is_some_and(|s| {
            !signals.contains_key(&s.uid())
                && s.value_type()
                    .as_ref()
                    .and_then(vj_sim::state::event_pool::event_count)
                    .is_none()
        });
    if class_field {
        return true;
    }
    let plain = e.referenced_symbol().is_some_and(|s| {
        vj_sim::symid::is_value_name(e.kind())
            || s.kind() == sv_lang::kinds::SymbolKind::ClockingBlock
    });
    !plain
}

fn expr_event_terms<'d>(
    point: &SuspendPoint<'d>,
    signals: &HashMap<SymbolId, SignalSlot>,
) -> Vec<ExprEventTerm<'d>> {
    let entries: Vec<(Expression<'d>, sv_lang::EdgeKind)> = match point {
        SuspendPoint::Edge { signal, edge, .. } => vec![(*signal, *edge)],
        SuspendPoint::EdgeList(entries, ..) => entries.clone(),
        _ => return Vec::new(),
    };
    entries
        .into_iter()
        .enumerate()
        .filter(|(_, (e, _))| is_expr_event_term(e, signals))
        .map(|(index, (expr, edge))| ExprEventTerm { index, expr, edge })
        .collect()
}

/// The state cells whose change can change expression `e`, in a stable
/// order: a watched sequence's cell, every module signal (or memory) it names
/// and the cells of the virtual interface members it may reach, plus the
/// shared-variable pseudo-cell when it names a process-local variable (which
/// changes while this process waits only if shared with a fork branch).
fn expr_dependency_slots<'d>(
    e: &Expression<'d>,
    signals: &HashMap<SymbolId, SignalSlot>,
    fn_sym: &Symbol<'d>,
) -> Vec<u32> {
    let mut slots: Vec<u32> = Vec::new();
    // `wait (s.triggered)`: the watcher's cell changes at each end point.
    let mut stack = vec![e.as_sem_node()];
    while let Some(n) = stack.pop() {
        if let Some(x) = n.as_expression()
            && let Some(inst) = vj_sim::sva::endpoint::watched_call(&x)
            && let Some(info) =
                signals.get(&vj_sim::sva::endpoint::watcher_id(&fn_sym.uid(), &inst))
            && !slots.contains(&info.slot)
        {
            slots.push(info.slot);
        }
        stack.extend(n.children());
    }
    let mut found = Vec::new();
    collect_named_value_symbols(e.as_sem_node(), &mut found);
    // `vif.m`: every candidate's `m` -- a change of an unselected one only
    // wakes the process to re-check.
    let mut stack = vec![e.as_sem_node()];
    while let Some(n) = stack.pop() {
        if let Some(x) = n.as_expression() {
            found.extend(vif_candidates(&x));
        }
        stack.extend(n.children());
    }
    for sym in found {
        let pooled_event = signals
            .get(&vj_sim::state::event_pool::pool_of_key(&sym.uid()))
            .or_else(|| signals.get(&vj_sim::state::event_pool::pool_key()))
            .filter(|_| {
                sym.value_type()
                    .as_ref()
                    .and_then(vj_sim::state::event_pool::event_count)
                    .is_some()
            });
        if let Some(pool) = pooled_event {
            // An event of a body with an event pool is a row of the pool (in
            // group mode a handle may name an event of any pool).
            for slot in std::iter::once(pool.slot).chain(group_pool_slots(signals)) {
                if !slots.contains(&slot) {
                    slots.push(slot);
                }
            }
        } else if let Some(info) = signals.get(&sym.uid()) {
            if !slots.contains(&info.slot) {
                slots.push(info.slot);
            }
        } else if matches!(
            sym.kind(),
            sv_lang::kinds::SymbolKind::Variable | sv_lang::kinds::SymbolKind::FormalArgument
        ) && !slots.contains(&vj_sim::sched::SHARED_VARS_SLOT)
        {
            // A process-local changes while this process waits only if it
            // shares it with a fork branch or its parent: wake on any shared
            // variable's change and re-check.
            slots.push(vj_sim::sched::SHARED_VARS_SLOT);
        }
    }
    // A class field read: a heap write is no signal change, so wake on any
    // object-state change and re-check.
    if crate::classes::reads_object_state(e) && !slots.contains(&vj_sim::sched::OBJECT_STATE_SLOT) {
        slots.push(vj_sim::sched::OBJECT_STATE_SLOT);
    }
    slots
}

/// Bytes of the part of an element term's snapshot the resume guard reads:
/// the row, whether it was valid, and the cell's trigger count (three `i64`).
const EVENT_ELEM_SNAPSHOT_BYTES: u32 = 24;
/// Bytes of the snapshot as stored: the guard's three words, then the
/// array's slot and the `SimHandle` of its instance, which let the runtime
/// record which element each process waits on (`vpiWaitingProcesses`,
/// LRM 1800-2023 37.27).
const EVENT_ELEM_STORE_BYTES: u32 = 40;

/// The snapshot site of element term `index` of the suspend resuming at
/// `resume` (marked so the runtime reads the extended snapshot).
fn event_elem_site(resume: u32, index: usize) -> u64 {
    local_event_site(resume, index) | vj_sim::sched::ELEM_SITE_BIT
}

/// The suspend epilogue's record of element term `t`: its row, validity and
/// current trigger count, under `site`.
fn event_elem_snapshot<'ctx, 'd>(
    cx: &LowerCtx<'ctx, 'd, '_>,
    local: PointerValue<'ctx>,
    site: u64,
    expr: Expression<'d>,
) -> Result<(), LoweringError> {
    let i64t = cx.ctx.i64_type();
    // `@(vif.ea[i])`: the selected candidate's element; its snapshot's
    // `valid` word holds the candidate's code (id) instead of 1, which the
    // resume guard reads back to know whose array to look at.
    let (el, row, valid, count, slot) =
        if let Some(cands) = crate::vif::event_elem_candidates(cx, expr) {
            let cands = cands?;
            let mut acc: Option<(
                IntValue<'ctx>,
                IntValue<'ctx>,
                IntValue<'ctx>,
                IntValue<'ctx>,
            )> = None;
            for (el, code) in &cands {
                let cell = crate::arrays::load_event_elem(cx, el)?;
                let count = cx.b.build_int_truncate(cell, i64t, "ev_count").unwrap();
                let code = i64t.const_int(*code, false);
                let slot = i64t.const_int(u64::from(el.info.slot), false);
                acc = Some(match acc {
                    None => (el.row, code, count, slot),
                    Some((r, v, c, s)) => {
                        let pick = |new: IntValue<'ctx>, old: IntValue<'ctx>| {
                            cx.b.build_select(el.valid, new, old, "ev_pick")
                                .unwrap()
                                .into_int_value()
                        };
                        (
                            pick(el.row, r),
                            pick(code, v),
                            pick(count, c),
                            pick(slot, s),
                        )
                    }
                });
            }
            let Some((row, code, count, slot)) = acc else {
                return Ok(());
            };
            // The first candidate's `valid` seeds the accumulator: none
            // selected (an invalid index, or an id past the candidates)
            // must read as no element.
            let any = cands
                .iter()
                .map(|(el, _)| el.valid)
                .try_fold(None::<IntValue<'ctx>>, |a, v| {
                    Ok::<_, LoweringError>(Some(match a {
                        Some(a) => cx.b.build_or(a, v, "ev_any_sel").unwrap(),
                        None => v,
                    }))
                })?
                .expect("a candidate");
            let valid =
                cx.b.build_select(any, code, i64t.const_zero(), "ev_code")
                    .unwrap()
                    .into_int_value();
            (cands[0].0, row, valid, count, slot)
        } else {
            let Some(el) = crate::arrays::resolve_event_element(cx, expr)? else {
                return Ok(());
            };
            let cell = crate::arrays::load_event_elem(cx, &el)?;
            let count = cx.b.build_int_truncate(cell, i64t, "ev_count").unwrap();
            let valid = cx.b.build_int_z_extend(el.valid, i64t, "ev_valid").unwrap();
            let slot = match el.slot {
                Some(s) => cx.b.build_int_z_extend(s, i64t, "ev_slot64").unwrap(),
                None => i64t.const_int(u64::from(el.info.slot), false),
            };
            (el, el.row, valid, count, slot)
        };
    let acc = cx.mem_accessor.ok_or_else(|| {
        LoweringError::unsupported_at("event element wait with no accessor context", &cx.fn_sym)
    })?;
    let handle =
        cx.b.build_ptr_to_int(acc.handle, i64t, "ev_handle")
            .unwrap();
    let _ = el;
    let buf = crate::types::entry_alloca_in(&cx.b, i64t.array_type(5), "ev_snap");
    for (i, v) in [row, valid, count, slot, handle].into_iter().enumerate() {
        // SAFETY: `i` is within the 5-element array allocated above.
        let p = unsafe {
            cx.b.build_in_bounds_gep(
                i64t,
                buf,
                &[i64t.const_int(i as u64, false)],
                "ev_snap_field",
            )
            .unwrap()
        };
        cx.b.build_store(p, v).unwrap();
    }
    edge_snapshot_call(cx, local, site, buf, EVENT_ELEM_STORE_BYTES);
    Ok(())
}

/// The snapshot site of term `index` of the suspend resuming at `resume`.
fn local_event_site(resume: u32, index: usize) -> u64 {
    (u64::from(resume) << 16) | index as u64
}

fn edge_snapshot_call<'ctx>(
    cx: &LowerCtx<'ctx, '_, '_>,
    local: PointerValue<'ctx>,
    site: u64,
    value: PointerValue<'ctx>,
    bytes: u32,
) {
    let i64t = cx.ctx.i64_type();
    let ptr_ty = cx.ctx.ptr_type(AddressSpace::default());
    let f = cx
        .module
        .get_function(SV_RT_EDGE_SNAPSHOT_SYMBOL)
        .unwrap_or_else(|| {
            cx.module.add_function(
                SV_RT_EDGE_SNAPSHOT_SYMBOL,
                cx.ctx.void_type().fn_type(
                    &[i64t.into(), i64t.into(), ptr_ty.into(), i64t.into()],
                    false,
                ),
                Some(Linkage::External),
            )
        });
    let frame = cx.b.build_ptr_to_int(local, i64t, "frame_id").unwrap();
    cx.b.build_call(
        f,
        &[
            frame.into(),
            i64t.const_int(site, false).into(),
            value.into(),
            i64t.const_int(u64::from(bytes), false).into(),
        ],
        "edge_snapshot",
    )
    .unwrap();
}

/// The resume guard of a suspend whose event control names variables
/// shared between processes: `fn(handle, frame) -> i8`, true when the wake
/// came from one of its signal terms, or when a shared term's own event
/// (any change, or an edge of its least significant bit) happened since
/// the suspend -- and its `iff` holds. Every shared term's snapshot moves
/// to the current value.
#[allow(clippy::too_many_arguments)]
fn local_event_guard<'ctx, 'd>(
    ctx: &'ctx Context,
    module: &Module<'ctx>,
    fns: &AccessorFns<'ctx>,
    plan: &ProcessLoweringPlan<'d>,
    signals: &HashMap<SymbolId, SignalSlot>,
    point: &SuspendPoint<'d>,
    resume: u32,
    fn_name: &str,
    value_repr: ValueRepr,
    this: Option<Symbol<'d>>,
) -> Result<FunctionValue<'ctx>, LoweringError> {
    let i64t = ctx.i64_type();
    let i32t = ctx.i32_type();
    let ptr_ty = ctx.ptr_type(AddressSpace::default());
    let f = module.add_function(
        fn_name,
        ctx.i8_type()
            .fn_type(&[ptr_ty.into(), ptr_ty.into()], false),
        None,
    );
    let handle = f.get_nth_param(0).unwrap().into_pointer_value();
    let local = f.get_nth_param(1).unwrap().into_pointer_value();
    // The element terms read their cells through the memory accessor.
    let cx = LowerCtx {
        ctx,
        b: ctx.create_builder(),
        repr: value_repr,
        locals: HashMap::new(),
        fn_sym: plan.fn_sym,
        module,
        mem_signals: mem_signals_of(signals),
        mem_accessor: Some(MemAccessorCtx { handle, fns }),
        lvalue_ref: Default::default(),
        deferred_start: Default::default(),
        unbounded: Default::default(),
        coll_temp: Default::default(),
        iter: Default::default(),
        loop_exits: Default::default(),
        block_exits: Default::default(),
        write_through: None,
        cells: Default::default(),
        copy_out: Default::default(),
        ctor_this: Default::default(),
        decl_scale: Default::default(),
        inline_this: Default::default(),
        end_flags: Default::default(),
        specify_dest: Default::default(),
        elem_refs: Default::default(),
    };
    let b = &cx.b;
    b.position_at_end(ctx.append_basic_block(f, "entry"));
    let terms = local_event_terms(point, signals);
    let elem_terms = event_elem_terms(point, signals);
    let expr_terms = expr_event_terms(point, signals);
    let total = match point {
        SuspendPoint::EdgeList(entries, ..) => entries.len(),
        _ => 1,
    };
    // Woken by a signal term: the scheduler already matched its event.
    let fired_fn = module
        .get_function(SV_RT_FIRED_TERM_SYMBOL)
        .unwrap_or_else(|| {
            module.add_function(SV_RT_FIRED_TERM_SYMBOL, i64t.fn_type(&[], false), None)
        });
    let fired = b
        .build_call(fired_fn, &[], "fired")
        .unwrap()
        .try_as_basic_value()
        .unwrap_basic()
        .into_int_value();
    let mut by_signal = ctx.bool_type().const_zero();
    for k in 0..total {
        if terms.iter().any(|t| t.index == k)
            || elem_terms.iter().any(|t| t.index == k)
            || expr_terms.iter().any(|t| t.index == k)
        {
            continue;
        }
        let hit = b
            .build_int_compare(
                inkwell::IntPredicate::EQ,
                fired,
                i64t.const_int(k as u64, false),
                "by_signal",
            )
            .unwrap();
        by_signal = b.build_or(by_signal, hit, "by_signal_any").unwrap();
    }
    let check_fn = module
        .get_function(SV_RT_EDGE_CHECK_SYMBOL)
        .unwrap_or_else(|| {
            module.add_function(
                SV_RT_EDGE_CHECK_SYMBOL,
                i32t.fn_type(
                    &[
                        i64t.into(),
                        i64t.into(),
                        ptr_ty.into(),
                        i64t.into(),
                        i32t.into(),
                        i32t.into(),
                    ],
                    false,
                ),
                Some(Linkage::External),
            )
        });
    let frame_id = b.build_ptr_to_int(local, i64t, "frame_id").unwrap();
    let mut any = ctx.bool_type().const_zero();
    for t in &terms {
        let Some((idx, slot)) = plan.frame.slots.iter().enumerate().find(|(_, s)| {
            s.cell && matches!(&s.source, FrameSlotSource::DeclaredVar(id) if *id == t.var.uid())
        }) else {
            // Not shared with any other process: it cannot change while
            // this process waits.
            continue;
        };
        let _ = idx;
        let (shadow, _, bytes) = open_cell(ctx, module, b, local, slot);
        let edge_code = edge_code_of(t.edge);
        let r = b
            .build_call(
                check_fn,
                &[
                    frame_id.into(),
                    i64t.const_int(local_event_site(resume, t.index), false)
                        .into(),
                    shadow.into(),
                    i64t.const_int(u64::from(bytes), false).into(),
                    i32t.const_int(u64::from(slot.width_bits), false).into(),
                    i32t.const_int(edge_code, false).into(),
                ],
                "edge_check",
            )
            .unwrap()
            .try_as_basic_value()
            .unwrap_basic()
            .into_int_value();
        let ok = b
            .build_int_compare(inkwell::IntPredicate::NE, r, i32t.const_zero(), "edge_hit")
            .unwrap();
        any = b.build_or(any, ok, "edge_any").unwrap();
    }
    // Expression terms: the expression's value now, against the one recorded
    // when the wait began (the check moves the record to it), with the
    // term's edge of its least significant bit if it has one.
    let mut expr_hits = Vec::new();
    for t in &expr_terms {
        let (value_fn, width) = compile_event_value(
            ctx,
            module,
            fns,
            signals,
            &plan.fn_sym,
            &format!("{fn_name}_value{}", t.index),
            t.expr,
            value_repr,
            (&plan.frame, &plan.frame_signed),
            this,
        )?;
        let words = event_value_words(width);
        let buf = crate::types::entry_alloca_in(b, i64t.array_type(words), "ev_value");
        b.build_call(
            value_fn,
            &[handle.into(), local.into(), buf.into()],
            "ev_eval",
        )
        .unwrap();
        let r = b
            .build_call(
                check_fn,
                &[
                    frame_id.into(),
                    i64t.const_int(local_event_site(resume, t.index), false)
                        .into(),
                    buf.into(),
                    i64t.const_int(u64::from(words) * 8, false).into(),
                    i32t.const_int(u64::from(width), false).into(),
                    i32t.const_int(edge_code_of(t.edge), false).into(),
                ],
                "ev_value_check",
            )
            .unwrap()
            .try_as_basic_value()
            .unwrap_basic()
            .into_int_value();
        let hit = b
            .build_int_compare(
                inkwell::IntPredicate::NE,
                r,
                i32t.const_zero(),
                "ev_value_hit",
            )
            .unwrap();
        expr_hits.push((t.index, hit));
        any = b.build_or(any, hit, "edge_any_expr").unwrap();
    }
    // Element terms: this element's trigger count moved since the wait began.
    // The scheduler wakes every one of them on the array's single cell and
    // names the first; the term reported to the kernel (`wait_order`) becomes
    // the first one whose element did trigger, unless a signal term fired.
    if !elem_terms.is_empty() || !expr_terms.is_empty() {
        let load_fn = module
            .get_function(SV_RT_EDGE_LOAD_SYMBOL)
            .unwrap_or_else(|| {
                module.add_function(
                    SV_RT_EDGE_LOAD_SYMBOL,
                    ctx.void_type().fn_type(
                        &[i64t.into(), i64t.into(), ptr_ty.into(), i64t.into()],
                        false,
                    ),
                    Some(Linkage::External),
                )
            });
        let mut hits = Vec::new();
        for t in &elem_terms {
            // Group mode also reads the slot word (the 4th).
            let words: u32 = if crate::events::group(&cx)?.is_some() {
                4
            } else {
                3
            };
            let buf = crate::types::entry_alloca_in(b, i64t.array_type(words), "ev_snap");
            b.build_call(
                load_fn,
                &[
                    frame_id.into(),
                    i64t.const_int(event_elem_site(resume, t.index), false)
                        .into(),
                    buf.into(),
                    i64t.const_int(
                        if words == 4 {
                            u64::from(EVENT_ELEM_SNAPSHOT_BYTES) + 8
                        } else {
                            u64::from(EVENT_ELEM_SNAPSHOT_BYTES)
                        },
                        false,
                    )
                    .into(),
                ],
                "ev_load",
            )
            .unwrap();
            let field = |i: u64, name: &str| {
                // SAFETY: `i` is within the 3-element array loaded above.
                let p = unsafe {
                    b.build_in_bounds_gep(i64t, buf, &[i64t.const_int(i, false)], name)
                        .unwrap()
                };
                b.build_load(i64t, p, name).unwrap().into_int_value()
            };
            let row = field(0, "ev_row");
            let was_valid = b
                .build_int_compare(
                    inkwell::IntPredicate::NE,
                    field(1, "ev_valid"),
                    i64t.const_zero(),
                    "ev_was_valid",
                )
                .unwrap();
            let before = field(2, "ev_before");
            let elem_info = |array: &SignalSlot| MemorySignalInfo {
                slot: array.slot,
                elem_width: array.width,
                signed: false,
                num_rows: 0,
                lower_index: 0,
            };
            let now = if let Some(root) = crate::vif::event_elem_root(&t.expr) {
                // `@(vif.ea[i])`: the snapshot's `valid` word is the code of
                // the candidate waited on; read that candidate's element.
                let code = field(1, "ev_code");
                let mut now = i64t.const_zero();
                for (k, cand) in vif_candidates(&root).iter().enumerate() {
                    let array = signals.get(&cand.uid()).ok_or_else(|| {
                        LoweringError::unsupported_at(
                            "a virtual interface event array this process cannot reach",
                            cand,
                        )
                    })?;
                    let el = crate::arrays::EventElem {
                        info: elem_info(array),
                        row,
                        valid: ctx.bool_type().const_all_ones(),
                        id: row,
                        slot: None,
                    };
                    let cell = crate::arrays::load_event_elem(&cx, &el)?;
                    let cnt = b.build_int_truncate(cell, i64t, "ev_now_k").unwrap();
                    let is_k = b
                        .build_int_compare(
                            inkwell::IntPredicate::EQ,
                            code,
                            i64t.const_int(k as u64 + 1, false),
                            "ev_is_cand",
                        )
                        .unwrap();
                    now = b
                        .build_select(is_k, cnt, now, "ev_now_pick")
                        .unwrap()
                        .into_int_value();
                }
                now
            } else {
                let array =
                    event_elem_signal(&t.expr, signals).expect("an element term has a slot");
                // Group mode: the pool the handle named when the wait began
                // is the snapshot's slot word.
                let dyn_slot = if crate::events::group(&cx)?.is_some() {
                    Some(
                        b.build_int_truncate(field(3, "ev_slot"), i32t, "ev_slot32")
                            .unwrap(),
                    )
                } else {
                    None
                };
                let el = crate::arrays::EventElem {
                    info: elem_info(array),
                    row,
                    valid: ctx.bool_type().const_all_ones(),
                    id: row,
                    slot: dyn_slot,
                };
                let cell = crate::arrays::load_event_elem(&cx, &el)?;
                b.build_int_truncate(cell, i64t, "ev_now").unwrap()
            };
            let moved = b
                .build_int_compare(inkwell::IntPredicate::NE, now, before, "ev_moved")
                .unwrap();
            let hit = b.build_and(moved, was_valid, "ev_hit").unwrap();
            hits.push((t.index, hit));
        }
        hits.extend(expr_hits.iter().copied());
        hits.sort_by_key(|(index, _)| *index);
        let mut term = fired;
        let mut any_elem = ctx.bool_type().const_zero();
        for (index, hit) in hits.iter().rev() {
            term = b
                .build_select(*hit, i64t.const_int(*index as u64, false), term, "ev_term")
                .unwrap()
                .into_int_value();
            any_elem = b.build_or(any_elem, *hit, "ev_any").unwrap();
        }
        // A genuine signal term wins; else the first element that triggered.
        let term = b
            .build_select(by_signal, fired, term, "ev_fired")
            .unwrap()
            .into_int_value();
        let set_fn = module
            .get_function(SV_RT_SET_FIRED_TERM_SYMBOL)
            .unwrap_or_else(|| {
                module.add_function(
                    SV_RT_SET_FIRED_TERM_SYMBOL,
                    ctx.void_type().fn_type(&[i64t.into()], false),
                    Some(Linkage::External),
                )
            });
        b.build_call(set_fn, &[term.into()], "ev_set_fired")
            .unwrap();
        any = b.build_or(any, any_elem, "edge_any_elem").unwrap();
    }
    let mut pass = b.build_or(by_signal, any, "pass").unwrap();
    // `iff` (LRM 1800-2023 9.4.2.3) gates the event, whichever term it came
    // from: the process continues only if the condition holds.
    if let SuspendPoint::Edge { iff: Some(iff), .. } = point {
        let g = compile_iff_guard_with_frame(
            ctx,
            module,
            fns,
            signals,
            &plan.fn_sym,
            &format!("{fn_name}_iff"),
            *iff,
            value_repr,
            Some((&plan.frame, &plan.frame_signed)),
            this,
        )?;
        let v = b
            .build_call(g, &[handle.into(), local.into()], "iff")
            .unwrap()
            .try_as_basic_value()
            .unwrap_basic()
            .into_int_value();
        let holds = b
            .build_int_compare(
                inkwell::IntPredicate::NE,
                v,
                ctx.i8_type().const_zero(),
                "iff_holds",
            )
            .unwrap();
        pass = b.build_and(pass, holds, "pass_and_iff").unwrap();
    }
    // A member's own `iff` (LRM 1800-2023 9.4.2.3, `@(posedge a iff c or b)`)
    // gates only that member's event: the wake passes if some member that
    // matched has no guard or a guard that holds now. Members can fire in one
    // wake and `sv_rt_fired_term` names only the first, so the guard reads the
    // set of all matched terms (`sv_rt_fired_mask`). Only a member the
    // scheduler itself matched (a plain signal) is in that set, so a guarded
    // local/element/expression member is refused.
    if let SuspendPoint::EdgeList(_, iffs) = point
        && iffs.iter().any(|g| !g.is_empty())
    {
        // A one-member list records no fired term at runtime: its one term.
        let mask = if iffs.len() == 1 {
            i64t.const_int(1, false)
        } else {
            let mask_fn = module
                .get_function(SV_RT_FIRED_MASK_SYMBOL)
                .unwrap_or_else(|| {
                    module.add_function(SV_RT_FIRED_MASK_SYMBOL, i64t.fn_type(&[], false), None)
                });
            b.build_call(mask_fn, &[], "fired_mask")
                .unwrap()
                .try_as_basic_value()
                .unwrap_basic()
                .into_int_value()
        };
        let mut bad = i64t.const_zero();
        for (k, guards) in iffs.iter().enumerate() {
            if guards.is_empty() {
                continue;
            }
            if k >= 64
                || terms.iter().any(|t| t.index == k)
                || elem_terms.iter().any(|t| t.index == k)
                || expr_terms.iter().any(|t| t.index == k)
            {
                return Err(LoweringError::unsupported_at(
                    "an `iff` guard on an event-list member that is a process-local variable,                      an event-array element or an expression, or beyond member 63                      (LRM 1800-2023 9.4.2.3)",
                    &plan.fn_sym,
                ));
            }
            // Every guard of the member must hold (a conjunction).
            let mut holds = ctx.bool_type().const_int(1, false);
            for (j, iff) in guards.iter().enumerate() {
                let g = compile_iff_guard_with_frame(
                    ctx,
                    module,
                    fns,
                    signals,
                    &plan.fn_sym,
                    &format!("{fn_name}_iff{k}_{j}"),
                    *iff,
                    value_repr,
                    Some((&plan.frame, &plan.frame_signed)),
                    this,
                )?;
                let v = b
                    .build_call(g, &[handle.into(), local.into()], "iff_k")
                    .unwrap()
                    .try_as_basic_value()
                    .unwrap_basic()
                    .into_int_value();
                let h = b
                    .build_int_compare(
                        inkwell::IntPredicate::NE,
                        v,
                        ctx.i8_type().const_zero(),
                        "iff_k_holds",
                    )
                    .unwrap();
                holds = b.build_and(holds, h, "iff_k_all").unwrap();
            }
            let bit = i64t.const_int(1u64 << k, false);
            let this_bad = b
                .build_select(holds, i64t.const_zero(), bit, "iff_k_bad")
                .unwrap()
                .into_int_value();
            bad = b.build_or(bad, this_bad, "iff_bad").unwrap();
        }
        let not_bad = b.build_not(bad, "iff_not_bad").unwrap();
        let good = b.build_and(mask, not_bad, "iff_good").unwrap();
        let nz = |v: inkwell::values::IntValue<'ctx>, name: &str| {
            b.build_int_compare(inkwell::IntPredicate::NE, v, i64t.const_zero(), name)
                .unwrap()
        };
        // No matched term at all (an unknown wake) passes as before; a
        // local/element/expression hit is not gated by a signal member's iff.
        let any_good = nz(good, "iff_any_good");
        let has_mask = nz(mask, "iff_has_mask");
        let no_mask = b.build_not(has_mask, "iff_no_mask").unwrap();
        let ok0 = b.build_or(any_good, no_mask, "iff_ok0").unwrap();
        let ok = b.build_or(ok0, any, "iff_ok").unwrap();
        pass = b.build_and(pass, ok, "pass_and_iff_k").unwrap();
        // Report the first member whose event survives its guard when the
        // one `sv_rt_fired_term` named was blocked.
        if iffs.len() > 1 {
            let fired_cur = fired_now_value(b, fired_fn);
            let mut term = fired_cur;
            for k in (0..iffs.len().min(64)).rev() {
                let bit = i64t.const_int(1u64 << k, false);
                let masked = b.build_and(good, bit, "iff_bit").unwrap();
                let hit = nz(masked, "iff_bit_set");
                term = b
                    .build_select(hit, i64t.const_int(k as u64, false), term, "iff_term")
                    .unwrap()
                    .into_int_value();
            }
            let set_fn = module
                .get_function(SV_RT_SET_FIRED_TERM_SYMBOL)
                .unwrap_or_else(|| {
                    module.add_function(
                        SV_RT_SET_FIRED_TERM_SYMBOL,
                        ctx.void_type().fn_type(&[i64t.into()], false),
                        Some(Linkage::External),
                    )
                });
            b.build_call(set_fn, &[term.into()], "iff_set_fired")
                .unwrap();
        }
    }
    let r = b
        .build_int_z_extend(pass, ctx.i8_type(), "pass_i8")
        .unwrap();
    b.build_return(Some(&r)).unwrap();
    Ok(f)
}

#[cfg(test)]
mod tests {
    use super::*;
    use sv_lang::kinds::SymbolKind;

    /// Mutation-testing regression (2026-09-28): `lower_repeat_counter_init`
    /// (the suspend-capable, permanent-frame-slot repeat counter path a
    /// `repeat(N) #delay ...;` body needs) must clamp a negative SIGNED
    /// count to a 0-iteration counter (LRM 1800-2023 SS12.7.1), exactly
    /// mirroring `stmt_shared::lower_repeat_loop`'s own identical clamp for
    /// the non-suspending path -- this function's own doc comment says so
    /// explicitly ("Mirrors `stmt_shared::lower_repeat_loop`'s identical
    /// clamp"), but the two are two SEPARATE, independently-maintained
    /// implementations (`vj`'s own "duplicate pure-function eval
    /// diverges" lesson): a mutant dropping ONLY this copy's `is_neg` select
    /// (leaving `stmt_shared::lower_repeat_loop`'s copy untouched) survived
    /// the full test suite before this test was added, because no existing
    /// fixture drives a negative repeat count through the delay-suspending
    /// CFG shape. Proven directly at the codegen level (never by actually
    /// running a `repeat(-1) #1 ...;` design to completion under a broken
    /// clamp -- that reinterprets `-1i32` as `4294967295u32` iterations,
    /// which would hang rather than fail cleanly).
    #[test]
    fn lower_repeat_counter_init_clamps_a_negative_signed_count_to_zero() {
        let design = crate::frontend::compile_source(
            "module m; initial repeat (-1) $display(\"x\"); endmodule\n",
        )
        .unwrap();
        let body = design
            .top_instances()
            .next()
            .unwrap()
            .instance_body()
            .unwrap();
        let block = body
            .members()
            .find(|s| s.kind() == SymbolKind::ProceduralBlock)
            .unwrap();
        let root = block.body().unwrap();
        assert_eq!(
            root.kind(),
            StatementKind::RepeatLoop,
            "a bare `repeat (-1) stmt;` body with no begin/end must be a bare RepeatLoop \
             statement"
        );
        let count_expr = root
            .condition()
            .expect("RepeatLoop's count expression lives on its own `condition()` slot");

        let llvm_ctx = Context::create();
        let module = llvm_ctx.create_module("test_repeat_counter_init");
        let width = 32u32;
        let fn_ty = llvm_ctx.i32_type().fn_type(&[], false);
        let f = module.add_function("test_fn", fn_ty, None);
        let entry = llvm_ctx.append_basic_block(f, "entry");
        let b = llvm_ctx.create_builder();
        b.position_at_end(entry);

        // A hand-built permanent counter slot standing in for the real
        // per-template frame allocation `counter_locals` would supply --
        // same "isolate the codegen mechanism from the rest of the
        // pipeline" shape `event_trigger_flips_the_targets_low_bit` above
        // already uses. `i64` == `width * 2` (FourState's packed val+unk
        // convention for a 32-bit counter), matching what
        // `store_repeat_counter`/`load_repeat_counter` both assume.
        let counter_ptr = b.build_alloca(llvm_ctx.i64_type(), "counter").unwrap();

        let cx = LowerCtx {
            ctx: &llvm_ctx,
            b,
            repr: ValueRepr::FourState,
            locals: HashMap::new(),
            fn_sym: body,
            module: &module,
            mem_signals: std::collections::HashMap::new(),
            mem_accessor: None,
            lvalue_ref: Default::default(),
            deferred_start: Default::default(),
            unbounded: Default::default(),
            coll_temp: Default::default(),
            iter: Default::default(),
            loop_exits: Default::default(),
            block_exits: Default::default(),
            write_through: None,
            cells: Default::default(),
            copy_out: Default::default(),
            ctor_this: Default::default(),
            decl_scale: Default::default(),
            inline_this: Default::default(),
            end_flags: Default::default(),
            specify_dest: Default::default(),
            elem_refs: Default::default(),
        };

        lower_repeat_counter_init(&cx, count_expr, counter_ptr, width)
            .expect("a plain, integral repeat count must lower without error");

        let op = OpBuilder {
            ctx: cx.ctx,
            b: &cx.b,
        };
        let result = load_repeat_counter(&cx, &op, counter_ptr, width);
        cx.b.build_return(Some(&result)).unwrap();

        assert!(
            f.verify(true),
            "the emitted IR must pass LLVM's own verifier"
        );

        let jit = crate::jit::Jit::from_module(module).expect("JIT engine construction failed");
        let raw = jit
            .get_raw("test_fn")
            .expect("test_fn must be a real symbol in the JIT'd module");
        // SAFETY: `test_fn` was declared and defined above as a genuine
        // `extern "C" fn() -> i32` (no parameters, `i32` return type,
        // default/C calling convention) inside this same JIT'd module, and
        // `f.verify(true)` already confirmed the emitted IR is well-formed
        // before this call -- the transmute recovers exactly the signature
        // that was declared, the same pattern `jit::Jit::get_fn2_i32` itself
        // uses for its own two-argument case.
        let callable: extern "C" fn() -> i32 =
            unsafe { std::mem::transmute::<*const (), extern "C" fn() -> i32>(raw) };
        let stored = callable();
        assert_eq!(
            stored, 0,
            "repeat(-1) must clamp its negative signed count to a 0-iteration counter, never \
             the huge unsigned-reinterpreted wraparound value a missing clamp would store (LRM \
             1800-2023 SS12.7.1: a negative repeat count runs its body ZERO times)"
        );
    }

    /// Task 7 (AB-096/CG-082): `resolve_suspend_point`'s own
    /// `SuspendPoint::Level` arm's documented scope restriction --
    /// `wait(a && b)` (two distinct watched signals) must fail with a named
    /// `LoweringError` naming "multi-term `wait(expr)` guard," never a
    /// silently-wrong single-signal guess that would miss a real wake on
    /// whichever signal it dropped.
    #[test]
    fn wait_on_more_than_one_signal_is_a_named_error() {
        let design = crate::frontend::compile_source(
            "module m; logic a, b; initial wait (a && b) begin end endmodule\n",
        )
        .unwrap();
        let body = design
            .top_instances()
            .next()
            .unwrap()
            .instance_body()
            .unwrap();
        let block = body
            .members()
            .find(|s| s.kind() == SymbolKind::ProceduralBlock)
            .unwrap();
        let root = block.body().unwrap();
        let cfg =
            vj_sim::process::cfg::build_cfg(&root, vj_sim::process::cfg::ProcessLoopKind::OneShot)
                .unwrap();
        let level_point = cfg
            .blocks
            .iter()
            .find_map(|b| match &b.terminator {
                vj_sim::process::cfg::Terminator::Suspend {
                    point: point @ SuspendPoint::Level(_),
                    ..
                } => Some(point.clone()),
                _ => None,
            })
            .expect("wait(a && b) must build a SuspendPoint::Level suspend terminator");

        let signals: HashMap<SymbolId, SignalSlot> = HashMap::new();
        let err = resolve_suspend_point(&level_point, &signals, &body, 0)
            .expect_err("a multi-signal wait(expr) guard must be a named LoweringError");
        assert!(
            err.message.contains("more than one signal"),
            "expected a named error citing the multi-signal wait(expr) scope restriction, got: \
             {}",
            err.message
        );
    }

    /// CG-094/PR-016's `Effect` tag: an assignment statement is `StateWrite`,
    /// everything this task's own slice-scope grammar otherwise accepts
    /// (`Empty`, an unassigned `VariableDeclaration`) is `Pure`.
    #[test]
    fn effect_of_statement_tags_assignment_as_state_write_and_declaration_as_pure() {
        let design = crate::frontend::compile_source(
            "module m; initial begin int x; x = 5; end endmodule\n",
        )
        .unwrap();
        let body = design
            .top_instances()
            .next()
            .unwrap()
            .instance_body()
            .unwrap();
        let block = body
            .members()
            .find(|s| s.kind() == SymbolKind::ProceduralBlock)
            .unwrap();
        let root = block.body().unwrap();
        // `root` is `begin int x; x = 5; end` -- a `Block` statement whose
        // own `.statements()` yields one `List`-kind child wrapping the two
        // real leaf statements (verified against real sv-lang=0.1.9 output:
        // this is exactly why `process::cfg::CfgBuilder::walk_stmt` recurses
        // through `StatementKind::List` separately from `StatementKind::
        // Block`). Task S3a's real `build_cfg` already does this flattening
        // correctly; reuse it here rather than re-deriving a second,
        // possibly-divergent flatten just for this in-crate unit test.
        let cfg =
            vj_sim::process::cfg::build_cfg(&root, vj_sim::process::cfg::ProcessLoopKind::OneShot)
                .unwrap();
        let stmts = &cfg.blocks[0].stmts;
        assert_eq!(stmts.len(), 2, "expected VariableDeclaration + Assignment");
        assert_eq!(
            effect_of_statement(&stmts[0]),
            Effect::Pure,
            "an unassigned VariableDeclaration must be Pure"
        );
        assert_eq!(
            effect_of_statement(&stmts[1]),
            Effect::StateWrite,
            "x = 5 must be StateWrite"
        );
    }
}